Package google.cloud.gkehub.v1beta1

Index

GkeHubMembershipService

The GKE Hub MembershipService handles the registration of many Kubernetes clusters to Google Cloud, represented with the Membership resource.

GKE Hub is currently available in the global region and all regions in https://cloud.google.com/compute/docs/regions-zones. Feature is only available in global region while membership is global region and all the regions.

Membership management may be non-trivial: it is recommended to use one of the Google-provided client libraries or tools where possible when working with Membership resources.

CreateMembership

rpc CreateMembership(CreateMembershipRequest) returns (Operation)

Creates a new Membership.

This is currently only supported for GKE clusters on Google Cloud. To register other clusters, follow the instructions at https://cloud.google.com/kubernetes-engine/enterprise/multicluster-management/connect/registering-a-cluster.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.
DeleteMembership

rpc DeleteMembership(DeleteMembershipRequest) returns (Operation)

Removes a Membership.

This is currently only supported for GKE clusters on Google Cloud. To unregister other clusters, follow the instructions at https://cloud.google.com/kubernetes-engine/enterprise/multicluster-management/connect/unregistering-a-cluster.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.
GenerateConnectManifest

rpc GenerateConnectManifest(GenerateConnectManifestRequest) returns (GenerateConnectManifestResponse)

Generates the manifest for deployment of the GKE connect agent.

This method is used internally by Google-provided libraries. Most clients should not need to call this method directly.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.
GenerateExclusivityManifest

rpc GenerateExclusivityManifest(GenerateExclusivityManifestRequest) returns (GenerateExclusivityManifestResponse)

GenerateExclusivityManifest generates the manifests to update the exclusivity artifacts in the cluster if needed.

Exclusivity artifacts include the Membership custom resource definition (CRD) and the singleton Membership custom resource (CR). Combined with ValidateExclusivity, exclusivity artifacts guarantee that a Kubernetes cluster is only registered to a single GKE Hub.

The Membership CRD is versioned, and may require conversion when the GKE Hub API server begins serving a newer version of the CRD and corresponding CR. The response will be the converted CRD and CR if there are any differences between the versions.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.
GetMembership

rpc GetMembership(GetMembershipRequest) returns (Membership)

Gets the details of a Membership.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.
ListMemberships

rpc ListMemberships(ListMembershipsRequest) returns (ListMembershipsResponse)

Lists Memberships in a given project and location.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.
UpdateMembership

rpc UpdateMembership(UpdateMembershipRequest) returns (Operation)

Updates an existing Membership.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.
ValidateExclusivity

rpc ValidateExclusivity(ValidateExclusivityRequest) returns (ValidateExclusivityResponse)

ValidateExclusivity validates the state of exclusivity in the cluster. The validation does not depend on an existing Hub membership resource.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.

ApplianceCluster

ApplianceCluster contains information specific to GDC Edge Appliance Clusters.

Fields

Authority

Authority encodes how Google will recognize identities from this Membership. See the workload identity documentation for more details: https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity

Fields
issuer

string

Optional. A JSON Web Token (JWT) issuer URI. issuer must start with https:// and be a valid URL with length <2000 characters.

If set, then Google will allow valid OIDC tokens from this issuer to authenticate within the workload_identity_pool. OIDC discovery will be performed on this URI to validate tokens from the issuer.

Clearing issuer disables Workload Identity. issuer cannot be directly modified; it must be cleared (and Workload Identity disabled) before using a new issuer (and re-enabling Workload Identity).
workload_identity_pool

string

Output only. The name of the workload identity pool in which issuer will be recognized.

There is a single Workload Identity Pool per Hub that is shared between all Memberships that belong to that Hub. For a Hub hosted in {PROJECT_ID}, the workload pool format is {PROJECT_ID}.hub.id.goog, although this is subject to change in newer versions of this API.
identity_provider

string

Output only. An identity provider that reflects the issuer in the workload identity pool.
oidc_jwks

bytes

Optional. OIDC verification keys for this Membership in JWKS format (RFC 7517).

When this field is set, OIDC discovery will NOT be performed on issuer, and instead OIDC tokens will be validated using this field.

ConnectAgent

The information required from end users to use GKE Connect.

Fields
name
(deprecated)

string

Do not set.
proxy

bytes

Optional. URI of a proxy if connectivity from the agent to gkeconnect.googleapis.com requires the use of a proxy. Format must be in the form http(s)://{proxy_address}, depending on the HTTP/HTTPS protocol supported by the proxy. This will direct the connect agent's outbound traffic through a HTTP(S) proxy.
namespace

string

Optional. Namespace for GKE Connect agent resources. Defaults to gke-connect.

The Connect Agent is authorized automatically when run in the default namespace. Otherwise, explicit authorization must be granted with an additional IAM binding.

ConnectAgentResource

ConnectAgentResource represents a Kubernetes resource manifest for Connect Agent deployment.

Fields
type

TypeMeta

Kubernetes type of the resource.
manifest

string

YAML manifest of the resource.

CreateMembershipRequest

Request message for the GkeHubMembershipService.CreateMembership method.

Fields
parent

string

Required. The parent (project and location) where the Memberships will be created. Specified in the format projects/*/locations/*.

Authorization requires the following IAM permission on the specified resource parent:

  • gkehub.memberships.create
membership_id

string

Required. Client chosen ID for the membership. membership_id must be a valid RFC 1123 compliant DNS label:

  1. At most 63 characters in length
  2. It must consist of lower case alphanumeric characters or -
  3. It must start and end with an alphanumeric character

Which can be expressed as the regex: [a-z0-9]([-a-z0-9]*[a-z0-9])?, with a maximum length of 63 characters.
resource

Membership

Required. The membership to create.
request_id

string

Optional. A request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes after the first request.

For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments.

The request ID must be a valid UUID with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).

DeleteMembershipRequest

Request message for GkeHubMembershipService.DeleteMembership method.

Fields
name

string

Required. The Membership resource name in the format projects/*/locations/*/memberships/*.

Authorization requires the following IAM permission on the specified resource name:

  • gkehub.memberships.delete
request_id

string

Optional. A request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes after the first request.

For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments.

The request ID must be a valid UUID with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).
force

bool

Optional. If set to true, any subresource from this Membership will also be deleted. Otherwise, the request will only work if the Membership has no subresource.

EdgeCluster

EdgeCluster contains information specific to Google Edge Clusters.

Fields

GenerateConnectManifestRequest

Request message for GkeHubMembershipService.GenerateConnectManifest method.

Fields
name

string

Required. The Membership resource name the Agent will associate with, in the format projects/*/locations/*/memberships/*.

Authorization requires the following IAM permission on the specified resource name:

  • gkehub.memberships.generateConnectManifest
connect_agent

ConnectAgent

Optional. The connect agent to generate manifest for.
version

string

Optional. The Connect agent version to use. Defaults to the most current version.
is_upgrade

bool

Optional. If true, generate the resources for upgrade only. Some resources generated only for installation (e.g. secrets) will be excluded.
registry

string

Optional. The registry to fetch the connect agent image from. Defaults to gcr.io/gkeconnect.
image_pull_secret_content

bytes

Optional. The image pull secret content for the registry, if not public.

GenerateConnectManifestResponse

GenerateConnectManifestResponse contains manifest information for installing/upgrading a Connect agent.

Fields
manifest[]

ConnectAgentResource

The ordered list of Kubernetes resources that need to be applied to the cluster for GKE Connect agent installation/upgrade.

GenerateExclusivityManifestRequest

The request to generate the manifests for exclusivity artifacts.

Fields
name

string

Required. The Membership resource name in the format projects/*/locations/*/memberships/*.

Authorization requires the following IAM permission on the specified resource name:

  • gkehub.memberships.generateConnectManifest
crd_manifest

string

Optional. The YAML manifest of the membership CRD retrieved by kubectl get customresourcedefinitions membership. Leave empty if the resource does not exist.
cr_manifest

string

Optional. The YAML manifest of the membership CR retrieved by kubectl get memberships membership. Leave empty if the resource does not exist.

GenerateExclusivityManifestResponse

The response of the exclusivity artifacts manifests for the client to apply.

Fields
crd_manifest

string

The YAML manifest of the membership CRD to apply if a newer version of the CRD is available. Empty if no update needs to be applied.
cr_manifest

string

The YAML manifest of the membership CR to apply if a new version of the CR is available. Empty if no update needs to be applied.

GetMembershipRequest

Request message for GkeHubMembershipService.GetMembership method.

Fields
name

string

Required. The Membership resource name in the format projects/*/locations/*/memberships/*.

Authorization requires the following IAM permission on the specified resource name:

  • gkehub.memberships.get

GkeCluster

GkeCluster contains information specific to GKE clusters.

Fields
cluster_missing

bool

Output only. If cluster_missing is set then it denotes that the GKE cluster no longer exists in the GKE Control Plane.

KubernetesMetadata

KubernetesMetadata provides informational metadata for Memberships representing Kubernetes clusters.

Fields
kubernetes_api_server_version

string

Output only. Kubernetes API server version string as reported by '/version'.
node_provider_id

string

Output only. Node providerID as reported by the first node in the list of nodes on the Kubernetes endpoint. On Kubernetes platforms that support zero-node clusters (like GKE-on-GCP), the node_count will be zero and the node_provider_id will be empty.
node_count

int32

Output only. Node count as reported by Kubernetes nodes resources.
vcpu_count

int32

Output only. vCPU count as reported by Kubernetes nodes resources.
memory_mb

int32

Output only. The total memory capacity as reported by the sum of all Kubernetes nodes resources, defined in MB.
update_time

Timestamp

Output only. The time at which these details were last updated. This update_time is different from the Membership-level update_time since EndpointDetails are updated internally for API consumers.

KubernetesResource

KubernetesResource contains the YAML manifests and configuration for Membership Kubernetes resources in the cluster. After CreateMembership or UpdateMembership, these resources should be re-applied in the cluster.

Fields
membership_cr_manifest

string

Input only. The YAML representation of the Membership CR. This field is ignored for GKE clusters where Hub can read the CR directly.

Callers should provide the CR that is currently present in the cluster during CreateMembership or UpdateMembership, or leave this field empty if none exists. The CR manifest is used to validate the cluster has not been registered with another Membership.
membership_resources[]

ResourceManifest

Output only. Additional Kubernetes resources that need to be applied to the cluster after Membership creation, and after every update.

This field is only populated in the Membership returned from a successful long-running operation from CreateMembership or UpdateMembership. It is not populated during normal GetMembership or ListMemberships requests. To get the resource manifest after the initial registration, the caller should make a UpdateMembership call with an empty field mask.
connect_resources[]

ResourceManifest

Output only. The Kubernetes resources for installing the GKE Connect agent

This field is only populated in the Membership returned from a successful long-running operation from CreateMembership or UpdateMembership. It is not populated during normal GetMembership or ListMemberships requests. To get the resource manifest after the initial registration, the caller should make a UpdateMembership call with an empty field mask.
resource_options

ResourceOptions

Optional. Options for Kubernetes resource generation.

ListMembershipsRequest

Request message for GkeHubMembershipService.ListMemberships method.

Fields
parent

string

Required. The parent (project and location) where the Memberships will be listed. Specified in the format projects/*/locations/*. projects/*/locations/- list memberships in all the regions.

Authorization requires the following IAM permission on the specified resource parent:

  • gkehub.memberships.list
page_size

int32

Optional. When requesting a 'page' of resources, page_size specifies number of resources to return. If unspecified or set to 0, all resources will be returned.
page_token

string

Optional. Token returned by previous call to ListMemberships which specifies the position in the list from where to continue listing the resources.
filter

string

Optional. Lists Memberships that match the filter expression, following the syntax outlined in https://google.aip.dev/160.

Examples:

  • Name is bar in project foo-proj and location global:
  name = "projects/foo-proj/locations/global/membership/bar"
  • Memberships that have a label called foo:
  labels.foo:*
  • Memberships that have a label called foo whose value is bar:
  labels.foo = bar
  • Memberships in the CREATING state:
  state = CREATING
order_by

string

Optional. One or more fields to compare and use to sort the output. See https://google.aip.dev/132#ordering.

ListMembershipsResponse

Response message for the GkeHubMembershipService.ListMemberships method.

Fields
resources[]

Membership

The list of matching Memberships.
next_page_token

string

A token to request the next page of resources from the ListMemberships method. The value of an empty string means that there are no more resources to return.
unreachable[]

string

List of locations that could not be reached while fetching this list.

Membership

Membership contains information about a member cluster.

Fields
name

string

Output only. The full, unique name of this Membership resource in the format projects/*/locations/*/memberships/{membership_id}, set during creation.

membership_id must be a valid RFC 1123 compliant DNS label:

  1. At most 63 characters in length
  2. It must consist of lower case alphanumeric characters or -
  3. It must start and end with an alphanumeric character

Which can be expressed as the regex: [a-z0-9]([-a-z0-9]*[a-z0-9])?, with a maximum length of 63 characters.
labels

map<string, string>

Optional. GCP labels for this membership.
description

string

Optional. Description of this membership, limited to 63 characters. Must match the regex: [a-zA-Z0-9][a-zA-Z0-9_\-\.\ ]*
state

MembershipState

Output only. State of the Membership resource.
authority

Authority

Optional. How to identify workloads from this Membership. See the documentation on Workload Identity for more details: https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity
create_time

Timestamp

Output only. When the Membership was created.
update_time

Timestamp

Output only. When the Membership was last updated.
delete_time

Timestamp

Output only. When the Membership was deleted.
external_id

string

Optional. An externally-generated and managed ID for this Membership. This ID may be modified after creation, but this is not recommended. For GKE clusters, external_id is managed by the Hub API and updates will be ignored.

The ID must match the regex: [a-zA-Z0-9][a-zA-Z0-9_\-\.]*

If this Membership represents a Kubernetes cluster, this value should be set to the UID of the kube-system namespace object.
last_connection_time

Timestamp

Output only. For clusters using Connect, the timestamp of the most recent connection established with Google Cloud. This time is updated every several minutes, not continuously. For clusters that do not use GKE Connect, or that have never connected successfully, this field will be unset.
unique_id

string

Output only. Google-generated UUID for this resource. This is unique across all Membership resources. If a Membership resource is deleted and another resource with the same name is created, it gets a different unique_id.
infrastructure_type

Membership.InfrastructureType

Optional. The infrastructure type this Membership is running on.
monitoring_config

MonitoringConfig

Optional. The monitoring config information for this membership.
Union field type. Type of resource represented by this Membership type can be only one of the following:
endpoint

MembershipEndpoint

Optional. Endpoint information to reach this member.

InfrastructureType

Specifies the infrastructure type of a Membership. Infrastructure type is used by Hub to control infrastructure-specific behavior, including pricing.

Each GKE distribution (on-GCP, on-Prem, on-X,...) will set this field automatically, but Attached Clusters customers should specify a type during registration.

Enums
INFRASTRUCTURE_TYPE_UNSPECIFIED No type was specified. Some Hub functionality may require a type be specified, and will not support Memberships with this value.
ON_PREM Private infrastructure that is owned or operated by customer. This includes GKE distributions such as GKE-OnPrem and GKE-OnBareMetal.
MULTI_CLOUD Public cloud infrastructure.

MembershipEndpoint

MembershipEndpoint contains information needed to contact a Kubernetes API, endpoint and any additional Kubernetes metadata.

Fields
kubernetes_metadata

KubernetesMetadata

Output only. Useful Kubernetes-specific metadata.
kubernetes_resource

KubernetesResource

Optional. The in-cluster Kubernetes Resources that should be applied for a correctly registered cluster, in the steady state. These resources:

  • Ensure that the cluster is exclusively registered to one and only one Hub Membership.
  • Propagate Workload Pool Information available in the Membership Authority field.
  • Ensure proper initial configuration of default Hub Features.
Union field type. Cluster information of the registered cluster. type can be only one of the following:
gke_cluster

GkeCluster

Optional. Specific information for a GKE-on-GCP cluster.
on_prem_cluster

OnPremCluster

Optional. Specific information for a GKE On-Prem cluster. An onprem user-cluster who has no resourceLink is not allowed to use this field, it should have a nil "type" instead.
multi_cloud_cluster

MultiCloudCluster

Optional. Specific information for a GKE Multi-Cloud cluster.
edge_cluster

EdgeCluster

Optional. Specific information for a Google Edge cluster.
appliance_cluster

ApplianceCluster

Optional. Specific information for a GDC Edge Appliance cluster.

MembershipState

State of the Membership resource.

Fields
code

MembershipState.Code

Output only. The current state of the Membership resource.
description
(deprecated)

string

This field is never set by the Hub Service.
update_time
(deprecated)

Timestamp

This field is never set by the Hub Service.

Code

Code describes the state of a Membership resource.

Enums
CODE_UNSPECIFIED The code is not set.
CREATING The cluster is being registered.
READY The cluster is registered.
DELETING The cluster is being unregistered.
UPDATING The Membership is being updated.
SERVICE_UPDATING The Membership is being updated by the Hub Service.

MonitoringConfig

MonitoringConfig informs Fleet-based applications/services/UIs how the metrics for the underlying cluster is reported to cloud monitoring services. It can be set from empty to non-empty, but can't be mutated directly to prevent accidentally breaking the constinousty of metrics.

Fields
project_id

string

Optional. Project used to report Metrics
location

string

Optional. Location used to report Metrics
cluster

string

Optional. Cluster name used to report metrics. For Anthos on VMWare/Baremetal/MultiCloud clusters, it would be in format {cluster_type}/{cluster_name}, e.g., "awsClusters/cluster_1".
kubernetes_metrics_prefix

string

Optional. Kubernetes system metrics, if available, are written to this prefix. This defaults to kubernetes.io for GKE, and kubernetes.io/anthos for Anthos eventually. Noted: Anthos MultiCloud will have kubernetes.io prefix today but will migration to be under kubernetes.io/anthos.
cluster_hash

string

Optional. For GKE and Multicloud clusters, this is the UUID of the cluster resource. For VMWare and Baremetal clusters, this is the kube-system UID.

MultiCloudCluster

MultiCloudCluster contains information specific to GKE Multi-Cloud clusters.

Fields
cluster_missing

bool

Output only. If cluster_missing is set then it denotes that API(gkemulticloud.googleapis.com) resource for this GKE Multi-Cloud cluster no longer exists.

OnPremCluster

OnPremCluster contains information specific to GKE On-Prem clusters.

Fields
cluster_missing

bool

Output only. If cluster_missing is set then it denotes that API(gkeonprem.googleapis.com) resource for this GKE On-Prem cluster no longer exists.
admin_cluster

bool

Immutable. Whether the cluster is an admin cluster.
cluster_type

OnPremCluster.ClusterType

Immutable. The on prem cluster's type.

ClusterType

ClusterType describes on prem cluster's type.

Enums
CLUSTERTYPE_UNSPECIFIED The ClusterType is not set.
BOOTSTRAP The ClusterType is bootstrap cluster.
HYBRID The ClusterType is baremetal hybrid cluster.
STANDALONE The ClusterType is baremetal standalone cluster.
USER The ClusterType is user cluster.

OperationMetadata

Represents the metadata of the long-running operation.

Fields
create_time

Timestamp

Output only. The time the operation was created.
end_time

Timestamp

Output only. The time the operation finished running.
target

string

Output only. Server-defined resource path for the target of the operation.
verb

string

Output only. Name of the verb executed by the operation.
status_detail

string

Output only. Human-readable status of the operation, if any.
cancel_requested

bool

Output only. Identifies whether the user has requested cancellation of the operation. Operations that have successfully been cancelled have [Operation.error][] value with a google.rpc.Status.code of 1, corresponding to Code.CANCELLED.
api_version

string

Output only. API version used to start the operation.

ResourceManifest

ResourceManifest represents a single Kubernetes resource to be applied to the cluster.

Fields
manifest

string

YAML manifest of the resource.
cluster_scoped

bool

Whether the resource provided in the manifest is cluster_scoped. If unset, the manifest is assumed to be namespace scoped.

This field is used for REST mapping when applying the resource in a cluster.

ResourceOptions

ResourceOptions represent options for Kubernetes resource generation.

Fields
connect_version

string

Optional. The Connect agent version to use for connect_resources. Defaults to the latest GKE Connect version. The version must be a currently supported version, obsolete versions will be rejected.
v1beta1_crd

bool

Optional. Use apiextensions/v1beta1 instead of apiextensions/v1 for CustomResourceDefinition resources. This option should be set for clusters with Kubernetes apiserver versions <1.16.
k8s_version

string

Optional. Major version of the Kubernetes cluster. This is only used to determine which version to use for the CustomResourceDefinition resources, apiextensions/v1beta1 orapiextensions/v1.

TypeMeta

TypeMeta is the type information needed for content unmarshalling of Kubernetes resources in the manifest.

Fields
kind

string

Kind of the resource (e.g. Deployment).
api_version

string

APIVersion of the resource (e.g. v1).

UpdateMembershipRequest

Request message for GkeHubMembershipService.UpdateMembership method.

Fields
name

string

Required. The membership resource name in the format: projects/[project_id]/locations/global/memberships/[membership_id]

Authorization requires the following IAM permission on the specified resource name:

  • gkehub.memberships.update
update_mask

FieldMask

Required. Mask of fields to update. At least one field path must be specified in this mask.
resource

Membership

Required. Only fields specified in update_mask are updated. If you specify a field in the update_mask but don't specify its value here that field will be deleted. If you are updating a map field, set the value of a key to null or empty string to delete the key from the map. It's not possible to update a key's value to the empty string. If you specify the update_mask to be a special path "*", fully replaces all user-modifiable fields to match resource.
request_id

string

Optional. A request ID to identify requests. Specify a unique request ID so that if you must retry your request, the server will know to ignore the request if it has already been completed. The server will guarantee that for at least 60 minutes after the first request.

For example, consider a situation where you make an initial request and the request times out. If you make the request again with the same request ID, the server can check if original operation with the same request ID was received, and if so, will ignore the second request. This prevents clients from accidentally creating duplicate commitments.

The request ID must be a valid UUID with the exception that zero UUID is not supported (00000000-0000-0000-0000-000000000000).

ValidateExclusivityRequest

The request to validate the existing state of the membership CR in the cluster.

Fields
parent

string

Required. The parent (project and location) where the Memberships will be created. Specified in the format projects/*/locations/*.

Authorization requires the following IAM permission on the specified resource parent:

  • gkehub.memberships.generateConnectManifest
cr_manifest

string

Optional. The YAML of the membership CR in the cluster. Empty if the membership CR does not exist.
intended_membership

string

Required. The intended membership name under the parent. This method only does validation in anticipation of a CreateMembership call with the same name.

ValidateExclusivityResponse

The response of exclusivity artifacts validation result status.

Fields
status

Status

The validation result.

  • OK means that exclusivity is validated, assuming the manifest produced by GenerateExclusivityManifest is successfully applied.
  • ALREADY_EXISTS means that the Membership CRD is already owned by another Hub. See status.message for more information.