Package google.cloud.gkehub.v1alpha2

Index

GkeHub

The GKE Hub service handles the registration of many Kubernetes clusters to Google Cloud, represented with the Membership resource.

GKE Hub is currently available in the global region and all regions in https://cloud.google.com/compute/docs/regions-zones. Feature is only available in global region while membership is global region and all the regions.

Membership management may be non-trivial: it is recommended to use one of the Google-provided client libraries or tools where possible when working with Membership resources.

CreateMembership

rpc CreateMembership(CreateMembershipRequest) returns (Operation)

Creates a new Membership.

This is currently only supported for GKE clusters on Google Cloud. To register other clusters, follow the instructions at https://cloud.google.com/kubernetes-engine/enterprise/multicluster-management/connect/registering-a-cluster.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.
DeleteMembership

rpc DeleteMembership(DeleteMembershipRequest) returns (Operation)

Removes a Membership.

This is currently only supported for GKE clusters on Google Cloud. To unregister other clusters, follow the instructions at https://cloud.google.com/kubernetes-engine/enterprise/multicluster-management/connect/unregistering-a-cluster.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.
GenerateConnectManifest

rpc GenerateConnectManifest(GenerateConnectManifestRequest) returns (GenerateConnectManifestResponse)

Generates the manifest for deployment of the GKE connect agent.

This method is used internally by Google-provided libraries. Most clients should not need to call this method directly.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.
GetMembership

rpc GetMembership(GetMembershipRequest) returns (Membership)

Gets the details of a Membership.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.
InitializeHub

rpc InitializeHub(InitializeHubRequest) returns (InitializeHubResponse)

Initializes the Hub in this project, which includes creating the default Hub Service Account and the Hub Workload Identity Pool. Initialization is optional, and happens automatically when the first Membership is created.

InitializeHub should be called when the first Membership cannot be registered without these resources. A common example is granting the Hub Service Account access to another project, which requires the account to exist first.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.
ListMemberships

rpc ListMemberships(ListMembershipsRequest) returns (ListMembershipsResponse)

Lists Memberships in a given project and location.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.
UpdateMembership

rpc UpdateMembership(UpdateMembershipRequest) returns (Operation)

Updates an existing Membership.

Authorization scopes

Requires the following OAuth scope:

  • https://www.googleapis.com/auth/cloud-platform

For more information, see the Authentication Overview.

ApplianceCluster

ApplianceCluster contains information specific to GDC Edge Appliance Clusters.

Fields

Authority

Authority encodes how Google will recognize identities from this Membership. See the workload identity documentation for more details: https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity

Fields
issuer

string

Optional. A JSON Web Token (JWT) issuer URI. issuer must start with https:// and be a valid URL with length <2000 characters.

If set, then Google will allow valid OIDC tokens from this issuer to authenticate within the workload_identity_pool. OIDC discovery will be performed on this URI to validate tokens from the issuer, unless oidc_jwks is set.

Clearing issuer disables Workload Identity. issuer cannot be directly modified; it must be cleared (and Workload Identity disabled) before using a new issuer (and re-enabling Workload Identity).
oidc_jwks

bytes

Optional. OIDC verification keys for this Membership in JWKS format (RFC 7517).

When this field is set, OIDC discovery will NOT be performed on issuer, and instead OIDC tokens will be validated using this field.
identity_provider

string

Output only. An identity provider that reflects the issuer in the workload identity pool.
workload_identity_pool

string

Output only. The name of the workload identity pool in which issuer will be recognized.

There is a single Workload Identity Pool per Hub that is shared between all Memberships that belong to that Hub. For a Hub hosted in {PROJECT_ID}, the workload pool format is {PROJECT_ID}.hub.id.goog, although this is subject to change in newer versions of this API.

ConnectAgentResource

ConnectAgentResource represents a Kubernetes resource manifest for Connect Agent deployment.

Fields
type

TypeMeta

Kubernetes type of the resource.
manifest

string

YAML manifest of the resource.

CreateMembershipRequest

Request message for the GkeHub.CreateMembership method.

Fields
parent

string

Required. The parent (project and location) where the Memberships will be created. Specified in the format projects/*/locations/*.

Authorization requires the following IAM permission on the specified resource parent:

  • gkehub.memberships.create
membership_id

string

Required. Client chosen ID for the membership. membership_id must be a valid RFC 1123 compliant DNS label:

  1. At most 63 characters in length
  2. It must consist of lower case alphanumeric characters or -
  3. It must start and end with an alphanumeric character

Which can be expressed as the regex: [a-z0-9]([-a-z0-9]*[a-z0-9])?, with a maximum length of 63 characters.
resource

Membership

Required. The membership to create.

DeleteMembershipRequest

Request message for GkeHub.DeleteMembership method.

Fields
name

string

Required. The Membership resource name in the format projects/*/locations/*/memberships/*.

Authorization requires the following IAM permission on the specified resource name:

  • gkehub.memberships.delete
force

bool

Optional. If set to true, any subresource from this Membership will also be deleted. Otherwise, the request will only work if the Membership has no subresource.

EdgeCluster

EdgeCluster contains information specific to Google Edge Clusters.

Fields

GenerateConnectManifestRequest

Request message for GkeHub.GenerateConnectManifest method. .

Fields
name

string

Required. The Membership resource name the Agent will associate with, in the format projects/*/locations/*/memberships/*.

Authorization requires the following IAM permission on the specified resource name:

  • gkehub.memberships.generateConnectManifest
namespace

string

Optional. Namespace for GKE Connect agent resources. Defaults to gke-connect.

The Connect Agent is authorized automatically when run in the default namespace. Otherwise, explicit authorization must be granted with an additional IAM binding.
proxy

bytes

Optional. URI of a proxy if connectivity from the agent to gkeconnect.googleapis.com requires the use of a proxy. Format must be in the form http(s)://{proxy_address}, depending on the HTTP/HTTPS protocol supported by the proxy. This will direct the connect agent's outbound traffic through a HTTP(S) proxy.
version

string

Optional. The Connect agent version to use. Defaults to the most current version.
is_upgrade

bool

Optional. If true, generate the resources for upgrade only. Some resources generated only for installation (e.g. secrets) will be excluded.
registry

string

Optional. The registry to fetch the connect agent image from. Defaults to gcr.io/gkeconnect.
image_pull_secret_content

bytes

Optional. The image pull secret content for the registry, if not public.

GenerateConnectManifestResponse

GenerateConnectManifestResponse contains manifest information for installing/upgrading a Connect agent.

Fields
manifest[]

ConnectAgentResource

The ordered list of Kubernetes resources that need to be applied to the cluster for GKE Connect agent installation/upgrade.

GetMembershipRequest

Request message for GkeHub.GetMembership method.

Fields
name

string

Required. The Membership resource name in the format projects/*/locations/*/memberships/*.

Authorization requires the following IAM permission on the specified resource name:

  • gkehub.memberships.get

GkeCluster

GkeCluster contains information specific to GKE clusters.

Fields
cluster_missing

bool

Output only. If cluster_missing is set then it denotes that the GKE cluster no longer exists in the GKE Control Plane.

InitializeHubRequest

Request message for the InitializeHub method.

Fields
project

string

Required. The Hub to initialize, in the format projects/*/locations/*/memberships/*.

InitializeHubResponse

Response message for the InitializeHub method.

Fields
service_identity

string

Name of the Hub default service identity, in the format:

service-<project-number>@gcp-sa-gkehub.iam.gserviceaccount.com

The service account has roles/gkehub.serviceAgent in the Hub project.
workload_identity_pool

string

The Workload Identity Pool used for Workload Identity-enabled clusters registered with this Hub. Format: <project-id>.hub.id.goog

KubernetesMetadata

KubernetesMetadata provides informational metadata for Memberships that are created from Kubernetes Endpoints (currently, these are equivalent to Kubernetes clusters).

Fields
kubernetes_api_server_version

string

Output only. Kubernetes API server version string as reported by '/version'.
node_provider_id

string

Output only. Node providerID as reported by the first node in the list of nodes on the Kubernetes endpoint. On Kubernetes platforms that support zero-node clusters (like GKE-on-GCP), the node_count will be zero and the node_provider_id will be empty.
node_count

int32

Output only. Node count as reported by Kubernetes nodes resources.
vcpu_count

int32

Output only. vCPU count as reported by Kubernetes nodes resources.
memory_mb

int32

Output only. The total memory capacity as reported by the sum of all Kubernetes nodes resources, defined in MB.
update_time

Timestamp

Output only. The time at which these details were last updated. This update_time is different from the Membership-level update_time since EndpointDetails are updated internally for API consumers.

KubernetesResource

KubernetesResource contains the YAML manifests and configuration for Membership Kubernetes resources in the cluster. After CreateMembership or UpdateMembership, these resources should be re-applied in the cluster.

Fields
membership_cr_manifest

string

Input only. The YAML representation of the Membership CR. This field is ignored for GKE clusters where Hub can read the CR directly.

Callers should provide the CR that is currently present in the cluster during Create or Update, or leave this field empty if none exists. The CR manifest is used to validate the cluster has not been registered with another Membership.
membership_resources[]

ResourceManifest

Output only. Additional Kubernetes resources that need to be applied to the cluster after Membership creation, and after every update.

This field is only populated in the Membership returned from a successful long-running operation from CreateMembership or UpdateMembership. It is not populated during normal GetMembership or ListMemberships requests. To get the resource manifest after the initial registration, the caller should make a UpdateMembership call with an empty field mask.
connect_resources[]

ResourceManifest

Output only. The Kubernetes resources for installing the GKE Connect agent.

This field is only populated in the Membership returned from a successful long-running operation from CreateMembership or UpdateMembership. It is not populated during normal GetMembership or ListMemberships requests. To get the resource manifest after the initial registration, the caller should make a UpdateMembership call with an empty field mask.
resource_options

ResourceOptions

Optional. Options for Kubernetes resource generation.

ListMembershipsRequest

Request message for GkeHub.ListMemberships method.

Fields
parent

string

Required. The parent (project and location) where the Memberships will be listed. Specified in the format projects/*/locations/*. projects/*/locations/- list memberships in all the regions.

Authorization requires the following IAM permission on the specified resource parent:

  • gkehub.memberships.list
page_size

int32

Optional. When requesting a 'page' of resources, page_size specifies number of resources to return. If unspecified or set to 0, all resources will be returned.
page_token

string

Optional. Token returned by previous call to ListMemberships which specifies the position in the list from where to continue listing the resources.
filter

string

Optional. Lists Memberships that match the filter expression, following the syntax outlined in https://google.aip.dev/160.

Examples:

  • Name is bar in project foo-proj and location global:
  name = "projects/foo-proj/locations/global/membership/bar"
  • Memberships that have a label called foo:
  labels.foo:*
  • Memberships that have a label called foo whose value is bar:
  labels.foo = bar
  • Memberships in the CREATING state:
  state = CREATING
order_by

string

Optional. One or more fields to compare and use to sort the output. See https://google.aip.dev/132#ordering.

ListMembershipsResponse

Response message for the GkeHub.ListMemberships method.

Fields
resources[]

Membership

The list of matching Memberships.
next_page_token

string

A token to request the next page of resources from the ListMemberships method. The value of an empty string means that there are no more resources to return.
unreachable[]

string

List of locations that could not be reached while fetching this list.

Membership

Membership contains information about a member cluster.

Fields
name

string

Output only. The full, unique name of this Membership resource in the format projects/*/locations/*/memberships/{membership_id}, set during creation.

membership_id must be a valid RFC 1123 compliant DNS label:

  1. At most 63 characters in length
  2. It must consist of lower case alphanumeric characters or -
  3. It must start and end with an alphanumeric character

Which can be expressed as the regex: [a-z0-9]([-a-z0-9]*[a-z0-9])?, with a maximum length of 63 characters.
labels

map<string, string>

Optional. Labels for this membership.
description

string

Output only. Description of this membership, limited to 63 characters. Must match the regex: [a-zA-Z0-9][a-zA-Z0-9_\-\.\ ]*

This field is present for legacy purposes.
state

MembershipState

Output only. State of the Membership resource.
create_time

Timestamp

Output only. When the Membership was created.
update_time

Timestamp

Output only. When the Membership was last updated.
delete_time

Timestamp

Output only. When the Membership was deleted.
external_id

string

Optional. An externally-generated and managed ID for this Membership. This ID may be modified after creation, but this is not recommended. For GKE clusters, external_id is managed by the Hub API and updates will be ignored.

The ID must match the regex: [a-zA-Z0-9][a-zA-Z0-9_\-\.]*

If this Membership represents a Kubernetes cluster, this value should be set to the UID of the kube-system namespace object.
authority

Authority

Optional. How to identify workloads from this Membership. See the documentation on Workload Identity for more details: https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity
last_connection_time

Timestamp

Output only. For clusters using Connect, the timestamp of the most recent connection established with Google Cloud. This time is updated every several minutes, not continuously. For clusters that do not use GKE Connect, or that have never connected successfully, this field will be unset.
unique_id

string

Output only. Google-generated UUID for this resource. This is unique across all Membership resources. If a Membership resource is deleted and another resource with the same name is created, it gets a different unique_id.
infrastructure_type

Membership.InfrastructureType

Optional. The infrastructure type this Membership is running on.
monitoring_config

MonitoringConfig

Optional. The monitoring config information for this membership.
Union field type. Type of resource represented by this Membership type can be only one of the following:
endpoint

MembershipEndpoint

Optional. Endpoint information to reach this member.

InfrastructureType

Specifies the infrastructure type of a Membership. Infrastructure type is used by Hub to control infrastructure-specific behavior, including pricing.

Each GKE distribution (on-GCP, on-Prem, on-X,...) will set this field automatically, but Attached Clusters customers should specify a type during registration.

Enums
INFRASTRUCTURE_TYPE_UNSPECIFIED No type was specified. Some Hub functionality may require a type be specified, and will not support Memberships with this value.
ON_PREM Private infrastructure that is owned or operated by customer. This includes GKE distributions such as GKE-OnPrem and GKE-OnBareMetal.
MULTI_CLOUD Public cloud infrastructure.

MembershipEndpoint

MembershipEndpoint contains information needed to contact a Kubernetes API, endpoint and any additional Kubernetes metadata.

Fields
kubernetes_metadata

KubernetesMetadata

Output only. Useful Kubernetes-specific metadata.
kubernetes_resource

KubernetesResource

Optional. The in-cluster Kubernetes Resources that should be applied for a correctly registered cluster, in the steady state. These resources:

  • Ensure that the cluster is exclusively registered to one and only one Hub Membership.
  • Propagate Workload Pool Information available in the Membership Authority field.
  • Ensure proper initial configuration of default Hub Features.
Union field type. Cluster information of the registered cluster. type can be only one of the following:
gke_cluster

GkeCluster

Optional. Specific information for a GKE-on-GCP cluster.
on_prem_cluster

OnPremCluster

Optional. Specific information for a GKE On-Prem cluster. An onprem user-cluster who has no resourceLink is not allowed to use this field, it should have a nil "type" instead.
multi_cloud_cluster

MultiCloudCluster

Optional. Specific information for a GKE Multi-Cloud cluster.
edge_cluster

EdgeCluster

Optional. Specific information for a Google Edge cluster.
appliance_cluster

ApplianceCluster

Optional. Specific information for a GDC Edge Appliance cluster.

MembershipState

MembershipState describes the state of a Membership resource.

Fields
code

MembershipState.Code

Output only. The current state of the Membership resource.

Code

Code describes the state of a Membership resource.

Enums
CODE_UNSPECIFIED The code is not set.
CREATING The cluster is being registered.
READY The cluster is registered.
DELETING The cluster is being unregistered.
UPDATING The Membership is being updated.
SERVICE_UPDATING The Membership is being updated by the Hub Service.

MonitoringConfig

MonitoringConfig informs Fleet-based applications/services/UIs how the metrics for the underlying cluster is reported to cloud monitoring services. It can be set from empty to non-empty, but can't be mutated directly to prevent accidentally breaking the constinousty of metrics.

Fields
project_id

string

Optional. Project used to report Metrics
location

string

Optional. Location used to report Metrics
cluster

string

Optional. Cluster name used to report metrics. For Anthos on VMWare/Baremetal/MultiCloud clusters, it would be in format {cluster_type}/{cluster_name}, e.g., "awsClusters/cluster_1".
kubernetes_metrics_prefix

string

Optional. Kubernetes system metrics, if available, are written to this prefix. This defaults to kubernetes.io for GKE, and kubernetes.io/anthos for Anthos eventually. Noted: Anthos MultiCloud will have kubernetes.io prefix today but will migration to be under kubernetes.io/anthos.
cluster_hash

string

Optional. For GKE and Multicloud clusters, this is the UUID of the cluster resource. For VMWare and Baremetal clusters, this is the kube-system UID.

MultiCloudCluster

MultiCloudCluster contains information specific to GKE Multi-Cloud clusters.

Fields
cluster_missing

bool

Output only. If cluster_missing is set then it denotes that API(gkemulticloud.googleapis.com) resource for this GKE Multi-Cloud cluster no longer exists.

OnPremCluster

OnPremCluster contains information specific to GKE On-Prem clusters.

Fields
cluster_missing

bool

Output only. If cluster_missing is set then it denotes that API(gkeonprem.googleapis.com) resource for this GKE On-Prem cluster no longer exists.
admin_cluster

bool

Immutable. Whether the cluster is an admin cluster.
cluster_type

OnPremCluster.ClusterType

Immutable. The on prem cluster's type.

ClusterType

ClusterType describes on prem cluster's type.

Enums
CLUSTERTYPE_UNSPECIFIED The ClusterType is not set.
BOOTSTRAP The ClusterType is bootstrap cluster.
HYBRID The ClusterType is baremetal hybrid cluster.
STANDALONE The ClusterType is baremetal standalone cluster.
USER The ClusterType is user cluster.

OperationMetadata

Represents the metadata of the long-running operation.

Fields
create_time

Timestamp

Output only. The time the operation was created.
end_time

Timestamp

Output only. The time the operation finished running.
target

string

Output only. Server-defined resource path for the target of the operation.
verb

string

Output only. Name of the verb executed by the operation.
status_detail

string

Output only. Human-readable status of the operation, if any.
cancel_requested

bool

Output only. Identifies whether the user has requested cancellation of the operation. Operations that have successfully been cancelled have [Operation.error][] value with a google.rpc.Status.code of 1, corresponding to Code.CANCELLED.
api_version

string

Output only. API version used to start the operation.

ResourceManifest

ResourceManifest represents a single Kubernetes resource to be applied to the cluster.

Fields
manifest

string

YAML manifest of the resource.
cluster_scoped

bool

Whether the resource provided in the manifest is cluster_scoped. If unset, the manifest is assumed to be namespace scoped.

This field is used for REST mapping when applying the resource in a cluster.

ResourceOptions

ResourceOptions represent options for Kubernetes resource generation.

Fields
connect_version

string

Optional. The Connect agent version to use for connect_resources. Defaults to the latest GKE Connect version. The version must be a currently supported version, obsolete versions will be rejected.
v1beta1_crd

bool

Optional. Use apiextensions/v1beta1 instead of apiextensions/v1 for CustomResourceDefinition resources. This option should be set for clusters with Kubernetes apiserver versions <1.16.
k8s_version

string

Optional. Major version of the Kubernetes cluster. This is only used to determine which version to use for the CustomResourceDefinition resources, apiextensions/v1beta1 orapiextensions/v1.

TypeMeta

TypeMeta is the type information needed for content unmarshalling of Kubernetes resources in the manifest.

Fields
kind

string

Kind of the resource (e.g. Deployment).
api_version

string

APIVersion of the resource (e.g. v1).

UpdateMembershipRequest

Request message for GkeHub.UpdateMembership method.

Fields
name

string

Required. The Membership resource name in the format projects/*/locations/*/memberships/*.

Authorization requires the following IAM permission on the specified resource name:

  • gkehub.memberships.update
update_mask

FieldMask

Required. Mask of fields to update.
resource

Membership

Required. Only fields specified in update_mask are updated. If you specify a field in the update_mask but don't specify its value here that field will be deleted. If you are updating a map field, set the value of a key to null or empty string to delete the key from the map. It's not possible to update a key's value to the empty string. If you specify the update_mask to be a special path "*", fully replaces all user-modifiable fields to match resource.