REST Resource: projects.locations.memberships

Resource: Membership

Membership contains information about a member cluster.

JSON representation
{
  "name": string,
  "labels": {
    string: string,
    ...
  },
  "description": string,
  "state": {
    object (MembershipState)
  },
  "createTime": string,
  "updateTime": string,
  "deleteTime": string,
  "externalId": string,
  "authority": {
    object (Authority)
  },
  "lastConnectionTime": string,
  "uniqueId": string,
  "infrastructureType": enum (Membership.InfrastructureType),
  "endpoint": {
    object (MembershipEndpoint)
  }
}
Fields
name

string

Output only. The full, unique name of this Membership resource in the format projects/*/locations/*/memberships/{membershipId}, set during creation.

membershipId must be a valid RFC 1123 compliant DNS label:

  1. At most 63 characters in length
  2. It must consist of lower case alphanumeric characters or -
  3. It must start and end with an alphanumeric character

Which can be expressed as the regex: [a-z0-9]([-a-z0-9]*[a-z0-9])?, with a maximum length of 63 characters.

labels

map (key: string, value: string)

Optional. GCP labels for this membership.

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.

description

string

Output only. Description of this membership, limited to 63 characters. Must match the regex: [a-zA-Z0-9][a-zA-Z0-9_\-\.\ ]*

This field is present for legacy purposes.

state

object (MembershipState)

Output only. State of the Membership resource.

createTime

string (Timestamp format)

Output only. When the Membership was created.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

updateTime

string (Timestamp format)

Output only. When the Membership was last updated.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

deleteTime

string (Timestamp format)

Output only. When the Membership was deleted.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

externalId

string

Optional. An externally-generated and managed ID for this Membership. This ID may be modified after creation, but this is not recommended. For GKE clusters, externalId is managed by the Hub API and updates will be ignored.

The ID must match the regex: [a-zA-Z0-9][a-zA-Z0-9_\-\.]*

If this Membership represents a Kubernetes cluster, this value should be set to the UID of the kube-system namespace object.

authority

object (Authority)

Optional. How to identify workloads from this Membership. See the documentation on Workload Identity for more details: https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity

lastConnectionTime

string (Timestamp format)

Output only. For clusters using Connect, the timestamp of the most recent connection established with Google Cloud. This time is updated every several minutes, not continuously. For clusters that do not use GKE Connect, or that have never connected successfully, this field will be unset.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

uniqueId

string

Output only. Google-generated UUID for this resource. This is unique across all Membership resources. If a Membership resource is deleted and another resource with the same name is created, it gets a different uniqueId.

infrastructureType

enum (Membership.InfrastructureType)

Optional. The infrastructure type this Membership is running on.

endpoint

object (MembershipEndpoint)

Optional. Endpoint information to reach this member.

MembershipEndpoint

MembershipEndpoint contains information needed to contact a Kubernetes API, endpoint and any additional Kubernetes metadata.

JSON representation
{
  "gkeCluster": {
    object (GkeCluster)
  },
  "kubernetesMetadata": {
    object (KubernetesMetadata)
  },
  "kubernetesResource": {
    object (KubernetesResource)
  }
}
Fields
gkeCluster

object (GkeCluster)

Optional. GKE-specific information. Only present if this Membership is a GKE cluster.

kubernetesMetadata

object (KubernetesMetadata)

Output only. Useful Kubernetes-specific metadata.

kubernetesResource

object (KubernetesResource)

Optional. The in-cluster Kubernetes Resources that should be applied for a correctly registered cluster, in the steady state. These resources:

  • Ensure that the cluster is exclusively registered to one and only one Hub Membership.
  • Propagate Workload Pool Information available in the Membership Authority field.
  • Ensure proper initial configuration of default Hub Features.

GkeCluster

GkeCluster contains information specific to GKE clusters.

JSON representation
{
  "resourceLink": string
}
Fields

KubernetesMetadata

KubernetesMetadata provides informational metadata for Memberships that are created from Kubernetes Endpoints (currently, these are equivalent to Kubernetes clusters).

JSON representation
{
  "kubernetesApiServerVersion": string,
  "nodeProviderId": string,
  "nodeCount": integer,
  "vcpuCount": integer,
  "memoryMb": integer,
  "updateTime": string
}
Fields
kubernetesApiServerVersion

string

Output only. Kubernetes API server version string as reported by '/version'.

nodeProviderId

string

Output only. Node providerID as reported by the first node in the list of nodes on the Kubernetes endpoint. On Kubernetes platforms that support zero-node clusters (like GKE-on-GCP), the nodeCount will be zero and the nodeProviderId will be empty.

nodeCount

integer

Output only. Node count as reported by Kubernetes nodes resources.

vcpuCount

integer

Output only. vCPU count as reported by Kubernetes nodes resources.

memoryMb

integer

Output only. The total memory capacity as reported by the sum of all Kubernetes nodes resources, defined in MB.

updateTime

string (Timestamp format)

Output only. The time at which these details were last updated. This updateTime is different from the Membership-level updateTime since EndpointDetails are updated internally for API consumers.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

KubernetesResource

KubernetesResource contains the YAML manifests and configuration for Membership Kubernetes resources in the cluster. After memberships.create or memberships.patch, these resources should be re-applied in the cluster.

JSON representation
{
  "membershipCrManifest": string,
  "membershipResources": [
    {
      object (ResourceManifest)
    }
  ],
  "connectResources": [
    {
      object (ResourceManifest)
    }
  ],
  "resourceOptions": {
    object (ResourceOptions)
  }
}
Fields
membershipCrManifest

string

Input only. The YAML representation of the Membership CR. This field is ignored for GKE clusters where Hub can read the CR directly.

Callers should provide the CR that is currently present in the cluster during Create or Update, or leave this field empty if none exists. The CR manifest is used to validate the cluster has not been registered with another Membership.

membershipResources[]

object (ResourceManifest)

Output only. Additional Kubernetes resources that need to be applied to the cluster after Membership creation, and after every update.

This field is only populated in the Membership returned from a successful long-running operation from memberships.create or memberships.patch. It is not populated during normal memberships.get or memberships.list requests. To get the resource manifest after the initial registration, the caller should make a memberships.patch call with an empty field mask.

connectResources[]

object (ResourceManifest)

Output only. The Kubernetes resources for installing the GKE Connect agent.

This field is only populated in the Membership returned from a successful long-running operation from memberships.create or memberships.patch. It is not populated during normal memberships.get or memberships.list requests. To get the resource manifest after the initial registration, the caller should make a memberships.patch call with an empty field mask.

resourceOptions

object (ResourceOptions)

Optional. Options for Kubernetes resource generation.

ResourceManifest

ResourceManifest represents a single Kubernetes resource to be applied to the cluster.

JSON representation
{
  "manifest": string,
  "clusterScoped": boolean
}
Fields
manifest

string

YAML manifest of the resource.

clusterScoped

boolean

Whether the resource provided in the manifest is clusterScoped. If unset, the manifest is assumed to be namespace scoped.

This field is used for REST mapping when applying the resource in a cluster.

ResourceOptions

ResourceOptions represent options for Kubernetes resource generation.

JSON representation
{
  "connectVersion": string,
  "v1beta1Crd": boolean
}
Fields
connectVersion

string

Optional. The Connect agent version to use for connectResources. Defaults to the latest GKE Connect version. The version must be a currently supported version, obsolete versions will be rejected.

v1beta1Crd

boolean

Optional. Use apiextensions/v1beta1 instead of apiextensions/v1 for CustomResourceDefinition resources. This option should be set for clusters with Kubernetes apiserver versions <1.16.

MembershipState

MembershipState describes the state of a Membership resource.

JSON representation
{
  "code": enum (MembershipState.Code)
}
Fields
code

enum (MembershipState.Code)

Output only. The current state of the Membership resource.

MembershipState.Code

Code describes the state of a Membership resource.

Enums
CODE_UNSPECIFIED The code is not set.
CREATING The cluster is being registered.
READY The cluster is registered.
DELETING The cluster is being unregistered.
UPDATING The Membership is being updated.
SERVICE_UPDATING The Membership is being updated by the Hub Service.

Authority

Authority encodes how Google will recognize identities from this Membership. See the workload identity documentation for more details: https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity

JSON representation
{
  "issuer": string,
  "oidcJwks": string,
  "identityProvider": string,
  "workloadIdentityPool": string
}
Fields
issuer

string

Optional. A JSON Web Token (JWT) issuer URI. issuer must start with https:// and be a valid URL with length <2000 characters.

If set, then Google will allow valid OIDC tokens from this issuer to authenticate within the workloadIdentityPool. OIDC discovery will be performed on this URI to validate tokens from the issuer, unless oidcJwks is set.

Clearing issuer disables Workload Identity. issuer cannot be directly modified; it must be cleared (and Workload Identity disabled) before using a new issuer (and re-enabling Workload Identity).

oidcJwks

string (bytes format)

Optional. OIDC verification keys for this Membership in JWKS format (RFC 7517).

When this field is set, OIDC discovery will NOT be performed on issuer, and instead OIDC tokens will be validated using this field.

A base64-encoded string.

identityProvider

string

Output only. An identity provider that reflects the issuer in the workload identity pool.

workloadIdentityPool

string

Output only. The name of the workload identity pool in which issuer will be recognized.

There is a single Workload Identity Pool per Hub that is shared between all Memberships that belong to that Hub. For a Hub hosted in {PROJECT_ID}, the workload pool format is {PROJECT_ID}.hub.id.goog, although this is subject to change in newer versions of this API.

Membership.InfrastructureType

Specifies the infrastructure type of a Membership. Infrastructure type is used by Hub to control infrastructure-specific behavior, including pricing.

Each GKE distribution (on-GCP, on-Prem, on-X,...) will set this field automatically, but Attached Clusters customers should specify a type during registration.

Enums
INFRASTRUCTURE_TYPE_UNSPECIFIED No type was specified. Some Hub functionality may require a type be specified, and will not support Memberships with this value.
ON_PREM Private infrastructure that is owned or operated by customer. This includes GKE distributions such as GKE-OnPrem and GKE-OnBareMetal.
MULTI_CLOUD Public cloud infrastructure.

Methods

create

Creates a new Membership.

delete

Removes a Membership.

generateConnectManifest

Generates the manifest for deployment of the GKE connect agent.

get

Gets the details of a Membership.

getIamPolicy

Gets the access control policy for a resource.

list

Lists Memberships in a given project and location.

patch

Updates an existing Membership.

setIamPolicy

Sets the access control policy on the specified resource.

testIamPermissions

Returns permissions that a caller has on the specified resource.