ComputeSubnetwork

Property	Value
Google Cloud Service Name	Compute Engine
Google Cloud Service Documentation	/compute/docs/
Google Cloud REST Resource Name	v1.subnetworks
Google Cloud REST Resource Documentation	/compute/docs/reference/rest/v1/subnetworks
Config Connector Resource Short Names	gcpcomputesubnetwork gcpcomputesubnetworks computesubnetwork
Config Connector Service Name	compute.googleapis.com
Config Connector Resource Fully Qualified Name	computesubnetworks.compute.cnrm.cloud.google.com
Can Be Referenced by IAMPolicy/IAMPolicyMember	Yes
Supports IAM Conditions	Yes
Supports IAM Audit Configs	No
IAM External Reference Format	projects/{{project}}/regions/{{region}}/subnetworks/{{name}}
Config Connector Default Average Reconcile Interval In Seconds	600

Custom Resource Definition Properties

Annotations

Fields
`cnrm.cloud.google.com/project-id`

Spec

Schema

description: string
ipCidrRange: string
ipv6AccessType: string
logConfig:
  aggregationInterval: string
  filterExpr: string
  flowSampling: float
  metadata: string
  metadataFields:
  - string
networkRef:
  external: string
  name: string
  namespace: string
privateIpGoogleAccess: boolean
privateIpv6GoogleAccess: string
purpose: string
region: string
resourceID: string
role: string
secondaryIpRange:
- ipCidrRange: string
  rangeName: string
stackType: string

Fields

Fields
`description` Optional	`string` Immutable. An optional description of this resource. Provide this property when you create the resource. This field can be set only at resource creation time.
`ipCidrRange` Required	`string` The range of internal addresses that are owned by this subnetwork. Provide this property when you create the subnetwork. For example, 10.0.0.0/8 or 192.168.0.0/16. Ranges must be unique and non-overlapping within a network. Only IPv4 is supported.
`ipv6AccessType` Optional	`string` The access type of IPv6 address this subnet holds. It's immutable and can only be specified during creation or the first time the subnet is updated into IPV4_IPV6 dual stack. If the ipv6_type is EXTERNAL then this subnet cannot enable direct path. Possible values: ["EXTERNAL", "INTERNAL"].
`logConfig` Optional	`object` This field denotes the VPC flow logging options for this subnetwork. If logging is enabled, logs are exported to Cloud Logging. Flow logging isn't supported if the subnet 'purpose' field is set to subnetwork is 'REGIONAL_MANAGED_PROXY' or 'GLOBAL_MANAGED_PROXY'.
`logConfig.aggregationInterval` Optional	`string` Can only be specified if VPC flow logging for this subnetwork is enabled. Toggles the aggregation interval for collecting flow logs. Increasing the interval time will reduce the amount of generated flow logs for long lasting connections. Default is an interval of 5 seconds per connection. Default value: "INTERVAL_5_SEC" Possible values: ["INTERVAL_5_SEC", "INTERVAL_30_SEC", "INTERVAL_1_MIN", "INTERVAL_5_MIN", "INTERVAL_10_MIN", "INTERVAL_15_MIN"].
`logConfig.filterExpr` Optional	`string` Export filter used to define which VPC flow logs should be logged, as as CEL expression. See https://cloud.google.com/vpc/docs/flow-logs#filtering for details on how to format this field. The default value is 'true', which evaluates to include everything.
`logConfig.flowSampling` Optional	`float` Can only be specified if VPC flow logging for this subnetwork is enabled. The value of the field must be in [0, 1]. Set the sampling rate of VPC flow logs within the subnetwork where 1.0 means all collected logs are reported and 0.0 means no logs are reported. Default is 0.5 which means half of all collected logs are reported.
`logConfig.metadata` Optional	`string` Can only be specified if VPC flow logging for this subnetwork is enabled. Configures whether metadata fields should be added to the reported VPC flow logs. Default value: "INCLUDE_ALL_METADATA" Possible values: ["EXCLUDE_ALL_METADATA", "INCLUDE_ALL_METADATA", "CUSTOM_METADATA"].
`logConfig.metadataFields` Optional	`list (string)` List of metadata fields that should be added to reported logs. Can only be specified if VPC flow logs for this subnetwork is enabled and "metadata" is set to CUSTOM_METADATA.
`logConfig.metadataFields[]` Optional	`string`
`networkRef` Required	`object` The network this subnet belongs to. Only networks that are in the distributed mode can have subnetworks.
`networkRef.external` Optional	`string` Allowed value: The `selfLink` field of a `ComputeNetwork` resource.
`networkRef.name` Optional	`string` Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names
`networkRef.namespace` Optional	`string` Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/
`privateIpGoogleAccess` Optional	`boolean` When enabled, VMs in this subnetwork without external IP addresses can access Google APIs and services by using Private Google Access.
`privateIpv6GoogleAccess` Optional	`string` The private IPv6 google access type for the VMs in this subnet.
`purpose` Optional	`string` Immutable. The purpose of the resource. This field can be either 'PRIVATE_RFC_1918', 'REGIONAL_MANAGED_PROXY', 'GLOBAL_MANAGED_PROXY', or 'PRIVATE_SERVICE_CONNECT'. A subnet with purpose set to 'REGIONAL_MANAGED_PROXY' is a user-created subnetwork that is reserved for regional Envoy-based load balancers. A subnetwork in a given region with purpose set to 'GLOBAL_MANAGED_PROXY' is a proxy-only subnet and is shared between all the cross-regional Envoy-based load balancers. A subnetwork with purpose set to 'PRIVATE_SERVICE_CONNECT' reserves the subnet for hosting a Private Service Connect published service. Note that 'REGIONAL_MANAGED_PROXY' is the preferred setting for all regional Envoy load balancers. If unspecified, the purpose defaults to 'PRIVATE_RFC_1918'.
`region` Required	`string` Immutable. The GCP region for this subnetwork.
`resourceID` Optional	`string` Immutable. Optional. The name of the resource. Used for creation and acquisition. When unset, the value of `metadata.name` is used as the default.
`role` Optional	`string` The role of subnetwork. Currently, this field is only used when 'purpose' is 'REGIONAL_MANAGED_PROXY'. The value can be set to 'ACTIVE' or 'BACKUP'. An 'ACTIVE' subnetwork is one that is currently being used for Envoy-based load balancers in a region. A 'BACKUP' subnetwork is one that is ready to be promoted to 'ACTIVE' or is currently draining. Possible values: ["ACTIVE", "BACKUP"].
`secondaryIpRange` Optional	`list (object)`
`secondaryIpRange[]` Optional	`object`
`secondaryIpRange[].ipCidrRange` Required*	`string` The range of IP addresses belonging to this subnetwork secondary range. Provide this property when you create the subnetwork. Ranges must be unique and non-overlapping with all primary and secondary IP ranges within a network. Only IPv4 is supported.
`secondaryIpRange[].rangeName` Required*	`string` The name associated with this subnetwork secondary range, used when adding an alias IP range to a VM instance. The name must be 1-63 characters long, and comply with RFC1035. The name must be unique within the subnetwork.
`stackType` Optional	`string` The stack type for this subnet to identify whether the IPv6 feature is enabled or not. If not specified IPV4_ONLY will be used. Possible values: ["IPV4_ONLY", "IPV4_IPV6"].

description

Optional

string

Immutable. An optional description of this resource. Provide this property when you create the resource. This field can be set only at resource creation time.

ipCidrRange

Required

string

The range of internal addresses that are owned by this subnetwork. Provide this property when you create the subnetwork. For example, 10.0.0.0/8 or 192.168.0.0/16. Ranges must be unique and non-overlapping within a network. Only IPv4 is supported.

ipv6AccessType

Optional

string

The access type of IPv6 address this subnet holds. It's immutable and can only be specified during creation or the first time the subnet is updated into IPV4_IPV6 dual stack. If the ipv6_type is EXTERNAL then this subnet cannot enable direct path. Possible values: ["EXTERNAL", "INTERNAL"].

logConfig

Optional

object

This field denotes the VPC flow logging options for this subnetwork. If logging is enabled, logs are exported to Cloud Logging. Flow logging isn't supported if the subnet 'purpose' field is set to subnetwork is 'REGIONAL_MANAGED_PROXY' or 'GLOBAL_MANAGED_PROXY'.

logConfig.aggregationInterval

Optional

string

Can only be specified if VPC flow logging for this subnetwork is enabled. Toggles the aggregation interval for collecting flow logs. Increasing the interval time will reduce the amount of generated flow logs for long lasting connections. Default is an interval of 5 seconds per connection. Default value: "INTERVAL_5_SEC" Possible values: ["INTERVAL_5_SEC", "INTERVAL_30_SEC", "INTERVAL_1_MIN", "INTERVAL_5_MIN", "INTERVAL_10_MIN", "INTERVAL_15_MIN"].

logConfig.filterExpr

Optional

string

Export filter used to define which VPC flow logs should be logged, as as CEL expression. See https://cloud.google.com/vpc/docs/flow-logs#filtering for details on how to format this field. The default value is 'true', which evaluates to include everything.

logConfig.flowSampling

Optional

float

Can only be specified if VPC flow logging for this subnetwork is enabled. The value of the field must be in [0, 1]. Set the sampling rate of VPC flow logs within the subnetwork where 1.0 means all collected logs are reported and 0.0 means no logs are reported. Default is 0.5 which means half of all collected logs are reported.

logConfig.metadata

Optional

string

Can only be specified if VPC flow logging for this subnetwork is enabled. Configures whether metadata fields should be added to the reported VPC flow logs. Default value: "INCLUDE_ALL_METADATA" Possible values: ["EXCLUDE_ALL_METADATA", "INCLUDE_ALL_METADATA", "CUSTOM_METADATA"].

logConfig.metadataFields

Optional

list (string)

List of metadata fields that should be added to reported logs. Can only be specified if VPC flow logs for this subnetwork is enabled and "metadata" is set to CUSTOM_METADATA.

logConfig.metadataFields[]

Optional

string

networkRef

Required

object

The network this subnet belongs to. Only networks that are in the distributed mode can have subnetworks.

networkRef.external

Optional

string

Allowed value: The `selfLink` field of a `ComputeNetwork` resource.

networkRef.name

Optional

string

Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names

networkRef.namespace

Optional

string

Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/

privateIpGoogleAccess

Optional

boolean

When enabled, VMs in this subnetwork without external IP addresses can access Google APIs and services by using Private Google Access.

privateIpv6GoogleAccess

Optional

string

The private IPv6 google access type for the VMs in this subnet.

purpose

Optional

string

Immutable. The purpose of the resource. This field can be either 'PRIVATE_RFC_1918', 'REGIONAL_MANAGED_PROXY', 'GLOBAL_MANAGED_PROXY', or 'PRIVATE_SERVICE_CONNECT'. A subnet with purpose set to 'REGIONAL_MANAGED_PROXY' is a user-created subnetwork that is reserved for regional Envoy-based load balancers. A subnetwork in a given region with purpose set to 'GLOBAL_MANAGED_PROXY' is a proxy-only subnet and is shared between all the cross-regional Envoy-based load balancers. A subnetwork with purpose set to 'PRIVATE_SERVICE_CONNECT' reserves the subnet for hosting a Private Service Connect published service. Note that 'REGIONAL_MANAGED_PROXY' is the preferred setting for all regional Envoy load balancers. If unspecified, the purpose defaults to 'PRIVATE_RFC_1918'.

region

Required

string

Immutable. The GCP region for this subnetwork.

resourceID

Optional

string

Immutable. Optional. The name of the resource. Used for creation and acquisition. When unset, the value of `metadata.name` is used as the default.

role

Optional

string

The role of subnetwork. Currently, this field is only used when 'purpose' is 'REGIONAL_MANAGED_PROXY'. The value can be set to 'ACTIVE' or 'BACKUP'. An 'ACTIVE' subnetwork is one that is currently being used for Envoy-based load balancers in a region. A 'BACKUP' subnetwork is one that is ready to be promoted to 'ACTIVE' or is currently draining. Possible values: ["ACTIVE", "BACKUP"].

secondaryIpRange

Optional

list (object)

secondaryIpRange[]

Optional

object

secondaryIpRange[].ipCidrRange

Required*

string

The range of IP addresses belonging to this subnetwork secondary range. Provide this property when you create the subnetwork. Ranges must be unique and non-overlapping with all primary and secondary IP ranges within a network. Only IPv4 is supported.

secondaryIpRange[].rangeName

Required*

string

The name associated with this subnetwork secondary range, used when adding an alias IP range to a VM instance. The name must be 1-63 characters long, and comply with RFC1035. The name must be unique within the subnetwork.

stackType

Optional

string

The stack type for this subnet to identify whether the IPv6 feature is enabled or not. If not specified IPV4_ONLY will be used. Possible values: ["IPV4_ONLY", "IPV4_IPV6"].

* Field is required when parent field is specified

Status

Schema

conditions:
- lastTransitionTime: string
  message: string
  reason: string
  status: string
  type: string
creationTimestamp: string
externalIpv6Prefix: string
fingerprint: string
gatewayAddress: string
internalIpv6Prefix: string
ipv6CidrRange: string
observedGeneration: integer
selfLink: string

Fields
`conditions`	`list (object)` Conditions represent the latest available observation of the resource's current state.
`conditions[]`	`object`
`conditions[].lastTransitionTime`	`string` Last time the condition transitioned from one status to another.
`conditions[].message`	`string` Human-readable message indicating details about last transition.
`conditions[].reason`	`string` Unique, one-word, CamelCase reason for the condition's last transition.
`conditions[].status`	`string` Status is the status of the condition. Can be True, False, Unknown.
`conditions[].type`	`string` Type is the type of the condition.
`creationTimestamp`	`string` Creation timestamp in RFC3339 text format.
`externalIpv6Prefix`	`string` The range of external IPv6 addresses that are owned by this subnetwork.
`fingerprint`	`string` DEPRECATED. This field is not useful for users, and has been removed as an output. Fingerprint of this resource. This field is used internally during updates of this resource.
`gatewayAddress`	`string` The gateway address for default routes to reach destination addresses outside this subnetwork.
`internalIpv6Prefix`	`string` The internal IPv6 address range that is assigned to this subnetwork.
`ipv6CidrRange`	`string` The range of internal IPv6 addresses that are owned by this subnetwork.
`observedGeneration`	`integer` ObservedGeneration is the generation of the resource that was most recently observed by the Config Connector controller. If this is equal to metadata.generation, then that means that the current reported status reflects the most recent desired state of the resource.
`selfLink`	`string`

Sample YAML(s)

Typical Use Case

# Copyright 2020 Google LLC
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#     http://www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.

apiVersion: compute.cnrm.cloud.google.com/v1beta1
kind: ComputeSubnetwork
metadata:
  labels:
    label-one: "value-one"
  name: computesubnetwork-sample
spec:
  ipCidrRange: 10.2.0.0/16
  region: us-central1
  description: My subnet
  privateIpGoogleAccess: false
  networkRef:
    name: computesubnetwork-dep
  logConfig:
    aggregationInterval: INTERVAL_10_MIN
    flowSampling: 0.5
    metadata: INCLUDE_ALL_METADATA
---
apiVersion: compute.cnrm.cloud.google.com/v1beta1
kind: ComputeNetwork
metadata:
  name: computesubnetwork-dep
spec:
  routingMode: REGIONAL
  autoCreateSubnetworks: false