REST Resource: projects.locations.clusters

Resource: Cluster

A Google Kubernetes Engine cluster.

JSON representation 
{
  "name": string,
  "description": string,
  "initialNodeCount": integer,
  "nodeConfig": {
    object (NodeConfig)
  },
  "masterAuth": {
    object (MasterAuth)
  },
  "loggingService": string,
  "monitoringService": string,
  "network": string,
  "clusterIpv4Cidr": string,
  "addonsConfig": {
    object (AddonsConfig)
  },
  "subnetwork": string,
  "nodePools": [
    {
      object (NodePool)
    }
  ],
  "locations": [
    string
  ],
  "enableKubernetesAlpha": boolean,
  "resourceLabels": {
    string: string,
    ...
  },
  "labelFingerprint": string,
  "legacyAbac": {
    object (LegacyAbac)
  },
  "networkPolicy": {
    object (NetworkPolicy)
  },
  "ipAllocationPolicy": {
    object (IPAllocationPolicy)
  },
  "masterAuthorizedNetworksConfig": {
    object (MasterAuthorizedNetworksConfig)
  },
  "maintenancePolicy": {
    object (MaintenancePolicy)
  },
  "binaryAuthorization": {
    object (BinaryAuthorization)
  },
  "autoscaling": {
    object (ClusterAutoscaling)
  },
  "networkConfig": {
    object (NetworkConfig)
  },
  "defaultMaxPodsConstraint": {
    object (MaxPodsConstraint)
  },
  "resourceUsageExportConfig": {
    object (ResourceUsageExportConfig)
  },
  "authenticatorGroupsConfig": {
    object (AuthenticatorGroupsConfig)
  },
  "privateClusterConfig": {
    object (PrivateClusterConfig)
  },
  "databaseEncryption": {
    object (DatabaseEncryption)
  },
  "verticalPodAutoscaling": {
    object (VerticalPodAutoscaling)
  },
  "shieldedNodes": {
    object (ShieldedNodes)
  },
  "releaseChannel": {
    object (ReleaseChannel)
  },
  "workloadIdentityConfig": {
    object (WorkloadIdentityConfig)
  },
  "meshCertificates": {
    object (MeshCertificates)
  },
  "costManagementConfig": {
    object (CostManagementConfig)
  },
  "notificationConfig": {
    object (NotificationConfig)
  },
  "confidentialNodes": {
    object (ConfidentialNodes)
  },
  "identityServiceConfig": {
    object (IdentityServiceConfig)
  },
  "selfLink": string,
  "zone": string,
  "endpoint": string,
  "initialClusterVersion": string,
  "currentMasterVersion": string,
  "currentNodeVersion": string,
  "createTime": string,
  "status": enum (Status),
  "statusMessage": string,
  "nodeIpv4CidrSize": integer,
  "servicesIpv4Cidr": string,
  "instanceGroupUrls": [
    string
  ],
  "currentNodeCount": integer,
  "expireTime": string,
  "location": string,
  "enableTpu": boolean,
  "tpuIpv4CidrBlock": string,
  "conditions": [
    {
      object (StatusCondition)
    }
  ],
  "autopilot": {
    object (Autopilot)
  },
  "id": string,
  "loggingConfig": {
    object (LoggingConfig)
  },
  "monitoringConfig": {
    object (MonitoringConfig)
  },
  "nodePoolAutoConfig": {
    object (NodePoolAutoConfig)
  },
  "etag": string,
  "fleet": {
    object (Fleet)
  },
  "securityPostureConfig": {
    object (SecurityPostureConfig)
  },
  "enableK8sBetaApis": {
    object (K8sBetaAPIConfig)
  },
  "nodePoolDefaults": {
    object (NodePoolDefaults)
  }
}
Fields
name

string

The name of this cluster. The name must be unique within this project and location (e.g. zone or region), and can be up to 40 characters with the following restrictions:

  • Lowercase letters, numbers, and hyphens only.
  • Must start with a letter.
  • Must end with a number or a letter.
description

string

An optional description of this cluster.
initialNodeCount
(deprecated)

integer

The number of nodes to create in this cluster. You must ensure that your Compute Engine resource quota is sufficient for this number of instances. You must also have available firewall and routes quota. For requests, this field should only be used in lieu of a "nodePool" object, since this configuration (along with the "nodeConfig") will be used to create a "NodePool" object with an auto-generated name. Do not use this and a nodePool at the same time.

This field is deprecated, use nodePool.initial_node_count instead.
nodeConfig
(deprecated)

object (NodeConfig)

Parameters used in creating the cluster's nodes. For requests, this field should only be used in lieu of a "nodePool" object, since this configuration (along with the "initialNodeCount") will be used to create a "NodePool" object with an auto-generated name. Do not use this and a nodePool at the same time. For responses, this field will be populated with the node configuration of the first node pool. (For configuration of each node pool, see nodePool.config)

If unspecified, the defaults are used. This field is deprecated, use nodePool.config instead.
masterAuth

object (MasterAuth)

The authentication information for accessing the master endpoint. If unspecified, the defaults are used: For clusters before v1.12, if masterAuth is unspecified, username will be set to "admin", a random password will be generated, and a client certificate will be issued.
loggingService

string

The logging service the cluster should use to write logs. Currently available options:

  • logging.googleapis.com/kubernetes - The Cloud Logging service with a Kubernetes-native resource model
  • logging.googleapis.com - The legacy Cloud Logging service (no longer available as of GKE 1.15).
  • none - no logs will be exported from the cluster.

If left as an empty string,logging.googleapis.com/kubernetes will be used for GKE 1.14+ or logging.googleapis.com for earlier versions.
monitoringService

string

The monitoring service the cluster should use to write metrics. Currently available options:

  • "monitoring.googleapis.com/kubernetes" - The Cloud Monitoring service with a Kubernetes-native resource model
  • monitoring.googleapis.com - The legacy Cloud Monitoring service (no longer available as of GKE 1.15).
  • none - No metrics will be exported from the cluster.

If left as an empty string,monitoring.googleapis.com/kubernetes will be used for GKE 1.14+ or monitoring.googleapis.com for earlier versions.
network

string

The name of the Google Compute Engine network to which the cluster is connected. If left unspecified, the default network will be used.
clusterIpv4Cidr

string

The IP address range of the container pods in this cluster, in CIDR notation (e.g. 10.96.0.0/14). Leave blank to have one automatically chosen or specify a /14 block in 10.0.0.0/8.
addonsConfig

object (AddonsConfig)

Configurations for the various addons available to run in the cluster.
subnetwork

string

The name of the Google Compute Engine subnetwork to which the cluster is connected.
nodePools[]

object (NodePool)

The node pools associated with this cluster. This field should not be set if "nodeConfig" or "initialNodeCount" are specified.
locations[]

string

The list of Google Compute Engine zones in which the cluster's nodes should be located.

This field provides a default value if NodePool.Locations are not specified during node pool creation.

Warning: changing cluster locations will update the NodePool.Locations of all node pools and will result in nodes being added and/or removed.
enableKubernetesAlpha

boolean

Kubernetes alpha features are enabled on this cluster. This includes alpha API groups (e.g. v1alpha1) and features that may not be production ready in the kubernetes version of the master and nodes. The cluster has no SLA for uptime and master/node upgrades are disabled. Alpha enabled clusters are automatically deleted thirty days after creation.
resourceLabels

map (key: string, value: string)

The resource labels for the cluster to use to annotate any related Google Compute Engine resources.

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
labelFingerprint

string

The fingerprint of the set of labels for this cluster.
legacyAbac

object (LegacyAbac)

Configuration for the legacy ABAC authorization mode.
networkPolicy

object (NetworkPolicy)

Configuration options for the NetworkPolicy feature.
ipAllocationPolicy

object (IPAllocationPolicy)

Configuration for cluster IP allocation.
masterAuthorizedNetworksConfig

object (MasterAuthorizedNetworksConfig)

The configuration options for master authorized networks feature.
maintenancePolicy

object (MaintenancePolicy)

Configure the maintenance policy for this cluster.
binaryAuthorization

object (BinaryAuthorization)

Configuration for Binary Authorization.
autoscaling

object (ClusterAutoscaling)

Cluster-level autoscaling configuration.
networkConfig

object (NetworkConfig)

Configuration for cluster networking.
defaultMaxPodsConstraint

object (MaxPodsConstraint)

The default constraint on the maximum number of pods that can be run simultaneously on a node in the node pool of this cluster. Only honored if cluster created with IP Alias support.
resourceUsageExportConfig

object (ResourceUsageExportConfig)

Configuration for exporting resource usages. Resource usage export is disabled when this config is unspecified.
authenticatorGroupsConfig

object (AuthenticatorGroupsConfig)

Configuration controlling RBAC group membership information.
privateClusterConfig

object (PrivateClusterConfig)

Configuration for private cluster.
databaseEncryption

object (DatabaseEncryption)

Configuration of etcd encryption.
verticalPodAutoscaling

object (VerticalPodAutoscaling)

Cluster-level Vertical Pod Autoscaling configuration.
shieldedNodes

object (ShieldedNodes)

Shielded Nodes configuration.
releaseChannel

object (ReleaseChannel)

Release channel configuration. If left unspecified on cluster creation and a version is specified, the cluster is enrolled in the most mature release channel where the version is available (first checking STABLE, then REGULAR, and finally RAPID). Otherwise, if no release channel configuration and no version is specified, the cluster is enrolled in the REGULAR channel with its default version.
workloadIdentityConfig

object (WorkloadIdentityConfig)

Configuration for the use of Kubernetes Service Accounts in GCP IAM policies.
meshCertificates

object (MeshCertificates)

Configuration for issuance of mTLS keys and certificates to Kubernetes pods.
costManagementConfig

object (CostManagementConfig)

Configuration for the fine-grained cost management feature.
notificationConfig

object (NotificationConfig)

Notification configuration of the cluster.
confidentialNodes

object (ConfidentialNodes)

Configuration of Confidential Nodes. All the nodes in the cluster will be Confidential VM once enabled.
identityServiceConfig

object (IdentityServiceConfig)

Configuration for Identity Service component.
zone
(deprecated)

string

[Output only] The name of the Google Compute Engine zone in which the cluster resides. This field is deprecated, use location instead.
endpoint

string

[Output only] The IP address of this cluster's master endpoint. The endpoint can be accessed from the internet at https://username:password@endpoint/.

See the masterAuth property of this resource for username and password information.
initialClusterVersion

string

The initial Kubernetes version for this cluster. Valid versions are those found in validMasterVersions returned by getServerConfig. The version can be upgraded over time; such upgrades are reflected in currentMasterVersion and currentNodeVersion.

Users may specify either explicit versions offered by Kubernetes Engine or version aliases, which have the following behavior:

  • "latest": picks the highest valid Kubernetes version
  • "1.X": picks the highest valid patch+gke.N patch in the 1.X version
  • "1.X.Y": picks the highest valid gke.N patch in the 1.X.Y version
  • "1.X.Y-gke.N": picks an explicit Kubernetes version
  • "","-": picks the default Kubernetes version
currentMasterVersion

string

[Output only] The current software version of the master endpoint.
currentNodeVersion
(deprecated)

string

[Output only] Deprecated, use NodePools.version instead. The current version of the node software components. If they are currently at multiple versions because they're in the process of being upgraded, this reflects the minimum version of all nodes.
createTime

string

[Output only] The time the cluster was created, in RFC3339 text format.
status

enum (Status)

[Output only] The current status of this cluster.
statusMessage
(deprecated)

string

[Output only] Deprecated. Use conditions instead. Additional information about the current status of this cluster, if available.
nodeIpv4CidrSize

integer

[Output only] The size of the address space on each node for hosting containers. This is provisioned from within the container_ipv4_cidr range. This field will only be set when cluster is in route-based network mode.
servicesIpv4Cidr

string

[Output only] The IP address range of the Kubernetes services in this cluster, in CIDR notation (e.g. 1.2.3.4/29). Service addresses are typically put in the last /16 from the container CIDR.
instanceGroupUrls[]
(deprecated)

string

Deprecated. Use nodePools.instance_group_urls.
currentNodeCount
(deprecated)

integer

[Output only] The number of nodes currently in the cluster. Deprecated. Call Kubernetes API directly to retrieve node information.
expireTime

string

[Output only] The time the cluster will be automatically deleted in RFC3339 text format.
location

string

[Output only] The name of the Google Compute Engine zone or region in which the cluster resides.
enableTpu

boolean

Enable the ability to use Cloud TPUs in this cluster.
tpuIpv4CidrBlock

string

[Output only] The IP address range of the Cloud TPUs in this cluster, in CIDR notation (e.g. 1.2.3.4/29).
conditions[]

object (StatusCondition)

Which conditions caused the current cluster state.
autopilot

object (Autopilot)

Autopilot configuration for the cluster.
id

string

Output only. Unique id for the cluster.
loggingConfig

object (LoggingConfig)

Logging configuration for the cluster.
monitoringConfig

object (MonitoringConfig)

Monitoring configuration for the cluster.
nodePoolAutoConfig

object (NodePoolAutoConfig)

Node pool configs that apply to all auto-provisioned node pools in autopilot clusters and node auto-provisioning enabled clusters.
etag

string

This checksum is computed by the server based on the value of cluster fields, and may be sent on update requests to ensure the client has an up-to-date value before proceeding.
fleet

object (Fleet)

Fleet information for the cluster.
securityPostureConfig

object (SecurityPostureConfig)

Enable/Disable Security Posture API features for the cluster.
enableK8sBetaApis

object (K8sBetaAPIConfig)

Beta APIs Config
nodePoolDefaults

object (NodePoolDefaults)

Default NodePool settings for the entire cluster. These settings are overridden if specified on the specific NodePool object.

MasterAuth

The authentication information for accessing the master endpoint. Authentication can be done using HTTP basic auth or using client certificates.

JSON representation 
{
  "username": string,
  "password": string,
  "clientCertificateConfig": {
    object (ClientCertificateConfig)
  },
  "clusterCaCertificate": string,
  "clientCertificate": string,
  "clientKey": string
}
Fields
username
(deprecated)

string

The username to use for HTTP basic authentication to the master endpoint. For clusters v1.6.0 and later, basic authentication can be disabled by leaving username unspecified (or setting it to the empty string).

Warning: basic authentication is deprecated, and will be removed in GKE control plane versions 1.19 and newer. For a list of recommended authentication methods, see: https://cloud.google.com/kubernetes-engine/docs/how-to/api-server-authentication
password
(deprecated)

string

The password to use for HTTP basic authentication to the master endpoint. Because the master endpoint is open to the Internet, you should create a strong password. If a password is provided for cluster creation, username must be non-empty.

Warning: basic authentication is deprecated, and will be removed in GKE control plane versions 1.19 and newer. For a list of recommended authentication methods, see: https://cloud.google.com/kubernetes-engine/docs/how-to/api-server-authentication
clientCertificateConfig

object (ClientCertificateConfig)

Configuration for client certificate authentication on the cluster. For clusters before v1.12, if no configuration is specified, a client certificate is issued.
clusterCaCertificate

string

[Output only] Base64-encoded public certificate that is the root of trust for the cluster.
clientCertificate

string

[Output only] Base64-encoded public certificate used by clients to authenticate to the cluster endpoint.
clientKey

string

[Output only] Base64-encoded private key used by clients to authenticate to the cluster endpoint.

ClientCertificateConfig

Configuration for client certificates on the cluster.

JSON representation 
{
  "issueClientCertificate": boolean
}
Fields
issueClientCertificate

boolean

Issue a client certificate.

AddonsConfig

Configuration for the addons that can be automatically spun up in the cluster, enabling additional functionality.

JSON representation 
{
  "httpLoadBalancing": {
    object (HttpLoadBalancing)
  },
  "horizontalPodAutoscaling": {
    object (HorizontalPodAutoscaling)
  },
  "kubernetesDashboard": {
    object (KubernetesDashboard)
  },
  "networkPolicyConfig": {
    object (NetworkPolicyConfig)
  },
  "cloudRunConfig": {
    object (CloudRunConfig)
  },
  "dnsCacheConfig": {
    object (DnsCacheConfig)
  },
  "configConnectorConfig": {
    object (ConfigConnectorConfig)
  },
  "gcePersistentDiskCsiDriverConfig": {
    object (GcePersistentDiskCsiDriverConfig)
  },
  "gcpFilestoreCsiDriverConfig": {
    object (GcpFilestoreCsiDriverConfig)
  },
  "gkeBackupAgentConfig": {
    object (GkeBackupAgentConfig)
  },
  "gcsFuseCsiDriverConfig": {
    object (GcsFuseCsiDriverConfig)
  }
}
Fields
httpLoadBalancing

object (HttpLoadBalancing)

Configuration for the HTTP (L7) load balancing controller addon, which makes it easy to set up HTTP load balancers for services in a cluster.
horizontalPodAutoscaling

object (HorizontalPodAutoscaling)

Configuration for the horizontal pod autoscaling feature, which increases or decreases the number of replica pods a replication controller has based on the resource usage of the existing pods.
kubernetesDashboard
(deprecated)

object (KubernetesDashboard)

Configuration for the Kubernetes Dashboard. This addon is deprecated, and will be disabled in 1.15. It is recommended to use the Cloud Console to manage and monitor your Kubernetes clusters, workloads and applications. For more information, see: https://cloud.google.com/kubernetes-engine/docs/concepts/dashboards
networkPolicyConfig

object (NetworkPolicyConfig)

Configuration for NetworkPolicy. This only tracks whether the addon is enabled or not on the Master, it does not track whether network policy is enabled for the nodes.
cloudRunConfig

object (CloudRunConfig)

Configuration for the Cloud Run addon, which allows the user to use a managed Knative service.
dnsCacheConfig

object (DnsCacheConfig)

Configuration for NodeLocalDNS, a dns cache running on cluster nodes
configConnectorConfig

object (ConfigConnectorConfig)

Configuration for the ConfigConnector add-on, a Kubernetes extension to manage hosted GCP services through the Kubernetes API
gcePersistentDiskCsiDriverConfig

object (GcePersistentDiskCsiDriverConfig)

Configuration for the Compute Engine Persistent Disk CSI driver.
gcpFilestoreCsiDriverConfig

object (GcpFilestoreCsiDriverConfig)

Configuration for the GCP Filestore CSI driver.
gkeBackupAgentConfig

object (GkeBackupAgentConfig)

Configuration for the Backup for GKE agent addon.
gcsFuseCsiDriverConfig

object (GcsFuseCsiDriverConfig)

Configuration for the Cloud Storage Fuse CSI driver.

HttpLoadBalancing

Configuration options for the HTTP (L7) load balancing controller addon, which makes it easy to set up HTTP load balancers for services in a cluster.

JSON representation 
{
  "disabled": boolean
}
Fields
disabled

boolean

Whether the HTTP Load Balancing controller is enabled in the cluster. When enabled, it runs a small pod in the cluster that manages the load balancers.

HorizontalPodAutoscaling

Configuration options for the horizontal pod autoscaling feature, which increases or decreases the number of replica pods a replication controller has based on the resource usage of the existing pods.

JSON representation 
{
  "disabled": boolean
}
Fields
disabled

boolean

Whether the Horizontal Pod Autoscaling feature is enabled in the cluster. When enabled, it ensures that metrics are collected into Stackdriver Monitoring.

KubernetesDashboard

Configuration for the Kubernetes Dashboard.

JSON representation 
{
  "disabled": boolean
}
Fields
disabled

boolean

Whether the Kubernetes Dashboard is enabled for this cluster.

NetworkPolicyConfig

Configuration for NetworkPolicy. This only tracks whether the addon is enabled or not on the Master, it does not track whether network policy is enabled for the nodes.

JSON representation 
{
  "disabled": boolean
}
Fields
disabled

boolean

Whether NetworkPolicy is enabled for this cluster.

CloudRunConfig

Configuration options for the Cloud Run feature.

JSON representation 
{
  "disabled": boolean,
  "loadBalancerType": enum (LoadBalancerType)
}
Fields
disabled

boolean

Whether Cloud Run addon is enabled for this cluster.
loadBalancerType

enum (LoadBalancerType)

Which load balancer type is installed for Cloud Run.

LoadBalancerType

Load balancer type of ingress service of Cloud Run.

Enums
LOAD_BALANCER_TYPE_UNSPECIFIED Load balancer type for Cloud Run is unspecified.
LOAD_BALANCER_TYPE_EXTERNAL Install external load balancer for Cloud Run.
LOAD_BALANCER_TYPE_INTERNAL Install internal load balancer for Cloud Run.

DnsCacheConfig

Configuration for NodeLocal DNSCache

JSON representation 
{
  "enabled": boolean
}
Fields
enabled

boolean

Whether NodeLocal DNSCache is enabled for this cluster.

ConfigConnectorConfig

Configuration options for the Config Connector add-on.

JSON representation 
{
  "enabled": boolean
}
Fields
enabled

boolean

Whether Cloud Connector is enabled for this cluster.

GcePersistentDiskCsiDriverConfig

Configuration for the Compute Engine PD CSI driver.

JSON representation 
{
  "enabled": boolean
}
Fields
enabled

boolean

Whether the Compute Engine PD CSI driver is enabled for this cluster.

GcpFilestoreCsiDriverConfig

Configuration for the GCP Filestore CSI driver.

JSON representation 
{
  "enabled": boolean
}
Fields
enabled

boolean

Whether the GCP Filestore CSI driver is enabled for this cluster.

GkeBackupAgentConfig

Configuration for the Backup for GKE Agent.

JSON representation 
{
  "enabled": boolean
}
Fields
enabled

boolean

Whether the Backup for GKE agent is enabled for this cluster.

GcsFuseCsiDriverConfig

Configuration for the Cloud Storage Fuse CSI driver.

JSON representation 
{
  "enabled": boolean
}
Fields
enabled

boolean

Whether the Cloud Storage Fuse CSI driver is enabled for this cluster.

LegacyAbac

Configuration for the legacy Attribute Based Access Control authorization mode.

JSON representation 
{
  "enabled": boolean
}
Fields
enabled

boolean

Whether the ABAC authorizer is enabled for this cluster. When enabled, identities in the system, including service accounts, nodes, and controllers, will have statically granted permissions beyond those provided by the RBAC configuration or IAM.

NetworkPolicy

Configuration options for the NetworkPolicy feature. https://kubernetes.io/docs/concepts/services-networking/networkpolicies/

JSON representation 
{
  "provider": enum (Provider),
  "enabled": boolean
}
Fields
provider

enum (Provider)

The selected network policy provider.
enabled

boolean

Whether network policy is enabled on the cluster.

Provider

Allowed Network Policy providers.

Enums
PROVIDER_UNSPECIFIED Not set
CALICO Tigera (Calico Felix).

IPAllocationPolicy

Configuration for controlling how IPs are allocated in the cluster.

JSON representation 
{
  "useIpAliases": boolean,
  "createSubnetwork": boolean,
  "subnetworkName": string,
  "clusterIpv4Cidr": string,
  "nodeIpv4Cidr": string,
  "servicesIpv4Cidr": string,
  "clusterSecondaryRangeName": string,
  "servicesSecondaryRangeName": string,
  "clusterIpv4CidrBlock": string,
  "nodeIpv4CidrBlock": string,
  "servicesIpv4CidrBlock": string,
  "tpuIpv4CidrBlock": string,
  "useRoutes": boolean,
  "stackType": enum (StackType),
  "ipv6AccessType": enum (IPv6AccessType),
  "podCidrOverprovisionConfig": {
    object (PodCIDROverprovisionConfig)
  },
  "subnetIpv6CidrBlock": string,
  "servicesIpv6CidrBlock": string,
  "additionalPodRangesConfig": {
    object (AdditionalPodRangesConfig)
  },
  "defaultPodIpv4RangeUtilization": number
}
Fields
useIpAliases

boolean

Whether alias IPs will be used for pod IPs in the cluster. This is used in conjunction with useRoutes. It cannot be true if useRoutes is true. If both useIpAliases and useRoutes are false, then the server picks the default IP allocation mode
createSubnetwork

boolean

Whether a new subnetwork will be created automatically for the cluster.

This field is only applicable when useIpAliases is true.
subnetworkName

string

A custom subnetwork name to be used if createSubnetwork is true. If this field is empty, then an automatic name will be chosen for the new subnetwork.
clusterIpv4Cidr
(deprecated)

string

This field is deprecated, use clusterIpv4CidrBlock.
nodeIpv4Cidr
(deprecated)

string

This field is deprecated, use nodeIpv4CidrBlock.
servicesIpv4Cidr
(deprecated)

string

This field is deprecated, use servicesIpv4CidrBlock.
clusterSecondaryRangeName

string

The name of the secondary range to be used for the cluster CIDR block. The secondary range will be used for pod IP addresses. This must be an existing secondary range associated with the cluster subnetwork.

This field is only applicable with useIpAliases is true and createSubnetwork is false.
servicesSecondaryRangeName

string

The name of the secondary range to be used as for the services CIDR block. The secondary range will be used for service ClusterIPs. This must be an existing secondary range associated with the cluster subnetwork.

This field is only applicable with useIpAliases is true and createSubnetwork is false.
clusterIpv4CidrBlock

string

The IP address range for the cluster pod IPs. If this field is set, then cluster.cluster_ipv4_cidr must be left blank.

This field is only applicable when useIpAliases is true.

Set to blank to have a range chosen with the default size.

Set to /netmask (e.g. /14) to have a range chosen with a specific netmask.

Set to a CIDR notation (e.g. 10.96.0.0/14) from the RFC-1918 private networks (e.g. 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) to pick a specific range to use.
nodeIpv4CidrBlock

string

The IP address range of the instance IPs in this cluster.

This is applicable only if createSubnetwork is true.

Set to blank to have a range chosen with the default size.

Set to /netmask (e.g. /14) to have a range chosen with a specific netmask.

Set to a CIDR notation (e.g. 10.96.0.0/14) from the RFC-1918 private networks (e.g. 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) to pick a specific range to use.
servicesIpv4CidrBlock

string

The IP address range of the services IPs in this cluster. If blank, a range will be automatically chosen with the default size.

This field is only applicable when useIpAliases is true.

Set to blank to have a range chosen with the default size.

Set to /netmask (e.g. /14) to have a range chosen with a specific netmask.

Set to a CIDR notation (e.g. 10.96.0.0/14) from the RFC-1918 private networks (e.g. 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) to pick a specific range to use.
tpuIpv4CidrBlock

string

The IP address range of the Cloud TPUs in this cluster. If unspecified, a range will be automatically chosen with the default size.

This field is only applicable when useIpAliases is true.

If unspecified, the range will use the default size.

Set to /netmask (e.g. /14) to have a range chosen with a specific netmask.

Set to a CIDR notation (e.g. 10.96.0.0/14) from the RFC-1918 private networks (e.g. 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16) to pick a specific range to use.
useRoutes

boolean

Whether routes will be used for pod IPs in the cluster. This is used in conjunction with useIpAliases. It cannot be true if useIpAliases is true. If both useIpAliases and useRoutes are false, then the server picks the default IP allocation mode
stackType

enum (StackType)

The IP stack type of the cluster
ipv6AccessType

enum (IPv6AccessType)

The ipv6 access type (internal or external) when createSubnetwork is true
podCidrOverprovisionConfig

object (PodCIDROverprovisionConfig)

[PRIVATE FIELD] Pod CIDR size overprovisioning config for the cluster.

Pod CIDR size per node depends on maxPodsPerNode. By default, the value of maxPodsPerNode is doubled and then rounded off to next power of 2 to get the size of pod CIDR block per node. Example: maxPodsPerNode of 30 would result in 64 IPs (/26).

This config can disable the doubling of IPs (we still round off to next power of 2) Example: maxPodsPerNode of 30 will result in 32 IPs (/27) when overprovisioning is disabled.
subnetIpv6CidrBlock

string

Output only. [Output only] The subnet's IPv6 CIDR block used by nodes and pods.
servicesIpv6CidrBlock

string

Output only. [Output only] The services IPv6 CIDR block for the cluster.
additionalPodRangesConfig

object (AdditionalPodRangesConfig)

Output only. [Output only] The additional pod ranges that are added to the cluster. These pod ranges can be used by new node pools to allocate pod IPs automatically. Once the range is removed it will not show up in IPAllocationPolicy.
defaultPodIpv4RangeUtilization

number

Output only. [Output only] The utilization of the cluster default IPv4 range for the pod. The ratio is Usage/[Total number of IPs in the secondary range], Usage=numNodes*numZones*podIPsPerNode.

StackType

Possible values for IP stack type

Enums
STACK_TYPE_UNSPECIFIED Default value, will be defaulted as IPV4 only
IPV4 Cluster is IPV4 only
IPV4_IPV6 Cluster can use both IPv4 and IPv6

IPv6AccessType

Possible values for IPv6 access type

Enums
IPV6_ACCESS_TYPE_UNSPECIFIED Default value, will be defaulted as type external.
INTERNAL Access type internal (all v6 addresses are internal IPs)
EXTERNAL Access type external (all v6 addresses are external IPs)

AdditionalPodRangesConfig

AdditionalPodRangesConfig is the configuration for additional pod secondary ranges supporting the ClusterUpdate message.

JSON representation 
{
  "podRangeNames": [
    string
  ],
  "podRangeInfo": [
    {
      object (RangeInfo)
    }
  ]
}
Fields
podRangeNames[]

string

Name for pod secondary ipv4 range which has the actual range defined ahead.
podRangeInfo[]

object (RangeInfo)

Output only. [Output only] Information for additional pod range.

RangeInfo

RangeInfo contains the range name and the range utilization by this cluster.

JSON representation 
{
  "rangeName": string,
  "utilization": number
}
Fields
rangeName

string

Output only. [Output only] Name of a range.
utilization

number

Output only. [Output only] The utilization of the range.

MasterAuthorizedNetworksConfig

Configuration options for the master authorized networks feature. Enabled master authorized networks will disallow all external traffic to access Kubernetes master through HTTPS except traffic from the given CIDR blocks, Google Compute Engine Public IPs and Google Prod IPs.

JSON representation 
{
  "enabled": boolean,
  "cidrBlocks": [
    {
      object (CidrBlock)
    }
  ],
  "gcpPublicCidrsAccessEnabled": boolean
}
Fields
enabled

boolean

Whether or not master authorized networks is enabled.
cidrBlocks[]

object (CidrBlock)

cidrBlocks define up to 50 external networks that could access Kubernetes master through HTTPS.
gcpPublicCidrsAccessEnabled

boolean

Whether master is accessbile via Google Compute Engine Public IP addresses.

CidrBlock

CidrBlock contains an optional name and one CIDR block.

JSON representation 
{
  "displayName": string,
  "cidrBlock": string
}
Fields
displayName

string

displayName is an optional field for users to identify CIDR blocks.
cidrBlock

string

cidrBlock must be specified in CIDR notation.

MaintenancePolicy

MaintenancePolicy defines the maintenance policy to be used for the cluster.

JSON representation 
{
  "window": {
    object (MaintenanceWindow)
  },
  "resourceVersion": string
}
Fields
window

object (MaintenanceWindow)

Specifies the maintenance window in which maintenance may be performed.
resourceVersion

string

A hash identifying the version of this policy, so that updates to fields of the policy won't accidentally undo intermediate changes (and so that users of the API unaware of some fields won't accidentally remove other fields). Make a get() request to the cluster to get the current resource version and include it with requests to set the policy.

MaintenanceWindow

MaintenanceWindow defines the maintenance window to be used for the cluster.

JSON representation 
{
  "maintenanceExclusions": {
    string: {
      object (TimeWindow)
    },
    ...
  },

  // Union field policy can be only one of the following:
  "dailyMaintenanceWindow": {
    object (DailyMaintenanceWindow)
  },
  "recurringWindow": {
    object (RecurringTimeWindow)
  }
  // End of list of possible types for union field policy.
}
Fields
maintenanceExclusions

map (key: string, value: object (TimeWindow))

Exceptions to maintenance window. Non-emergency maintenance should not occur in these windows.

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.

Union field policy.

policy can be only one of the following:
dailyMaintenanceWindow

object (DailyMaintenanceWindow)

DailyMaintenanceWindow specifies a daily maintenance operation window.
recurringWindow

object (RecurringTimeWindow)

RecurringWindow specifies some number of recurring time periods for maintenance to occur. The time windows may be overlapping. If no maintenance windows are set, maintenance can occur at any time.

DailyMaintenanceWindow

Time window specified for daily maintenance operations.

JSON representation 
{
  "startTime": string,
  "duration": string
}
Fields
startTime

string

Time within the maintenance window to start the maintenance operations. Time format should be in RFC3339 format "HH:MM", where HH : [00-23] and MM : [00-59] GMT.
duration

string

[Output only] Duration of the time window, automatically chosen to be smallest possible in the given scenario. Duration will be in RFC3339 format "PTnHnMnS".

RecurringTimeWindow

Represents an arbitrary window of time that recurs.

JSON representation 
{
  "window": {
    object (TimeWindow)
  },
  "recurrence": string
}
Fields
window

object (TimeWindow)

The window of the first recurrence.
recurrence

string

An RRULE (https://tools.ietf.org/html/rfc5545#section-3.8.5.3) for how this window reccurs. They go on for the span of time between the start and end time.

For example, to have something repeat every weekday, you'd use: FREQ=WEEKLY;BYDAY=MO,TU,WE,TH,FR

To repeat some window daily (equivalent to the DailyMaintenanceWindow): FREQ=DAILY

For the first weekend of every month: FREQ=MONTHLY;BYSETPOS=1;BYDAY=SA,SU

This specifies how frequently the window starts. Eg, if you wanted to have a 9-5 UTC-4 window every weekday, you'd use something like:

start time = 2019-01-01T09:00:00-0400
end time = 2019-01-01T17:00:00-0400
recurrence = FREQ=WEEKLY;BYDAY=MO,TU,WE,TH,FR

Windows can span multiple days. Eg, to make the window encompass every weekend from midnight Saturday till the last minute of Sunday UTC:

start time = 2019-01-05T00:00:00Z
end time = 2019-01-07T23:59:00Z
recurrence = FREQ=WEEKLY;BYDAY=SA

Note the start and end time's specific dates are largely arbitrary except to specify duration of the window and when it first starts. The FREQ values of HOURLY, MINUTELY, and SECONDLY are not supported.

BinaryAuthorization

Configuration for Binary Authorization.

JSON representation 
{
  "enabled": boolean,
  "evaluationMode": enum (EvaluationMode)
}
Fields
enabled
(deprecated)

boolean

This field is deprecated. Leave this unset and instead configure BinaryAuthorization using evaluationMode. If evaluationMode is set to anything other than EVALUATION_MODE_UNSPECIFIED, this field is ignored.
evaluationMode

enum (EvaluationMode)

Mode of operation for binauthz policy evaluation. If unspecified, defaults to DISABLED.

EvaluationMode

Binary Authorization mode of operation.

Enums
EVALUATION_MODE_UNSPECIFIED Default value
DISABLED Disable BinaryAuthorization
PROJECT_SINGLETON_POLICY_ENFORCE Enforce Kubernetes admission requests with BinaryAuthorization using the project's singleton policy. This is equivalent to setting the enabled boolean to true.

ClusterAutoscaling

ClusterAutoscaling contains global, per-cluster information required by Cluster Autoscaler to automatically adjust the size of the cluster and create/delete node pools based on the current needs.

JSON representation 
{
  "enableNodeAutoprovisioning": boolean,
  "resourceLimits": [
    {
      object (ResourceLimit)
    }
  ],
  "autoscalingProfile": enum (AutoscalingProfile),
  "autoprovisioningNodePoolDefaults": {
    object (AutoprovisioningNodePoolDefaults)
  },
  "autoprovisioningLocations": [
    string
  ]
}
Fields
enableNodeAutoprovisioning

boolean

Enables automatic node pool creation and deletion.
resourceLimits[]

object (ResourceLimit)

Contains global constraints regarding minimum and maximum amount of resources in the cluster.
autoscalingProfile

enum (AutoscalingProfile)

Defines autoscaling behaviour.
autoprovisioningNodePoolDefaults

object (AutoprovisioningNodePoolDefaults)

AutoprovisioningNodePoolDefaults contains defaults for a node pool created by NAP.
autoprovisioningLocations[]

string

The list of Google Compute Engine zones in which the NodePool's nodes can be created by NAP.

ResourceLimit

Contains information about amount of some resource in the cluster. For memory, value should be in GB.

JSON representation 
{
  "resourceType": string,
  "minimum": string,
  "maximum": string
}
Fields
resourceType

string

Resource name "cpu", "memory" or gpu-specific string.
minimum

string (int64 format)

Minimum amount of the resource in the cluster.
maximum

string (int64 format)

Maximum amount of the resource in the cluster.

AutoscalingProfile

Defines possible options for autoscalingProfile field.

Enums
PROFILE_UNSPECIFIED No change to autoscaling configuration.
OPTIMIZE_UTILIZATION Prioritize optimizing utilization of resources.
BALANCED Use default (balanced) autoscaling configuration.

AutoprovisioningNodePoolDefaults

AutoprovisioningNodePoolDefaults contains defaults for a node pool created by NAP.

JSON representation 
{
  "oauthScopes": [
    string
  ],
  "serviceAccount": string,
  "upgradeSettings": {
    object (UpgradeSettings)
  },
  "management": {
    object (NodeManagement)
  },
  "minCpuPlatform": string,
  "diskSizeGb": integer,
  "diskType": string,
  "shieldedInstanceConfig": {
    object (ShieldedInstanceConfig)
  },
  "bootDiskKmsKey": string,
  "imageType": string,
  "insecureKubeletReadonlyPortEnabled": boolean
}
Fields
oauthScopes[]

string

Scopes that are used by NAP when creating node pools.
serviceAccount

string

The Google Cloud Platform Service Account to be used by the node VMs.
upgradeSettings

object (UpgradeSettings)

Specifies the upgrade settings for NAP created node pools
management

object (NodeManagement)

Specifies the node management options for NAP created node-pools.
minCpuPlatform
(deprecated)

string

Deprecated. Minimum CPU platform to be used for NAP created node pools. The instance may be scheduled on the specified or newer CPU platform. Applicable values are the friendly names of CPU platforms, such as minCpuPlatform: Intel Haswell or minCpuPlatform: Intel Sandy Bridge. For more information, read how to specify min CPU platform. This field is deprecated, minCpuPlatform should be specified using cloud.google.com/requested-min-cpu-platform label selector on the pod. To unset the min cpu platform field pass "automatic" as field value.
diskSizeGb

integer

Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB.

If unspecified, the default disk size is 100GB.
diskType

string

Type of the disk attached to each node (e.g. 'pd-standard', 'pd-ssd' or 'pd-balanced')

If unspecified, the default disk type is 'pd-standard'
shieldedInstanceConfig

object (ShieldedInstanceConfig)

Shielded Instance options.
bootDiskKmsKey

string

The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption
imageType

string

The image type to use for NAP created node. Please see https://cloud.google.com/kubernetes-engine/docs/concepts/node-images for available image types.
insecureKubeletReadonlyPortEnabled

boolean

Enable or disable Kubelet read only port.

NetworkConfig

NetworkConfig reports the relative names of network & subnetwork.

JSON representation 
{
  "network": string,
  "subnetwork": string,
  "enableIntraNodeVisibility": boolean,
  "defaultSnatStatus": {
    object (DefaultSnatStatus)
  },
  "enableL4ilbSubsetting": boolean,
  "datapathProvider": enum (DatapathProvider),
  "privateIpv6GoogleAccess": enum (PrivateIPv6GoogleAccess),
  "dnsConfig": {
    object (DNSConfig)
  },
  "serviceExternalIpsConfig": {
    object (ServiceExternalIPsConfig)
  },
  "gatewayApiConfig": {
    object (GatewayAPIConfig)
  },
  "enableMultiNetworking": boolean,
  "networkPerformanceConfig": {
    object (ClusterNetworkPerformanceConfig)
  },
  "enableFqdnNetworkPolicy": boolean
}
Fields
network

string

Output only. The relative name of the Google Compute Engine network(https://cloud.google.com/compute/docs/networks-and-firewalls#networks) to which the cluster is connected. Example: projects/my-project/global/networks/my-network
subnetwork

string

Output only. The relative name of the Google Compute Engine subnetwork to which the cluster is connected. Example: projects/my-project/regions/us-central1/subnetworks/my-subnet
enableIntraNodeVisibility

boolean

Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network.
defaultSnatStatus

object (DefaultSnatStatus)

Whether the cluster disables default in-node sNAT rules. In-node sNAT rules will be disabled when defaultSnatStatus is disabled. When disabled is set to false, default IP masquerade rules will be applied to the nodes to prevent sNAT on cluster internal traffic.
enableL4ilbSubsetting

boolean

Whether L4ILB Subsetting is enabled for this cluster.
datapathProvider

enum (DatapathProvider)

The desired datapath provider for this cluster. By default, uses the IPTables-based kube-proxy implementation.
privateIpv6GoogleAccess

enum (PrivateIPv6GoogleAccess)

The desired state of IPv6 connectivity to Google Services. By default, no private IPv6 access to or from Google Services (all access will be via IPv4)
dnsConfig

object (DNSConfig)

DNSConfig contains clusterDNS config for this cluster.
serviceExternalIpsConfig

object (ServiceExternalIPsConfig)

ServiceExternalIPsConfig specifies if services with externalIPs field are blocked or not.
gatewayApiConfig

object (GatewayAPIConfig)

GatewayAPIConfig contains the desired config of Gateway API on this cluster.
enableMultiNetworking

boolean

Whether multi-networking is enabled for this cluster.
networkPerformanceConfig

object (ClusterNetworkPerformanceConfig)

Network bandwidth tier configuration.
enableFqdnNetworkPolicy

boolean

Whether FQDN Network Policy is enabled on this cluster.

DefaultSnatStatus

DefaultSnatStatus contains the desired state of whether default sNAT should be disabled on the cluster.

JSON representation 
{
  "disabled": boolean
}
Fields
disabled

boolean

Disables cluster default sNAT rules.

DatapathProvider

The datapath provider selects the implementation of the Kubernetes networking model for service resolution and network policy enforcement.

Enums
DATAPATH_PROVIDER_UNSPECIFIED Default value.
LEGACY_DATAPATH Use the IPTables implementation based on kube-proxy.
ADVANCED_DATAPATH Use the eBPF based GKE Dataplane V2 with additional features. See the GKE Dataplane V2 documentation for more.

PrivateIPv6GoogleAccess

PrivateIPv6GoogleAccess controls whether and how the pods can communicate with Google Services through gRPC over IPv6.

Enums
PRIVATE_IPV6_GOOGLE_ACCESS_UNSPECIFIED Default value. Same as DISABLED
PRIVATE_IPV6_GOOGLE_ACCESS_DISABLED No private access to or from Google Services
PRIVATE_IPV6_GOOGLE_ACCESS_TO_GOOGLE Enables private IPv6 access to Google Services from GKE
PRIVATE_IPV6_GOOGLE_ACCESS_BIDIRECTIONAL Enables private IPv6 access to and from Google Services

DNSConfig

DNSConfig contains the desired set of options for configuring clusterDNS.

JSON representation 
{
  "clusterDns": enum (Provider),
  "clusterDnsScope": enum (DNSScope),
  "clusterDnsDomain": string
}
Fields
clusterDns

enum (Provider)

clusterDns indicates which in-cluster DNS provider should be used.
clusterDnsScope

enum (DNSScope)

clusterDnsScope indicates the scope of access to cluster DNS records.
clusterDnsDomain

string

clusterDnsDomain is the suffix used for all cluster service records.

Provider

Provider lists the various in-cluster DNS providers.

Enums
PROVIDER_UNSPECIFIED Default value
PLATFORM_DEFAULT Use GKE default DNS provider(kube-dns) for DNS resolution.
CLOUD_DNS Use CloudDNS for DNS resolution.
KUBE_DNS Use KubeDNS for DNS resolution.

DNSScope

DNSScope lists the various scopes of access to cluster DNS records.

Enums
DNS_SCOPE_UNSPECIFIED Default value, will be inferred as cluster scope.
CLUSTER_SCOPE DNS records are accessible from within the cluster.
VPC_SCOPE DNS records are accessible from within the VPC.

ServiceExternalIPsConfig

Config to block services with externalIPs field.

JSON representation 
{
  "enabled": boolean
}
Fields
enabled

boolean

Whether Services with ExternalIPs field are allowed or not.

GatewayAPIConfig

GatewayAPIConfig contains the desired config of Gateway API on this cluster.

JSON representation 
{
  "channel": enum (Channel)
}
Fields
channel

enum (Channel)

The Gateway API release channel to use for Gateway API.

Channel

Channel describes if/how Gateway API should be installed and implemented in a cluster.

Enums
CHANNEL_UNSPECIFIED Default value.
CHANNEL_DISABLED Gateway API support is disabled
CHANNEL_EXPERIMENTAL Gateway API support is enabled, experimental CRDs are installed
CHANNEL_STANDARD Gateway API support is enabled, standard CRDs are installed

ClusterNetworkPerformanceConfig

Configuration of network bandwidth tiers

JSON representation 
{
  "totalEgressBandwidthTier": enum (Tier)
}
Fields
totalEgressBandwidthTier

enum (Tier)

Specifies the total network bandwidth tier for NodePools in the cluster.

Tier

Node network tier

Enums
TIER_UNSPECIFIED Default value
TIER_1 Higher bandwidth, actual values based on VM size.

ResourceUsageExportConfig

Configuration for exporting cluster resource usages.

JSON representation 
{
  "bigqueryDestination": {
    object (BigQueryDestination)
  },
  "enableNetworkEgressMetering": boolean,
  "consumptionMeteringConfig": {
    object (ConsumptionMeteringConfig)
  }
}
Fields
bigqueryDestination

object (BigQueryDestination)

Configuration to use BigQuery as usage export destination.
enableNetworkEgressMetering

boolean

Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic.
consumptionMeteringConfig

object (ConsumptionMeteringConfig)

Configuration to enable resource consumption metering.

BigQueryDestination

Parameters for using BigQuery as the destination of resource usage export.

JSON representation