REST Resource: projects.locations.memberships

Resource: Membership

Membership contains information about a member cluster.

JSON representation 
{
  "name": string,
  "labels": {
    string: string,
    ...
  },
  "description": string,
  "state": {
    object (MembershipState)
  },
  "authority": {
    object (Authority)
  },
  "createTime": string,
  "updateTime": string,
  "deleteTime": string,
  "externalId": string,
  "lastConnectionTime": string,
  "uniqueId": string,
  "infrastructureType": enum (Membership.InfrastructureType),
  "monitoringConfig": {
    object (MonitoringConfig)
  },

  // Union field type can be only one of the following:
  "endpoint": {
    object (MembershipEndpoint)
  }
  // End of list of possible types for union field type.
}
Fields
name

string

Output only. The full, unique name of this Membership resource in the format projects/*/locations/*/memberships/{membershipId}, set during creation.

membershipId must be a valid RFC 1123 compliant DNS label:

  1. At most 63 characters in length
  2. It must consist of lower case alphanumeric characters or -
  3. It must start and end with an alphanumeric character

Which can be expressed as the regex: [a-z0-9]([-a-z0-9]*[a-z0-9])?, with a maximum length of 63 characters.
labels

map (key: string, value: string)

Optional. GCP labels for this membership.

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
description

string

Optional. Description of this membership, limited to 63 characters. Must match the regex: [a-zA-Z0-9][a-zA-Z0-9_\-\.\ ]*
state

object (MembershipState)

Output only. State of the Membership resource.
authority

object (Authority)

Optional. How to identify workloads from this Membership. See the documentation on Workload Identity for more details: https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity
createTime

string (Timestamp format)

Output only. When the Membership was created.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
updateTime

string (Timestamp format)

Output only. When the Membership was last updated.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
deleteTime

string (Timestamp format)

Output only. When the Membership was deleted.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
externalId

string

Optional. An externally-generated and managed ID for this Membership. This ID may be modified after creation, but this is not recommended. For GKE clusters, externalId is managed by the Hub API and updates will be ignored.

The ID must match the regex: [a-zA-Z0-9][a-zA-Z0-9_\-\.]*

If this Membership represents a Kubernetes cluster, this value should be set to the UID of the kube-system namespace object.
lastConnectionTime

string (Timestamp format)

Output only. For clusters using Connect, the timestamp of the most recent connection established with Google Cloud. This time is updated every several minutes, not continuously. For clusters that do not use GKE Connect, or that have never connected successfully, this field will be unset.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
uniqueId

string

Output only. Google-generated UUID for this resource. This is unique across all Membership resources. If a Membership resource is deleted and another resource with the same name is created, it gets a different uniqueId.
infrastructureType

enum (Membership.InfrastructureType)

Optional. The infrastructure type this Membership is running on.
monitoringConfig

object (MonitoringConfig)

Optional. The monitoring config information for this membership.
Union field type. Type of resource represented by this Membership type can be only one of the following:
endpoint

object (MembershipEndpoint)

Optional. Endpoint information to reach this member.

MembershipEndpoint

MembershipEndpoint contains information needed to contact a Kubernetes API, endpoint and any additional Kubernetes metadata.

JSON representation 
{
  "kubernetesMetadata": {
    object (KubernetesMetadata)
  },
  "kubernetesResource": {
    object (KubernetesResource)
  },

  // Union field type can be only one of the following:
  "gkeCluster": {
    object (GkeCluster)
  },
  "onPremCluster": {
    object (OnPremCluster)
  },
  "multiCloudCluster": {
    object (MultiCloudCluster)
  },
  "edgeCluster": {
    object (EdgeCluster)
  },
  "applianceCluster": {
    object (ApplianceCluster)
  }
  // End of list of possible types for union field type.
}
Fields
kubernetesMetadata

object (KubernetesMetadata)

Output only. Useful Kubernetes-specific metadata.
kubernetesResource

object (KubernetesResource)

Optional. The in-cluster Kubernetes Resources that should be applied for a correctly registered cluster, in the steady state. These resources:

  • Ensure that the cluster is exclusively registered to one and only one Hub Membership.
  • Propagate Workload Pool Information available in the Membership Authority field.
  • Ensure proper initial configuration of default Hub Features.
Union field type. Cluster information of the registered cluster. type can be only one of the following:
gkeCluster

object (GkeCluster)

Optional. Specific information for a GKE-on-GCP cluster.
onPremCluster

object (OnPremCluster)

Optional. Specific information for a GKE On-Prem cluster. An onprem user-cluster who has no resourceLink is not allowed to use this field, it should have a nil "type" instead.
multiCloudCluster

object (MultiCloudCluster)

Optional. Specific information for a GKE Multi-Cloud cluster.
edgeCluster

object (EdgeCluster)

Optional. Specific information for a Google Edge cluster.
applianceCluster

object (ApplianceCluster)

Optional. Specific information for a GDC Edge Appliance cluster.

GkeCluster

GkeCluster contains information specific to GKE clusters.

JSON representation 
{
  "resourceLink": string,
  "clusterMissing": boolean
}
Fields
clusterMissing

boolean

Output only. If clusterMissing is set then it denotes that the GKE cluster no longer exists in the GKE Control Plane.

OnPremCluster

OnPremCluster contains information specific to GKE On-Prem clusters.

JSON representation 
{
  "resourceLink": string,
  "clusterMissing": boolean,
  "adminCluster": boolean,
  "clusterType": enum (OnPremCluster.ClusterType)
}
Fields
clusterMissing

boolean

Output only. If clusterMissing is set then it denotes that API(gkeonprem.googleapis.com) resource for this GKE On-Prem cluster no longer exists.
adminCluster

boolean

Immutable. Whether the cluster is an admin cluster.
clusterType

enum (OnPremCluster.ClusterType)

Immutable. The on prem cluster's type.

OnPremCluster.ClusterType

ClusterType describes on prem cluster's type.

Enums
CLUSTERTYPE_UNSPECIFIED The ClusterType is not set.
BOOTSTRAP The ClusterType is bootstrap cluster.
HYBRID The ClusterType is baremetal hybrid cluster.
STANDALONE The ClusterType is baremetal standalone cluster.
USER The ClusterType is user cluster.

MultiCloudCluster

MultiCloudCluster contains information specific to GKE Multi-Cloud clusters.

JSON representation 
{
  "resourceLink": string,
  "clusterMissing": boolean
}
Fields
clusterMissing

boolean

Output only. If clusterMissing is set then it denotes that API(gkemulticloud.googleapis.com) resource for this GKE Multi-Cloud cluster no longer exists.

EdgeCluster

EdgeCluster contains information specific to Google Edge Clusters.

JSON representation 
{
  "resourceLink": string
}
Fields

ApplianceCluster

ApplianceCluster contains information specific to GDC Edge Appliance Clusters.

JSON representation 
{
  "resourceLink": string
}
Fields

KubernetesMetadata

KubernetesMetadata provides informational metadata for Memberships representing Kubernetes clusters.

JSON representation 
{
  "kubernetesApiServerVersion": string,
  "nodeProviderId": string,
  "nodeCount": integer,
  "vcpuCount": integer,
  "memoryMb": integer,
  "updateTime": string
}
Fields
kubernetesApiServerVersion

string

Output only. Kubernetes API server version string as reported by '/version'.
nodeProviderId

string

Output only. Node providerID as reported by the first node in the list of nodes on the Kubernetes endpoint. On Kubernetes platforms that support zero-node clusters (like GKE-on-GCP), the nodeCount will be zero and the nodeProviderId will be empty.
nodeCount

integer

Output only. Node count as reported by Kubernetes nodes resources.
vcpuCount

integer

Output only. vCPU count as reported by Kubernetes nodes resources.
memoryMb

integer

Output only. The total memory capacity as reported by the sum of all Kubernetes nodes resources, defined in MB.
updateTime

string (Timestamp format)

Output only. The time at which these details were last updated. This updateTime is different from the Membership-level updateTime since EndpointDetails are updated internally for API consumers.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

KubernetesResource

KubernetesResource contains the YAML manifests and configuration for Membership Kubernetes resources in the cluster. After memberships.create or memberships.patch, these resources should be re-applied in the cluster.

JSON representation 
{
  "membershipCrManifest": string,
  "membershipResources": [
    {
      object (ResourceManifest)
    }
  ],
  "connectResources": [
    {
      object (ResourceManifest)
    }
  ],
  "resourceOptions": {
    object (ResourceOptions)
  }
}
Fields
membershipCrManifest

string

Input only. The YAML representation of the Membership CR. This field is ignored for GKE clusters where Hub can read the CR directly.

Callers should provide the CR that is currently present in the cluster during memberships.create or memberships.patch, or leave this field empty if none exists. The CR manifest is used to validate the cluster has not been registered with another Membership.
membershipResources[]

object (ResourceManifest)

Output only. Additional Kubernetes resources that need to be applied to the cluster after Membership creation, and after every update.

This field is only populated in the Membership returned from a successful long-running operation from memberships.create or memberships.patch. It is not populated during normal memberships.get or memberships.list requests. To get the resource manifest after the initial registration, the caller should make a memberships.patch call with an empty field mask.
connectResources[]

object (ResourceManifest)

Output only. The Kubernetes resources for installing the GKE Connect agent

This field is only populated in the Membership returned from a successful long-running operation from memberships.create or memberships.patch. It is not populated during normal memberships.get or memberships.list requests. To get the resource manifest after the initial registration, the caller should make a memberships.patch call with an empty field mask.
resourceOptions

object (ResourceOptions)

Optional. Options for Kubernetes resource generation.

ResourceManifest

ResourceManifest represents a single Kubernetes resource to be applied to the cluster.

JSON representation 
{
  "manifest": string,
  "clusterScoped": boolean
}
Fields
manifest

string

YAML manifest of the resource.
clusterScoped

boolean

Whether the resource provided in the manifest is clusterScoped. If unset, the manifest is assumed to be namespace scoped.

This field is used for REST mapping when applying the resource in a cluster.

ResourceOptions

ResourceOptions represent options for Kubernetes resource generation.

JSON representation 
{
  "connectVersion": string,
  "v1beta1Crd": boolean,
  "k8sVersion": string
}
Fields
connectVersion

string

Optional. The Connect agent version to use for connectResources. Defaults to the latest GKE Connect version. The version must be a currently supported version, obsolete versions will be rejected.
v1beta1Crd

boolean

Optional. Use apiextensions/v1beta1 instead of apiextensions/v1 for CustomResourceDefinition resources. This option should be set for clusters with Kubernetes apiserver versions <1.16.
k8sVersion

string

Optional. Major version of the Kubernetes cluster. This is only used to determine which version to use for the CustomResourceDefinition resources, apiextensions/v1beta1 orapiextensions/v1.

MembershipState

State of the Membership resource.

JSON representation 
{
  "code": enum (MembershipState.Code),
  "description": string,
  "updateTime": string
}
Fields
code

enum (MembershipState.Code)

Output only. The current state of the Membership resource.
description
(deprecated)

string

This field is never set by the Hub Service.
updateTime
(deprecated)

string (Timestamp format)

This field is never set by the Hub Service.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".

MembershipState.Code

Code describes the state of a Membership resource.

Enums
CODE_UNSPECIFIED The code is not set.
CREATING The cluster is being registered.
READY The cluster is registered.
DELETING The cluster is being unregistered.
UPDATING The Membership is being updated.
SERVICE_UPDATING The Membership is being updated by the Hub Service.

Authority

Authority encodes how Google will recognize identities from this Membership. See the workload identity documentation for more details: https://cloud.google.com/kubernetes-engine/docs/how-to/workload-identity

JSON representation 
{
  "issuer": string,
  "workloadIdentityPool": string,
  "identityProvider": string,
  "oidcJwks": string,
  "scopeTenancyWorkloadIdentityPool": string,
  "scopeTenancyIdentityProvider": string
}
Fields
issuer

string

Optional. A JSON Web Token (JWT) issuer URI. issuer must start with https:// and be a valid URL with length <2000 characters.

If set, then Google will allow valid OIDC tokens from this issuer to authenticate within the workloadIdentityPool. OIDC discovery will be performed on this URI to validate tokens from the issuer.

Clearing issuer disables Workload Identity. issuer cannot be directly modified; it must be cleared (and Workload Identity disabled) before using a new issuer (and re-enabling Workload Identity).
workloadIdentityPool

string

Output only. The name of the workload identity pool in which issuer will be recognized.

There is a single Workload Identity Pool per Hub that is shared between all Memberships that belong to that Hub. For a Hub hosted in {PROJECT_ID}, the workload pool format is {PROJECT_ID}.hub.id.goog, although this is subject to change in newer versions of this API.
identityProvider

string

Output only. An identity provider that reflects the issuer in the workload identity pool.
oidcJwks

string (bytes format)

Optional. OIDC verification keys for this Membership in JWKS format (RFC 7517).

When this field is set, OIDC discovery will NOT be performed on issuer, and instead OIDC tokens will be validated using this field.

A base64-encoded string.
scopeTenancyWorkloadIdentityPool

string

Optional. Output only. The name of the scope-tenancy workload identity pool. This pool is set in the fleet-level feature.
scopeTenancyIdentityProvider

string

Optional. Output only. The identity provider for the scope-tenancy workload identity pool.

Membership.InfrastructureType

Specifies the infrastructure type of a Membership. Infrastructure type is used by Hub to control infrastructure-specific behavior, including pricing.

Each GKE distribution (on-GCP, on-Prem, on-X,...) will set this field automatically, but Attached Clusters customers should specify a type during registration.

Enums
INFRASTRUCTURE_TYPE_UNSPECIFIED No type was specified. Some Hub functionality may require a type be specified, and will not support Memberships with this value.
ON_PREM Private infrastructure that is owned or operated by customer. This includes GKE distributions such as GKE-OnPrem and GKE-OnBareMetal.
MULTI_CLOUD Public cloud infrastructure.

MonitoringConfig

MonitoringConfig informs Fleet-based applications/services/UIs how the metrics for the underlying cluster is reported to cloud monitoring services. It can be set from empty to non-empty, but can't be mutated directly to prevent accidentally breaking the constinousty of metrics.

JSON representation 
{
  "projectId": string,
  "location": string,
  "cluster": string,
  "kubernetesMetricsPrefix": string,
  "clusterHash": string
}
Fields
projectId

string

Optional. Project used to report Metrics
location

string

Optional. Location used to report Metrics
cluster

string

Optional. Cluster name used to report metrics. For Anthos on VMWare/Baremetal/MultiCloud clusters, it would be in format {clusterType}/{clusterName}, e.g., "awsClusters/cluster_1".
kubernetesMetricsPrefix

string

Optional. Kubernetes system metrics, if available, are written to this prefix. This defaults to kubernetes.io for GKE, and kubernetes.io/anthos for Anthos eventually. Noted: Anthos MultiCloud will have kubernetes.io prefix today but will migration to be under kubernetes.io/anthos.
clusterHash

string

Optional. For GKE and Multicloud clusters, this is the UUID of the cluster resource. For VMWare and Baremetal clusters, this is the kube-system UID.

Methods

create

 Creates a new Membership.

delete

 Removes a Membership.

generateConnectManifest

 Generates the manifest for deployment of the GKE connect agent.

generateExclusivityManifest

 GenerateExclusivityManifest generates the manifests to update the exclusivity artifacts in the cluster if needed.

get

 Gets the details of a Membership.

getIamPolicy

 Gets the access control policy for a resource.

list

 Lists Memberships in a given project and location.

patch

 Updates an existing Membership.

setIamPolicy

 Sets the access control policy on the specified resource.

testIamPermissions

 Returns permissions that a caller has on the specified resource.

validateExclusivity

 ValidateExclusivity validates the state of exclusivity in the cluster.