- Resource: AwsCluster
- AwsClusterNetworking
- AwsControlPlane
- AwsDatabaseEncryption
- AwsServicesAuthentication
- AwsAuthorization
- AwsClusterUser
- AwsClusterGroup
- State
- AwsClusterError
- Methods
Resource: AwsCluster
An Anthos cluster running on AWS.
JSON representation |
---|
{ "name": string, "description": string, "networking": { object ( |
Fields | |
---|---|
name |
The name of this resource. Cluster names are formatted as See Resource Names for more details on Google Cloud Platform resource names. |
description |
Optional. A human readable description of this cluster. Cannot be longer than 255 UTF-8 encoded bytes. |
networking |
Required. Cluster-wide networking configuration. |
awsRegion |
Required. The AWS region where the cluster runs. Each Google Cloud region supports a subset of nearby AWS regions. You can call |
controlPlane |
Required. Configuration related to the cluster control plane. |
authorization |
Required. Configuration related to the cluster RBAC settings. |
state |
Output only. The current state of the cluster. |
endpoint |
Output only. The endpoint of the cluster's API server. |
uid |
Output only. A globally unique identifier for the cluster. |
reconciling |
Output only. If set, there are currently changes in flight to the cluster. |
createTime |
Output only. The time at which this cluster was created. A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: |
updateTime |
Output only. The time at which this cluster was last updated. A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: |
etag |
Allows clients to perform consistent read-modify-writes through optimistic concurrency control. Can be sent on update and delete requests to ensure the client has an up-to-date value before proceeding. |
annotations |
Optional. Annotations on the cluster. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Key can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between. An object containing a list of |
workloadIdentityConfig |
Output only. Workload Identity settings. |
clusterCaCertificate |
Output only. PEM encoded x509 certificate of the cluster root of trust. |
fleet |
Required. Fleet configuration. |
loggingConfig |
Optional. Logging configuration for this cluster. |
errors[] |
Output only. A set of errors found in the cluster. |
monitoringConfig |
Optional. Monitoring configuration for this cluster. |
binaryAuthorization |
Optional. Binary Authorization configuration for this cluster. |
AwsClusterNetworking
ClusterNetworking defines cluster-wide networking configuration.
Anthos clusters on AWS run on a single VPC. This includes control plane replicas and node pool nodes.
JSON representation |
---|
{ "vpcId": string, "podAddressCidrBlocks": [ string ], "serviceAddressCidrBlocks": [ string ], "perNodePoolSgRulesDisabled": boolean } |
Fields | |
---|---|
vpcId |
Required. The VPC associated with the cluster. All component clusters (i.e. control plane and node pools) run on a single VPC. This field cannot be changed after creation. |
podAddressCidrBlocks[] |
Required. All pods in the cluster are assigned an IPv4 address from these ranges. Only a single range is supported. This field cannot be changed after creation. |
serviceAddressCidrBlocks[] |
Required. All services in the cluster are assigned an IPv4 address from these ranges. Only a single range is supported. This field cannot be changed after creation. |
perNodePoolSgRulesDisabled |
Optional. Disable the per node pool subnet security group rules on the control plane security group. When set to true, you must also provide one or more security groups that ensure node pools are able to send requests to the control plane on TCP/443 and TCP/8132. Failure to do so may result in unavailable node pools. |
AwsControlPlane
ControlPlane defines common parameters between control plane nodes.
JSON representation |
---|
{ "version": string, "instanceType": string, "sshConfig": { object ( |
Fields | |
---|---|
version |
Required. The Kubernetes version to run on control plane replicas (e.g. You can list all supported versions on a given Google Cloud region by calling |
instanceType |
Optional. The AWS instance type. When unspecified, it uses a default based on the cluster's version. |
sshConfig |
Optional. SSH configuration for how to access the underlying control plane machines. |
subnetIds[] |
Required. The list of subnets where control plane replicas will run. A replica will be provisioned on each subnet and up to three values can be provided. Each subnet must be in a different AWS Availability Zone (AZ). |
securityGroupIds[] |
Optional. The IDs of additional security groups to add to control plane replicas. The Anthos Multi-Cloud API will automatically create and manage security groups with the minimum rules needed for a functioning cluster. |
iamInstanceProfile |
Required. The name or ARN of the AWS IAM instance profile to assign to each control plane replica. |
rootVolume |
Optional. Configuration related to the root volume provisioned for each control plane replica. Volumes will be provisioned in the availability zone associated with the corresponding subnet. When unspecified, it defaults to 32 GiB with the GP2 volume type. |
mainVolume |
Optional. Configuration related to the main volume provisioned for each control plane replica. The main volume is in charge of storing all of the cluster's etcd state. Volumes will be provisioned in the availability zone associated with the corresponding subnet. When unspecified, it defaults to 8 GiB with the GP2 volume type. |
databaseEncryption |
Required. The ARN of the AWS KMS key used to encrypt cluster secrets. |
tags |
Optional. A set of AWS resource tags to propagate to all underlying managed AWS resources. Specify at most 50 pairs containing alphanumerics, spaces, and symbols (.+-=_:@/). Keys can be up to 127 Unicode characters. Values can be up to 255 Unicode characters. An object containing a list of |
awsServicesAuthentication |
Required. Authentication configuration for management of AWS resources. |
proxyConfig |
Optional. Proxy configuration for outbound HTTP(S) traffic. |
configEncryption |
Required. Config encryption for user data. |
instancePlacement |
Optional. The placement to use on control plane instances. When unspecified, the VPC's default tenancy will be used. |
AwsDatabaseEncryption
Configuration related to application-layer secrets encryption.
JSON representation |
---|
{ "kmsKeyArn": string } |
Fields | |
---|---|
kmsKeyArn |
Required. The ARN of the AWS KMS key used to encrypt cluster secrets. |
AwsServicesAuthentication
Authentication configuration for the management of AWS resources.
JSON representation |
---|
{ "roleArn": string, "roleSessionName": string } |
Fields | |
---|---|
roleArn |
Required. The Amazon Resource Name (ARN) of the role that the Anthos Multi-Cloud API will assume when managing AWS resources on your account. |
roleSessionName |
Optional. An identifier for the assumed role session. When unspecified, it defaults to |
AwsAuthorization
Configuration related to the cluster RBAC settings.
JSON representation |
---|
{ "adminUsers": [ { object ( |
Fields | |
---|---|
adminUsers[] |
Optional. Users that can perform operations as a cluster admin. A managed ClusterRoleBinding will be created to grant the For more info on RBAC, see https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles |
adminGroups[] |
Optional. Groups of users that can perform operations as a cluster admin. A managed ClusterRoleBinding will be created to grant the For more info on RBAC, see https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles |
AwsClusterUser
Identities of a user-type subject for AWS clusters.
JSON representation |
---|
{ "username": string } |
Fields | |
---|---|
username |
Required. The name of the user, e.g. |
AwsClusterGroup
Identities of a group-type subject for AWS clusters.
JSON representation |
---|
{ "group": string } |
Fields | |
---|---|
group |
Required. The name of the group, e.g. |
State
The lifecycle state of the cluster.
Enums | |
---|---|
STATE_UNSPECIFIED |
Not set. |
PROVISIONING |
The PROVISIONING state indicates the cluster is being created. |
RUNNING |
The RUNNING state indicates the cluster has been created and is fully usable. |
RECONCILING |
The RECONCILING state indicates that some work is actively being done on the cluster, such as upgrading the control plane replicas. |
STOPPING |
The STOPPING state indicates the cluster is being deleted. |
ERROR |
The ERROR state indicates the cluster is in a broken unrecoverable state. |
DEGRADED |
The DEGRADED state indicates the cluster requires user action to restore full functionality. |
AwsClusterError
AwsClusterError describes errors found on AWS clusters.
JSON representation |
---|
{ "message": string } |
Fields | |
---|---|
message |
Human-friendly description of the error. |
Methods |
|
---|---|
|
Creates a new AwsCluster resource on a given Google Cloud Platform project and region. |
|
Deletes a specific AwsCluster resource. |
|
Generates a short-lived access token to authenticate to a given AwsCluster resource. |
|
Generates an access token for a cluster agent. |
|
Describes a specific AwsCluster resource. |
|
Gets the public component of the cluster signing keys in JSON Web Key format. |
|
Lists all AwsCluster resources on a given Google Cloud project and region. |
|
Updates an AwsCluster . |