REST Resource: projects.locations.azureClusters

Resource: AzureCluster

An Anthos cluster running on Azure.

JSON representation 
{
  "name": string,
  "description": string,
  "azureRegion": string,
  "resourceGroupId": string,
  "azureClient": string,
  "networking": {
    object (AzureClusterNetworking)
  },
  "controlPlane": {
    object (AzureControlPlane)
  },
  "authorization": {
    object (AzureAuthorization)
  },
  "azureServicesAuthentication": {
    object (AzureServicesAuthentication)
  },
  "state": enum (State),
  "endpoint": string,
  "uid": string,
  "reconciling": boolean,
  "createTime": string,
  "updateTime": string,
  "etag": string,
  "annotations": {
    string: string,
    ...
  },
  "workloadIdentityConfig": {
    object (WorkloadIdentityConfig)
  },
  "clusterCaCertificate": string,
  "fleet": {
    object (Fleet)
  },
  "managedResources": {
    object (AzureClusterResources)
  },
  "loggingConfig": {
    object (LoggingConfig)
  },
  "errors": [
    {
      object (AzureClusterError)
    }
  ],
  "monitoringConfig": {
    object (MonitoringConfig)
  }
}
Fields
name

string

The name of this resource.

Cluster names are formatted as projects/<project-number>/locations/<region>/azureClusters/<cluster-id>.

See Resource Names for more details on Google Cloud Platform resource names.
description

string

Optional. A human readable description of this cluster. Cannot be longer than 255 UTF-8 encoded bytes.
azureRegion

string

Required. The Azure region where the cluster runs.

Each Google Cloud region supports a subset of nearby Azure regions. You can call locations.getAzureServerConfig to list all supported Azure regions within a given Google Cloud region.
resourceGroupId

string

Required. The ARM ID of the resource group where the cluster resources are deployed. For example: /subscriptions/<subscription-id>/resourceGroups/<resource-group-name>
azureClient

string

Optional. Name of the AzureClient that contains authentication configuration for how the Anthos Multi-Cloud API connects to Azure APIs.

Either azureClient or azureServicesAuthentication should be provided.

The AzureClient resource must reside on the same Google Cloud Platform project and region as the AzureCluster.

AzureClient names are formatted as projects/<project-number>/locations/<region>/azureClients/<client-id>.

See Resource Names for more details on Google Cloud resource names.
networking

object (AzureClusterNetworking)

Required. Cluster-wide networking configuration.
controlPlane

object (AzureControlPlane)

Required. Configuration related to the cluster control plane.
authorization

object (AzureAuthorization)

Required. Configuration related to the cluster RBAC settings.
azureServicesAuthentication

object (AzureServicesAuthentication)

Optional. Authentication configuration for management of Azure resources.

Either azureClient or azureServicesAuthentication should be provided.
state

enum (State)

Output only. The current state of the cluster.
endpoint

string

Output only. The endpoint of the cluster's API server.
uid

string

Output only. A globally unique identifier for the cluster.
reconciling

boolean

Output only. If set, there are currently changes in flight to the cluster.
createTime

string (Timestamp format)

Output only. The time at which this cluster was created.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
updateTime

string (Timestamp format)

Output only. The time at which this cluster was last updated.

A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
etag

string

Allows clients to perform consistent read-modify-writes through optimistic concurrency control.

Can be sent on update and delete requests to ensure the client has an up-to-date value before proceeding.
annotations

map (key: string, value: string)

Optional. Annotations on the cluster.

This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Keys can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
workloadIdentityConfig

object (WorkloadIdentityConfig)

Output only. Workload Identity settings.
clusterCaCertificate

string

Output only. PEM encoded x509 certificate of the cluster root of trust.
fleet

object (Fleet)

Required. Fleet configuration.
managedResources

object (AzureClusterResources)

Output only. Managed Azure resources for this cluster.
loggingConfig

object (LoggingConfig)

Optional. Logging configuration for this cluster.
errors[]

object (AzureClusterError)

Output only. A set of errors found in the cluster.
monitoringConfig

object (MonitoringConfig)

Optional. Monitoring configuration for this cluster.

AzureClusterNetworking

ClusterNetworking contains cluster-wide networking configuration.

JSON representation 
{
  "virtualNetworkId": string,
  "podAddressCidrBlocks": [
    string
  ],
  "serviceAddressCidrBlocks": [
    string
  ],
  "serviceLoadBalancerSubnetId": string
}
Fields
virtualNetworkId

string

Required. The Azure Resource Manager (ARM) ID of the VNet associated with your cluster.

All components in the cluster (i.e. control plane and node pools) run on a single VNet.

Example: /subscriptions/<subscription-id>/resourceGroups/<resource-group-id>/providers/Microsoft.Network/virtualNetworks/<vnet-id>

This field cannot be changed after creation.
podAddressCidrBlocks[]

string

Required. The IP address range of the pods in this cluster, in CIDR notation (e.g. 10.96.0.0/14).

All pods in the cluster get assigned a unique IPv4 address from these ranges. Only a single range is supported.

This field cannot be changed after creation.
serviceAddressCidrBlocks[]

string

Required. The IP address range for services in this cluster, in CIDR notation (e.g. 10.96.0.0/14).

All services in the cluster get assigned a unique IPv4 address from these ranges. Only a single range is supported.

This field cannot be changed after creating a cluster.
serviceLoadBalancerSubnetId

string

Optional. The ARM ID of the subnet where Kubernetes private service type load balancers are deployed. When unspecified, it defaults to AzureControlPlane.subnet_id.

Example: "/subscriptions/d00494d6-6f3c-4280-bbb2-899e163d1d30/resourceGroups/anthos_cluster_gkeust4/providers/Microsoft.Network/virtualNetworks/gke-vnet-gkeust4/subnets/subnetid456"

AzureControlPlane

AzureControlPlane represents the control plane configurations.

JSON representation 
{
  "version": string,
  "subnetId": string,
  "vmSize": string,
  "sshConfig": {
    object (AzureSshConfig)
  },
  "rootVolume": {
    object (AzureDiskTemplate)
  },
  "mainVolume": {
    object (AzureDiskTemplate)
  },
  "databaseEncryption": {
    object (AzureDatabaseEncryption)
  },
  "proxyConfig": {
    object (AzureProxyConfig)
  },
  "configEncryption": {
    object (AzureConfigEncryption)
  },
  "tags": {
    string: string,
    ...
  },
  "replicaPlacements": [
    {
      object (ReplicaPlacement)
    }
  ],
  "endpointSubnetId": string
}
Fields
version

string

Required. The Kubernetes version to run on control plane replicas (e.g. 1.19.10-gke.1000).

You can list all supported versions on a given Google Cloud region by calling locations.getAzureServerConfig.
subnetId

string

Optional. The ARM ID of the default subnet for the control plane. The control plane VMs are deployed in this subnet, unless AzureControlPlane.replica_placements is specified. This subnet will also be used as default for AzureControlPlane.endpoint_subnet_id if AzureControlPlane.endpoint_subnet_id is not specified. Similarly it will be used as default for AzureClusterNetworking.service_load_balancer_subnet_id.

Example: /subscriptions/<subscription-id>/resourceGroups/<resource-group-id>/providers/Microsoft.Network/virtualNetworks/<vnet-id>/subnets/default.
vmSize

string

Optional. The Azure VM size name. Example: Standard_DS2_v2.

For available VM sizes, see https://docs.microsoft.com/en-us/azure/virtual-machines/vm-naming-conventions.

When unspecified, it defaults to Standard_DS2_v2.
sshConfig

object (AzureSshConfig)

Required. SSH configuration for how to access the underlying control plane machines.
rootVolume

object (AzureDiskTemplate)

Optional. Configuration related to the root volume provisioned for each control plane replica.

When unspecified, it defaults to 32-GiB Azure Disk.
mainVolume

object (AzureDiskTemplate)

Optional. Configuration related to the main volume provisioned for each control plane replica. The main volume is in charge of storing all of the cluster's etcd state.

When unspecified, it defaults to a 8-GiB Azure Disk.
databaseEncryption

object (AzureDatabaseEncryption)

Optional. Configuration related to application-layer secrets encryption.
proxyConfig

object (AzureProxyConfig)

Optional. Proxy configuration for outbound HTTP(S) traffic.
configEncryption

object (AzureConfigEncryption)

Optional. Configuration related to vm config encryption.
tags

map (key: string, value: string)

Optional. A set of tags to apply to all underlying control plane Azure resources.

An object containing a list of "key": value pairs. Example: { "name": "wrench", "mass": "1.3kg", "count": "3" }.
replicaPlacements[]

object (ReplicaPlacement)

Optional. Configuration for where to place the control plane replicas.

Up to three replica placement instances can be specified. If replicaPlacements is set, the replica placement instances will be applied to the three control plane replicas as evenly as possible.
endpointSubnetId

string

Optional. The ARM ID of the subnet where the control plane load balancer is deployed. When unspecified, it defaults to AzureControlPlane.subnet_id.

Example: "/subscriptions/d00494d6-6f3c-4280-bbb2-899e163d1d30/resourceGroups/anthos_cluster_gkeust4/providers/Microsoft.Network/virtualNetworks/gke-vnet-gkeust4/subnets/subnetid123"

AzureDatabaseEncryption

Configuration related to application-layer secrets encryption.

Anthos clusters on Azure encrypts your Kubernetes data at rest in etcd using Azure Key Vault.

JSON representation 
{
  "keyId": string
}
Fields
keyId

string

Required. The ARM ID of the Azure Key Vault key to encrypt / decrypt data.

For example: /subscriptions/<subscription-id>/resourceGroups/<resource-group-id>/providers/Microsoft.KeyVault/vaults/<key-vault-id>/keys/<key-name> Encryption will always take the latest version of the key and hence specific version is not supported.

ReplicaPlacement

Configuration for the placement of a control plane replica.

JSON representation 
{
  "subnetId": string,
  "azureAvailabilityZone": string
}
Fields
subnetId

string

Required. For a given replica, the ARM ID of the subnet where the control plane VM is deployed. Make sure it's a subnet under the virtual network in the cluster configuration.
azureAvailabilityZone

string

Required. For a given replica, the Azure availability zone where to provision the control plane VM and the ETCD disk.

AzureAuthorization

Configuration related to the cluster RBAC settings.

JSON representation 
{
  "adminUsers": [
    {
      object (AzureClusterUser)
    }
  ],
  "adminGroups": [
    {
      object (AzureClusterGroup)
    }
  ]
}
Fields
adminUsers[]

object (AzureClusterUser)

Optional. Users that can perform operations as a cluster admin. A managed ClusterRoleBinding will be created to grant the cluster-admin ClusterRole to the users. Up to ten admin users can be provided.

For more info on RBAC, see https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles
adminGroups[]

object (AzureClusterGroup)

Optional. Groups of users that can perform operations as a cluster admin. A managed ClusterRoleBinding will be created to grant the cluster-admin ClusterRole to the groups. Up to ten admin groups can be provided.

For more info on RBAC, see https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles

AzureClusterUser

Identities of a user-type subject for Azure clusters.

JSON representation 
{
  "username": string
}
Fields
username

string

Required. The name of the user, e.g. my-gcp-id@gmail.com.

AzureClusterGroup

Identities of a group-type subject for Azure clusters.

JSON representation 
{
  "group": string
}
Fields
group

string

Required. The name of the group, e.g. my-group@domain.com.

AzureServicesAuthentication

Authentication configuration for the management of Azure resources.

JSON representation 
{
  "tenantId": string,
  "applicationId": string
}
Fields
tenantId

string

Required. The Azure Active Directory Tenant ID.
applicationId

string

Required. The Azure Active Directory Application ID.

State

The lifecycle state of the cluster.

Enums
STATE_UNSPECIFIED Not set.
PROVISIONING The PROVISIONING state indicates the cluster is being created.
RUNNING The RUNNING state indicates the cluster has been created and is fully usable.
RECONCILING The RECONCILING state indicates that some work is actively being done on the cluster, such as upgrading the control plane replicas.
STOPPING The STOPPING state indicates the cluster is being deleted.
ERROR The ERROR state indicates the cluster is in a broken unrecoverable state.
DEGRADED The DEGRADED state indicates the cluster requires user action to restore full functionality.

AzureClusterResources

Managed Azure resources for the cluster.

The values could change and be empty, depending on the state of the cluster.

JSON representation 
{
  "networkSecurityGroupId": string,
  "controlPlaneApplicationSecurityGroupId": string
}
Fields
networkSecurityGroupId

string

Output only. The ARM ID of the cluster network security group.
controlPlaneApplicationSecurityGroupId

string

Output only. The ARM ID of the control plane application security group.

AzureClusterError

AzureClusterError describes errors found on Azure clusters.

JSON representation 
{
  "message": string
}
Fields
message

string

Human-friendly description of the error.

Methods

create

 Creates a new AzureCluster resource on a given Google Cloud Platform project and region.

delete

 Deletes a specific AzureCluster resource.

generateAzureAccessToken

 Generates a short-lived access token to authenticate to a given AzureCluster resource.

generateAzureClusterAgentToken

 Generates an access token for a cluster agent.

get

 Describes a specific AzureCluster resource.

getJwks

 Gets the public component of the cluster signing keys in JSON Web Key format.

list

 Lists all AzureCluster resources on a given Google Cloud project and region.

patch

 Updates an AzureCluster.