The Google GKE MCP server is a managed Model Context Protocol server that provides AI applications with tools to manage Google Kubernetes Engine (GKE) clusters and Kubernetes resources. It exposes a structured, discoverable interface that allows AI agents to interact with GKE and Kubernetes APIs, enabling them to inspect cluster configurations, retrieve Kubernetes resource YAMLs, monitor operations like cluster upgrades, diagnose issues, and optimize costs—all without needing to parse text output or use complex kubectl commands.
Applies a Kubernetes manifest to a cluster using server-side apply. This is similar to running kubectl apply --server-side.
| Name | Required | Description | Default |
|---|---|---|---|
| dryRun | No | Optional. If true, run in dry-run mode. | |
| parent | Yes | Required. The cluster to apply the manifest to. Format: projects/{project}/locations/{location}/clusters/{cluster} | |
| yamlManifest | Yes | Required. The YAML manifest to apply. | |
| forceConflicts | No | Optional. If true, force conflicts resolution when applying. |
| Name | Required | Description |
|---|---|---|
| errors | No | Errors encountered during apply. If this field is populated, some resources may not have been applied. |
| result | No | Result of the apply operation, e.g., resources created/configured. This might be a summary string or structured data. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description reveals the use of server-side apply, which is a meaningful behavioral trait (conflict handling, ownership semantics). Annotations already indicate idempotent and destructive hints, and the description does not contradict them. It adds value beyond annotations by specifying the apply method, though it doesn't detail side effects.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loaded with the main purpose, and contains no redundant information. The kubectl analogy is valuable and concise.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the presence of a full input schema, annotations, and an output schema, the description provides sufficient contextual information for an agent to select and invoke the tool. It covers the core function and method, and does not need to explain return values due to the output schema.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema fully documents all parameters. The description adds no additional parameter semantics beyond what's already in the schema, so baseline score of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function with a specific verb ('Applies') and resource ('Kubernetes manifest'), and distinguishes it from sibling tools by specifying server-side apply and the kubectl analogy.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context for when to use this tool (applying manifests to a cluster) but does not explicitly mention alternatives or exclusions. The analogy to kubectl apply helps set expectations but doesn't reference other mutation tools like patch_k8s_resource.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Cancels a specific GKE operation.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Required. The name (project, location, operation id) of the operation to cancel. Specified in the format `projects/*/locations/*/operations/*`. | |
| parent | Yes | Required. The parent cluster of the operation. Specified in the format `projects/*/locations/*/clusters/*`. |
| Name | Required | Description |
|---|---|---|
| errors | No | Errors encountered during operation cancellation. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description does not add behavioral context beyond the existing annotations. While annotations already indicate destructive (destructiveHint=true) and idempotent (idempotentHint=true), the description merely restates the tool's function without disclosing side effects, reversibility, permission requirements, or response behavior.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence that directly states the tool's purpose. Every word is useful, and there is no extraneous information.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
With full schema coverage, an output schema, and annotations specifying destructive/idempotent behavior, the description is minimally sufficient for invocation. However, it lacks guidance on when to cancel an operation and does not mention state prerequisites or return semantics, leaving some context to the agent's inference.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description coverage is 100% for both required parameters, with detailed format specifications in the schema. The description itself adds no additional parameter semantics, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb+resource ('Cancels a specific GKE operation') and clearly distinguishes itself from sibling tools like get_operation and list_operations. It conveys the exact action without ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided on when to use this tool versus alternatives, such as checking operation status with get_operation or waiting for completion. The description states only what it does, not the circumstances under which cancellation is appropriate or prerequisites (e.g., operation state).
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Checks whether an action is allowed on a Kubernetes resource. This is similar to running kubectl auth can-i.
| Name | Required | Description | Default |
|---|---|---|---|
| verb | Yes | Required. The verb to check. e.g. "get", "list", "watch", "create", "update", "patch", "delete". | |
| parent | Yes | Required. The cluster to check authorization against. Format: projects/{project}/locations/{location}/clusters/{cluster} | |
| resource | No | Optional. The name of the resource to check. | |
| namespace | No | Optional. The namespace of the resource. If not specified, "default" is used for namespace-scoped resources. | |
| resourceType | Yes | Required. The type of resource to check. e.g. "pods", "deployments", "services". |
| Name | Required | Description |
|---|---|---|
| errors | No | Errors encountered during auth check. |
| result | No | The result of auth can-i check. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds value by explaining that it 'checks' rather than performs an action, and the `kubectl auth can-i` analogy further clarifies the read-only, non-mutating nature. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, focused sentence that front-loads the core purpose and includes a concise analogy. Every word earns its place, and there is no redundancy or fluff.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has 5 parameters with full schema documentation, an output schema, and annotations covering safety. The description succinctly conveys the core function and analogy, which is sufficient for an agent to understand and invoke the tool. No critical context is missing given the tool's simplicity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema covers 100% of parameters with descriptive text (e.g., verb, resourceType, namespace). The tool description itself does not add parameter-level details, but the schema already provides sufficient meaning. This meets the baseline for full schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose with a specific verb and resource: 'Checks whether an action is allowed on a Kubernetes resource.' It also uses a well-known analogy (`kubectl auth can-i`) that reinforces the exact behavior and distinguishes it from sibling tools that perform resource operations like apply, delete, or get.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context that this is for checking authorization, similar to `kubectl auth can-i`. It does not explicitly name alternatives or exclusions, but the tool is unique among siblings (no other auth-check tool exists), making its usage obvious. The analogy gives practical guidance on when to use it.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Creates a new GKE cluster in a given project and location. It's recommended to read the GKE documentation to understand cluster configuration options. Cluster creation will default to Autopilot mode, as recommended by GKE best practices. If the user explicitly wants to create a Standard cluster, you need to set autopilot.enabled=false in the cluster configuration. This is similar to running gcloud container clusters create-auto or gcloud container clusters create.
| Name | Required | Description | Default |
|---|---|---|---|
| parent | Yes | Required. The parent (project and location) where the cluster will be created. Specified in the format `projects/*/locations/*`. | |
| cluster | Yes | Required. A [cluster resource](https://cloud.google.com/container-engine/reference/rest/v1/projects.locations.clusters) represented as a string using JSON format. |
| Name | Required | Description |
|---|---|---|
| errors | No | Errors encountered during the operation. |
| operation | No | JSON string of the GKE Operation object. See: https://docs.cloud.google.com/kubernetes-engine/docs/reference/rest/v1/projects.locations.operations |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations indicate readOnlyHint=false, implying a write operation. The description adds valuable behavioral context beyond annotations by revealing the Autopilot default and the specific field needed to create a Standard cluster. It also notes similarity to gcloud CLI behavior. No contradiction with annotations is present.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is 4 sentences, front-loaded with the primary purpose. The second sentence suggests reading docs, which is somewhat optional, but the Autopilot vs. Standard guidance is essential. Overall, every sentence provides useful information without excessive verbosity.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool has 2 well-defined params and an output schema, so return values need no explanation. The description covers the key decision point (Autopilot vs Standard) and points to docs for deeper configuration. It does not mention prerequisites or authentication, but sibling tools like check_k8s_auth and get_cluster provide some context. Sufficient for a creation tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with both params clearly described (parent format and cluster JSON resource). The description adds extra meaning to the cluster parameter by explaining that cluster creation defaults to Autopilot and how to configure a Standard cluster. This goes beyond the schema's generic JSON description.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description explicitly states 'Creates a new GKE cluster in a given project and location,' which is a specific verb+resource. It clearly distinguishes from sibling tools like create_node_pool (node pool creation) and get_cluster/list_clusters (read operations). The reference to equivalent gcloud commands further reinforces its purpose.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description gives clear context for the main usage decision: it defaults to Autopilot mode and explains how to switch to Standard by setting autopilot.enabled=false. It also recommends reading GKE documentation for configuration options. However, it does not explicitly mention when not to use this tool or distinguish it from update_cluster or other alternatives, though the purpose is unambiguous from sibling names.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Creates a node pool for a specific GKE cluster.
| Name | Required | Description | Default |
|---|---|---|---|
| parent | Yes | Required. The parent (project, location, cluster name) where the node pool will be created. Specified in the format `projects/*/locations/*/clusters/*`. | |
| nodePool | Yes | Required. The node pool to create represented as a string using JSON format. The full node pool object can be found at https://docs.cloud.google.com/kubernetes-engine/docs/reference/rest/v1/projects.locations.clusters.nodePools |
| Name | Required | Description |
|---|---|---|
| errors | No | Errors encountered during the operation. |
| operation | No | JSON string of the GKE Operation object. See: https://docs.cloud.google.com/kubernetes-engine/docs/reference/rest/v1/projects.locations.operations |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=false, idempotentHint=false, and destructiveHint=false, so the write and non-destructive nature is known. The description adds minimal extra behavioral context, only noting the target scope, with no mention of long-running operations or side effects; no contradiction with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no redundant words, stating the core action and target clearly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the annotations, complete parameter schema, and output schema presence, the description is adequate for a straightforward create operation. It clearly identifies the target resource, and the schema fills in the parameter details; minor omissions like operational duration are not critical when structured fields cover them.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema coverage is 100%: both parent and nodePool have detailed descriptions in the schema. The tool description adds no additional parameter-level semantics, so baseline 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'creates', identifies the resource 'node pool', and scopes it to 'a specific GKE cluster', clearly distinguishing it from sibling tools like create_cluster or update_node_pool.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use for an existing cluster ('for a specific GKE cluster') but does not explicitly compare with alternatives such as create_cluster or update_node_pool, nor mention prerequisites or when not to use this tool.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Deletes a Kubernetes resource from a cluster. This is similar to running kubectl delete.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Required. The name of the resource to delete. | |
| dryRun | No | Optional. If true, run in dry-run mode. | |
| parent | Yes | Required. The cluster, which owns this collection of resources. Format: projects/{project}/locations/{location}/clusters/{cluster} | |
| cascade | No | Optional. The cascading deletion policy to use. If not specified, 'background' is used. Valid values are 'background', 'foreground', and 'orphan'. | |
| namespace | No | Optional. The namespace of the resource. If not specified, "default" is used. | |
| resourceType | Yes | Required. The type of resource to delete. Kubernetes resource/kind name in singular form, lower case. e.g. "pod", "deployment", "service". |
| Name | Required | Description |
|---|---|---|
| errors | No | Errors encountered during deletion. |
| result | No | Result of the delete operation. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare destructiveHint=true, so the description doesn't need to restate that. However, it adds no further behavioral context beyond the basic deletion, such as irreversibility, permissions, or side effects. It aligns with annotations and offers no contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences, front-loaded with the main action and a useful analogy. Every word earns its place, and there is no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the presence of a rich schema and annotations, the description is sufficient for a straightforward delete operation. It omits nuances like dry-run or cascade behavior, but those are captured in the schema. The description is not overly verbose and covers the core purpose.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema covers all 6 parameters with descriptions, including required fields and defaults. Since schema coverage is 100%, the description need not add parameter details, and it doesn't—staying neutral. This meets the baseline for high coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the action ('Deletes a Kubernetes resource from a cluster') and provides a familiar analogy ('similar to running kubectl delete'). It distinguishes from siblings by naming the delete operation, though it does not explicitly compare with alternative operations.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description offers no explicit guidance on when to use this tool versus alternatives like patch_k8s_resource or apply_k8s_manifest. The kubectl delete analogy implies usage context, but no criteria or scenarios are given.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Shows the details of a specific Kubernetes resource. This is similar to running kubectl describe.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | Optional. The name of the resource. | |
| parent | Yes | Required. The parent cluster. | |
| namespace | No | Optional. The namespace of the resource. | |
| resourceType | Yes | Required. The type of the resource. | |
| labelSelector | No | Optional. A label selector to filter resources. |
| Name | Required | Description |
|---|---|---|
| errors | No | Errors encountered during description retrieval. |
| description | No | The description of the resource. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and destructiveHint=false, so the agent knows it's safe. The description adds that it's 'similar to kubectl describe', which conveys that output is detailed and human-oriented. It does not mention potential large output size or pagination, but given annotations cover the safety profile, this is adequate and adds useful context beyond annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two sentences, immediately states the core purpose and an analogy. No fluff. Perfectly sized for the tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given an output schema exists and annotations indicate a safe read, the description is complete enough for a describe-like operation. It could mention what 'details' includes, but the kubectl describe comparison covers that. For a tool with good structured data, this is sufficient.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the input schema already documents all five parameters with descriptions. The description itself adds no extra parameter detail. Baseline 3 is appropriate since schema does the heavy lifting; no additional semantics needed.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states it 'shows the details of a specific Kubernetes resource' and compares to 'kubectl describe', which is a specific verb+resource. It distinguishes from siblings like get_k8s_resource (which likely returns a summary) and list_k8s_events, but doesn't explicitly contrast with them, so not a 5.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage: use when you need detailed information about a resource, similar to kubectl describe. It does not explicitly state when not to use it or mention alternatives, but the analogy to 'kubectl describe' provides context that it's for detailed inspection rather than listing. It lacks explicit exclusions or guidance about when to use get_k8s_resource or list_k8s_api_resources instead.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Gets the details of a specific GKE cluster.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Required. The name (project, location, cluster) of the cluster to retrieve. Specified in the format `projects/*/locations/*/clusters/*`. | |
| readMask | No | Optional. The field mask to specify the fields to be returned in the response. Use a single "*" to get all fields. Default: autopilot,createTime,currentMasterVersion,currentNodeCount,currentNodeVersion,description,endpoint,fleet,location,name,network,nodePools.locations,nodePools.name,nodePools.status,nodePools.version,releaseChannel,resourceLabels,selfLink,status,statusMessage,subnetwork. |
| Name | Required | Description |
|---|---|---|
| errors | No | Errors encountered during cluster retrieval. |
| cluster | No | A string representing the Cluster object in JSON format. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint and idempotentHint, and the description aligns with a safe read operation. However, the description adds no extra behavioral context beyond the annotations, such as field masking defaults or pagination behavior, so it meets the baseline without enriching transparency.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single focused sentence with no redundant content. Every word contributes to the purpose, achieving maximum conciseness.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple get operation with a comprehensive input schema, an output schema, and strong annotations, the description is adequate. It lacks explicit differentiation from get_k8s_cluster_info, but the 'GKE cluster' specificity mitigates ambiguity, so it is nearly complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema fully documents both parameters. The tool description does not add any additional meaning beyond the schema, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Gets') and clearly identifies the resource ('details of a specific GKE cluster'). This distinguishes it from sibling tools like list_clusters or get_node_pool, as it targets a single GKE cluster's details.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided about when to use this tool versus alternatives such as list_clusters or get_k8s_cluster_info. The description gives no exclusions or explicit context for selection, leaving the agent to infer usage.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Gets cluster endpoint information. This is similar to running kubectl cluster-info.
| Name | Required | Description | Default |
|---|---|---|---|
| parent | Yes | Required. The parent cluster. Format: projects/{project}/locations/{location}/clusters/{cluster} |
| Name | Required | Description |
|---|---|---|
| errors | No | Errors encountered during cluster info retrieval. |
| clusterInfo | No | The cluster info of the resource. Displays address and port information about the Kubernetes control plane and other services running within the cluster such as CoreDNS and Metrics-server. Example: "The Kubernetes control plane is at 10.128.0.10:6443. CoreDNS is running at https://192.0.2.1:6443/api/v1/namespaces/kube-system/services/kube-dns:dns/proxy Metrics-server is running at 127.0.0.1:8080" |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, so the agent knows this is a safe read operation. The description adds the `kubectl cluster-info` analogy, which gives some context about the output behavior, but this is limited beyond what annotations and the word 'Gets' already convey.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences, front-loads the action, and contains no fluff. Every word contributes to understanding what the tool does.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter tool with an output schema and rich annotations, the description is mostly sufficient. However, it lacks differentiation from the sibling `get_cluster`, which could leave the agent unsure which tool to invoke in a given context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the single `parent` parameter, including its format. The description does not add any additional parameter information, so the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb 'Gets' with a clear resource 'cluster endpoint information', and the analogy to `kubectl cluster-info` clarifies the scope. However, it does not explicitly distinguish from the sibling tool `get_cluster`, which might have overlapping functionality.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is given on when to use this tool versus alternatives like `get_cluster` or `list_clusters`. The `kubectl cluster-info` analogy implies a use case, but it does not provide boundaries or exclusions.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Gets logs from a Kubernetes container in a pod. This is similar to running kubectl logs.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Required. The name of the resource to retrieve logs from. This can be a pod name (e.g. "my-pod") or a type/name (e.g. "deployment/my-deployment"). If a type is not specified, "pod" is assumed. | |
| tail | No | Optional. The number of lines from the end of the logs to show. | |
| since | No | Optional. Retrieve logs since this duration ago (e.g. "1h", "10m"). | |
| parent | Yes | Required. The cluster to retrieve logs from. Format: projects/{project}/locations/{location}/clusters/{cluster} | |
| previous | No | Optional. If true, retrieve logs from the previous instantiation of the container. | |
| container | No | Optional. The name of the container to retrieve logs from. If not specified, logs from the first container are returned. | |
| namespace | No | Optional. The namespace of the resource. If not specified, "default" is used. | |
| sinceTime | No | Optional. Retrieve logs since this time (RFC3339). e.g. "2024-08-30T06:00:00Z". | |
| timestamps | No | Optional. If true, include timestamps in the log output. | |
| allContainers | No | Optional. If true, retrieve logs from all containers in the pod. |
| Name | Required | Description |
|---|---|---|
| logs | No | The logs from the resources. |
| errors | No | Errors encountered during log retrieval. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, establishing a safe read-only operation. The description adds the `kubectl logs` analogy, which provides a familiar behavioral reference but doesn't disclose additional side effects, rate limits, or failure modes. This is adequate but not substantial.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, focused sentence that clearly states the tool's purpose without redundancy. It is concise and front-loaded, making it easy to parse quickly.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description, combined with the comprehensive input schema and strong annotations, provides enough context for an agent to select and invoke the tool correctly. The kubectl logs analogy aids understanding, and the output schema covers return values, so the description doesn't need to explain them. It is complete but not exceptionally detailed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema provides detailed descriptions for all 10 parameters, covering their meanings and defaults. The tool description doesn't add any parameter-level semantics beyond the schema. With 100% schema coverage, the baseline of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's purpose: 'Gets logs from a Kubernetes container in a pod.' The verb 'Gets' and the resource 'logs from a Kubernetes container in a pod' are specific. The comparison to 'kubectl logs' reinforces clarity and distinguishes it from sibling tools like get_k8s_resource or describe_k8s_resource.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context by likening the tool to `kubectl logs`, making it evident when to use it (retrieving container logs). However, it lacks explicit exclusions or mention of alternative tools (e.g., list_k8s_events for events), so it doesn't fully meet the 'explicit when/when-not' criterion.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Gets one or more Kubernetes resources from a cluster. Resources can be filtered by type, name, namespace, and label selectors. Returns the resources in YAML format. This is similar to running kubectl get.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | Optional. The name of the resource to retrieve. If not specified, all resources of the given type are returned. | |
| parent | Yes | Required. The cluster, which owns this collection of resources. Format: projects/{project}/locations/{location}/clusters/{cluster} | |
| namespace | No | Optional. The namespace of the resource. If not specified, all namespaces are searched. | |
| outputFormat | No | Optional. The output format. One of: (table, wide, yaml, json). If not specified, defaults to table. When both custom_columns and output_format are specified, output_format is ignored. | |
| resourceType | Yes | Required. The type of resource to retrieve. Kubernetes resource/kind name in singular form, lower case. e.g. "pod", "deployment", "service". | |
| customColumns | No | Optional. The field mask to specify columns to display. Use a single "*" to get all fields. When both custom_columns and output_format are specified, output_format is ignored. | |
| fieldSelector | No | Optional. A field selector to filter resources. | |
| labelSelector | No | Optional. A label selector to filter resources. |
| Name | Required | Description |
|---|---|---|
| errors | No | Errors encountered during retrieval. |
| output | No | The output of the command in the requested format. It may contain resources in YAML or JSON format, or a table in plain text, or errors. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description claims 'Returns the resources in YAML format,' which conflicts with the schema's `outputFormat` parameter that defaults to table. This misleading statement could cause an agent to expect YAML output when the default is actually table. Annotations indicate readOnly and idempotent, but the return-format inaccuracy is a transparency failure. The `kubectl get` analogy is helpful but does not offset the incorrect format statement.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is concise (four short sentences) and front-loaded with the core purpose. The analogy to `kubectl get` is useful, but the sentence about YAML format is redundant and inaccurate, reducing overall effectiveness. It could be tightened by removing the misleading format claim.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the rich schema, output schema, and annotations, the description does not need to explain return values. However, it has a significant gap: the misleading YAML statement, which could confuse an agent about output format. It also doesn't mention the required `parent` cluster parameter or clarify that omitting `name` returns all resources of a type. Overall, it's minimally viable but incomplete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% description coverage with detailed parameter descriptions, so the baseline is 3. The description mentions filtering by 'type, name, namespace, and label selectors,' which maps to some parameters but omits others like `outputFormat`, `customColumns`, and `fieldSelector`. Since the schema already fully explains these, the description adds little extra semantic value.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Gets one or more Kubernetes resources from a cluster.' It mentions filtering and the analogy to `kubectl get`. However, it does not explicitly distinguish it from sibling tool `describe_k8s_resource`, which in kubectl would provide more detailed output. Thus it lacks full sibling differentiation.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context that this tool is for retrieving Kubernetes resources, and the analogy to `kubectl get` implies basic listing/filtering. However, it does not explicitly state when to prefer this tool over alternatives like `describe_k8s_resource` or `get_k8s_logs`, and it provides no exclusions or when-not-to-use guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Checks the current rollout status of a Kubernetes resource. This is similar to running kubectl rollout status.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Required. The name of the resource to check. | |
| parent | Yes | Required. The cluster to check rollout status in. Format: projects/{project}/locations/{location}/clusters/{cluster} | |
| namespace | No | Optional. The namespace of the resource. If not specified, "default" is used for namespace-scoped resources. | |
| resourceType | Yes | Required. The type of resource to check. e.g. "deployment", "daemonset", "statefulset". |
| Name | Required | Description |
|---|---|---|
| errors | No | Errors encountered during rollout status check. |
| result | No | The result of the rollout status check. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, which the description's 'Checks' aligns with. The description adds the notion of 'current' status, which implies a point-in-time check rather than a blocking wait, but it does not elaborate on whether the call waits for rollout completion or returns immediately, leaving potential ambiguity given the kubectl analogy.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two sentences long, front-loads the core purpose in the first sentence, and uses the second sentence for a helpful analogy. Every word earns its place, with no redundant content.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is a simple read-only operation with complete schema coverage, clear annotations, and an output schema. The description sufficiently orients the agent, and the kubectl analogy adds relevant context. No significant gaps exist for a tool of this complexity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema has 100% coverage with detailed descriptions for all four parameters, so the schema carries the full semantic burden. The description provides no additional parameter-level details, which is acceptable given the schema's completeness; baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Checks the current rollout status of a Kubernetes resource.' It includes a specific verb ('checks') and resource ('rollout status'), and the kubectl analogy ('similar to running `kubectl rollout status`') precisely conveys the intended operation, distinguishing it from generic get/describe tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The kubectl analogy gives implicit guidance on when to use the tool (when you would run `kubectl rollout status`), but it does not explicitly mention alternatives or exclusion criteria among sibling tools. No when-not-to-use guidance is provided.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Retrieves Kubernetes client and server versions for a given cluster. This is similar to running kubectl version.
| Name | Required | Description | Default |
|---|---|---|---|
| parent | Yes | Required. The cluster to get version information from, in the format `projects/*/locations/*/clusters/*`. |
| Name | Required | Description |
|---|---|---|
| errors | No | Errors encountered during version retrieval. |
| serverVersion | No | The server version. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false, covering the safety profile. The description adds useful context by specifying that both client and server versions are retrieved and by comparing it to `kubectl version`, giving the agent a clear mental model of behavior beyond the annotations. No contradictions.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences, with the action front-loaded. It provides no redundant information and every word adds value. The analogy to `kubectl version` is a useful explanatory touch without bloating the text.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter getter with an output schema, the description is complete. It clearly states what is retrieved and for which resource, while the schema handles the parameter format and the output schema covers return values. No additional context is necessary.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema description covers 100% of the parameter, including the required format for `parent`. The tool description itself does not add parameter-specific details, but the schema already provides full semantics. With high schema coverage, a baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool retrieves Kubernetes client and server versions for a cluster, using the specific verb 'retrieves' and a clear resource (versions). The similarity to `kubectl version` reinforces its purpose and distinguishes it from siblings like get_cluster or get_k8s_resource, which focus on other aspects.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description provides clear context: it is used to get Kubernetes version information for a given cluster, analogous to `kubectl version`. While it doesn't explicitly name alternatives or state when not to use it, the narrow scope makes its use case unambiguous. The absence of exclusions is acceptable for a simple read-only getter.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Gets the details of a specific node pool within a GKE cluster.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Required. The name (project, location, cluster, node pool id) of the node pool to get. Specified in the format `projects/*/locations/*/clusters/*/nodePools/*`. |
| Name | Required | Description |
|---|---|---|
| errors | No | Errors encountered during node pool retrieval. |
| nodePool | No | A string representing the NodePool object in JSON format. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and idempotentHint=true, and the description 'Gets' is consistent with a safe read operation. The description adds minimal behavioral context beyond the scope ('specific node pool' vs list), but it doesn't disclose return format or error behavior. Since annotations cover the safety profile, this is acceptable but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no filler words. It communicates the essential action and resource in under 20 words, perfectly sized for a simple getter tool.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the single parameter fully documented in the schema, strong annotations, and presence of an output schema, the description is mostly complete. However, it lacks any usage guidance relative to sibling list/get tools, which would make it more helpful. For a simple getter, this is a minor gap, so a score of 4 is appropriate.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The schema provides 100% coverage for the sole parameter 'name,' including the exact resource format. The description adds no additional parameter semantics, so it relies entirely on the schema. This matches the baseline for high schema coverage.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses the specific verb 'Gets' and identifies the resource as 'details of a specific node pool within a GKE cluster.' This clearly distinguishes it from list_node_pools and get_cluster, making the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage when you need details for one specific node pool, but it does not explicitly state when to use this tool over siblings like list_node_pools or get_cluster. There is no explicit when-not or alternative naming, so guidance is only implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Gets the details of a specific GKE operation.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Required. The name (project, location, operation id) of the operation to get. Specified in the format `projects/*/locations/*/operations/*`. |
| Name | Required | Description |
|---|---|---|
| errors | No | Errors encountered during the operation. |
| operation | No | JSON string of the GKE Operation object. See: https://docs.cloud.google.com/kubernetes-engine/docs/reference/rest/v1/projects.locations.operations |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and destructiveHint, so the safety profile is known. The description adds no behavioral context beyond that, such as return behavior, error cases, or resource implications, providing no extra disclosure beyond the structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that directly states the tool's purpose. No filler or redundant information, every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the simple one-parameter schema, strong annotations, and presence of an output schema, the description is fully adequate. It tells the agent what the tool does and the schema covers invocation details, so no further context is needed.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the single parameter 'name' is well-documented with format details. The description adds no parameter-specific meaning beyond what the schema already provides, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Gets') and resource ('details of a specific GKE operation'), clearly distinguishing it from sibling tools like list_operations or cancel_operation. It states exactly what the tool does with no ambiguity.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage for retrieving a single GKE operation by name, which is clear context. However, it does not explicitly mention alternatives or when not to use it, such as 'use list_operations to list all operations'.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Lists GKE clusters in a given project and location. Location can be a region, zone, or '-' for all locations.
| Name | Required | Description | Default |
|---|---|---|---|
| parent | Yes | Required. The parent (project and location) where the clusters will be listed. Specified in the format `projects/*/locations/*`. Location "-" matches all zones and all regions. | |
| readMask | No | Optional. The field mask to specify the fields to be returned in the response. Use a single "*" to get all fields. Default: clusters.autopilot,clusters.createTime,clusters.currentMasterVersion,clusters.currentNodeCount,clusters.currentNodeVersion,clusters.description,clusters.endpoint,clusters.fleet,clusters.location,clusters.name,clusters.network,clusters.nodePools.name,clusters.releaseChannel,clusters.resourceLabels,clusters.selfLink,clusters.status,clusters.statusMessage,clusters.subnetwork,missingZones. |
| Name | Required | Description |
|---|---|---|
| errors | No | Errors encountered during cluster listing. |
| clusters | No | A string representing the ListClustersResponse object. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint, idempotentHint, and non-destructive behavior, so the description adds no additional behavioral context. The location semantics are already present in the schema's parent parameter description, so repeating them provides no extra value. The description does not mention pagination, response size, or other operational details.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single concise sentence that front-loads the verb and resource, then adds essential scope information about location. There is no wasted text or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple read-only list tool with rich annotations and an output schema, the description adequately covers the core purpose and location flexibility. It lacks explicit guidance on alternatives, but overall it is sufficiently complete for an agent to select and invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with detailed descriptions for both parent and readMask. The description itself adds no parameter meaning beyond what the schema already provides, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the specific action 'Lists GKE clusters' with scope 'in a given project and location', and further clarifies location semantics including '-' for all locations. This distinguishes it from sibling tools like get_cluster (single cluster) and list_node_pools (node pools).
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies when to use: to list GKE clusters in a project/location, and explains the required parent/location format. However, it does not explicitly name alternatives or exclusion criteria, such as using get_cluster for a single cluster.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Retrieves the available API groups and resources from a Kubernetes cluster. This is similar to running kubectl api-resources.
| Name | Required | Description | Default |
|---|---|---|---|
| parent | Yes | Required. The cluster, which owns this collection of resource types. Format: projects/{project}/locations/{location}/clusters/{cluster} |
| Name | Required | Description |
|---|---|---|
| errors | No | Errors encountered during discovery. |
| groups | No | The list of API group discovery. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and idempotentHint=true, so the safety profile is clear. The description adds the kubectl analogy and scope, but no extra behavioral details (e.g., whether it requires specific permissions or list pagination). With annotation coverage, this is adequate but not rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two concise sentences that both earn their place: the first states the core action and object, the second gives a useful analogy. No filler or redundant wording.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
This is a simple, read-only listing tool with one parameter, strong annotations, and an output schema. The description provides sufficient context for an agent to select and invoke it correctly; nothing important is missing.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% and the sole parameter 'parent' is fully documented in the schema with format guidance. The tool description adds no additional parameter semantics, so the baseline score of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Retrieves') and resource ('available API groups and resources from a Kubernetes cluster'), and the analogy to `kubectl api-resources` makes the purpose unmistakable. It clearly distinguishes this from sibling list tools like list_clusters or list_k8s_events.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clearly implies when to use it (to discover API groups and resources) and the analogy to kubectl api-resources provides a familiar reference. However, it does not explicitly mention alternatives or when not to use it, falling short of full usage guidance.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Retrieves events from a Kubernetes cluster. This is similar to running kubectl events.
| Name | Required | Description | Default |
|---|---|---|---|
| name | No | Optional. The name of the resource to retrieve events for. | |
| limit | No | Optional. The maximum number of events to return. If not specified, 500 is used. | |
| parent | Yes | Required. The parent cluster. Format: projects/{project}/locations/{location}/clusters/{cluster} | |
| namespace | No | Optional. The namespace of the resource. If not specified and all_namespaces is false, "default" is used. | |
| resourceType | No | Optional. The type of the resource to retrieve events for. | |
| allNamespaces | No | Optional. If true, retrieve events from all namespaces. |
| Name | Required | Description |
|---|---|---|
| errors | No | Errors encountered during events retrieval. |
| events | No | The events in string format. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already cover the safe read-only, non-destructive, idempotent nature. The description adds the `kubectl events` analogy, which helps the agent predict command-like behavior and output style. It does not contradict annotations and adds value beyond the structured fields.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
Two short sentences, with the primary purpose front-loaded and an illustrative analogy in the second. Every word earns its place; no filler or redundancy.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The output schema exists and the input schema fully documents parameters and defaults (e.g., limit 500, namespace default). The description is minimal but sufficient for a simple list operation. It could mention whether it supports cross-namespace or cluster-wide events, but that's already in the schema. The analogy to kubectl events adds practical context.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, so the schema fully documents all six parameters. The description adds no additional parameter semantics beyond the `kubectl` analogy, which only loosely implies filtering options. Baseline 3 is appropriate since the schema carries the load.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Retrieves') and resource ('events from a Kubernetes cluster'), clearly distinguishing it from sibling tools that retrieve logs, resources, or API resources. The analogy to `kubectl events` reinforces the tool's function.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies use for fetching Kubernetes events via the `kubectl` analogy, but it does not explicitly state when to prefer this tool over alternatives like get_k8s_logs or describe_k8s_resource. There are no stated exclusions or alternative references, so guidance is only implicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Lists the node pools for a specific GKE cluster.
| Name | Required | Description | Default |
|---|---|---|---|
| parent | Yes | Required. The parent (project, location, cluster name) where the node pools will be listed. Specified in the format `projects/*/locations/*/clusters/*`. |
| Name | Required | Description |
|---|---|---|
| errors | No | Errors encountered during node pool listing. |
| nodePools | No | A string representing the ListNodePoolsResponse object. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true, idempotentHint=true, and destructiveHint=false. The description adds the cluster-scoping constraint but does not disclose pagination, ordering, or handling of empty results; with annotations covering the safety profile, a 3 is appropriate.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that conveys the essential purpose without any filler. Every word earns its place.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
For a simple one-parameter list operation with rich annotations and an output schema, the description is complete. The agent has enough information to select and invoke correctly.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the single 'parent' parameter, which documents the required format. The description adds little beyond saying 'specific GKE cluster', which is already implied by the schema. Baseline 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
Description clearly states the action ('Lists') and the target resource ('node pools for a specific GKE cluster'). This distinguishes it from sibling tools like get_node_pool (which fetches a single pool) and create/update node pool tools.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The verb 'Lists' implies this is for enumerating node pools, and the scope 'for a specific GKE cluster' indicates prerequisite context. However, no explicit alternative is mentioned (e.g., 'use get_node_pool for a single pool'), so guidance is only implied.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Lists GKE operations in a given project and location. Location can be a region, zone, or '-' for all locations.
| Name | Required | Description | Default |
|---|---|---|---|
| parent | Yes | Required. The parent (project and location) where the operations will be listed. Specified in the format `projects/*/locations/*`. Location "-" matches all zones and all regions. |
| Name | Required | Description |
|---|---|---|
| errors | No | Errors encountered during operations listing. |
| operations | No | A list of JSON strings of GKE Operation objects. See: https://docs.cloud.google.com/kubernetes-engine/docs/reference/rest/v1/projects.locations.operations |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already declare readOnlyHint=true and idempotentHint=true, so the safety profile is covered. The description adds valuable behavioral context, specifically that the location parameter accepts a region, zone, or '-' for all locations, and that listing is scoped to a given project and location. No contradictions with annotations.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence that directly states the core functionality and the most important usage nuance (location wildcard). There is no redundant or extraneous information, making it highly concise and efficient.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The tool is simple (one parameter, read-only) and the output schema exists, so return-value details are covered externally. The description conveys the essential purpose and the key location behavior. A small gap is the lack of any mention of pagination or whether only active operations are returned, but these may be addressed by the output schema, and the simplicity of the tool keeps it mostly complete.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100% for the 'parent' parameter, with detailed format ('projects/*/locations/*') and explanation of '-' wildcard already provided in the schema. The tool description paraphrases the location flexibility but adds little new semantic value beyond what the schema already documents, so the baseline score of 3 is appropriate.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description uses a specific verb ('Lists') and identifies the exact resource ('GKE operations') and scope ('in a given project and location'). It clearly distinguishes from sibling tools like get_operation (single operation) and cancel_operation (mutation) by focusing on the listing behavior.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description clarifies the scope (project and location) and notes the wildcard '-' for all locations, which implies when it might be used (e.g., to list across all zones/regions). However, it does not explicitly mention when to use this tool versus alternatives like get_operation, leaving the usage context somewhat implied rather than spelled out.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Patches a Kubernetes resource. This is similar to running kubectl patch.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Required. The name of the resource to patch. | |
| patch | Yes | Required. The patch to apply in JSON format. | |
| parent | Yes | Required. The cluster to patch the resource in. Format: projects/{project}/locations/{location}/clusters/{cluster} | |
| namespace | No | Optional. The namespace of the resource. If not specified, "default" is used. | |
| patchType | No | Optional. The patch strategy to apply. Valid values are "strategic", "merge", or "json". If not specified, "strategic" patch type will be used. | |
| resourceType | Yes | Required. The type of resource to patch. e.g. "pods", "deployments", "services". |
| Name | Required | Description |
|---|---|---|
| errors | No | Errors encountered during patching. |
| result | No | The result of the patch operation. |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already disclose destructiveHint=true, readOnlyHint=false, and idempotentHint=false, so the description does not need to repeat these. The description adds minimal behavioral context beyond the kubectl analogy; it does not explain side effects or requirements. This is adequate given the annotations, but not especially rich.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is two short sentences that are front-loaded with the core action and immediately provide a useful analogy. Every word contributes; there is no redundancy or filler.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the rich input schema (100% parameter coverage) and annotations (destructiveHint, readOnlyHint), the description is succinct but sufficient. The analogy to `kubectl patch` provides practical context for users familiar with Kubernetes tooling. It does not explain all nuances (e.g., patch types), but these are covered in the schema, and an output schema exists.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The input schema covers 100% of parameters with descriptions, so the baseline is 3. The description itself adds no parameter-level details, but this is acceptable because the schema fully documents each parameter (e.g., patchType valid values, namespace default).
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly states the tool's function: 'Patches a Kubernetes resource.' The verb 'patch' is specific and distinguishes it from sibling tools like apply_k8s_manifest, delete_k8s_resource, and get_k8s_resource. It also adds the apt comparison to `kubectl patch`, reinforcing the operation type.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
The description implies usage via the analogy to `kubectl patch`, suggesting it's for partial updates to existing resources. However, it does not explicitly state when to use this tool over apply_k8s_manifest or other alternatives, nor does it provide exclusions. The guidance is implicit rather than explicit.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Updates a specific GKE cluster.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Required. The name (project, location, cluster) of the cluster to update. Specified in the format `projects/*/locations/*/clusters/*`. | |
| update | Yes | Required. A description of the update represented as a string using JSON format. The full update request object can be found at https://cloud.google.com/container-engine/reference/rest/v1/projects.locations.clusters/update https://docs.cloud.google.com/kubernetes-engine/docs/reference/rest/v1/ClusterUpdate |
| Name | Required | Description |
|---|---|---|
| errors | No | Errors encountered during the operation. |
| operation | No | JSON string of the GKE Operation object. See: https://docs.cloud.google.com/kubernetes-engine/docs/reference/rest/v1/projects.locations.operations |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
Annotations already disclose destructiveHint=true, readOnlyHint=false, and idempotentHint=true, so the safety profile is covered. The description adds no additional behavioral context (e.g., permission requirements, side effects). It is consistent with annotations but does not enrich the transparency beyond them.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, front-loaded sentence with no redundancy or filler. Every word contributes to meaning, making it highly concise and appropriately structured.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
Given the rich schema descriptions, output schema, and annotations, the one-line description is mostly sufficient to identify the tool and its purpose. However, it does not clarify the nature of the update (e.g., full replacement vs. partial patch), which would be useful for a mutation tool.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
Schema description coverage is 100%, with both 'name' and 'update' having descriptive explanations in the input schema. The tool description itself mentions no parameter details, but the schema carries the full burden, so a baseline score of 3 applies.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description states a clear verb ('updates') and a specific resource ('GKE cluster'), distinguishing it from sibling tools like update_node_pool or create_cluster. The word 'specific' reinforces the targeted single-cluster operation, making the purpose unambiguous.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
No guidance is provided about when to use this tool vs alternatives such as patch_k8s_resource or update_node_pool. The description only states what it does, with no prerequisites or exclusions, leaving the agent without contextual decision support.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Updates a specific node pool within a GKE cluster.
| Name | Required | Description | Default |
|---|---|---|---|
| name | Yes | Required. The name (project, location, cluster, node pool) of the node pool to update. Specified in the format 'projects/*/locations/*/clusters/*/nodePools/*'. | |
| update | Yes | Required. A [node pool update request](https://cloud.google.com/container-engine/reference/rest/v1/projects.locations.clusters.nodePools/update) represented as a string using JSON format. |
| Name | Required | Description |
|---|---|---|
| errors | No | Errors encountered during the operation. |
| operation | No | JSON string of the GKE Operation object. See: https://docs.cloud.google.com/kubernetes-engine/docs/reference/rest/v1/projects.locations.operations |
Does the description disclose side effects, auth requirements, rate limits, or destructive behavior?
The description adds no behavioral context beyond the annotations. Annotations already indicate a mutating, destructive, idempotent operation, and the description merely restates 'updates' without detailing potential side effects like node replacement or whether the update is partial or full.
Agents need to know what a tool does to the world before calling it. Descriptions should go beyond structured annotations to explain consequences.
Is the description appropriately sized, front-loaded, and free of redundancy?
The description is a single, concise sentence with no filler. It is front-loaded and efficiently conveys the tool's core purpose.
Shorter descriptions cost fewer tokens and are easier for agents to parse. Every sentence should earn its place.
Given the tool's complexity, does the description cover enough for an agent to succeed on first attempt?
The description, combined with the full input schema and output schema, is adequate but lacks contextual richness. It doesn't mention when to choose this over create/delete node pools or any caveats about the update request, leaving some ambiguity.
Complex tools with many parameters or behaviors need more documentation. Simple tools need less. This dimension scales expectations accordingly.
Does the description clarify parameter syntax, constraints, interactions, or defaults beyond what the schema provides?
The description does not explain parameters, but the input schema provides complete descriptions for both required parameters (name and update). Since schema coverage is 100%, the description adds no extra meaning beyond the schema.
Input schemas describe structure but not intent. Descriptions should explain non-obvious parameter relationships and valid value ranges.
Does the description clearly state what the tool does and how it differs from similar tools?
The description clearly identifies the tool as updating a node pool in a GKE cluster, using a specific verb and resource. It distinguishes from sibling tools like create_node_pool and get_node_pool, though it doesn't elaborate on the types of updates possible.
Agents choose between tools based on descriptions. A clear purpose with a specific verb and resource helps agents select the right tool.
Does the description explain when to use this tool, when not to, or what alternatives exist?
There is no guidance on when to use this tool versus alternatives such as update_cluster or create_node_pool. No prerequisites, exclusions, or scenarios are mentioned.
Agents often have multiple tools that could apply. Explicit usage guidance like "use X instead of Y when Z" prevents misuse.
Recent tool additions, removals, and schema changes observed during successful MCP inspections. Dates show when Glama detected each change.
patch_k8s_resource1 field changedInput schema / properties / patchTypeAdded value: +{
+ "description": "Optional. The patch strategy to apply. Valid values are \"strategic\", \"merge\", or \"json\". If not specified, \"strategic\" patch type will be used.",
+ "type": "string"
+}apply_k8s_manifestcancel_operationcheck_k8s_authcreate_clustercreate_node_pooldelete_k8s_resourcedescribe_k8s_resourceget_k8s_cluster_infoget_k8s_logsget_k8s_resourceget_k8s_rollout_statusget_k8s_versionkube_api_resourceskube_getlist_k8s_api_resourceslist_k8s_eventspatch_k8s_resourceupdate_clusterupdate_node_poolget_cluster2 fields changedOutput schema / $defsAdded value: +{
+ "Status": {
+ "description": "The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).",
+ "properties": {
+ "code": {
+ "description": "The status code, which should be an enum value of google.rpc.Code.",
+ "format": "int32",
+ "type": "integer"
+ },
+ "details": {
+ "description": "A list of messages that carry the error details. There is a common set of message types for APIs to use.",
+ "items": {
+ "additionalProperties": {
+ "description": "Properties of the object. Contains field @type with type URL."
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "message": {
+ "description": "A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ }
+}Output schema / properties / errorsAdded value: +{
+ "description": "Errors encountered during cluster retrieval.",
+ "items": {
+ "$ref": "#/$defs/Status"
+ },
+ "type": "array"
+}get_node_pool2 fields changedOutput schema / $defsAdded value: +{
+ "Status": {
+ "description": "The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).",
+ "properties": {
+ "code": {
+ "description": "The status code, which should be an enum value of google.rpc.Code.",
+ "format": "int32",
+ "type": "integer"
+ },
+ "details": {
+ "description": "A list of messages that carry the error details. There is a common set of message types for APIs to use.",
+ "items": {
+ "additionalProperties": {
+ "description": "Properties of the object. Contains field @type with type URL."
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "message": {
+ "description": "A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ }
+}Output schema / properties / errorsAdded value: +{
+ "description": "Errors encountered during node pool retrieval.",
+ "items": {
+ "$ref": "#/$defs/Status"
+ },
+ "type": "array"
+}get_operation21 fields changedOutput schema / $defs / MetricRemoved value: -{
- "description": "Progress metric is (string, int|float|string) pair.",
- "properties": {
- "doubleValue": {
- "description": "For metrics with floating point value.",
- "format": "double",
- "type": "number"
- },
- "intValue": {
- "description": "For metrics with integer value.",
- "format": "int64",
- "type": "string"
- },
- "name": {
- "description": "Required. Metric name, e.g., \"nodes total\", \"percent done\".",
- "type": "string"
- },
- "stringValue": {
- "description": "For metrics with custom values (ratios, visual progress, etc.).",
- "type": "string"
- }
- },
- "type": "object"
-}Output schema / $defs / OperationProgressRemoved value: -{
- "description": "Information about operation (or operation stage) progress.",
- "properties": {
- "metrics": {
- "description": "Progress metric bundle, for example: metrics: [{name: \"nodes done\", int_value: 15}, {name: \"nodes total\", int_value: 32}] or metrics: [{name: \"progress\", double_value: 0.56}, {name: \"progress scale\", double_value: 1.0}]",
- "items": {
- "$ref": "#/$defs/Metric"
- },
- "type": "array"
- },
- "name": {
- "description": "A non-parameterized string describing an operation stage. Unset for single-stage operations.",
- "type": "string"
- },
- "stages": {
- "description": "Substages of an operation or a stage.",
- "items": {
- "$ref": "#/$defs/OperationProgress"
- },
- "type": "array"
- },
- "status": {
- "description": "Status of an operation stage. Unset for single-stage operations.",
- "enum": [
- "STATUS_UNSPECIFIED",
- "PENDING",
- "RUNNING",
- "DONE",
- "ABORTING"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Not set.",
- "The operation has been created.",
- "The operation is currently running.",
- "The operation is done, either cancelled or completed.",
- "The operation is aborting."
- ]
- }
- },
- "type": "object"
-}Output schema / $defs / StatusConditionRemoved value: -{
- "description": "StatusCondition describes why a cluster or a node pool has a certain status (e.g., ERROR or DEGRADED).",
- "properties": {
- "canonicalCode": {
- "description": "Canonical code of the condition.",
- "enum": [
- "OK",
- "CANCELLED",
- "UNKNOWN",
- "INVALID_ARGUMENT",
- "DEADLINE_EXCEEDED",
- "NOT_FOUND",
- "ALREADY_EXISTS",
- "PERMISSION_DENIED",
- "UNAUTHENTICATED",
- "RESOURCE_EXHAUSTED",
- "FAILED_PRECONDITION",
- "ABORTED",
- "OUT_OF_RANGE",
- "UNIMPLEMENTED",
- "INTERNAL",
- "UNAVAILABLE",
- "DATA_LOSS"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Not an error; returned on success. HTTP Mapping: 200 OK",
- "The operation was cancelled, typically by the caller. HTTP Mapping: 499 Client Closed Request",
- "Unknown error. For example, this error may be returned when a `Status` value received from another address space belongs to an error space that is not known in this address space. Also errors raised by APIs that do not return enough error information may be converted to this error. HTTP Mapping: 500 Internal Server Error",
- "The client specified an invalid argument. Note that this differs from `FAILED_PRECONDITION`. `INVALID_ARGUMENT` indicates arguments that are problematic regardless of the state of the system (e.g., a malformed file name). HTTP Mapping: 400 Bad Request",
- "The deadline expired before the operation could complete. For operations that change the state of the system, this error may be returned even if the operation has completed successfully. For example, a successful response from a server could have been delayed long enough for the deadline to expire. HTTP Mapping: 504 Gateway Timeout",
- "Some requested entity (e.g., file or directory) was not found. Note to server developers: if a request is denied for an entire class of users, such as gradual feature rollout or undocumented allowlist, `NOT_FOUND` may be used. If a request is denied for some users within a class of users, such as user-based access control, `PERMISSION_DENIED` must be used. HTTP Mapping: 404 Not Found",
- "The entity that a client attempted to create (e.g., file or directory) already exists. HTTP Mapping: 409 Conflict",
- "The caller does not have permission to execute the specified operation. `PERMISSION_DENIED` must not be used for rejections caused by exhausting some resource (use `RESOURCE_EXHAUSTED` instead for those errors). `PERMISSION_DENIED` must not be used if the caller can not be identified (use `UNAUTHENTICATED` instead for those errors). This error code does not imply the request is valid or the requested entity exists or satisfies other pre-conditions. HTTP Mapping: 403 Forbidden",
- "The request does not have valid authentication credentials for the operation. HTTP Mapping: 401 Unauthorized",
- "Some resource has been exhausted, perhaps a per-user quota, or perhaps the entire file system is out of space. HTTP Mapping: 429 Too Many Requests",
- "The operation was rejected because the system is not in a state required for the operation's execution. For example, the directory to be deleted is non-empty, an rmdir operation is applied to a non-directory, etc. Service implementors can use the following guidelines to decide between `FAILED_PRECONDITION`, `ABORTED`, and `UNAVAILABLE`: (a) Use `UNAVAILABLE` if the client can retry just the failing call. (b) Use `ABORTED` if the client should retry at a higher level. For example, when a client-specified test-and-set fails, indicating the client should restart a read-modify-write sequence. (c) Use `FAILED_PRECONDITION` if the client should not retry until the system state has been explicitly fixed. For example, if an \"rmdir\" fails because the directory is non-empty, `FAILED_PRECONDITION` should be returned since the client should not retry unless the files are deleted from the directory. HTTP Mapping: 400 Bad Request",
- "The operation was aborted, typically due to a concurrency issue such as a sequencer check failure or transaction abort. See the guidelines above for deciding between `FAILED_PRECONDITION`, `ABORTED`, and `UNAVAILABLE`. HTTP Mapping: 409 Conflict",
- "The operation was attempted past the valid range. E.g., seeking or reading past end-of-file. Unlike `INVALID_ARGUMENT`, this error indicates a problem that may be fixed if the system state changes. For example, a 32-bit file system will generate `INVALID_ARGUMENT` if asked to read at an offset that is not in the range [0,2^32-1], but it will generate `OUT_OF_RANGE` if asked to read from an offset past the current file size. There is a fair bit of overlap between `FAILED_PRECONDITION` and `OUT_OF_RANGE`. We recommend using `OUT_OF_RANGE` (the more specific error) when it applies so that callers who are iterating through a space can easily look for an `OUT_OF_RANGE` error to detect when they are done. HTTP Mapping: 400 Bad Request",
- "The operation is not implemented or is not supported/enabled in this service. HTTP Mapping: 501 Not Implemented",
- "Internal errors. This means that some invariants expected by the underlying system have been broken. This error code is reserved for serious errors. HTTP Mapping: 500 Internal Server Error",
- "The service is currently unavailable. This is most likely a transient condition, which can be corrected by retrying with a backoff. Note that it is not always safe to retry non-idempotent operations. See the guidelines above for deciding between `FAILED_PRECONDITION`, `ABORTED`, and `UNAVAILABLE`. HTTP Mapping: 503 Service Unavailable",
- "Unrecoverable data loss or corruption. HTTP Mapping: 500 Internal Server Error"
- ]
- },
- "code": {
- "deprecated": true,
- "description": "Machine-friendly representation of the condition Deprecated. Use canonical_code instead.",
- "enum": [
- "UNKNOWN",
- "GCE_STOCKOUT",
- "GKE_SERVICE_ACCOUNT_DELETED",
- "GCE_QUOTA_EXCEEDED",
- "SET_BY_OPERATOR",
- "CLOUD_KMS_KEY_ERROR",
- "CA_EXPIRING",
- "NODE_SERVICE_ACCOUNT_MISSING_PERMISSIONS",
- "CLOUD_KMS_KEY_DESTROYED"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "UNKNOWN indicates a generic condition.",
- "GCE_STOCKOUT indicates that Google Compute Engine resources are temporarily unavailable.",
- "GKE_SERVICE_ACCOUNT_DELETED indicates that the user deleted their robot service account.",
- "Google Compute Engine quota was exceeded.",
- "Cluster state was manually changed by an SRE due to a system logic error.",
- "Unable to perform an encrypt operation against the CloudKMS key used for etcd level encryption.",
- "Cluster CA is expiring soon.",
- "Node service account is missing permissions.",
- "Cloud KMS key version used for etcd level encryption has been destroyed. This is a permanent error."
- ]
- },
- "message": {
- "description": "Human-friendly representation of the condition",
- "type": "string"
- }
- },
- "type": "object"
-}Output schema / descriptionPrevious value: -"This operation resource represents operations that may have happened or are happening on the cluster. All fields are output only."New value: +"MCPOperation wraps the GKE Operation with an errors field."Output schema / properties / clusterConditionsRemoved value: -{
- "deprecated": true,
- "description": "Which conditions caused the current cluster state. Deprecated. Use field error instead.",
- "items": {
- "$ref": "#/$defs/StatusCondition"
- },
- "type": "array"
-}Output schema / properties / detailRemoved value: -{
- "description": "Output only. Detailed operation progress, if available.",
- "readOnly": true,
- "type": "string"
-}Output schema / properties / endTimeRemoved value: -{
- "description": "Output only. The time the operation completed, in [RFC3339](https://www.ietf.org/rfc/rfc3339.txt) text format.",
- "readOnly": true,
- "type": "string"
-}Output schema / properties / errorRemoved value: -{
- "$ref": "#/$defs/Status",
- "description": "The error result of the operation in case of failure."
-}Output schema / properties / errorsAdded value: +{
+ "description": "Errors encountered during the operation.",
+ "items": {
+ "$ref": "#/$defs/Status"
+ },
+ "type": "array"
+}Output schema / properties / locationRemoved value: -{
- "description": "Output only. The name of the Google Compute Engine [zone](https://cloud.google.com/compute/docs/regions-zones/regions-zones#available) or [region](https://cloud.google.com/compute/docs/regions-zones/regions-zones#available) in which the cluster resides.",
- "readOnly": true,
- "type": "string"
-}Output schema / properties / nameRemoved value: -{
- "description": "Output only. The server-assigned ID for the operation.",
- "readOnly": true,
- "type": "string"
-}Output schema / properties / nodepoolConditionsRemoved value: -{
- "deprecated": true,
- "description": "Which conditions caused the current node pool state. Deprecated. Use field error instead.",
- "items": {
- "$ref": "#/$defs/StatusCondition"
- },
- "type": "array"
-}Output schema / properties / operationAdded value: +{
+ "description": "JSON string of the GKE Operation object. See: https://docs.cloud.google.com/kubernetes-engine/docs/reference/rest/v1/projects.locations.operations",
+ "type": "string"
+}Output schema / properties / operationTypeRemoved value: -{
- "description": "Output only. The operation type.",
- "enum": [
- "TYPE_UNSPECIFIED",
- "CREATE_CLUSTER",
- "DELETE_CLUSTER",
- "UPGRADE_MASTER",
- "UPGRADE_NODES",
- "REPAIR_CLUSTER",
- "UPDATE_CLUSTER",
- "CREATE_NODE_POOL",
- "DELETE_NODE_POOL",
- "SET_NODE_POOL_MANAGEMENT",
- "AUTO_REPAIR_NODES",
- "AUTO_UPGRADE_NODES",
- "SET_LABELS",
- "SET_MASTER_AUTH",
- "SET_NODE_POOL_SIZE",
- "SET_NETWORK_POLICY",
- "SET_MAINTENANCE_POLICY",
- "RESIZE_CLUSTER",
- "FLEET_FEATURE_UPGRADE"
- ],
- "readOnly": true,
- "type": "string",
- "x-google-enum-deprecated": [
- false,
- false,
- false,
- false,
- false,
- false,
- false,
- false,
- false,
- false,
- false,
- true,
- true,
- true,
- false,
- true,
- true,
- false,
- false
- ],
- "x-google-enum-descriptions": [
- "Not set.",
- "The cluster is being created. The cluster should be assumed to be unusable until the operation finishes. In the event of the operation failing, the cluster will enter the ERROR state and eventually be deleted.",
- "The cluster is being deleted. The cluster should be assumed to be unusable as soon as this operation starts. In the event of the operation failing, the cluster will enter the ERROR state and the deletion will be automatically retried until completed.",
- "The cluster version is being updated. Note that this includes \"upgrades\" to the same version, which are simply a recreation. This also includes [auto-upgrades](https://cloud.google.com/kubernetes-engine/docs/concepts/cluster-upgrades#upgrading_automatically). For more details, see [documentation on cluster upgrades](https://cloud.google.com/kubernetes-engine/docs/concepts/cluster-upgrades#cluster_upgrades).",
- "A node pool is being updated. Despite calling this an \"upgrade\", this includes most forms of updates to node pools. This also includes [auto-upgrades](https://cloud.google.com/kubernetes-engine/docs/how-to/node-auto-upgrades). This operation sets the progress field and may be canceled. The upgrade strategy depends on [node pool configuration](https://cloud.google.com/kubernetes-engine/docs/concepts/node-pool-upgrade-strategies). The nodes are generally still usable during this operation.",
- "A problem has been detected with the control plane and is being repaired. This operation type is initiated by GKE. For more details, see [documentation on repairs](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#repairs).",
- "The cluster is being updated. This is a broad category of operations and includes operations that only change metadata as well as those that must recreate the entire cluster. If the control plane must be recreated, this will cause temporary downtime for zonal clusters. Some features require recreating the nodes as well. Those will be recreated as separate operations and the update may not be completely functional until the node pools recreations finish. Node recreations will generally follow [maintenance policies](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions). Some GKE-initiated operations use this type. This includes certain types of auto-upgrades and incident mitigations.",
- "A node pool is being created. The node pool should be assumed to be unusable until this operation finishes. In the event of an error, the node pool may be partially created. If enabled, [node autoprovisioning](https://cloud.google.com/kubernetes-engine/docs/how-to/node-auto-provisioning) may have automatically initiated such operations.",
- "The node pool is being deleted. The node pool should be assumed to be unusable as soon as this operation starts.",
- "The node pool's manamagent field is being updated. These operations only update metadata and may be concurrent with most other operations.",
- "A problem has been detected with nodes and [they are being repaired](https://cloud.google.com/kubernetes-engine/docs/how-to/node-auto-repair). This operation type is initiated by GKE, typically automatically. This operation may be concurrent with other operations and there may be multiple repairs occurring on the same node pool.",
- "Unused. Automatic node upgrade uses UPGRADE_NODES.",
- "Unused. Updating labels uses UPDATE_CLUSTER.",
- "Unused. Updating master auth uses UPDATE_CLUSTER.",
- "The node pool is being resized. With the exception of resizing to or from size zero, the node pool is generally usable during this operation.",
- "Unused. Updating network policy uses UPDATE_CLUSTER.",
- "Unused. Updating maintenance policy uses UPDATE_CLUSTER.",
- "The control plane is being resized. This operation type is initiated by GKE. These operations are often performed preemptively to ensure that the control plane has sufficient resources and is not typically an indication of issues. For more details, see [documentation on resizes](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#repairs).",
- "Fleet features of GKE Enterprise are being upgraded. The cluster should be assumed to be blocked for other upgrades until the operation finishes."
- ]
-}Output schema / properties / progressRemoved value: -{
- "$ref": "#/$defs/OperationProgress",
- "description": "Output only. Progress information for an operation.",
- "readOnly": true
-}Output schema / properties / selfLinkRemoved value: -{
- "description": "Output only. Server-defined URI for the operation. Example: `https://container.googleapis.com/v1alpha1/projects/123/locations/us-central1/operations/operation-123`.",
- "readOnly": true,
- "type": "string"
-}Output schema / properties / startTimeRemoved value: -{
- "description": "Output only. The time the operation started, in [RFC3339](https://www.ietf.org/rfc/rfc3339.txt) text format.",
- "readOnly": true,
- "type": "string"
-}Output schema / properties / statusRemoved value: -{
- "description": "Output only. The current status of the operation.",
- "enum": [
- "STATUS_UNSPECIFIED",
- "PENDING",
- "RUNNING",
- "DONE",
- "ABORTING"
- ],
- "readOnly": true,
- "type": "string",
- "x-google-enum-descriptions": [
- "Not set.",
- "The operation has been created.",
- "The operation is currently running.",
- "The operation is done, either cancelled or completed.",
- "The operation is aborting."
- ]
-}Output schema / properties / statusMessageRemoved value: -{
- "deprecated": true,
- "description": "Output only. If an error has occurred, a textual description of the error. Deprecated. Use the field error instead.",
- "readOnly": true,
- "type": "string"
-}Output schema / properties / targetLinkRemoved value: -{
- "description": "Output only. Server-defined URI for the target of the operation. The format of this is a URI to the resource being modified (such as a cluster, node pool, or node). For node pool repairs, there may be multiple nodes being repaired, but only one will be the target. Examples: - ## `https://container.googleapis.com/v1/projects/123/locations/us-central1/clusters/my-cluster` ## `https://container.googleapis.com/v1/projects/123/zones/us-central1-c/clusters/my-cluster/nodePools/my-np` `https://container.googleapis.com/v1/projects/123/zones/us-central1-c/clusters/my-cluster/nodePools/my-np/node/my-node`",
- "readOnly": true,
- "type": "string"
-}Output schema / properties / zoneRemoved value: -{
- "deprecated": true,
- "description": "Output only. The name of the Google Compute Engine [zone](https://cloud.google.com/compute/docs/zones#available) in which the operation is taking place. This field is deprecated, use location instead.",
- "readOnly": true,
- "type": "string"
-}kube_api_resources2 fields changedOutput schema / $defs / StatusAdded value: +{
+ "description": "The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).",
+ "properties": {
+ "code": {
+ "description": "The status code, which should be an enum value of google.rpc.Code.",
+ "format": "int32",
+ "type": "integer"
+ },
+ "details": {
+ "description": "A list of messages that carry the error details. There is a common set of message types for APIs to use.",
+ "items": {
+ "additionalProperties": {
+ "description": "Properties of the object. Contains field @type with type URL."
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "message": {
+ "description": "A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.",
+ "type": "string"
+ }
+ },
+ "type": "object"
+}Output schema / properties / errorsAdded value: +{
+ "description": "Errors encountered during discovery.",
+ "items": {
+ "$ref": "#/$defs/Status"
+ },
+ "type": "array"
+}kube_get2 fields changedOutput schema / $defsAdded value: +{
+ "Status": {
+ "description": "The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).",
+ "properties": {
+ "code": {
+ "description": "The status code, which should be an enum value of google.rpc.Code.",
+ "format": "int32",
+ "type": "integer"
+ },
+ "details": {
+ "description": "A list of messages that carry the error details. There is a common set of message types for APIs to use.",
+ "items": {
+ "additionalProperties": {
+ "description": "Properties of the object. Contains field @type with type URL."
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "message": {
+ "description": "A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ }
+}Output schema / properties / errorsAdded value: +{
+ "description": "Errors encountered during retrieval.",
+ "items": {
+ "$ref": "#/$defs/Status"
+ },
+ "type": "array"
+}list_clusters2 fields changedOutput schema / $defsAdded value: +{
+ "Status": {
+ "description": "The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).",
+ "properties": {
+ "code": {
+ "description": "The status code, which should be an enum value of google.rpc.Code.",
+ "format": "int32",
+ "type": "integer"
+ },
+ "details": {
+ "description": "A list of messages that carry the error details. There is a common set of message types for APIs to use.",
+ "items": {
+ "additionalProperties": {
+ "description": "Properties of the object. Contains field @type with type URL."
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "message": {
+ "description": "A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ }
+}Output schema / properties / errorsAdded value: +{
+ "description": "Errors encountered during cluster listing.",
+ "items": {
+ "$ref": "#/$defs/Status"
+ },
+ "type": "array"
+}list_node_pools2 fields changedOutput schema / $defsAdded value: +{
+ "Status": {
+ "description": "The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).",
+ "properties": {
+ "code": {
+ "description": "The status code, which should be an enum value of google.rpc.Code.",
+ "format": "int32",
+ "type": "integer"
+ },
+ "details": {
+ "description": "A list of messages that carry the error details. There is a common set of message types for APIs to use.",
+ "items": {
+ "additionalProperties": {
+ "description": "Properties of the object. Contains field @type with type URL."
+ },
+ "type": "object"
+ },
+ "type": "array"
+ },
+ "message": {
+ "description": "A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.",
+ "type": "string"
+ }
+ },
+ "type": "object"
+ }
+}Output schema / properties / errorsAdded value: +{
+ "description": "Errors encountered during node pool listing.",
+ "items": {
+ "$ref": "#/$defs/Status"
+ },
+ "type": "array"
+}list_operations10 fields changedOutput schema / $defs / MetricRemoved value: -{
- "description": "Progress metric is (string, int|float|string) pair.",
- "properties": {
- "doubleValue": {
- "description": "For metrics with floating point value.",
- "format": "double",
- "type": "number"
- },
- "intValue": {
- "description": "For metrics with integer value.",
- "format": "int64",
- "type": "string"
- },
- "name": {
- "description": "Required. Metric name, e.g., \"nodes total\", \"percent done\".",
- "type": "string"
- },
- "stringValue": {
- "description": "For metrics with custom values (ratios, visual progress, etc.).",
- "type": "string"
- }
- },
- "type": "object"
-}Output schema / $defs / OperationRemoved value: -{
- "description": "This operation resource represents operations that may have happened or are happening on the cluster. All fields are output only.",
- "properties": {
- "clusterConditions": {
- "deprecated": true,
- "description": "Which conditions caused the current cluster state. Deprecated. Use field error instead.",
- "items": {
- "$ref": "#/$defs/StatusCondition"
- },
- "type": "array"
- },
- "detail": {
- "description": "Output only. Detailed operation progress, if available.",
- "readOnly": true,
- "type": "string"
- },
- "endTime": {
- "description": "Output only. The time the operation completed, in [RFC3339](https://www.ietf.org/rfc/rfc3339.txt) text format.",
- "readOnly": true,
- "type": "string"
- },
- "error": {
- "$ref": "#/$defs/Status",
- "description": "The error result of the operation in case of failure."
- },
- "location": {
- "description": "Output only. The name of the Google Compute Engine [zone](https://cloud.google.com/compute/docs/regions-zones/regions-zones#available) or [region](https://cloud.google.com/compute/docs/regions-zones/regions-zones#available) in which the cluster resides.",
- "readOnly": true,
- "type": "string"
- },
- "name": {
- "description": "Output only. The server-assigned ID for the operation.",
- "readOnly": true,
- "type": "string"
- },
- "nodepoolConditions": {
- "deprecated": true,
- "description": "Which conditions caused the current node pool state. Deprecated. Use field error instead.",
- "items": {
- "$ref": "#/$defs/StatusCondition"
- },
- "type": "array"
- },
- "operationType": {
- "description": "Output only. The operation type.",
- "enum": [
- "TYPE_UNSPECIFIED",
- "CREATE_CLUSTER",
- "DELETE_CLUSTER",
- "UPGRADE_MASTER",
- "UPGRADE_NODES",
- "REPAIR_CLUSTER",
- "UPDATE_CLUSTER",
- "CREATE_NODE_POOL",
- "DELETE_NODE_POOL",
- "SET_NODE_POOL_MANAGEMENT",
- "AUTO_REPAIR_NODES",
- "AUTO_UPGRADE_NODES",
- "SET_LABELS",
- "SET_MASTER_AUTH",
- "SET_NODE_POOL_SIZE",
- "SET_NETWORK_POLICY",
- "SET_MAINTENANCE_POLICY",
- "RESIZE_CLUSTER",
- "FLEET_FEATURE_UPGRADE"
- ],
- "readOnly": true,
- "type": "string",
- "x-google-enum-deprecated": [
- false,
- false,
- false,
- false,
- false,
- false,
- false,
- false,
- false,
- false,
- false,
- true,
- true,
- true,
- false,
- true,
- true,
- false,
- false
- ],
- "x-google-enum-descriptions": [
- "Not set.",
- "The cluster is being created. The cluster should be assumed to be unusable until the operation finishes. In the event of the operation failing, the cluster will enter the ERROR state and eventually be deleted.",
- "The cluster is being deleted. The cluster should be assumed to be unusable as soon as this operation starts. In the event of the operation failing, the cluster will enter the ERROR state and the deletion will be automatically retried until completed.",
- "The cluster version is being updated. Note that this includes \"upgrades\" to the same version, which are simply a recreation. This also includes [auto-upgrades](https://cloud.google.com/kubernetes-engine/docs/concepts/cluster-upgrades#upgrading_automatically). For more details, see [documentation on cluster upgrades](https://cloud.google.com/kubernetes-engine/docs/concepts/cluster-upgrades#cluster_upgrades).",
- "A node pool is being updated. Despite calling this an \"upgrade\", this includes most forms of updates to node pools. This also includes [auto-upgrades](https://cloud.google.com/kubernetes-engine/docs/how-to/node-auto-upgrades). This operation sets the progress field and may be canceled. The upgrade strategy depends on [node pool configuration](https://cloud.google.com/kubernetes-engine/docs/concepts/node-pool-upgrade-strategies). The nodes are generally still usable during this operation.",
- "A problem has been detected with the control plane and is being repaired. This operation type is initiated by GKE. For more details, see [documentation on repairs](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#repairs).",
- "The cluster is being updated. This is a broad category of operations and includes operations that only change metadata as well as those that must recreate the entire cluster. If the control plane must be recreated, this will cause temporary downtime for zonal clusters. Some features require recreating the nodes as well. Those will be recreated as separate operations and the update may not be completely functional until the node pools recreations finish. Node recreations will generally follow [maintenance policies](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions). Some GKE-initiated operations use this type. This includes certain types of auto-upgrades and incident mitigations.",
- "A node pool is being created. The node pool should be assumed to be unusable until this operation finishes. In the event of an error, the node pool may be partially created. If enabled, [node autoprovisioning](https://cloud.google.com/kubernetes-engine/docs/how-to/node-auto-provisioning) may have automatically initiated such operations.",
- "The node pool is being deleted. The node pool should be assumed to be unusable as soon as this operation starts.",
- "The node pool's manamagent field is being updated. These operations only update metadata and may be concurrent with most other operations.",
- "A problem has been detected with nodes and [they are being repaired](https://cloud.google.com/kubernetes-engine/docs/how-to/node-auto-repair). This operation type is initiated by GKE, typically automatically. This operation may be concurrent with other operations and there may be multiple repairs occurring on the same node pool.",
- "Unused. Automatic node upgrade uses UPGRADE_NODES.",
- "Unused. Updating labels uses UPDATE_CLUSTER.",
- "Unused. Updating master auth uses UPDATE_CLUSTER.",
- "The node pool is being resized. With the exception of resizing to or from size zero, the node pool is generally usable during this operation.",
- "Unused. Updating network policy uses UPDATE_CLUSTER.",
- "Unused. Updating maintenance policy uses UPDATE_CLUSTER.",
- "The control plane is being resized. This operation type is initiated by GKE. These operations are often performed preemptively to ensure that the control plane has sufficient resources and is not typically an indication of issues. For more details, see [documentation on resizes](https://cloud.google.com/kubernetes-engine/docs/concepts/maintenance-windows-and-exclusions#repairs).",
- "Fleet features of GKE Enterprise are being upgraded. The cluster should be assumed to be blocked for other upgrades until the operation finishes."
- ]
- },
- "progress": {
- "$ref": "#/$defs/OperationProgress",
- "description": "Output only. Progress information for an operation.",
- "readOnly": true
- },
- "selfLink": {
- "description": "Output only. Server-defined URI for the operation. Example: `https://container.googleapis.com/v1alpha1/projects/123/locations/us-central1/operations/operation-123`.",
- "readOnly": true,
- "type": "string"
- },
- "startTime": {
- "description": "Output only. The time the operation started, in [RFC3339](https://www.ietf.org/rfc/rfc3339.txt) text format.",
- "readOnly": true,
- "type": "string"
- },
- "status": {
- "description": "Output only. The current status of the operation.",
- "enum": [
- "STATUS_UNSPECIFIED",
- "PENDING",
- "RUNNING",
- "DONE",
- "ABORTING"
- ],
- "readOnly": true,
- "type": "string",
- "x-google-enum-descriptions": [
- "Not set.",
- "The operation has been created.",
- "The operation is currently running.",
- "The operation is done, either cancelled or completed.",
- "The operation is aborting."
- ]
- },
- "statusMessage": {
- "deprecated": true,
- "description": "Output only. If an error has occurred, a textual description of the error. Deprecated. Use the field error instead.",
- "readOnly": true,
- "type": "string"
- },
- "targetLink": {
- "description": "Output only. Server-defined URI for the target of the operation. The format of this is a URI to the resource being modified (such as a cluster, node pool, or node). For node pool repairs, there may be multiple nodes being repaired, but only one will be the target. Examples: - ## `https://container.googleapis.com/v1/projects/123/locations/us-central1/clusters/my-cluster` ## `https://container.googleapis.com/v1/projects/123/zones/us-central1-c/clusters/my-cluster/nodePools/my-np` `https://container.googleapis.com/v1/projects/123/zones/us-central1-c/clusters/my-cluster/nodePools/my-np/node/my-node`",
- "readOnly": true,
- "type": "string"
- },
- "zone": {
- "deprecated": true,
- "description": "Output only. The name of the Google Compute Engine [zone](https://cloud.google.com/compute/docs/zones#available) in which the operation is taking place. This field is deprecated, use location instead.",
- "readOnly": true,
- "type": "string"
- }
- },
- "type": "object"
-}Output schema / $defs / OperationProgressRemoved value: -{
- "description": "Information about operation (or operation stage) progress.",
- "properties": {
- "metrics": {
- "description": "Progress metric bundle, for example: metrics: [{name: \"nodes done\", int_value: 15}, {name: \"nodes total\", int_value: 32}] or metrics: [{name: \"progress\", double_value: 0.56}, {name: \"progress scale\", double_value: 1.0}]",
- "items": {
- "$ref": "#/$defs/Metric"
- },
- "type": "array"
- },
- "name": {
- "description": "A non-parameterized string describing an operation stage. Unset for single-stage operations.",
- "type": "string"
- },
- "stages": {
- "description": "Substages of an operation or a stage.",
- "items": {
- "$ref": "#/$defs/OperationProgress"
- },
- "type": "array"
- },
- "status": {
- "description": "Status of an operation stage. Unset for single-stage operations.",
- "enum": [
- "STATUS_UNSPECIFIED",
- "PENDING",
- "RUNNING",
- "DONE",
- "ABORTING"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Not set.",
- "The operation has been created.",
- "The operation is currently running.",
- "The operation is done, either cancelled or completed.",
- "The operation is aborting."
- ]
- }
- },
- "type": "object"
-}Output schema / $defs / StatusConditionRemoved value: -{
- "description": "StatusCondition describes why a cluster or a node pool has a certain status (e.g., ERROR or DEGRADED).",
- "properties": {
- "canonicalCode": {
- "description": "Canonical code of the condition.",
- "enum": [
- "OK",
- "CANCELLED",
- "UNKNOWN",
- "INVALID_ARGUMENT",
- "DEADLINE_EXCEEDED",
- "NOT_FOUND",
- "ALREADY_EXISTS",
- "PERMISSION_DENIED",
- "UNAUTHENTICATED",
- "RESOURCE_EXHAUSTED",
- "FAILED_PRECONDITION",
- "ABORTED",
- "OUT_OF_RANGE",
- "UNIMPLEMENTED",
- "INTERNAL",
- "UNAVAILABLE",
- "DATA_LOSS"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Not an error; returned on success. HTTP Mapping: 200 OK",
- "The operation was cancelled, typically by the caller. HTTP Mapping: 499 Client Closed Request",
- "Unknown error. For example, this error may be returned when a `Status` value received from another address space belongs to an error space that is not known in this address space. Also errors raised by APIs that do not return enough error information may be converted to this error. HTTP Mapping: 500 Internal Server Error",
- "The client specified an invalid argument. Note that this differs from `FAILED_PRECONDITION`. `INVALID_ARGUMENT` indicates arguments that are problematic regardless of the state of the system (e.g., a malformed file name). HTTP Mapping: 400 Bad Request",
- "The deadline expired before the operation could complete. For operations that change the state of the system, this error may be returned even if the operation has completed successfully. For example, a successful response from a server could have been delayed long enough for the deadline to expire. HTTP Mapping: 504 Gateway Timeout",
- "Some requested entity (e.g., file or directory) was not found. Note to server developers: if a request is denied for an entire class of users, such as gradual feature rollout or undocumented allowlist, `NOT_FOUND` may be used. If a request is denied for some users within a class of users, such as user-based access control, `PERMISSION_DENIED` must be used. HTTP Mapping: 404 Not Found",
- "The entity that a client attempted to create (e.g., file or directory) already exists. HTTP Mapping: 409 Conflict",
- "The caller does not have permission to execute the specified operation. `PERMISSION_DENIED` must not be used for rejections caused by exhausting some resource (use `RESOURCE_EXHAUSTED` instead for those errors). `PERMISSION_DENIED` must not be used if the caller can not be identified (use `UNAUTHENTICATED` instead for those errors). This error code does not imply the request is valid or the requested entity exists or satisfies other pre-conditions. HTTP Mapping: 403 Forbidden",
- "The request does not have valid authentication credentials for the operation. HTTP Mapping: 401 Unauthorized",
- "Some resource has been exhausted, perhaps a per-user quota, or perhaps the entire file system is out of space. HTTP Mapping: 429 Too Many Requests",
- "The operation was rejected because the system is not in a state required for the operation's execution. For example, the directory to be deleted is non-empty, an rmdir operation is applied to a non-directory, etc. Service implementors can use the following guidelines to decide between `FAILED_PRECONDITION`, `ABORTED`, and `UNAVAILABLE`: (a) Use `UNAVAILABLE` if the client can retry just the failing call. (b) Use `ABORTED` if the client should retry at a higher level. For example, when a client-specified test-and-set fails, indicating the client should restart a read-modify-write sequence. (c) Use `FAILED_PRECONDITION` if the client should not retry until the system state has been explicitly fixed. For example, if an \"rmdir\" fails because the directory is non-empty, `FAILED_PRECONDITION` should be returned since the client should not retry unless the files are deleted from the directory. HTTP Mapping: 400 Bad Request",
- "The operation was aborted, typically due to a concurrency issue such as a sequencer check failure or transaction abort. See the guidelines above for deciding between `FAILED_PRECONDITION`, `ABORTED`, and `UNAVAILABLE`. HTTP Mapping: 409 Conflict",
- "The operation was attempted past the valid range. E.g., seeking or reading past end-of-file. Unlike `INVALID_ARGUMENT`, this error indicates a problem that may be fixed if the system state changes. For example, a 32-bit file system will generate `INVALID_ARGUMENT` if asked to read at an offset that is not in the range [0,2^32-1], but it will generate `OUT_OF_RANGE` if asked to read from an offset past the current file size. There is a fair bit of overlap between `FAILED_PRECONDITION` and `OUT_OF_RANGE`. We recommend using `OUT_OF_RANGE` (the more specific error) when it applies so that callers who are iterating through a space can easily look for an `OUT_OF_RANGE` error to detect when they are done. HTTP Mapping: 400 Bad Request",
- "The operation is not implemented or is not supported/enabled in this service. HTTP Mapping: 501 Not Implemented",
- "Internal errors. This means that some invariants expected by the underlying system have been broken. This error code is reserved for serious errors. HTTP Mapping: 500 Internal Server Error",
- "The service is currently unavailable. This is most likely a transient condition, which can be corrected by retrying with a backoff. Note that it is not always safe to retry non-idempotent operations. See the guidelines above for deciding between `FAILED_PRECONDITION`, `ABORTED`, and `UNAVAILABLE`. HTTP Mapping: 503 Service Unavailable",
- "Unrecoverable data loss or corruption. HTTP Mapping: 500 Internal Server Error"
- ]
- },
- "code": {
- "deprecated": true,
- "description": "Machine-friendly representation of the condition Deprecated. Use canonical_code instead.",
- "enum": [
- "UNKNOWN",
- "GCE_STOCKOUT",
- "GKE_SERVICE_ACCOUNT_DELETED",
- "GCE_QUOTA_EXCEEDED",
- "SET_BY_OPERATOR",
- "CLOUD_KMS_KEY_ERROR",
- "CA_EXPIRING",
- "NODE_SERVICE_ACCOUNT_MISSING_PERMISSIONS",
- "CLOUD_KMS_KEY_DESTROYED"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "UNKNOWN indicates a generic condition.",
- "GCE_STOCKOUT indicates that Google Compute Engine resources are temporarily unavailable.",
- "GKE_SERVICE_ACCOUNT_DELETED indicates that the user deleted their robot service account.",
- "Google Compute Engine quota was exceeded.",
- "Cluster state was manually changed by an SRE due to a system logic error.",
- "Unable to perform an encrypt operation against the CloudKMS key used for etcd level encryption.",
- "Cluster CA is expiring soon.",
- "Node service account is missing permissions.",
- "Cloud KMS key version used for etcd level encryption has been destroyed. This is a permanent error."
- ]
- },
- "message": {
- "description": "Human-friendly representation of the condition",
- "type": "string"
- }
- },
- "type": "object"
-}Output schema / descriptionPrevious value: -"ListOperationsResponse is the result of ListOperationsRequest."New value: +"MCPListOperationsResponse wraps the list of operations with an errors field."Output schema / properties / errorsAdded value: +{
+ "description": "Errors encountered during operations listing.",
+ "items": {
+ "$ref": "#/$defs/Status"
+ },
+ "type": "array"
+}Output schema / properties / missingZonesRemoved value: -{
- "description": "If any zones are listed here, the list of operations returned may be missing the operations from those zones.",
- "items": {
- "type": "string"
- },
- "type": "array"
-}Output schema / properties / operations / descriptionPrevious value: -"A list of operations in the project in the specified zone."New value: +"A list of JSON strings of GKE Operation objects. See: https://docs.cloud.google.com/kubernetes-engine/docs/reference/rest/v1/projects.locations.operations"Output schema / properties / operations / items / $refRemoved value: -"#/$defs/Operation"Output schema / properties / operations / items / typeAdded value: +"string"get_cluster86 fields changedOutput schema / $defsRemoved value: -{
- "AcceleratorConfig": {
- "description": "AcceleratorConfig represents a Hardware Accelerator request.",
- "properties": {
- "acceleratorCount": {
- "description": "The number of the accelerator cards exposed to an instance.",
- "format": "int64",
- "type": "string"
- },
- "acceleratorType": {
- "description": "The accelerator type resource name. List of supported accelerators [here](https://cloud.google.com/compute/docs/gpus)",
- "type": "string"
- },
- "gpuDriverInstallationConfig": {
- "$ref": "#/$defs/GPUDriverInstallationConfig",
- "description": "The configuration for auto installation of GPU driver."
- },
- "gpuPartitionSize": {
- "description": "Size of partitions to create on the GPU. Valid values are described in the NVIDIA [mig user guide](https://docs.nvidia.com/datacenter/tesla/mig-user-guide/#partitioning).",
- "type": "string"
- },
- "gpuSharingConfig": {
- "$ref": "#/$defs/GPUSharingConfig",
- "description": "The configuration for GPU sharing options."
- }
- },
- "type": "object"
- },
- "AdditionalIPRangesConfig": {
- "description": "AdditionalIPRangesConfig is the configuration for individual additional subnetwork attached to the cluster",
- "properties": {
- "podIpv4RangeNames": {
- "description": "List of secondary ranges names within this subnetwork that can be used for pod IPs. Example1: gke-pod-range1 Example2: gke-pod-range1,gke-pod-range2",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "status": {
- "description": "Draining status of the additional subnet.",
- "enum": [
- "STATUS_UNSPECIFIED",
- "ACTIVE",
- "DRAINING"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Not set, same as ACTIVE.",
- "ACTIVE status indicates that the subnet is available for new node pool creation.",
- "DRAINING status indicates that the subnet is not used for new node pool creation."
- ]
- },
- "subnetwork": {
- "description": "Name of the subnetwork. This can be the full path of the subnetwork or just the name. Example1: my-subnet Example2: projects/gke-project/regions/us-central1/subnetworks/my-subnet",
- "type": "string"
- }
- },
- "type": "object"
- },
- "AdditionalNodeNetworkConfig": {
- "description": "AdditionalNodeNetworkConfig is the configuration for additional node networks within the NodeNetworkConfig message",
- "properties": {
- "network": {
- "description": "Name of the VPC where the additional interface belongs",
- "type": "string"
- },
- "subnetwork": {
- "description": "Name of the subnetwork where the additional interface belongs",
- "type": "string"
- }
- },
- "type": "object"
- },
- "AdditionalPodNetworkConfig": {
- "description": "AdditionalPodNetworkConfig is the configuration for additional pod networks within the NodeNetworkConfig message",
- "properties": {
- "maxPodsPerNode": {
- "$ref": "#/$defs/MaxPodsConstraint",
- "description": "The maximum number of pods per node which use this pod network."
- },
- "networkAttachment": {
- "description": "The name of the network attachment for pods to communicate to; cannot be specified along with subnetwork or secondary_pod_range.",
- "type": "string"
- },
- "secondaryPodRange": {
- "description": "The name of the secondary range on the subnet which provides IP address for this pod range.",
- "type": "string"
- },
- "subnetwork": {
- "description": "Name of the subnetwork where the additional pod network belongs.",
- "type": "string"
- }
- },
- "type": "object"
- },
- "AdditionalPodRangesConfig": {
- "description": "AdditionalPodRangesConfig is the configuration for additional pod secondary ranges supporting the ClusterUpdate message.",
- "properties": {
- "podRangeInfo": {
- "description": "Output only. Information for additional pod range.",
- "items": {
- "$ref": "#/$defs/RangeInfo"
- },
- "readOnly": true,
- "type": "array"
- },
- "podRangeNames": {
- "description": "Name for pod secondary ipv4 range which has the actual range defined ahead.",
- "items": {
- "type": "string"
- },
- "type": "array"
- }
- },
- "type": "object"
- },
- "AddonsConfig": {
- "description": "Configuration for the addons that can be automatically spun up in the cluster, enabling additional functionality.",
- "properties": {
- "cloudRunConfig": {
- "$ref": "#/$defs/CloudRunConfig",
- "description": "Configuration for the Cloud Run addon, which allows the user to use a managed Knative service."
- },
- "configConnectorConfig": {
- "$ref": "#/$defs/ConfigConnectorConfig",
- "description": "Configuration for the ConfigConnector add-on, a Kubernetes extension to manage hosted Google Cloud services through the Kubernetes API."
- },
- "dnsCacheConfig": {
- "$ref": "#/$defs/DnsCacheConfig",
- "description": "Configuration for NodeLocalDNS, a dns cache running on cluster nodes"
- },
- "gcePersistentDiskCsiDriverConfig": {
- "$ref": "#/$defs/GcePersistentDiskCsiDriverConfig",
- "description": "Configuration for the Compute Engine Persistent Disk CSI driver."
- },
- "gcpFilestoreCsiDriverConfig": {
- "$ref": "#/$defs/GcpFilestoreCsiDriverConfig",
- "description": "Configuration for the Filestore CSI driver."
- },
- "gcsFuseCsiDriverConfig": {
- "$ref": "#/$defs/GcsFuseCsiDriverConfig",
- "description": "Configuration for the Cloud Storage Fuse CSI driver."
- },
- "gkeBackupAgentConfig": {
- "$ref": "#/$defs/GkeBackupAgentConfig",
- "description": "Configuration for the Backup for GKE agent addon."
- },
- "highScaleCheckpointingConfig": {
- "$ref": "#/$defs/HighScaleCheckpointingConfig",
- "description": "Configuration for the High Scale Checkpointing add-on."
- },
- "horizontalPodAutoscaling": {
- "$ref": "#/$defs/HorizontalPodAutoscaling",
- "description": "Configuration for the horizontal pod autoscaling feature, which increases or decreases the number of replica pods a replication controller has based on the resource usage of the existing pods."
- },
- "httpLoadBalancing": {
- "$ref": "#/$defs/HttpLoadBalancing",
- "description": "Configuration for the HTTP (L7) load balancing controller addon, which makes it easy to set up HTTP load balancers for services in a cluster."
- },
- "kubernetesDashboard": {
- "$ref": "#/$defs/KubernetesDashboard",
- "deprecated": true,
- "description": "Configuration for the Kubernetes Dashboard. This addon is deprecated, and will be disabled in 1.15. It is recommended to use the Cloud Console to manage and monitor your Kubernetes clusters, workloads and applications. For more information, see: https://cloud.google.com/kubernetes-engine/docs/concepts/dashboards"
- },
- "lustreCsiDriverConfig": {
- "$ref": "#/$defs/LustreCsiDriverConfig",
- "description": "Configuration for the Lustre CSI driver."
- },
- "networkPolicyConfig": {
- "$ref": "#/$defs/NetworkPolicyConfig",
- "description": "Configuration for NetworkPolicy. This only tracks whether the addon is enabled or not on the Master, it does not track whether network policy is enabled for the nodes."
- },
- "parallelstoreCsiDriverConfig": {
- "$ref": "#/$defs/ParallelstoreCsiDriverConfig",
- "description": "Configuration for the Cloud Storage Parallelstore CSI driver."
- },
- "rayOperatorConfig": {
- "$ref": "#/$defs/RayOperatorConfig",
- "description": "Optional. Configuration for Ray Operator addon."
- },
- "sliceControllerConfig": {
- "$ref": "#/$defs/SliceControllerConfig",
- "description": "Optional. Configuration for the slice controller add-on."
- },
- "statefulHaConfig": {
- "$ref": "#/$defs/StatefulHAConfig",
- "description": "Optional. Configuration for the StatefulHA add-on."
- }
- },
- "type": "object"
- },
- "AdvancedDatapathObservabilityConfig": {
- "description": "AdvancedDatapathObservabilityConfig specifies configuration of observability features of advanced datapath.",
- "properties": {
- "enableMetrics": {
- "description": "Expose flow metrics on nodes",
- "type": "boolean"
- },
- "enableRelay": {
- "description": "Enable Relay component",
- "type": "boolean"
- },
- "relayMode": {
- "description": "Method used to make Relay available",
- "enum": [
- "RELAY_MODE_UNSPECIFIED",
- "DISABLED",
- "INTERNAL_VPC_LB",
- "EXTERNAL_LB"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value. This shouldn't be used.",
- "disabled",
- "exposed via internal load balancer",
- "exposed via external load balancer"
- ]
- }
- },
- "type": "object"
- },
- "AdvancedMachineFeatures": {
- "description": "Specifies options for controlling advanced machine features.",
- "properties": {
- "enableNestedVirtualization": {
- "description": "Whether or not to enable nested virtualization (defaults to false).",
- "type": "boolean"
- },
- "performanceMonitoringUnit": {
- "description": "Type of Performance Monitoring Unit (PMU) requested on node pool instances. If unset, PMU will not be available to the node.",
- "enum": [
- "PERFORMANCE_MONITORING_UNIT_UNSPECIFIED",
- "ARCHITECTURAL",
- "STANDARD",
- "ENHANCED"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "PMU not enabled.",
- "Architecturally defined non-LLC events.",
- "Most documented core/L2 events.",
- "Most documented core/L2 and LLC events."
- ]
- },
- "threadsPerCore": {
- "description": "The number of threads per physical core. To disable simultaneous multithreading (SMT) set this to 1. If unset, the maximum number of threads supported per core by the underlying processor is assumed.",
- "format": "int64",
- "type": "string"
- }
- },
- "type": "object"
- },
- "AnonymousAuthenticationConfig": {
- "description": "AnonymousAuthenticationConfig defines the settings needed to limit endpoints that allow anonymous authentication.",
- "properties": {
- "mode": {
- "description": "Defines the mode of limiting anonymous access in the cluster.",
- "enum": [
- "MODE_UNSPECIFIED",
- "ENABLED",
- "LIMITED"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value not specified.",
- "Anonymous authentication is allowed for all endpoints.",
- "Anonymous authentication is allowed for only health check endpoints."
- ]
- }
- },
- "type": "object"
- },
- "AuthenticatorGroupsConfig": {
- "description": "Configuration for returning group information from authenticators.",
- "properties": {
- "enabled": {
- "description": "Whether this cluster should return group membership lookups during authentication using a group of security groups.",
- "type": "boolean"
- },
- "securityGroup": {
- "description": "The name of the security group-of-groups to be used. Only relevant if enabled = true.",
- "type": "string"
- }
- },
- "type": "object"
- },
- "AutoIpamConfig": {
- "description": "AutoIpamConfig contains all information related to Auto IPAM",
- "properties": {
- "enabled": {
- "description": "The flag that enables Auto IPAM on this cluster",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "AutoMonitoringConfig": {
- "description": "AutoMonitoringConfig defines the configuration for GKE Workload Auto-Monitoring.",
- "properties": {
- "scope": {
- "description": "Scope for GKE Workload Auto-Monitoring.",
- "enum": [
- "SCOPE_UNSPECIFIED",
- "ALL",
- "NONE"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Not set.",
- "Auto-Monitoring is enabled for all supported applications.",
- "Disable Auto-Monitoring."
- ]
- }
- },
- "type": "object"
- },
- "AutoUpgradeOptions": {
- "description": "AutoUpgradeOptions defines the set of options for the user to control how the Auto Upgrades will proceed.",
- "properties": {
- "autoUpgradeStartTime": {
- "description": "Output only. This field is set when upgrades are about to commence with the approximate start time for the upgrades, in [RFC3339](https://www.ietf.org/rfc/rfc3339.txt) text format.",
- "readOnly": true,
- "type": "string"
- },
- "description": {
- "description": "Output only. This field is set when upgrades are about to commence with the description of the upgrade.",
- "readOnly": true,
- "type": "string"
- }
- },
- "type": "object"
- },
- "Autopilot": {
- "description": "Autopilot is the configuration for Autopilot settings on the cluster.",
- "properties": {
- "clusterPolicyConfig": {
- "$ref": "#/$defs/ClusterPolicyConfig",
- "description": "ClusterPolicyConfig denotes cluster level policies that are enforced for the cluster."
- },
- "enabled": {
- "description": "Enable Autopilot",
- "type": "boolean"
- },
- "privilegedAdmissionConfig": {
- "$ref": "#/$defs/PrivilegedAdmissionConfig",
- "description": "PrivilegedAdmissionConfig is the configuration related to privileged admission control."
- },
- "workloadPolicyConfig": {
- "$ref": "#/$defs/WorkloadPolicyConfig",
- "description": "WorkloadPolicyConfig is the configuration related to GCW workload policy"
- }
- },
- "type": "object"
- },
- "AutopilotConfig": {
- "description": "AutopilotConfig contains configuration of autopilot feature for this nodepool.",
- "properties": {
- "enabled": {
- "description": "Denotes that nodes belonging to this node pool are Autopilot nodes.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "AutoprovisioningNodePoolDefaults": {
- "description": "AutoprovisioningNodePoolDefaults contains defaults for a node pool created by NAP.",
- "properties": {
- "bootDiskKmsKey": {
- "description": "The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption",
- "type": "string"
- },
- "diskSizeGb": {
- "description": "Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB. If unspecified, the default disk size is 100GB.",
- "format": "int32",
- "type": "integer"
- },
- "diskType": {
- "description": "Type of the disk attached to each node (e.g. 'pd-standard', 'pd-ssd' or 'pd-balanced') If unspecified, the default disk type is 'pd-standard'",
- "type": "string"
- },
- "imageType": {
- "description": "The image type to use for NAP created node. Please see https://cloud.google.com/kubernetes-engine/docs/concepts/node-images for available image types.",
- "type": "string"
- },
- "insecureKubeletReadonlyPortEnabled": {
- "description": "DEPRECATED. Use NodePoolAutoConfig.NodeKubeletConfig instead.",
- "type": "boolean"
- },
- "management": {
- "$ref": "#/$defs/NodeManagement",
- "description": "Specifies the node management options for NAP created node-pools."
- },
- "minCpuPlatform": {
- "deprecated": true,
- "description": "Deprecated. Minimum CPU platform to be used for NAP created node pools. The instance may be scheduled on the specified or newer CPU platform. Applicable values are the friendly names of CPU platforms, such as minCpuPlatform: Intel Haswell or minCpuPlatform: Intel Sandy Bridge. For more information, read [how to specify min CPU platform](https://cloud.google.com/compute/docs/instances/specify-min-cpu-platform). This field is deprecated, min_cpu_platform should be specified using `cloud.google.com/requested-min-cpu-platform` label selector on the pod. To unset the min cpu platform field pass \"automatic\" as field value.",
- "type": "string"
- },
- "oauthScopes": {
- "description": "Scopes that are used by NAP when creating node pools.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "serviceAccount": {
- "description": "The Google Cloud Platform Service Account to be used by the node VMs.",
- "type": "string"
- },
- "shieldedInstanceConfig": {
- "$ref": "#/$defs/ShieldedInstanceConfig",
- "description": "Shielded Instance options."
- },
- "upgradeSettings": {
- "$ref": "#/$defs/UpgradeSettings",
- "description": "Specifies the upgrade settings for NAP created node pools"
- }
- },
- "type": "object"
- },
- "AutoscaledRolloutPolicy": {
- "description": "Autoscaled rollout policy utilizes the cluster autoscaler during blue-green upgrade to scale both the blue and green pools.",
- "properties": {
- "waitForDrainDuration": {
- "description": "Optional. Time to wait after cordoning the blue pool before draining the nodes. Defaults to 3 days. The value can be set between 0 and 7 days, inclusive.",
- "format": "google-duration",
- "type": "string"
- }
- },
- "type": "object"
- },
- "BestEffortProvisioning": {
- "description": "Best effort provisioning.",
- "properties": {
- "enabled": {
- "description": "When this is enabled, cluster/node pool creations will ignore non-fatal errors like stockout to best provision as many nodes as possible right now and eventually bring up all target number of nodes",
- "type": "boolean"
- },
- "minProvisionNodes": {
- "description": "Minimum number of nodes to be provisioned to be considered as succeeded, and the rest of nodes will be provisioned gradually and eventually when stockout issue has been resolved.",
- "format": "int32",
- "type": "integer"
- }
- },
- "type": "object"
- },
- "BigQueryDestination": {
- "description": "Parameters for using BigQuery as the destination of resource usage export.",
- "properties": {
- "datasetId": {
- "description": "The ID of a BigQuery Dataset.",
- "type": "string"
- }
- },
- "type": "object"
- },
- "BinaryAuthorization": {
- "description": "Configuration for Binary Authorization.",
- "properties": {
- "enabled": {
- "deprecated": true,
- "description": "This field is deprecated. Leave this unset and instead configure BinaryAuthorization using evaluation_mode. If evaluation_mode is set to anything other than EVALUATION_MODE_UNSPECIFIED, this field is ignored.",
- "type": "boolean"
- },
- "evaluationMode": {
- "description": "Mode of operation for binauthz policy evaluation. If unspecified, defaults to DISABLED.",
- "enum": [
- "EVALUATION_MODE_UNSPECIFIED",
- "DISABLED",
- "PROJECT_SINGLETON_POLICY_ENFORCE"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value",
- "Disable BinaryAuthorization",
- "Enforce Kubernetes admission requests with BinaryAuthorization using the project's singleton policy. This is equivalent to setting the enabled boolean to true."
- ]
- }
- },
- "type": "object"
- },
- "BlueGreenInfo": {
- "description": "Information relevant to blue-green upgrade.",
- "properties": {
- "blueInstanceGroupUrls": {
- "description": "The resource URLs of the [managed instance groups] (/compute/docs/instance-groups/creating-groups-of-managed-instances) associated with blue pool.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "bluePoolDeletionStartTime": {
- "description": "Time to start deleting blue pool to complete blue-green upgrade, in [RFC3339](https://www.ietf.org/rfc/rfc3339.txt) text format.",
- "type": "string"
- },
- "greenInstanceGroupUrls": {
- "description": "The resource URLs of the [managed instance groups] (/compute/docs/instance-groups/creating-groups-of-managed-instances) associated with green pool.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "greenPoolVersion": {
- "description": "Version of green pool.",
- "type": "string"
- },
- "phase": {
- "description": "Current blue-green upgrade phase.",
- "enum": [
- "PHASE_UNSPECIFIED",
- "UPDATE_STARTED",
- "CREATING_GREEN_POOL",
- "CORDONING_BLUE_POOL",
- "DRAINING_BLUE_POOL",
- "NODE_POOL_SOAKING",
- "DELETING_BLUE_POOL",
- "ROLLBACK_STARTED"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Unspecified phase.",
- "blue-green upgrade has been initiated.",
- "Start creating green pool nodes.",
- "Start cordoning blue pool nodes.",
- "Start draining blue pool nodes.",
- "Start soaking time after draining entire blue pool.",
- "Start deleting blue nodes.",
- "Rollback has been initiated."
- ]
- }
- },
- "type": "object"
- },
- "BlueGreenSettings": {
- "description": "Settings for blue-green upgrade.",
- "properties": {
- "autoscaledRolloutPolicy": {
- "$ref": "#/$defs/AutoscaledRolloutPolicy",
- "description": "Autoscaled policy for cluster autoscaler enabled blue-green upgrade."
- },
- "nodePoolSoakDuration": {
- "description": "Time needed after draining entire blue pool. After this period, blue pool will be cleaned up.",
- "format": "google-duration",
- "type": "string"
- },
- "standardRolloutPolicy": {
- "$ref": "#/$defs/StandardRolloutPolicy",
- "description": "Standard policy for the blue-green upgrade."
- }
- },
- "type": "object"
- },
- "BootDisk": {
- "description": "BootDisk specifies the boot disk configuration for nodepools.",
- "properties": {
- "diskType": {
- "description": "Disk type of the boot disk. (i.e. Hyperdisk-Balanced, PD-Balanced, etc.)",
- "type": "string"
- },
- "provisionedIops": {
- "description": "For Hyperdisk-Balanced only, the provisioned IOPS config value.",
- "format": "int64",
- "type": "string"
- },
- "provisionedThroughput": {
- "description": "For Hyperdisk-Balanced only, the provisioned throughput config value.",
- "format": "int64",
- "type": "string"
- },
- "sizeGb": {
- "description": "Disk size in GB. Replaces NodeConfig.disk_size_gb",
- "format": "int64",
- "type": "string"
- }
- },
- "type": "object"
- },
- "BootDiskProfile": {
- "description": "Swap on the node's boot disk.",
- "properties": {
- "swapSizeGib": {
- "description": "Specifies the size of the swap space in gibibytes (GiB).",
- "format": "int64",
- "type": "string"
- },
- "swapSizePercent": {
- "description": "Specifies the size of the swap space as a percentage of the boot disk size.",
- "format": "int32",
- "type": "integer"
- }
- },
- "type": "object"
- },
- "CertificateAuthorityDomainConfig": {
- "description": "CertificateAuthorityDomainConfig configures one or more fully qualified domain names (FQDN) to a specific certificate.",
- "properties": {
- "fqdns": {
- "description": "List of fully qualified domain names (FQDN). Specifying port is supported. Wildcards are NOT supported. Examples: - my.customdomain.com - 10.0.1.2:5000",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "gcpSecretManagerCertificateConfig": {
- "$ref": "#/$defs/GCPSecretManagerCertificateConfig",
- "description": "Secret Manager certificate configuration."
- }
- },
- "type": "object"
- },
- "CertificateConfig": {
- "description": "CertificateConfig configures certificate for the registry.",
- "properties": {
- "gcpSecretManagerSecretUri": {
- "description": "The URI configures a secret from [Secret Manager](https://cloud.google.com/secret-manager) in the format \"projects/$PROJECT_ID/secrets/$SECRET_NAME/versions/$VERSION\" for global secret or \"projects/$PROJECT_ID/locations/$REGION/secrets/$SECRET_NAME/versions/$VERSION\" for regional secret. Version can be fixed (e.g. \"2\") or \"latest\"",
- "type": "string"
- }
- },
- "type": "object"
- },
- "CertificateConfigPair": {
- "description": "CertificateConfigPair configures pairs of certificates, which is used for client certificate and key pairs under a registry.",
- "properties": {
- "cert": {
- "$ref": "#/$defs/CertificateConfig",
- "description": "Cert configures the client certificate."
- },
- "key": {
- "$ref": "#/$defs/CertificateConfig",
- "description": "Key configures the client private key. Optional."
- }
- },
- "type": "object"
- },
- "CidrBlock": {
- "description": "CidrBlock contains an optional name and one CIDR block.",
- "properties": {
- "cidrBlock": {
- "description": "cidr_block must be specified in CIDR notation.",
- "type": "string"
- },
- "displayName": {
- "description": "display_name is an optional field for users to identify CIDR blocks.",
- "type": "string"
- }
- },
- "type": "object"
- },
- "ClientCertificateConfig": {
- "description": "Configuration for client certificates on the cluster.",
- "properties": {
- "issueClientCertificate": {
- "description": "Issue a client certificate.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "CloudRunConfig": {
- "description": "Configuration options for the Cloud Run feature.",
- "properties": {
- "disabled": {
- "description": "Whether Cloud Run addon is enabled for this cluster.",
- "type": "boolean"
- },
- "loadBalancerType": {
- "description": "Which load balancer type is installed for Cloud Run.",
- "enum": [
- "LOAD_BALANCER_TYPE_UNSPECIFIED",
- "LOAD_BALANCER_TYPE_EXTERNAL",
- "LOAD_BALANCER_TYPE_INTERNAL"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Load balancer type for Cloud Run is unspecified.",
- "Install external load balancer for Cloud Run.",
- "Install internal load balancer for Cloud Run."
- ]
- }
- },
- "type": "object"
- },
- "ClusterAutoscaling": {
- "description": "ClusterAutoscaling contains global, per-cluster information required by Cluster Autoscaler to automatically adjust the size of the cluster and create/delete node pools based on the current needs.",
- "properties": {
- "autopilotGeneralProfile": {
- "description": "Autopilot general profile for the cluster, which defines the configuration for the cluster.",
- "enum": [
- "AUTOPILOT_GENERAL_PROFILE_UNSPECIFIED",
- "NO_PERFORMANCE",
- "NONE"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Use default configuration.",
- "Avoid extra IP consumption.",
- "Use default configuration."
- ]
- },
- "autoprovisioningLocations": {
- "description": "The list of Google Compute Engine [zones](https://cloud.google.com/compute/docs/zones#available) in which the NodePool's nodes can be created by NAP.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "autoprovisioningNodePoolDefaults": {
- "$ref": "#/$defs/AutoprovisioningNodePoolDefaults",
- "description": "AutoprovisioningNodePoolDefaults contains defaults for a node pool created by NAP."
- },
- "autoscalingProfile": {
- "description": "Defines autoscaling behaviour.",
- "enum": [
- "PROFILE_UNSPECIFIED",
- "OPTIMIZE_UTILIZATION",
- "BALANCED"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "No change to autoscaling configuration.",
- "Prioritize optimizing utilization of resources.",
- "Use default (balanced) autoscaling configuration."
- ]
- },
- "defaultComputeClassConfig": {
- "$ref": "#/$defs/DefaultComputeClassConfig",
- "description": "Default compute class is a configuration for default compute class."
- },
- "enableNodeAutoprovisioning": {
- "description": "Enables automatic node pool creation and deletion.",
- "type": "boolean"
- },
- "resourceLimits": {
- "description": "Contains global constraints regarding minimum and maximum amount of resources in the cluster.",
- "items": {
- "$ref": "#/$defs/ResourceLimit"
- },
- "type": "array"
- }
- },
- "type": "object"
- },
- "ClusterNetworkPerformanceConfig": {
- "description": "Configuration of network bandwidth tiers",
- "properties": {
- "totalEgressBandwidthTier": {
- "description": "Specifies the total network bandwidth tier for NodePools in the cluster.",
- "enum": [
- "TIER_UNSPECIFIED",
- "TIER_1"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value",
- "Higher bandwidth, actual values based on VM size."
- ]
- }
- },
- "type": "object"
- },
- "ClusterPolicyConfig": {
- "description": "ClusterPolicyConfig stores the configuration for cluster wide policies.",
- "properties": {
- "noStandardNodePools": {
- "description": "Denotes preventing standard node pools and requiring only autopilot node pools.",
- "type": "boolean"
- },
- "noSystemImpersonation": {
- "description": "Denotes preventing impersonation and CSRs for GKE System users.",
- "type": "boolean"
- },
- "noSystemMutation": {
- "description": "Denotes that preventing creation and mutation of resources in GKE managed namespaces and cluster-scoped GKE managed resources .",
- "type": "boolean"
- },
- "noUnsafeWebhooks": {
- "description": "Denotes preventing unsafe webhooks.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "CompliancePostureConfig": {
- "description": "Deprecated: Compliance Posture is no longer supported. For more details, see https://cloud.google.com/kubernetes-engine/docs/deprecations/posture-management-deprecation. CompliancePostureConfig defines the settings needed to enable/disable features for the Compliance Posture.",
- "properties": {
- "complianceStandards": {
- "description": "List of enabled compliance standards.",
- "items": {
- "$ref": "#/$defs/ComplianceStandard"
- },
- "type": "array"
- },
- "mode": {
- "description": "Defines the enablement mode for Compliance Posture.",
- "enum": [
- "MODE_UNSPECIFIED",
- "DISABLED",
- "ENABLED"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value not specified.",
- "Disables Compliance Posture features on the cluster.",
- "Enables Compliance Posture features on the cluster."
- ]
- }
- },
- "type": "object"
- },
- "ComplianceStandard": {
- "description": "Defines the details of a compliance standard.",
- "properties": {
- "standard": {
- "description": "Name of the compliance standard.",
- "type": "string"
- }
- },
- "type": "object"
- },
- "ConfidentialNodes": {
- "description": "ConfidentialNodes is configuration for the confidential nodes feature, which makes nodes run on confidential VMs.",
- "properties": {
- "confidentialInstanceType": {
- "description": "Defines the type of technology used by the confidential node.",
- "enum": [
- "CONFIDENTIAL_INSTANCE_TYPE_UNSPECIFIED",
- "SEV",
- "SEV_SNP",
- "TDX"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "No type specified. Do not use this value.",
- "AMD Secure Encrypted Virtualization.",
- "AMD Secure Encrypted Virtualization - Secure Nested Paging.",
- "Intel Trust Domain eXtension."
- ]
- },
- "enabled": {
- "description": "Whether Confidential Nodes feature is enabled.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "ConfigConnectorConfig": {
- "description": "Configuration options for the Config Connector add-on.",
- "properties": {
- "enabled": {
- "description": "Whether Cloud Connector is enabled for this cluster.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "ConsumptionMeteringConfig": {
- "description": "Parameters for controlling consumption metering.",
- "properties": {
- "enabled": {
- "description": "Whether to enable consumption metering for this cluster. If enabled, a second BigQuery table will be created to hold resource consumption records.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "ContainerdConfig": {
- "description": "ContainerdConfig contains configuration to customize containerd.",
- "properties": {
- "privateRegistryAccessConfig": {
- "$ref": "#/$defs/PrivateRegistryAccessConfig",
- "description": "PrivateRegistryAccessConfig is used to configure access configuration for private container registries."
- },
- "registryHosts": {
- "description": "RegistryHostConfig configures containerd registry host configuration. Each registry_hosts represents a hosts.toml file. At most 25 registry_hosts are allowed.",
- "items": {
- "$ref": "#/$defs/RegistryHostConfig"
- },
- "type": "array"
- },
- "writableCgroups": {
- "$ref": "#/$defs/WritableCgroups",
- "description": "Optional. WritableCgroups defines writable cgroups configuration for the node pool."
- }
- },
- "type": "object"
- },
- "ControlPlaneEgress": {
- "description": "ControlPlaneEgress defines the settings needed to enable control plane egress control.",
- "properties": {
- "mode": {
- "description": "Defines the mode of control plane egress.",
- "enum": [
- "MODE_UNSPECIFIED",
- "VIA_CONTROL_PLANE",
- "NONE"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value not specified.",
- "Control plane has public IP and no restriction on egress.",
- "No public IP on control plane and only internal allowlisted egress."
- ]
- }
- },
- "type": "object"
- },
- "ControlPlaneEndpointsConfig": {
- "description": "Configuration for all of the cluster's control plane endpoints.",
- "properties": {
- "dnsEndpointConfig": {
- "$ref": "#/$defs/DNSEndpointConfig",
- "description": "DNS endpoint configuration."
- },
- "ipEndpointsConfig": {
- "$ref": "#/$defs/IPEndpointsConfig",
- "description": "IP endpoints configuration."
- }
- },
- "type": "object"
- },
- "CostManagementConfig": {
- "description": "Configuration for fine-grained cost management feature.",
- "properties": {
- "enabled": {
- "description": "Whether the feature is enabled or not.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "CrashLoopBackOffConfig": {
- "description": "Contains config to modify node-level parameters for container restart behavior.",
- "properties": {
- "maxContainerRestartPeriod": {
- "description": "Optional. The maximum duration the backoff delay can accrue to for container restarts, minimum 1 second, maximum 300 seconds. If not set, defaults to the internal crashloopbackoff maximum. The string must be a sequence of decimal numbers, each with optional fraction and a unit suffix, such as \"300ms\". Valid time units are \"ns\", \"us\" (or \"µs\"), \"ms\", \"s\", \"m\", \"h\". See https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#configurable-container-restart-delay for more details.",
- "type": "string"
- }
- },
- "type": "object"
- },
- "DNSConfig": {
- "description": "DNSConfig contains the desired set of options for configuring clusterDNS.",
- "properties": {
- "additiveVpcScopeDnsDomain": {
- "description": "Optional. The domain used in Additive VPC scope.",
- "type": "string"
- },
- "clusterDns": {
- "description": "cluster_dns indicates which in-cluster DNS provider should be used.",
- "enum": [
- "PROVIDER_UNSPECIFIED",
- "PLATFORM_DEFAULT",
- "CLOUD_DNS",
- "KUBE_DNS"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value",
- "Use GKE default DNS provider(kube-dns) for DNS resolution.",
- "Use CloudDNS for DNS resolution.",
- "Use KubeDNS for DNS resolution."
- ]
- },
- "clusterDnsDomain": {
- "description": "cluster_dns_domain is the suffix used for all cluster service records.",
- "type": "string"
- },
- "clusterDnsScope": {
- "description": "cluster_dns_scope indicates the scope of access to cluster DNS records.",
- "enum": [
- "DNS_SCOPE_UNSPECIFIED",
- "CLUSTER_SCOPE",
- "VPC_SCOPE"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value, will be inferred as cluster scope.",
- "DNS records are accessible from within the cluster.",
- "DNS records are accessible from within the VPC."
- ]
- }
- },
- "type": "object"
- },
- "DNSEndpointConfig": {
- "description": "Describes the configuration of a DNS endpoint.",
- "properties": {
- "allowExternalTraffic": {
- "description": "Controls whether user traffic is allowed over this endpoint. Note that Google-managed services may still use the endpoint even if this is false.",
- "type": "boolean"
- },
- "enableK8sCertsViaDns": {
- "description": "Controls whether the k8s certs auth is allowed via DNS.",
- "type": "boolean"
- },
- "enableK8sTokensViaDns": {
- "description": "Controls whether the k8s token auth is allowed via DNS.",
- "type": "boolean"
- },
- "endpoint": {
- "description": "Output only. The cluster's DNS endpoint configuration. A DNS format address. This is accessible from the public internet. Ex: uid.us-central1.gke.goog. Always present, but the behavior may change according to the value of DNSEndpointConfig.allow_external_traffic.",
- "readOnly": true,
- "type": "string"
- }
- },
- "type": "object"
- },
- "DailyMaintenanceWindow": {
- "description": "Time window specified for daily maintenance operations.",
- "properties": {
- "duration": {
- "description": "Output only. Duration of the time window, automatically chosen to be smallest possible in the given scenario. Duration will be in [RFC3339](https://www.ietf.org/rfc/rfc3339.txt) format \"PTnHnMnS\".",
- "readOnly": true,
- "type": "string"
- },
- "startTime": {
- "description": "Time within the maintenance window to start the maintenance operations. Time format should be in [RFC3339](https://www.ietf.org/rfc/rfc3339.txt) format \"HH:MM\", where HH : [00-23] and MM : [00-59] GMT.",
- "type": "string"
- }
- },
- "type": "object"
- },
- "DatabaseEncryption": {
- "description": "Configuration of etcd encryption.",
- "properties": {
- "currentState": {
- "description": "Output only. The current state of etcd encryption.",
- "enum": [
- "CURRENT_STATE_UNSPECIFIED",
- "CURRENT_STATE_ENCRYPTED",
- "CURRENT_STATE_DECRYPTED",
- "CURRENT_STATE_ENCRYPTION_PENDING",
- "CURRENT_STATE_ENCRYPTION_ERROR",
- "CURRENT_STATE_DECRYPTION_PENDING",
- "CURRENT_STATE_DECRYPTION_ERROR",
- "CURRENT_STATE_ALL_OBJECTS_ENCRYPTION_ENABLED",
- "CURRENT_STATE_ALL_OBJECTS_ENCRYPTION_PENDING",
- "CURRENT_STATE_ALL_OBJECTS_ENCRYPTION_ERROR"
- ],
- "readOnly": true,
- "type": "string",
- "x-google-enum-descriptions": [
- "Should never be set",
- "Secrets in etcd are encrypted.",
- "Secrets in etcd are stored in plain text (at etcd level) - this is unrelated to Compute Engine level full disk encryption.",
- "Encryption (or re-encryption with a different CloudKMS key) of Secrets is in progress.",
- "Encryption (or re-encryption with a different CloudKMS key) of Secrets in etcd encountered an error.",
- "De-crypting Secrets to plain text in etcd is in progress.",
- "De-crypting Secrets to plain text in etcd encountered an error.",
- "Encryption of all objects in the storage is enabled. It does not guarantee that all objects in the storage are encrypted, but eventually they will be.",
- "Enablement of the encryption of all objects in storage is pending.",
- "Enabling encryption of all objects in storage encountered an error."
- ]
- },
- "decryptionKeys": {
- "description": "Output only. Keys in use by the cluster for decrypting existing objects, in addition to the key in `key_name`. Each item is a CloudKMS key resource.",
- "items": {
- "type": "string"
- },
- "readOnly": true,
- "type": "array"
- },
- "keyName": {
- "description": "Name of CloudKMS key to use for the encryption of secrets in etcd. Ex. projects/my-project/locations/global/keyRings/my-ring/cryptoKeys/my-key",
- "type": "string"
- },
- "lastOperationErrors": {
- "description": "Output only. Records errors seen during DatabaseEncryption update operations.",
- "items": {
- "$ref": "#/$defs/OperationError"
- },
- "readOnly": true,
- "type": "array"
- },
- "state": {
- "description": "The desired state of etcd encryption.",
- "enum": [
- "UNKNOWN",
- "ENCRYPTED",
- "DECRYPTED",
- "ALL_OBJECTS_ENCRYPTION_ENABLED"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Should never be set",
- "Secrets in etcd are encrypted.",
- "Secrets in etcd are stored in plain text (at etcd level) - this is unrelated to Compute Engine level full disk encryption.",
- "Encryption of all objects in the storage is enabled. There is no guarantee that all objects in the storage are encrypted, but eventually they will be."
- ]
- }
- },
- "type": "object"
- },
- "DedicatedLocalSsdProfile": {
- "description": "Provisions a new, separate local NVMe SSD exclusively for swap.",
- "properties": {
- "diskCount": {
- "description": "The number of physical local NVMe SSD disks to attach.",
- "format": "int64",
- "type": "string"
- }
- },
- "type": "object"
- },
- "DefaultComputeClassConfig": {
- "description": "DefaultComputeClassConfig defines default compute class configuration.",
- "properties": {
- "enabled": {
- "description": "Enables default compute class.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "DefaultSnatStatus": {
- "description": "DefaultSnatStatus contains the desired state of whether default sNAT should be disabled on the cluster.",
- "properties": {
- "disabled": {
- "description": "Disables cluster default sNAT rules.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "DisruptionBudget": {
- "description": "DisruptionBudget defines the upgrade disruption budget for the cluster control plane.",
- "properties": {
- "lastDisruptionTime": {
- "description": "Output only. The last time a disruption was performed on the control plane.",
- "format": "date-time",
- "readOnly": true,
- "type": "string"
- },
- "lastMinorVersionDisruptionTime": {
- "description": "Output only. The last time a minor version upgrade was performed on the control plane.",
- "format": "date-time",
- "readOnly": true,
- "type": "string"
- },
- "minorVersionDisruptionInterval": {
- "description": "Optional. The minimum duration between two minor version upgrades of the control plane.",
- "format": "google-duration",
- "type": "string"
- },
- "patchVersionDisruptionInterval": {
- "description": "Optional. The minimum duration between two patch version upgrades of the control plane.",
- "format": "google-duration",
- "type": "string"
- }
- },
- "type": "object"
- },
- "DnsCacheConfig": {
- "description": "Configuration for NodeLocal DNSCache",
- "properties": {
- "enabled": {
- "description": "Whether NodeLocal DNSCache is enabled for this cluster.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "EncryptionConfig": {
- "description": "Defines encryption settings for the swap space.",
- "properties": {
- "disabled": {
- "description": "Optional. If true, swap space will not be encrypted. Defaults to false (encrypted).",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "EnterpriseConfig": {
- "description": "EnterpriseConfig is the cluster enterprise configuration. Deprecated: GKE Enterprise features are now available without an Enterprise tier.",
- "properties": {
- "clusterTier": {
- "description": "Output only. cluster_tier indicates the effective tier of the cluster.",
- "enum": [
- "CLUSTER_TIER_UNSPECIFIED",
- "STANDARD",
- "ENTERPRISE"
- ],
- "readOnly": true,
- "type": "string",
- "x-google-enum-descriptions": [
- "CLUSTER_TIER_UNSPECIFIED is when cluster_tier is not set.",
- "STANDARD indicates a standard GKE cluster.",
- "ENTERPRISE indicates a GKE Enterprise cluster."
- ]
- },
- "desiredTier": {
- "description": "desired_tier specifies the desired tier of the cluster.",
- "enum": [
- "CLUSTER_TIER_UNSPECIFIED",
- "STANDARD",
- "ENTERPRISE"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "CLUSTER_TIER_UNSPECIFIED is when cluster_tier is not set.",
- "STANDARD indicates a standard GKE cluster.",
- "ENTERPRISE indicates a GKE Enterprise cluster."
- ]
- }
- },
- "type": "object"
- },
- "EphemeralLocalSsdProfile": {
- "description": "Swap on the local SSD shared with pod ephemeral storage.",
- "properties": {
- "swapSizeGib": {
- "description": "Specifies the size of the swap space in gibibytes (GiB).",
- "format": "int64",
- "type": "string"
- },
- "swapSizePercent": {
- "description": "Specifies the size of the swap space as a percentage of the ephemeral local SSD capacity.",
- "format": "int32",
- "type": "integer"
- }
- },
- "type": "object"
- },
- "EphemeralStorageLocalSsdConfig": {
- "description": "EphemeralStorageLocalSsdConfig contains configuration for the node ephemeral storage using Local SSDs.",
- "properties": {
- "dataCacheCount": {
- "description": "Number of local SSDs to use for GKE Data Cache.",
- "format": "int32",
- "type": "integer"
- },
- "localSsdCount": {
- "description": "Number of local SSDs to use to back ephemeral storage. Uses NVMe interfaces. A zero (or unset) value has different meanings depending on machine type being used: 1. For pre-Gen3 machines, which support flexible numbers of local ssds, zero (or unset) means to disable using local SSDs as ephemeral storage. The limit for this value is dependent upon the maximum number of disk available on a machine per zone. See: https://cloud.google.com/compute/docs/disks/local-ssd for more information. 2. For Gen3 machines which dictate a specific number of local ssds, zero (or unset) means to use the default number of local ssds that goes with that machine type. For example, for a c3-standard-8-lssd machine, 2 local ssds would be provisioned. For c3-standard-8 (which doesn't support local ssds), 0 will be provisioned. See https://cloud.google.com/compute/docs/disks/local-ssd#choose_number_local_ssds for more info.",
- "format": "int32",
- "type": "integer"
- }
- },
- "type": "object"
- },
- "EvictionGracePeriod": {
- "description": "Eviction grace periods are grace periods for each eviction signal.",
- "properties": {
- "imagefsAvailable": {
- "description": "Optional. Grace period for eviction due to imagefs available signal. Sample format: \"10s\". Must be >= 0. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "imagefsInodesFree": {
- "description": "Optional. Grace period for eviction due to imagefs inodes free signal. Sample format: \"10s\". Must be >= 0. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "memoryAvailable": {
- "description": "Optional. Grace period for eviction due to memory available signal. Sample format: \"10s\". Must be >= 0. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "nodefsAvailable": {
- "description": "Optional. Grace period for eviction due to nodefs available signal. Sample format: \"10s\". Must be >= 0. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "nodefsInodesFree": {
- "description": "Optional. Grace period for eviction due to nodefs inodes free signal. Sample format: \"10s\". Must be >= 0. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "pidAvailable": {
- "description": "Optional. Grace period for eviction due to pid available signal. Sample format: \"10s\". Must be >= 0. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- }
- },
- "type": "object"
- },
- "EvictionMinimumReclaim": {
- "description": "Eviction minimum reclaims are the resource amounts of minimum reclaims for each eviction signal.",
- "properties": {
- "imagefsAvailable": {
- "description": "Optional. Minimum reclaim for eviction due to imagefs available signal. Only take percentage value for now. Sample format: \"10%\". Must be <=10%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "imagefsInodesFree": {
- "description": "Optional. Minimum reclaim for eviction due to imagefs inodes free signal. Only take percentage value for now. Sample format: \"10%\". Must be <=10%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "memoryAvailable": {
- "description": "Optional. Minimum reclaim for eviction due to memory available signal. Only take percentage value for now. Sample format: \"10%\". Must be <=10%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "nodefsAvailable": {
- "description": "Optional. Minimum reclaim for eviction due to nodefs available signal. Only take percentage value for now. Sample format: \"10%\". Must be <=10%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "nodefsInodesFree": {
- "description": "Optional. Minimum reclaim for eviction due to nodefs inodes free signal. Only take percentage value for now. Sample format: \"10%\". Must be <=10%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "pidAvailable": {
- "description": "Optional. Minimum reclaim for eviction due to pid available signal. Only take percentage value for now. Sample format: \"10%\". Must be <=10%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- }
- },
- "type": "object"
- },
- "EvictionSignals": {
- "description": "Eviction signals are the current state of a particular resource at a specific point in time. The kubelet uses eviction signals to make eviction decisions by comparing the signals to eviction thresholds, which are the minimum amount of the resource that should be available on the node.",
- "properties": {
- "imagefsAvailable": {
- "description": "Optional. Amount of storage available on filesystem that container runtime uses for storing images layers. If the container filesystem and image filesystem are not separate, then imagefs can store both image layers and writeable layers. Defines the amount of \"imagefs.available\" signal in kubelet. Default is unset, if not specified in the kubelet config. It takses percentage value for now. Sample format: \"30%\". Must be >= 15% and <= 50%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "imagefsInodesFree": {
- "description": "Optional. Amount of inodes available on filesystem that container runtime uses for storing images layers. Defines the amount of \"imagefs.inodesFree\" signal in kubelet. Default is unset, if not specified in the kubelet config. Linux only. It takses percentage value for now. Sample format: \"30%\". Must be >= 5% and <= 50%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "memoryAvailable": {
- "description": "Optional. Memory available (i.e. capacity - workingSet), in bytes. Defines the amount of \"memory.available\" signal in kubelet. Default is unset, if not specified in the kubelet config. Format: positive number + unit, e.g. 100Ki, 10Mi, 5Gi. Valid units are Ki, Mi, Gi. Must be >= 100Mi and <= 50% of the node's memory. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "nodefsAvailable": {
- "description": "Optional. Amount of storage available on filesystem that kubelet uses for volumes, daemon logs, etc. Defines the amount of \"nodefs.available\" signal in kubelet. Default is unset, if not specified in the kubelet config. It takses percentage value for now. Sample format: \"30%\". Must be >= 10% and <= 50%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "nodefsInodesFree": {
- "description": "Optional. Amount of inodes available on filesystem that kubelet uses for volumes, daemon logs, etc. Defines the amount of \"nodefs.inodesFree\" signal in kubelet. Default is unset, if not specified in the kubelet config. Linux only. It takses percentage value for now. Sample format: \"30%\". Must be >= 5% and <= 50%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "pidAvailable": {
- "description": "Optional. Amount of PID available for pod allocation. Defines the amount of \"pid.available\" signal in kubelet. Default is unset, if not specified in the kubelet config. It takses percentage value for now. Sample format: \"30%\". Must be >= 10% and <= 50%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- }
- },
- "type": "object"
- },
- "FastSocket": {
- "description": "Configuration of Fast Socket feature.",
- "properties": {
- "enabled": {
- "description": "Whether Fast Socket features are enabled in the node pool.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "Filter": {
- "description": "Allows filtering to one or more specific event types. If event types are present, those and only those event types will be transmitted to the cluster. Other types will be skipped. If no filter is specified, or no event types are present, all event types will be sent",
- "properties": {
- "eventType": {
- "description": "Event types to allowlist.",
- "items": {
- "enum": [
- "EVENT_TYPE_UNSPECIFIED",
- "UPGRADE_AVAILABLE_EVENT",
- "UPGRADE_EVENT",
- "SECURITY_BULLETIN_EVENT",
- "UPGRADE_INFO_EVENT"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Not set, will be ignored.",
- "Corresponds with UpgradeAvailableEvent.",
- "Corresponds with UpgradeEvent.",
- "Corresponds with SecurityBulletinEvent.",
- "Corresponds with UpgradeInfoEvent."
- ]
- },
- "type": "array"
- }
- },
- "type": "object"
- },
- "Fleet": {
- "description": "Fleet is the fleet configuration for the cluster.",
- "properties": {
- "membership": {
- "description": "Output only. The full resource name of the registered fleet membership of the cluster, in the format `//gkehub.googleapis.com/projects/*/locations/*/memberships/*`.",
- "readOnly": true,
- "type": "string"
- },
- "membershipType": {
- "description": "The type of the cluster's fleet membership.",
- "enum": [
- "MEMBERSHIP_TYPE_UNSPECIFIED",
- "LIGHTWEIGHT"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "The MembershipType is not set.",
- "The membership supports only lightweight compatible features."
- ]
- },
- "preRegistered": {
- "description": "Output only. Whether the cluster has been registered through the fleet API.",
- "readOnly": true,
- "type": "boolean"
- },
- "project": {
- "description": "The Fleet host project(project ID or project number) where this cluster will be registered to. This field cannot be changed after the cluster has been registered.",
- "type": "string"
- }
- },
- "type": "object"
- },
- "GCPSecretManagerCertificateConfig": {
- "description": "GCPSecretManagerCertificateConfig configures a secret from [Secret Manager](https://cloud.google.com/secret-manager).",
- "properties": {
- "secretUri": {
- "description": "Secret URI, in the form \"projects/$PROJECT_ID/secrets/$SECRET_NAME/versions/$VERSION\". Version can be fixed (e.g. \"2\") or \"latest\"",
- "type": "string"
- }
- },
- "type": "object"
- },
- "GPUDirectConfig": {
- "description": "GPUDirectConfig specifies the GPU direct strategy on the node pool.",
- "properties": {
- "gpuDirectStrategy": {
- "description": "The type of GPU direct strategy to enable on the node pool.",
- "enum": [
- "GPU_DIRECT_STRATEGY_UNSPECIFIED",
- "RDMA"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value. No GPU Direct strategy is enabled on the node.",
- "GPUDirect-RDMA on A3 Ultra, and A4 machine types"
- ]
- }
- },
- "type": "object"
- },
- "GPUDriverInstallationConfig": {
- "description": "GPUDriverInstallationConfig specifies the version of GPU driver to be auto installed.",
- "properties": {
- "gpuDriverVersion": {
- "description": "Mode for how the GPU driver is installed.",
- "enum": [
- "GPU_DRIVER_VERSION_UNSPECIFIED",
- "INSTALLATION_DISABLED",
- "DEFAULT",
- "LATEST"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value is to not install any GPU driver.",
- "Disable GPU driver auto installation and needs manual installation",
- "\"Default\" GPU driver in COS and Ubuntu.",
- "\"Latest\" GPU driver in COS."
- ]
- }
- },
- "type": "object"
- },
- "GPUSharingConfig": {
- "description": "GPUSharingConfig represents the GPU sharing configuration for Hardware Accelerators.",
- "properties": {
- "gpuSharingStrategy": {
- "description": "The type of GPU sharing strategy to enable on the GPU node.",
- "enum": [
- "GPU_SHARING_STRATEGY_UNSPECIFIED",
- "TIME_SHARING",
- "MPS"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value.",
- "GPUs are time-shared between containers.",
- "GPUs are shared between containers with NVIDIA MPS."
- ]
- },
- "maxSharedClientsPerGpu": {
- "description": "The max number of containers that can share a physical GPU.",
- "format": "int64",
- "type": "string"
- }
- },
- "type": "object"
- },
- "GatewayAPIConfig": {
- "description": "GatewayAPIConfig contains the desired config of Gateway API on this cluster.",
- "properties": {
- "channel": {
- "description": "The Gateway API release channel to use for Gateway API.",
- "enum": [
- "CHANNEL_UNSPECIFIED",
- "CHANNEL_DISABLED",
- "CHANNEL_EXPERIMENTAL",
- "CHANNEL_STANDARD"
- ],
- "type": "string",
- "x-google-enum-deprecated": [
- false,
- false,
- true,
- false
- ],
- "x-google-enum-descriptions": [
- "Default value.",
- "Gateway API support is disabled",
- "Deprecated: use CHANNEL_STANDARD instead. Gateway API support is enabled, experimental CRDs are installed",
- "Gateway API support is enabled, standard CRDs are installed"
- ]
- }
- },
- "type": "object"
- },
- "GcePersistentDiskCsiDriverConfig": {
- "description": "Configuration for the Compute Engine PD CSI driver.",
- "properties": {
- "enabled": {
- "description": "Whether the Compute Engine PD CSI driver is enabled for this cluster.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "GcfsConfig": {
- "description": "GcfsConfig contains configurations of Google Container File System (image streaming).",
- "properties": {
- "enabled": {
- "description": "Whether to use GCFS.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "GcpFilestoreCsiDriverConfig": {
- "description": "Configuration for the Filestore CSI driver.",
- "properties": {
- "enabled": {
- "description": "Whether the Filestore CSI driver is enabled for this cluster.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "GcsFuseCsiDriverConfig": {
- "description": "Configuration for the Cloud Storage Fuse CSI driver.",
- "properties": {
- "enabled": {
- "description": "Whether the Cloud Storage Fuse CSI driver is enabled for this cluster.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "GkeAutoUpgradeConfig": {
- "description": "GkeAutoUpgradeConfig is the configuration for GKE auto upgrades.",
- "properties": {
- "patchMode": {
- "description": "PatchMode specifies how auto upgrade patch builds should be selected.",
- "enum": [
- "PATCH_MODE_UNSPECIFIED",
- "ACCELERATED"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "PATCH_MODE_UNSPECIFIED defaults to using the upgrade target from the channel's patch upgrade targets as the upgrade target for the version.",
- "ACCELERATED denotes that the latest patch build in the channel should be used as the upgrade target for the version."
- ]
- }
- },
- "type": "object"
- },
- "GkeBackupAgentConfig": {
- "description": "Configuration for the Backup for GKE Agent.",
- "properties": {
- "enabled": {
- "description": "Whether the Backup for GKE agent is enabled for this cluster.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "HighScaleCheckpointingConfig": {
- "description": "Configuration for the High Scale Checkpointing.",
- "properties": {
- "enabled": {
- "description": "Whether the High Scale Checkpointing is enabled for this cluster.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "HorizontalPodAutoscaling": {
- "description": "Configuration options for the horizontal pod autoscaling feature, which increases or decreases the number of replica pods a replication controller has based on the resource usage of the existing pods.",
- "properties": {
- "disabled": {
- "description": "Whether the Horizontal Pod Autoscaling feature is enabled in the cluster. When enabled, it ensures that metrics are collected into Stackdriver Monitoring.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "HostConfig": {
- "description": "HostConfig configures the registry host under a given Server.",
- "properties": {
- "ca": {
- "description": "CA configures the registry host certificate.",
- "items": {
- "$ref": "#/$defs/CertificateConfig"
- },
- "type": "array"
- },
- "capabilities": {
- "description": "Capabilities represent the capabilities of the registry host, specifying what operations a host is capable of performing. If not set, containerd enables all capabilities by default.",
- "items": {
- "enum": [
- "HOST_CAPABILITY_UNSPECIFIED",
- "HOST_CAPABILITY_PULL",
- "HOST_CAPABILITY_RESOLVE",
- "HOST_CAPABILITY_PUSH"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "UNKNOWN should never be set.",
- "Pull represents the capability to fetch manifests and blobs by digest.",
- "Resolve represents the capability to fetch manifests by name.",
- "Push represents the capability to push blobs and manifests."
- ]
- },
- "type": "array"
- },
- "client": {
- "description": "Client configures the registry host client certificate and key.",
- "items": {
- "$ref": "#/$defs/CertificateConfigPair"
- },
- "type": "array"
- },
- "dialTimeout": {
- "description": "Specifies the maximum duration allowed for a connection attempt to complete. A shorter timeout helps reduce delays when falling back to the original registry if the mirror is unreachable. Maximum allowed value is 180s. If not set, containerd sets default 30s. The value should be a decimal number of seconds with an `s` suffix.",
- "format": "google-duration",
- "type": "string"
- },
- "header": {
- "description": "Header configures the registry host headers.",
- "items": {
- "$ref": "#/$defs/RegistryHeader"
- },
- "type": "array"
- },
- "host": {
- "description": "Host configures the registry host/mirror. It supports fully qualified domain names (FQDN) and IP addresses: Specifying port is supported. Wildcards are NOT supported. Examples: - my.customdomain.com - 10.0.1.2:5000",
- "type": "string"
- },
- "overridePath": {
- "description": "OverridePath is used to indicate the host's API root endpoint is defined in the URL path rather than by the API specification. This may be used with non-compliant OCI registries which are missing the /v2 prefix. If not set, containerd sets default false.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "HttpLoadBalancing": {
- "description": "Configuration options for the HTTP (L7) load balancing controller addon, which makes it easy to set up HTTP load balancers for services in a cluster.",
- "properties": {
- "disabled": {
- "description": "Whether the HTTP Load Balancing controller is enabled in the cluster. When enabled, it runs a small pod in the cluster that manages the load balancers.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "HugepagesConfig": {
- "description": "Hugepages amount in both 2m and 1g size",
- "properties": {
- "hugepageSize1g": {
- "description": "Optional. Amount of 1G hugepages",
- "format": "int32",
- "type": "integer"
- },
- "hugepageSize2m": {
- "description": "Optional. Amount of 2M hugepages",
- "format": "int32",
- "type": "integer"
- }
- },
- "type": "object"
- },
- "IPAllocationPolicy": {
- "description": "Configuration for controlling how IPs are allocated in the cluster.",
- "properties": {
- "additionalIpRangesConfigs": {
- "description": "Output only. The additional IP ranges that are added to the cluster. These IP ranges can be used by new node pools to allocate node and pod IPs automatically. Each AdditionalIPRangesConfig corresponds to a single subnetwork. Once a range is removed it will not show up in IPAllocationPolicy.",
- "items": {
- "$ref": "#/$defs/AdditionalIPRangesConfig"
- },
- "readOnly": true,
- "type": "array"
- },
- "additionalPodRangesConfig": {
- "$ref": "#/$defs/AdditionalPodRangesConfig",
- "description": "Output only. The additional pod ranges that are added to the cluster. These pod ranges can be used by new node pools to allocate pod IPs automatically. Once the range is removed it will not show up in IPAllocationPolicy.",
- "readOnly": true
- },
- "autoIpamConfig": {
- "$ref": "#/$defs/AutoIpamConfig",
- "description": "Optional. AutoIpamConfig contains all information related to Auto IPAM"
- },
- "clusterIpv4Cidr": {
- "deprecated": true,
- "description": "This field is deprecated, use cluster_ipv4_cidr_block.",
- "type": "string"
- },
- "clusterIpv4CidrBlock": {
- "description": "The IP address range for the cluster pod IPs. If this field is set, then `cluster.cluster_ipv4_cidr` must be left blank. This field is only applicable when `use_ip_aliases` is true. Set to blank to have a range chosen with the default size. Set to /netmask (e.g. `/14`) to have a range chosen with a specific netmask. Set to a [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) from the RFC-1918 private networks (e.g. `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) to pick a specific range to use.",
- "type": "string"
- },
- "clusterSecondaryRangeName": {
- "description": "The name of the secondary range to be used for the cluster CIDR block. The secondary range will be used for pod IP addresses. This must be an existing secondary range associated with the cluster subnetwork. This field is only applicable with use_ip_aliases is true and create_subnetwork is false.",
- "type": "string"
- },
- "createSubnetwork": {
- "description": "Whether a new subnetwork will be created automatically for the cluster. This field is only applicable when `use_ip_aliases` is true.",
- "type": "boolean"
- },
- "defaultPodIpv4RangeUtilization": {
- "description": "Output only. The utilization of the cluster default IPv4 range for the pod. The ratio is Usage/[Total number of IPs in the secondary range], Usage=numNodes*numZones*podIPsPerNode.",
- "format": "double",
- "readOnly": true,
- "type": "number"
- },
- "ipv6AccessType": {
- "description": "The ipv6 access type (internal or external) when create_subnetwork is true",
- "enum": [
- "IPV6_ACCESS_TYPE_UNSPECIFIED",
- "INTERNAL",
- "EXTERNAL"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value, will be defaulted as type external.",
- "Access type internal (all v6 addresses are internal IPs)",
- "Access type external (all v6 addresses are external IPs)"
- ]
- },
- "networkTierConfig": {
- "$ref": "#/$defs/NetworkTierConfig",
- "description": "Cluster-level network tier configuration is used to determine the default network tier for external IP addresses on cluster resources, such as node pools and load balancers."
- },
- "nodeIpv4Cidr": {
- "deprecated": true,
- "description": "This field is deprecated, use node_ipv4_cidr_block.",
- "type": "string"
- },
- "nodeIpv4CidrBlock": {
- "description": "The IP address range of the instance IPs in this cluster. This is applicable only if `create_subnetwork` is true. Set to blank to have a range chosen with the default size. Set to /netmask (e.g. `/14`) to have a range chosen with a specific netmask. Set to a [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) from the RFC-1918 private networks (e.g. `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) to pick a specific range to use.",
- "type": "string"
- },
- "podCidrOverprovisionConfig": {
- "$ref": "#/$defs/PodCIDROverprovisionConfig",
- "description": "[PRIVATE FIELD] Pod CIDR size overprovisioning config for the cluster. Pod CIDR size per node depends on max_pods_per_node. By default, the value of max_pods_per_node is doubled and then rounded off to next power of 2 to get the size of pod CIDR block per node. Example: max_pods_per_node of 30 would result in 64 IPs (/26). This config can disable the doubling of IPs (we still round off to next power of 2) Example: max_pods_per_node of 30 will result in 32 IPs (/27) when overprovisioning is disabled."
- },
- "servicesIpv4Cidr": {
- "deprecated": true,
- "description": "This field is deprecated, use services_ipv4_cidr_block.",
- "type": "string"
- },
- "servicesIpv4CidrBlock": {
- "description": "The IP address range of the services IPs in this cluster. If blank, a range will be automatically chosen with the default size. This field is only applicable when `use_ip_aliases` is true. Set to blank to have a range chosen with the default size. Set to /netmask (e.g. `/14`) to have a range chosen with a specific netmask. Set to a [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) from the RFC-1918 private networks (e.g. `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) to pick a specific range to use.",
- "type": "string"
- },
- "servicesIpv6CidrBlock": {
- "description": "Output only. The services IPv6 CIDR block for the cluster.",
- "readOnly": true,
- "type": "string"
- },
- "servicesSecondaryRangeName": {
- "description": "The name of the secondary range to be used as for the services CIDR block. The secondary range will be used for service ClusterIPs. This must be an existing secondary range associated with the cluster subnetwork. This field is only applicable with use_ip_aliases is true and create_subnetwork is false.",
- "type": "string"
- },
- "stackType": {
- "description": "The IP stack type of the cluster",
- "enum": [
- "STACK_TYPE_UNSPECIFIED",
- "IPV4",
- "IPV4_IPV6"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value, will be defaulted as IPV4 only",
- "Cluster is IPV4 only",
- "Cluster can use both IPv4 and IPv6"
- ]
- },
- "subnetIpv6CidrBlock": {
- "description": "Output only. The subnet's IPv6 CIDR block used by nodes and pods.",
- "readOnly": true,
- "type": "string"
- },
- "subnetworkName": {
- "description": "A custom subnetwork name to be used if `create_subnetwork` is true. If this field is empty, then an automatic name will be chosen for the new subnetwork.",
- "type": "string"
- },
- "tpuIpv4CidrBlock": {
- "deprecated": true,
- "description": "The IP address range of the Cloud TPUs in this cluster. If unspecified, a range will be automatically chosen with the default size. This field is only applicable when `use_ip_aliases` is true. If unspecified, the range will use the default size. Set to /netmask (e.g. `/14`) to have a range chosen with a specific netmask. Set to a [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) from the RFC-1918 private networks (e.g. `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) to pick a specific range to use. This field is deprecated due to the deprecation of 2VM TPU. The end of life date for 2VM TPU is 2025-04-25.",
- "type": "string"
- },
- "useIpAliases": {
- "description": "Whether alias IPs will be used for pod IPs in the cluster. This is used in conjunction with use_routes. It cannot be true if use_routes is true. If both use_ip_aliases and use_routes are false, then the server picks the default IP allocation mode",
- "type": "boolean"
- },
- "useRoutes": {
- "description": "Whether routes will be used for pod IPs in the cluster. This is used in conjunction with use_ip_aliases. It cannot be true if use_ip_aliases is true. If both use_ip_aliases and use_routes are false, then the server picks the default IP allocation mode",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "IPEndpointsConfig": {
- "description": "IP endpoints configuration.",
- "properties": {
- "authorizedNetworksConfig": {
- "$ref": "#/$defs/MasterAuthorizedNetworksConfig",
- "description": "Configuration of authorized networks. If enabled, restricts access to the control plane based on source IP. It is invalid to specify both Cluster.masterAuthorizedNetworksConfig and this field at the same time."
- },
- "enablePublicEndpoint": {
- "description": "Controls whether the control plane allows access through a public IP. It is invalid to specify both PrivateClusterConfig.enablePrivateEndpoint and this field at the same time.",
- "type": "boolean"
- },
- "enabled": {
- "description": "Controls whether to allow direct IP access.",
- "type": "boolean"
- },
- "globalAccess": {
- "description": "Controls whether the control plane's private endpoint is accessible from sources in other regions. It is invalid to specify both PrivateClusterMasterGlobalAccessConfig.enabled and this field at the same time.",
- "type": "boolean"
- },
- "privateEndpoint": {
- "description": "Output only. The internal IP address of this cluster's control plane. Only populated if enabled.",
- "readOnly": true,
- "type": "string"
- },
- "privateEndpointSubnetwork": {
- "description": "Subnet to provision the master's private endpoint during cluster creation. Specified in projects/*/regions/*/subnetworks/* format. It is invalid to specify both PrivateClusterConfig.privateEndpointSubnetwork and this field at the same time.",
- "type": "string"
- },
- "publicEndpoint": {
- "description": "Output only. The external IP address of this cluster's control plane. Only populated if enabled.",
- "readOnly": true,
- "type": "string"
- }
- },
- "type": "object"
- },
- "IdentityServiceConfig": {
- "description": "IdentityServiceConfig is configuration for Identity Service which allows customers to use external identity providers with the K8S API",
- "properties": {
- "enabled": {
- "description": "Whether to enable the Identity Service component",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "K8sBetaAPIConfig": {
- "description": "K8sBetaAPIConfig , configuration for beta APIs",
- "properties": {
- "enabledApis": {
- "description": "Enabled k8s beta APIs.",
- "items": {
- "type": "string"
- },
- "type": "array"
- }
- },
- "type": "object"
- },
- "KubernetesDashboard": {
- "description": "Configuration for the Kubernetes Dashboard.",
- "properties": {
- "disabled": {
- "description": "Whether the Kubernetes Dashboard is enabled for this cluster.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "LegacyAbac": {
- "description": "Configuration for the legacy Attribute Based Access Control authorization mode.",
- "properties": {
- "enabled": {
- "description": "Whether the ABAC authorizer is enabled for this cluster. When enabled, identities in the system, including service accounts, nodes, and controllers, will have statically granted permissions beyond those provided by the RBAC configuration or IAM.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "LinuxNodeConfig": {
- "description": "Parameters that can be configured on Linux nodes.",
- "properties": {
- "cgroupMode": {
- "description": "cgroup_mode specifies the cgroup mode to be used on the node.",
- "enum": [
- "CGROUP_MODE_UNSPECIFIED",
- "CGROUP_MODE_V1",
- "CGROUP_MODE_V2"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "CGROUP_MODE_UNSPECIFIED is when unspecified cgroup configuration is used. The default for the GKE node OS image will be used.",
- "CGROUP_MODE_V1 specifies to use cgroupv1 for the cgroup configuration on the node image.",
- "CGROUP_MODE_V2 specifies to use cgroupv2 for the cgroup configuration on the node image."
- ]
- },
- "hugepages": {
- "$ref": "#/$defs/HugepagesConfig",
- "description": "Optional. Amounts for 2M and 1G hugepages"
- },
- "nodeKernelModuleLoading": {
- "$ref": "#/$defs/NodeKernelModuleLoading",
- "description": "Optional. Configuration for kernel module loading on nodes. When enabled, the node pool will be provisioned with a Container-Optimized OS image that enforces kernel module signature verification."
- },
- "swapConfig": {
- "$ref": "#/$defs/SwapConfig",
- "description": "Optional. Enables and configures swap space on nodes. If omitted, swap is disabled."
- },
- "sysctls": {
- "additionalProperties": {
- "type": "string"
- },
- "description": "The Linux kernel parameters to be applied to the nodes and all pods running on the nodes. The following parameters are supported. net.core.busy_poll net.core.busy_read net.core.netdev_max_backlog net.core.rmem_max net.core.rmem_default net.core.wmem_default net.core.wmem_max net.core.optmem_max net.core.somaxconn net.ipv4.tcp_rmem net.ipv4.tcp_wmem net.ipv4.tcp_tw_reuse net.ipv4.tcp_mtu_probing net.ipv4.tcp_max_orphans net.ipv4.tcp_max_tw_buckets net.ipv4.tcp_syn_retries net.ipv4.tcp_ecn net.ipv4.tcp_congestion_control net.netfilter.nf_conntrack_max net.netfilter.nf_conntrack_buckets net.netfilter.nf_conntrack_tcp_timeout_close_wait net.netfilter.nf_conntrack_tcp_timeout_time_wait net.netfilter.nf_conntrack_tcp_timeout_established net.netfilter.nf_conntrack_acct kernel.shmmni kernel.shmmax kernel.shmall kernel.perf_event_paranoid kernel.sched_rt_runtime_us kernel.softlockup_panic kernel.yama.ptrace_scope kernel.kptr_restrict kernel.dmesg_restrict kernel.sysrq fs.aio-max-nr fs.file-max fs.inotify.max_user_instances fs.inotify.max_user_watches fs.nr_open vm.dirty_background_ratio vm.dirty_background_bytes vm.dirty_expire_centisecs vm.dirty_ratio vm.dirty_bytes vm.dirty_writeback_centisecs vm.max_map_count vm.overcommit_memory vm.overcommit_ratio vm.vfs_cache_pressure vm.swappiness vm.watermark_scale_factor vm.min_free_kbytes",
- "type": "object"
- },
- "transparentHugepageDefrag": {
- "description": "Optional. Defines the transparent hugepage defrag configuration on the node. VM hugepage allocation can be managed by either limiting defragmentation for delayed allocation or skipping it entirely for immediate allocation only. See https://docs.kernel.org/admin-guide/mm/transhuge.html for more details.",
- "enum": [
- "TRANSPARENT_HUGEPAGE_DEFRAG_UNSPECIFIED",
- "TRANSPARENT_HUGEPAGE_DEFRAG_ALWAYS",
- "TRANSPARENT_HUGEPAGE_DEFRAG_DEFER",
- "TRANSPARENT_HUGEPAGE_DEFRAG_DEFER_WITH_MADVISE",
- "TRANSPARENT_HUGEPAGE_DEFRAG_MADVISE",
- "TRANSPARENT_HUGEPAGE_DEFRAG_NEVER"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value. GKE will not modify the kernel configuration.",
- "It means that an application requesting THP will stall on allocation failure and directly reclaim pages and compact memory in an effort to allocate a THP immediately.",
- "It means that an application will wake kswapd in the background to reclaim pages and wake kcompactd to compact memory so that THP is available in the near future. It's the responsibility of khugepaged to then install the THP pages later.",
- "It means that an application will enter direct reclaim and compaction like always, but only for regions that have used madvise(MADV_HUGEPAGE); all other regions will wake kswapd in the background to reclaim pages and wake kcompactd to compact memory so that THP is available in the near future.",
- "It means that an application will enter direct reclaim like always but only for regions that are have used madvise(MADV_HUGEPAGE). This is the default kernel configuration.",
- "It means that an application will never enter direct reclaim or compaction."
- ]
- },
- "transparentHugepageEnabled": {
- "description": "Optional. Transparent hugepage support for anonymous memory can be entirely disabled (mostly for debugging purposes) or only enabled inside MADV_HUGEPAGE regions (to avoid the risk of consuming more memory resources) or enabled system wide. See https://docs.kernel.org/admin-guide/mm/transhuge.html for more details.",
- "enum": [
- "TRANSPARENT_HUGEPAGE_ENABLED_UNSPECIFIED",
- "TRANSPARENT_HUGEPAGE_ENABLED_ALWAYS",
- "TRANSPARENT_HUGEPAGE_ENABLED_MADVISE",
- "TRANSPARENT_HUGEPAGE_ENABLED_NEVER"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value. GKE will not modify the kernel configuration.",
- "Transparent hugepage support for anonymous memory is enabled system wide.",
- "Transparent hugepage support for anonymous memory is enabled inside MADV_HUGEPAGE regions. This is the default kernel configuration.",
- "Transparent hugepage support for anonymous memory is disabled."
- ]
- }
- },
- "type": "object"
- },
- "LocalNvmeSsdBlockConfig": {
- "description": "LocalNvmeSsdBlockConfig contains configuration for using raw-block local NVMe SSDs",
- "properties": {
- "localSsdCount": {
- "description": "Number of local NVMe SSDs to use. The limit for this value is dependent upon the maximum number of disk available on a machine per zone. See: https://cloud.google.com/compute/docs/disks/local-ssd for more information. A zero (or unset) value has different meanings depending on machine type being used: 1. For pre-Gen3 machines, which support flexible numbers of local ssds, zero (or unset) means to disable using local SSDs as ephemeral storage. 2. For Gen3 machines which dictate a specific number of local ssds, zero (or unset) means to use the default number of local ssds that goes with that machine type. For example, for a c3-standard-8-lssd machine, 2 local ssds would be provisioned. For c3-standard-8 (which doesn't support local ssds), 0 will be provisioned. See https://cloud.google.com/compute/docs/disks/local-ssd#choose_number_local_ssds for more info.",
- "format": "int32",
- "type": "integer"
- }
- },
- "type": "object"
- },
- "LoggingComponentConfig": {
- "description": "LoggingComponentConfig is cluster logging component configuration.",
- "properties": {
- "enableComponents": {
- "description": "Select components to collect logs. An empty set would disable all logging.",
- "items": {
- "enum": [
- "COMPONENT_UNSPECIFIED",
- "SYSTEM_COMPONENTS",
- "WORKLOADS",
- "APISERVER",
- "SCHEDULER",
- "CONTROLLER_MANAGER",
- "KCP_SSHD",
- "KCP_CONNECTION",
- "KCP_HPA"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value. This shouldn't be used.",
- "system components",
- "workloads",
- "kube-apiserver",
- "kube-scheduler",
- "kube-controller-manager",
- "kcp-sshd",
- "kcp connection logs",
- "horizontal pod autoscaler decision logs"
- ]
- },
- "type": "array"
- }
- },
- "type": "object"
- },
- "LoggingConfig": {
- "description": "LoggingConfig is cluster logging configuration.",
- "properties": {
- "componentConfig": {
- "$ref": "#/$defs/LoggingComponentConfig",
- "description": "Logging components configuration"
- }
- },
- "type": "object"
- },
- "LoggingVariantConfig": {
- "description": "LoggingVariantConfig specifies the behaviour of the logging component.",
- "properties": {
- "variant": {
- "description": "Logging variant deployed on nodes.",
- "enum": [
- "VARIANT_UNSPECIFIED",
- "DEFAULT",
- "MAX_THROUGHPUT"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value. This shouldn't be used.",
- "default logging variant.",
- "maximum logging throughput variant."
- ]
- }
- },
- "type": "object"
- },
- "LustreCsiDriverConfig": {
- "description": "Configuration for the Lustre CSI driver.",
- "properties": {
- "disableMultiNic": {
- "description": "When set to true, this disables multi-NIC support for the Lustre CSI driver. By default, GKE enables multi-NIC support, which allows the Lustre CSI driver to automatically detect and configure all suitable network interfaces on a node to maximize I/O performance for demanding workloads.",
- "type": "boolean"
- },
- "enableLegacyLustrePort": {
- "deprecated": true,
- "description": "If set to true, the Lustre CSI driver will install Lustre kernel modules using port 6988. This serves as a workaround for a port conflict with the gke-metadata-server. This field is required ONLY under the following conditions: 1. The GKE node version is older than 1.33.2-gke.4655000. 2. You're connecting to a Lustre instance that has the 'gke-support-enabled' flag. Deprecated: This flag is no longer required as of GKE node version 1.33.2-gke.4655000, unless you are connecting to a Lustre instance that has the `gke-support-enabled` flag.",
- "type": "boolean"
- },
- "enabled": {
- "description": "Whether the Lustre CSI driver is enabled for this cluster.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "MaintenanceExclusionOptions": {
- "description": "Represents the Maintenance exclusion option.",
- "properties": {
- "endTimeBehavior": {
- "description": "EndTimeBehavior specifies the behavior of the exclusion end time.",
- "enum": [
- "END_TIME_BEHAVIOR_UNSPECIFIED",
- "UNTIL_END_OF_SUPPORT"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "END_TIME_BEHAVIOR_UNSPECIFIED is the default behavior, which is fixed end time.",
- "UNTIL_END_OF_SUPPORT means the exclusion will be in effect until the end of the support of the cluster's current version."
- ]
- },
- "scope": {
- "description": "Scope specifies the upgrade scope which upgrades are blocked by the exclusion.",
- "enum": [
- "NO_UPGRADES",
- "NO_MINOR_UPGRADES",
- "NO_MINOR_OR_NODE_UPGRADES"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "NO_UPGRADES excludes all upgrades, including patch upgrades and minor upgrades across control planes and nodes. This is the default exclusion behavior.",
- "NO_MINOR_UPGRADES excludes all minor upgrades for the cluster, only patches are allowed.",
- "NO_MINOR_OR_NODE_UPGRADES excludes all minor upgrades for the cluster, and also exclude all node pool upgrades. Only control plane patches are allowed."
- ]
- }
- },
- "type": "object"
- },
- "MaintenancePolicy": {
- "description": "MaintenancePolicy defines the maintenance policy to be used for the cluster.",
- "properties": {
- "disruptionBudget": {
- "$ref": "#/$defs/DisruptionBudget",
- "description": "Optional. The upgrade disruption budget for the cluster control plane."
- },
- "resourceVersion": {
- "description": "A hash identifying the version of this policy, so that updates to fields of the policy won't accidentally undo intermediate changes (and so that users of the API unaware of some fields won't accidentally remove other fields). Make a `get()` request to the cluster to get the current resource version and include it with requests to set the policy.",
- "type": "string"
- },
- "window": {
- "$ref": "#/$defs/MaintenanceWindow",
- "description": "Specifies the maintenance window in which maintenance may be performed."
- }
- },
- "type": "object"
- },
- "MaintenanceWindow": {
- "description": "MaintenanceWindow defines the maintenance window to be used for the cluster.",
- "properties": {
- "dailyMaintenanceWindow": {
- "$ref": "#/$defs/DailyMaintenanceWindow",
- "description": "DailyMaintenanceWindow specifies a daily maintenance operation window."
- },
- "maintenanceExclusions": {
- "additionalProperties": {
- "$ref": "#/$defs/TimeWindow"
- },
- "description": "Exceptions to maintenance window. Non-emergency maintenance should not occur in these windows.",
- "type": "object"
- },
- "recurringWindow": {
- "$ref": "#/$defs/RecurringTimeWindow",
- "description": "RecurringWindow specifies some number of recurring time periods for maintenance to occur. The time windows may be overlapping. If no maintenance windows are set, maintenance can occur at any time."
- }
- },
- "type": "object"
- },
- "ManagedMachineLearningDiagnosticsConfig": {
- "description": "ManagedMachineLearningDiagnosticsConfig is the configuration for the GKE Managed Machine Learning Diagnostics pipeline.",
- "properties": {
- "enabled": {
- "description": "Enable/Disable Managed Machine Learning Diagnostics.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "ManagedOpenTelemetryConfig": {
- "description": "ManagedOpenTelemetryConfig is the configuration for the GKE Managed OpenTelemetry pipeline.",
- "properties": {
- "scope": {
- "description": "Scope of the Managed OpenTelemetry pipeline.",
- "enum": [
- "SCOPE_UNSPECIFIED",
- "NONE",
- "COLLECTION_AND_INSTRUMENTATION_COMPONENTS"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "SCOPE_UNSPECIFIED is when the scope is not set.",
- "NONE is used to disable the Managed OpenTelemetry pipeline.",
- "COLLECTION_AND_INSTRUMENTATION_COMPONENTS is used to enable the Managed OpenTelemetry pipeline for collection and instrumentation components."
- ]
- }
- },
- "type": "object"
- },
- "ManagedPrometheusConfig": {
- "description": "ManagedPrometheusConfig defines the configuration for Google Cloud Managed Service for Prometheus.",
- "properties": {
- "autoMonitoringConfig": {
- "$ref": "#/$defs/AutoMonitoringConfig",
- "description": "GKE Workload Auto-Monitoring Configuration."
- },
- "enabled": {
- "description": "Enable Managed Collection.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "MasterAuth": {
- "description": "The authentication information for accessing the master endpoint. Authentication can be done using HTTP basic auth or using client certificates.",
- "properties": {
- "clientCertificate": {
- "description": "Output only. Base64-encoded public certificate used by clients to authenticate to the cluster endpoint. Issued only if client_certificate_config is set.",
- "readOnly": true,
- "type": "string"
- },
- "clientCertificateConfig": {
- "$ref": "#/$defs/ClientCertificateConfig",
- "description": "Configuration for client certificate authentication on the cluster. For clusters before v1.12, if no configuration is specified, a client certificate is issued."
- },
- "clientKey": {
- "description": "Output only. Base64-encoded private key used by clients to authenticate to the cluster endpoint.",
- "readOnly": true,
- "type": "string"
- },
- "clusterCaCertificate": {
- "description": "Output only. Base64-encoded public certificate that is the root of trust for the cluster.",
- "readOnly": true,
- "type": "string"
- },
- "password": {
- "deprecated": true,
- "description": "The password to use for HTTP basic authentication to the master endpoint. Because the master endpoint is open to the Internet, you should create a strong password. If a password is provided for cluster creation, username must be non-empty. Warning: basic authentication is deprecated, and will be removed in GKE control plane versions 1.19 and newer. For a list of recommended authentication methods, see: https://cloud.google.com/kubernetes-engine/docs/how-to/api-server-authentication",
- "type": "string"
- },
- "username": {
- "deprecated": true,
- "description": "The username to use for HTTP basic authentication to the master endpoint. For clusters v1.6.0 and later, basic authentication can be disabled by leaving username unspecified (or setting it to the empty string). Warning: basic authentication is deprecated, and will be removed in GKE control plane versions 1.19 and newer. For a list of recommended authentication methods, see: https://cloud.google.com/kubernetes-engine/docs/how-to/api-server-authentication",
- "type": "string"
- }
- },
- "type": "object"
- },
- "MasterAuthorizedNetworksConfig": {
- "description": "Configuration options for the master authorized networks feature. Enabled master authorized networks will disallow all external traffic to access Kubernetes master through HTTPS except traffic from the given CIDR blocks, Google Compute Engine Public IPs and Google Prod IPs.",
- "properties": {
- "cidrBlocks": {
- "description": "cidr_blocks define up to 50 external networks that could access Kubernetes master through HTTPS.",
- "items": {
- "$ref": "#/$defs/CidrBlock"
- },
- "type": "array"
- },
- "enabled": {
- "description": "Whether or not master authorized networks is enabled.",
- "type": "boolean"
- },
- "gcpPublicCidrsAccessEnabled": {
- "description": "Whether master is accessible via Google Compute Engine Public IP addresses.",
- "type": "boolean"
- },
- "privateEndpointEnforcementEnabled": {
- "description": "Whether master authorized networks is enforced on private endpoint or not.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "MaxPodsConstraint": {
- "description": "Constraints applied to pods.",
- "properties": {
- "maxPodsPerNode": {
- "description": "Constraint enforced on the max num of pods per node.",
- "format": "int64",
- "type": "string"
- }
- },
- "type": "object"
- },
- "MemoryManager": {
- "description": "The option enables the Kubernetes NUMA-aware Memory Manager feature. Detailed description about the feature can be found [here](https://kubernetes.io/docs/tasks/administer-cluster/memory-manager/).",
- "properties": {
- "policy": {
- "description": "Controls the memory management policy on the Node. See https://kubernetes.io/docs/tasks/administer-cluster/memory-manager/#policies The following values are allowed. * \"none\" * \"static\" The default value is 'none' if unspecified.",
- "type": "string"
- }
- },
- "type": "object"
- },
- "MeshCertificates": {
- "description": "Configuration for issuance of mTLS keys and certificates to Kubernetes pods.",
- "properties": {
- "enableCertificates": {
- "description": "enable_certificates controls issuance of workload mTLS certificates. If set, the GKE Workload Identity Certificates controller and node agent will be deployed in the cluster, which can then be configured by creating a WorkloadCertificateConfig Custom Resource. Requires Workload Identity (workload_pool must be non-empty).",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "MonitoringComponentConfig": {
- "description": "MonitoringComponentConfig is cluster monitoring component configuration.",
- "properties": {
- "enableComponents": {
- "description": "Select components to collect metrics. An empty set would disable all monitoring.",
- "items": {
- "enum": [
- "COMPONENT_UNSPECIFIED",
- "SYSTEM_COMPONENTS",
- "APISERVER",
- "SCHEDULER",
- "CONTROLLER_MANAGER",
- "STORAGE",
- "HPA",
- "POD",
- "DAEMONSET",
- "DEPLOYMENT",
- "STATEFULSET",
- "CADVISOR",
- "KUBELET",
- "DCGM",
- "JOBSET"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value. This shouldn't be used.",
- "system components",
- "kube-apiserver",
- "kube-scheduler",
- "kube-controller-manager",
- "Storage",
- "Horizontal Pod Autoscaling",
- "Pod",
- "DaemonSet",
- "Deployment",
- "Statefulset",
- "CADVISOR",
- "KUBELET",
- "NVIDIA Data Center GPU Manager (DCGM)",
- "JobSet"
- ]
- },
- "type": "array"
- }
- },
- "type": "object"
- },
- "MonitoringConfig": {
- "description": "MonitoringConfig is cluster monitoring configuration.",
- "properties": {
- "advancedDatapathObservabilityConfig": {
- "$ref": "#/$defs/AdvancedDatapathObservabilityConfig",
- "description": "Configuration of Advanced Datapath Observability features."
- },
- "componentConfig": {
- "$ref": "#/$defs/MonitoringComponentConfig",
- "description": "Monitoring components configuration"
- },
- "managedPrometheusConfig": {
- "$ref": "#/$defs/ManagedPrometheusConfig",
- "description": "Enable Google Cloud Managed Service for Prometheus in the cluster."
- }
- },
- "type": "object"
- },
- "NetworkConfig": {
- "description": "NetworkConfig reports the relative names of network & subnetwork.",
- "properties": {
- "datapathProvider": {
- "description": "The desired datapath provider for this cluster. By default, uses the IPTables-based kube-proxy implementation.",
- "enum": [
- "DATAPATH_PROVIDER_UNSPECIFIED",
- "LEGACY_DATAPATH",
- "ADVANCED_DATAPATH"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value.",
- "Use the IPTables implementation based on kube-proxy.",
- "Use the eBPF based GKE Dataplane V2 with additional features. See the [GKE Dataplane V2 documentation](https://cloud.google.com/kubernetes-engine/docs/how-to/dataplane-v2) for more."
- ]
- },
- "defaultEnablePrivateNodes": {
- "description": "Controls whether by default nodes have private IP addresses only. It is invalid to specify both PrivateClusterConfig.enablePrivateNodes and this field at the same time. To update the default setting, use ClusterUpdate.desired_default_enable_private_nodes",
- "type": "boolean"
- },
- "defaultSnatStatus": {
- "$ref": "#/$defs/DefaultSnatStatus",
- "description": "Whether the cluster disables default in-node sNAT rules. In-node sNAT rules will be disabled when default_snat_status is disabled. When disabled is set to false, default IP masquerade rules will be applied to the nodes to prevent sNAT on cluster internal traffic."
- },
- "disableL4LbFirewallReconciliation": {
- "description": "Disable L4 load balancer VPC firewalls to enable firewall policies.",
- "type": "boolean"
- },
- "dnsConfig": {
- "$ref": "#/$defs/DNSConfig",
- "description": "DNSConfig contains clusterDNS config for this cluster."
- },
- "enableCiliumClusterwideNetworkPolicy": {
- "description": "Whether CiliumClusterwideNetworkPolicy is enabled on this cluster.",
- "type": "boolean"
- },
- "enableFqdnNetworkPolicy": {
- "description": "Whether FQDN Network Policy is enabled on this cluster.",
- "type": "boolean"
- },
- "enableIntraNodeVisibility": {
- "description": "Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network.",
- "type": "boolean"
- },
- "enableL4ilbSubsetting": {
- "description": "Whether L4ILB Subsetting is enabled for this cluster.",
- "type": "boolean"
- },
- "enableMultiNetworking": {
- "description": "Whether multi-networking is enabled for this cluster.",
- "type": "boolean"
- },
- "gatewayApiConfig": {
- "$ref": "#/$defs/GatewayAPIConfig",
- "description": "GatewayAPIConfig contains the desired config of Gateway API on this cluster."
- },
- "inTransitEncryptionConfig": {
- "description": "Specify the details of in-transit encryption. Now named inter-node transparent encryption.",
- "enum": [
- "IN_TRANSIT_ENCRYPTION_CONFIG_UNSPECIFIED",
- "IN_TRANSIT_ENCRYPTION_DISABLED",
- "IN_TRANSIT_ENCRYPTION_INTER_NODE_TRANSPARENT"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Unspecified, will be inferred as default - IN_TRANSIT_ENCRYPTION_UNSPECIFIED.",
- "In-transit encryption is disabled.",
- "Data in-transit is encrypted using inter-node transparent encryption."
- ]
- },
- "network": {
- "description": "Output only. The relative name of the Google Compute Engine [network](https://cloud.google.com/compute/docs/networks-and-firewalls#networks) to which the cluster is connected. Example: projects/my-project/global/networks/my-network",
- "readOnly": true,
- "type": "string"
- },
- "networkPerformanceConfig": {
- "$ref": "#/$defs/ClusterNetworkPerformanceConfig",
- "description": "Network bandwidth tier configuration."
- },
- "privateIpv6GoogleAccess": {
- "description": "The desired state of IPv6 connectivity to Google Services. By default, no private IPv6 access to or from Google Services (all access will be via IPv4)",
- "enum": [
- "PRIVATE_IPV6_GOOGLE_ACCESS_UNSPECIFIED",
- "PRIVATE_IPV6_GOOGLE_ACCESS_DISABLED",
- "PRIVATE_IPV6_GOOGLE_ACCESS_TO_GOOGLE",
- "PRIVATE_IPV6_GOOGLE_ACCESS_BIDIRECTIONAL"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value. Same as DISABLED",
- "No private access to or from Google Services",
- "Enables private IPv6 access to Google Services from GKE",
- "Enables private IPv6 access to and from Google Services"
- ]
- },
- "serviceExternalIpsConfig": {
- "$ref": "#/$defs/ServiceExternalIPsConfig",
- "description": "ServiceExternalIPsConfig specifies if services with externalIPs field are blocked or not."
- },
- "subnetwork": {
- "description": "Output only. The relative name of the Google Compute Engine [subnetwork](https://cloud.google.com/compute/docs/vpc) to which the cluster is connected. Example: projects/my-project/regions/us-central1/subnetworks/my-subnet",
- "readOnly": true,
- "type": "string"
- }
- },
- "type": "object"
- },
- "NetworkPerformanceConfig": {
- "description": "Configuration of all network bandwidth tiers",
- "properties": {
- "totalEgressBandwidthTier": {
- "description": "Specifies the total network bandwidth tier for the NodePool.",
- "enum": [
- "TIER_UNSPECIFIED",
- "TIER_1"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value",
- "Higher bandwidth, actual values based on VM size."
- ]
- }
- },
- "type": "object"
- },
- "NetworkPolicy": {
- "description": "Configuration options for the NetworkPolicy feature. https://kubernetes.io/docs/concepts/services-networking/networkpolicies/",
- "properties": {
- "enabled": {
- "description": "Whether network policy is enabled on the cluster.",
- "type": "boolean"
- },
- "provider": {
- "description": "The selected network policy provider.",
- "enum": [
- "PROVIDER_UNSPECIFIED",
- "CALICO"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Not set",
- "Tigera (Calico Felix)."
- ]
- }
- },
- "type": "object"
- },
- "NetworkPolicyConfig": {
- "description": "Configuration for NetworkPolicy. This only tracks whether the addon is enabled or not on the Master, it does not track whether network policy is enabled for the nodes.",
- "properties": {
- "disabled": {
- "description": "Whether NetworkPolicy is enabled for this cluster.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "NetworkTags": {
- "description": "Collection of Compute Engine network tags that can be applied to a node's underlying VM instance.",
- "properties": {
- "tags": {
- "description": "List of network tags.",
- "items": {
- "type": "string"
- },
- "type": "array"
- }
- },
- "type": "object"
- },
- "NetworkTierConfig": {
- "description": "NetworkTierConfig contains network tier information.",
- "properties": {
- "networkTier": {
- "description": "Network tier configuration.",
- "enum": [
- "NETWORK_TIER_UNSPECIFIED",
- "NETWORK_TIER_DEFAULT",
- "NETWORK_TIER_PREMIUM",
- "NETWORK_TIER_STANDARD"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "By default, use project-level configuration. When unspecified, the behavior defaults to NETWORK_TIER_DEFAULT. For cluster updates, this implies no action (no-op).",
- "Default network tier. Use project-level configuration. User can specify this value, meaning they want to keep the same behaviour as before cluster level network tier configuration is introduced. This field ensures backward compatibility for the network tier of cluster resources, such as node pools and load balancers, for their external IP addresses.",
- "Premium network tier.",
- "Standard network tier."
- ]
- }
- },
- "type": "object"
- },
- "NodeAffinity": {
- "description": "Specifies the NodeAffinity key, values, and affinity operator according to [shared sole tenant node group affinities](https://cloud.google.com/compute/docs/nodes/sole-tenant-nodes#node_affinity_and_anti-affinity).",
- "properties": {
- "key": {
- "description": "Key for NodeAffinity.",
- "type": "string"
- },
- "operator": {
- "description": "Operator for NodeAffinity.",
- "enum": [
- "OPERATOR_UNSPECIFIED",
- "IN",
- "NOT_IN"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Invalid or unspecified affinity operator.",
- "Affinity operator.",
- "Anti-affinity operator."
- ]
- },
- "values": {
- "description": "Values for NodeAffinity.",
- "items": {
- "type": "string"
- },
- "type": "array"
- }
- },
- "type": "object"
- },
- "NodeConfig": {
- "description": "Parameters that describe the nodes in a cluster. GKE Autopilot clusters do not recognize parameters in `NodeConfig`. Use AutoprovisioningNodePoolDefaults instead.",
- "properties": {
- "accelerators": {
- "description": "A list of hardware accelerators to be attached to each node. See https://cloud.google.com/compute/docs/gpus for more information about support for GPUs.",
- "items": {
- "$ref": "#/$defs/AcceleratorConfig"
- },
- "type": "array"
- },
- "advancedMachineFeatures": {
- "$ref": "#/$defs/AdvancedMachineFeatures",
- "description": "Advanced features for the Compute Engine VM."
- },
- "bootDisk": {
- "$ref": "#/$defs/BootDisk",
- "description": "The boot disk configuration for the node pool."
- },
- "bootDiskKmsKey": {
- "description": " The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption",
- "type": "string"
- },
- "confidentialNodes": {
- "$ref": "#/$defs/ConfidentialNodes",
- "description": "Confidential nodes config. All the nodes in the node pool will be Confidential VM once enabled."
- },
- "consolidationDelay": {
- "description": "Consolidation delay defines duration after which the Cluster Autoscaler can scale down underutilized nodes. If not set, nodes are scaled down by default behavior, i.e. according to the chosen autoscaling profile.",
- "format": "google-duration",
- "type": "string"
- },
- "containerdConfig": {
- "$ref": "#/$defs/ContainerdConfig",
- "description": "Parameters for containerd customization."
- },
- "diskSizeGb": {
- "description": "Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB. If unspecified, the default disk size is 100GB.",
- "format": "int32",
- "type": "integer"
- },
- "diskType": {
- "description": "Type of the disk attached to each node (e.g. 'pd-standard', 'pd-ssd' or 'pd-balanced') If unspecified, the default disk type is 'pd-standard'",
- "type": "string"
- },
- "effectiveCgroupMode": {
- "description": "Output only. effective_cgroup_mode is the cgroup mode actually used by the node pool. It is determined by the cgroup mode specified in the LinuxNodeConfig or the default cgroup mode based on the cluster creation version.",
- "enum": [
- "EFFECTIVE_CGROUP_MODE_UNSPECIFIED",
- "EFFECTIVE_CGROUP_MODE_V1",
- "EFFECTIVE_CGROUP_MODE_V2"
- ],
- "readOnly": true,
- "type": "string",
- "x-google-enum-descriptions": [
- "EFFECTIVE_CGROUP_MODE_UNSPECIFIED means the cgroup configuration for the node pool is unspecified, i.e. the node pool is a Windows node pool.",
- "CGROUP_MODE_V1 means the node pool is configured to use cgroupv1 for the cgroup configuration.",
- "CGROUP_MODE_V2 means the node pool is configured to use cgroupv2 for the cgroup configuration."
- ]
- },
- "enableConfidentialStorage": {
- "description": "Optional. Reserved for future use.",
- "type": "boolean"
- },
- "ephemeralStorageLocalSsdConfig": {
- "$ref": "#/$defs/EphemeralStorageLocalSsdConfig",
- "description": "Parameters for the node ephemeral storage using Local SSDs. If unspecified, ephemeral storage is backed by the boot disk."
- },
- "fastSocket": {
- "$ref": "#/$defs/FastSocket",
- "description": "Enable or disable NCCL fast socket for the node pool."
- },
- "flexStart": {
- "description": "Flex Start flag for enabling Flex Start VM.",
- "type": "boolean"
- },
- "gcfsConfig": {
- "$ref": "#/$defs/GcfsConfig",
- "description": "Google Container File System (image streaming) configs."
- },
- "gpuDirectConfig": {
- "$ref": "#/$defs/GPUDirectConfig",
- "description": "The configuration for GPU Direct"
- },
- "gvnic": {
- "$ref": "#/$defs/VirtualNIC",
- "description": "Enable or disable gvnic in the node pool."
- },
- "imageType": {
- "description": "The image type to use for this node. Note that for a given image type, the latest version of it will be used. Please see https://cloud.google.com/kubernetes-engine/docs/concepts/node-images for available image types.",
- "type": "string"
- },
- "kubeletConfig": {
- "$ref": "#/$defs/NodeKubeletConfig",
- "description": "Node kubelet configs."
- },
- "labels": {
- "additionalProperties": {
- "type": "string"
- },
- "description": "The map of Kubernetes labels (key/value pairs) to be applied to each node. These will added in addition to any default label(s) that Kubernetes may apply to the node. In case of conflict in label keys, the applied set may differ depending on the Kubernetes version -- it's best to assume the behavior is undefined and conflicts should be avoided. For more information, including usage and the valid values, see: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/",
- "type": "object"
- },
- "linuxNodeConfig": {
- "$ref": "#/$defs/LinuxNodeConfig",
- "description": "Parameters that can be configured on Linux nodes."
- },
- "localNvmeSsdBlockConfig": {
- "$ref": "#/$defs/LocalNvmeSsdBlockConfig",
- "description": "Parameters for using raw-block Local NVMe SSDs."
- },
- "localSsdCount": {
- "description": "The number of local SSD disks to be attached to the node. The limit for this value is dependent upon the maximum number of disks available on a machine per zone. See: https://cloud.google.com/compute/docs/disks/local-ssd for more information.",
- "format": "int32",
- "type": "integer"
- },
- "localSsdEncryptionMode": {
- "description": "Specifies which method should be used for encrypting the Local SSDs attached to the node.",
- "enum": [
- "LOCAL_SSD_ENCRYPTION_MODE_UNSPECIFIED",
- "STANDARD_ENCRYPTION",
- "EPHEMERAL_KEY_ENCRYPTION"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "The given node will be encrypted using keys managed by Google infrastructure and the keys will be deleted when the node is deleted.",
- "The given node will be encrypted using keys managed by Google infrastructure and the keys will be deleted when the node is deleted.",
- "The given node will opt-in for using ephemeral key for encryption of Local SSDs. The Local SSDs will not be able to recover data in case of node crash."
- ]
- },
- "loggingConfig": {
- "$ref": "#/$defs/NodePoolLoggingConfig",
- "description": "Logging configuration."
- },
- "machineType": {
- "description": "The name of a Google Compute Engine [machine type](https://cloud.google.com/compute/docs/machine-types) If unspecified, the default machine type is `e2-medium`.",
- "type": "string"
- },
- "maxRunDuration": {
- "description": "The maximum duration for the nodes to exist. If unspecified, the nodes can exist indefinitely.",
- "format": "google-duration",
- "type": "string"
- },
- "metadata": {
- "additionalProperties": {
- "type": "string"
- },
- "description": "The metadata key/value pairs assigned to instances in the cluster. Keys must conform to the regexp `[a-zA-Z0-9-_]+` and be less than 128 bytes in length. These are reflected as part of a URL in the metadata server. Additionally, to avoid ambiguity, keys must not conflict with any other metadata keys for the project or be one of the reserved keys: - \"cluster-location\" - \"cluster-name\" - \"cluster-uid\" - \"configure-sh\" - \"containerd-configure-sh\" - \"enable-os-login\" - \"gci-ensure-gke-docker\" - \"gci-metrics-enabled\" - \"gci-update-strategy\" - \"instance-template\" - \"kube-env\" - \"startup-script\" - \"user-data\" - \"disable-address-manager\" - \"windows-startup-script-ps1\" - \"common-psm1\" - \"k8s-node-setup-psm1\" - \"install-ssh-psm1\" - \"user-profile-psm1\" Values are free-form strings, and only have meaning as interpreted by the image running in the instance. The only restriction placed on them is that each value's size must be less than or equal to 32 KB. The total size of all keys and values must be less than 512 KB.",
- "type": "object"
- },
- "minCpuPlatform": {
- "description": "Minimum CPU platform to be used by this instance. The instance may be scheduled on the specified or newer CPU platform. Applicable values are the friendly names of CPU platforms, such as `minCpuPlatform: \"Intel Haswell\"` or `minCpuPlatform: \"Intel Sandy Bridge\"`. For more information, read [how to specify min CPU platform](https://cloud.google.com/compute/docs/instances/specify-min-cpu-platform)",
- "type": "string"
- },
- "nodeGroup": {
- "description": "Setting this field will assign instances of this pool to run on the specified node group. This is useful for running workloads on [sole tenant nodes](https://cloud.google.com/compute/docs/nodes/sole-tenant-nodes).",
- "type": "string"
- },
- "oauthScopes": {
- "description": "The set of Google API scopes to be made available on all of the node VMs under the \"default\" service account. The following scopes are recommended, but not required, and by default are not included: * `https://www.googleapis.com/auth/compute` is required for mounting persistent storage on your nodes. * `https://www.googleapis.com/auth/devstorage.read_only` is required for communicating with **gcr.io** (the [Artifact Registry](https://cloud.google.com/artifact-registry/)). If unspecified, no scopes are added, unless Cloud Logging or Cloud Monitoring are enabled, in which case their required scopes will be added.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "preemptible": {
- "description": "Whether the nodes are created as preemptible VM instances. See: https://cloud.google.com/compute/docs/instances/preemptible for more information about preemptible VM instances.",
- "type": "boolean"
- },
- "reservationAffinity": {
- "$ref": "#/$defs/ReservationAffinity",
- "description": "The optional reservation affinity. Setting this field will apply the specified [Zonal Compute Reservation](https://cloud.google.com/compute/docs/instances/reserving-zonal-resources) to this node pool."
- },
- "resourceLabels": {
- "additionalProperties": {
- "type": "string"
- },
- "description": "The resource labels for the node pool to use to annotate any related Google Compute Engine resources.",
- "type": "object"
- },
- "resourceManagerTags": {
- "$ref": "#/$defs/ResourceManagerTags",
- "description": "A map of resource manager tag keys and values to be attached to the nodes."
- },
- "sandboxConfig": {
- "$ref": "#/$defs/SandboxConfig",
- "description": "Sandbox configuration for this node."
- },
- "secondaryBootDiskUpdateStrategy": {
- "$ref": "#/$defs/SecondaryBootDiskUpdateStrategy",
- "description": "Secondary boot disk update strategy."
- },
- "secondaryBootDisks": {
- "description": "List of secondary boot disks attached to the nodes.",
- "items": {
- "$ref": "#/$defs/SecondaryBootDisk"
- },
- "type": "array"
- },
- "serviceAccount": {
- "description": "The Google Cloud Platform Service Account to be used by the node VMs. Specify the email address of the Service Account; otherwise, if no Service Account is specified, the \"default\" service account is used.",
- "type": "string"
- },
- "shieldedInstanceConfig": {
- "$ref": "#/$defs/ShieldedInstanceConfig",
- "description": "Shielded Instance options."
- },
- "soleTenantConfig": {
- "$ref": "#/$defs/SoleTenantConfig",
- "description": "Parameters for node pools to be backed by shared sole tenant node groups."
- },
- "spot": {
- "description": "Spot flag for enabling Spot VM, which is a rebrand of the existing preemptible flag.",
- "type": "boolean"
- },
- "storagePools": {
- "description": "List of Storage Pools where boot disks are provisioned.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "tags": {
- "description": "The list of instance tags applied to all nodes. Tags are used to identify valid sources or targets for network firewalls and are specified by the client during cluster or node pool creation. Each tag within the list must comply with RFC1035.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "taintConfig": {
- "$ref": "#/$defs/TaintConfig",
- "description": "Optional. The taint configuration for the node pool."
- },
- "taints": {
- "description": "List of kubernetes taints to be applied to each node. For more information, including usage and the valid values, see: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/",
- "items": {
- "$ref": "#/$defs/NodeTaint"
- },
- "type": "array"
- },
- "windowsNodeConfig": {
- "$ref": "#/$defs/WindowsNodeConfig",
- "description": "Parameters that can be configured on Windows nodes."
- },
- "workloadMetadataConfig": {
- "$ref": "#/$defs/WorkloadMetadataConfig",
- "description": "The workload metadata configuration for this node."
- }
- },
- "type": "object"
- },
- "NodeConfigDefaults": {
- "description": "Subset of NodeConfig message that has defaults.",
- "properties": {
- "containerdConfig": {
- "$ref": "#/$defs/ContainerdConfig",
- "description": "Parameters for containerd customization."
- },
- "gcfsConfig": {
- "$ref": "#/$defs/GcfsConfig",
- "description": "GCFS (Google Container File System, also known as Riptide) options."
- },
- "loggingConfig": {
- "$ref": "#/$defs/NodePoolLoggingConfig",
- "description": "Logging configuration for node pools."
- },
- "nodeKubeletConfig": {
- "$ref": "#/$defs/NodeKubeletConfig",
- "description": "NodeKubeletConfig controls the defaults for new node-pools. Currently only `insecure_kubelet_readonly_port_enabled` can be set here."
- }
- },
- "type": "object"
- },
- "NodeDrainConfig": {
- "description": "NodeDrainConfig contains the node drain related configurations for this nodepool.",
- "properties": {
- "respectPdbDuringNodePoolDeletion": {
- "description": "Whether to respect PDB during node pool deletion.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "NodeKernelModuleLoading": {
- "description": "Configuration for kernel module loading on nodes.",
- "properties": {
- "policy": {
- "description": "Set the node module loading policy for nodes in the node pool.",
- "enum": [
- "POLICY_UNSPECIFIED",
- "ENFORCE_SIGNED_MODULES",
- "DO_NOT_ENFORCE_SIGNED_MODULES"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default behavior. GKE selects the image based on node type. For CPU and TPU nodes, the image will not allow loading external kernel modules. For GPU nodes, the image will allow loading any module, whether it is signed or not.",
- "Enforced signature verification: Node pools will use a Container-Optimized OS image configured to allow loading of *Google-signed* external kernel modules. Loadpin is enabled but configured to exclude modules, and kernel module signature checking is enforced.",
- "Mirrors existing DEFAULT behavior: For CPU and TPU nodes, the image will not allow loading external kernel modules. For GPU nodes, the image will allow loading any module, whether it is signed or not."
- ]
- }
- },
- "type": "object"
- },
- "NodeKubeletConfig": {
- "description": "Node kubelet configs.",
- "properties": {
- "allowedUnsafeSysctls": {
- "description": "Optional. Defines a comma-separated allowlist of unsafe sysctls or sysctl patterns (ending in `*`). The unsafe namespaced sysctl groups are `kernel.shm*`, `kernel.msg*`, `kernel.sem`, `fs.mqueue.*`, and `net.*`. Leaving this allowlist empty means they cannot be set on Pods. To allow certain sysctls or sysctl patterns to be set on Pods, list them separated by commas. For example: `kernel.msg*,net.ipv4.route.min_pmtu`. See https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ for more details.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "containerLogMaxFiles": {
- "description": "Optional. Defines the maximum number of container log files that can be present for a container. See https://kubernetes.io/docs/concepts/cluster-administration/logging/#log-rotation The value must be an integer between 2 and 10, inclusive. The default value is 5 if unspecified.",
- "format": "int32",
- "type": "integer"
- },
- "containerLogMaxSize": {
- "description": "Optional. Defines the maximum size of the container log file before it is rotated. See https://kubernetes.io/docs/concepts/cluster-administration/logging/#log-rotation Valid format is positive number + unit, e.g. 100Ki, 10Mi. Valid units are Ki, Mi, Gi. The value must be between 10Mi and 500Mi, inclusive. Note that the total container log size (container_log_max_size * container_log_max_files) cannot exceed 1% of the total storage of the node, to avoid disk pressure caused by log files. The default value is 10Mi if unspecified.",
- "type": "string"
- },
- "cpuCfsQuota": {
- "description": "Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.",
- "type": "boolean"
- },
- "cpuCfsQuotaPeriod": {
- "description": "Set the CPU CFS quota period value 'cpu.cfs_period_us'. The string must be a sequence of decimal numbers, each with optional fraction and a unit suffix, such as \"300ms\". Valid time units are \"ns\", \"us\" (or \"µs\"), \"ms\", \"s\", \"m\", \"h\". The value must be a positive duration between 1ms and 1 second, inclusive.",
- "type": "string"
- },
- "cpuManagerPolicy": {
- "description": "Control the CPU management policy on the node. See https://kubernetes.io/docs/tasks/administer-cluster/cpu-management-policies/ The following values are allowed. * \"none\": the default, which represents the existing scheduling behavior. * \"static\": allows pods with certain resource characteristics to be granted increased CPU affinity and exclusivity on the node. The default value is 'none' if unspecified.",
- "type": "string"
- },
- "crashLoopBackOff": {
- "$ref": "#/$defs/CrashLoopBackOffConfig",
- "description": "Optional. Contains configuration options to modify node-level parameters for container restart behavior."
- },
- "evictionMaxPodGracePeriodSeconds": {
- "description": "Optional. eviction_max_pod_grace_period_seconds is the maximum allowed grace period (in seconds) to use when terminating pods in response to a soft eviction threshold being met. This value effectively caps the Pod's terminationGracePeriodSeconds value during soft evictions. Default: 0. Range: [0, 300].",
- "format": "int32",
- "type": "integer"
- },
- "evictionMinimumReclaim": {
- "$ref": "#/$defs/EvictionMinimumReclaim",
- "description": "Optional. eviction_minimum_reclaim is a map of signal names to quantities that defines minimum reclaims, which describe the minimum amount of a given resource the kubelet will reclaim when performing a pod eviction while that resource is under pressure."
- },
- "evictionSoft": {
- "$ref": "#/$defs/EvictionSignals",
- "description": "Optional. eviction_soft is a map of signal names to quantities that defines soft eviction thresholds. Each signal is compared to its corresponding threshold to determine if a pod eviction should occur."
- },
- "evictionSoftGracePeriod": {
- "$ref": "#/$defs/EvictionGracePeriod",
- "description": "Optional. eviction_soft_grace_period is a map of signal names to quantities that defines grace periods for each soft eviction signal. The grace period is the amount of time that a pod must be under pressure before an eviction occurs."
- },
- "imageGcHighThresholdPercent": {
- "description": "Optional. Defines the percent of disk usage after which image garbage collection is always run. The percent is calculated as this field value out of 100. The value must be between 10 and 85, inclusive and greater than image_gc_low_threshold_percent. The default value is 85 if unspecified.",
- "format": "int32",
- "type": "integer"
- },
- "imageGcLowThresholdPercent": {
- "description": "Optional. Defines the percent of disk usage before which image garbage collection is never run. Lowest disk usage to garbage collect to. The percent is calculated as this field value out of 100. The value must be between 10 and 85, inclusive and smaller than image_gc_high_threshold_percent. The default value is 80 if unspecified.",
- "format": "int32",
- "type": "integer"
- },
- "imageMaximumGcAge": {
- "description": "Optional. Defines the maximum age an image can be unused before it is garbage collected. The string must be a sequence of decimal numbers, each with optional fraction and a unit suffix, such as \"300s\", \"1.5h\", and \"2h45m\". Valid time units are \"ns\", \"us\" (or \"µs\"), \"ms\", \"s\", \"m\", \"h\". The value must be a positive duration greater than image_minimum_gc_age or \"0s\". The default value is \"0s\" if unspecified, which disables this field, meaning images won't be garbage collected based on being unused for too long.",
- "type": "string"
- },
- "imageMinimumGcAge": {
- "description": "Optional. Defines the minimum age for an unused image before it is garbage collected. The string must be a sequence of decimal numbers, each with optional fraction and a unit suffix, such as \"300s\", \"1.5h\", and \"2h45m\". Valid time units are \"ns\", \"us\" (or \"µs\"), \"ms\", \"s\", \"m\", \"h\". The value must be a positive duration less than or equal to 2 minutes. The default value is \"2m0s\" if unspecified.",
- "type": "string"
- },
- "insecureKubeletReadonlyPortEnabled": {
- "description": "Enable or disable Kubelet read only port.",
- "type": "boolean"
- },
- "maxParallelImagePulls": {
- "description": "Optional. Defines the maximum number of image pulls in parallel. The range is 2 to 5, inclusive. The default value is 2 or 3 depending on the disk type. See https://kubernetes.io/docs/concepts/containers/images/#maximum-parallel-image-pulls for more details.",
- "format": "int32",
- "type": "integer"
- },
- "memoryManager": {
- "$ref": "#/$defs/MemoryManager",
- "description": "Optional. Controls NUMA-aware Memory Manager configuration on the node. For more information, see: https://kubernetes.io/docs/tasks/administer-cluster/memory-manager/"
- },
- "podPidsLimit": {
- "description": "Set the Pod PID limits. See https://kubernetes.io/docs/concepts/policy/pid-limiting/#pod-pid-limits Controls the maximum number of processes allowed to run in a pod. The value must be greater than or equal to 1024 and less than 4194304.",
- "format": "int64",
- "type": "string"
- },
- "shutdownGracePeriodCriticalPodsSeconds": {
- "description": "Optional. shutdown_grace_period_critical_pods_seconds is the maximum allowed grace period (in seconds) used to terminate critical pods during a node shutdown. This value should be <= shutdown_grace_period_seconds, and is only valid if shutdown_grace_period_seconds is set. https://kubernetes.io/docs/concepts/cluster-administration/node-shutdown/ Range: [0, 120].",
- "format": "int32",
- "type": "integer"
- },
- "shutdownGracePeriodSeconds": {
- "description": "Optional. shutdown_grace_period_seconds is the maximum allowed grace period (in seconds) the total duration that the node should delay the shutdown during a graceful shutdown. This is the total grace period for pod termination for both regular and critical pods. https://kubernetes.io/docs/concepts/cluster-administration/node-shutdown/ If set to 0, node will not enable the graceful node shutdown functionality. This field is only valid for Spot VMs. Allowed values: 0, 30, 120.",
- "format": "int32",
- "type": "integer"
- },
- "singleProcessOomKill": {
- "description": "Optional. Defines whether to enable single process OOM killer. If true, will prevent the memory.oom.group flag from being set for container cgroups in cgroups v2. This causes processes in the container to be OOM killed individually instead of as a group.",
- "type": "boolean"
- },
- "topologyManager": {
- "$ref": "#/$defs/TopologyManager",
- "description": "Optional. Controls Topology Manager configuration on the node. For more information, see: https://kubernetes.io/docs/tasks/administer-cluster/topology-manager/"
- }
- },
- "type": "object"
- },
- "NodeManagement": {
- "description": "NodeManagement defines the set of node management services turned on for the node pool.",
- "properties": {
- "autoRepair": {
- "description": "A flag that specifies whether the node auto-repair is enabled for the node pool. If enabled, the nodes in this node pool will be monitored and, if they fail health checks too many times, an automatic repair action will be triggered.",
- "type": "boolean"
- },
- "autoUpgrade": {
- "description": "A flag that specifies whether node auto-upgrade is enabled for the node pool. If enabled, node auto-upgrade helps keep the nodes in your node pool up to date with the latest release version of Kubernetes.",
- "type": "boolean"
- },
- "upgradeOptions": {
- "$ref": "#/$defs/AutoUpgradeOptions",
- "description": "Specifies the Auto Upgrade knobs for the node pool."
- }
- },
- "type": "object"
- },
- "NodeNetworkConfig": {
- "description": "Parameters for node pool-level network config.",
- "properties": {
- "additionalNodeNetworkConfigs": {
- "description": "We specify the additional node networks for this node pool using this list. Each node network corresponds to an additional interface",
- "items": {
- "$ref": "#/$defs/AdditionalNodeNetworkConfig"
- },
- "type": "array"
- },
- "additionalPodNetworkConfigs": {
- "description": "We specify the additional pod networks for this node pool using this list. Each pod network corresponds to an additional alias IP range for the node",
- "items": {
- "$ref": "#/$defs/AdditionalPodNetworkConfig"
- },
- "type": "array"
- },
- "createPodRange": {
- "description": "Input only. Whether to create a new range for pod IPs in this node pool. Defaults are provided for `pod_range` and `pod_ipv4_cidr_block` if they are not specified. If neither `create_pod_range` or `pod_range` are specified, the cluster-level default (`ip_allocation_policy.cluster_ipv4_cidr_block`) is used. Only applicable if `ip_allocation_policy.use_ip_aliases` is true. This field cannot be changed after the node pool has been created.",
- "type": "boolean",
- "writeOnly": true
- },
- "enablePrivateNodes": {
- "description": "Whether nodes have internal IP addresses only. If enable_private_nodes is not specified, then the value is derived from Cluster.NetworkConfig.default_enable_private_nodes",
- "type": "boolean"
- },
- "networkPerformanceConfig": {
- "$ref": "#/$defs/NetworkPerformanceConfig",
- "description": "Network bandwidth tier configuration."
- },
- "networkTierConfig": {
- "$ref": "#/$defs/NetworkTierConfig",
- "description": "Output only. The network tier configuration for the node pool inherits from the cluster-level configuration and remains immutable throughout the node pool's lifecycle, including during upgrades.",
- "readOnly": true
- },
- "podCidrOverprovisionConfig": {
- "$ref": "#/$defs/PodCIDROverprovisionConfig",
- "description": "[PRIVATE FIELD] Pod CIDR size overprovisioning config for the nodepool. Pod CIDR size per node depends on max_pods_per_node. By default, the value of max_pods_per_node is rounded off to next power of 2 and we then double that to get the size of pod CIDR block per node. Example: max_pods_per_node of 30 would result in 64 IPs (/26). This config can disable the doubling of IPs (we still round off to next power of 2) Example: max_pods_per_node of 30 will result in 32 IPs (/27) when overprovisioning is disabled."
- },
- "podIpv4CidrBlock": {
- "description": "The IP address range for pod IPs in this node pool. Only applicable if `create_pod_range` is true. Set to blank to have a range chosen with the default size. Set to /netmask (e.g. `/14`) to have a range chosen with a specific netmask. Set to a [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) to pick a specific range to use. Only applicable if `ip_allocation_policy.use_ip_aliases` is true. This field cannot be changed after the node pool has been created.",
- "type": "string"
- },
- "podIpv4RangeUtilization": {
- "description": "Output only. The utilization of the IPv4 range for the pod. The ratio is Usage/[Total number of IPs in the secondary range], Usage=numNodes*numZones*podIPsPerNode.",
- "format": "double",
- "readOnly": true,
- "type": "number"
- },
- "podRange": {
- "description": "The ID of the secondary range for pod IPs. If `create_pod_range` is true, this ID is used for the new range. If `create_pod_range` is false, uses an existing secondary range with this ID. Only applicable if `ip_allocation_policy.use_ip_aliases` is true. This field cannot be changed after the node pool has been created.",
- "type": "string"
- },
- "subnetwork": {
- "description": "Optional. The subnetwork name/path for the node pool. Format: projects/{project}/regions/{region}/subnetworks/{subnetwork} If the cluster is associated with multiple subnetworks, the subnetwork can be either: - A user supplied subnetwork name during node pool creation (e.g., `my-subnet`). The name must be between 1 and 63 characters long, start with a letter, contain only letters, numbers, and hyphens, and end with a letter or a number. - A full subnetwork path during node pool creation, such as `projects/gke-project/regions/us-central1/subnetworks/my-subnet` - A subnetwork path picked based on the IP utilization during node pool creation and is immutable.",
- "type": "string"
- }
- },
- "type": "object"
- },
- "NodePool": {
- "description": "NodePool contains the name and configuration for a cluster's node pool. Node pools are a set of nodes (i.e. VM's), with a common configuration and specification, under the control of the cluster master. They may have a set of Kubernetes labels applied to them, which may be used to reference them during pod scheduling. They may also be resized up or down, to accommodate the workload.",
- "properties": {
- "autopilotConfig": {
- "$ref": "#/$defs/AutopilotConfig",
- "description": "Specifies the autopilot configuration for this node pool. This field is exclusively reserved for Cluster Autoscaler."
- },
- "autoscaling": {
- "$ref": "#/$defs/NodePoolAutoscaling",
- "description": "Autoscaler configuration for this NodePool. Autoscaler is enabled only if a valid configuration is present."
- },
- "bestEffortProvisioning": {
- "$ref": "#/$defs/BestEffortProvisioning",
- "description": "Enable best effort provisioning for nodes"
- },
- "conditions": {
- "description": "Which conditions caused the current node pool state.",
- "items": {
- "$ref": "#/$defs/StatusCondition"
- },
- "type": "array"
- },
- "config": {
- "$ref": "#/$defs/NodeConfig",
- "description": "The node configuration of the pool."
- },
- "etag": {
- "description": "This checksum is computed by the server based on the value of node pool fields, and may be sent on update requests to ensure the client has an up-to-date value before proceeding.",
- "type": "string"
- },
- "initialNodeCount": {
- "description": "The initial node count for the pool. You must ensure that your Compute Engine [resource quota](https://cloud.google.com/compute/quotas) is sufficient for this number of instances. You must also have available firewall and routes quota.",
- "format": "int32",
- "type": "integer"
- },
- "instanceGroupUrls": {
- "description": "Output only. The resource URLs of the [managed instance groups](https://cloud.google.com/compute/docs/instance-groups/creating-groups-of-managed-instances) associated with this node pool. During the node pool blue-green upgrade operation, the URLs contain both blue and green resources.",
- "items": {
- "type": "string"
- },
- "readOnly": true,
- "type": "array"
- },
- "locations": {
- "description": "The list of Google Compute Engine [zones](https://cloud.google.com/compute/docs/zones#available) in which the NodePool's nodes should be located. If this value is unspecified during node pool creation, the [Cluster.Locations](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1/projects.locations.clusters#Cluster.FIELDS.locations) value will be used, instead. Warning: changing node pool locations will result in nodes being added and/or removed.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "management": {
- "$ref": "#/$defs/NodeManagement",
- "description": "NodeManagement configuration for this NodePool."
- },
- "maxPodsConstraint": {
- "$ref": "#/$defs/MaxPodsConstraint",
- "description": "The constraint on the maximum number of pods that can be run simultaneously on a node in the node pool."
- },
- "name": {
- "description": "The name of the node pool.",
- "type": "string"
- },
- "networkConfig": {
- "$ref": "#/$defs/NodeNetworkConfig",
- "description": "Networking configuration for this NodePool. If specified, it overrides the cluster-level defaults."
- },
- "nodeDrainConfig": {
- "$ref": "#/$defs/NodeDrainConfig",
- "description": "Specifies the node drain configuration for this node pool."
- },
- "placementPolicy": {
- "$ref": "#/$defs/PlacementPolicy",
- "description": "Specifies the node placement policy."
- },
- "podIpv4CidrSize": {
- "description": "Output only. The pod CIDR block size per node in this node pool.",
- "format": "int32",
- "readOnly": true,
- "type": "integer"
- },
- "queuedProvisioning": {
- "$ref": "#/$defs/QueuedProvisioning",
- "description": "Specifies the configuration of queued provisioning."
- },
- "selfLink": {
- "description": "Output only. Server-defined URL for the resource.",
- "readOnly": true,
- "type": "string"
- },
- "status": {
- "description": "Output only. The status of the nodes in this pool instance.",
- "enum": [
- "STATUS_UNSPECIFIED",
- "PROVISIONING",
- "RUNNING",
- "RUNNING_WITH_ERROR",
- "RECONCILING",
- "STOPPING",
- "ERROR"
- ],
- "readOnly": true,
- "type": "string",
- "x-google-enum-descriptions": [
- "Not set.",
- "The PROVISIONING state indicates the node pool is being created.",
- "The RUNNING state indicates the node pool has been created and is fully usable.",
- "The RUNNING_WITH_ERROR state indicates the node pool has been created and is partially usable. Some error state has occurred and some functionality may be impaired. Customer may need to reissue a request or trigger a new update.",
- "The RECONCILING state indicates that some work is actively being done on the node pool, such as upgrading node software. Details can be found in the `statusMessage` field.",
- "The STOPPING state indicates the node pool is being deleted.",
- "The ERROR state indicates the node pool may be unusable. Details can be found in the `statusMessage` field."
- ]
- },
- "statusMessage": {
- "deprecated": true,
- "description": "Output only. Deprecated. Use conditions instead. Additional information about the current status of this node pool instance, if available.",
- "readOnly": true,
- "type": "string"
- },
- "updateInfo": {
- "$ref": "#/$defs/UpdateInfo",
- "description": "Output only. Update info contains relevant information during a node pool update.",
- "readOnly": true
- },
- "upgradeSettings": {
- "$ref": "#/$defs/UpgradeSettings",
- "description": "Upgrade settings control disruption and speed of the upgrade."
- },
- "version": {
- "description": "The version of Kubernetes running on this NodePool's nodes. If unspecified, it defaults as described [here](https://cloud.google.com/kubernetes-engine/versioning#specifying_node_version).",
- "type": "string"
- }
- },
- "type": "object"
- },
- "NodePoolAutoConfig": {
- "description": "Node pool configs that apply to all auto-provisioned node pools in autopilot clusters and node auto-provisioning enabled clusters.",
- "properties": {
- "linuxNodeConfig": {
- "$ref": "#/$defs/LinuxNodeConfig",
- "description": "Output only. Configuration options for Linux nodes.",
- "readOnly": true
- },
- "networkTags": {
- "$ref": "#/$defs/NetworkTags",
- "description": "The list of instance tags applied to all nodes. Tags are used to identify valid sources or targets for network firewalls and are specified by the client during cluster creation. Each tag within the list must comply with RFC1035."
- },
- "nodeKubeletConfig": {
- "$ref": "#/$defs/NodeKubeletConfig",
- "description": "NodeKubeletConfig controls the defaults for autoprovisioned node-pools. Currently only `insecure_kubelet_readonly_port_enabled` can be set here."
- },
- "resourceManagerTags": {
- "$ref": "#/$defs/ResourceManagerTags",
- "description": "Resource manager tag keys and values to be attached to the nodes for managing Compute Engine firewalls using Network Firewall Policies."
- }
- },
- "type": "object"
- },
- "NodePoolAutoscaling": {
- "description": "NodePoolAutoscaling contains information required by cluster autoscaler to adjust the size of the node pool to the current cluster usage.",
- "properties": {
- "autoprovisioned": {
- "description": "Can this node pool be deleted automatically.",
- "type": "boolean"
- },
- "enabled": {
- "description": "Is autoscaling enabled for this node pool.",
- "type": "boolean"
- },
- "locationPolicy": {
- "description": "Location policy used when scaling up a nodepool.",
- "enum": [
- "LOCATION_POLICY_UNSPECIFIED",
- "BALANCED",
- "ANY"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Not set.",
- "BALANCED is a best effort policy that aims to balance the sizes of different zones.",
- "ANY policy picks zones that have the highest capacity available."
- ]
- },
- "maxNodeCount": {
- "description": "Maximum number of nodes for one location in the node pool. Must be >= min_node_count. There has to be enough quota to scale up the cluster.",
- "format": "int32",
- "type": "integer"
- },
- "minNodeCount": {
- "description": "Minimum number of nodes for one location in the node pool. Must be greater than or equal to 0 and less than or equal to max_node_count.",
- "format": "int32",
- "type": "integer"
- },
- "totalMaxNodeCount": {
- "description": "Maximum number of nodes in the node pool. Must be greater than or equal to total_min_node_count. There has to be enough quota to scale up the cluster. The total_*_node_count fields are mutually exclusive with the *_node_count fields.",
- "format": "int32",
- "type": "integer"
- },
- "totalMinNodeCount": {
- "description": "Minimum number of nodes in the node pool. Must be greater than or equal to 0 and less than or equal to total_max_node_count. The total_*_node_count fields are mutually exclusive with the *_node_count fields.",
- "format": "int32",
- "type": "integer"
- }
- },
- "type": "object"
- },
- "NodePoolDefaults": {
- "description": "Subset of Nodepool message that has defaults.",
- "properties": {
- "nodeConfigDefaults": {
- "$ref": "#/$defs/NodeConfigDefaults",
- "description": "Subset of NodeConfig message that has defaults."
- }
- },
- "type": "object"
- },
- "NodePoolLoggingConfig": {
- "description": "NodePoolLoggingConfig specifies logging configuration for nodepools.",
- "properties": {
- "variantConfig": {
- "$ref": "#/$defs/LoggingVariantConfig",
- "description": "Logging variant configuration."
- }
- },
- "type": "object"
- },
- "NodeTaint": {
- "description": "Kubernetes taint is composed of three fields: key, value, and effect. Effect can only be one of three types: NoSchedule, PreferNoSchedule or NoExecute. See [here](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration) for more information, including usage and the valid values.",
- "properties": {
- "effect": {
- "description": "Effect for taint.",
- "enum": [
- "EFFECT_UNSPECIFIED",
- "NO_SCHEDULE",
- "PREFER_NO_SCHEDULE",
- "NO_EXECUTE"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Not set",
- "NoSchedule",
- "PreferNoSchedule",
- "NoExecute"
- ]
- },
- "key": {
- "description": "Key for taint.",
- "type": "string"
- },
- "value": {
- "description": "Value for taint.",
- "type": "string"
- }
- },
- "type": "object"
- },
- "NotificationConfig": {
- "description": "NotificationConfig is the configuration of notifications.",
- "properties": {
- "pubsub": {
- "$ref": "#/$defs/PubSub",
- "description": "Notification config for Pub/Sub."
- }
- },
- "type": "object"
- },
- "OperationError": {
- "description": "OperationError records errors seen from CloudKMS keys encountered during updates to DatabaseEncryption configuration.",
- "properties": {
- "errorMessage": {
- "description": "Description of the error seen during the operation.",
- "type": "string"
- },
- "keyName": {
- "description": "CloudKMS key resource that had the error.",
- "type": "string"
- },
- "timestamp": {
- "description": "Time when the CloudKMS error was seen.",
- "format": "date-time",
- "type": "string"
- }
- },
- "type": "object"
- },
- "ParallelstoreCsiDriverConfig": {
- "description": "Configuration for the Cloud Storage Parallelstore CSI driver.",
- "properties": {
- "enabled": {
- "description": "Whether the Cloud Storage Parallelstore CSI driver is enabled for this cluster.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "ParentProductConfig": {
- "description": "ParentProductConfig is the configuration of the parent product of the cluster. This field is used by Google internal products that are built on top of a GKE cluster and take the ownership of the cluster.",
- "properties": {
- "labels": {
- "additionalProperties": {
- "type": "string"
- },
- "description": "Labels contain the configuration of the parent product.",
- "type": "object"
- },
- "productName": {
- "description": "Name of the parent product associated with the cluster.",
- "type": "string"
- }
- },
- "type": "object"
- },
- "PlacementPolicy": {
- "description": "PlacementPolicy defines the placement policy used by the node pool.",
- "properties": {
- "policyName": {
- "description": "If set, refers to the name of a custom resource policy supplied by the user. The resource policy must be in the same project and region as the node pool. If not found, InvalidArgument error is returned.",
- "type": "string"
- },
- "tpuTopology": {
- "description": "Optional. TPU placement topology for pod slice node pool. https://cloud.google.com/tpu/docs/types-topologies#tpu_topologies",
- "type": "string"
- },
- "type": {
- "description": "The type of placement.",
- "enum": [
- "TYPE_UNSPECIFIED",
- "COMPACT"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "TYPE_UNSPECIFIED specifies no requirements on nodes placement.",
- "COMPACT specifies node placement in the same availability domain to ensure low communication latency."
- ]
- }
- },
- "type": "object"
- },
- "PodAutoscaling": {
- "description": "PodAutoscaling is used for configuration of parameters for workload autoscaling.",
- "properties": {
- "hpaProfile": {
- "description": "Selected Horizontal Pod Autoscaling profile.",
- "enum": [
- "HPA_PROFILE_UNSPECIFIED",
- "NONE",
- "PERFORMANCE"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "HPA_PROFILE_UNSPECIFIED is used when no custom HPA profile is set.",
- "Customers explicitly opt-out of HPA profiles.",
- "PERFORMANCE is used when customers opt-in to the performance HPA profile. In this profile we support a higher number of HPAs per cluster and faster metrics collection for workload autoscaling."
- ]
- }
- },
- "type": "object"
- },
- "PodCIDROverprovisionConfig": {
- "description": "[PRIVATE FIELD] Config for pod CIDR size overprovisioning.",
- "properties": {
- "disable": {
- "description": "Whether Pod CIDR overprovisioning is disabled. Note: Pod CIDR overprovisioning is enabled by default.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "PrivateClusterConfig": {
- "description": "Configuration options for private clusters.",
- "properties": {
- "enablePrivateEndpoint": {
- "deprecated": true,
- "description": "Whether the master's internal IP address is used as the cluster endpoint. Deprecated: Use ControlPlaneEndpointsConfig.IPEndpointsConfig.enable_public_endpoint instead. Note that the value of enable_public_endpoint is reversed: if enable_private_endpoint is false, then enable_public_endpoint will be true.",
- "type": "boolean"
- },
- "enablePrivateNodes": {
- "deprecated": true,
- "description": "Whether nodes have internal IP addresses only. If enabled, all nodes are given only RFC 1918 private addresses and communicate with the master via private networking. Deprecated: Use NetworkConfig.default_enable_private_nodes instead.",
- "type": "boolean"
- },
- "masterGlobalAccessConfig": {
- "$ref": "#/$defs/PrivateClusterMasterGlobalAccessConfig",
- "deprecated": true,
- "description": "Controls master global access settings. Deprecated: Use ControlPlaneEndpointsConfig.IPEndpointsConfig.enable_global_access instead."
- },
- "masterIpv4CidrBlock": {
- "description": "The IP range in CIDR notation to use for the hosted master network. This range will be used for assigning internal IP addresses to the master or set of masters, as well as the ILB VIP. This range must not overlap with any other ranges in use within the cluster's network.",
- "type": "string"
- },
- "peeringName": {
- "description": "Output only. The peering name in the customer VPC used by this cluster.",
- "readOnly": true,
- "type": "string"
- },
- "privateEndpoint": {
- "deprecated": true,
- "description": "Output only. The internal IP address of this cluster's master endpoint. Deprecated: Use ControlPlaneEndpointsConfig.IPEndpointsConfig.private_endpoint instead.",
- "readOnly": true,
- "type": "string"
- },
- "privateEndpointSubnetwork": {
- "deprecated": true,
- "description": "Subnet to provision the master's private endpoint during cluster creation. Specified in projects/*/regions/*/subnetworks/* format. Deprecated: Use ControlPlaneEndpointsConfig.IPEndpointsConfig.private_endpoint_subnetwork instead.",
- "type": "string"
- },
- "publicEndpoint": {
- "deprecated": true,
- "description": "Output only. The external IP address of this cluster's master endpoint. Deprecated:Use ControlPlaneEndpointsConfig.IPEndpointsConfig.public_endpoint instead.",
- "readOnly": true,
- "type": "string"
- }
- },
- "type": "object"
- },
- "PrivateClusterMasterGlobalAccessConfig": {
- "description": "Configuration for controlling master global access settings.",
- "properties": {
- "enabled": {
- "description": "Whenever master is accessible globally or not.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "PrivateRegistryAccessConfig": {
- "description": "PrivateRegistryAccessConfig contains access configuration for private container registries.",
- "properties": {
- "certificateAuthorityDomainConfig": {
- "description": "Private registry access configuration.",
- "items": {
- "$ref": "#/$defs/CertificateAuthorityDomainConfig"
- },
- "type": "array"
- },
- "enabled": {
- "description": "Private registry access is enabled.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "PrivilegedAdmissionConfig": {
- "description": "PrivilegedAdmissionConfig stores the list of authorized allowlist paths for the cluster.",
- "properties": {
- "allowlistPaths": {
- "description": "The customer allowlist Cloud Storage paths for the cluster. These paths are used with the `--autopilot-privileged-admission` flag to authorize privileged workloads in Autopilot clusters. Paths can be GKE-owned, in the format `gke:////`, or customer-owned, in the format `gs:///`. Wildcards (`*`) are supported to authorize all allowlists under specific paths or directories. Example: `gs://my-bucket/*` will authorize all allowlists under the `my-bucket` bucket.",
- "items": {
- "type": "string"
- },
- "type": "array"
- }
- },
- "type": "object"
- },
- "PubSub": {
- "description": "Pub/Sub specific notification config.",
- "properties": {
- "enabled": {
- "description": "Enable notifications for Pub/Sub.",
- "type": "boolean"
- },
- "filter": {
- "$ref": "#/$defs/Filter",
- "description": "Allows filtering to one or more specific event types. If no filter is specified, or if a filter is specified with no event types, all event types will be sent"
- },
- "topic": {
- "description": "The desired Pub/Sub topic to which notifications will be sent by GKE. Format is `projects/{project}/topics/{topic}`.",
- "type": "string"
- }
- },
- "type": "object"
- },
- "QueuedProvisioning": {
- "description": "QueuedProvisioning defines the queued provisioning used by the node pool.",
- "properties": {
- "enabled": {
- "description": "Denotes that this nodepool is QRM specific, meaning nodes can be only obtained through queuing via the Cluster Autoscaler ProvisioningRequest API.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "RBACBindingConfig": {
- "description": "RBACBindingConfig allows user to restrict ClusterRoleBindings an RoleBindings that can be created.",
- "properties": {
- "enableInsecureBindingSystemAuthenticated": {
- "description": "Setting this to true will allow any ClusterRoleBinding and RoleBinding with subjects system:authenticated.",
- "type": "boolean"
- },
- "enableInsecureBindingSystemUnauthenticated": {
- "description": "Setting this to true will allow any ClusterRoleBinding and RoleBinding with subjets system:anonymous or system:unauthenticated.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "RangeInfo": {
- "description": "RangeInfo contains the range name and the range utilization by this cluster.",
- "properties": {
- "rangeName": {
- "description": "Output only. Name of a range.",
- "readOnly": true,
- "type": "string"
- },
- "utilization": {
- "description": "Output only. The utilization of the range.",
- "format": "double",
- "readOnly": true,
- "type": "number"
- }
- },
- "type": "object"
- },
- "RayClusterLoggingConfig": {
- "description": "RayClusterLoggingConfig specifies configuration of Ray logging.",
- "properties": {
- "enabled": {
- "description": "Enable log collection for Ray clusters.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "RayClusterMonitoringConfig": {
- "description": "RayClusterMonitoringConfig specifies monitoring configuration for Ray clusters.",
- "properties": {
- "enabled": {
- "description": "Enable metrics collection for Ray clusters.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "RayOperatorConfig": {
- "description": "Configuration options for the Ray Operator add-on.",
- "properties": {
- "enabled": {
- "description": "Whether the Ray Operator addon is enabled for this cluster.",
- "type": "boolean"
- },
- "rayClusterLoggingConfig": {
- "$ref": "#/$defs/RayClusterLoggingConfig",
- "description": "Optional. Logging configuration for Ray clusters."
- },
- "rayClusterMonitoringConfig": {
- "$ref": "#/$defs/RayClusterMonitoringConfig",
- "description": "Optional. Monitoring configuration for Ray clusters."
- }
- },
- "type": "object"
- },
- "RecurringTimeWindow": {
- "description": "Represents an arbitrary window of time that recurs.",
- "properties": {
- "recurrence": {
- "description": "An RRULE (https://tools.ietf.org/html/rfc5545#section-3.8.5.3) for how this window recurs. They go on for the span of time between the start and end time. For example, to have something repeat every weekday, you'd use: `FREQ=WEEKLY;BYDAY=MO,TU,WE,TH,FR` To repeat some window daily (equivalent to the DailyMaintenanceWindow): `FREQ=DAILY` For the first weekend of every month: `FREQ=MONTHLY;BYSETPOS=1;BYDAY=SA,SU` This specifies how frequently the window starts. Eg, if you wanted to have a 9-5 UTC-4 window every weekday, you'd use something like: ``` start time = 2019-01-01T09:00:00-0400 end time = 2019-01-01T17:00:00-0400 recurrence = FREQ=WEEKLY;BYDAY=MO,TU,WE,TH,FR ``` Windows can span multiple days. Eg, to make the window encompass every weekend from midnight Saturday till the last minute of Sunday UTC: ``` start time = 2019-01-05T00:00:00Z end time = 2019-01-07T23:59:00Z recurrence = FREQ=WEEKLY;BYDAY=SA ``` Note the start and end time's specific dates are largely arbitrary except to specify duration of the window and when it first starts. The FREQ values of HOURLY, MINUTELY, and SECONDLY are not supported.",
- "type": "string"
- },
- "window": {
- "$ref": "#/$defs/TimeWindow",
- "description": "The window of the first recurrence."
- }
- },
- "type": "object"
- },
- "RegistryHeader": {
- "description": "RegistryHeader configures headers for the registry.",
- "properties": {
- "key": {
- "description": "Key configures the header key.",
- "type": "string"
- },
- "value": {
- "description": "Value configures the header value.",
- "items": {
- "type": "string"
- },
- "type": "array"
- }
- },
- "type": "object"
- },
- "RegistryHostConfig": {
- "description": "RegistryHostConfig configures the top-level structure for a single containerd registry server's configuration, which represents one hosts.toml file on the node. It will override the same fqdns in PrivateRegistryAccessConfig.",
- "properties": {
- "hosts": {
- "description": "HostConfig configures a list of host-specific configurations for the server. Each server can have at most 10 host configurations.",
- "items": {
- "$ref": "#/$defs/HostConfig"
- },
- "type": "array"
- },
- "server": {
- "description": "Defines the host name of the registry server, which will be used to create configuration file as /etc/containerd/hosts.d//hosts.toml. It supports fully qualified domain names (FQDN) and IP addresses: Specifying port is supported. Wildcards are NOT supported. Examples: - my.customdomain.com - 10.0.1.2:5000",
- "type": "string"
- }
- },
- "type": "object"
- },
- "ReleaseChannel": {
- "description": "ReleaseChannel indicates which release channel a cluster is subscribed to. Release channels are arranged in order of risk. When a cluster is subscribed to a release channel, Google maintains both the master version and the node version. Node auto-upgrade defaults to true and cannot be disabled.",
- "properties": {
- "channel": {
- "description": "channel specifies which release channel the cluster is subscribed to.",
- "enum": [
- "UNSPECIFIED",
- "RAPID",
- "REGULAR",
- "STABLE",
- "EXTENDED"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "No channel specified.",
- "RAPID channel is offered on an early access basis for customers who want to test new releases. WARNING: Versions available in the RAPID Channel may be subject to unresolved issues with no known workaround and are not subject to any SLAs.",
- "Clusters subscribed to REGULAR receive versions that are considered GA quality. REGULAR is intended for production users who want to take advantage of new features.",
- "Clusters subscribed to STABLE receive versions that are known to be stable and reliable in production.",
- "Clusters subscribed to EXTENDED receive extended support and availability for versions which are known to be stable and reliable in production."
- ]
- }
- },
- "type": "object"
- },
- "ReservationAffinity": {
- "description": "[ReservationAffinity](https://cloud.google.com/compute/docs/instances/reserving-zonal-resources) is the configuration of desired reservation which instances could take capacity from.",
- "properties": {
- "consumeReservationType": {
- "description": "Corresponds to the type of reservation consumption.",
- "enum": [
- "UNSPECIFIED",
- "NO_RESERVATION",
- "ANY_RESERVATION",
- "SPECIFIC_RESERVATION"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value. This should not be used.",
- "Do not consume from any reserved capacity.",
- "Consume any reservation available.",
- "Must consume from a specific reservation. Must specify key value fields for specifying the reservations."
- ]
- },
- "key": {
- "description": "Corresponds to the label key of a reservation resource. To target a SPECIFIC_RESERVATION by name, specify \"compute.googleapis.com/reservation-name\" as the key and specify the name of your reservation as its value.",
- "type": "string"
- },
- "values": {
- "description": "Corresponds to the label value(s) of reservation resource(s).",
- "items": {
- "type": "string"
- },
- "type": "array"
- }
- },
- "type": "object"
- },
- "ResourceLimit": {
- "description": "Contains information about amount of some resource in the cluster. For memory, value should be in GB.",
- "properties": {
- "maximum": {
- "description": "Maximum amount of the resource in the cluster.",
- "format": "int64",
- "type": "string"
- },
- "minimum": {
- "description": "Minimum amount of the resource in the cluster.",
- "format": "int64",
- "type": "string"
- },
- "resourceType": {
- "description": "Resource name \"cpu\", \"memory\" or gpu-specific string.",
- "type": "string"
- }
- },
- "type": "object"
- },
- "ResourceManagerTags": {
- "description": "A map of resource manager tag keys and values to be attached to the nodes for managing Compute Engine firewalls using Network Firewall Policies. Tags must be according to specifications in https://cloud.google.com/vpc/docs/tags-firewalls-overview#specifications. A maximum of 5 tag key-value pairs can be specified. Existing tags will be replaced with new values.",
- "properties": {
- "tags": {
- "additionalProperties": {
- "type": "string"
- },
- "description": "TagKeyValue must be in one of the following formats ([KEY]=[VALUE]) 1. `tagKeys/{tag_key_id}=tagValues/{tag_value_id}` 2. `{org_id}/{tag_key_name}={tag_value_name}` 3. `{project_id}/{tag_key_name}={tag_value_name}`",
- "type": "object"
- }
- },
- "type": "object"
- },
- "ResourceUsageExportConfig": {
- "description": "Configuration for exporting cluster resource usages.",
- "properties": {
- "bigqueryDestination": {
- "$ref": "#/$defs/BigQueryDestination",
- "description": "Configuration to use BigQuery as usage export destination."
- },
- "consumptionMeteringConfig": {
- "$ref": "#/$defs/ConsumptionMeteringConfig",
- "description": "Configuration to enable resource consumption metering."
- },
- "enableNetworkEgressMetering": {
- "description": "Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "RotationConfig": {
- "description": "RotationConfig is config for secret manager auto rotation.",
- "properties": {
- "enabled": {
- "description": "Whether the rotation is enabled.",
- "type": "boolean"
- },
- "rotationInterval": {
- "description": "The interval between two consecutive rotations. Default rotation interval is 2 minutes.",
- "format": "google-duration",
- "type": "string"
- }
- },
- "type": "object"
- },
- "SandboxConfig": {
- "description": "SandboxConfig contains configurations of the sandbox to use for the node.",
- "properties": {
- "type": {
- "description": "Type of the sandbox to use for the node.",
- "enum": [
- "UNSPECIFIED",
- "GVISOR"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value. This should not be used.",
- "Run sandbox using gvisor."
- ]
- }
- },
- "type": "object"
- },
- "ScheduleUpgradeConfig": {
- "description": "Configuration for scheduled upgrades on the cluster.",
- "properties": {
- "enabled": {
- "description": "Optional. Whether or not scheduled upgrades are enabled.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "SecondaryBootDisk": {
- "description": "SecondaryBootDisk represents a persistent disk attached to a node with special configurations based on its mode.",
- "properties": {
- "diskImage": {
- "description": "Fully-qualified resource ID for an existing disk image.",
- "type": "string"
- },
- "mode": {
- "description": "Disk mode (container image cache, etc.)",
- "enum": [
- "MODE_UNSPECIFIED",
- "CONTAINER_IMAGE_CACHE"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "MODE_UNSPECIFIED is when mode is not set.",
- "CONTAINER_IMAGE_CACHE is for using the secondary boot disk as a container image cache."
- ]
- }
- },
- "type": "object"
- },
- "SecondaryBootDiskUpdateStrategy": {
- "description": "SecondaryBootDiskUpdateStrategy is a placeholder which will be extended in the future to define different options for updating secondary boot disks.",
- "type": "object"
- },
- "SecretManagerConfig": {
- "description": "SecretManagerConfig is config for secret manager enablement.",
- "properties": {
- "enabled": {
- "description": "Enable/Disable Secret Manager Config.",
- "type": "boolean"
- },
- "rotationConfig": {
- "$ref": "#/$defs/RotationConfig",
- "description": "Rotation config for secret manager."
- }
- },
- "type": "object"
- },
- "SecurityPostureConfig": {
- "description": "SecurityPostureConfig defines the flags needed to enable/disable features for the Security Posture API.",
- "properties": {
- "mode": {
- "description": "Sets which mode to use for Security Posture features.",
- "enum": [
- "MODE_UNSPECIFIED",
- "DISABLED",
- "BASIC",
- "ENTERPRISE"
- ],
- "type": "string",
- "x-google-enum-deprecated": [
- false,
- false,
- false,
- true
- ],
- "x-google-enum-descriptions": [
- "Default value not specified.",
- "Disables Security Posture features on the cluster.",
- "Applies Security Posture features on the cluster.",
- "Deprecated: Security Posture Enterprise features are no longer supported. For more details, see https://cloud.google.com/kubernetes-engine/docs/deprecations/posture-management-deprecation. Applies the Security Posture off cluster Enterprise level features."
- ]
- },
- "vulnerabilityMode": {
- "description": "Sets which mode to use for vulnerability scanning.",
- "enum": [
- "VULNERABILITY_MODE_UNSPECIFIED",
- "VULNERABILITY_DISABLED",
- "VULNERABILITY_BASIC",
- "VULNERABILITY_ENTERPRISE"
- ],
- "type": "string",
- "x-google-enum-deprecated": [
- false,
- false,
- true,
- false
- ],
- "x-google-enum-descriptions": [
- "Default value not specified.",
- "Disables vulnerability scanning on the cluster.",
- "Deprecated: Basic vulnerability scanning is no longer supported. For more details, see https://cloud.google.com/kubernetes-engine/docs/deprecations/posture-management-deprecation. Applies basic vulnerability scanning on the cluster.",
- "Applies the Security Posture's vulnerability on cluster Enterprise level features."
- ]
- }
- },
- "type": "object"
- },
- "ServiceExternalIPsConfig": {
- "description": "Config to block services with externalIPs field.",
- "properties": {
- "enabled": {
- "description": "Whether Services with ExternalIPs field are allowed or not.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "ShieldedInstanceConfig": {
- "description": "A set of Shielded Instance options.",
- "properties": {
- "enableIntegrityMonitoring": {
- "description": "Defines whether the instance has integrity monitoring enabled. Enables monitoring and attestation of the boot integrity of the instance. The attestation is performed against the integrity policy baseline. This baseline is initially derived from the implicitly trusted boot image when the instance is created.",
- "type": "boolean"
- },
- "enableSecureBoot": {
- "description": "Defines whether the instance has Secure Boot enabled. Secure Boot helps ensure that the system only runs authentic software by verifying the digital signature of all boot components, and halting the boot process if signature verification fails.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "ShieldedNodes": {
- "description": "Configuration of Shielded Nodes feature.",
- "properties": {
- "enabled": {
- "description": "Whether Shielded Nodes features are enabled on all nodes in this cluster.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "SliceControllerConfig": {
- "description": "Configuration for the Slice Controller.",
- "properties": {
- "enabled": {
- "description": "Optional. Indicates whether Slice Controller is enabled in the cluster.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "SoleTenantConfig": {
- "description": "SoleTenantConfig contains the NodeAffinities to specify what shared sole tenant node groups should back the node pool.",
- "properties": {
- "minNodeCpus": {
- "description": "Optional. The minimum number of virtual CPUs this instance will consume when running on a sole-tenant node. This field can only be set if the node pool is created in a shared sole-tenant node group.",
- "format": "int32",
- "type": "integer"
- },
- "nodeAffinities": {
- "description": "NodeAffinities used to match to a shared sole tenant node group.",
- "items": {
- "$ref": "#/$defs/NodeAffinity"
- },
- "type": "array"
- }
- },
- "type": "object"
- },
- "StandardRolloutPolicy": {
- "description": "Standard rollout policy is the default policy for blue-green.",
- "properties": {
- "batchNodeCount": {
- "description": "Number of blue nodes to drain in a batch.",
- "format": "int32",
- "type": "integer"
- },
- "batchPercentage": {
- "description": "Percentage of the blue pool nodes to drain in a batch. The range of this field should be (0.0, 1.0].",
- "format": "float",
- "type": "number"
- },
- "batchSoakDuration": {
- "description": "Soak time after each batch gets drained. Default to zero.",
- "format": "google-duration",
- "type": "string"
- }
- },
- "type": "object"
- },
- "StatefulHAConfig": {
- "description": "Configuration for the Stateful HA add-on.",
- "properties": {
- "enabled": {
- "description": "Whether the Stateful HA add-on is enabled for this cluster.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "StatusCondition": {
- "description": "StatusCondition describes why a cluster or a node pool has a certain status (e.g., ERROR or DEGRADED).",
- "properties": {
- "canonicalCode": {
- "description": "Canonical code of the condition.",
- "enum": [
- "OK",
- "CANCELLED",
- "UNKNOWN",
- "INVALID_ARGUMENT",
- "DEADLINE_EXCEEDED",
- "NOT_FOUND",
- "ALREADY_EXISTS",
- "PERMISSION_DENIED",
- "UNAUTHENTICATED",
- "RESOURCE_EXHAUSTED",
- "FAILED_PRECONDITION",
- "ABORTED",
- "OUT_OF_RANGE",
- "UNIMPLEMENTED",
- "INTERNAL",
- "UNAVAILABLE",
- "DATA_LOSS"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Not an error; returned on success. HTTP Mapping: 200 OK",
- "The operation was cancelled, typically by the caller. HTTP Mapping: 499 Client Closed Request",
- "Unknown error. For example, this error may be returned when a `Status` value received from another address space belongs to an error space that is not known in this address space. Also errors raised by APIs that do not return enough error information may be converted to this error. HTTP Mapping: 500 Internal Server Error",
- "The client specified an invalid argument. Note that this differs from `FAILED_PRECONDITION`. `INVALID_ARGUMENT` indicates arguments that are problematic regardless of the state of the system (e.g., a malformed file name). HTTP Mapping: 400 Bad Request",
- "The deadline expired before the operation could complete. For operations that change the state of the system, this error may be returned even if the operation has completed successfully. For example, a successful response from a server could have been delayed long enough for the deadline to expire. HTTP Mapping: 504 Gateway Timeout",
- "Some requested entity (e.g., file or directory) was not found. Note to server developers: if a request is denied for an entire class of users, such as gradual feature rollout or undocumented allowlist, `NOT_FOUND` may be used. If a request is denied for some users within a class of users, such as user-based access control, `PERMISSION_DENIED` must be used. HTTP Mapping: 404 Not Found",
- "The entity that a client attempted to create (e.g., file or directory) already exists. HTTP Mapping: 409 Conflict",
- "The caller does not have permission to execute the specified operation. `PERMISSION_DENIED` must not be used for rejections caused by exhausting some resource (use `RESOURCE_EXHAUSTED` instead for those errors). `PERMISSION_DENIED` must not be used if the caller can not be identified (use `UNAUTHENTICATED` instead for those errors). This error code does not imply the request is valid or the requested entity exists or satisfies other pre-conditions. HTTP Mapping: 403 Forbidden",
- "The request does not have valid authentication credentials for the operation. HTTP Mapping: 401 Unauthorized",
- "Some resource has been exhausted, perhaps a per-user quota, or perhaps the entire file system is out of space. HTTP Mapping: 429 Too Many Requests",
- "The operation was rejected because the system is not in a state required for the operation's execution. For example, the directory to be deleted is non-empty, an rmdir operation is applied to a non-directory, etc. Service implementors can use the following guidelines to decide between `FAILED_PRECONDITION`, `ABORTED`, and `UNAVAILABLE`: (a) Use `UNAVAILABLE` if the client can retry just the failing call. (b) Use `ABORTED` if the client should retry at a higher level. For example, when a client-specified test-and-set fails, indicating the client should restart a read-modify-write sequence. (c) Use `FAILED_PRECONDITION` if the client should not retry until the system state has been explicitly fixed. For example, if an \"rmdir\" fails because the directory is non-empty, `FAILED_PRECONDITION` should be returned since the client should not retry unless the files are deleted from the directory. HTTP Mapping: 400 Bad Request",
- "The operation was aborted, typically due to a concurrency issue such as a sequencer check failure or transaction abort. See the guidelines above for deciding between `FAILED_PRECONDITION`, `ABORTED`, and `UNAVAILABLE`. HTTP Mapping: 409 Conflict",
- "The operation was attempted past the valid range. E.g., seeking or reading past end-of-file. Unlike `INVALID_ARGUMENT`, this error indicates a problem that may be fixed if the system state changes. For example, a 32-bit file system will generate `INVALID_ARGUMENT` if asked to read at an offset that is not in the range [0,2^32-1], but it will generate `OUT_OF_RANGE` if asked to read from an offset past the current file size. There is a fair bit of overlap between `FAILED_PRECONDITION` and `OUT_OF_RANGE`. We recommend using `OUT_OF_RANGE` (the more specific error) when it applies so that callers who are iterating through a space can easily look for an `OUT_OF_RANGE` error to detect when they are done. HTTP Mapping: 400 Bad Request",
- "The operation is not implemented or is not supported/enabled in this service. HTTP Mapping: 501 Not Implemented",
- "Internal errors. This means that some invariants expected by the underlying system have been broken. This error code is reserved for serious errors. HTTP Mapping: 500 Internal Server Error",
- "The service is currently unavailable. This is most likely a transient condition, which can be corrected by retrying with a backoff. Note that it is not always safe to retry non-idempotent operations. See the guidelines above for deciding between `FAILED_PRECONDITION`, `ABORTED`, and `UNAVAILABLE`. HTTP Mapping: 503 Service Unavailable",
- "Unrecoverable data loss or corruption. HTTP Mapping: 500 Internal Server Error"
- ]
- },
- "code": {
- "deprecated": true,
- "description": "Machine-friendly representation of the condition Deprecated. Use canonical_code instead.",
- "enum": [
- "UNKNOWN",
- "GCE_STOCKOUT",
- "GKE_SERVICE_ACCOUNT_DELETED",
- "GCE_QUOTA_EXCEEDED",
- "SET_BY_OPERATOR",
- "CLOUD_KMS_KEY_ERROR",
- "CA_EXPIRING",
- "NODE_SERVICE_ACCOUNT_MISSING_PERMISSIONS",
- "CLOUD_KMS_KEY_DESTROYED"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "UNKNOWN indicates a generic condition.",
- "GCE_STOCKOUT indicates that Google Compute Engine resources are temporarily unavailable.",
- "GKE_SERVICE_ACCOUNT_DELETED indicates that the user deleted their robot service account.",
- "Google Compute Engine quota was exceeded.",
- "Cluster state was manually changed by an SRE due to a system logic error.",
- "Unable to perform an encrypt operation against the CloudKMS key used for etcd level encryption.",
- "Cluster CA is expiring soon.",
- "Node service account is missing permissions.",
- "Cloud KMS key version used for etcd level encryption has been destroyed. This is a permanent error."
- ]
- },
- "message": {
- "description": "Human-friendly representation of the condition",
- "type": "string"
- }
- },
- "type": "object"
- },
- "SwapConfig": {
- "description": "Configuration for swap memory on a node pool.",
- "properties": {
- "bootDiskProfile": {
- "$ref": "#/$defs/BootDiskProfile",
- "description": "Swap on the node's boot disk."
- },
- "dedicatedLocalSsdProfile": {
- "$ref": "#/$defs/DedicatedLocalSsdProfile",
- "description": "Provisions a new, separate local NVMe SSD exclusively for swap."
- },
- "enabled": {
- "description": "Optional. Enables or disables swap for the node pool.",
- "type": "boolean"
- },
- "encryptionConfig": {
- "$ref": "#/$defs/EncryptionConfig",
- "description": "Optional. If omitted, swap space is encrypted by default."
- },
- "ephemeralLocalSsdProfile": {
- "$ref": "#/$defs/EphemeralLocalSsdProfile",
- "description": "Swap on the local SSD shared with pod ephemeral storage."
- }
- },
- "type": "object"
- },
- "TaintConfig": {
- "description": "TaintConfig contains the configuration for the taints of the node pool.",
- "properties": {
- "architectureTaintBehavior": {
- "description": "Optional. Controls architecture tainting behavior.",
- "enum": [
- "ARCHITECTURE_TAINT_BEHAVIOR_UNSPECIFIED",
- "NONE",
- "ARM"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Specifies that the behavior is unspecified, defaults to ARM.",
- "Disables default architecture taints on the node pool.",
- "Taints all the nodes in the node pool with the default ARM taint."
- ]
- }
- },
- "type": "object"
- },
- "TimeWindow": {
- "description": "Represents an arbitrary window of time.",
- "properties": {
- "endTime": {
- "description": "The time that the window ends. The end time should take place after the start time.",
- "format": "date-time",
- "type": "string"
- },
- "maintenanceExclusionOptions": {
- "$ref": "#/$defs/MaintenanceExclusionOptions",
- "description": "MaintenanceExclusionOptions provides maintenance exclusion related options."
- },
- "startTime": {
- "description": "The time that the window first starts.",
- "format": "date-time",
- "type": "string"
- }
- },
- "type": "object"
- },
- "TopologyManager": {
- "description": "TopologyManager defines the configuration options for Topology Manager feature. See https://kubernetes.io/docs/tasks/administer-cluster/topology-manager/",
- "properties": {
- "policy": {
- "description": "Configures the strategy for resource alignment. Allowed values are: * none: the default policy, and does not perform any topology alignment. * restricted: the topology manager stores the preferred NUMA node affinity for the container, and will reject the pod if the affinity if not preferred. * best-effort: the topology manager stores the preferred NUMA node affinity for the container. If the affinity is not preferred, the topology manager will admit the pod to the node anyway. * single-numa-node: the topology manager determines if the single NUMA node affinity is possible. If it is, Topology Manager will store this and the Hint Providers can then use this information when making the resource allocation decision. If, however, this is not possible then the Topology Manager will reject the pod from the node. This will result in a pod in a Terminated state with a pod admission failure. The default policy value is 'none' if unspecified. Details about each strategy can be found [here](https://kubernetes.io/docs/tasks/administer-cluster/topology-manager/#topology-manager-policies).",
- "type": "string"
- },
- "scope": {
- "description": "The Topology Manager aligns resources in following scopes: * container * pod The default scope is 'container' if unspecified. See https://kubernetes.io/docs/tasks/administer-cluster/topology-manager/#topology-manager-scopes",
- "type": "string"
- }
- },
- "type": "object"
- },
- "UpdateInfo": {
- "description": "UpdateInfo contains resource (instance groups, etc), status and other intermediate information relevant to a node pool upgrade.",
- "properties": {
- "blueGreenInfo": {
- "$ref": "#/$defs/BlueGreenInfo",
- "description": "Information of a blue-green upgrade."
- }
- },
- "type": "object"
- },
- "UpgradeSettings": {
- "description": "These upgrade settings control the level of parallelism and the level of disruption caused by an upgrade. maxUnavailable controls the number of nodes that can be simultaneously unavailable. maxSurge controls the number of additional nodes that can be added to the node pool temporarily for the time of the upgrade to increase the number of available nodes. (maxUnavailable + maxSurge) determines the level of parallelism (how many nodes are being upgraded at the same time). Note: upgrades inevitably introduce some disruption since workloads need to be moved from old nodes to new, upgraded ones. Even if maxUnavailable=0, this holds true. (Disruption stays within the limits of PodDisruptionBudget, if it is configured.) Consider a hypothetical node pool with 5 nodes having maxSurge=2, maxUnavailable=1. This means the upgrade process upgrades 3 nodes simultaneously. It creates 2 additional (upgraded) nodes, then it brings down 3 old (not yet upgraded) nodes at the same time. This ensures that there are always at least 4 nodes available. These upgrade settings configure the upgrade strategy for the node pool. Use strategy to switch between the strategies applied to the node pool. If the strategy is ROLLING, use max_surge and max_unavailable to control the level of parallelism and the level of disruption caused by upgrade. 1. maxSurge controls the number of additional nodes that can be added to the node pool temporarily for the time of the upgrade to increase the number of available nodes. 2. maxUnavailable controls the number of nodes that can be simultaneously unavailable. 3. (maxUnavailable + maxSurge) determines the level of parallelism (how many nodes are being upgraded at the same time). If the strategy is BLUE_GREEN, use blue_green_settings to configure the blue-green upgrade related settings. 1. standard_rollout_policy is the default policy. The policy is used to control the way blue pool gets drained. The draining is executed in the batch mode. The batch size could be specified as either percentage of the node pool size or the number of nodes. batch_soak_duration is the soak time after each batch gets drained. 2. node_pool_soak_duration is the soak time after all blue nodes are drained. After this period, the blue pool nodes will be deleted.",
- "properties": {
- "blueGreenSettings": {
- "$ref": "#/$defs/BlueGreenSettings",
- "description": "Settings for blue-green upgrade strategy."
- },
- "maxSurge": {
- "description": "The maximum number of nodes that can be created beyond the current size of the node pool during the upgrade process.",
- "format": "int32",
- "type": "integer"
- },
- "maxUnavailable": {
- "description": "The maximum number of nodes that can be simultaneously unavailable during the upgrade process. A node is considered available if its status is Ready.",
- "format": "int32",
- "type": "integer"
- },
- "strategy": {
- "description": "Update strategy of the node pool.",
- "enum": [
- "NODE_POOL_UPDATE_STRATEGY_UNSPECIFIED",
- "BLUE_GREEN",
- "SURGE",
- "SHORT_LIVED"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value if unset. GKE internally defaults the update strategy to SURGE for unspecified strategies.",
- "blue-green upgrade.",
- "SURGE is the traditional way of upgrade a node pool. max_surge and max_unavailable determines the level of upgrade parallelism.",
- "SHORT_LIVED is the dedicated upgrade strategy for QueuedProvisioning and flex start nodepools scaled up only by enqueueing to the Dynamic Workload Scheduler (DWS)."
- ]
- }
- },
- "type": "object"
- },
- "UserManagedKeysConfig": {
- "description": "UserManagedKeysConfig holds the resource address to Keys which are used for signing certs and token that are used for communication within cluster.",
- "properties": {
- "aggregationCa": {
- "description": "The Certificate Authority Service caPool to use for the aggregation CA in this cluster.",
- "type": "string"
- },
- "clusterCa": {
- "description": "The Certificate Authority Service caPool to use for the cluster CA in this cluster.",
- "type": "string"
- },
- "controlPlaneDiskEncryptionKey": {
- "description": "The Cloud KMS cryptoKey to use for Confidential Hyperdisk on the control plane nodes.",
- "type": "string"
- },
- "controlPlaneDiskEncryptionKeyVersions": {
- "description": "Output only. All of the versions of the Cloud KMS cryptoKey that are used by Confidential Hyperdisks on the control plane nodes.",
- "items": {
- "type": "string"
- },
- "readOnly": true,
- "type": "array"
- },
- "etcdApiCa": {
- "description": "Resource path of the Certificate Authority Service caPool to use for the etcd API CA in this cluster.",
- "type": "string"
- },
- "etcdPeerCa": {
- "description": "Resource path of the Certificate Authority Service caPool to use for the etcd peer CA in this cluster.",
- "type": "string"
- },
- "gkeopsEtcdBackupEncryptionKey": {
- "description": "Resource path of the Cloud KMS cryptoKey to use for encryption of internal etcd backups.",
- "type": "string"
- },
- "serviceAccountSigningKeys": {
- "description": "The Cloud KMS cryptoKeyVersions to use for signing service account JWTs issued by this cluster. Format: `projects/{project}/locations/{location}/keyRings/{keyring}/cryptoKeys/{cryptoKey}/cryptoKeyVersions/{cryptoKeyVersion}`",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "serviceAccountVerificationKeys": {
- "description": "The Cloud KMS cryptoKeyVersions to use for verifying service account JWTs issued by this cluster. Format: `projects/{project}/locations/{location}/keyRings/{keyring}/cryptoKeys/{cryptoKey}/cryptoKeyVersions/{cryptoKeyVersion}`",
- "items": {
- "type": "string"
- },
- "type": "array"
- }
- },
- "type": "object"
- },
- "VerticalPodAutoscaling": {
- "description": "VerticalPodAutoscaling contains global, per-cluster information required by Vertical Pod Autoscaler to automatically adjust the resources of pods controlled by it.",
- "properties": {
- "enabled": {
- "description": "Enables vertical pod autoscaling.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "VirtualNIC": {
- "description": "Configuration of gVNIC feature.",
- "properties": {
- "enabled": {
- "description": "Whether gVNIC features are enabled in the node pool.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "WindowsNodeConfig": {
- "description": "Parameters that can be configured on Windows nodes. Windows Node Config that define the parameters that will be used to configure the Windows node pool settings.",
- "properties": {
- "osVersion": {
- "description": "OSVersion specifies the Windows node config to be used on the node.",
- "enum": [
- "OS_VERSION_UNSPECIFIED",
- "OS_VERSION_LTSC2019",
- "OS_VERSION_LTSC2022"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "When OSVersion is not specified.",
- "LTSC2019 specifies to use LTSC2019 as the Windows Servercore Base Image.",
- "LTSC2022 specifies to use LTSC2022 as the Windows Servercore Base Image."
- ]
- }
- },
- "type": "object"
- },
- "WorkloadIdentityConfig": {
- "description": "Configuration for the use of Kubernetes Service Accounts in IAM policies.",
- "properties": {
- "workloadPool": {
- "description": "The workload pool to attach all Kubernetes service accounts to.",
- "type": "string"
- }
- },
- "type": "object"
- },
- "WorkloadMetadataConfig": {
- "description": "WorkloadMetadataConfig defines the metadata configuration to expose to workloads on the node pool.",
- "properties": {
- "mode": {
- "description": "Mode is the configuration for how to expose metadata to workloads running on the node pool.",
- "enum": [
- "MODE_UNSPECIFIED",
- "GCE_METADATA",
- "GKE_METADATA"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Not set.",
- "Expose all Compute Engine metadata to pods.",
- "Run the GKE Metadata Server on this node. The GKE Metadata Server exposes a metadata API to workloads that is compatible with the V1 Compute Metadata APIs exposed by the Compute Engine and App Engine Metadata Servers. This feature can only be enabled if Workload Identity is enabled at the cluster level."
- ]
- }
- },
- "type": "object"
- },
- "WorkloadPolicyConfig": {
- "description": "WorkloadPolicyConfig is the configuration related to GCW workload policy",
- "properties": {
- "allowNetAdmin": {
- "description": "If true, workloads can use NET_ADMIN capability.",
- "type": "boolean"
- },
- "autopilotCompatibilityAuditingEnabled": {
- "description": "If true, enables the GCW Auditor that audits workloads on standard clusters.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "WritableCgroups": {
- "description": "Defines writable cgroups configuration.",
- "properties": {
- "enabled": {
- "description": "Optional. Whether writable cgroups is enabled.",
- "type": "boolean"
- }
- },
- "type": "object"
- }
-}Output schema / descriptionPrevious value: -"A Google Kubernetes Engine cluster."New value: +"Response for returned cluster object in JSON format. The full cluster object can be found at https://cloud.google.com/container-engine/reference/rest/v1/projects.locations.clusters."Output schema / properties / addonsConfigRemoved value: -{
- "$ref": "#/$defs/AddonsConfig",
- "description": "Configurations for the various addons available to run in the cluster."
-}Output schema / properties / alphaClusterFeatureGatesRemoved value: -{
- "description": "The list of user specified Kubernetes feature gates. Each string represents the activation status of a feature gate (e.g. \"featureX=true\" or \"featureX=false\")",
- "items": {
- "type": "string"
- },
- "type": "array"
-}Output schema / properties / anonymousAuthenticationConfigRemoved value: -{
- "$ref": "#/$defs/AnonymousAuthenticationConfig",
- "description": "Configuration for limiting anonymous access to all endpoints except the health checks."
-}Output schema / properties / authenticatorGroupsConfigRemoved value: -{
- "$ref": "#/$defs/AuthenticatorGroupsConfig",
- "description": "Configuration controlling RBAC group membership information."
-}Output schema / properties / autopilotRemoved value: -{
- "$ref": "#/$defs/Autopilot",
- "description": "Autopilot configuration for the cluster."
-}Output schema / properties / autoscalingRemoved value: -{
- "$ref": "#/$defs/ClusterAutoscaling",
- "description": "Cluster-level autoscaling configuration."
-}Output schema / properties / binaryAuthorizationRemoved value: -{
- "$ref": "#/$defs/BinaryAuthorization",
- "description": "Configuration for Binary Authorization."
-}Output schema / properties / clusterAdded value: +{
+ "description": "A string representing the Cluster object in JSON format.",
+ "type": "string"
+}Output schema / properties / clusterIpv4CidrRemoved value: -{
- "description": "The IP address range of the container pods in this cluster, in [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`). Leave blank to have one automatically chosen or specify a `/14` block in `10.0.0.0/8`.",
- "type": "string"
-}Output schema / properties / compliancePostureConfigRemoved value: -{
- "$ref": "#/$defs/CompliancePostureConfig",
- "deprecated": true,
- "description": "Optional. Deprecated: Compliance Posture is no longer supported. For more details, see https://cloud.google.com/kubernetes-engine/docs/deprecations/posture-management-deprecation. Enable/Disable Compliance Posture features for the cluster."
-}Output schema / properties / conditionsRemoved value: -{
- "description": "Which conditions caused the current cluster state.",
- "items": {
- "$ref": "#/$defs/StatusCondition"
- },
- "type": "array"
-}Output schema / properties / confidentialNodesRemoved value: -{
- "$ref": "#/$defs/ConfidentialNodes",
- "description": "Configuration of Confidential Nodes. All the nodes in the cluster will be Confidential VM once enabled."
-}Output schema / properties / controlPlaneEgressRemoved value: -{
- "$ref": "#/$defs/ControlPlaneEgress",
- "description": "Configuration for control plane egress control."
-}Output schema / properties / controlPlaneEndpointsConfigRemoved value: -{
- "$ref": "#/$defs/ControlPlaneEndpointsConfig",
- "description": "Configuration for all cluster's control plane endpoints."
-}Output schema / properties / costManagementConfigRemoved value: -{
- "$ref": "#/$defs/CostManagementConfig",
- "description": "Configuration for the fine-grained cost management feature."
-}Output schema / properties / createTimeRemoved value: -{
- "description": "Output only. The time the cluster was created, in [RFC3339](https://www.ietf.org/rfc/rfc3339.txt) text format.",
- "readOnly": true,
- "type": "string"
-}Output schema / properties / currentMasterVersionRemoved value: -{
- "description": "Output only. The current software version of the master endpoint.",
- "readOnly": true,
- "type": "string"
-}Output schema / properties / currentNodeCountRemoved value: -{
- "deprecated": true,
- "description": "Output only. The number of nodes currently in the cluster. Deprecated. Call Kubernetes API directly to retrieve node information.",
- "format": "int32",
- "readOnly": true,
- "type": "integer"
-}Output schema / properties / currentNodeVersionRemoved value: -{
- "deprecated": true,
- "description": "Output only. Deprecated, use [NodePools.version](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1/projects.locations.clusters.nodePools) instead. The current version of the node software components. If they are currently at multiple versions because they're in the process of being upgraded, this reflects the minimum version of all nodes.",
- "readOnly": true,
- "type": "string"
-}Output schema / properties / databaseEncryptionRemoved value: -{
- "$ref": "#/$defs/DatabaseEncryption",
- "description": "Configuration of etcd encryption."
-}Output schema / properties / defaultMaxPodsConstraintRemoved value: -{
- "$ref": "#/$defs/MaxPodsConstraint",
- "description": "The default constraint on the maximum number of pods that can be run simultaneously on a node in the node pool of this cluster. Only honored if cluster created with IP Alias support."
-}Output schema / properties / descriptionRemoved value: -{
- "description": "An optional description of this cluster.",
- "type": "string"
-}Output schema / properties / enableK8sBetaApisRemoved value: -{
- "$ref": "#/$defs/K8sBetaAPIConfig",
- "description": "Beta APIs Config"
-}Output schema / properties / enableKubernetesAlphaRemoved value: -{
- "description": "Kubernetes alpha features are enabled on this cluster. This includes alpha API groups (e.g. v1alpha1) and features that may not be production ready in the kubernetes version of the master and nodes. The cluster has no SLA for uptime and master/node upgrades are disabled. Alpha enabled clusters are automatically deleted thirty days after creation.",
- "type": "boolean"
-}Output schema / properties / enableTpuRemoved value: -{
- "deprecated": true,
- "description": "Enable the ability to use Cloud TPUs in this cluster. This field is deprecated due to the deprecation of 2VM TPU. The end of life date for 2VM TPU is 2025-04-25.",
- "type": "boolean"
-}Output schema / properties / endpointRemoved value: -{
- "description": "Output only. The IP address of this cluster's master endpoint. The endpoint can be accessed from the internet at `https://username:password@endpoint/`. See the `masterAuth` property of this resource for username and password information.",
- "readOnly": true,
- "type": "string"
-}Output schema / properties / enterpriseConfigRemoved value: -{
- "$ref": "#/$defs/EnterpriseConfig",
- "deprecated": true,
- "description": "GKE Enterprise Configuration. Deprecated: GKE Enterprise features are now available without an Enterprise tier."
-}Output schema / properties / etagRemoved value: -{
- "description": "This checksum is computed by the server based on the value of cluster fields, and may be sent on update requests to ensure the client has an up-to-date value before proceeding.",
- "type": "string"
-}Output schema / properties / expireTimeRemoved value: -{
- "description": "Output only. The time the cluster will be automatically deleted in [RFC3339](https://www.ietf.org/rfc/rfc3339.txt) text format.",
- "readOnly": true,
- "type": "string"
-}Output schema / properties / fleetRemoved value: -{
- "$ref": "#/$defs/Fleet",
- "description": "Fleet information for the cluster."
-}Output schema / properties / gkeAutoUpgradeConfigRemoved value: -{
- "$ref": "#/$defs/GkeAutoUpgradeConfig",
- "description": "Configuration for GKE auto upgrades."
-}Output schema / properties / idRemoved value: -{
- "description": "Output only. Unique id for the cluster.",
- "readOnly": true,
- "type": "string"
-}Output schema / properties / identityServiceConfigRemoved value: -{
- "$ref": "#/$defs/IdentityServiceConfig",
- "description": "Configuration for Identity Service component."
-}Output schema / properties / initialClusterVersionRemoved value: -{
- "description": "The initial Kubernetes version for this cluster. Valid versions are those found in validMasterVersions returned by getServerConfig. The version can be upgraded over time; such upgrades are reflected in currentMasterVersion and currentNodeVersion. Users may specify either explicit versions offered by Kubernetes Engine or version aliases, which have the following behavior: - \"latest\": picks the highest valid Kubernetes version - \"1.X\": picks the highest valid patch+gke.N patch in the 1.X version - \"1.X.Y\": picks the highest valid gke.N patch in the 1.X.Y version - \"1.X.Y-gke.N\": picks an explicit Kubernetes version - \"\",\"-\": picks the default Kubernetes version",
- "type": "string"
-}Output schema / properties / initialNodeCountRemoved value: -{
- "deprecated": true,
- "description": "The number of nodes to create in this cluster. You must ensure that your Compute Engine [resource quota](https://cloud.google.com/compute/quotas) is sufficient for this number of instances. You must also have available firewall and routes quota. For requests, this field should only be used in lieu of a \"node_pool\" object, since this configuration (along with the \"node_config\") will be used to create a \"NodePool\" object with an auto-generated name. Do not use this and a node_pool at the same time. This field is deprecated, use node_pool.initial_node_count instead.",
- "format": "int32",
- "type": "integer"
-}Output schema / properties / instanceGroupUrlsRemoved value: -{
- "deprecated": true,
- "description": "Output only. Deprecated. Use node_pools.instance_group_urls.",
- "items": {
- "type": "string"
- },
- "readOnly": true,
- "type": "array"
-}Output schema / properties / ipAllocationPolicyRemoved value: -{
- "$ref": "#/$defs/IPAllocationPolicy",
- "description": "Configuration for cluster IP allocation."
-}Output schema / properties / labelFingerprintRemoved value: -{
- "description": "The fingerprint of the set of labels for this cluster.",
- "type": "string"
-}Output schema / properties / legacyAbacRemoved value: -{
- "$ref": "#/$defs/LegacyAbac",
- "description": "Configuration for the legacy ABAC authorization mode."
-}Output schema / properties / locationRemoved value: -{
- "description": "Output only. The name of the Google Compute Engine [zone](https://cloud.google.com/compute/docs/regions-zones/regions-zones#available) or [region](https://cloud.google.com/compute/docs/regions-zones/regions-zones#available) in which the cluster resides.",
- "readOnly": true,
- "type": "string"
-}Output schema / properties / locationsRemoved value: -{
- "description": "The list of Google Compute Engine [zones](https://cloud.google.com/compute/docs/zones#available) in which the cluster's nodes should be located. This field provides a default value if [NodePool.Locations](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1/projects.locations.clusters.nodePools#NodePool.FIELDS.locations) are not specified during node pool creation. Warning: changing cluster locations will update the [NodePool.Locations](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1/projects.locations.clusters.nodePools#NodePool.FIELDS.locations) of all node pools and will result in nodes being added and/or removed.",
- "items": {
- "type": "string"
- },
- "type": "array"
-}Output schema / properties / loggingConfigRemoved value: -{
- "$ref": "#/$defs/LoggingConfig",
- "description": "Logging configuration for the cluster."
-}Output schema / properties / loggingServiceRemoved value: -{
- "description": "The logging service the cluster should use to write logs. Currently available options: * `logging.googleapis.com/kubernetes` - The Cloud Logging service with a Kubernetes-native resource model * `logging.googleapis.com` - The legacy Cloud Logging service (no longer available as of GKE 1.15). * `none` - no logs will be exported from the cluster. If left as an empty string,`logging.googleapis.com/kubernetes` will be used for GKE 1.14+ or `logging.googleapis.com` for earlier versions.",
- "type": "string"
-}Output schema / properties / maintenancePolicyRemoved value: -{
- "$ref": "#/$defs/MaintenancePolicy",
- "description": "Configure the maintenance policy for this cluster."
-}Output schema / properties / managedMachineLearningDiagnosticsConfigRemoved value: -{
- "$ref": "#/$defs/ManagedMachineLearningDiagnosticsConfig",
- "description": "Configuration for Managed Machine Learning Diagnostics."
-}Output schema / properties / managedOpentelemetryConfigRemoved value: -{
- "$ref": "#/$defs/ManagedOpenTelemetryConfig",
- "description": "Configuration for Managed OpenTelemetry pipeline."
-}Output schema / properties / masterAuthRemoved value: -{
- "$ref": "#/$defs/MasterAuth",
- "description": "The authentication information for accessing the master endpoint. If unspecified, the defaults are used: For clusters before v1.12, if master_auth is unspecified, `username` will be set to \"admin\", a random password will be generated, and a client certificate will be issued."
-}Output schema / properties / masterAuthorizedNetworksConfigRemoved value: -{
- "$ref": "#/$defs/MasterAuthorizedNetworksConfig",
- "deprecated": true,
- "description": "The configuration options for master authorized networks feature. Deprecated: Use ControlPlaneEndpointsConfig.IPEndpointsConfig.authorized_networks_config instead."
-}Output schema / properties / meshCertificatesRemoved value: -{
- "$ref": "#/$defs/MeshCertificates",
- "description": "Configuration for issuance of mTLS keys and certificates to Kubernetes pods."
-}Output schema / properties / monitoringConfigRemoved value: -{
- "$ref": "#/$defs/MonitoringConfig",
- "description": "Monitoring configuration for the cluster."
-}Output schema / properties / monitoringServiceRemoved value: -{
- "description": "The monitoring service the cluster should use to write metrics. Currently available options: * `monitoring.googleapis.com/kubernetes` - The Cloud Monitoring service with a Kubernetes-native resource model * `monitoring.googleapis.com` - The legacy Cloud Monitoring service (no longer available as of GKE 1.15). * `none` - No metrics will be exported from the cluster. If left as an empty string,`monitoring.googleapis.com/kubernetes` will be used for GKE 1.14+ or `monitoring.googleapis.com` for earlier versions.",
- "type": "string"
-}Output schema / properties / nameRemoved value: -{
- "description": "The name of this cluster. The name must be unique within this project and location (e.g. zone or region), and can be up to 40 characters with the following restrictions: * Lowercase letters, numbers, and hyphens only. * Must start with a letter. * Must end with a number or a letter.",
- "type": "string"
-}Output schema / properties / networkRemoved value: -{
- "description": "The name of the Google Compute Engine [network](https://cloud.google.com/compute/docs/networks-and-firewalls#networks) to which the cluster is connected. If left unspecified, the `default` network will be used.",
- "type": "string"
-}Output schema / properties / networkConfigRemoved value: -{
- "$ref": "#/$defs/NetworkConfig",
- "description": "Configuration for cluster networking."
-}Output schema / properties / networkPolicyRemoved value: -{
- "$ref": "#/$defs/NetworkPolicy",
- "description": "Configuration options for the NetworkPolicy feature."
-}Output schema / properties / nodeConfigRemoved value: -{
- "$ref": "#/$defs/NodeConfig",
- "deprecated": true,
- "description": "Parameters used in creating the cluster's nodes. For requests, this field should only be used in lieu of a \"node_pool\" object, since this configuration (along with the \"initial_node_count\") will be used to create a \"NodePool\" object with an auto-generated name. Do not use this and a node_pool at the same time. For responses, this field will be populated with the node configuration of the first node pool. (For configuration of each node pool, see `node_pool.config`) If unspecified, the defaults are used. This field is deprecated, use node_pool.config instead."
-}Output schema / properties / nodeIpv4CidrSizeRemoved value: -{
- "description": "Output only. The size of the address space on each node for hosting containers. This is provisioned from within the `container_ipv4_cidr` range. This field will only be set when cluster is in route-based network mode.",
- "format": "int32",
- "readOnly": true,
- "type": "integer"
-}Output schema / properties / nodePoolAutoConfigRemoved value: -{
- "$ref": "#/$defs/NodePoolAutoConfig",
- "description": "Node pool configs that apply to all auto-provisioned node pools in autopilot clusters and node auto-provisioning enabled clusters."
-}Output schema / properties / nodePoolDefaultsRemoved value: -{
- "$ref": "#/$defs/NodePoolDefaults",
- "description": "Default NodePool settings for the entire cluster. These settings are overridden if specified on the specific NodePool object."
-}Output schema / properties / nodePoolsRemoved value: -{
- "description": "The node pools associated with this cluster. This field should not be set if \"node_config\" or \"initial_node_count\" are specified.",
- "items": {
- "$ref": "#/$defs/NodePool"
- },
- "type": "array"
-}Output schema / properties / notificationConfigRemoved value: -{
- "$ref": "#/$defs/NotificationConfig",
- "description": "Notification configuration of the cluster."
-}Output schema / properties / parentProductConfigRemoved value: -{
- "$ref": "#/$defs/ParentProductConfig",
- "description": "The configuration of the parent product of the cluster. This field is used by Google internal products that are built on top of the GKE cluster and take the ownership of the cluster."
-}Output schema / properties / podAutoscalingRemoved value: -{
- "$ref": "#/$defs/PodAutoscaling",
- "description": "The config for pod autoscaling."
-}Output schema / properties / privateClusterConfigRemoved value: -{
- "$ref": "#/$defs/PrivateClusterConfig",
- "description": "Configuration for private cluster."
-}Output schema / properties / rbacBindingConfigRemoved value: -{
- "$ref": "#/$defs/RBACBindingConfig",
- "description": "RBACBindingConfig allows user to restrict ClusterRoleBindings an RoleBindings that can be created."
-}Output schema / properties / releaseChannelRemoved value: -{
- "$ref": "#/$defs/ReleaseChannel",
- "description": "Release channel configuration. If left unspecified on cluster creation and a version is specified, the cluster is enrolled in the most mature release channel where the version is available (first checking STABLE, then REGULAR, and finally RAPID). Otherwise, if no release channel configuration and no version is specified, the cluster is enrolled in the REGULAR channel with its default version."
-}Output schema / properties / resourceLabelsRemoved value: -{
- "additionalProperties": {
- "type": "string"
- },
- "description": "The resource labels for the cluster to use to annotate any related Google Compute Engine resources.",
- "type": "object"
-}Output schema / properties / resourceUsageExportConfigRemoved value: -{
- "$ref": "#/$defs/ResourceUsageExportConfig",
- "description": "Configuration for exporting resource usages. Resource usage export is disabled when this config is unspecified."
-}Output schema / properties / satisfiesPziRemoved value: -{
- "description": "Output only. Reserved for future use.",
- "readOnly": true,
- "type": "boolean"
-}Output schema / properties / satisfiesPzsRemoved value: -{
- "description": "Output only. Reserved for future use.",
- "readOnly": true,
- "type": "boolean"
-}Output schema / properties / scheduleUpgradeConfigRemoved value: -{
- "$ref": "#/$defs/ScheduleUpgradeConfig",
- "description": "Optional. Configuration for scheduled upgrades."
-}Output schema / properties / secretManagerConfigRemoved value: -{
- "$ref": "#/$defs/SecretManagerConfig",
- "description": "Secret CSI driver configuration."
-}Output schema / properties / securityPostureConfigRemoved value: -{
- "$ref": "#/$defs/SecurityPostureConfig",
- "description": "Optional. Enable/Disable Security Posture API features for the cluster."
-}Output schema / properties / selfLinkRemoved value: -{
- "description": "Output only. Server-defined URL for the resource.",
- "readOnly": true,
- "type": "string"
-}Output schema / properties / servicesIpv4CidrRemoved value: -{
- "description": "Output only. The IP address range of the Kubernetes services in this cluster, in [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `1.2.3.4/29`). Service addresses are typically put in the last `/16` from the container CIDR.",
- "readOnly": true,
- "type": "string"
-}Output schema / properties / shieldedNodesRemoved value: -{
- "$ref": "#/$defs/ShieldedNodes",
- "description": "Shielded Nodes configuration."
-}Output schema / properties / statusRemoved value: -{
- "description": "Output only. The current status of this cluster.",
- "enum": [
- "STATUS_UNSPECIFIED",
- "PROVISIONING",
- "RUNNING",
- "RECONCILING",
- "STOPPING",
- "ERROR",
- "DEGRADED"
- ],
- "readOnly": true,
- "type": "string",
- "x-google-enum-descriptions": [
- "Not set.",
- "The PROVISIONING state indicates the cluster is being created.",
- "The RUNNING state indicates the cluster has been created and is fully usable.",
- "The RECONCILING state indicates that some work is actively being done on the cluster, such as upgrading the master or node software. Details can be found in the `statusMessage` field.",
- "The STOPPING state indicates the cluster is being deleted.",
- "The ERROR state indicates the cluster is unusable. It will be automatically deleted. Details can be found in the `statusMessage` field.",
- "The DEGRADED state indicates the cluster requires user action to restore full functionality. Details can be found in the `statusMessage` field."
- ]
-}Output schema / properties / statusMessageRemoved value: -{
- "deprecated": true,
- "description": "Output only. Deprecated. Use conditions instead. Additional information about the current status of this cluster, if available.",
- "readOnly": true,
- "type": "string"
-}Output schema / properties / subnetworkRemoved value: -{
- "description": "The name of the Google Compute Engine [subnetwork](https://cloud.google.com/compute/docs/subnetworks) to which the cluster is connected.",
- "type": "string"
-}Output schema / properties / tpuIpv4CidrBlockRemoved value: -{
- "deprecated": true,
- "description": "Output only. The IP address range of the Cloud TPUs in this cluster, in [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `1.2.3.4/29`). This field is deprecated due to the deprecation of 2VM TPU. The end of life date for 2VM TPU is 2025-04-25.",
- "readOnly": true,
- "type": "string"
-}Output schema / properties / userManagedKeysConfigRemoved value: -{
- "$ref": "#/$defs/UserManagedKeysConfig",
- "description": "The Custom keys configuration for the cluster."
-}Output schema / properties / verticalPodAutoscalingRemoved value: -{
- "$ref": "#/$defs/VerticalPodAutoscaling",
- "description": "Cluster-level Vertical Pod Autoscaling configuration."
-}Output schema / properties / workloadIdentityConfigRemoved value: -{
- "$ref": "#/$defs/WorkloadIdentityConfig",
- "description": "Configuration for the use of Kubernetes Service Accounts in IAM policies."
-}Output schema / properties / zoneRemoved value: -{
- "deprecated": true,
- "description": "Output only. The name of the Google Compute Engine [zone](https://cloud.google.com/compute/docs/zones#available) in which the cluster resides. This field is deprecated, use location instead.",
- "readOnly": true,
- "type": "string"
-}get_node_pool26 fields changedOutput schema / $defsRemoved value: -{
- "AcceleratorConfig": {
- "description": "AcceleratorConfig represents a Hardware Accelerator request.",
- "properties": {
- "acceleratorCount": {
- "description": "The number of the accelerator cards exposed to an instance.",
- "format": "int64",
- "type": "string"
- },
- "acceleratorType": {
- "description": "The accelerator type resource name. List of supported accelerators [here](https://cloud.google.com/compute/docs/gpus)",
- "type": "string"
- },
- "gpuDriverInstallationConfig": {
- "$ref": "#/$defs/GPUDriverInstallationConfig",
- "description": "The configuration for auto installation of GPU driver."
- },
- "gpuPartitionSize": {
- "description": "Size of partitions to create on the GPU. Valid values are described in the NVIDIA [mig user guide](https://docs.nvidia.com/datacenter/tesla/mig-user-guide/#partitioning).",
- "type": "string"
- },
- "gpuSharingConfig": {
- "$ref": "#/$defs/GPUSharingConfig",
- "description": "The configuration for GPU sharing options."
- }
- },
- "type": "object"
- },
- "AdditionalNodeNetworkConfig": {
- "description": "AdditionalNodeNetworkConfig is the configuration for additional node networks within the NodeNetworkConfig message",
- "properties": {
- "network": {
- "description": "Name of the VPC where the additional interface belongs",
- "type": "string"
- },
- "subnetwork": {
- "description": "Name of the subnetwork where the additional interface belongs",
- "type": "string"
- }
- },
- "type": "object"
- },
- "AdditionalPodNetworkConfig": {
- "description": "AdditionalPodNetworkConfig is the configuration for additional pod networks within the NodeNetworkConfig message",
- "properties": {
- "maxPodsPerNode": {
- "$ref": "#/$defs/MaxPodsConstraint",
- "description": "The maximum number of pods per node which use this pod network."
- },
- "networkAttachment": {
- "description": "The name of the network attachment for pods to communicate to; cannot be specified along with subnetwork or secondary_pod_range.",
- "type": "string"
- },
- "secondaryPodRange": {
- "description": "The name of the secondary range on the subnet which provides IP address for this pod range.",
- "type": "string"
- },
- "subnetwork": {
- "description": "Name of the subnetwork where the additional pod network belongs.",
- "type": "string"
- }
- },
- "type": "object"
- },
- "AdvancedMachineFeatures": {
- "description": "Specifies options for controlling advanced machine features.",
- "properties": {
- "enableNestedVirtualization": {
- "description": "Whether or not to enable nested virtualization (defaults to false).",
- "type": "boolean"
- },
- "performanceMonitoringUnit": {
- "description": "Type of Performance Monitoring Unit (PMU) requested on node pool instances. If unset, PMU will not be available to the node.",
- "enum": [
- "PERFORMANCE_MONITORING_UNIT_UNSPECIFIED",
- "ARCHITECTURAL",
- "STANDARD",
- "ENHANCED"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "PMU not enabled.",
- "Architecturally defined non-LLC events.",
- "Most documented core/L2 events.",
- "Most documented core/L2 and LLC events."
- ]
- },
- "threadsPerCore": {
- "description": "The number of threads per physical core. To disable simultaneous multithreading (SMT) set this to 1. If unset, the maximum number of threads supported per core by the underlying processor is assumed.",
- "format": "int64",
- "type": "string"
- }
- },
- "type": "object"
- },
- "AutoUpgradeOptions": {
- "description": "AutoUpgradeOptions defines the set of options for the user to control how the Auto Upgrades will proceed.",
- "properties": {
- "autoUpgradeStartTime": {
- "description": "Output only. This field is set when upgrades are about to commence with the approximate start time for the upgrades, in [RFC3339](https://www.ietf.org/rfc/rfc3339.txt) text format.",
- "readOnly": true,
- "type": "string"
- },
- "description": {
- "description": "Output only. This field is set when upgrades are about to commence with the description of the upgrade.",
- "readOnly": true,
- "type": "string"
- }
- },
- "type": "object"
- },
- "AutopilotConfig": {
- "description": "AutopilotConfig contains configuration of autopilot feature for this nodepool.",
- "properties": {
- "enabled": {
- "description": "Denotes that nodes belonging to this node pool are Autopilot nodes.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "AutoscaledRolloutPolicy": {
- "description": "Autoscaled rollout policy utilizes the cluster autoscaler during blue-green upgrade to scale both the blue and green pools.",
- "properties": {
- "waitForDrainDuration": {
- "description": "Optional. Time to wait after cordoning the blue pool before draining the nodes. Defaults to 3 days. The value can be set between 0 and 7 days, inclusive.",
- "format": "google-duration",
- "type": "string"
- }
- },
- "type": "object"
- },
- "BestEffortProvisioning": {
- "description": "Best effort provisioning.",
- "properties": {
- "enabled": {
- "description": "When this is enabled, cluster/node pool creations will ignore non-fatal errors like stockout to best provision as many nodes as possible right now and eventually bring up all target number of nodes",
- "type": "boolean"
- },
- "minProvisionNodes": {
- "description": "Minimum number of nodes to be provisioned to be considered as succeeded, and the rest of nodes will be provisioned gradually and eventually when stockout issue has been resolved.",
- "format": "int32",
- "type": "integer"
- }
- },
- "type": "object"
- },
- "BlueGreenInfo": {
- "description": "Information relevant to blue-green upgrade.",
- "properties": {
- "blueInstanceGroupUrls": {
- "description": "The resource URLs of the [managed instance groups] (/compute/docs/instance-groups/creating-groups-of-managed-instances) associated with blue pool.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "bluePoolDeletionStartTime": {
- "description": "Time to start deleting blue pool to complete blue-green upgrade, in [RFC3339](https://www.ietf.org/rfc/rfc3339.txt) text format.",
- "type": "string"
- },
- "greenInstanceGroupUrls": {
- "description": "The resource URLs of the [managed instance groups] (/compute/docs/instance-groups/creating-groups-of-managed-instances) associated with green pool.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "greenPoolVersion": {
- "description": "Version of green pool.",
- "type": "string"
- },
- "phase": {
- "description": "Current blue-green upgrade phase.",
- "enum": [
- "PHASE_UNSPECIFIED",
- "UPDATE_STARTED",
- "CREATING_GREEN_POOL",
- "CORDONING_BLUE_POOL",
- "DRAINING_BLUE_POOL",
- "NODE_POOL_SOAKING",
- "DELETING_BLUE_POOL",
- "ROLLBACK_STARTED"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Unspecified phase.",
- "blue-green upgrade has been initiated.",
- "Start creating green pool nodes.",
- "Start cordoning blue pool nodes.",
- "Start draining blue pool nodes.",
- "Start soaking time after draining entire blue pool.",
- "Start deleting blue nodes.",
- "Rollback has been initiated."
- ]
- }
- },
- "type": "object"
- },
- "BlueGreenSettings": {
- "description": "Settings for blue-green upgrade.",
- "properties": {
- "autoscaledRolloutPolicy": {
- "$ref": "#/$defs/AutoscaledRolloutPolicy",
- "description": "Autoscaled policy for cluster autoscaler enabled blue-green upgrade."
- },
- "nodePoolSoakDuration": {
- "description": "Time needed after draining entire blue pool. After this period, blue pool will be cleaned up.",
- "format": "google-duration",
- "type": "string"
- },
- "standardRolloutPolicy": {
- "$ref": "#/$defs/StandardRolloutPolicy",
- "description": "Standard policy for the blue-green upgrade."
- }
- },
- "type": "object"
- },
- "BootDisk": {
- "description": "BootDisk specifies the boot disk configuration for nodepools.",
- "properties": {
- "diskType": {
- "description": "Disk type of the boot disk. (i.e. Hyperdisk-Balanced, PD-Balanced, etc.)",
- "type": "string"
- },
- "provisionedIops": {
- "description": "For Hyperdisk-Balanced only, the provisioned IOPS config value.",
- "format": "int64",
- "type": "string"
- },
- "provisionedThroughput": {
- "description": "For Hyperdisk-Balanced only, the provisioned throughput config value.",
- "format": "int64",
- "type": "string"
- },
- "sizeGb": {
- "description": "Disk size in GB. Replaces NodeConfig.disk_size_gb",
- "format": "int64",
- "type": "string"
- }
- },
- "type": "object"
- },
- "BootDiskProfile": {
- "description": "Swap on the node's boot disk.",
- "properties": {
- "swapSizeGib": {
- "description": "Specifies the size of the swap space in gibibytes (GiB).",
- "format": "int64",
- "type": "string"
- },
- "swapSizePercent": {
- "description": "Specifies the size of the swap space as a percentage of the boot disk size.",
- "format": "int32",
- "type": "integer"
- }
- },
- "type": "object"
- },
- "CertificateAuthorityDomainConfig": {
- "description": "CertificateAuthorityDomainConfig configures one or more fully qualified domain names (FQDN) to a specific certificate.",
- "properties": {
- "fqdns": {
- "description": "List of fully qualified domain names (FQDN). Specifying port is supported. Wildcards are NOT supported. Examples: - my.customdomain.com - 10.0.1.2:5000",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "gcpSecretManagerCertificateConfig": {
- "$ref": "#/$defs/GCPSecretManagerCertificateConfig",
- "description": "Secret Manager certificate configuration."
- }
- },
- "type": "object"
- },
- "CertificateConfig": {
- "description": "CertificateConfig configures certificate for the registry.",
- "properties": {
- "gcpSecretManagerSecretUri": {
- "description": "The URI configures a secret from [Secret Manager](https://cloud.google.com/secret-manager) in the format \"projects/$PROJECT_ID/secrets/$SECRET_NAME/versions/$VERSION\" for global secret or \"projects/$PROJECT_ID/locations/$REGION/secrets/$SECRET_NAME/versions/$VERSION\" for regional secret. Version can be fixed (e.g. \"2\") or \"latest\"",
- "type": "string"
- }
- },
- "type": "object"
- },
- "CertificateConfigPair": {
- "description": "CertificateConfigPair configures pairs of certificates, which is used for client certificate and key pairs under a registry.",
- "properties": {
- "cert": {
- "$ref": "#/$defs/CertificateConfig",
- "description": "Cert configures the client certificate."
- },
- "key": {
- "$ref": "#/$defs/CertificateConfig",
- "description": "Key configures the client private key. Optional."
- }
- },
- "type": "object"
- },
- "ConfidentialNodes": {
- "description": "ConfidentialNodes is configuration for the confidential nodes feature, which makes nodes run on confidential VMs.",
- "properties": {
- "confidentialInstanceType": {
- "description": "Defines the type of technology used by the confidential node.",
- "enum": [
- "CONFIDENTIAL_INSTANCE_TYPE_UNSPECIFIED",
- "SEV",
- "SEV_SNP",
- "TDX"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "No type specified. Do not use this value.",
- "AMD Secure Encrypted Virtualization.",
- "AMD Secure Encrypted Virtualization - Secure Nested Paging.",
- "Intel Trust Domain eXtension."
- ]
- },
- "enabled": {
- "description": "Whether Confidential Nodes feature is enabled.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "ContainerdConfig": {
- "description": "ContainerdConfig contains configuration to customize containerd.",
- "properties": {
- "privateRegistryAccessConfig": {
- "$ref": "#/$defs/PrivateRegistryAccessConfig",
- "description": "PrivateRegistryAccessConfig is used to configure access configuration for private container registries."
- },
- "registryHosts": {
- "description": "RegistryHostConfig configures containerd registry host configuration. Each registry_hosts represents a hosts.toml file. At most 25 registry_hosts are allowed.",
- "items": {
- "$ref": "#/$defs/RegistryHostConfig"
- },
- "type": "array"
- },
- "writableCgroups": {
- "$ref": "#/$defs/WritableCgroups",
- "description": "Optional. WritableCgroups defines writable cgroups configuration for the node pool."
- }
- },
- "type": "object"
- },
- "CrashLoopBackOffConfig": {
- "description": "Contains config to modify node-level parameters for container restart behavior.",
- "properties": {
- "maxContainerRestartPeriod": {
- "description": "Optional. The maximum duration the backoff delay can accrue to for container restarts, minimum 1 second, maximum 300 seconds. If not set, defaults to the internal crashloopbackoff maximum. The string must be a sequence of decimal numbers, each with optional fraction and a unit suffix, such as \"300ms\". Valid time units are \"ns\", \"us\" (or \"µs\"), \"ms\", \"s\", \"m\", \"h\". See https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#configurable-container-restart-delay for more details.",
- "type": "string"
- }
- },
- "type": "object"
- },
- "DedicatedLocalSsdProfile": {
- "description": "Provisions a new, separate local NVMe SSD exclusively for swap.",
- "properties": {
- "diskCount": {
- "description": "The number of physical local NVMe SSD disks to attach.",
- "format": "int64",
- "type": "string"
- }
- },
- "type": "object"
- },
- "EncryptionConfig": {
- "description": "Defines encryption settings for the swap space.",
- "properties": {
- "disabled": {
- "description": "Optional. If true, swap space will not be encrypted. Defaults to false (encrypted).",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "EphemeralLocalSsdProfile": {
- "description": "Swap on the local SSD shared with pod ephemeral storage.",
- "properties": {
- "swapSizeGib": {
- "description": "Specifies the size of the swap space in gibibytes (GiB).",
- "format": "int64",
- "type": "string"
- },
- "swapSizePercent": {
- "description": "Specifies the size of the swap space as a percentage of the ephemeral local SSD capacity.",
- "format": "int32",
- "type": "integer"
- }
- },
- "type": "object"
- },
- "EphemeralStorageLocalSsdConfig": {
- "description": "EphemeralStorageLocalSsdConfig contains configuration for the node ephemeral storage using Local SSDs.",
- "properties": {
- "dataCacheCount": {
- "description": "Number of local SSDs to use for GKE Data Cache.",
- "format": "int32",
- "type": "integer"
- },
- "localSsdCount": {
- "description": "Number of local SSDs to use to back ephemeral storage. Uses NVMe interfaces. A zero (or unset) value has different meanings depending on machine type being used: 1. For pre-Gen3 machines, which support flexible numbers of local ssds, zero (or unset) means to disable using local SSDs as ephemeral storage. The limit for this value is dependent upon the maximum number of disk available on a machine per zone. See: https://cloud.google.com/compute/docs/disks/local-ssd for more information. 2. For Gen3 machines which dictate a specific number of local ssds, zero (or unset) means to use the default number of local ssds that goes with that machine type. For example, for a c3-standard-8-lssd machine, 2 local ssds would be provisioned. For c3-standard-8 (which doesn't support local ssds), 0 will be provisioned. See https://cloud.google.com/compute/docs/disks/local-ssd#choose_number_local_ssds for more info.",
- "format": "int32",
- "type": "integer"
- }
- },
- "type": "object"
- },
- "EvictionGracePeriod": {
- "description": "Eviction grace periods are grace periods for each eviction signal.",
- "properties": {
- "imagefsAvailable": {
- "description": "Optional. Grace period for eviction due to imagefs available signal. Sample format: \"10s\". Must be >= 0. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "imagefsInodesFree": {
- "description": "Optional. Grace period for eviction due to imagefs inodes free signal. Sample format: \"10s\". Must be >= 0. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "memoryAvailable": {
- "description": "Optional. Grace period for eviction due to memory available signal. Sample format: \"10s\". Must be >= 0. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "nodefsAvailable": {
- "description": "Optional. Grace period for eviction due to nodefs available signal. Sample format: \"10s\". Must be >= 0. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "nodefsInodesFree": {
- "description": "Optional. Grace period for eviction due to nodefs inodes free signal. Sample format: \"10s\". Must be >= 0. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "pidAvailable": {
- "description": "Optional. Grace period for eviction due to pid available signal. Sample format: \"10s\". Must be >= 0. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- }
- },
- "type": "object"
- },
- "EvictionMinimumReclaim": {
- "description": "Eviction minimum reclaims are the resource amounts of minimum reclaims for each eviction signal.",
- "properties": {
- "imagefsAvailable": {
- "description": "Optional. Minimum reclaim for eviction due to imagefs available signal. Only take percentage value for now. Sample format: \"10%\". Must be <=10%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "imagefsInodesFree": {
- "description": "Optional. Minimum reclaim for eviction due to imagefs inodes free signal. Only take percentage value for now. Sample format: \"10%\". Must be <=10%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "memoryAvailable": {
- "description": "Optional. Minimum reclaim for eviction due to memory available signal. Only take percentage value for now. Sample format: \"10%\". Must be <=10%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "nodefsAvailable": {
- "description": "Optional. Minimum reclaim for eviction due to nodefs available signal. Only take percentage value for now. Sample format: \"10%\". Must be <=10%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "nodefsInodesFree": {
- "description": "Optional. Minimum reclaim for eviction due to nodefs inodes free signal. Only take percentage value for now. Sample format: \"10%\". Must be <=10%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "pidAvailable": {
- "description": "Optional. Minimum reclaim for eviction due to pid available signal. Only take percentage value for now. Sample format: \"10%\". Must be <=10%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- }
- },
- "type": "object"
- },
- "EvictionSignals": {
- "description": "Eviction signals are the current state of a particular resource at a specific point in time. The kubelet uses eviction signals to make eviction decisions by comparing the signals to eviction thresholds, which are the minimum amount of the resource that should be available on the node.",
- "properties": {
- "imagefsAvailable": {
- "description": "Optional. Amount of storage available on filesystem that container runtime uses for storing images layers. If the container filesystem and image filesystem are not separate, then imagefs can store both image layers and writeable layers. Defines the amount of \"imagefs.available\" signal in kubelet. Default is unset, if not specified in the kubelet config. It takses percentage value for now. Sample format: \"30%\". Must be >= 15% and <= 50%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "imagefsInodesFree": {
- "description": "Optional. Amount of inodes available on filesystem that container runtime uses for storing images layers. Defines the amount of \"imagefs.inodesFree\" signal in kubelet. Default is unset, if not specified in the kubelet config. Linux only. It takses percentage value for now. Sample format: \"30%\". Must be >= 5% and <= 50%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "memoryAvailable": {
- "description": "Optional. Memory available (i.e. capacity - workingSet), in bytes. Defines the amount of \"memory.available\" signal in kubelet. Default is unset, if not specified in the kubelet config. Format: positive number + unit, e.g. 100Ki, 10Mi, 5Gi. Valid units are Ki, Mi, Gi. Must be >= 100Mi and <= 50% of the node's memory. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "nodefsAvailable": {
- "description": "Optional. Amount of storage available on filesystem that kubelet uses for volumes, daemon logs, etc. Defines the amount of \"nodefs.available\" signal in kubelet. Default is unset, if not specified in the kubelet config. It takses percentage value for now. Sample format: \"30%\". Must be >= 10% and <= 50%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "nodefsInodesFree": {
- "description": "Optional. Amount of inodes available on filesystem that kubelet uses for volumes, daemon logs, etc. Defines the amount of \"nodefs.inodesFree\" signal in kubelet. Default is unset, if not specified in the kubelet config. Linux only. It takses percentage value for now. Sample format: \"30%\". Must be >= 5% and <= 50%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "pidAvailable": {
- "description": "Optional. Amount of PID available for pod allocation. Defines the amount of \"pid.available\" signal in kubelet. Default is unset, if not specified in the kubelet config. It takses percentage value for now. Sample format: \"30%\". Must be >= 10% and <= 50%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- }
- },
- "type": "object"
- },
- "FastSocket": {
- "description": "Configuration of Fast Socket feature.",
- "properties": {
- "enabled": {
- "description": "Whether Fast Socket features are enabled in the node pool.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "GCPSecretManagerCertificateConfig": {
- "description": "GCPSecretManagerCertificateConfig configures a secret from [Secret Manager](https://cloud.google.com/secret-manager).",
- "properties": {
- "secretUri": {
- "description": "Secret URI, in the form \"projects/$PROJECT_ID/secrets/$SECRET_NAME/versions/$VERSION\". Version can be fixed (e.g. \"2\") or \"latest\"",
- "type": "string"
- }
- },
- "type": "object"
- },
- "GPUDirectConfig": {
- "description": "GPUDirectConfig specifies the GPU direct strategy on the node pool.",
- "properties": {
- "gpuDirectStrategy": {
- "description": "The type of GPU direct strategy to enable on the node pool.",
- "enum": [
- "GPU_DIRECT_STRATEGY_UNSPECIFIED",
- "RDMA"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value. No GPU Direct strategy is enabled on the node.",
- "GPUDirect-RDMA on A3 Ultra, and A4 machine types"
- ]
- }
- },
- "type": "object"
- },
- "GPUDriverInstallationConfig": {
- "description": "GPUDriverInstallationConfig specifies the version of GPU driver to be auto installed.",
- "properties": {
- "gpuDriverVersion": {
- "description": "Mode for how the GPU driver is installed.",
- "enum": [
- "GPU_DRIVER_VERSION_UNSPECIFIED",
- "INSTALLATION_DISABLED",
- "DEFAULT",
- "LATEST"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value is to not install any GPU driver.",
- "Disable GPU driver auto installation and needs manual installation",
- "\"Default\" GPU driver in COS and Ubuntu.",
- "\"Latest\" GPU driver in COS."
- ]
- }
- },
- "type": "object"
- },
- "GPUSharingConfig": {
- "description": "GPUSharingConfig represents the GPU sharing configuration for Hardware Accelerators.",
- "properties": {
- "gpuSharingStrategy": {
- "description": "The type of GPU sharing strategy to enable on the GPU node.",
- "enum": [
- "GPU_SHARING_STRATEGY_UNSPECIFIED",
- "TIME_SHARING",
- "MPS"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value.",
- "GPUs are time-shared between containers.",
- "GPUs are shared between containers with NVIDIA MPS."
- ]
- },
- "maxSharedClientsPerGpu": {
- "description": "The max number of containers that can share a physical GPU.",
- "format": "int64",
- "type": "string"
- }
- },
- "type": "object"
- },
- "GcfsConfig": {
- "description": "GcfsConfig contains configurations of Google Container File System (image streaming).",
- "properties": {
- "enabled": {
- "description": "Whether to use GCFS.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "HostConfig": {
- "description": "HostConfig configures the registry host under a given Server.",
- "properties": {
- "ca": {
- "description": "CA configures the registry host certificate.",
- "items": {
- "$ref": "#/$defs/CertificateConfig"
- },
- "type": "array"
- },
- "capabilities": {
- "description": "Capabilities represent the capabilities of the registry host, specifying what operations a host is capable of performing. If not set, containerd enables all capabilities by default.",
- "items": {
- "enum": [
- "HOST_CAPABILITY_UNSPECIFIED",
- "HOST_CAPABILITY_PULL",
- "HOST_CAPABILITY_RESOLVE",
- "HOST_CAPABILITY_PUSH"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "UNKNOWN should never be set.",
- "Pull represents the capability to fetch manifests and blobs by digest.",
- "Resolve represents the capability to fetch manifests by name.",
- "Push represents the capability to push blobs and manifests."
- ]
- },
- "type": "array"
- },
- "client": {
- "description": "Client configures the registry host client certificate and key.",
- "items": {
- "$ref": "#/$defs/CertificateConfigPair"
- },
- "type": "array"
- },
- "dialTimeout": {
- "description": "Specifies the maximum duration allowed for a connection attempt to complete. A shorter timeout helps reduce delays when falling back to the original registry if the mirror is unreachable. Maximum allowed value is 180s. If not set, containerd sets default 30s. The value should be a decimal number of seconds with an `s` suffix.",
- "format": "google-duration",
- "type": "string"
- },
- "header": {
- "description": "Header configures the registry host headers.",
- "items": {
- "$ref": "#/$defs/RegistryHeader"
- },
- "type": "array"
- },
- "host": {
- "description": "Host configures the registry host/mirror. It supports fully qualified domain names (FQDN) and IP addresses: Specifying port is supported. Wildcards are NOT supported. Examples: - my.customdomain.com - 10.0.1.2:5000",
- "type": "string"
- },
- "overridePath": {
- "description": "OverridePath is used to indicate the host's API root endpoint is defined in the URL path rather than by the API specification. This may be used with non-compliant OCI registries which are missing the /v2 prefix. If not set, containerd sets default false.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "HugepagesConfig": {
- "description": "Hugepages amount in both 2m and 1g size",
- "properties": {
- "hugepageSize1g": {
- "description": "Optional. Amount of 1G hugepages",
- "format": "int32",
- "type": "integer"
- },
- "hugepageSize2m": {
- "description": "Optional. Amount of 2M hugepages",
- "format": "int32",
- "type": "integer"
- }
- },
- "type": "object"
- },
- "LinuxNodeConfig": {
- "description": "Parameters that can be configured on Linux nodes.",
- "properties": {
- "cgroupMode": {
- "description": "cgroup_mode specifies the cgroup mode to be used on the node.",
- "enum": [
- "CGROUP_MODE_UNSPECIFIED",
- "CGROUP_MODE_V1",
- "CGROUP_MODE_V2"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "CGROUP_MODE_UNSPECIFIED is when unspecified cgroup configuration is used. The default for the GKE node OS image will be used.",
- "CGROUP_MODE_V1 specifies to use cgroupv1 for the cgroup configuration on the node image.",
- "CGROUP_MODE_V2 specifies to use cgroupv2 for the cgroup configuration on the node image."
- ]
- },
- "hugepages": {
- "$ref": "#/$defs/HugepagesConfig",
- "description": "Optional. Amounts for 2M and 1G hugepages"
- },
- "nodeKernelModuleLoading": {
- "$ref": "#/$defs/NodeKernelModuleLoading",
- "description": "Optional. Configuration for kernel module loading on nodes. When enabled, the node pool will be provisioned with a Container-Optimized OS image that enforces kernel module signature verification."
- },
- "swapConfig": {
- "$ref": "#/$defs/SwapConfig",
- "description": "Optional. Enables and configures swap space on nodes. If omitted, swap is disabled."
- },
- "sysctls": {
- "additionalProperties": {
- "type": "string"
- },
- "description": "The Linux kernel parameters to be applied to the nodes and all pods running on the nodes. The following parameters are supported. net.core.busy_poll net.core.busy_read net.core.netdev_max_backlog net.core.rmem_max net.core.rmem_default net.core.wmem_default net.core.wmem_max net.core.optmem_max net.core.somaxconn net.ipv4.tcp_rmem net.ipv4.tcp_wmem net.ipv4.tcp_tw_reuse net.ipv4.tcp_mtu_probing net.ipv4.tcp_max_orphans net.ipv4.tcp_max_tw_buckets net.ipv4.tcp_syn_retries net.ipv4.tcp_ecn net.ipv4.tcp_congestion_control net.netfilter.nf_conntrack_max net.netfilter.nf_conntrack_buckets net.netfilter.nf_conntrack_tcp_timeout_close_wait net.netfilter.nf_conntrack_tcp_timeout_time_wait net.netfilter.nf_conntrack_tcp_timeout_established net.netfilter.nf_conntrack_acct kernel.shmmni kernel.shmmax kernel.shmall kernel.perf_event_paranoid kernel.sched_rt_runtime_us kernel.softlockup_panic kernel.yama.ptrace_scope kernel.kptr_restrict kernel.dmesg_restrict kernel.sysrq fs.aio-max-nr fs.file-max fs.inotify.max_user_instances fs.inotify.max_user_watches fs.nr_open vm.dirty_background_ratio vm.dirty_background_bytes vm.dirty_expire_centisecs vm.dirty_ratio vm.dirty_bytes vm.dirty_writeback_centisecs vm.max_map_count vm.overcommit_memory vm.overcommit_ratio vm.vfs_cache_pressure vm.swappiness vm.watermark_scale_factor vm.min_free_kbytes",
- "type": "object"
- },
- "transparentHugepageDefrag": {
- "description": "Optional. Defines the transparent hugepage defrag configuration on the node. VM hugepage allocation can be managed by either limiting defragmentation for delayed allocation or skipping it entirely for immediate allocation only. See https://docs.kernel.org/admin-guide/mm/transhuge.html for more details.",
- "enum": [
- "TRANSPARENT_HUGEPAGE_DEFRAG_UNSPECIFIED",
- "TRANSPARENT_HUGEPAGE_DEFRAG_ALWAYS",
- "TRANSPARENT_HUGEPAGE_DEFRAG_DEFER",
- "TRANSPARENT_HUGEPAGE_DEFRAG_DEFER_WITH_MADVISE",
- "TRANSPARENT_HUGEPAGE_DEFRAG_MADVISE",
- "TRANSPARENT_HUGEPAGE_DEFRAG_NEVER"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value. GKE will not modify the kernel configuration.",
- "It means that an application requesting THP will stall on allocation failure and directly reclaim pages and compact memory in an effort to allocate a THP immediately.",
- "It means that an application will wake kswapd in the background to reclaim pages and wake kcompactd to compact memory so that THP is available in the near future. It's the responsibility of khugepaged to then install the THP pages later.",
- "It means that an application will enter direct reclaim and compaction like always, but only for regions that have used madvise(MADV_HUGEPAGE); all other regions will wake kswapd in the background to reclaim pages and wake kcompactd to compact memory so that THP is available in the near future.",
- "It means that an application will enter direct reclaim like always but only for regions that are have used madvise(MADV_HUGEPAGE). This is the default kernel configuration.",
- "It means that an application will never enter direct reclaim or compaction."
- ]
- },
- "transparentHugepageEnabled": {
- "description": "Optional. Transparent hugepage support for anonymous memory can be entirely disabled (mostly for debugging purposes) or only enabled inside MADV_HUGEPAGE regions (to avoid the risk of consuming more memory resources) or enabled system wide. See https://docs.kernel.org/admin-guide/mm/transhuge.html for more details.",
- "enum": [
- "TRANSPARENT_HUGEPAGE_ENABLED_UNSPECIFIED",
- "TRANSPARENT_HUGEPAGE_ENABLED_ALWAYS",
- "TRANSPARENT_HUGEPAGE_ENABLED_MADVISE",
- "TRANSPARENT_HUGEPAGE_ENABLED_NEVER"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value. GKE will not modify the kernel configuration.",
- "Transparent hugepage support for anonymous memory is enabled system wide.",
- "Transparent hugepage support for anonymous memory is enabled inside MADV_HUGEPAGE regions. This is the default kernel configuration.",
- "Transparent hugepage support for anonymous memory is disabled."
- ]
- }
- },
- "type": "object"
- },
- "LocalNvmeSsdBlockConfig": {
- "description": "LocalNvmeSsdBlockConfig contains configuration for using raw-block local NVMe SSDs",
- "properties": {
- "localSsdCount": {
- "description": "Number of local NVMe SSDs to use. The limit for this value is dependent upon the maximum number of disk available on a machine per zone. See: https://cloud.google.com/compute/docs/disks/local-ssd for more information. A zero (or unset) value has different meanings depending on machine type being used: 1. For pre-Gen3 machines, which support flexible numbers of local ssds, zero (or unset) means to disable using local SSDs as ephemeral storage. 2. For Gen3 machines which dictate a specific number of local ssds, zero (or unset) means to use the default number of local ssds that goes with that machine type. For example, for a c3-standard-8-lssd machine, 2 local ssds would be provisioned. For c3-standard-8 (which doesn't support local ssds), 0 will be provisioned. See https://cloud.google.com/compute/docs/disks/local-ssd#choose_number_local_ssds for more info.",
- "format": "int32",
- "type": "integer"
- }
- },
- "type": "object"
- },
- "LoggingVariantConfig": {
- "description": "LoggingVariantConfig specifies the behaviour of the logging component.",
- "properties": {
- "variant": {
- "description": "Logging variant deployed on nodes.",
- "enum": [
- "VARIANT_UNSPECIFIED",
- "DEFAULT",
- "MAX_THROUGHPUT"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value. This shouldn't be used.",
- "default logging variant.",
- "maximum logging throughput variant."
- ]
- }
- },
- "type": "object"
- },
- "MaxPodsConstraint": {
- "description": "Constraints applied to pods.",
- "properties": {
- "maxPodsPerNode": {
- "description": "Constraint enforced on the max num of pods per node.",
- "format": "int64",
- "type": "string"
- }
- },
- "type": "object"
- },
- "MemoryManager": {
- "description": "The option enables the Kubernetes NUMA-aware Memory Manager feature. Detailed description about the feature can be found [here](https://kubernetes.io/docs/tasks/administer-cluster/memory-manager/).",
- "properties": {
- "policy": {
- "description": "Controls the memory management policy on the Node. See https://kubernetes.io/docs/tasks/administer-cluster/memory-manager/#policies The following values are allowed. * \"none\" * \"static\" The default value is 'none' if unspecified.",
- "type": "string"
- }
- },
- "type": "object"
- },
- "NetworkPerformanceConfig": {
- "description": "Configuration of all network bandwidth tiers",
- "properties": {
- "totalEgressBandwidthTier": {
- "description": "Specifies the total network bandwidth tier for the NodePool.",
- "enum": [
- "TIER_UNSPECIFIED",
- "TIER_1"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value",
- "Higher bandwidth, actual values based on VM size."
- ]
- }
- },
- "type": "object"
- },
- "NetworkTierConfig": {
- "description": "NetworkTierConfig contains network tier information.",
- "properties": {
- "networkTier": {
- "description": "Network tier configuration.",
- "enum": [
- "NETWORK_TIER_UNSPECIFIED",
- "NETWORK_TIER_DEFAULT",
- "NETWORK_TIER_PREMIUM",
- "NETWORK_TIER_STANDARD"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "By default, use project-level configuration. When unspecified, the behavior defaults to NETWORK_TIER_DEFAULT. For cluster updates, this implies no action (no-op).",
- "Default network tier. Use project-level configuration. User can specify this value, meaning they want to keep the same behaviour as before cluster level network tier configuration is introduced. This field ensures backward compatibility for the network tier of cluster resources, such as node pools and load balancers, for their external IP addresses.",
- "Premium network tier.",
- "Standard network tier."
- ]
- }
- },
- "type": "object"
- },
- "NodeAffinity": {
- "description": "Specifies the NodeAffinity key, values, and affinity operator according to [shared sole tenant node group affinities](https://cloud.google.com/compute/docs/nodes/sole-tenant-nodes#node_affinity_and_anti-affinity).",
- "properties": {
- "key": {
- "description": "Key for NodeAffinity.",
- "type": "string"
- },
- "operator": {
- "description": "Operator for NodeAffinity.",
- "enum": [
- "OPERATOR_UNSPECIFIED",
- "IN",
- "NOT_IN"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Invalid or unspecified affinity operator.",
- "Affinity operator.",
- "Anti-affinity operator."
- ]
- },
- "values": {
- "description": "Values for NodeAffinity.",
- "items": {
- "type": "string"
- },
- "type": "array"
- }
- },
- "type": "object"
- },
- "NodeConfig": {
- "description": "Parameters that describe the nodes in a cluster. GKE Autopilot clusters do not recognize parameters in `NodeConfig`. Use AutoprovisioningNodePoolDefaults instead.",
- "properties": {
- "accelerators": {
- "description": "A list of hardware accelerators to be attached to each node. See https://cloud.google.com/compute/docs/gpus for more information about support for GPUs.",
- "items": {
- "$ref": "#/$defs/AcceleratorConfig"
- },
- "type": "array"
- },
- "advancedMachineFeatures": {
- "$ref": "#/$defs/AdvancedMachineFeatures",
- "description": "Advanced features for the Compute Engine VM."
- },
- "bootDisk": {
- "$ref": "#/$defs/BootDisk",
- "description": "The boot disk configuration for the node pool."
- },
- "bootDiskKmsKey": {
- "description": " The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption",
- "type": "string"
- },
- "confidentialNodes": {
- "$ref": "#/$defs/ConfidentialNodes",
- "description": "Confidential nodes config. All the nodes in the node pool will be Confidential VM once enabled."
- },
- "consolidationDelay": {
- "description": "Consolidation delay defines duration after which the Cluster Autoscaler can scale down underutilized nodes. If not set, nodes are scaled down by default behavior, i.e. according to the chosen autoscaling profile.",
- "format": "google-duration",
- "type": "string"
- },
- "containerdConfig": {
- "$ref": "#/$defs/ContainerdConfig",
- "description": "Parameters for containerd customization."
- },
- "diskSizeGb": {
- "description": "Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB. If unspecified, the default disk size is 100GB.",
- "format": "int32",
- "type": "integer"
- },
- "diskType": {
- "description": "Type of the disk attached to each node (e.g. 'pd-standard', 'pd-ssd' or 'pd-balanced') If unspecified, the default disk type is 'pd-standard'",
- "type": "string"
- },
- "effectiveCgroupMode": {
- "description": "Output only. effective_cgroup_mode is the cgroup mode actually used by the node pool. It is determined by the cgroup mode specified in the LinuxNodeConfig or the default cgroup mode based on the cluster creation version.",
- "enum": [
- "EFFECTIVE_CGROUP_MODE_UNSPECIFIED",
- "EFFECTIVE_CGROUP_MODE_V1",
- "EFFECTIVE_CGROUP_MODE_V2"
- ],
- "readOnly": true,
- "type": "string",
- "x-google-enum-descriptions": [
- "EFFECTIVE_CGROUP_MODE_UNSPECIFIED means the cgroup configuration for the node pool is unspecified, i.e. the node pool is a Windows node pool.",
- "CGROUP_MODE_V1 means the node pool is configured to use cgroupv1 for the cgroup configuration.",
- "CGROUP_MODE_V2 means the node pool is configured to use cgroupv2 for the cgroup configuration."
- ]
- },
- "enableConfidentialStorage": {
- "description": "Optional. Reserved for future use.",
- "type": "boolean"
- },
- "ephemeralStorageLocalSsdConfig": {
- "$ref": "#/$defs/EphemeralStorageLocalSsdConfig",
- "description": "Parameters for the node ephemeral storage using Local SSDs. If unspecified, ephemeral storage is backed by the boot disk."
- },
- "fastSocket": {
- "$ref": "#/$defs/FastSocket",
- "description": "Enable or disable NCCL fast socket for the node pool."
- },
- "flexStart": {
- "description": "Flex Start flag for enabling Flex Start VM.",
- "type": "boolean"
- },
- "gcfsConfig": {
- "$ref": "#/$defs/GcfsConfig",
- "description": "Google Container File System (image streaming) configs."
- },
- "gpuDirectConfig": {
- "$ref": "#/$defs/GPUDirectConfig",
- "description": "The configuration for GPU Direct"
- },
- "gvnic": {
- "$ref": "#/$defs/VirtualNIC",
- "description": "Enable or disable gvnic in the node pool."
- },
- "imageType": {
- "description": "The image type to use for this node. Note that for a given image type, the latest version of it will be used. Please see https://cloud.google.com/kubernetes-engine/docs/concepts/node-images for available image types.",
- "type": "string"
- },
- "kubeletConfig": {
- "$ref": "#/$defs/NodeKubeletConfig",
- "description": "Node kubelet configs."
- },
- "labels": {
- "additionalProperties": {
- "type": "string"
- },
- "description": "The map of Kubernetes labels (key/value pairs) to be applied to each node. These will added in addition to any default label(s) that Kubernetes may apply to the node. In case of conflict in label keys, the applied set may differ depending on the Kubernetes version -- it's best to assume the behavior is undefined and conflicts should be avoided. For more information, including usage and the valid values, see: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/",
- "type": "object"
- },
- "linuxNodeConfig": {
- "$ref": "#/$defs/LinuxNodeConfig",
- "description": "Parameters that can be configured on Linux nodes."
- },
- "localNvmeSsdBlockConfig": {
- "$ref": "#/$defs/LocalNvmeSsdBlockConfig",
- "description": "Parameters for using raw-block Local NVMe SSDs."
- },
- "localSsdCount": {
- "description": "The number of local SSD disks to be attached to the node. The limit for this value is dependent upon the maximum number of disks available on a machine per zone. See: https://cloud.google.com/compute/docs/disks/local-ssd for more information.",
- "format": "int32",
- "type": "integer"
- },
- "localSsdEncryptionMode": {
- "description": "Specifies which method should be used for encrypting the Local SSDs attached to the node.",
- "enum": [
- "LOCAL_SSD_ENCRYPTION_MODE_UNSPECIFIED",
- "STANDARD_ENCRYPTION",
- "EPHEMERAL_KEY_ENCRYPTION"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "The given node will be encrypted using keys managed by Google infrastructure and the keys will be deleted when the node is deleted.",
- "The given node will be encrypted using keys managed by Google infrastructure and the keys will be deleted when the node is deleted.",
- "The given node will opt-in for using ephemeral key for encryption of Local SSDs. The Local SSDs will not be able to recover data in case of node crash."
- ]
- },
- "loggingConfig": {
- "$ref": "#/$defs/NodePoolLoggingConfig",
- "description": "Logging configuration."
- },
- "machineType": {
- "description": "The name of a Google Compute Engine [machine type](https://cloud.google.com/compute/docs/machine-types) If unspecified, the default machine type is `e2-medium`.",
- "type": "string"
- },
- "maxRunDuration": {
- "description": "The maximum duration for the nodes to exist. If unspecified, the nodes can exist indefinitely.",
- "format": "google-duration",
- "type": "string"
- },
- "metadata": {
- "additionalProperties": {
- "type": "string"
- },
- "description": "The metadata key/value pairs assigned to instances in the cluster. Keys must conform to the regexp `[a-zA-Z0-9-_]+` and be less than 128 bytes in length. These are reflected as part of a URL in the metadata server. Additionally, to avoid ambiguity, keys must not conflict with any other metadata keys for the project or be one of the reserved keys: - \"cluster-location\" - \"cluster-name\" - \"cluster-uid\" - \"configure-sh\" - \"containerd-configure-sh\" - \"enable-os-login\" - \"gci-ensure-gke-docker\" - \"gci-metrics-enabled\" - \"gci-update-strategy\" - \"instance-template\" - \"kube-env\" - \"startup-script\" - \"user-data\" - \"disable-address-manager\" - \"windows-startup-script-ps1\" - \"common-psm1\" - \"k8s-node-setup-psm1\" - \"install-ssh-psm1\" - \"user-profile-psm1\" Values are free-form strings, and only have meaning as interpreted by the image running in the instance. The only restriction placed on them is that each value's size must be less than or equal to 32 KB. The total size of all keys and values must be less than 512 KB.",
- "type": "object"
- },
- "minCpuPlatform": {
- "description": "Minimum CPU platform to be used by this instance. The instance may be scheduled on the specified or newer CPU platform. Applicable values are the friendly names of CPU platforms, such as `minCpuPlatform: \"Intel Haswell\"` or `minCpuPlatform: \"Intel Sandy Bridge\"`. For more information, read [how to specify min CPU platform](https://cloud.google.com/compute/docs/instances/specify-min-cpu-platform)",
- "type": "string"
- },
- "nodeGroup": {
- "description": "Setting this field will assign instances of this pool to run on the specified node group. This is useful for running workloads on [sole tenant nodes](https://cloud.google.com/compute/docs/nodes/sole-tenant-nodes).",
- "type": "string"
- },
- "oauthScopes": {
- "description": "The set of Google API scopes to be made available on all of the node VMs under the \"default\" service account. The following scopes are recommended, but not required, and by default are not included: * `https://www.googleapis.com/auth/compute` is required for mounting persistent storage on your nodes. * `https://www.googleapis.com/auth/devstorage.read_only` is required for communicating with **gcr.io** (the [Artifact Registry](https://cloud.google.com/artifact-registry/)). If unspecified, no scopes are added, unless Cloud Logging or Cloud Monitoring are enabled, in which case their required scopes will be added.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "preemptible": {
- "description": "Whether the nodes are created as preemptible VM instances. See: https://cloud.google.com/compute/docs/instances/preemptible for more information about preemptible VM instances.",
- "type": "boolean"
- },
- "reservationAffinity": {
- "$ref": "#/$defs/ReservationAffinity",
- "description": "The optional reservation affinity. Setting this field will apply the specified [Zonal Compute Reservation](https://cloud.google.com/compute/docs/instances/reserving-zonal-resources) to this node pool."
- },
- "resourceLabels": {
- "additionalProperties": {
- "type": "string"
- },
- "description": "The resource labels for the node pool to use to annotate any related Google Compute Engine resources.",
- "type": "object"
- },
- "resourceManagerTags": {
- "$ref": "#/$defs/ResourceManagerTags",
- "description": "A map of resource manager tag keys and values to be attached to the nodes."
- },
- "sandboxConfig": {
- "$ref": "#/$defs/SandboxConfig",
- "description": "Sandbox configuration for this node."
- },
- "secondaryBootDiskUpdateStrategy": {
- "$ref": "#/$defs/SecondaryBootDiskUpdateStrategy",
- "description": "Secondary boot disk update strategy."
- },
- "secondaryBootDisks": {
- "description": "List of secondary boot disks attached to the nodes.",
- "items": {
- "$ref": "#/$defs/SecondaryBootDisk"
- },
- "type": "array"
- },
- "serviceAccount": {
- "description": "The Google Cloud Platform Service Account to be used by the node VMs. Specify the email address of the Service Account; otherwise, if no Service Account is specified, the \"default\" service account is used.",
- "type": "string"
- },
- "shieldedInstanceConfig": {
- "$ref": "#/$defs/ShieldedInstanceConfig",
- "description": "Shielded Instance options."
- },
- "soleTenantConfig": {
- "$ref": "#/$defs/SoleTenantConfig",
- "description": "Parameters for node pools to be backed by shared sole tenant node groups."
- },
- "spot": {
- "description": "Spot flag for enabling Spot VM, which is a rebrand of the existing preemptible flag.",
- "type": "boolean"
- },
- "storagePools": {
- "description": "List of Storage Pools where boot disks are provisioned.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "tags": {
- "description": "The list of instance tags applied to all nodes. Tags are used to identify valid sources or targets for network firewalls and are specified by the client during cluster or node pool creation. Each tag within the list must comply with RFC1035.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "taintConfig": {
- "$ref": "#/$defs/TaintConfig",
- "description": "Optional. The taint configuration for the node pool."
- },
- "taints": {
- "description": "List of kubernetes taints to be applied to each node. For more information, including usage and the valid values, see: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/",
- "items": {
- "$ref": "#/$defs/NodeTaint"
- },
- "type": "array"
- },
- "windowsNodeConfig": {
- "$ref": "#/$defs/WindowsNodeConfig",
- "description": "Parameters that can be configured on Windows nodes."
- },
- "workloadMetadataConfig": {
- "$ref": "#/$defs/WorkloadMetadataConfig",
- "description": "The workload metadata configuration for this node."
- }
- },
- "type": "object"
- },
- "NodeDrainConfig": {
- "description": "NodeDrainConfig contains the node drain related configurations for this nodepool.",
- "properties": {
- "respectPdbDuringNodePoolDeletion": {
- "description": "Whether to respect PDB during node pool deletion.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "NodeKernelModuleLoading": {
- "description": "Configuration for kernel module loading on nodes.",
- "properties": {
- "policy": {
- "description": "Set the node module loading policy for nodes in the node pool.",
- "enum": [
- "POLICY_UNSPECIFIED",
- "ENFORCE_SIGNED_MODULES",
- "DO_NOT_ENFORCE_SIGNED_MODULES"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default behavior. GKE selects the image based on node type. For CPU and TPU nodes, the image will not allow loading external kernel modules. For GPU nodes, the image will allow loading any module, whether it is signed or not.",
- "Enforced signature verification: Node pools will use a Container-Optimized OS image configured to allow loading of *Google-signed* external kernel modules. Loadpin is enabled but configured to exclude modules, and kernel module signature checking is enforced.",
- "Mirrors existing DEFAULT behavior: For CPU and TPU nodes, the image will not allow loading external kernel modules. For GPU nodes, the image will allow loading any module, whether it is signed or not."
- ]
- }
- },
- "type": "object"
- },
- "NodeKubeletConfig": {
- "description": "Node kubelet configs.",
- "properties": {
- "allowedUnsafeSysctls": {
- "description": "Optional. Defines a comma-separated allowlist of unsafe sysctls or sysctl patterns (ending in `*`). The unsafe namespaced sysctl groups are `kernel.shm*`, `kernel.msg*`, `kernel.sem`, `fs.mqueue.*`, and `net.*`. Leaving this allowlist empty means they cannot be set on Pods. To allow certain sysctls or sysctl patterns to be set on Pods, list them separated by commas. For example: `kernel.msg*,net.ipv4.route.min_pmtu`. See https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ for more details.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "containerLogMaxFiles": {
- "description": "Optional. Defines the maximum number of container log files that can be present for a container. See https://kubernetes.io/docs/concepts/cluster-administration/logging/#log-rotation The value must be an integer between 2 and 10, inclusive. The default value is 5 if unspecified.",
- "format": "int32",
- "type": "integer"
- },
- "containerLogMaxSize": {
- "description": "Optional. Defines the maximum size of the container log file before it is rotated. See https://kubernetes.io/docs/concepts/cluster-administration/logging/#log-rotation Valid format is positive number + unit, e.g. 100Ki, 10Mi. Valid units are Ki, Mi, Gi. The value must be between 10Mi and 500Mi, inclusive. Note that the total container log size (container_log_max_size * container_log_max_files) cannot exceed 1% of the total storage of the node, to avoid disk pressure caused by log files. The default value is 10Mi if unspecified.",
- "type": "string"
- },
- "cpuCfsQuota": {
- "description": "Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.",
- "type": "boolean"
- },
- "cpuCfsQuotaPeriod": {
- "description": "Set the CPU CFS quota period value 'cpu.cfs_period_us'. The string must be a sequence of decimal numbers, each with optional fraction and a unit suffix, such as \"300ms\". Valid time units are \"ns\", \"us\" (or \"µs\"), \"ms\", \"s\", \"m\", \"h\". The value must be a positive duration between 1ms and 1 second, inclusive.",
- "type": "string"
- },
- "cpuManagerPolicy": {
- "description": "Control the CPU management policy on the node. See https://kubernetes.io/docs/tasks/administer-cluster/cpu-management-policies/ The following values are allowed. * \"none\": the default, which represents the existing scheduling behavior. * \"static\": allows pods with certain resource characteristics to be granted increased CPU affinity and exclusivity on the node. The default value is 'none' if unspecified.",
- "type": "string"
- },
- "crashLoopBackOff": {
- "$ref": "#/$defs/CrashLoopBackOffConfig",
- "description": "Optional. Contains configuration options to modify node-level parameters for container restart behavior."
- },
- "evictionMaxPodGracePeriodSeconds": {
- "description": "Optional. eviction_max_pod_grace_period_seconds is the maximum allowed grace period (in seconds) to use when terminating pods in response to a soft eviction threshold being met. This value effectively caps the Pod's terminationGracePeriodSeconds value during soft evictions. Default: 0. Range: [0, 300].",
- "format": "int32",
- "type": "integer"
- },
- "evictionMinimumReclaim": {
- "$ref": "#/$defs/EvictionMinimumReclaim",
- "description": "Optional. eviction_minimum_reclaim is a map of signal names to quantities that defines minimum reclaims, which describe the minimum amount of a given resource the kubelet will reclaim when performing a pod eviction while that resource is under pressure."
- },
- "evictionSoft": {
- "$ref": "#/$defs/EvictionSignals",
- "description": "Optional. eviction_soft is a map of signal names to quantities that defines soft eviction thresholds. Each signal is compared to its corresponding threshold to determine if a pod eviction should occur."
- },
- "evictionSoftGracePeriod": {
- "$ref": "#/$defs/EvictionGracePeriod",
- "description": "Optional. eviction_soft_grace_period is a map of signal names to quantities that defines grace periods for each soft eviction signal. The grace period is the amount of time that a pod must be under pressure before an eviction occurs."
- },
- "imageGcHighThresholdPercent": {
- "description": "Optional. Defines the percent of disk usage after which image garbage collection is always run. The percent is calculated as this field value out of 100. The value must be between 10 and 85, inclusive and greater than image_gc_low_threshold_percent. The default value is 85 if unspecified.",
- "format": "int32",
- "type": "integer"
- },
- "imageGcLowThresholdPercent": {
- "description": "Optional. Defines the percent of disk usage before which image garbage collection is never run. Lowest disk usage to garbage collect to. The percent is calculated as this field value out of 100. The value must be between 10 and 85, inclusive and smaller than image_gc_high_threshold_percent. The default value is 80 if unspecified.",
- "format": "int32",
- "type": "integer"
- },
- "imageMaximumGcAge": {
- "description": "Optional. Defines the maximum age an image can be unused before it is garbage collected. The string must be a sequence of decimal numbers, each with optional fraction and a unit suffix, such as \"300s\", \"1.5h\", and \"2h45m\". Valid time units are \"ns\", \"us\" (or \"µs\"), \"ms\", \"s\", \"m\", \"h\". The value must be a positive duration greater than image_minimum_gc_age or \"0s\". The default value is \"0s\" if unspecified, which disables this field, meaning images won't be garbage collected based on being unused for too long.",
- "type": "string"
- },
- "imageMinimumGcAge": {
- "description": "Optional. Defines the minimum age for an unused image before it is garbage collected. The string must be a sequence of decimal numbers, each with optional fraction and a unit suffix, such as \"300s\", \"1.5h\", and \"2h45m\". Valid time units are \"ns\", \"us\" (or \"µs\"), \"ms\", \"s\", \"m\", \"h\". The value must be a positive duration less than or equal to 2 minutes. The default value is \"2m0s\" if unspecified.",
- "type": "string"
- },
- "insecureKubeletReadonlyPortEnabled": {
- "description": "Enable or disable Kubelet read only port.",
- "type": "boolean"
- },
- "maxParallelImagePulls": {
- "description": "Optional. Defines the maximum number of image pulls in parallel. The range is 2 to 5, inclusive. The default value is 2 or 3 depending on the disk type. See https://kubernetes.io/docs/concepts/containers/images/#maximum-parallel-image-pulls for more details.",
- "format": "int32",
- "type": "integer"
- },
- "memoryManager": {
- "$ref": "#/$defs/MemoryManager",
- "description": "Optional. Controls NUMA-aware Memory Manager configuration on the node. For more information, see: https://kubernetes.io/docs/tasks/administer-cluster/memory-manager/"
- },
- "podPidsLimit": {
- "description": "Set the Pod PID limits. See https://kubernetes.io/docs/concepts/policy/pid-limiting/#pod-pid-limits Controls the maximum number of processes allowed to run in a pod. The value must be greater than or equal to 1024 and less than 4194304.",
- "format": "int64",
- "type": "string"
- },
- "shutdownGracePeriodCriticalPodsSeconds": {
- "description": "Optional. shutdown_grace_period_critical_pods_seconds is the maximum allowed grace period (in seconds) used to terminate critical pods during a node shutdown. This value should be <= shutdown_grace_period_seconds, and is only valid if shutdown_grace_period_seconds is set. https://kubernetes.io/docs/concepts/cluster-administration/node-shutdown/ Range: [0, 120].",
- "format": "int32",
- "type": "integer"
- },
- "shutdownGracePeriodSeconds": {
- "description": "Optional. shutdown_grace_period_seconds is the maximum allowed grace period (in seconds) the total duration that the node should delay the shutdown during a graceful shutdown. This is the total grace period for pod termination for both regular and critical pods. https://kubernetes.io/docs/concepts/cluster-administration/node-shutdown/ If set to 0, node will not enable the graceful node shutdown functionality. This field is only valid for Spot VMs. Allowed values: 0, 30, 120.",
- "format": "int32",
- "type": "integer"
- },
- "singleProcessOomKill": {
- "description": "Optional. Defines whether to enable single process OOM killer. If true, will prevent the memory.oom.group flag from being set for container cgroups in cgroups v2. This causes processes in the container to be OOM killed individually instead of as a group.",
- "type": "boolean"
- },
- "topologyManager": {
- "$ref": "#/$defs/TopologyManager",
- "description": "Optional. Controls Topology Manager configuration on the node. For more information, see: https://kubernetes.io/docs/tasks/administer-cluster/topology-manager/"
- }
- },
- "type": "object"
- },
- "NodeManagement": {
- "description": "NodeManagement defines the set of node management services turned on for the node pool.",
- "properties": {
- "autoRepair": {
- "description": "A flag that specifies whether the node auto-repair is enabled for the node pool. If enabled, the nodes in this node pool will be monitored and, if they fail health checks too many times, an automatic repair action will be triggered.",
- "type": "boolean"
- },
- "autoUpgrade": {
- "description": "A flag that specifies whether node auto-upgrade is enabled for the node pool. If enabled, node auto-upgrade helps keep the nodes in your node pool up to date with the latest release version of Kubernetes.",
- "type": "boolean"
- },
- "upgradeOptions": {
- "$ref": "#/$defs/AutoUpgradeOptions",
- "description": "Specifies the Auto Upgrade knobs for the node pool."
- }
- },
- "type": "object"
- },
- "NodeNetworkConfig": {
- "description": "Parameters for node pool-level network config.",
- "properties": {
- "additionalNodeNetworkConfigs": {
- "description": "We specify the additional node networks for this node pool using this list. Each node network corresponds to an additional interface",
- "items": {
- "$ref": "#/$defs/AdditionalNodeNetworkConfig"
- },
- "type": "array"
- },
- "additionalPodNetworkConfigs": {
- "description": "We specify the additional pod networks for this node pool using this list. Each pod network corresponds to an additional alias IP range for the node",
- "items": {
- "$ref": "#/$defs/AdditionalPodNetworkConfig"
- },
- "type": "array"
- },
- "createPodRange": {
- "description": "Input only. Whether to create a new range for pod IPs in this node pool. Defaults are provided for `pod_range` and `pod_ipv4_cidr_block` if they are not specified. If neither `create_pod_range` or `pod_range` are specified, the cluster-level default (`ip_allocation_policy.cluster_ipv4_cidr_block`) is used. Only applicable if `ip_allocation_policy.use_ip_aliases` is true. This field cannot be changed after the node pool has been created.",
- "type": "boolean",
- "writeOnly": true
- },
- "enablePrivateNodes": {
- "description": "Whether nodes have internal IP addresses only. If enable_private_nodes is not specified, then the value is derived from Cluster.NetworkConfig.default_enable_private_nodes",
- "type": "boolean"
- },
- "networkPerformanceConfig": {
- "$ref": "#/$defs/NetworkPerformanceConfig",
- "description": "Network bandwidth tier configuration."
- },
- "networkTierConfig": {
- "$ref": "#/$defs/NetworkTierConfig",
- "description": "Output only. The network tier configuration for the node pool inherits from the cluster-level configuration and remains immutable throughout the node pool's lifecycle, including during upgrades.",
- "readOnly": true
- },
- "podCidrOverprovisionConfig": {
- "$ref": "#/$defs/PodCIDROverprovisionConfig",
- "description": "[PRIVATE FIELD] Pod CIDR size overprovisioning config for the nodepool. Pod CIDR size per node depends on max_pods_per_node. By default, the value of max_pods_per_node is rounded off to next power of 2 and we then double that to get the size of pod CIDR block per node. Example: max_pods_per_node of 30 would result in 64 IPs (/26). This config can disable the doubling of IPs (we still round off to next power of 2) Example: max_pods_per_node of 30 will result in 32 IPs (/27) when overprovisioning is disabled."
- },
- "podIpv4CidrBlock": {
- "description": "The IP address range for pod IPs in this node pool. Only applicable if `create_pod_range` is true. Set to blank to have a range chosen with the default size. Set to /netmask (e.g. `/14`) to have a range chosen with a specific netmask. Set to a [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) to pick a specific range to use. Only applicable if `ip_allocation_policy.use_ip_aliases` is true. This field cannot be changed after the node pool has been created.",
- "type": "string"
- },
- "podIpv4RangeUtilization": {
- "description": "Output only. The utilization of the IPv4 range for the pod. The ratio is Usage/[Total number of IPs in the secondary range], Usage=numNodes*numZones*podIPsPerNode.",
- "format": "double",
- "readOnly": true,
- "type": "number"
- },
- "podRange": {
- "description": "The ID of the secondary range for pod IPs. If `create_pod_range` is true, this ID is used for the new range. If `create_pod_range` is false, uses an existing secondary range with this ID. Only applicable if `ip_allocation_policy.use_ip_aliases` is true. This field cannot be changed after the node pool has been created.",
- "type": "string"
- },
- "subnetwork": {
- "description": "Optional. The subnetwork name/path for the node pool. Format: projects/{project}/regions/{region}/subnetworks/{subnetwork} If the cluster is associated with multiple subnetworks, the subnetwork can be either: - A user supplied subnetwork name during node pool creation (e.g., `my-subnet`). The name must be between 1 and 63 characters long, start with a letter, contain only letters, numbers, and hyphens, and end with a letter or a number. - A full subnetwork path during node pool creation, such as `projects/gke-project/regions/us-central1/subnetworks/my-subnet` - A subnetwork path picked based on the IP utilization during node pool creation and is immutable.",
- "type": "string"
- }
- },
- "type": "object"
- },
- "NodePoolAutoscaling": {
- "description": "NodePoolAutoscaling contains information required by cluster autoscaler to adjust the size of the node pool to the current cluster usage.",
- "properties": {
- "autoprovisioned": {
- "description": "Can this node pool be deleted automatically.",
- "type": "boolean"
- },
- "enabled": {
- "description": "Is autoscaling enabled for this node pool.",
- "type": "boolean"
- },
- "locationPolicy": {
- "description": "Location policy used when scaling up a nodepool.",
- "enum": [
- "LOCATION_POLICY_UNSPECIFIED",
- "BALANCED",
- "ANY"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Not set.",
- "BALANCED is a best effort policy that aims to balance the sizes of different zones.",
- "ANY policy picks zones that have the highest capacity available."
- ]
- },
- "maxNodeCount": {
- "description": "Maximum number of nodes for one location in the node pool. Must be >= min_node_count. There has to be enough quota to scale up the cluster.",
- "format": "int32",
- "type": "integer"
- },
- "minNodeCount": {
- "description": "Minimum number of nodes for one location in the node pool. Must be greater than or equal to 0 and less than or equal to max_node_count.",
- "format": "int32",
- "type": "integer"
- },
- "totalMaxNodeCount": {
- "description": "Maximum number of nodes in the node pool. Must be greater than or equal to total_min_node_count. There has to be enough quota to scale up the cluster. The total_*_node_count fields are mutually exclusive with the *_node_count fields.",
- "format": "int32",
- "type": "integer"
- },
- "totalMinNodeCount": {
- "description": "Minimum number of nodes in the node pool. Must be greater than or equal to 0 and less than or equal to total_max_node_count. The total_*_node_count fields are mutually exclusive with the *_node_count fields.",
- "format": "int32",
- "type": "integer"
- }
- },
- "type": "object"
- },
- "NodePoolLoggingConfig": {
- "description": "NodePoolLoggingConfig specifies logging configuration for nodepools.",
- "properties": {
- "variantConfig": {
- "$ref": "#/$defs/LoggingVariantConfig",
- "description": "Logging variant configuration."
- }
- },
- "type": "object"
- },
- "NodeTaint": {
- "description": "Kubernetes taint is composed of three fields: key, value, and effect. Effect can only be one of three types: NoSchedule, PreferNoSchedule or NoExecute. See [here](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration) for more information, including usage and the valid values.",
- "properties": {
- "effect": {
- "description": "Effect for taint.",
- "enum": [
- "EFFECT_UNSPECIFIED",
- "NO_SCHEDULE",
- "PREFER_NO_SCHEDULE",
- "NO_EXECUTE"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Not set",
- "NoSchedule",
- "PreferNoSchedule",
- "NoExecute"
- ]
- },
- "key": {
- "description": "Key for taint.",
- "type": "string"
- },
- "value": {
- "description": "Value for taint.",
- "type": "string"
- }
- },
- "type": "object"
- },
- "PlacementPolicy": {
- "description": "PlacementPolicy defines the placement policy used by the node pool.",
- "properties": {
- "policyName": {
- "description": "If set, refers to the name of a custom resource policy supplied by the user. The resource policy must be in the same project and region as the node pool. If not found, InvalidArgument error is returned.",
- "type": "string"
- },
- "tpuTopology": {
- "description": "Optional. TPU placement topology for pod slice node pool. https://cloud.google.com/tpu/docs/types-topologies#tpu_topologies",
- "type": "string"
- },
- "type": {
- "description": "The type of placement.",
- "enum": [
- "TYPE_UNSPECIFIED",
- "COMPACT"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "TYPE_UNSPECIFIED specifies no requirements on nodes placement.",
- "COMPACT specifies node placement in the same availability domain to ensure low communication latency."
- ]
- }
- },
- "type": "object"
- },
- "PodCIDROverprovisionConfig": {
- "description": "[PRIVATE FIELD] Config for pod CIDR size overprovisioning.",
- "properties": {
- "disable": {
- "description": "Whether Pod CIDR overprovisioning is disabled. Note: Pod CIDR overprovisioning is enabled by default.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "PrivateRegistryAccessConfig": {
- "description": "PrivateRegistryAccessConfig contains access configuration for private container registries.",
- "properties": {
- "certificateAuthorityDomainConfig": {
- "description": "Private registry access configuration.",
- "items": {
- "$ref": "#/$defs/CertificateAuthorityDomainConfig"
- },
- "type": "array"
- },
- "enabled": {
- "description": "Private registry access is enabled.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "QueuedProvisioning": {
- "description": "QueuedProvisioning defines the queued provisioning used by the node pool.",
- "properties": {
- "enabled": {
- "description": "Denotes that this nodepool is QRM specific, meaning nodes can be only obtained through queuing via the Cluster Autoscaler ProvisioningRequest API.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "RegistryHeader": {
- "description": "RegistryHeader configures headers for the registry.",
- "properties": {
- "key": {
- "description": "Key configures the header key.",
- "type": "string"
- },
- "value": {
- "description": "Value configures the header value.",
- "items": {
- "type": "string"
- },
- "type": "array"
- }
- },
- "type": "object"
- },
- "RegistryHostConfig": {
- "description": "RegistryHostConfig configures the top-level structure for a single containerd registry server's configuration, which represents one hosts.toml file on the node. It will override the same fqdns in PrivateRegistryAccessConfig.",
- "properties": {
- "hosts": {
- "description": "HostConfig configures a list of host-specific configurations for the server. Each server can have at most 10 host configurations.",
- "items": {
- "$ref": "#/$defs/HostConfig"
- },
- "type": "array"
- },
- "server": {
- "description": "Defines the host name of the registry server, which will be used to create configuration file as /etc/containerd/hosts.d//hosts.toml. It supports fully qualified domain names (FQDN) and IP addresses: Specifying port is supported. Wildcards are NOT supported. Examples: - my.customdomain.com - 10.0.1.2:5000",
- "type": "string"
- }
- },
- "type": "object"
- },
- "ReservationAffinity": {
- "description": "[ReservationAffinity](https://cloud.google.com/compute/docs/instances/reserving-zonal-resources) is the configuration of desired reservation which instances could take capacity from.",
- "properties": {
- "consumeReservationType": {
- "description": "Corresponds to the type of reservation consumption.",
- "enum": [
- "UNSPECIFIED",
- "NO_RESERVATION",
- "ANY_RESERVATION",
- "SPECIFIC_RESERVATION"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value. This should not be used.",
- "Do not consume from any reserved capacity.",
- "Consume any reservation available.",
- "Must consume from a specific reservation. Must specify key value fields for specifying the reservations."
- ]
- },
- "key": {
- "description": "Corresponds to the label key of a reservation resource. To target a SPECIFIC_RESERVATION by name, specify \"compute.googleapis.com/reservation-name\" as the key and specify the name of your reservation as its value.",
- "type": "string"
- },
- "values": {
- "description": "Corresponds to the label value(s) of reservation resource(s).",
- "items": {
- "type": "string"
- },
- "type": "array"
- }
- },
- "type": "object"
- },
- "ResourceManagerTags": {
- "description": "A map of resource manager tag keys and values to be attached to the nodes for managing Compute Engine firewalls using Network Firewall Policies. Tags must be according to specifications in https://cloud.google.com/vpc/docs/tags-firewalls-overview#specifications. A maximum of 5 tag key-value pairs can be specified. Existing tags will be replaced with new values.",
- "properties": {
- "tags": {
- "additionalProperties": {
- "type": "string"
- },
- "description": "TagKeyValue must be in one of the following formats ([KEY]=[VALUE]) 1. `tagKeys/{tag_key_id}=tagValues/{tag_value_id}` 2. `{org_id}/{tag_key_name}={tag_value_name}` 3. `{project_id}/{tag_key_name}={tag_value_name}`",
- "type": "object"
- }
- },
- "type": "object"
- },
- "SandboxConfig": {
- "description": "SandboxConfig contains configurations of the sandbox to use for the node.",
- "properties": {
- "type": {
- "description": "Type of the sandbox to use for the node.",
- "enum": [
- "UNSPECIFIED",
- "GVISOR"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value. This should not be used.",
- "Run sandbox using gvisor."
- ]
- }
- },
- "type": "object"
- },
- "SecondaryBootDisk": {
- "description": "SecondaryBootDisk represents a persistent disk attached to a node with special configurations based on its mode.",
- "properties": {
- "diskImage": {
- "description": "Fully-qualified resource ID for an existing disk image.",
- "type": "string"
- },
- "mode": {
- "description": "Disk mode (container image cache, etc.)",
- "enum": [
- "MODE_UNSPECIFIED",
- "CONTAINER_IMAGE_CACHE"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "MODE_UNSPECIFIED is when mode is not set.",
- "CONTAINER_IMAGE_CACHE is for using the secondary boot disk as a container image cache."
- ]
- }
- },
- "type": "object"
- },
- "SecondaryBootDiskUpdateStrategy": {
- "description": "SecondaryBootDiskUpdateStrategy is a placeholder which will be extended in the future to define different options for updating secondary boot disks.",
- "type": "object"
- },
- "ShieldedInstanceConfig": {
- "description": "A set of Shielded Instance options.",
- "properties": {
- "enableIntegrityMonitoring": {
- "description": "Defines whether the instance has integrity monitoring enabled. Enables monitoring and attestation of the boot integrity of the instance. The attestation is performed against the integrity policy baseline. This baseline is initially derived from the implicitly trusted boot image when the instance is created.",
- "type": "boolean"
- },
- "enableSecureBoot": {
- "description": "Defines whether the instance has Secure Boot enabled. Secure Boot helps ensure that the system only runs authentic software by verifying the digital signature of all boot components, and halting the boot process if signature verification fails.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "SoleTenantConfig": {
- "description": "SoleTenantConfig contains the NodeAffinities to specify what shared sole tenant node groups should back the node pool.",
- "properties": {
- "minNodeCpus": {
- "description": "Optional. The minimum number of virtual CPUs this instance will consume when running on a sole-tenant node. This field can only be set if the node pool is created in a shared sole-tenant node group.",
- "format": "int32",
- "type": "integer"
- },
- "nodeAffinities": {
- "description": "NodeAffinities used to match to a shared sole tenant node group.",
- "items": {
- "$ref": "#/$defs/NodeAffinity"
- },
- "type": "array"
- }
- },
- "type": "object"
- },
- "StandardRolloutPolicy": {
- "description": "Standard rollout policy is the default policy for blue-green.",
- "properties": {
- "batchNodeCount": {
- "description": "Number of blue nodes to drain in a batch.",
- "format": "int32",
- "type": "integer"
- },
- "batchPercentage": {
- "description": "Percentage of the blue pool nodes to drain in a batch. The range of this field should be (0.0, 1.0].",
- "format": "float",
- "type": "number"
- },
- "batchSoakDuration": {
- "description": "Soak time after each batch gets drained. Default to zero.",
- "format": "google-duration",
- "type": "string"
- }
- },
- "type": "object"
- },
- "StatusCondition": {
- "description": "StatusCondition describes why a cluster or a node pool has a certain status (e.g., ERROR or DEGRADED).",
- "properties": {
- "canonicalCode": {
- "description": "Canonical code of the condition.",
- "enum": [
- "OK",
- "CANCELLED",
- "UNKNOWN",
- "INVALID_ARGUMENT",
- "DEADLINE_EXCEEDED",
- "NOT_FOUND",
- "ALREADY_EXISTS",
- "PERMISSION_DENIED",
- "UNAUTHENTICATED",
- "RESOURCE_EXHAUSTED",
- "FAILED_PRECONDITION",
- "ABORTED",
- "OUT_OF_RANGE",
- "UNIMPLEMENTED",
- "INTERNAL",
- "UNAVAILABLE",
- "DATA_LOSS"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Not an error; returned on success. HTTP Mapping: 200 OK",
- "The operation was cancelled, typically by the caller. HTTP Mapping: 499 Client Closed Request",
- "Unknown error. For example, this error may be returned when a `Status` value received from another address space belongs to an error space that is not known in this address space. Also errors raised by APIs that do not return enough error information may be converted to this error. HTTP Mapping: 500 Internal Server Error",
- "The client specified an invalid argument. Note that this differs from `FAILED_PRECONDITION`. `INVALID_ARGUMENT` indicates arguments that are problematic regardless of the state of the system (e.g., a malformed file name). HTTP Mapping: 400 Bad Request",
- "The deadline expired before the operation could complete. For operations that change the state of the system, this error may be returned even if the operation has completed successfully. For example, a successful response from a server could have been delayed long enough for the deadline to expire. HTTP Mapping: 504 Gateway Timeout",
- "Some requested entity (e.g., file or directory) was not found. Note to server developers: if a request is denied for an entire class of users, such as gradual feature rollout or undocumented allowlist, `NOT_FOUND` may be used. If a request is denied for some users within a class of users, such as user-based access control, `PERMISSION_DENIED` must be used. HTTP Mapping: 404 Not Found",
- "The entity that a client attempted to create (e.g., file or directory) already exists. HTTP Mapping: 409 Conflict",
- "The caller does not have permission to execute the specified operation. `PERMISSION_DENIED` must not be used for rejections caused by exhausting some resource (use `RESOURCE_EXHAUSTED` instead for those errors). `PERMISSION_DENIED` must not be used if the caller can not be identified (use `UNAUTHENTICATED` instead for those errors). This error code does not imply the request is valid or the requested entity exists or satisfies other pre-conditions. HTTP Mapping: 403 Forbidden",
- "The request does not have valid authentication credentials for the operation. HTTP Mapping: 401 Unauthorized",
- "Some resource has been exhausted, perhaps a per-user quota, or perhaps the entire file system is out of space. HTTP Mapping: 429 Too Many Requests",
- "The operation was rejected because the system is not in a state required for the operation's execution. For example, the directory to be deleted is non-empty, an rmdir operation is applied to a non-directory, etc. Service implementors can use the following guidelines to decide between `FAILED_PRECONDITION`, `ABORTED`, and `UNAVAILABLE`: (a) Use `UNAVAILABLE` if the client can retry just the failing call. (b) Use `ABORTED` if the client should retry at a higher level. For example, when a client-specified test-and-set fails, indicating the client should restart a read-modify-write sequence. (c) Use `FAILED_PRECONDITION` if the client should not retry until the system state has been explicitly fixed. For example, if an \"rmdir\" fails because the directory is non-empty, `FAILED_PRECONDITION` should be returned since the client should not retry unless the files are deleted from the directory. HTTP Mapping: 400 Bad Request",
- "The operation was aborted, typically due to a concurrency issue such as a sequencer check failure or transaction abort. See the guidelines above for deciding between `FAILED_PRECONDITION`, `ABORTED`, and `UNAVAILABLE`. HTTP Mapping: 409 Conflict",
- "The operation was attempted past the valid range. E.g., seeking or reading past end-of-file. Unlike `INVALID_ARGUMENT`, this error indicates a problem that may be fixed if the system state changes. For example, a 32-bit file system will generate `INVALID_ARGUMENT` if asked to read at an offset that is not in the range [0,2^32-1], but it will generate `OUT_OF_RANGE` if asked to read from an offset past the current file size. There is a fair bit of overlap between `FAILED_PRECONDITION` and `OUT_OF_RANGE`. We recommend using `OUT_OF_RANGE` (the more specific error) when it applies so that callers who are iterating through a space can easily look for an `OUT_OF_RANGE` error to detect when they are done. HTTP Mapping: 400 Bad Request",
- "The operation is not implemented or is not supported/enabled in this service. HTTP Mapping: 501 Not Implemented",
- "Internal errors. This means that some invariants expected by the underlying system have been broken. This error code is reserved for serious errors. HTTP Mapping: 500 Internal Server Error",
- "The service is currently unavailable. This is most likely a transient condition, which can be corrected by retrying with a backoff. Note that it is not always safe to retry non-idempotent operations. See the guidelines above for deciding between `FAILED_PRECONDITION`, `ABORTED`, and `UNAVAILABLE`. HTTP Mapping: 503 Service Unavailable",
- "Unrecoverable data loss or corruption. HTTP Mapping: 500 Internal Server Error"
- ]
- },
- "code": {
- "deprecated": true,
- "description": "Machine-friendly representation of the condition Deprecated. Use canonical_code instead.",
- "enum": [
- "UNKNOWN",
- "GCE_STOCKOUT",
- "GKE_SERVICE_ACCOUNT_DELETED",
- "GCE_QUOTA_EXCEEDED",
- "SET_BY_OPERATOR",
- "CLOUD_KMS_KEY_ERROR",
- "CA_EXPIRING",
- "NODE_SERVICE_ACCOUNT_MISSING_PERMISSIONS",
- "CLOUD_KMS_KEY_DESTROYED"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "UNKNOWN indicates a generic condition.",
- "GCE_STOCKOUT indicates that Google Compute Engine resources are temporarily unavailable.",
- "GKE_SERVICE_ACCOUNT_DELETED indicates that the user deleted their robot service account.",
- "Google Compute Engine quota was exceeded.",
- "Cluster state was manually changed by an SRE due to a system logic error.",
- "Unable to perform an encrypt operation against the CloudKMS key used for etcd level encryption.",
- "Cluster CA is expiring soon.",
- "Node service account is missing permissions.",
- "Cloud KMS key version used for etcd level encryption has been destroyed. This is a permanent error."
- ]
- },
- "message": {
- "description": "Human-friendly representation of the condition",
- "type": "string"
- }
- },
- "type": "object"
- },
- "SwapConfig": {
- "description": "Configuration for swap memory on a node pool.",
- "properties": {
- "bootDiskProfile": {
- "$ref": "#/$defs/BootDiskProfile",
- "description": "Swap on the node's boot disk."
- },
- "dedicatedLocalSsdProfile": {
- "$ref": "#/$defs/DedicatedLocalSsdProfile",
- "description": "Provisions a new, separate local NVMe SSD exclusively for swap."
- },
- "enabled": {
- "description": "Optional. Enables or disables swap for the node pool.",
- "type": "boolean"
- },
- "encryptionConfig": {
- "$ref": "#/$defs/EncryptionConfig",
- "description": "Optional. If omitted, swap space is encrypted by default."
- },
- "ephemeralLocalSsdProfile": {
- "$ref": "#/$defs/EphemeralLocalSsdProfile",
- "description": "Swap on the local SSD shared with pod ephemeral storage."
- }
- },
- "type": "object"
- },
- "TaintConfig": {
- "description": "TaintConfig contains the configuration for the taints of the node pool.",
- "properties": {
- "architectureTaintBehavior": {
- "description": "Optional. Controls architecture tainting behavior.",
- "enum": [
- "ARCHITECTURE_TAINT_BEHAVIOR_UNSPECIFIED",
- "NONE",
- "ARM"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Specifies that the behavior is unspecified, defaults to ARM.",
- "Disables default architecture taints on the node pool.",
- "Taints all the nodes in the node pool with the default ARM taint."
- ]
- }
- },
- "type": "object"
- },
- "TopologyManager": {
- "description": "TopologyManager defines the configuration options for Topology Manager feature. See https://kubernetes.io/docs/tasks/administer-cluster/topology-manager/",
- "properties": {
- "policy": {
- "description": "Configures the strategy for resource alignment. Allowed values are: * none: the default policy, and does not perform any topology alignment. * restricted: the topology manager stores the preferred NUMA node affinity for the container, and will reject the pod if the affinity if not preferred. * best-effort: the topology manager stores the preferred NUMA node affinity for the container. If the affinity is not preferred, the topology manager will admit the pod to the node anyway. * single-numa-node: the topology manager determines if the single NUMA node affinity is possible. If it is, Topology Manager will store this and the Hint Providers can then use this information when making the resource allocation decision. If, however, this is not possible then the Topology Manager will reject the pod from the node. This will result in a pod in a Terminated state with a pod admission failure. The default policy value is 'none' if unspecified. Details about each strategy can be found [here](https://kubernetes.io/docs/tasks/administer-cluster/topology-manager/#topology-manager-policies).",
- "type": "string"
- },
- "scope": {
- "description": "The Topology Manager aligns resources in following scopes: * container * pod The default scope is 'container' if unspecified. See https://kubernetes.io/docs/tasks/administer-cluster/topology-manager/#topology-manager-scopes",
- "type": "string"
- }
- },
- "type": "object"
- },
- "UpdateInfo": {
- "description": "UpdateInfo contains resource (instance groups, etc), status and other intermediate information relevant to a node pool upgrade.",
- "properties": {
- "blueGreenInfo": {
- "$ref": "#/$defs/BlueGreenInfo",
- "description": "Information of a blue-green upgrade."
- }
- },
- "type": "object"
- },
- "UpgradeSettings": {
- "description": "These upgrade settings control the level of parallelism and the level of disruption caused by an upgrade. maxUnavailable controls the number of nodes that can be simultaneously unavailable. maxSurge controls the number of additional nodes that can be added to the node pool temporarily for the time of the upgrade to increase the number of available nodes. (maxUnavailable + maxSurge) determines the level of parallelism (how many nodes are being upgraded at the same time). Note: upgrades inevitably introduce some disruption since workloads need to be moved from old nodes to new, upgraded ones. Even if maxUnavailable=0, this holds true. (Disruption stays within the limits of PodDisruptionBudget, if it is configured.) Consider a hypothetical node pool with 5 nodes having maxSurge=2, maxUnavailable=1. This means the upgrade process upgrades 3 nodes simultaneously. It creates 2 additional (upgraded) nodes, then it brings down 3 old (not yet upgraded) nodes at the same time. This ensures that there are always at least 4 nodes available. These upgrade settings configure the upgrade strategy for the node pool. Use strategy to switch between the strategies applied to the node pool. If the strategy is ROLLING, use max_surge and max_unavailable to control the level of parallelism and the level of disruption caused by upgrade. 1. maxSurge controls the number of additional nodes that can be added to the node pool temporarily for the time of the upgrade to increase the number of available nodes. 2. maxUnavailable controls the number of nodes that can be simultaneously unavailable. 3. (maxUnavailable + maxSurge) determines the level of parallelism (how many nodes are being upgraded at the same time). If the strategy is BLUE_GREEN, use blue_green_settings to configure the blue-green upgrade related settings. 1. standard_rollout_policy is the default policy. The policy is used to control the way blue pool gets drained. The draining is executed in the batch mode. The batch size could be specified as either percentage of the node pool size or the number of nodes. batch_soak_duration is the soak time after each batch gets drained. 2. node_pool_soak_duration is the soak time after all blue nodes are drained. After this period, the blue pool nodes will be deleted.",
- "properties": {
- "blueGreenSettings": {
- "$ref": "#/$defs/BlueGreenSettings",
- "description": "Settings for blue-green upgrade strategy."
- },
- "maxSurge": {
- "description": "The maximum number of nodes that can be created beyond the current size of the node pool during the upgrade process.",
- "format": "int32",
- "type": "integer"
- },
- "maxUnavailable": {
- "description": "The maximum number of nodes that can be simultaneously unavailable during the upgrade process. A node is considered available if its status is Ready.",
- "format": "int32",
- "type": "integer"
- },
- "strategy": {
- "description": "Update strategy of the node pool.",
- "enum": [
- "NODE_POOL_UPDATE_STRATEGY_UNSPECIFIED",
- "BLUE_GREEN",
- "SURGE",
- "SHORT_LIVED"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value if unset. GKE internally defaults the update strategy to SURGE for unspecified strategies.",
- "blue-green upgrade.",
- "SURGE is the traditional way of upgrade a node pool. max_surge and max_unavailable determines the level of upgrade parallelism.",
- "SHORT_LIVED is the dedicated upgrade strategy for QueuedProvisioning and flex start nodepools scaled up only by enqueueing to the Dynamic Workload Scheduler (DWS)."
- ]
- }
- },
- "type": "object"
- },
- "VirtualNIC": {
- "description": "Configuration of gVNIC feature.",
- "properties": {
- "enabled": {
- "description": "Whether gVNIC features are enabled in the node pool.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "WindowsNodeConfig": {
- "description": "Parameters that can be configured on Windows nodes. Windows Node Config that define the parameters that will be used to configure the Windows node pool settings.",
- "properties": {
- "osVersion": {
- "description": "OSVersion specifies the Windows node config to be used on the node.",
- "enum": [
- "OS_VERSION_UNSPECIFIED",
- "OS_VERSION_LTSC2019",
- "OS_VERSION_LTSC2022"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "When OSVersion is not specified.",
- "LTSC2019 specifies to use LTSC2019 as the Windows Servercore Base Image.",
- "LTSC2022 specifies to use LTSC2022 as the Windows Servercore Base Image."
- ]
- }
- },
- "type": "object"
- },
- "WorkloadMetadataConfig": {
- "description": "WorkloadMetadataConfig defines the metadata configuration to expose to workloads on the node pool.",
- "properties": {
- "mode": {
- "description": "Mode is the configuration for how to expose metadata to workloads running on the node pool.",
- "enum": [
- "MODE_UNSPECIFIED",
- "GCE_METADATA",
- "GKE_METADATA"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Not set.",
- "Expose all Compute Engine metadata to pods.",
- "Run the GKE Metadata Server on this node. The GKE Metadata Server exposes a metadata API to workloads that is compatible with the V1 Compute Metadata APIs exposed by the Compute Engine and App Engine Metadata Servers. This feature can only be enabled if Workload Identity is enabled at the cluster level."
- ]
- }
- },
- "type": "object"
- },
- "WritableCgroups": {
- "description": "Defines writable cgroups configuration.",
- "properties": {
- "enabled": {
- "description": "Optional. Whether writable cgroups is enabled.",
- "type": "boolean"
- }
- },
- "type": "object"
- }
-}Output schema / descriptionPrevious value: -"NodePool contains the name and configuration for a cluster's node pool. Node pools are a set of nodes (i.e. VM's), with a common configuration and specification, under the control of the cluster master. They may have a set of Kubernetes labels applied to them, which may be used to reference them during pod scheduling. They may also be resized up or down, to accommodate the workload."New value: +"Response for returned node pool object in JSON format. The full node pool object can be found at https://docs.cloud.google.com/kubernetes-engine/docs/reference/rest/v1/projects.locations.clusters.nodePools"Output schema / properties / autopilotConfigRemoved value: -{
- "$ref": "#/$defs/AutopilotConfig",
- "description": "Specifies the autopilot configuration for this node pool. This field is exclusively reserved for Cluster Autoscaler."
-}Output schema / properties / autoscalingRemoved value: -{
- "$ref": "#/$defs/NodePoolAutoscaling",
- "description": "Autoscaler configuration for this NodePool. Autoscaler is enabled only if a valid configuration is present."
-}Output schema / properties / bestEffortProvisioningRemoved value: -{
- "$ref": "#/$defs/BestEffortProvisioning",
- "description": "Enable best effort provisioning for nodes"
-}Output schema / properties / conditionsRemoved value: -{
- "description": "Which conditions caused the current node pool state.",
- "items": {
- "$ref": "#/$defs/StatusCondition"
- },
- "type": "array"
-}Output schema / properties / configRemoved value: -{
- "$ref": "#/$defs/NodeConfig",
- "description": "The node configuration of the pool."
-}Output schema / properties / etagRemoved value: -{
- "description": "This checksum is computed by the server based on the value of node pool fields, and may be sent on update requests to ensure the client has an up-to-date value before proceeding.",
- "type": "string"
-}Output schema / properties / initialNodeCountRemoved value: -{
- "description": "The initial node count for the pool. You must ensure that your Compute Engine [resource quota](https://cloud.google.com/compute/quotas) is sufficient for this number of instances. You must also have available firewall and routes quota.",
- "format": "int32",
- "type": "integer"
-}Output schema / properties / instanceGroupUrlsRemoved value: -{
- "description": "Output only. The resource URLs of the [managed instance groups](https://cloud.google.com/compute/docs/instance-groups/creating-groups-of-managed-instances) associated with this node pool. During the node pool blue-green upgrade operation, the URLs contain both blue and green resources.",
- "items": {
- "type": "string"
- },
- "readOnly": true,
- "type": "array"
-}Output schema / properties / locationsRemoved value: -{
- "description": "The list of Google Compute Engine [zones](https://cloud.google.com/compute/docs/zones#available) in which the NodePool's nodes should be located. If this value is unspecified during node pool creation, the [Cluster.Locations](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1/projects.locations.clusters#Cluster.FIELDS.locations) value will be used, instead. Warning: changing node pool locations will result in nodes being added and/or removed.",
- "items": {
- "type": "string"
- },
- "type": "array"
-}Output schema / properties / managementRemoved value: -{
- "$ref": "#/$defs/NodeManagement",
- "description": "NodeManagement configuration for this NodePool."
-}Output schema / properties / maxPodsConstraintRemoved value: -{
- "$ref": "#/$defs/MaxPodsConstraint",
- "description": "The constraint on the maximum number of pods that can be run simultaneously on a node in the node pool."
-}Output schema / properties / nameRemoved value: -{
- "description": "The name of the node pool.",
- "type": "string"
-}Output schema / properties / networkConfigRemoved value: -{
- "$ref": "#/$defs/NodeNetworkConfig",
- "description": "Networking configuration for this NodePool. If specified, it overrides the cluster-level defaults."
-}Output schema / properties / nodeDrainConfigRemoved value: -{
- "$ref": "#/$defs/NodeDrainConfig",
- "description": "Specifies the node drain configuration for this node pool."
-}Output schema / properties / nodePoolAdded value: +{
+ "description": "A string representing the NodePool object in JSON format.",
+ "type": "string"
+}Output schema / properties / placementPolicyRemoved value: -{
- "$ref": "#/$defs/PlacementPolicy",
- "description": "Specifies the node placement policy."
-}Output schema / properties / podIpv4CidrSizeRemoved value: -{
- "description": "Output only. The pod CIDR block size per node in this node pool.",
- "format": "int32",
- "readOnly": true,
- "type": "integer"
-}Output schema / properties / queuedProvisioningRemoved value: -{
- "$ref": "#/$defs/QueuedProvisioning",
- "description": "Specifies the configuration of queued provisioning."
-}Output schema / properties / selfLinkRemoved value: -{
- "description": "Output only. Server-defined URL for the resource.",
- "readOnly": true,
- "type": "string"
-}Output schema / properties / statusRemoved value: -{
- "description": "Output only. The status of the nodes in this pool instance.",
- "enum": [
- "STATUS_UNSPECIFIED",
- "PROVISIONING",
- "RUNNING",
- "RUNNING_WITH_ERROR",
- "RECONCILING",
- "STOPPING",
- "ERROR"
- ],
- "readOnly": true,
- "type": "string",
- "x-google-enum-descriptions": [
- "Not set.",
- "The PROVISIONING state indicates the node pool is being created.",
- "The RUNNING state indicates the node pool has been created and is fully usable.",
- "The RUNNING_WITH_ERROR state indicates the node pool has been created and is partially usable. Some error state has occurred and some functionality may be impaired. Customer may need to reissue a request or trigger a new update.",
- "The RECONCILING state indicates that some work is actively being done on the node pool, such as upgrading node software. Details can be found in the `statusMessage` field.",
- "The STOPPING state indicates the node pool is being deleted.",
- "The ERROR state indicates the node pool may be unusable. Details can be found in the `statusMessage` field."
- ]
-}Output schema / properties / statusMessageRemoved value: -{
- "deprecated": true,
- "description": "Output only. Deprecated. Use conditions instead. Additional information about the current status of this node pool instance, if available.",
- "readOnly": true,
- "type": "string"
-}Output schema / properties / updateInfoRemoved value: -{
- "$ref": "#/$defs/UpdateInfo",
- "description": "Output only. Update info contains relevant information during a node pool update.",
- "readOnly": true
-}Output schema / properties / upgradeSettingsRemoved value: -{
- "$ref": "#/$defs/UpgradeSettings",
- "description": "Upgrade settings control disruption and speed of the upgrade."
-}Output schema / properties / versionRemoved value: -{
- "description": "The version of Kubernetes running on this NodePool's nodes. If unspecified, it defaults as described [here](https://cloud.google.com/kubernetes-engine/versioning#specifying_node_version).",
- "type": "string"
-}list_clusters6 fields changedOutput schema / $defsRemoved value: -{
- "AcceleratorConfig": {
- "description": "AcceleratorConfig represents a Hardware Accelerator request.",
- "properties": {
- "acceleratorCount": {
- "description": "The number of the accelerator cards exposed to an instance.",
- "format": "int64",
- "type": "string"
- },
- "acceleratorType": {
- "description": "The accelerator type resource name. List of supported accelerators [here](https://cloud.google.com/compute/docs/gpus)",
- "type": "string"
- },
- "gpuDriverInstallationConfig": {
- "$ref": "#/$defs/GPUDriverInstallationConfig",
- "description": "The configuration for auto installation of GPU driver."
- },
- "gpuPartitionSize": {
- "description": "Size of partitions to create on the GPU. Valid values are described in the NVIDIA [mig user guide](https://docs.nvidia.com/datacenter/tesla/mig-user-guide/#partitioning).",
- "type": "string"
- },
- "gpuSharingConfig": {
- "$ref": "#/$defs/GPUSharingConfig",
- "description": "The configuration for GPU sharing options."
- }
- },
- "type": "object"
- },
- "AdditionalIPRangesConfig": {
- "description": "AdditionalIPRangesConfig is the configuration for individual additional subnetwork attached to the cluster",
- "properties": {
- "podIpv4RangeNames": {
- "description": "List of secondary ranges names within this subnetwork that can be used for pod IPs. Example1: gke-pod-range1 Example2: gke-pod-range1,gke-pod-range2",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "status": {
- "description": "Draining status of the additional subnet.",
- "enum": [
- "STATUS_UNSPECIFIED",
- "ACTIVE",
- "DRAINING"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Not set, same as ACTIVE.",
- "ACTIVE status indicates that the subnet is available for new node pool creation.",
- "DRAINING status indicates that the subnet is not used for new node pool creation."
- ]
- },
- "subnetwork": {
- "description": "Name of the subnetwork. This can be the full path of the subnetwork or just the name. Example1: my-subnet Example2: projects/gke-project/regions/us-central1/subnetworks/my-subnet",
- "type": "string"
- }
- },
- "type": "object"
- },
- "AdditionalNodeNetworkConfig": {
- "description": "AdditionalNodeNetworkConfig is the configuration for additional node networks within the NodeNetworkConfig message",
- "properties": {
- "network": {
- "description": "Name of the VPC where the additional interface belongs",
- "type": "string"
- },
- "subnetwork": {
- "description": "Name of the subnetwork where the additional interface belongs",
- "type": "string"
- }
- },
- "type": "object"
- },
- "AdditionalPodNetworkConfig": {
- "description": "AdditionalPodNetworkConfig is the configuration for additional pod networks within the NodeNetworkConfig message",
- "properties": {
- "maxPodsPerNode": {
- "$ref": "#/$defs/MaxPodsConstraint",
- "description": "The maximum number of pods per node which use this pod network."
- },
- "networkAttachment": {
- "description": "The name of the network attachment for pods to communicate to; cannot be specified along with subnetwork or secondary_pod_range.",
- "type": "string"
- },
- "secondaryPodRange": {
- "description": "The name of the secondary range on the subnet which provides IP address for this pod range.",
- "type": "string"
- },
- "subnetwork": {
- "description": "Name of the subnetwork where the additional pod network belongs.",
- "type": "string"
- }
- },
- "type": "object"
- },
- "AdditionalPodRangesConfig": {
- "description": "AdditionalPodRangesConfig is the configuration for additional pod secondary ranges supporting the ClusterUpdate message.",
- "properties": {
- "podRangeInfo": {
- "description": "Output only. Information for additional pod range.",
- "items": {
- "$ref": "#/$defs/RangeInfo"
- },
- "readOnly": true,
- "type": "array"
- },
- "podRangeNames": {
- "description": "Name for pod secondary ipv4 range which has the actual range defined ahead.",
- "items": {
- "type": "string"
- },
- "type": "array"
- }
- },
- "type": "object"
- },
- "AddonsConfig": {
- "description": "Configuration for the addons that can be automatically spun up in the cluster, enabling additional functionality.",
- "properties": {
- "cloudRunConfig": {
- "$ref": "#/$defs/CloudRunConfig",
- "description": "Configuration for the Cloud Run addon, which allows the user to use a managed Knative service."
- },
- "configConnectorConfig": {
- "$ref": "#/$defs/ConfigConnectorConfig",
- "description": "Configuration for the ConfigConnector add-on, a Kubernetes extension to manage hosted Google Cloud services through the Kubernetes API."
- },
- "dnsCacheConfig": {
- "$ref": "#/$defs/DnsCacheConfig",
- "description": "Configuration for NodeLocalDNS, a dns cache running on cluster nodes"
- },
- "gcePersistentDiskCsiDriverConfig": {
- "$ref": "#/$defs/GcePersistentDiskCsiDriverConfig",
- "description": "Configuration for the Compute Engine Persistent Disk CSI driver."
- },
- "gcpFilestoreCsiDriverConfig": {
- "$ref": "#/$defs/GcpFilestoreCsiDriverConfig",
- "description": "Configuration for the Filestore CSI driver."
- },
- "gcsFuseCsiDriverConfig": {
- "$ref": "#/$defs/GcsFuseCsiDriverConfig",
- "description": "Configuration for the Cloud Storage Fuse CSI driver."
- },
- "gkeBackupAgentConfig": {
- "$ref": "#/$defs/GkeBackupAgentConfig",
- "description": "Configuration for the Backup for GKE agent addon."
- },
- "highScaleCheckpointingConfig": {
- "$ref": "#/$defs/HighScaleCheckpointingConfig",
- "description": "Configuration for the High Scale Checkpointing add-on."
- },
- "horizontalPodAutoscaling": {
- "$ref": "#/$defs/HorizontalPodAutoscaling",
- "description": "Configuration for the horizontal pod autoscaling feature, which increases or decreases the number of replica pods a replication controller has based on the resource usage of the existing pods."
- },
- "httpLoadBalancing": {
- "$ref": "#/$defs/HttpLoadBalancing",
- "description": "Configuration for the HTTP (L7) load balancing controller addon, which makes it easy to set up HTTP load balancers for services in a cluster."
- },
- "kubernetesDashboard": {
- "$ref": "#/$defs/KubernetesDashboard",
- "deprecated": true,
- "description": "Configuration for the Kubernetes Dashboard. This addon is deprecated, and will be disabled in 1.15. It is recommended to use the Cloud Console to manage and monitor your Kubernetes clusters, workloads and applications. For more information, see: https://cloud.google.com/kubernetes-engine/docs/concepts/dashboards"
- },
- "lustreCsiDriverConfig": {
- "$ref": "#/$defs/LustreCsiDriverConfig",
- "description": "Configuration for the Lustre CSI driver."
- },
- "networkPolicyConfig": {
- "$ref": "#/$defs/NetworkPolicyConfig",
- "description": "Configuration for NetworkPolicy. This only tracks whether the addon is enabled or not on the Master, it does not track whether network policy is enabled for the nodes."
- },
- "parallelstoreCsiDriverConfig": {
- "$ref": "#/$defs/ParallelstoreCsiDriverConfig",
- "description": "Configuration for the Cloud Storage Parallelstore CSI driver."
- },
- "rayOperatorConfig": {
- "$ref": "#/$defs/RayOperatorConfig",
- "description": "Optional. Configuration for Ray Operator addon."
- },
- "sliceControllerConfig": {
- "$ref": "#/$defs/SliceControllerConfig",
- "description": "Optional. Configuration for the slice controller add-on."
- },
- "statefulHaConfig": {
- "$ref": "#/$defs/StatefulHAConfig",
- "description": "Optional. Configuration for the StatefulHA add-on."
- }
- },
- "type": "object"
- },
- "AdvancedDatapathObservabilityConfig": {
- "description": "AdvancedDatapathObservabilityConfig specifies configuration of observability features of advanced datapath.",
- "properties": {
- "enableMetrics": {
- "description": "Expose flow metrics on nodes",
- "type": "boolean"
- },
- "enableRelay": {
- "description": "Enable Relay component",
- "type": "boolean"
- },
- "relayMode": {
- "description": "Method used to make Relay available",
- "enum": [
- "RELAY_MODE_UNSPECIFIED",
- "DISABLED",
- "INTERNAL_VPC_LB",
- "EXTERNAL_LB"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value. This shouldn't be used.",
- "disabled",
- "exposed via internal load balancer",
- "exposed via external load balancer"
- ]
- }
- },
- "type": "object"
- },
- "AdvancedMachineFeatures": {
- "description": "Specifies options for controlling advanced machine features.",
- "properties": {
- "enableNestedVirtualization": {
- "description": "Whether or not to enable nested virtualization (defaults to false).",
- "type": "boolean"
- },
- "performanceMonitoringUnit": {
- "description": "Type of Performance Monitoring Unit (PMU) requested on node pool instances. If unset, PMU will not be available to the node.",
- "enum": [
- "PERFORMANCE_MONITORING_UNIT_UNSPECIFIED",
- "ARCHITECTURAL",
- "STANDARD",
- "ENHANCED"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "PMU not enabled.",
- "Architecturally defined non-LLC events.",
- "Most documented core/L2 events.",
- "Most documented core/L2 and LLC events."
- ]
- },
- "threadsPerCore": {
- "description": "The number of threads per physical core. To disable simultaneous multithreading (SMT) set this to 1. If unset, the maximum number of threads supported per core by the underlying processor is assumed.",
- "format": "int64",
- "type": "string"
- }
- },
- "type": "object"
- },
- "AnonymousAuthenticationConfig": {
- "description": "AnonymousAuthenticationConfig defines the settings needed to limit endpoints that allow anonymous authentication.",
- "properties": {
- "mode": {
- "description": "Defines the mode of limiting anonymous access in the cluster.",
- "enum": [
- "MODE_UNSPECIFIED",
- "ENABLED",
- "LIMITED"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value not specified.",
- "Anonymous authentication is allowed for all endpoints.",
- "Anonymous authentication is allowed for only health check endpoints."
- ]
- }
- },
- "type": "object"
- },
- "AuthenticatorGroupsConfig": {
- "description": "Configuration for returning group information from authenticators.",
- "properties": {
- "enabled": {
- "description": "Whether this cluster should return group membership lookups during authentication using a group of security groups.",
- "type": "boolean"
- },
- "securityGroup": {
- "description": "The name of the security group-of-groups to be used. Only relevant if enabled = true.",
- "type": "string"
- }
- },
- "type": "object"
- },
- "AutoIpamConfig": {
- "description": "AutoIpamConfig contains all information related to Auto IPAM",
- "properties": {
- "enabled": {
- "description": "The flag that enables Auto IPAM on this cluster",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "AutoMonitoringConfig": {
- "description": "AutoMonitoringConfig defines the configuration for GKE Workload Auto-Monitoring.",
- "properties": {
- "scope": {
- "description": "Scope for GKE Workload Auto-Monitoring.",
- "enum": [
- "SCOPE_UNSPECIFIED",
- "ALL",
- "NONE"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Not set.",
- "Auto-Monitoring is enabled for all supported applications.",
- "Disable Auto-Monitoring."
- ]
- }
- },
- "type": "object"
- },
- "AutoUpgradeOptions": {
- "description": "AutoUpgradeOptions defines the set of options for the user to control how the Auto Upgrades will proceed.",
- "properties": {
- "autoUpgradeStartTime": {
- "description": "Output only. This field is set when upgrades are about to commence with the approximate start time for the upgrades, in [RFC3339](https://www.ietf.org/rfc/rfc3339.txt) text format.",
- "readOnly": true,
- "type": "string"
- },
- "description": {
- "description": "Output only. This field is set when upgrades are about to commence with the description of the upgrade.",
- "readOnly": true,
- "type": "string"
- }
- },
- "type": "object"
- },
- "Autopilot": {
- "description": "Autopilot is the configuration for Autopilot settings on the cluster.",
- "properties": {
- "clusterPolicyConfig": {
- "$ref": "#/$defs/ClusterPolicyConfig",
- "description": "ClusterPolicyConfig denotes cluster level policies that are enforced for the cluster."
- },
- "enabled": {
- "description": "Enable Autopilot",
- "type": "boolean"
- },
- "privilegedAdmissionConfig": {
- "$ref": "#/$defs/PrivilegedAdmissionConfig",
- "description": "PrivilegedAdmissionConfig is the configuration related to privileged admission control."
- },
- "workloadPolicyConfig": {
- "$ref": "#/$defs/WorkloadPolicyConfig",
- "description": "WorkloadPolicyConfig is the configuration related to GCW workload policy"
- }
- },
- "type": "object"
- },
- "AutopilotConfig": {
- "description": "AutopilotConfig contains configuration of autopilot feature for this nodepool.",
- "properties": {
- "enabled": {
- "description": "Denotes that nodes belonging to this node pool are Autopilot nodes.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "AutoprovisioningNodePoolDefaults": {
- "description": "AutoprovisioningNodePoolDefaults contains defaults for a node pool created by NAP.",
- "properties": {
- "bootDiskKmsKey": {
- "description": "The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption",
- "type": "string"
- },
- "diskSizeGb": {
- "description": "Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB. If unspecified, the default disk size is 100GB.",
- "format": "int32",
- "type": "integer"
- },
- "diskType": {
- "description": "Type of the disk attached to each node (e.g. 'pd-standard', 'pd-ssd' or 'pd-balanced') If unspecified, the default disk type is 'pd-standard'",
- "type": "string"
- },
- "imageType": {
- "description": "The image type to use for NAP created node. Please see https://cloud.google.com/kubernetes-engine/docs/concepts/node-images for available image types.",
- "type": "string"
- },
- "insecureKubeletReadonlyPortEnabled": {
- "description": "DEPRECATED. Use NodePoolAutoConfig.NodeKubeletConfig instead.",
- "type": "boolean"
- },
- "management": {
- "$ref": "#/$defs/NodeManagement",
- "description": "Specifies the node management options for NAP created node-pools."
- },
- "minCpuPlatform": {
- "deprecated": true,
- "description": "Deprecated. Minimum CPU platform to be used for NAP created node pools. The instance may be scheduled on the specified or newer CPU platform. Applicable values are the friendly names of CPU platforms, such as minCpuPlatform: Intel Haswell or minCpuPlatform: Intel Sandy Bridge. For more information, read [how to specify min CPU platform](https://cloud.google.com/compute/docs/instances/specify-min-cpu-platform). This field is deprecated, min_cpu_platform should be specified using `cloud.google.com/requested-min-cpu-platform` label selector on the pod. To unset the min cpu platform field pass \"automatic\" as field value.",
- "type": "string"
- },
- "oauthScopes": {
- "description": "Scopes that are used by NAP when creating node pools.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "serviceAccount": {
- "description": "The Google Cloud Platform Service Account to be used by the node VMs.",
- "type": "string"
- },
- "shieldedInstanceConfig": {
- "$ref": "#/$defs/ShieldedInstanceConfig",
- "description": "Shielded Instance options."
- },
- "upgradeSettings": {
- "$ref": "#/$defs/UpgradeSettings",
- "description": "Specifies the upgrade settings for NAP created node pools"
- }
- },
- "type": "object"
- },
- "AutoscaledRolloutPolicy": {
- "description": "Autoscaled rollout policy utilizes the cluster autoscaler during blue-green upgrade to scale both the blue and green pools.",
- "properties": {
- "waitForDrainDuration": {
- "description": "Optional. Time to wait after cordoning the blue pool before draining the nodes. Defaults to 3 days. The value can be set between 0 and 7 days, inclusive.",
- "format": "google-duration",
- "type": "string"
- }
- },
- "type": "object"
- },
- "BestEffortProvisioning": {
- "description": "Best effort provisioning.",
- "properties": {
- "enabled": {
- "description": "When this is enabled, cluster/node pool creations will ignore non-fatal errors like stockout to best provision as many nodes as possible right now and eventually bring up all target number of nodes",
- "type": "boolean"
- },
- "minProvisionNodes": {
- "description": "Minimum number of nodes to be provisioned to be considered as succeeded, and the rest of nodes will be provisioned gradually and eventually when stockout issue has been resolved.",
- "format": "int32",
- "type": "integer"
- }
- },
- "type": "object"
- },
- "BigQueryDestination": {
- "description": "Parameters for using BigQuery as the destination of resource usage export.",
- "properties": {
- "datasetId": {
- "description": "The ID of a BigQuery Dataset.",
- "type": "string"
- }
- },
- "type": "object"
- },
- "BinaryAuthorization": {
- "description": "Configuration for Binary Authorization.",
- "properties": {
- "enabled": {
- "deprecated": true,
- "description": "This field is deprecated. Leave this unset and instead configure BinaryAuthorization using evaluation_mode. If evaluation_mode is set to anything other than EVALUATION_MODE_UNSPECIFIED, this field is ignored.",
- "type": "boolean"
- },
- "evaluationMode": {
- "description": "Mode of operation for binauthz policy evaluation. If unspecified, defaults to DISABLED.",
- "enum": [
- "EVALUATION_MODE_UNSPECIFIED",
- "DISABLED",
- "PROJECT_SINGLETON_POLICY_ENFORCE"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value",
- "Disable BinaryAuthorization",
- "Enforce Kubernetes admission requests with BinaryAuthorization using the project's singleton policy. This is equivalent to setting the enabled boolean to true."
- ]
- }
- },
- "type": "object"
- },
- "BlueGreenInfo": {
- "description": "Information relevant to blue-green upgrade.",
- "properties": {
- "blueInstanceGroupUrls": {
- "description": "The resource URLs of the [managed instance groups] (/compute/docs/instance-groups/creating-groups-of-managed-instances) associated with blue pool.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "bluePoolDeletionStartTime": {
- "description": "Time to start deleting blue pool to complete blue-green upgrade, in [RFC3339](https://www.ietf.org/rfc/rfc3339.txt) text format.",
- "type": "string"
- },
- "greenInstanceGroupUrls": {
- "description": "The resource URLs of the [managed instance groups] (/compute/docs/instance-groups/creating-groups-of-managed-instances) associated with green pool.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "greenPoolVersion": {
- "description": "Version of green pool.",
- "type": "string"
- },
- "phase": {
- "description": "Current blue-green upgrade phase.",
- "enum": [
- "PHASE_UNSPECIFIED",
- "UPDATE_STARTED",
- "CREATING_GREEN_POOL",
- "CORDONING_BLUE_POOL",
- "DRAINING_BLUE_POOL",
- "NODE_POOL_SOAKING",
- "DELETING_BLUE_POOL",
- "ROLLBACK_STARTED"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Unspecified phase.",
- "blue-green upgrade has been initiated.",
- "Start creating green pool nodes.",
- "Start cordoning blue pool nodes.",
- "Start draining blue pool nodes.",
- "Start soaking time after draining entire blue pool.",
- "Start deleting blue nodes.",
- "Rollback has been initiated."
- ]
- }
- },
- "type": "object"
- },
- "BlueGreenSettings": {
- "description": "Settings for blue-green upgrade.",
- "properties": {
- "autoscaledRolloutPolicy": {
- "$ref": "#/$defs/AutoscaledRolloutPolicy",
- "description": "Autoscaled policy for cluster autoscaler enabled blue-green upgrade."
- },
- "nodePoolSoakDuration": {
- "description": "Time needed after draining entire blue pool. After this period, blue pool will be cleaned up.",
- "format": "google-duration",
- "type": "string"
- },
- "standardRolloutPolicy": {
- "$ref": "#/$defs/StandardRolloutPolicy",
- "description": "Standard policy for the blue-green upgrade."
- }
- },
- "type": "object"
- },
- "BootDisk": {
- "description": "BootDisk specifies the boot disk configuration for nodepools.",
- "properties": {
- "diskType": {
- "description": "Disk type of the boot disk. (i.e. Hyperdisk-Balanced, PD-Balanced, etc.)",
- "type": "string"
- },
- "provisionedIops": {
- "description": "For Hyperdisk-Balanced only, the provisioned IOPS config value.",
- "format": "int64",
- "type": "string"
- },
- "provisionedThroughput": {
- "description": "For Hyperdisk-Balanced only, the provisioned throughput config value.",
- "format": "int64",
- "type": "string"
- },
- "sizeGb": {
- "description": "Disk size in GB. Replaces NodeConfig.disk_size_gb",
- "format": "int64",
- "type": "string"
- }
- },
- "type": "object"
- },
- "BootDiskProfile": {
- "description": "Swap on the node's boot disk.",
- "properties": {
- "swapSizeGib": {
- "description": "Specifies the size of the swap space in gibibytes (GiB).",
- "format": "int64",
- "type": "string"
- },
- "swapSizePercent": {
- "description": "Specifies the size of the swap space as a percentage of the boot disk size.",
- "format": "int32",
- "type": "integer"
- }
- },
- "type": "object"
- },
- "CertificateAuthorityDomainConfig": {
- "description": "CertificateAuthorityDomainConfig configures one or more fully qualified domain names (FQDN) to a specific certificate.",
- "properties": {
- "fqdns": {
- "description": "List of fully qualified domain names (FQDN). Specifying port is supported. Wildcards are NOT supported. Examples: - my.customdomain.com - 10.0.1.2:5000",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "gcpSecretManagerCertificateConfig": {
- "$ref": "#/$defs/GCPSecretManagerCertificateConfig",
- "description": "Secret Manager certificate configuration."
- }
- },
- "type": "object"
- },
- "CertificateConfig": {
- "description": "CertificateConfig configures certificate for the registry.",
- "properties": {
- "gcpSecretManagerSecretUri": {
- "description": "The URI configures a secret from [Secret Manager](https://cloud.google.com/secret-manager) in the format \"projects/$PROJECT_ID/secrets/$SECRET_NAME/versions/$VERSION\" for global secret or \"projects/$PROJECT_ID/locations/$REGION/secrets/$SECRET_NAME/versions/$VERSION\" for regional secret. Version can be fixed (e.g. \"2\") or \"latest\"",
- "type": "string"
- }
- },
- "type": "object"
- },
- "CertificateConfigPair": {
- "description": "CertificateConfigPair configures pairs of certificates, which is used for client certificate and key pairs under a registry.",
- "properties": {
- "cert": {
- "$ref": "#/$defs/CertificateConfig",
- "description": "Cert configures the client certificate."
- },
- "key": {
- "$ref": "#/$defs/CertificateConfig",
- "description": "Key configures the client private key. Optional."
- }
- },
- "type": "object"
- },
- "CidrBlock": {
- "description": "CidrBlock contains an optional name and one CIDR block.",
- "properties": {
- "cidrBlock": {
- "description": "cidr_block must be specified in CIDR notation.",
- "type": "string"
- },
- "displayName": {
- "description": "display_name is an optional field for users to identify CIDR blocks.",
- "type": "string"
- }
- },
- "type": "object"
- },
- "ClientCertificateConfig": {
- "description": "Configuration for client certificates on the cluster.",
- "properties": {
- "issueClientCertificate": {
- "description": "Issue a client certificate.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "CloudRunConfig": {
- "description": "Configuration options for the Cloud Run feature.",
- "properties": {
- "disabled": {
- "description": "Whether Cloud Run addon is enabled for this cluster.",
- "type": "boolean"
- },
- "loadBalancerType": {
- "description": "Which load balancer type is installed for Cloud Run.",
- "enum": [
- "LOAD_BALANCER_TYPE_UNSPECIFIED",
- "LOAD_BALANCER_TYPE_EXTERNAL",
- "LOAD_BALANCER_TYPE_INTERNAL"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Load balancer type for Cloud Run is unspecified.",
- "Install external load balancer for Cloud Run.",
- "Install internal load balancer for Cloud Run."
- ]
- }
- },
- "type": "object"
- },
- "Cluster": {
- "description": "A Google Kubernetes Engine cluster.",
- "properties": {
- "addonsConfig": {
- "$ref": "#/$defs/AddonsConfig",
- "description": "Configurations for the various addons available to run in the cluster."
- },
- "alphaClusterFeatureGates": {
- "description": "The list of user specified Kubernetes feature gates. Each string represents the activation status of a feature gate (e.g. \"featureX=true\" or \"featureX=false\")",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "anonymousAuthenticationConfig": {
- "$ref": "#/$defs/AnonymousAuthenticationConfig",
- "description": "Configuration for limiting anonymous access to all endpoints except the health checks."
- },
- "authenticatorGroupsConfig": {
- "$ref": "#/$defs/AuthenticatorGroupsConfig",
- "description": "Configuration controlling RBAC group membership information."
- },
- "autopilot": {
- "$ref": "#/$defs/Autopilot",
- "description": "Autopilot configuration for the cluster."
- },
- "autoscaling": {
- "$ref": "#/$defs/ClusterAutoscaling",
- "description": "Cluster-level autoscaling configuration."
- },
- "binaryAuthorization": {
- "$ref": "#/$defs/BinaryAuthorization",
- "description": "Configuration for Binary Authorization."
- },
- "clusterIpv4Cidr": {
- "description": "The IP address range of the container pods in this cluster, in [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`). Leave blank to have one automatically chosen or specify a `/14` block in `10.0.0.0/8`.",
- "type": "string"
- },
- "compliancePostureConfig": {
- "$ref": "#/$defs/CompliancePostureConfig",
- "deprecated": true,
- "description": "Optional. Deprecated: Compliance Posture is no longer supported. For more details, see https://cloud.google.com/kubernetes-engine/docs/deprecations/posture-management-deprecation. Enable/Disable Compliance Posture features for the cluster."
- },
- "conditions": {
- "description": "Which conditions caused the current cluster state.",
- "items": {
- "$ref": "#/$defs/StatusCondition"
- },
- "type": "array"
- },
- "confidentialNodes": {
- "$ref": "#/$defs/ConfidentialNodes",
- "description": "Configuration of Confidential Nodes. All the nodes in the cluster will be Confidential VM once enabled."
- },
- "controlPlaneEgress": {
- "$ref": "#/$defs/ControlPlaneEgress",
- "description": "Configuration for control plane egress control."
- },
- "controlPlaneEndpointsConfig": {
- "$ref": "#/$defs/ControlPlaneEndpointsConfig",
- "description": "Configuration for all cluster's control plane endpoints."
- },
- "costManagementConfig": {
- "$ref": "#/$defs/CostManagementConfig",
- "description": "Configuration for the fine-grained cost management feature."
- },
- "createTime": {
- "description": "Output only. The time the cluster was created, in [RFC3339](https://www.ietf.org/rfc/rfc3339.txt) text format.",
- "readOnly": true,
- "type": "string"
- },
- "currentMasterVersion": {
- "description": "Output only. The current software version of the master endpoint.",
- "readOnly": true,
- "type": "string"
- },
- "currentNodeCount": {
- "deprecated": true,
- "description": "Output only. The number of nodes currently in the cluster. Deprecated. Call Kubernetes API directly to retrieve node information.",
- "format": "int32",
- "readOnly": true,
- "type": "integer"
- },
- "currentNodeVersion": {
- "deprecated": true,
- "description": "Output only. Deprecated, use [NodePools.version](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1/projects.locations.clusters.nodePools) instead. The current version of the node software components. If they are currently at multiple versions because they're in the process of being upgraded, this reflects the minimum version of all nodes.",
- "readOnly": true,
- "type": "string"
- },
- "databaseEncryption": {
- "$ref": "#/$defs/DatabaseEncryption",
- "description": "Configuration of etcd encryption."
- },
- "defaultMaxPodsConstraint": {
- "$ref": "#/$defs/MaxPodsConstraint",
- "description": "The default constraint on the maximum number of pods that can be run simultaneously on a node in the node pool of this cluster. Only honored if cluster created with IP Alias support."
- },
- "description": {
- "description": "An optional description of this cluster.",
- "type": "string"
- },
- "enableK8sBetaApis": {
- "$ref": "#/$defs/K8sBetaAPIConfig",
- "description": "Beta APIs Config"
- },
- "enableKubernetesAlpha": {
- "description": "Kubernetes alpha features are enabled on this cluster. This includes alpha API groups (e.g. v1alpha1) and features that may not be production ready in the kubernetes version of the master and nodes. The cluster has no SLA for uptime and master/node upgrades are disabled. Alpha enabled clusters are automatically deleted thirty days after creation.",
- "type": "boolean"
- },
- "enableTpu": {
- "deprecated": true,
- "description": "Enable the ability to use Cloud TPUs in this cluster. This field is deprecated due to the deprecation of 2VM TPU. The end of life date for 2VM TPU is 2025-04-25.",
- "type": "boolean"
- },
- "endpoint": {
- "description": "Output only. The IP address of this cluster's master endpoint. The endpoint can be accessed from the internet at `https://username:password@endpoint/`. See the `masterAuth` property of this resource for username and password information.",
- "readOnly": true,
- "type": "string"
- },
- "enterpriseConfig": {
- "$ref": "#/$defs/EnterpriseConfig",
- "deprecated": true,
- "description": "GKE Enterprise Configuration. Deprecated: GKE Enterprise features are now available without an Enterprise tier."
- },
- "etag": {
- "description": "This checksum is computed by the server based on the value of cluster fields, and may be sent on update requests to ensure the client has an up-to-date value before proceeding.",
- "type": "string"
- },
- "expireTime": {
- "description": "Output only. The time the cluster will be automatically deleted in [RFC3339](https://www.ietf.org/rfc/rfc3339.txt) text format.",
- "readOnly": true,
- "type": "string"
- },
- "fleet": {
- "$ref": "#/$defs/Fleet",
- "description": "Fleet information for the cluster."
- },
- "gkeAutoUpgradeConfig": {
- "$ref": "#/$defs/GkeAutoUpgradeConfig",
- "description": "Configuration for GKE auto upgrades."
- },
- "id": {
- "description": "Output only. Unique id for the cluster.",
- "readOnly": true,
- "type": "string"
- },
- "identityServiceConfig": {
- "$ref": "#/$defs/IdentityServiceConfig",
- "description": "Configuration for Identity Service component."
- },
- "initialClusterVersion": {
- "description": "The initial Kubernetes version for this cluster. Valid versions are those found in validMasterVersions returned by getServerConfig. The version can be upgraded over time; such upgrades are reflected in currentMasterVersion and currentNodeVersion. Users may specify either explicit versions offered by Kubernetes Engine or version aliases, which have the following behavior: - \"latest\": picks the highest valid Kubernetes version - \"1.X\": picks the highest valid patch+gke.N patch in the 1.X version - \"1.X.Y\": picks the highest valid gke.N patch in the 1.X.Y version - \"1.X.Y-gke.N\": picks an explicit Kubernetes version - \"\",\"-\": picks the default Kubernetes version",
- "type": "string"
- },
- "initialNodeCount": {
- "deprecated": true,
- "description": "The number of nodes to create in this cluster. You must ensure that your Compute Engine [resource quota](https://cloud.google.com/compute/quotas) is sufficient for this number of instances. You must also have available firewall and routes quota. For requests, this field should only be used in lieu of a \"node_pool\" object, since this configuration (along with the \"node_config\") will be used to create a \"NodePool\" object with an auto-generated name. Do not use this and a node_pool at the same time. This field is deprecated, use node_pool.initial_node_count instead.",
- "format": "int32",
- "type": "integer"
- },
- "instanceGroupUrls": {
- "deprecated": true,
- "description": "Output only. Deprecated. Use node_pools.instance_group_urls.",
- "items": {
- "type": "string"
- },
- "readOnly": true,
- "type": "array"
- },
- "ipAllocationPolicy": {
- "$ref": "#/$defs/IPAllocationPolicy",
- "description": "Configuration for cluster IP allocation."
- },
- "labelFingerprint": {
- "description": "The fingerprint of the set of labels for this cluster.",
- "type": "string"
- },
- "legacyAbac": {
- "$ref": "#/$defs/LegacyAbac",
- "description": "Configuration for the legacy ABAC authorization mode."
- },
- "location": {
- "description": "Output only. The name of the Google Compute Engine [zone](https://cloud.google.com/compute/docs/regions-zones/regions-zones#available) or [region](https://cloud.google.com/compute/docs/regions-zones/regions-zones#available) in which the cluster resides.",
- "readOnly": true,
- "type": "string"
- },
- "locations": {
- "description": "The list of Google Compute Engine [zones](https://cloud.google.com/compute/docs/zones#available) in which the cluster's nodes should be located. This field provides a default value if [NodePool.Locations](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1/projects.locations.clusters.nodePools#NodePool.FIELDS.locations) are not specified during node pool creation. Warning: changing cluster locations will update the [NodePool.Locations](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1/projects.locations.clusters.nodePools#NodePool.FIELDS.locations) of all node pools and will result in nodes being added and/or removed.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "loggingConfig": {
- "$ref": "#/$defs/LoggingConfig",
- "description": "Logging configuration for the cluster."
- },
- "loggingService": {
- "description": "The logging service the cluster should use to write logs. Currently available options: * `logging.googleapis.com/kubernetes` - The Cloud Logging service with a Kubernetes-native resource model * `logging.googleapis.com` - The legacy Cloud Logging service (no longer available as of GKE 1.15). * `none` - no logs will be exported from the cluster. If left as an empty string,`logging.googleapis.com/kubernetes` will be used for GKE 1.14+ or `logging.googleapis.com` for earlier versions.",
- "type": "string"
- },
- "maintenancePolicy": {
- "$ref": "#/$defs/MaintenancePolicy",
- "description": "Configure the maintenance policy for this cluster."
- },
- "managedMachineLearningDiagnosticsConfig": {
- "$ref": "#/$defs/ManagedMachineLearningDiagnosticsConfig",
- "description": "Configuration for Managed Machine Learning Diagnostics."
- },
- "managedOpentelemetryConfig": {
- "$ref": "#/$defs/ManagedOpenTelemetryConfig",
- "description": "Configuration for Managed OpenTelemetry pipeline."
- },
- "masterAuth": {
- "$ref": "#/$defs/MasterAuth",
- "description": "The authentication information for accessing the master endpoint. If unspecified, the defaults are used: For clusters before v1.12, if master_auth is unspecified, `username` will be set to \"admin\", a random password will be generated, and a client certificate will be issued."
- },
- "masterAuthorizedNetworksConfig": {
- "$ref": "#/$defs/MasterAuthorizedNetworksConfig",
- "deprecated": true,
- "description": "The configuration options for master authorized networks feature. Deprecated: Use ControlPlaneEndpointsConfig.IPEndpointsConfig.authorized_networks_config instead."
- },
- "meshCertificates": {
- "$ref": "#/$defs/MeshCertificates",
- "description": "Configuration for issuance of mTLS keys and certificates to Kubernetes pods."
- },
- "monitoringConfig": {
- "$ref": "#/$defs/MonitoringConfig",
- "description": "Monitoring configuration for the cluster."
- },
- "monitoringService": {
- "description": "The monitoring service the cluster should use to write metrics. Currently available options: * `monitoring.googleapis.com/kubernetes` - The Cloud Monitoring service with a Kubernetes-native resource model * `monitoring.googleapis.com` - The legacy Cloud Monitoring service (no longer available as of GKE 1.15). * `none` - No metrics will be exported from the cluster. If left as an empty string,`monitoring.googleapis.com/kubernetes` will be used for GKE 1.14+ or `monitoring.googleapis.com` for earlier versions.",
- "type": "string"
- },
- "name": {
- "description": "The name of this cluster. The name must be unique within this project and location (e.g. zone or region), and can be up to 40 characters with the following restrictions: * Lowercase letters, numbers, and hyphens only. * Must start with a letter. * Must end with a number or a letter.",
- "type": "string"
- },
- "network": {
- "description": "The name of the Google Compute Engine [network](https://cloud.google.com/compute/docs/networks-and-firewalls#networks) to which the cluster is connected. If left unspecified, the `default` network will be used.",
- "type": "string"
- },
- "networkConfig": {
- "$ref": "#/$defs/NetworkConfig",
- "description": "Configuration for cluster networking."
- },
- "networkPolicy": {
- "$ref": "#/$defs/NetworkPolicy",
- "description": "Configuration options for the NetworkPolicy feature."
- },
- "nodeConfig": {
- "$ref": "#/$defs/NodeConfig",
- "deprecated": true,
- "description": "Parameters used in creating the cluster's nodes. For requests, this field should only be used in lieu of a \"node_pool\" object, since this configuration (along with the \"initial_node_count\") will be used to create a \"NodePool\" object with an auto-generated name. Do not use this and a node_pool at the same time. For responses, this field will be populated with the node configuration of the first node pool. (For configuration of each node pool, see `node_pool.config`) If unspecified, the defaults are used. This field is deprecated, use node_pool.config instead."
- },
- "nodeIpv4CidrSize": {
- "description": "Output only. The size of the address space on each node for hosting containers. This is provisioned from within the `container_ipv4_cidr` range. This field will only be set when cluster is in route-based network mode.",
- "format": "int32",
- "readOnly": true,
- "type": "integer"
- },
- "nodePoolAutoConfig": {
- "$ref": "#/$defs/NodePoolAutoConfig",
- "description": "Node pool configs that apply to all auto-provisioned node pools in autopilot clusters and node auto-provisioning enabled clusters."
- },
- "nodePoolDefaults": {
- "$ref": "#/$defs/NodePoolDefaults",
- "description": "Default NodePool settings for the entire cluster. These settings are overridden if specified on the specific NodePool object."
- },
- "nodePools": {
- "description": "The node pools associated with this cluster. This field should not be set if \"node_config\" or \"initial_node_count\" are specified.",
- "items": {
- "$ref": "#/$defs/NodePool"
- },
- "type": "array"
- },
- "notificationConfig": {
- "$ref": "#/$defs/NotificationConfig",
- "description": "Notification configuration of the cluster."
- },
- "parentProductConfig": {
- "$ref": "#/$defs/ParentProductConfig",
- "description": "The configuration of the parent product of the cluster. This field is used by Google internal products that are built on top of the GKE cluster and take the ownership of the cluster."
- },
- "podAutoscaling": {
- "$ref": "#/$defs/PodAutoscaling",
- "description": "The config for pod autoscaling."
- },
- "privateClusterConfig": {
- "$ref": "#/$defs/PrivateClusterConfig",
- "description": "Configuration for private cluster."
- },
- "rbacBindingConfig": {
- "$ref": "#/$defs/RBACBindingConfig",
- "description": "RBACBindingConfig allows user to restrict ClusterRoleBindings an RoleBindings that can be created."
- },
- "releaseChannel": {
- "$ref": "#/$defs/ReleaseChannel",
- "description": "Release channel configuration. If left unspecified on cluster creation and a version is specified, the cluster is enrolled in the most mature release channel where the version is available (first checking STABLE, then REGULAR, and finally RAPID). Otherwise, if no release channel configuration and no version is specified, the cluster is enrolled in the REGULAR channel with its default version."
- },
- "resourceLabels": {
- "additionalProperties": {
- "type": "string"
- },
- "description": "The resource labels for the cluster to use to annotate any related Google Compute Engine resources.",
- "type": "object"
- },
- "resourceUsageExportConfig": {
- "$ref": "#/$defs/ResourceUsageExportConfig",
- "description": "Configuration for exporting resource usages. Resource usage export is disabled when this config is unspecified."
- },
- "satisfiesPzi": {
- "description": "Output only. Reserved for future use.",
- "readOnly": true,
- "type": "boolean"
- },
- "satisfiesPzs": {
- "description": "Output only. Reserved for future use.",
- "readOnly": true,
- "type": "boolean"
- },
- "scheduleUpgradeConfig": {
- "$ref": "#/$defs/ScheduleUpgradeConfig",
- "description": "Optional. Configuration for scheduled upgrades."
- },
- "secretManagerConfig": {
- "$ref": "#/$defs/SecretManagerConfig",
- "description": "Secret CSI driver configuration."
- },
- "securityPostureConfig": {
- "$ref": "#/$defs/SecurityPostureConfig",
- "description": "Optional. Enable/Disable Security Posture API features for the cluster."
- },
- "selfLink": {
- "description": "Output only. Server-defined URL for the resource.",
- "readOnly": true,
- "type": "string"
- },
- "servicesIpv4Cidr": {
- "description": "Output only. The IP address range of the Kubernetes services in this cluster, in [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `1.2.3.4/29`). Service addresses are typically put in the last `/16` from the container CIDR.",
- "readOnly": true,
- "type": "string"
- },
- "shieldedNodes": {
- "$ref": "#/$defs/ShieldedNodes",
- "description": "Shielded Nodes configuration."
- },
- "status": {
- "description": "Output only. The current status of this cluster.",
- "enum": [
- "STATUS_UNSPECIFIED",
- "PROVISIONING",
- "RUNNING",
- "RECONCILING",
- "STOPPING",
- "ERROR",
- "DEGRADED"
- ],
- "readOnly": true,
- "type": "string",
- "x-google-enum-descriptions": [
- "Not set.",
- "The PROVISIONING state indicates the cluster is being created.",
- "The RUNNING state indicates the cluster has been created and is fully usable.",
- "The RECONCILING state indicates that some work is actively being done on the cluster, such as upgrading the master or node software. Details can be found in the `statusMessage` field.",
- "The STOPPING state indicates the cluster is being deleted.",
- "The ERROR state indicates the cluster is unusable. It will be automatically deleted. Details can be found in the `statusMessage` field.",
- "The DEGRADED state indicates the cluster requires user action to restore full functionality. Details can be found in the `statusMessage` field."
- ]
- },
- "statusMessage": {
- "deprecated": true,
- "description": "Output only. Deprecated. Use conditions instead. Additional information about the current status of this cluster, if available.",
- "readOnly": true,
- "type": "string"
- },
- "subnetwork": {
- "description": "The name of the Google Compute Engine [subnetwork](https://cloud.google.com/compute/docs/subnetworks) to which the cluster is connected.",
- "type": "string"
- },
- "tpuIpv4CidrBlock": {
- "deprecated": true,
- "description": "Output only. The IP address range of the Cloud TPUs in this cluster, in [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `1.2.3.4/29`). This field is deprecated due to the deprecation of 2VM TPU. The end of life date for 2VM TPU is 2025-04-25.",
- "readOnly": true,
- "type": "string"
- },
- "userManagedKeysConfig": {
- "$ref": "#/$defs/UserManagedKeysConfig",
- "description": "The Custom keys configuration for the cluster."
- },
- "verticalPodAutoscaling": {
- "$ref": "#/$defs/VerticalPodAutoscaling",
- "description": "Cluster-level Vertical Pod Autoscaling configuration."
- },
- "workloadIdentityConfig": {
- "$ref": "#/$defs/WorkloadIdentityConfig",
- "description": "Configuration for the use of Kubernetes Service Accounts in IAM policies."
- },
- "zone": {
- "deprecated": true,
- "description": "Output only. The name of the Google Compute Engine [zone](https://cloud.google.com/compute/docs/zones#available) in which the cluster resides. This field is deprecated, use location instead.",
- "readOnly": true,
- "type": "string"
- }
- },
- "type": "object"
- },
- "ClusterAutoscaling": {
- "description": "ClusterAutoscaling contains global, per-cluster information required by Cluster Autoscaler to automatically adjust the size of the cluster and create/delete node pools based on the current needs.",
- "properties": {
- "autopilotGeneralProfile": {
- "description": "Autopilot general profile for the cluster, which defines the configuration for the cluster.",
- "enum": [
- "AUTOPILOT_GENERAL_PROFILE_UNSPECIFIED",
- "NO_PERFORMANCE",
- "NONE"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Use default configuration.",
- "Avoid extra IP consumption.",
- "Use default configuration."
- ]
- },
- "autoprovisioningLocations": {
- "description": "The list of Google Compute Engine [zones](https://cloud.google.com/compute/docs/zones#available) in which the NodePool's nodes can be created by NAP.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "autoprovisioningNodePoolDefaults": {
- "$ref": "#/$defs/AutoprovisioningNodePoolDefaults",
- "description": "AutoprovisioningNodePoolDefaults contains defaults for a node pool created by NAP."
- },
- "autoscalingProfile": {
- "description": "Defines autoscaling behaviour.",
- "enum": [
- "PROFILE_UNSPECIFIED",
- "OPTIMIZE_UTILIZATION",
- "BALANCED"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "No change to autoscaling configuration.",
- "Prioritize optimizing utilization of resources.",
- "Use default (balanced) autoscaling configuration."
- ]
- },
- "defaultComputeClassConfig": {
- "$ref": "#/$defs/DefaultComputeClassConfig",
- "description": "Default compute class is a configuration for default compute class."
- },
- "enableNodeAutoprovisioning": {
- "description": "Enables automatic node pool creation and deletion.",
- "type": "boolean"
- },
- "resourceLimits": {
- "description": "Contains global constraints regarding minimum and maximum amount of resources in the cluster.",
- "items": {
- "$ref": "#/$defs/ResourceLimit"
- },
- "type": "array"
- }
- },
- "type": "object"
- },
- "ClusterNetworkPerformanceConfig": {
- "description": "Configuration of network bandwidth tiers",
- "properties": {
- "totalEgressBandwidthTier": {
- "description": "Specifies the total network bandwidth tier for NodePools in the cluster.",
- "enum": [
- "TIER_UNSPECIFIED",
- "TIER_1"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value",
- "Higher bandwidth, actual values based on VM size."
- ]
- }
- },
- "type": "object"
- },
- "ClusterPolicyConfig": {
- "description": "ClusterPolicyConfig stores the configuration for cluster wide policies.",
- "properties": {
- "noStandardNodePools": {
- "description": "Denotes preventing standard node pools and requiring only autopilot node pools.",
- "type": "boolean"
- },
- "noSystemImpersonation": {
- "description": "Denotes preventing impersonation and CSRs for GKE System users.",
- "type": "boolean"
- },
- "noSystemMutation": {
- "description": "Denotes that preventing creation and mutation of resources in GKE managed namespaces and cluster-scoped GKE managed resources .",
- "type": "boolean"
- },
- "noUnsafeWebhooks": {
- "description": "Denotes preventing unsafe webhooks.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "CompliancePostureConfig": {
- "description": "Deprecated: Compliance Posture is no longer supported. For more details, see https://cloud.google.com/kubernetes-engine/docs/deprecations/posture-management-deprecation. CompliancePostureConfig defines the settings needed to enable/disable features for the Compliance Posture.",
- "properties": {
- "complianceStandards": {
- "description": "List of enabled compliance standards.",
- "items": {
- "$ref": "#/$defs/ComplianceStandard"
- },
- "type": "array"
- },
- "mode": {
- "description": "Defines the enablement mode for Compliance Posture.",
- "enum": [
- "MODE_UNSPECIFIED",
- "DISABLED",
- "ENABLED"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value not specified.",
- "Disables Compliance Posture features on the cluster.",
- "Enables Compliance Posture features on the cluster."
- ]
- }
- },
- "type": "object"
- },
- "ComplianceStandard": {
- "description": "Defines the details of a compliance standard.",
- "properties": {
- "standard": {
- "description": "Name of the compliance standard.",
- "type": "string"
- }
- },
- "type": "object"
- },
- "ConfidentialNodes": {
- "description": "ConfidentialNodes is configuration for the confidential nodes feature, which makes nodes run on confidential VMs.",
- "properties": {
- "confidentialInstanceType": {
- "description": "Defines the type of technology used by the confidential node.",
- "enum": [
- "CONFIDENTIAL_INSTANCE_TYPE_UNSPECIFIED",
- "SEV",
- "SEV_SNP",
- "TDX"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "No type specified. Do not use this value.",
- "AMD Secure Encrypted Virtualization.",
- "AMD Secure Encrypted Virtualization - Secure Nested Paging.",
- "Intel Trust Domain eXtension."
- ]
- },
- "enabled": {
- "description": "Whether Confidential Nodes feature is enabled.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "ConfigConnectorConfig": {
- "description": "Configuration options for the Config Connector add-on.",
- "properties": {
- "enabled": {
- "description": "Whether Cloud Connector is enabled for this cluster.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "ConsumptionMeteringConfig": {
- "description": "Parameters for controlling consumption metering.",
- "properties": {
- "enabled": {
- "description": "Whether to enable consumption metering for this cluster. If enabled, a second BigQuery table will be created to hold resource consumption records.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "ContainerdConfig": {
- "description": "ContainerdConfig contains configuration to customize containerd.",
- "properties": {
- "privateRegistryAccessConfig": {
- "$ref": "#/$defs/PrivateRegistryAccessConfig",
- "description": "PrivateRegistryAccessConfig is used to configure access configuration for private container registries."
- },
- "registryHosts": {
- "description": "RegistryHostConfig configures containerd registry host configuration. Each registry_hosts represents a hosts.toml file. At most 25 registry_hosts are allowed.",
- "items": {
- "$ref": "#/$defs/RegistryHostConfig"
- },
- "type": "array"
- },
- "writableCgroups": {
- "$ref": "#/$defs/WritableCgroups",
- "description": "Optional. WritableCgroups defines writable cgroups configuration for the node pool."
- }
- },
- "type": "object"
- },
- "ControlPlaneEgress": {
- "description": "ControlPlaneEgress defines the settings needed to enable control plane egress control.",
- "properties": {
- "mode": {
- "description": "Defines the mode of control plane egress.",
- "enum": [
- "MODE_UNSPECIFIED",
- "VIA_CONTROL_PLANE",
- "NONE"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value not specified.",
- "Control plane has public IP and no restriction on egress.",
- "No public IP on control plane and only internal allowlisted egress."
- ]
- }
- },
- "type": "object"
- },
- "ControlPlaneEndpointsConfig": {
- "description": "Configuration for all of the cluster's control plane endpoints.",
- "properties": {
- "dnsEndpointConfig": {
- "$ref": "#/$defs/DNSEndpointConfig",
- "description": "DNS endpoint configuration."
- },
- "ipEndpointsConfig": {
- "$ref": "#/$defs/IPEndpointsConfig",
- "description": "IP endpoints configuration."
- }
- },
- "type": "object"
- },
- "CostManagementConfig": {
- "description": "Configuration for fine-grained cost management feature.",
- "properties": {
- "enabled": {
- "description": "Whether the feature is enabled or not.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "CrashLoopBackOffConfig": {
- "description": "Contains config to modify node-level parameters for container restart behavior.",
- "properties": {
- "maxContainerRestartPeriod": {
- "description": "Optional. The maximum duration the backoff delay can accrue to for container restarts, minimum 1 second, maximum 300 seconds. If not set, defaults to the internal crashloopbackoff maximum. The string must be a sequence of decimal numbers, each with optional fraction and a unit suffix, such as \"300ms\". Valid time units are \"ns\", \"us\" (or \"µs\"), \"ms\", \"s\", \"m\", \"h\". See https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#configurable-container-restart-delay for more details.",
- "type": "string"
- }
- },
- "type": "object"
- },
- "DNSConfig": {
- "description": "DNSConfig contains the desired set of options for configuring clusterDNS.",
- "properties": {
- "additiveVpcScopeDnsDomain": {
- "description": "Optional. The domain used in Additive VPC scope.",
- "type": "string"
- },
- "clusterDns": {
- "description": "cluster_dns indicates which in-cluster DNS provider should be used.",
- "enum": [
- "PROVIDER_UNSPECIFIED",
- "PLATFORM_DEFAULT",
- "CLOUD_DNS",
- "KUBE_DNS"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value",
- "Use GKE default DNS provider(kube-dns) for DNS resolution.",
- "Use CloudDNS for DNS resolution.",
- "Use KubeDNS for DNS resolution."
- ]
- },
- "clusterDnsDomain": {
- "description": "cluster_dns_domain is the suffix used for all cluster service records.",
- "type": "string"
- },
- "clusterDnsScope": {
- "description": "cluster_dns_scope indicates the scope of access to cluster DNS records.",
- "enum": [
- "DNS_SCOPE_UNSPECIFIED",
- "CLUSTER_SCOPE",
- "VPC_SCOPE"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value, will be inferred as cluster scope.",
- "DNS records are accessible from within the cluster.",
- "DNS records are accessible from within the VPC."
- ]
- }
- },
- "type": "object"
- },
- "DNSEndpointConfig": {
- "description": "Describes the configuration of a DNS endpoint.",
- "properties": {
- "allowExternalTraffic": {
- "description": "Controls whether user traffic is allowed over this endpoint. Note that Google-managed services may still use the endpoint even if this is false.",
- "type": "boolean"
- },
- "enableK8sCertsViaDns": {
- "description": "Controls whether the k8s certs auth is allowed via DNS.",
- "type": "boolean"
- },
- "enableK8sTokensViaDns": {
- "description": "Controls whether the k8s token auth is allowed via DNS.",
- "type": "boolean"
- },
- "endpoint": {
- "description": "Output only. The cluster's DNS endpoint configuration. A DNS format address. This is accessible from the public internet. Ex: uid.us-central1.gke.goog. Always present, but the behavior may change according to the value of DNSEndpointConfig.allow_external_traffic.",
- "readOnly": true,
- "type": "string"
- }
- },
- "type": "object"
- },
- "DailyMaintenanceWindow": {
- "description": "Time window specified for daily maintenance operations.",
- "properties": {
- "duration": {
- "description": "Output only. Duration of the time window, automatically chosen to be smallest possible in the given scenario. Duration will be in [RFC3339](https://www.ietf.org/rfc/rfc3339.txt) format \"PTnHnMnS\".",
- "readOnly": true,
- "type": "string"
- },
- "startTime": {
- "description": "Time within the maintenance window to start the maintenance operations. Time format should be in [RFC3339](https://www.ietf.org/rfc/rfc3339.txt) format \"HH:MM\", where HH : [00-23] and MM : [00-59] GMT.",
- "type": "string"
- }
- },
- "type": "object"
- },
- "DatabaseEncryption": {
- "description": "Configuration of etcd encryption.",
- "properties": {
- "currentState": {
- "description": "Output only. The current state of etcd encryption.",
- "enum": [
- "CURRENT_STATE_UNSPECIFIED",
- "CURRENT_STATE_ENCRYPTED",
- "CURRENT_STATE_DECRYPTED",
- "CURRENT_STATE_ENCRYPTION_PENDING",
- "CURRENT_STATE_ENCRYPTION_ERROR",
- "CURRENT_STATE_DECRYPTION_PENDING",
- "CURRENT_STATE_DECRYPTION_ERROR",
- "CURRENT_STATE_ALL_OBJECTS_ENCRYPTION_ENABLED",
- "CURRENT_STATE_ALL_OBJECTS_ENCRYPTION_PENDING",
- "CURRENT_STATE_ALL_OBJECTS_ENCRYPTION_ERROR"
- ],
- "readOnly": true,
- "type": "string",
- "x-google-enum-descriptions": [
- "Should never be set",
- "Secrets in etcd are encrypted.",
- "Secrets in etcd are stored in plain text (at etcd level) - this is unrelated to Compute Engine level full disk encryption.",
- "Encryption (or re-encryption with a different CloudKMS key) of Secrets is in progress.",
- "Encryption (or re-encryption with a different CloudKMS key) of Secrets in etcd encountered an error.",
- "De-crypting Secrets to plain text in etcd is in progress.",
- "De-crypting Secrets to plain text in etcd encountered an error.",
- "Encryption of all objects in the storage is enabled. It does not guarantee that all objects in the storage are encrypted, but eventually they will be.",
- "Enablement of the encryption of all objects in storage is pending.",
- "Enabling encryption of all objects in storage encountered an error."
- ]
- },
- "decryptionKeys": {
- "description": "Output only. Keys in use by the cluster for decrypting existing objects, in addition to the key in `key_name`. Each item is a CloudKMS key resource.",
- "items": {
- "type": "string"
- },
- "readOnly": true,
- "type": "array"
- },
- "keyName": {
- "description": "Name of CloudKMS key to use for the encryption of secrets in etcd. Ex. projects/my-project/locations/global/keyRings/my-ring/cryptoKeys/my-key",
- "type": "string"
- },
- "lastOperationErrors": {
- "description": "Output only. Records errors seen during DatabaseEncryption update operations.",
- "items": {
- "$ref": "#/$defs/OperationError"
- },
- "readOnly": true,
- "type": "array"
- },
- "state": {
- "description": "The desired state of etcd encryption.",
- "enum": [
- "UNKNOWN",
- "ENCRYPTED",
- "DECRYPTED",
- "ALL_OBJECTS_ENCRYPTION_ENABLED"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Should never be set",
- "Secrets in etcd are encrypted.",
- "Secrets in etcd are stored in plain text (at etcd level) - this is unrelated to Compute Engine level full disk encryption.",
- "Encryption of all objects in the storage is enabled. There is no guarantee that all objects in the storage are encrypted, but eventually they will be."
- ]
- }
- },
- "type": "object"
- },
- "DedicatedLocalSsdProfile": {
- "description": "Provisions a new, separate local NVMe SSD exclusively for swap.",
- "properties": {
- "diskCount": {
- "description": "The number of physical local NVMe SSD disks to attach.",
- "format": "int64",
- "type": "string"
- }
- },
- "type": "object"
- },
- "DefaultComputeClassConfig": {
- "description": "DefaultComputeClassConfig defines default compute class configuration.",
- "properties": {
- "enabled": {
- "description": "Enables default compute class.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "DefaultSnatStatus": {
- "description": "DefaultSnatStatus contains the desired state of whether default sNAT should be disabled on the cluster.",
- "properties": {
- "disabled": {
- "description": "Disables cluster default sNAT rules.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "DisruptionBudget": {
- "description": "DisruptionBudget defines the upgrade disruption budget for the cluster control plane.",
- "properties": {
- "lastDisruptionTime": {
- "description": "Output only. The last time a disruption was performed on the control plane.",
- "format": "date-time",
- "readOnly": true,
- "type": "string"
- },
- "lastMinorVersionDisruptionTime": {
- "description": "Output only. The last time a minor version upgrade was performed on the control plane.",
- "format": "date-time",
- "readOnly": true,
- "type": "string"
- },
- "minorVersionDisruptionInterval": {
- "description": "Optional. The minimum duration between two minor version upgrades of the control plane.",
- "format": "google-duration",
- "type": "string"
- },
- "patchVersionDisruptionInterval": {
- "description": "Optional. The minimum duration between two patch version upgrades of the control plane.",
- "format": "google-duration",
- "type": "string"
- }
- },
- "type": "object"
- },
- "DnsCacheConfig": {
- "description": "Configuration for NodeLocal DNSCache",
- "properties": {
- "enabled": {
- "description": "Whether NodeLocal DNSCache is enabled for this cluster.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "EncryptionConfig": {
- "description": "Defines encryption settings for the swap space.",
- "properties": {
- "disabled": {
- "description": "Optional. If true, swap space will not be encrypted. Defaults to false (encrypted).",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "EnterpriseConfig": {
- "description": "EnterpriseConfig is the cluster enterprise configuration. Deprecated: GKE Enterprise features are now available without an Enterprise tier.",
- "properties": {
- "clusterTier": {
- "description": "Output only. cluster_tier indicates the effective tier of the cluster.",
- "enum": [
- "CLUSTER_TIER_UNSPECIFIED",
- "STANDARD",
- "ENTERPRISE"
- ],
- "readOnly": true,
- "type": "string",
- "x-google-enum-descriptions": [
- "CLUSTER_TIER_UNSPECIFIED is when cluster_tier is not set.",
- "STANDARD indicates a standard GKE cluster.",
- "ENTERPRISE indicates a GKE Enterprise cluster."
- ]
- },
- "desiredTier": {
- "description": "desired_tier specifies the desired tier of the cluster.",
- "enum": [
- "CLUSTER_TIER_UNSPECIFIED",
- "STANDARD",
- "ENTERPRISE"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "CLUSTER_TIER_UNSPECIFIED is when cluster_tier is not set.",
- "STANDARD indicates a standard GKE cluster.",
- "ENTERPRISE indicates a GKE Enterprise cluster."
- ]
- }
- },
- "type": "object"
- },
- "EphemeralLocalSsdProfile": {
- "description": "Swap on the local SSD shared with pod ephemeral storage.",
- "properties": {
- "swapSizeGib": {
- "description": "Specifies the size of the swap space in gibibytes (GiB).",
- "format": "int64",
- "type": "string"
- },
- "swapSizePercent": {
- "description": "Specifies the size of the swap space as a percentage of the ephemeral local SSD capacity.",
- "format": "int32",
- "type": "integer"
- }
- },
- "type": "object"
- },
- "EphemeralStorageLocalSsdConfig": {
- "description": "EphemeralStorageLocalSsdConfig contains configuration for the node ephemeral storage using Local SSDs.",
- "properties": {
- "dataCacheCount": {
- "description": "Number of local SSDs to use for GKE Data Cache.",
- "format": "int32",
- "type": "integer"
- },
- "localSsdCount": {
- "description": "Number of local SSDs to use to back ephemeral storage. Uses NVMe interfaces. A zero (or unset) value has different meanings depending on machine type being used: 1. For pre-Gen3 machines, which support flexible numbers of local ssds, zero (or unset) means to disable using local SSDs as ephemeral storage. The limit for this value is dependent upon the maximum number of disk available on a machine per zone. See: https://cloud.google.com/compute/docs/disks/local-ssd for more information. 2. For Gen3 machines which dictate a specific number of local ssds, zero (or unset) means to use the default number of local ssds that goes with that machine type. For example, for a c3-standard-8-lssd machine, 2 local ssds would be provisioned. For c3-standard-8 (which doesn't support local ssds), 0 will be provisioned. See https://cloud.google.com/compute/docs/disks/local-ssd#choose_number_local_ssds for more info.",
- "format": "int32",
- "type": "integer"
- }
- },
- "type": "object"
- },
- "EvictionGracePeriod": {
- "description": "Eviction grace periods are grace periods for each eviction signal.",
- "properties": {
- "imagefsAvailable": {
- "description": "Optional. Grace period for eviction due to imagefs available signal. Sample format: \"10s\". Must be >= 0. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "imagefsInodesFree": {
- "description": "Optional. Grace period for eviction due to imagefs inodes free signal. Sample format: \"10s\". Must be >= 0. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "memoryAvailable": {
- "description": "Optional. Grace period for eviction due to memory available signal. Sample format: \"10s\". Must be >= 0. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "nodefsAvailable": {
- "description": "Optional. Grace period for eviction due to nodefs available signal. Sample format: \"10s\". Must be >= 0. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "nodefsInodesFree": {
- "description": "Optional. Grace period for eviction due to nodefs inodes free signal. Sample format: \"10s\". Must be >= 0. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "pidAvailable": {
- "description": "Optional. Grace period for eviction due to pid available signal. Sample format: \"10s\". Must be >= 0. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- }
- },
- "type": "object"
- },
- "EvictionMinimumReclaim": {
- "description": "Eviction minimum reclaims are the resource amounts of minimum reclaims for each eviction signal.",
- "properties": {
- "imagefsAvailable": {
- "description": "Optional. Minimum reclaim for eviction due to imagefs available signal. Only take percentage value for now. Sample format: \"10%\". Must be <=10%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "imagefsInodesFree": {
- "description": "Optional. Minimum reclaim for eviction due to imagefs inodes free signal. Only take percentage value for now. Sample format: \"10%\". Must be <=10%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "memoryAvailable": {
- "description": "Optional. Minimum reclaim for eviction due to memory available signal. Only take percentage value for now. Sample format: \"10%\". Must be <=10%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "nodefsAvailable": {
- "description": "Optional. Minimum reclaim for eviction due to nodefs available signal. Only take percentage value for now. Sample format: \"10%\". Must be <=10%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "nodefsInodesFree": {
- "description": "Optional. Minimum reclaim for eviction due to nodefs inodes free signal. Only take percentage value for now. Sample format: \"10%\". Must be <=10%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "pidAvailable": {
- "description": "Optional. Minimum reclaim for eviction due to pid available signal. Only take percentage value for now. Sample format: \"10%\". Must be <=10%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- }
- },
- "type": "object"
- },
- "EvictionSignals": {
- "description": "Eviction signals are the current state of a particular resource at a specific point in time. The kubelet uses eviction signals to make eviction decisions by comparing the signals to eviction thresholds, which are the minimum amount of the resource that should be available on the node.",
- "properties": {
- "imagefsAvailable": {
- "description": "Optional. Amount of storage available on filesystem that container runtime uses for storing images layers. If the container filesystem and image filesystem are not separate, then imagefs can store both image layers and writeable layers. Defines the amount of \"imagefs.available\" signal in kubelet. Default is unset, if not specified in the kubelet config. It takses percentage value for now. Sample format: \"30%\". Must be >= 15% and <= 50%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "imagefsInodesFree": {
- "description": "Optional. Amount of inodes available on filesystem that container runtime uses for storing images layers. Defines the amount of \"imagefs.inodesFree\" signal in kubelet. Default is unset, if not specified in the kubelet config. Linux only. It takses percentage value for now. Sample format: \"30%\". Must be >= 5% and <= 50%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "memoryAvailable": {
- "description": "Optional. Memory available (i.e. capacity - workingSet), in bytes. Defines the amount of \"memory.available\" signal in kubelet. Default is unset, if not specified in the kubelet config. Format: positive number + unit, e.g. 100Ki, 10Mi, 5Gi. Valid units are Ki, Mi, Gi. Must be >= 100Mi and <= 50% of the node's memory. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "nodefsAvailable": {
- "description": "Optional. Amount of storage available on filesystem that kubelet uses for volumes, daemon logs, etc. Defines the amount of \"nodefs.available\" signal in kubelet. Default is unset, if not specified in the kubelet config. It takses percentage value for now. Sample format: \"30%\". Must be >= 10% and <= 50%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "nodefsInodesFree": {
- "description": "Optional. Amount of inodes available on filesystem that kubelet uses for volumes, daemon logs, etc. Defines the amount of \"nodefs.inodesFree\" signal in kubelet. Default is unset, if not specified in the kubelet config. Linux only. It takses percentage value for now. Sample format: \"30%\". Must be >= 5% and <= 50%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "pidAvailable": {
- "description": "Optional. Amount of PID available for pod allocation. Defines the amount of \"pid.available\" signal in kubelet. Default is unset, if not specified in the kubelet config. It takses percentage value for now. Sample format: \"30%\". Must be >= 10% and <= 50%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- }
- },
- "type": "object"
- },
- "FastSocket": {
- "description": "Configuration of Fast Socket feature.",
- "properties": {
- "enabled": {
- "description": "Whether Fast Socket features are enabled in the node pool.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "Filter": {
- "description": "Allows filtering to one or more specific event types. If event types are present, those and only those event types will be transmitted to the cluster. Other types will be skipped. If no filter is specified, or no event types are present, all event types will be sent",
- "properties": {
- "eventType": {
- "description": "Event types to allowlist.",
- "items": {
- "enum": [
- "EVENT_TYPE_UNSPECIFIED",
- "UPGRADE_AVAILABLE_EVENT",
- "UPGRADE_EVENT",
- "SECURITY_BULLETIN_EVENT",
- "UPGRADE_INFO_EVENT"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Not set, will be ignored.",
- "Corresponds with UpgradeAvailableEvent.",
- "Corresponds with UpgradeEvent.",
- "Corresponds with SecurityBulletinEvent.",
- "Corresponds with UpgradeInfoEvent."
- ]
- },
- "type": "array"
- }
- },
- "type": "object"
- },
- "Fleet": {
- "description": "Fleet is the fleet configuration for the cluster.",
- "properties": {
- "membership": {
- "description": "Output only. The full resource name of the registered fleet membership of the cluster, in the format `//gkehub.googleapis.com/projects/*/locations/*/memberships/*`.",
- "readOnly": true,
- "type": "string"
- },
- "membershipType": {
- "description": "The type of the cluster's fleet membership.",
- "enum": [
- "MEMBERSHIP_TYPE_UNSPECIFIED",
- "LIGHTWEIGHT"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "The MembershipType is not set.",
- "The membership supports only lightweight compatible features."
- ]
- },
- "preRegistered": {
- "description": "Output only. Whether the cluster has been registered through the fleet API.",
- "readOnly": true,
- "type": "boolean"
- },
- "project": {
- "description": "The Fleet host project(project ID or project number) where this cluster will be registered to. This field cannot be changed after the cluster has been registered.",
- "type": "string"
- }
- },
- "type": "object"
- },
- "GCPSecretManagerCertificateConfig": {
- "description": "GCPSecretManagerCertificateConfig configures a secret from [Secret Manager](https://cloud.google.com/secret-manager).",
- "properties": {
- "secretUri": {
- "description": "Secret URI, in the form \"projects/$PROJECT_ID/secrets/$SECRET_NAME/versions/$VERSION\". Version can be fixed (e.g. \"2\") or \"latest\"",
- "type": "string"
- }
- },
- "type": "object"
- },
- "GPUDirectConfig": {
- "description": "GPUDirectConfig specifies the GPU direct strategy on the node pool.",
- "properties": {
- "gpuDirectStrategy": {
- "description": "The type of GPU direct strategy to enable on the node pool.",
- "enum": [
- "GPU_DIRECT_STRATEGY_UNSPECIFIED",
- "RDMA"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value. No GPU Direct strategy is enabled on the node.",
- "GPUDirect-RDMA on A3 Ultra, and A4 machine types"
- ]
- }
- },
- "type": "object"
- },
- "GPUDriverInstallationConfig": {
- "description": "GPUDriverInstallationConfig specifies the version of GPU driver to be auto installed.",
- "properties": {
- "gpuDriverVersion": {
- "description": "Mode for how the GPU driver is installed.",
- "enum": [
- "GPU_DRIVER_VERSION_UNSPECIFIED",
- "INSTALLATION_DISABLED",
- "DEFAULT",
- "LATEST"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value is to not install any GPU driver.",
- "Disable GPU driver auto installation and needs manual installation",
- "\"Default\" GPU driver in COS and Ubuntu.",
- "\"Latest\" GPU driver in COS."
- ]
- }
- },
- "type": "object"
- },
- "GPUSharingConfig": {
- "description": "GPUSharingConfig represents the GPU sharing configuration for Hardware Accelerators.",
- "properties": {
- "gpuSharingStrategy": {
- "description": "The type of GPU sharing strategy to enable on the GPU node.",
- "enum": [
- "GPU_SHARING_STRATEGY_UNSPECIFIED",
- "TIME_SHARING",
- "MPS"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value.",
- "GPUs are time-shared between containers.",
- "GPUs are shared between containers with NVIDIA MPS."
- ]
- },
- "maxSharedClientsPerGpu": {
- "description": "The max number of containers that can share a physical GPU.",
- "format": "int64",
- "type": "string"
- }
- },
- "type": "object"
- },
- "GatewayAPIConfig": {
- "description": "GatewayAPIConfig contains the desired config of Gateway API on this cluster.",
- "properties": {
- "channel": {
- "description": "The Gateway API release channel to use for Gateway API.",
- "enum": [
- "CHANNEL_UNSPECIFIED",
- "CHANNEL_DISABLED",
- "CHANNEL_EXPERIMENTAL",
- "CHANNEL_STANDARD"
- ],
- "type": "string",
- "x-google-enum-deprecated": [
- false,
- false,
- true,
- false
- ],
- "x-google-enum-descriptions": [
- "Default value.",
- "Gateway API support is disabled",
- "Deprecated: use CHANNEL_STANDARD instead. Gateway API support is enabled, experimental CRDs are installed",
- "Gateway API support is enabled, standard CRDs are installed"
- ]
- }
- },
- "type": "object"
- },
- "GcePersistentDiskCsiDriverConfig": {
- "description": "Configuration for the Compute Engine PD CSI driver.",
- "properties": {
- "enabled": {
- "description": "Whether the Compute Engine PD CSI driver is enabled for this cluster.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "GcfsConfig": {
- "description": "GcfsConfig contains configurations of Google Container File System (image streaming).",
- "properties": {
- "enabled": {
- "description": "Whether to use GCFS.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "GcpFilestoreCsiDriverConfig": {
- "description": "Configuration for the Filestore CSI driver.",
- "properties": {
- "enabled": {
- "description": "Whether the Filestore CSI driver is enabled for this cluster.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "GcsFuseCsiDriverConfig": {
- "description": "Configuration for the Cloud Storage Fuse CSI driver.",
- "properties": {
- "enabled": {
- "description": "Whether the Cloud Storage Fuse CSI driver is enabled for this cluster.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "GkeAutoUpgradeConfig": {
- "description": "GkeAutoUpgradeConfig is the configuration for GKE auto upgrades.",
- "properties": {
- "patchMode": {
- "description": "PatchMode specifies how auto upgrade patch builds should be selected.",
- "enum": [
- "PATCH_MODE_UNSPECIFIED",
- "ACCELERATED"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "PATCH_MODE_UNSPECIFIED defaults to using the upgrade target from the channel's patch upgrade targets as the upgrade target for the version.",
- "ACCELERATED denotes that the latest patch build in the channel should be used as the upgrade target for the version."
- ]
- }
- },
- "type": "object"
- },
- "GkeBackupAgentConfig": {
- "description": "Configuration for the Backup for GKE Agent.",
- "properties": {
- "enabled": {
- "description": "Whether the Backup for GKE agent is enabled for this cluster.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "HighScaleCheckpointingConfig": {
- "description": "Configuration for the High Scale Checkpointing.",
- "properties": {
- "enabled": {
- "description": "Whether the High Scale Checkpointing is enabled for this cluster.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "HorizontalPodAutoscaling": {
- "description": "Configuration options for the horizontal pod autoscaling feature, which increases or decreases the number of replica pods a replication controller has based on the resource usage of the existing pods.",
- "properties": {
- "disabled": {
- "description": "Whether the Horizontal Pod Autoscaling feature is enabled in the cluster. When enabled, it ensures that metrics are collected into Stackdriver Monitoring.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "HostConfig": {
- "description": "HostConfig configures the registry host under a given Server.",
- "properties": {
- "ca": {
- "description": "CA configures the registry host certificate.",
- "items": {
- "$ref": "#/$defs/CertificateConfig"
- },
- "type": "array"
- },
- "capabilities": {
- "description": "Capabilities represent the capabilities of the registry host, specifying what operations a host is capable of performing. If not set, containerd enables all capabilities by default.",
- "items": {
- "enum": [
- "HOST_CAPABILITY_UNSPECIFIED",
- "HOST_CAPABILITY_PULL",
- "HOST_CAPABILITY_RESOLVE",
- "HOST_CAPABILITY_PUSH"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "UNKNOWN should never be set.",
- "Pull represents the capability to fetch manifests and blobs by digest.",
- "Resolve represents the capability to fetch manifests by name.",
- "Push represents the capability to push blobs and manifests."
- ]
- },
- "type": "array"
- },
- "client": {
- "description": "Client configures the registry host client certificate and key.",
- "items": {
- "$ref": "#/$defs/CertificateConfigPair"
- },
- "type": "array"
- },
- "dialTimeout": {
- "description": "Specifies the maximum duration allowed for a connection attempt to complete. A shorter timeout helps reduce delays when falling back to the original registry if the mirror is unreachable. Maximum allowed value is 180s. If not set, containerd sets default 30s. The value should be a decimal number of seconds with an `s` suffix.",
- "format": "google-duration",
- "type": "string"
- },
- "header": {
- "description": "Header configures the registry host headers.",
- "items": {
- "$ref": "#/$defs/RegistryHeader"
- },
- "type": "array"
- },
- "host": {
- "description": "Host configures the registry host/mirror. It supports fully qualified domain names (FQDN) and IP addresses: Specifying port is supported. Wildcards are NOT supported. Examples: - my.customdomain.com - 10.0.1.2:5000",
- "type": "string"
- },
- "overridePath": {
- "description": "OverridePath is used to indicate the host's API root endpoint is defined in the URL path rather than by the API specification. This may be used with non-compliant OCI registries which are missing the /v2 prefix. If not set, containerd sets default false.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "HttpLoadBalancing": {
- "description": "Configuration options for the HTTP (L7) load balancing controller addon, which makes it easy to set up HTTP load balancers for services in a cluster.",
- "properties": {
- "disabled": {
- "description": "Whether the HTTP Load Balancing controller is enabled in the cluster. When enabled, it runs a small pod in the cluster that manages the load balancers.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "HugepagesConfig": {
- "description": "Hugepages amount in both 2m and 1g size",
- "properties": {
- "hugepageSize1g": {
- "description": "Optional. Amount of 1G hugepages",
- "format": "int32",
- "type": "integer"
- },
- "hugepageSize2m": {
- "description": "Optional. Amount of 2M hugepages",
- "format": "int32",
- "type": "integer"
- }
- },
- "type": "object"
- },
- "IPAllocationPolicy": {
- "description": "Configuration for controlling how IPs are allocated in the cluster.",
- "properties": {
- "additionalIpRangesConfigs": {
- "description": "Output only. The additional IP ranges that are added to the cluster. These IP ranges can be used by new node pools to allocate node and pod IPs automatically. Each AdditionalIPRangesConfig corresponds to a single subnetwork. Once a range is removed it will not show up in IPAllocationPolicy.",
- "items": {
- "$ref": "#/$defs/AdditionalIPRangesConfig"
- },
- "readOnly": true,
- "type": "array"
- },
- "additionalPodRangesConfig": {
- "$ref": "#/$defs/AdditionalPodRangesConfig",
- "description": "Output only. The additional pod ranges that are added to the cluster. These pod ranges can be used by new node pools to allocate pod IPs automatically. Once the range is removed it will not show up in IPAllocationPolicy.",
- "readOnly": true
- },
- "autoIpamConfig": {
- "$ref": "#/$defs/AutoIpamConfig",
- "description": "Optional. AutoIpamConfig contains all information related to Auto IPAM"
- },
- "clusterIpv4Cidr": {
- "deprecated": true,
- "description": "This field is deprecated, use cluster_ipv4_cidr_block.",
- "type": "string"
- },
- "clusterIpv4CidrBlock": {
- "description": "The IP address range for the cluster pod IPs. If this field is set, then `cluster.cluster_ipv4_cidr` must be left blank. This field is only applicable when `use_ip_aliases` is true. Set to blank to have a range chosen with the default size. Set to /netmask (e.g. `/14`) to have a range chosen with a specific netmask. Set to a [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) from the RFC-1918 private networks (e.g. `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) to pick a specific range to use.",
- "type": "string"
- },
- "clusterSecondaryRangeName": {
- "description": "The name of the secondary range to be used for the cluster CIDR block. The secondary range will be used for pod IP addresses. This must be an existing secondary range associated with the cluster subnetwork. This field is only applicable with use_ip_aliases is true and create_subnetwork is false.",
- "type": "string"
- },
- "createSubnetwork": {
- "description": "Whether a new subnetwork will be created automatically for the cluster. This field is only applicable when `use_ip_aliases` is true.",
- "type": "boolean"
- },
- "defaultPodIpv4RangeUtilization": {
- "description": "Output only. The utilization of the cluster default IPv4 range for the pod. The ratio is Usage/[Total number of IPs in the secondary range], Usage=numNodes*numZones*podIPsPerNode.",
- "format": "double",
- "readOnly": true,
- "type": "number"
- },
- "ipv6AccessType": {
- "description": "The ipv6 access type (internal or external) when create_subnetwork is true",
- "enum": [
- "IPV6_ACCESS_TYPE_UNSPECIFIED",
- "INTERNAL",
- "EXTERNAL"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value, will be defaulted as type external.",
- "Access type internal (all v6 addresses are internal IPs)",
- "Access type external (all v6 addresses are external IPs)"
- ]
- },
- "networkTierConfig": {
- "$ref": "#/$defs/NetworkTierConfig",
- "description": "Cluster-level network tier configuration is used to determine the default network tier for external IP addresses on cluster resources, such as node pools and load balancers."
- },
- "nodeIpv4Cidr": {
- "deprecated": true,
- "description": "This field is deprecated, use node_ipv4_cidr_block.",
- "type": "string"
- },
- "nodeIpv4CidrBlock": {
- "description": "The IP address range of the instance IPs in this cluster. This is applicable only if `create_subnetwork` is true. Set to blank to have a range chosen with the default size. Set to /netmask (e.g. `/14`) to have a range chosen with a specific netmask. Set to a [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) from the RFC-1918 private networks (e.g. `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) to pick a specific range to use.",
- "type": "string"
- },
- "podCidrOverprovisionConfig": {
- "$ref": "#/$defs/PodCIDROverprovisionConfig",
- "description": "[PRIVATE FIELD] Pod CIDR size overprovisioning config for the cluster. Pod CIDR size per node depends on max_pods_per_node. By default, the value of max_pods_per_node is doubled and then rounded off to next power of 2 to get the size of pod CIDR block per node. Example: max_pods_per_node of 30 would result in 64 IPs (/26). This config can disable the doubling of IPs (we still round off to next power of 2) Example: max_pods_per_node of 30 will result in 32 IPs (/27) when overprovisioning is disabled."
- },
- "servicesIpv4Cidr": {
- "deprecated": true,
- "description": "This field is deprecated, use services_ipv4_cidr_block.",
- "type": "string"
- },
- "servicesIpv4CidrBlock": {
- "description": "The IP address range of the services IPs in this cluster. If blank, a range will be automatically chosen with the default size. This field is only applicable when `use_ip_aliases` is true. Set to blank to have a range chosen with the default size. Set to /netmask (e.g. `/14`) to have a range chosen with a specific netmask. Set to a [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) from the RFC-1918 private networks (e.g. `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) to pick a specific range to use.",
- "type": "string"
- },
- "servicesIpv6CidrBlock": {
- "description": "Output only. The services IPv6 CIDR block for the cluster.",
- "readOnly": true,
- "type": "string"
- },
- "servicesSecondaryRangeName": {
- "description": "The name of the secondary range to be used as for the services CIDR block. The secondary range will be used for service ClusterIPs. This must be an existing secondary range associated with the cluster subnetwork. This field is only applicable with use_ip_aliases is true and create_subnetwork is false.",
- "type": "string"
- },
- "stackType": {
- "description": "The IP stack type of the cluster",
- "enum": [
- "STACK_TYPE_UNSPECIFIED",
- "IPV4",
- "IPV4_IPV6"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value, will be defaulted as IPV4 only",
- "Cluster is IPV4 only",
- "Cluster can use both IPv4 and IPv6"
- ]
- },
- "subnetIpv6CidrBlock": {
- "description": "Output only. The subnet's IPv6 CIDR block used by nodes and pods.",
- "readOnly": true,
- "type": "string"
- },
- "subnetworkName": {
- "description": "A custom subnetwork name to be used if `create_subnetwork` is true. If this field is empty, then an automatic name will be chosen for the new subnetwork.",
- "type": "string"
- },
- "tpuIpv4CidrBlock": {
- "deprecated": true,
- "description": "The IP address range of the Cloud TPUs in this cluster. If unspecified, a range will be automatically chosen with the default size. This field is only applicable when `use_ip_aliases` is true. If unspecified, the range will use the default size. Set to /netmask (e.g. `/14`) to have a range chosen with a specific netmask. Set to a [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) from the RFC-1918 private networks (e.g. `10.0.0.0/8`, `172.16.0.0/12`, `192.168.0.0/16`) to pick a specific range to use. This field is deprecated due to the deprecation of 2VM TPU. The end of life date for 2VM TPU is 2025-04-25.",
- "type": "string"
- },
- "useIpAliases": {
- "description": "Whether alias IPs will be used for pod IPs in the cluster. This is used in conjunction with use_routes. It cannot be true if use_routes is true. If both use_ip_aliases and use_routes are false, then the server picks the default IP allocation mode",
- "type": "boolean"
- },
- "useRoutes": {
- "description": "Whether routes will be used for pod IPs in the cluster. This is used in conjunction with use_ip_aliases. It cannot be true if use_ip_aliases is true. If both use_ip_aliases and use_routes are false, then the server picks the default IP allocation mode",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "IPEndpointsConfig": {
- "description": "IP endpoints configuration.",
- "properties": {
- "authorizedNetworksConfig": {
- "$ref": "#/$defs/MasterAuthorizedNetworksConfig",
- "description": "Configuration of authorized networks. If enabled, restricts access to the control plane based on source IP. It is invalid to specify both Cluster.masterAuthorizedNetworksConfig and this field at the same time."
- },
- "enablePublicEndpoint": {
- "description": "Controls whether the control plane allows access through a public IP. It is invalid to specify both PrivateClusterConfig.enablePrivateEndpoint and this field at the same time.",
- "type": "boolean"
- },
- "enabled": {
- "description": "Controls whether to allow direct IP access.",
- "type": "boolean"
- },
- "globalAccess": {
- "description": "Controls whether the control plane's private endpoint is accessible from sources in other regions. It is invalid to specify both PrivateClusterMasterGlobalAccessConfig.enabled and this field at the same time.",
- "type": "boolean"
- },
- "privateEndpoint": {
- "description": "Output only. The internal IP address of this cluster's control plane. Only populated if enabled.",
- "readOnly": true,
- "type": "string"
- },
- "privateEndpointSubnetwork": {
- "description": "Subnet to provision the master's private endpoint during cluster creation. Specified in projects/*/regions/*/subnetworks/* format. It is invalid to specify both PrivateClusterConfig.privateEndpointSubnetwork and this field at the same time.",
- "type": "string"
- },
- "publicEndpoint": {
- "description": "Output only. The external IP address of this cluster's control plane. Only populated if enabled.",
- "readOnly": true,
- "type": "string"
- }
- },
- "type": "object"
- },
- "IdentityServiceConfig": {
- "description": "IdentityServiceConfig is configuration for Identity Service which allows customers to use external identity providers with the K8S API",
- "properties": {
- "enabled": {
- "description": "Whether to enable the Identity Service component",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "K8sBetaAPIConfig": {
- "description": "K8sBetaAPIConfig , configuration for beta APIs",
- "properties": {
- "enabledApis": {
- "description": "Enabled k8s beta APIs.",
- "items": {
- "type": "string"
- },
- "type": "array"
- }
- },
- "type": "object"
- },
- "KubernetesDashboard": {
- "description": "Configuration for the Kubernetes Dashboard.",
- "properties": {
- "disabled": {
- "description": "Whether the Kubernetes Dashboard is enabled for this cluster.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "LegacyAbac": {
- "description": "Configuration for the legacy Attribute Based Access Control authorization mode.",
- "properties": {
- "enabled": {
- "description": "Whether the ABAC authorizer is enabled for this cluster. When enabled, identities in the system, including service accounts, nodes, and controllers, will have statically granted permissions beyond those provided by the RBAC configuration or IAM.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "LinuxNodeConfig": {
- "description": "Parameters that can be configured on Linux nodes.",
- "properties": {
- "cgroupMode": {
- "description": "cgroup_mode specifies the cgroup mode to be used on the node.",
- "enum": [
- "CGROUP_MODE_UNSPECIFIED",
- "CGROUP_MODE_V1",
- "CGROUP_MODE_V2"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "CGROUP_MODE_UNSPECIFIED is when unspecified cgroup configuration is used. The default for the GKE node OS image will be used.",
- "CGROUP_MODE_V1 specifies to use cgroupv1 for the cgroup configuration on the node image.",
- "CGROUP_MODE_V2 specifies to use cgroupv2 for the cgroup configuration on the node image."
- ]
- },
- "hugepages": {
- "$ref": "#/$defs/HugepagesConfig",
- "description": "Optional. Amounts for 2M and 1G hugepages"
- },
- "nodeKernelModuleLoading": {
- "$ref": "#/$defs/NodeKernelModuleLoading",
- "description": "Optional. Configuration for kernel module loading on nodes. When enabled, the node pool will be provisioned with a Container-Optimized OS image that enforces kernel module signature verification."
- },
- "swapConfig": {
- "$ref": "#/$defs/SwapConfig",
- "description": "Optional. Enables and configures swap space on nodes. If omitted, swap is disabled."
- },
- "sysctls": {
- "additionalProperties": {
- "type": "string"
- },
- "description": "The Linux kernel parameters to be applied to the nodes and all pods running on the nodes. The following parameters are supported. net.core.busy_poll net.core.busy_read net.core.netdev_max_backlog net.core.rmem_max net.core.rmem_default net.core.wmem_default net.core.wmem_max net.core.optmem_max net.core.somaxconn net.ipv4.tcp_rmem net.ipv4.tcp_wmem net.ipv4.tcp_tw_reuse net.ipv4.tcp_mtu_probing net.ipv4.tcp_max_orphans net.ipv4.tcp_max_tw_buckets net.ipv4.tcp_syn_retries net.ipv4.tcp_ecn net.ipv4.tcp_congestion_control net.netfilter.nf_conntrack_max net.netfilter.nf_conntrack_buckets net.netfilter.nf_conntrack_tcp_timeout_close_wait net.netfilter.nf_conntrack_tcp_timeout_time_wait net.netfilter.nf_conntrack_tcp_timeout_established net.netfilter.nf_conntrack_acct kernel.shmmni kernel.shmmax kernel.shmall kernel.perf_event_paranoid kernel.sched_rt_runtime_us kernel.softlockup_panic kernel.yama.ptrace_scope kernel.kptr_restrict kernel.dmesg_restrict kernel.sysrq fs.aio-max-nr fs.file-max fs.inotify.max_user_instances fs.inotify.max_user_watches fs.nr_open vm.dirty_background_ratio vm.dirty_background_bytes vm.dirty_expire_centisecs vm.dirty_ratio vm.dirty_bytes vm.dirty_writeback_centisecs vm.max_map_count vm.overcommit_memory vm.overcommit_ratio vm.vfs_cache_pressure vm.swappiness vm.watermark_scale_factor vm.min_free_kbytes",
- "type": "object"
- },
- "transparentHugepageDefrag": {
- "description": "Optional. Defines the transparent hugepage defrag configuration on the node. VM hugepage allocation can be managed by either limiting defragmentation for delayed allocation or skipping it entirely for immediate allocation only. See https://docs.kernel.org/admin-guide/mm/transhuge.html for more details.",
- "enum": [
- "TRANSPARENT_HUGEPAGE_DEFRAG_UNSPECIFIED",
- "TRANSPARENT_HUGEPAGE_DEFRAG_ALWAYS",
- "TRANSPARENT_HUGEPAGE_DEFRAG_DEFER",
- "TRANSPARENT_HUGEPAGE_DEFRAG_DEFER_WITH_MADVISE",
- "TRANSPARENT_HUGEPAGE_DEFRAG_MADVISE",
- "TRANSPARENT_HUGEPAGE_DEFRAG_NEVER"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value. GKE will not modify the kernel configuration.",
- "It means that an application requesting THP will stall on allocation failure and directly reclaim pages and compact memory in an effort to allocate a THP immediately.",
- "It means that an application will wake kswapd in the background to reclaim pages and wake kcompactd to compact memory so that THP is available in the near future. It's the responsibility of khugepaged to then install the THP pages later.",
- "It means that an application will enter direct reclaim and compaction like always, but only for regions that have used madvise(MADV_HUGEPAGE); all other regions will wake kswapd in the background to reclaim pages and wake kcompactd to compact memory so that THP is available in the near future.",
- "It means that an application will enter direct reclaim like always but only for regions that are have used madvise(MADV_HUGEPAGE). This is the default kernel configuration.",
- "It means that an application will never enter direct reclaim or compaction."
- ]
- },
- "transparentHugepageEnabled": {
- "description": "Optional. Transparent hugepage support for anonymous memory can be entirely disabled (mostly for debugging purposes) or only enabled inside MADV_HUGEPAGE regions (to avoid the risk of consuming more memory resources) or enabled system wide. See https://docs.kernel.org/admin-guide/mm/transhuge.html for more details.",
- "enum": [
- "TRANSPARENT_HUGEPAGE_ENABLED_UNSPECIFIED",
- "TRANSPARENT_HUGEPAGE_ENABLED_ALWAYS",
- "TRANSPARENT_HUGEPAGE_ENABLED_MADVISE",
- "TRANSPARENT_HUGEPAGE_ENABLED_NEVER"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value. GKE will not modify the kernel configuration.",
- "Transparent hugepage support for anonymous memory is enabled system wide.",
- "Transparent hugepage support for anonymous memory is enabled inside MADV_HUGEPAGE regions. This is the default kernel configuration.",
- "Transparent hugepage support for anonymous memory is disabled."
- ]
- }
- },
- "type": "object"
- },
- "LocalNvmeSsdBlockConfig": {
- "description": "LocalNvmeSsdBlockConfig contains configuration for using raw-block local NVMe SSDs",
- "properties": {
- "localSsdCount": {
- "description": "Number of local NVMe SSDs to use. The limit for this value is dependent upon the maximum number of disk available on a machine per zone. See: https://cloud.google.com/compute/docs/disks/local-ssd for more information. A zero (or unset) value has different meanings depending on machine type being used: 1. For pre-Gen3 machines, which support flexible numbers of local ssds, zero (or unset) means to disable using local SSDs as ephemeral storage. 2. For Gen3 machines which dictate a specific number of local ssds, zero (or unset) means to use the default number of local ssds that goes with that machine type. For example, for a c3-standard-8-lssd machine, 2 local ssds would be provisioned. For c3-standard-8 (which doesn't support local ssds), 0 will be provisioned. See https://cloud.google.com/compute/docs/disks/local-ssd#choose_number_local_ssds for more info.",
- "format": "int32",
- "type": "integer"
- }
- },
- "type": "object"
- },
- "LoggingComponentConfig": {
- "description": "LoggingComponentConfig is cluster logging component configuration.",
- "properties": {
- "enableComponents": {
- "description": "Select components to collect logs. An empty set would disable all logging.",
- "items": {
- "enum": [
- "COMPONENT_UNSPECIFIED",
- "SYSTEM_COMPONENTS",
- "WORKLOADS",
- "APISERVER",
- "SCHEDULER",
- "CONTROLLER_MANAGER",
- "KCP_SSHD",
- "KCP_CONNECTION",
- "KCP_HPA"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value. This shouldn't be used.",
- "system components",
- "workloads",
- "kube-apiserver",
- "kube-scheduler",
- "kube-controller-manager",
- "kcp-sshd",
- "kcp connection logs",
- "horizontal pod autoscaler decision logs"
- ]
- },
- "type": "array"
- }
- },
- "type": "object"
- },
- "LoggingConfig": {
- "description": "LoggingConfig is cluster logging configuration.",
- "properties": {
- "componentConfig": {
- "$ref": "#/$defs/LoggingComponentConfig",
- "description": "Logging components configuration"
- }
- },
- "type": "object"
- },
- "LoggingVariantConfig": {
- "description": "LoggingVariantConfig specifies the behaviour of the logging component.",
- "properties": {
- "variant": {
- "description": "Logging variant deployed on nodes.",
- "enum": [
- "VARIANT_UNSPECIFIED",
- "DEFAULT",
- "MAX_THROUGHPUT"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value. This shouldn't be used.",
- "default logging variant.",
- "maximum logging throughput variant."
- ]
- }
- },
- "type": "object"
- },
- "LustreCsiDriverConfig": {
- "description": "Configuration for the Lustre CSI driver.",
- "properties": {
- "disableMultiNic": {
- "description": "When set to true, this disables multi-NIC support for the Lustre CSI driver. By default, GKE enables multi-NIC support, which allows the Lustre CSI driver to automatically detect and configure all suitable network interfaces on a node to maximize I/O performance for demanding workloads.",
- "type": "boolean"
- },
- "enableLegacyLustrePort": {
- "deprecated": true,
- "description": "If set to true, the Lustre CSI driver will install Lustre kernel modules using port 6988. This serves as a workaround for a port conflict with the gke-metadata-server. This field is required ONLY under the following conditions: 1. The GKE node version is older than 1.33.2-gke.4655000. 2. You're connecting to a Lustre instance that has the 'gke-support-enabled' flag. Deprecated: This flag is no longer required as of GKE node version 1.33.2-gke.4655000, unless you are connecting to a Lustre instance that has the `gke-support-enabled` flag.",
- "type": "boolean"
- },
- "enabled": {
- "description": "Whether the Lustre CSI driver is enabled for this cluster.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "MaintenanceExclusionOptions": {
- "description": "Represents the Maintenance exclusion option.",
- "properties": {
- "endTimeBehavior": {
- "description": "EndTimeBehavior specifies the behavior of the exclusion end time.",
- "enum": [
- "END_TIME_BEHAVIOR_UNSPECIFIED",
- "UNTIL_END_OF_SUPPORT"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "END_TIME_BEHAVIOR_UNSPECIFIED is the default behavior, which is fixed end time.",
- "UNTIL_END_OF_SUPPORT means the exclusion will be in effect until the end of the support of the cluster's current version."
- ]
- },
- "scope": {
- "description": "Scope specifies the upgrade scope which upgrades are blocked by the exclusion.",
- "enum": [
- "NO_UPGRADES",
- "NO_MINOR_UPGRADES",
- "NO_MINOR_OR_NODE_UPGRADES"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "NO_UPGRADES excludes all upgrades, including patch upgrades and minor upgrades across control planes and nodes. This is the default exclusion behavior.",
- "NO_MINOR_UPGRADES excludes all minor upgrades for the cluster, only patches are allowed.",
- "NO_MINOR_OR_NODE_UPGRADES excludes all minor upgrades for the cluster, and also exclude all node pool upgrades. Only control plane patches are allowed."
- ]
- }
- },
- "type": "object"
- },
- "MaintenancePolicy": {
- "description": "MaintenancePolicy defines the maintenance policy to be used for the cluster.",
- "properties": {
- "disruptionBudget": {
- "$ref": "#/$defs/DisruptionBudget",
- "description": "Optional. The upgrade disruption budget for the cluster control plane."
- },
- "resourceVersion": {
- "description": "A hash identifying the version of this policy, so that updates to fields of the policy won't accidentally undo intermediate changes (and so that users of the API unaware of some fields won't accidentally remove other fields). Make a `get()` request to the cluster to get the current resource version and include it with requests to set the policy.",
- "type": "string"
- },
- "window": {
- "$ref": "#/$defs/MaintenanceWindow",
- "description": "Specifies the maintenance window in which maintenance may be performed."
- }
- },
- "type": "object"
- },
- "MaintenanceWindow": {
- "description": "MaintenanceWindow defines the maintenance window to be used for the cluster.",
- "properties": {
- "dailyMaintenanceWindow": {
- "$ref": "#/$defs/DailyMaintenanceWindow",
- "description": "DailyMaintenanceWindow specifies a daily maintenance operation window."
- },
- "maintenanceExclusions": {
- "additionalProperties": {
- "$ref": "#/$defs/TimeWindow"
- },
- "description": "Exceptions to maintenance window. Non-emergency maintenance should not occur in these windows.",
- "type": "object"
- },
- "recurringWindow": {
- "$ref": "#/$defs/RecurringTimeWindow",
- "description": "RecurringWindow specifies some number of recurring time periods for maintenance to occur. The time windows may be overlapping. If no maintenance windows are set, maintenance can occur at any time."
- }
- },
- "type": "object"
- },
- "ManagedMachineLearningDiagnosticsConfig": {
- "description": "ManagedMachineLearningDiagnosticsConfig is the configuration for the GKE Managed Machine Learning Diagnostics pipeline.",
- "properties": {
- "enabled": {
- "description": "Enable/Disable Managed Machine Learning Diagnostics.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "ManagedOpenTelemetryConfig": {
- "description": "ManagedOpenTelemetryConfig is the configuration for the GKE Managed OpenTelemetry pipeline.",
- "properties": {
- "scope": {
- "description": "Scope of the Managed OpenTelemetry pipeline.",
- "enum": [
- "SCOPE_UNSPECIFIED",
- "NONE",
- "COLLECTION_AND_INSTRUMENTATION_COMPONENTS"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "SCOPE_UNSPECIFIED is when the scope is not set.",
- "NONE is used to disable the Managed OpenTelemetry pipeline.",
- "COLLECTION_AND_INSTRUMENTATION_COMPONENTS is used to enable the Managed OpenTelemetry pipeline for collection and instrumentation components."
- ]
- }
- },
- "type": "object"
- },
- "ManagedPrometheusConfig": {
- "description": "ManagedPrometheusConfig defines the configuration for Google Cloud Managed Service for Prometheus.",
- "properties": {
- "autoMonitoringConfig": {
- "$ref": "#/$defs/AutoMonitoringConfig",
- "description": "GKE Workload Auto-Monitoring Configuration."
- },
- "enabled": {
- "description": "Enable Managed Collection.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "MasterAuth": {
- "description": "The authentication information for accessing the master endpoint. Authentication can be done using HTTP basic auth or using client certificates.",
- "properties": {
- "clientCertificate": {
- "description": "Output only. Base64-encoded public certificate used by clients to authenticate to the cluster endpoint. Issued only if client_certificate_config is set.",
- "readOnly": true,
- "type": "string"
- },
- "clientCertificateConfig": {
- "$ref": "#/$defs/ClientCertificateConfig",
- "description": "Configuration for client certificate authentication on the cluster. For clusters before v1.12, if no configuration is specified, a client certificate is issued."
- },
- "clientKey": {
- "description": "Output only. Base64-encoded private key used by clients to authenticate to the cluster endpoint.",
- "readOnly": true,
- "type": "string"
- },
- "clusterCaCertificate": {
- "description": "Output only. Base64-encoded public certificate that is the root of trust for the cluster.",
- "readOnly": true,
- "type": "string"
- },
- "password": {
- "deprecated": true,
- "description": "The password to use for HTTP basic authentication to the master endpoint. Because the master endpoint is open to the Internet, you should create a strong password. If a password is provided for cluster creation, username must be non-empty. Warning: basic authentication is deprecated, and will be removed in GKE control plane versions 1.19 and newer. For a list of recommended authentication methods, see: https://cloud.google.com/kubernetes-engine/docs/how-to/api-server-authentication",
- "type": "string"
- },
- "username": {
- "deprecated": true,
- "description": "The username to use for HTTP basic authentication to the master endpoint. For clusters v1.6.0 and later, basic authentication can be disabled by leaving username unspecified (or setting it to the empty string). Warning: basic authentication is deprecated, and will be removed in GKE control plane versions 1.19 and newer. For a list of recommended authentication methods, see: https://cloud.google.com/kubernetes-engine/docs/how-to/api-server-authentication",
- "type": "string"
- }
- },
- "type": "object"
- },
- "MasterAuthorizedNetworksConfig": {
- "description": "Configuration options for the master authorized networks feature. Enabled master authorized networks will disallow all external traffic to access Kubernetes master through HTTPS except traffic from the given CIDR blocks, Google Compute Engine Public IPs and Google Prod IPs.",
- "properties": {
- "cidrBlocks": {
- "description": "cidr_blocks define up to 50 external networks that could access Kubernetes master through HTTPS.",
- "items": {
- "$ref": "#/$defs/CidrBlock"
- },
- "type": "array"
- },
- "enabled": {
- "description": "Whether or not master authorized networks is enabled.",
- "type": "boolean"
- },
- "gcpPublicCidrsAccessEnabled": {
- "description": "Whether master is accessible via Google Compute Engine Public IP addresses.",
- "type": "boolean"
- },
- "privateEndpointEnforcementEnabled": {
- "description": "Whether master authorized networks is enforced on private endpoint or not.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "MaxPodsConstraint": {
- "description": "Constraints applied to pods.",
- "properties": {
- "maxPodsPerNode": {
- "description": "Constraint enforced on the max num of pods per node.",
- "format": "int64",
- "type": "string"
- }
- },
- "type": "object"
- },
- "MemoryManager": {
- "description": "The option enables the Kubernetes NUMA-aware Memory Manager feature. Detailed description about the feature can be found [here](https://kubernetes.io/docs/tasks/administer-cluster/memory-manager/).",
- "properties": {
- "policy": {
- "description": "Controls the memory management policy on the Node. See https://kubernetes.io/docs/tasks/administer-cluster/memory-manager/#policies The following values are allowed. * \"none\" * \"static\" The default value is 'none' if unspecified.",
- "type": "string"
- }
- },
- "type": "object"
- },
- "MeshCertificates": {
- "description": "Configuration for issuance of mTLS keys and certificates to Kubernetes pods.",
- "properties": {
- "enableCertificates": {
- "description": "enable_certificates controls issuance of workload mTLS certificates. If set, the GKE Workload Identity Certificates controller and node agent will be deployed in the cluster, which can then be configured by creating a WorkloadCertificateConfig Custom Resource. Requires Workload Identity (workload_pool must be non-empty).",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "MonitoringComponentConfig": {
- "description": "MonitoringComponentConfig is cluster monitoring component configuration.",
- "properties": {
- "enableComponents": {
- "description": "Select components to collect metrics. An empty set would disable all monitoring.",
- "items": {
- "enum": [
- "COMPONENT_UNSPECIFIED",
- "SYSTEM_COMPONENTS",
- "APISERVER",
- "SCHEDULER",
- "CONTROLLER_MANAGER",
- "STORAGE",
- "HPA",
- "POD",
- "DAEMONSET",
- "DEPLOYMENT",
- "STATEFULSET",
- "CADVISOR",
- "KUBELET",
- "DCGM",
- "JOBSET"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value. This shouldn't be used.",
- "system components",
- "kube-apiserver",
- "kube-scheduler",
- "kube-controller-manager",
- "Storage",
- "Horizontal Pod Autoscaling",
- "Pod",
- "DaemonSet",
- "Deployment",
- "Statefulset",
- "CADVISOR",
- "KUBELET",
- "NVIDIA Data Center GPU Manager (DCGM)",
- "JobSet"
- ]
- },
- "type": "array"
- }
- },
- "type": "object"
- },
- "MonitoringConfig": {
- "description": "MonitoringConfig is cluster monitoring configuration.",
- "properties": {
- "advancedDatapathObservabilityConfig": {
- "$ref": "#/$defs/AdvancedDatapathObservabilityConfig",
- "description": "Configuration of Advanced Datapath Observability features."
- },
- "componentConfig": {
- "$ref": "#/$defs/MonitoringComponentConfig",
- "description": "Monitoring components configuration"
- },
- "managedPrometheusConfig": {
- "$ref": "#/$defs/ManagedPrometheusConfig",
- "description": "Enable Google Cloud Managed Service for Prometheus in the cluster."
- }
- },
- "type": "object"
- },
- "NetworkConfig": {
- "description": "NetworkConfig reports the relative names of network & subnetwork.",
- "properties": {
- "datapathProvider": {
- "description": "The desired datapath provider for this cluster. By default, uses the IPTables-based kube-proxy implementation.",
- "enum": [
- "DATAPATH_PROVIDER_UNSPECIFIED",
- "LEGACY_DATAPATH",
- "ADVANCED_DATAPATH"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value.",
- "Use the IPTables implementation based on kube-proxy.",
- "Use the eBPF based GKE Dataplane V2 with additional features. See the [GKE Dataplane V2 documentation](https://cloud.google.com/kubernetes-engine/docs/how-to/dataplane-v2) for more."
- ]
- },
- "defaultEnablePrivateNodes": {
- "description": "Controls whether by default nodes have private IP addresses only. It is invalid to specify both PrivateClusterConfig.enablePrivateNodes and this field at the same time. To update the default setting, use ClusterUpdate.desired_default_enable_private_nodes",
- "type": "boolean"
- },
- "defaultSnatStatus": {
- "$ref": "#/$defs/DefaultSnatStatus",
- "description": "Whether the cluster disables default in-node sNAT rules. In-node sNAT rules will be disabled when default_snat_status is disabled. When disabled is set to false, default IP masquerade rules will be applied to the nodes to prevent sNAT on cluster internal traffic."
- },
- "disableL4LbFirewallReconciliation": {
- "description": "Disable L4 load balancer VPC firewalls to enable firewall policies.",
- "type": "boolean"
- },
- "dnsConfig": {
- "$ref": "#/$defs/DNSConfig",
- "description": "DNSConfig contains clusterDNS config for this cluster."
- },
- "enableCiliumClusterwideNetworkPolicy": {
- "description": "Whether CiliumClusterwideNetworkPolicy is enabled on this cluster.",
- "type": "boolean"
- },
- "enableFqdnNetworkPolicy": {
- "description": "Whether FQDN Network Policy is enabled on this cluster.",
- "type": "boolean"
- },
- "enableIntraNodeVisibility": {
- "description": "Whether Intra-node visibility is enabled for this cluster. This makes same node pod to pod traffic visible for VPC network.",
- "type": "boolean"
- },
- "enableL4ilbSubsetting": {
- "description": "Whether L4ILB Subsetting is enabled for this cluster.",
- "type": "boolean"
- },
- "enableMultiNetworking": {
- "description": "Whether multi-networking is enabled for this cluster.",
- "type": "boolean"
- },
- "gatewayApiConfig": {
- "$ref": "#/$defs/GatewayAPIConfig",
- "description": "GatewayAPIConfig contains the desired config of Gateway API on this cluster."
- },
- "inTransitEncryptionConfig": {
- "description": "Specify the details of in-transit encryption. Now named inter-node transparent encryption.",
- "enum": [
- "IN_TRANSIT_ENCRYPTION_CONFIG_UNSPECIFIED",
- "IN_TRANSIT_ENCRYPTION_DISABLED",
- "IN_TRANSIT_ENCRYPTION_INTER_NODE_TRANSPARENT"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Unspecified, will be inferred as default - IN_TRANSIT_ENCRYPTION_UNSPECIFIED.",
- "In-transit encryption is disabled.",
- "Data in-transit is encrypted using inter-node transparent encryption."
- ]
- },
- "network": {
- "description": "Output only. The relative name of the Google Compute Engine [network](https://cloud.google.com/compute/docs/networks-and-firewalls#networks) to which the cluster is connected. Example: projects/my-project/global/networks/my-network",
- "readOnly": true,
- "type": "string"
- },
- "networkPerformanceConfig": {
- "$ref": "#/$defs/ClusterNetworkPerformanceConfig",
- "description": "Network bandwidth tier configuration."
- },
- "privateIpv6GoogleAccess": {
- "description": "The desired state of IPv6 connectivity to Google Services. By default, no private IPv6 access to or from Google Services (all access will be via IPv4)",
- "enum": [
- "PRIVATE_IPV6_GOOGLE_ACCESS_UNSPECIFIED",
- "PRIVATE_IPV6_GOOGLE_ACCESS_DISABLED",
- "PRIVATE_IPV6_GOOGLE_ACCESS_TO_GOOGLE",
- "PRIVATE_IPV6_GOOGLE_ACCESS_BIDIRECTIONAL"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value. Same as DISABLED",
- "No private access to or from Google Services",
- "Enables private IPv6 access to Google Services from GKE",
- "Enables private IPv6 access to and from Google Services"
- ]
- },
- "serviceExternalIpsConfig": {
- "$ref": "#/$defs/ServiceExternalIPsConfig",
- "description": "ServiceExternalIPsConfig specifies if services with externalIPs field are blocked or not."
- },
- "subnetwork": {
- "description": "Output only. The relative name of the Google Compute Engine [subnetwork](https://cloud.google.com/compute/docs/vpc) to which the cluster is connected. Example: projects/my-project/regions/us-central1/subnetworks/my-subnet",
- "readOnly": true,
- "type": "string"
- }
- },
- "type": "object"
- },
- "NetworkPerformanceConfig": {
- "description": "Configuration of all network bandwidth tiers",
- "properties": {
- "totalEgressBandwidthTier": {
- "description": "Specifies the total network bandwidth tier for the NodePool.",
- "enum": [
- "TIER_UNSPECIFIED",
- "TIER_1"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value",
- "Higher bandwidth, actual values based on VM size."
- ]
- }
- },
- "type": "object"
- },
- "NetworkPolicy": {
- "description": "Configuration options for the NetworkPolicy feature. https://kubernetes.io/docs/concepts/services-networking/networkpolicies/",
- "properties": {
- "enabled": {
- "description": "Whether network policy is enabled on the cluster.",
- "type": "boolean"
- },
- "provider": {
- "description": "The selected network policy provider.",
- "enum": [
- "PROVIDER_UNSPECIFIED",
- "CALICO"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Not set",
- "Tigera (Calico Felix)."
- ]
- }
- },
- "type": "object"
- },
- "NetworkPolicyConfig": {
- "description": "Configuration for NetworkPolicy. This only tracks whether the addon is enabled or not on the Master, it does not track whether network policy is enabled for the nodes.",
- "properties": {
- "disabled": {
- "description": "Whether NetworkPolicy is enabled for this cluster.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "NetworkTags": {
- "description": "Collection of Compute Engine network tags that can be applied to a node's underlying VM instance.",
- "properties": {
- "tags": {
- "description": "List of network tags.",
- "items": {
- "type": "string"
- },
- "type": "array"
- }
- },
- "type": "object"
- },
- "NetworkTierConfig": {
- "description": "NetworkTierConfig contains network tier information.",
- "properties": {
- "networkTier": {
- "description": "Network tier configuration.",
- "enum": [
- "NETWORK_TIER_UNSPECIFIED",
- "NETWORK_TIER_DEFAULT",
- "NETWORK_TIER_PREMIUM",
- "NETWORK_TIER_STANDARD"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "By default, use project-level configuration. When unspecified, the behavior defaults to NETWORK_TIER_DEFAULT. For cluster updates, this implies no action (no-op).",
- "Default network tier. Use project-level configuration. User can specify this value, meaning they want to keep the same behaviour as before cluster level network tier configuration is introduced. This field ensures backward compatibility for the network tier of cluster resources, such as node pools and load balancers, for their external IP addresses.",
- "Premium network tier.",
- "Standard network tier."
- ]
- }
- },
- "type": "object"
- },
- "NodeAffinity": {
- "description": "Specifies the NodeAffinity key, values, and affinity operator according to [shared sole tenant node group affinities](https://cloud.google.com/compute/docs/nodes/sole-tenant-nodes#node_affinity_and_anti-affinity).",
- "properties": {
- "key": {
- "description": "Key for NodeAffinity.",
- "type": "string"
- },
- "operator": {
- "description": "Operator for NodeAffinity.",
- "enum": [
- "OPERATOR_UNSPECIFIED",
- "IN",
- "NOT_IN"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Invalid or unspecified affinity operator.",
- "Affinity operator.",
- "Anti-affinity operator."
- ]
- },
- "values": {
- "description": "Values for NodeAffinity.",
- "items": {
- "type": "string"
- },
- "type": "array"
- }
- },
- "type": "object"
- },
- "NodeConfig": {
- "description": "Parameters that describe the nodes in a cluster. GKE Autopilot clusters do not recognize parameters in `NodeConfig`. Use AutoprovisioningNodePoolDefaults instead.",
- "properties": {
- "accelerators": {
- "description": "A list of hardware accelerators to be attached to each node. See https://cloud.google.com/compute/docs/gpus for more information about support for GPUs.",
- "items": {
- "$ref": "#/$defs/AcceleratorConfig"
- },
- "type": "array"
- },
- "advancedMachineFeatures": {
- "$ref": "#/$defs/AdvancedMachineFeatures",
- "description": "Advanced features for the Compute Engine VM."
- },
- "bootDisk": {
- "$ref": "#/$defs/BootDisk",
- "description": "The boot disk configuration for the node pool."
- },
- "bootDiskKmsKey": {
- "description": " The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption",
- "type": "string"
- },
- "confidentialNodes": {
- "$ref": "#/$defs/ConfidentialNodes",
- "description": "Confidential nodes config. All the nodes in the node pool will be Confidential VM once enabled."
- },
- "consolidationDelay": {
- "description": "Consolidation delay defines duration after which the Cluster Autoscaler can scale down underutilized nodes. If not set, nodes are scaled down by default behavior, i.e. according to the chosen autoscaling profile.",
- "format": "google-duration",
- "type": "string"
- },
- "containerdConfig": {
- "$ref": "#/$defs/ContainerdConfig",
- "description": "Parameters for containerd customization."
- },
- "diskSizeGb": {
- "description": "Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB. If unspecified, the default disk size is 100GB.",
- "format": "int32",
- "type": "integer"
- },
- "diskType": {
- "description": "Type of the disk attached to each node (e.g. 'pd-standard', 'pd-ssd' or 'pd-balanced') If unspecified, the default disk type is 'pd-standard'",
- "type": "string"
- },
- "effectiveCgroupMode": {
- "description": "Output only. effective_cgroup_mode is the cgroup mode actually used by the node pool. It is determined by the cgroup mode specified in the LinuxNodeConfig or the default cgroup mode based on the cluster creation version.",
- "enum": [
- "EFFECTIVE_CGROUP_MODE_UNSPECIFIED",
- "EFFECTIVE_CGROUP_MODE_V1",
- "EFFECTIVE_CGROUP_MODE_V2"
- ],
- "readOnly": true,
- "type": "string",
- "x-google-enum-descriptions": [
- "EFFECTIVE_CGROUP_MODE_UNSPECIFIED means the cgroup configuration for the node pool is unspecified, i.e. the node pool is a Windows node pool.",
- "CGROUP_MODE_V1 means the node pool is configured to use cgroupv1 for the cgroup configuration.",
- "CGROUP_MODE_V2 means the node pool is configured to use cgroupv2 for the cgroup configuration."
- ]
- },
- "enableConfidentialStorage": {
- "description": "Optional. Reserved for future use.",
- "type": "boolean"
- },
- "ephemeralStorageLocalSsdConfig": {
- "$ref": "#/$defs/EphemeralStorageLocalSsdConfig",
- "description": "Parameters for the node ephemeral storage using Local SSDs. If unspecified, ephemeral storage is backed by the boot disk."
- },
- "fastSocket": {
- "$ref": "#/$defs/FastSocket",
- "description": "Enable or disable NCCL fast socket for the node pool."
- },
- "flexStart": {
- "description": "Flex Start flag for enabling Flex Start VM.",
- "type": "boolean"
- },
- "gcfsConfig": {
- "$ref": "#/$defs/GcfsConfig",
- "description": "Google Container File System (image streaming) configs."
- },
- "gpuDirectConfig": {
- "$ref": "#/$defs/GPUDirectConfig",
- "description": "The configuration for GPU Direct"
- },
- "gvnic": {
- "$ref": "#/$defs/VirtualNIC",
- "description": "Enable or disable gvnic in the node pool."
- },
- "imageType": {
- "description": "The image type to use for this node. Note that for a given image type, the latest version of it will be used. Please see https://cloud.google.com/kubernetes-engine/docs/concepts/node-images for available image types.",
- "type": "string"
- },
- "kubeletConfig": {
- "$ref": "#/$defs/NodeKubeletConfig",
- "description": "Node kubelet configs."
- },
- "labels": {
- "additionalProperties": {
- "type": "string"
- },
- "description": "The map of Kubernetes labels (key/value pairs) to be applied to each node. These will added in addition to any default label(s) that Kubernetes may apply to the node. In case of conflict in label keys, the applied set may differ depending on the Kubernetes version -- it's best to assume the behavior is undefined and conflicts should be avoided. For more information, including usage and the valid values, see: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/",
- "type": "object"
- },
- "linuxNodeConfig": {
- "$ref": "#/$defs/LinuxNodeConfig",
- "description": "Parameters that can be configured on Linux nodes."
- },
- "localNvmeSsdBlockConfig": {
- "$ref": "#/$defs/LocalNvmeSsdBlockConfig",
- "description": "Parameters for using raw-block Local NVMe SSDs."
- },
- "localSsdCount": {
- "description": "The number of local SSD disks to be attached to the node. The limit for this value is dependent upon the maximum number of disks available on a machine per zone. See: https://cloud.google.com/compute/docs/disks/local-ssd for more information.",
- "format": "int32",
- "type": "integer"
- },
- "localSsdEncryptionMode": {
- "description": "Specifies which method should be used for encrypting the Local SSDs attached to the node.",
- "enum": [
- "LOCAL_SSD_ENCRYPTION_MODE_UNSPECIFIED",
- "STANDARD_ENCRYPTION",
- "EPHEMERAL_KEY_ENCRYPTION"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "The given node will be encrypted using keys managed by Google infrastructure and the keys will be deleted when the node is deleted.",
- "The given node will be encrypted using keys managed by Google infrastructure and the keys will be deleted when the node is deleted.",
- "The given node will opt-in for using ephemeral key for encryption of Local SSDs. The Local SSDs will not be able to recover data in case of node crash."
- ]
- },
- "loggingConfig": {
- "$ref": "#/$defs/NodePoolLoggingConfig",
- "description": "Logging configuration."
- },
- "machineType": {
- "description": "The name of a Google Compute Engine [machine type](https://cloud.google.com/compute/docs/machine-types) If unspecified, the default machine type is `e2-medium`.",
- "type": "string"
- },
- "maxRunDuration": {
- "description": "The maximum duration for the nodes to exist. If unspecified, the nodes can exist indefinitely.",
- "format": "google-duration",
- "type": "string"
- },
- "metadata": {
- "additionalProperties": {
- "type": "string"
- },
- "description": "The metadata key/value pairs assigned to instances in the cluster. Keys must conform to the regexp `[a-zA-Z0-9-_]+` and be less than 128 bytes in length. These are reflected as part of a URL in the metadata server. Additionally, to avoid ambiguity, keys must not conflict with any other metadata keys for the project or be one of the reserved keys: - \"cluster-location\" - \"cluster-name\" - \"cluster-uid\" - \"configure-sh\" - \"containerd-configure-sh\" - \"enable-os-login\" - \"gci-ensure-gke-docker\" - \"gci-metrics-enabled\" - \"gci-update-strategy\" - \"instance-template\" - \"kube-env\" - \"startup-script\" - \"user-data\" - \"disable-address-manager\" - \"windows-startup-script-ps1\" - \"common-psm1\" - \"k8s-node-setup-psm1\" - \"install-ssh-psm1\" - \"user-profile-psm1\" Values are free-form strings, and only have meaning as interpreted by the image running in the instance. The only restriction placed on them is that each value's size must be less than or equal to 32 KB. The total size of all keys and values must be less than 512 KB.",
- "type": "object"
- },
- "minCpuPlatform": {
- "description": "Minimum CPU platform to be used by this instance. The instance may be scheduled on the specified or newer CPU platform. Applicable values are the friendly names of CPU platforms, such as `minCpuPlatform: \"Intel Haswell\"` or `minCpuPlatform: \"Intel Sandy Bridge\"`. For more information, read [how to specify min CPU platform](https://cloud.google.com/compute/docs/instances/specify-min-cpu-platform)",
- "type": "string"
- },
- "nodeGroup": {
- "description": "Setting this field will assign instances of this pool to run on the specified node group. This is useful for running workloads on [sole tenant nodes](https://cloud.google.com/compute/docs/nodes/sole-tenant-nodes).",
- "type": "string"
- },
- "oauthScopes": {
- "description": "The set of Google API scopes to be made available on all of the node VMs under the \"default\" service account. The following scopes are recommended, but not required, and by default are not included: * `https://www.googleapis.com/auth/compute` is required for mounting persistent storage on your nodes. * `https://www.googleapis.com/auth/devstorage.read_only` is required for communicating with **gcr.io** (the [Artifact Registry](https://cloud.google.com/artifact-registry/)). If unspecified, no scopes are added, unless Cloud Logging or Cloud Monitoring are enabled, in which case their required scopes will be added.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "preemptible": {
- "description": "Whether the nodes are created as preemptible VM instances. See: https://cloud.google.com/compute/docs/instances/preemptible for more information about preemptible VM instances.",
- "type": "boolean"
- },
- "reservationAffinity": {
- "$ref": "#/$defs/ReservationAffinity",
- "description": "The optional reservation affinity. Setting this field will apply the specified [Zonal Compute Reservation](https://cloud.google.com/compute/docs/instances/reserving-zonal-resources) to this node pool."
- },
- "resourceLabels": {
- "additionalProperties": {
- "type": "string"
- },
- "description": "The resource labels for the node pool to use to annotate any related Google Compute Engine resources.",
- "type": "object"
- },
- "resourceManagerTags": {
- "$ref": "#/$defs/ResourceManagerTags",
- "description": "A map of resource manager tag keys and values to be attached to the nodes."
- },
- "sandboxConfig": {
- "$ref": "#/$defs/SandboxConfig",
- "description": "Sandbox configuration for this node."
- },
- "secondaryBootDiskUpdateStrategy": {
- "$ref": "#/$defs/SecondaryBootDiskUpdateStrategy",
- "description": "Secondary boot disk update strategy."
- },
- "secondaryBootDisks": {
- "description": "List of secondary boot disks attached to the nodes.",
- "items": {
- "$ref": "#/$defs/SecondaryBootDisk"
- },
- "type": "array"
- },
- "serviceAccount": {
- "description": "The Google Cloud Platform Service Account to be used by the node VMs. Specify the email address of the Service Account; otherwise, if no Service Account is specified, the \"default\" service account is used.",
- "type": "string"
- },
- "shieldedInstanceConfig": {
- "$ref": "#/$defs/ShieldedInstanceConfig",
- "description": "Shielded Instance options."
- },
- "soleTenantConfig": {
- "$ref": "#/$defs/SoleTenantConfig",
- "description": "Parameters for node pools to be backed by shared sole tenant node groups."
- },
- "spot": {
- "description": "Spot flag for enabling Spot VM, which is a rebrand of the existing preemptible flag.",
- "type": "boolean"
- },
- "storagePools": {
- "description": "List of Storage Pools where boot disks are provisioned.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "tags": {
- "description": "The list of instance tags applied to all nodes. Tags are used to identify valid sources or targets for network firewalls and are specified by the client during cluster or node pool creation. Each tag within the list must comply with RFC1035.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "taintConfig": {
- "$ref": "#/$defs/TaintConfig",
- "description": "Optional. The taint configuration for the node pool."
- },
- "taints": {
- "description": "List of kubernetes taints to be applied to each node. For more information, including usage and the valid values, see: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/",
- "items": {
- "$ref": "#/$defs/NodeTaint"
- },
- "type": "array"
- },
- "windowsNodeConfig": {
- "$ref": "#/$defs/WindowsNodeConfig",
- "description": "Parameters that can be configured on Windows nodes."
- },
- "workloadMetadataConfig": {
- "$ref": "#/$defs/WorkloadMetadataConfig",
- "description": "The workload metadata configuration for this node."
- }
- },
- "type": "object"
- },
- "NodeConfigDefaults": {
- "description": "Subset of NodeConfig message that has defaults.",
- "properties": {
- "containerdConfig": {
- "$ref": "#/$defs/ContainerdConfig",
- "description": "Parameters for containerd customization."
- },
- "gcfsConfig": {
- "$ref": "#/$defs/GcfsConfig",
- "description": "GCFS (Google Container File System, also known as Riptide) options."
- },
- "loggingConfig": {
- "$ref": "#/$defs/NodePoolLoggingConfig",
- "description": "Logging configuration for node pools."
- },
- "nodeKubeletConfig": {
- "$ref": "#/$defs/NodeKubeletConfig",
- "description": "NodeKubeletConfig controls the defaults for new node-pools. Currently only `insecure_kubelet_readonly_port_enabled` can be set here."
- }
- },
- "type": "object"
- },
- "NodeDrainConfig": {
- "description": "NodeDrainConfig contains the node drain related configurations for this nodepool.",
- "properties": {
- "respectPdbDuringNodePoolDeletion": {
- "description": "Whether to respect PDB during node pool deletion.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "NodeKernelModuleLoading": {
- "description": "Configuration for kernel module loading on nodes.",
- "properties": {
- "policy": {
- "description": "Set the node module loading policy for nodes in the node pool.",
- "enum": [
- "POLICY_UNSPECIFIED",
- "ENFORCE_SIGNED_MODULES",
- "DO_NOT_ENFORCE_SIGNED_MODULES"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default behavior. GKE selects the image based on node type. For CPU and TPU nodes, the image will not allow loading external kernel modules. For GPU nodes, the image will allow loading any module, whether it is signed or not.",
- "Enforced signature verification: Node pools will use a Container-Optimized OS image configured to allow loading of *Google-signed* external kernel modules. Loadpin is enabled but configured to exclude modules, and kernel module signature checking is enforced.",
- "Mirrors existing DEFAULT behavior: For CPU and TPU nodes, the image will not allow loading external kernel modules. For GPU nodes, the image will allow loading any module, whether it is signed or not."
- ]
- }
- },
- "type": "object"
- },
- "NodeKubeletConfig": {
- "description": "Node kubelet configs.",
- "properties": {
- "allowedUnsafeSysctls": {
- "description": "Optional. Defines a comma-separated allowlist of unsafe sysctls or sysctl patterns (ending in `*`). The unsafe namespaced sysctl groups are `kernel.shm*`, `kernel.msg*`, `kernel.sem`, `fs.mqueue.*`, and `net.*`. Leaving this allowlist empty means they cannot be set on Pods. To allow certain sysctls or sysctl patterns to be set on Pods, list them separated by commas. For example: `kernel.msg*,net.ipv4.route.min_pmtu`. See https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ for more details.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "containerLogMaxFiles": {
- "description": "Optional. Defines the maximum number of container log files that can be present for a container. See https://kubernetes.io/docs/concepts/cluster-administration/logging/#log-rotation The value must be an integer between 2 and 10, inclusive. The default value is 5 if unspecified.",
- "format": "int32",
- "type": "integer"
- },
- "containerLogMaxSize": {
- "description": "Optional. Defines the maximum size of the container log file before it is rotated. See https://kubernetes.io/docs/concepts/cluster-administration/logging/#log-rotation Valid format is positive number + unit, e.g. 100Ki, 10Mi. Valid units are Ki, Mi, Gi. The value must be between 10Mi and 500Mi, inclusive. Note that the total container log size (container_log_max_size * container_log_max_files) cannot exceed 1% of the total storage of the node, to avoid disk pressure caused by log files. The default value is 10Mi if unspecified.",
- "type": "string"
- },
- "cpuCfsQuota": {
- "description": "Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.",
- "type": "boolean"
- },
- "cpuCfsQuotaPeriod": {
- "description": "Set the CPU CFS quota period value 'cpu.cfs_period_us'. The string must be a sequence of decimal numbers, each with optional fraction and a unit suffix, such as \"300ms\". Valid time units are \"ns\", \"us\" (or \"µs\"), \"ms\", \"s\", \"m\", \"h\". The value must be a positive duration between 1ms and 1 second, inclusive.",
- "type": "string"
- },
- "cpuManagerPolicy": {
- "description": "Control the CPU management policy on the node. See https://kubernetes.io/docs/tasks/administer-cluster/cpu-management-policies/ The following values are allowed. * \"none\": the default, which represents the existing scheduling behavior. * \"static\": allows pods with certain resource characteristics to be granted increased CPU affinity and exclusivity on the node. The default value is 'none' if unspecified.",
- "type": "string"
- },
- "crashLoopBackOff": {
- "$ref": "#/$defs/CrashLoopBackOffConfig",
- "description": "Optional. Contains configuration options to modify node-level parameters for container restart behavior."
- },
- "evictionMaxPodGracePeriodSeconds": {
- "description": "Optional. eviction_max_pod_grace_period_seconds is the maximum allowed grace period (in seconds) to use when terminating pods in response to a soft eviction threshold being met. This value effectively caps the Pod's terminationGracePeriodSeconds value during soft evictions. Default: 0. Range: [0, 300].",
- "format": "int32",
- "type": "integer"
- },
- "evictionMinimumReclaim": {
- "$ref": "#/$defs/EvictionMinimumReclaim",
- "description": "Optional. eviction_minimum_reclaim is a map of signal names to quantities that defines minimum reclaims, which describe the minimum amount of a given resource the kubelet will reclaim when performing a pod eviction while that resource is under pressure."
- },
- "evictionSoft": {
- "$ref": "#/$defs/EvictionSignals",
- "description": "Optional. eviction_soft is a map of signal names to quantities that defines soft eviction thresholds. Each signal is compared to its corresponding threshold to determine if a pod eviction should occur."
- },
- "evictionSoftGracePeriod": {
- "$ref": "#/$defs/EvictionGracePeriod",
- "description": "Optional. eviction_soft_grace_period is a map of signal names to quantities that defines grace periods for each soft eviction signal. The grace period is the amount of time that a pod must be under pressure before an eviction occurs."
- },
- "imageGcHighThresholdPercent": {
- "description": "Optional. Defines the percent of disk usage after which image garbage collection is always run. The percent is calculated as this field value out of 100. The value must be between 10 and 85, inclusive and greater than image_gc_low_threshold_percent. The default value is 85 if unspecified.",
- "format": "int32",
- "type": "integer"
- },
- "imageGcLowThresholdPercent": {
- "description": "Optional. Defines the percent of disk usage before which image garbage collection is never run. Lowest disk usage to garbage collect to. The percent is calculated as this field value out of 100. The value must be between 10 and 85, inclusive and smaller than image_gc_high_threshold_percent. The default value is 80 if unspecified.",
- "format": "int32",
- "type": "integer"
- },
- "imageMaximumGcAge": {
- "description": "Optional. Defines the maximum age an image can be unused before it is garbage collected. The string must be a sequence of decimal numbers, each with optional fraction and a unit suffix, such as \"300s\", \"1.5h\", and \"2h45m\". Valid time units are \"ns\", \"us\" (or \"µs\"), \"ms\", \"s\", \"m\", \"h\". The value must be a positive duration greater than image_minimum_gc_age or \"0s\". The default value is \"0s\" if unspecified, which disables this field, meaning images won't be garbage collected based on being unused for too long.",
- "type": "string"
- },
- "imageMinimumGcAge": {
- "description": "Optional. Defines the minimum age for an unused image before it is garbage collected. The string must be a sequence of decimal numbers, each with optional fraction and a unit suffix, such as \"300s\", \"1.5h\", and \"2h45m\". Valid time units are \"ns\", \"us\" (or \"µs\"), \"ms\", \"s\", \"m\", \"h\". The value must be a positive duration less than or equal to 2 minutes. The default value is \"2m0s\" if unspecified.",
- "type": "string"
- },
- "insecureKubeletReadonlyPortEnabled": {
- "description": "Enable or disable Kubelet read only port.",
- "type": "boolean"
- },
- "maxParallelImagePulls": {
- "description": "Optional. Defines the maximum number of image pulls in parallel. The range is 2 to 5, inclusive. The default value is 2 or 3 depending on the disk type. See https://kubernetes.io/docs/concepts/containers/images/#maximum-parallel-image-pulls for more details.",
- "format": "int32",
- "type": "integer"
- },
- "memoryManager": {
- "$ref": "#/$defs/MemoryManager",
- "description": "Optional. Controls NUMA-aware Memory Manager configuration on the node. For more information, see: https://kubernetes.io/docs/tasks/administer-cluster/memory-manager/"
- },
- "podPidsLimit": {
- "description": "Set the Pod PID limits. See https://kubernetes.io/docs/concepts/policy/pid-limiting/#pod-pid-limits Controls the maximum number of processes allowed to run in a pod. The value must be greater than or equal to 1024 and less than 4194304.",
- "format": "int64",
- "type": "string"
- },
- "shutdownGracePeriodCriticalPodsSeconds": {
- "description": "Optional. shutdown_grace_period_critical_pods_seconds is the maximum allowed grace period (in seconds) used to terminate critical pods during a node shutdown. This value should be <= shutdown_grace_period_seconds, and is only valid if shutdown_grace_period_seconds is set. https://kubernetes.io/docs/concepts/cluster-administration/node-shutdown/ Range: [0, 120].",
- "format": "int32",
- "type": "integer"
- },
- "shutdownGracePeriodSeconds": {
- "description": "Optional. shutdown_grace_period_seconds is the maximum allowed grace period (in seconds) the total duration that the node should delay the shutdown during a graceful shutdown. This is the total grace period for pod termination for both regular and critical pods. https://kubernetes.io/docs/concepts/cluster-administration/node-shutdown/ If set to 0, node will not enable the graceful node shutdown functionality. This field is only valid for Spot VMs. Allowed values: 0, 30, 120.",
- "format": "int32",
- "type": "integer"
- },
- "singleProcessOomKill": {
- "description": "Optional. Defines whether to enable single process OOM killer. If true, will prevent the memory.oom.group flag from being set for container cgroups in cgroups v2. This causes processes in the container to be OOM killed individually instead of as a group.",
- "type": "boolean"
- },
- "topologyManager": {
- "$ref": "#/$defs/TopologyManager",
- "description": "Optional. Controls Topology Manager configuration on the node. For more information, see: https://kubernetes.io/docs/tasks/administer-cluster/topology-manager/"
- }
- },
- "type": "object"
- },
- "NodeManagement": {
- "description": "NodeManagement defines the set of node management services turned on for the node pool.",
- "properties": {
- "autoRepair": {
- "description": "A flag that specifies whether the node auto-repair is enabled for the node pool. If enabled, the nodes in this node pool will be monitored and, if they fail health checks too many times, an automatic repair action will be triggered.",
- "type": "boolean"
- },
- "autoUpgrade": {
- "description": "A flag that specifies whether node auto-upgrade is enabled for the node pool. If enabled, node auto-upgrade helps keep the nodes in your node pool up to date with the latest release version of Kubernetes.",
- "type": "boolean"
- },
- "upgradeOptions": {
- "$ref": "#/$defs/AutoUpgradeOptions",
- "description": "Specifies the Auto Upgrade knobs for the node pool."
- }
- },
- "type": "object"
- },
- "NodeNetworkConfig": {
- "description": "Parameters for node pool-level network config.",
- "properties": {
- "additionalNodeNetworkConfigs": {
- "description": "We specify the additional node networks for this node pool using this list. Each node network corresponds to an additional interface",
- "items": {
- "$ref": "#/$defs/AdditionalNodeNetworkConfig"
- },
- "type": "array"
- },
- "additionalPodNetworkConfigs": {
- "description": "We specify the additional pod networks for this node pool using this list. Each pod network corresponds to an additional alias IP range for the node",
- "items": {
- "$ref": "#/$defs/AdditionalPodNetworkConfig"
- },
- "type": "array"
- },
- "createPodRange": {
- "description": "Input only. Whether to create a new range for pod IPs in this node pool. Defaults are provided for `pod_range` and `pod_ipv4_cidr_block` if they are not specified. If neither `create_pod_range` or `pod_range` are specified, the cluster-level default (`ip_allocation_policy.cluster_ipv4_cidr_block`) is used. Only applicable if `ip_allocation_policy.use_ip_aliases` is true. This field cannot be changed after the node pool has been created.",
- "type": "boolean",
- "writeOnly": true
- },
- "enablePrivateNodes": {
- "description": "Whether nodes have internal IP addresses only. If enable_private_nodes is not specified, then the value is derived from Cluster.NetworkConfig.default_enable_private_nodes",
- "type": "boolean"
- },
- "networkPerformanceConfig": {
- "$ref": "#/$defs/NetworkPerformanceConfig",
- "description": "Network bandwidth tier configuration."
- },
- "networkTierConfig": {
- "$ref": "#/$defs/NetworkTierConfig",
- "description": "Output only. The network tier configuration for the node pool inherits from the cluster-level configuration and remains immutable throughout the node pool's lifecycle, including during upgrades.",
- "readOnly": true
- },
- "podCidrOverprovisionConfig": {
- "$ref": "#/$defs/PodCIDROverprovisionConfig",
- "description": "[PRIVATE FIELD] Pod CIDR size overprovisioning config for the nodepool. Pod CIDR size per node depends on max_pods_per_node. By default, the value of max_pods_per_node is rounded off to next power of 2 and we then double that to get the size of pod CIDR block per node. Example: max_pods_per_node of 30 would result in 64 IPs (/26). This config can disable the doubling of IPs (we still round off to next power of 2) Example: max_pods_per_node of 30 will result in 32 IPs (/27) when overprovisioning is disabled."
- },
- "podIpv4CidrBlock": {
- "description": "The IP address range for pod IPs in this node pool. Only applicable if `create_pod_range` is true. Set to blank to have a range chosen with the default size. Set to /netmask (e.g. `/14`) to have a range chosen with a specific netmask. Set to a [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) to pick a specific range to use. Only applicable if `ip_allocation_policy.use_ip_aliases` is true. This field cannot be changed after the node pool has been created.",
- "type": "string"
- },
- "podIpv4RangeUtilization": {
- "description": "Output only. The utilization of the IPv4 range for the pod. The ratio is Usage/[Total number of IPs in the secondary range], Usage=numNodes*numZones*podIPsPerNode.",
- "format": "double",
- "readOnly": true,
- "type": "number"
- },
- "podRange": {
- "description": "The ID of the secondary range for pod IPs. If `create_pod_range` is true, this ID is used for the new range. If `create_pod_range` is false, uses an existing secondary range with this ID. Only applicable if `ip_allocation_policy.use_ip_aliases` is true. This field cannot be changed after the node pool has been created.",
- "type": "string"
- },
- "subnetwork": {
- "description": "Optional. The subnetwork name/path for the node pool. Format: projects/{project}/regions/{region}/subnetworks/{subnetwork} If the cluster is associated with multiple subnetworks, the subnetwork can be either: - A user supplied subnetwork name during node pool creation (e.g., `my-subnet`). The name must be between 1 and 63 characters long, start with a letter, contain only letters, numbers, and hyphens, and end with a letter or a number. - A full subnetwork path during node pool creation, such as `projects/gke-project/regions/us-central1/subnetworks/my-subnet` - A subnetwork path picked based on the IP utilization during node pool creation and is immutable.",
- "type": "string"
- }
- },
- "type": "object"
- },
- "NodePool": {
- "description": "NodePool contains the name and configuration for a cluster's node pool. Node pools are a set of nodes (i.e. VM's), with a common configuration and specification, under the control of the cluster master. They may have a set of Kubernetes labels applied to them, which may be used to reference them during pod scheduling. They may also be resized up or down, to accommodate the workload.",
- "properties": {
- "autopilotConfig": {
- "$ref": "#/$defs/AutopilotConfig",
- "description": "Specifies the autopilot configuration for this node pool. This field is exclusively reserved for Cluster Autoscaler."
- },
- "autoscaling": {
- "$ref": "#/$defs/NodePoolAutoscaling",
- "description": "Autoscaler configuration for this NodePool. Autoscaler is enabled only if a valid configuration is present."
- },
- "bestEffortProvisioning": {
- "$ref": "#/$defs/BestEffortProvisioning",
- "description": "Enable best effort provisioning for nodes"
- },
- "conditions": {
- "description": "Which conditions caused the current node pool state.",
- "items": {
- "$ref": "#/$defs/StatusCondition"
- },
- "type": "array"
- },
- "config": {
- "$ref": "#/$defs/NodeConfig",
- "description": "The node configuration of the pool."
- },
- "etag": {
- "description": "This checksum is computed by the server based on the value of node pool fields, and may be sent on update requests to ensure the client has an up-to-date value before proceeding.",
- "type": "string"
- },
- "initialNodeCount": {
- "description": "The initial node count for the pool. You must ensure that your Compute Engine [resource quota](https://cloud.google.com/compute/quotas) is sufficient for this number of instances. You must also have available firewall and routes quota.",
- "format": "int32",
- "type": "integer"
- },
- "instanceGroupUrls": {
- "description": "Output only. The resource URLs of the [managed instance groups](https://cloud.google.com/compute/docs/instance-groups/creating-groups-of-managed-instances) associated with this node pool. During the node pool blue-green upgrade operation, the URLs contain both blue and green resources.",
- "items": {
- "type": "string"
- },
- "readOnly": true,
- "type": "array"
- },
- "locations": {
- "description": "The list of Google Compute Engine [zones](https://cloud.google.com/compute/docs/zones#available) in which the NodePool's nodes should be located. If this value is unspecified during node pool creation, the [Cluster.Locations](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1/projects.locations.clusters#Cluster.FIELDS.locations) value will be used, instead. Warning: changing node pool locations will result in nodes being added and/or removed.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "management": {
- "$ref": "#/$defs/NodeManagement",
- "description": "NodeManagement configuration for this NodePool."
- },
- "maxPodsConstraint": {
- "$ref": "#/$defs/MaxPodsConstraint",
- "description": "The constraint on the maximum number of pods that can be run simultaneously on a node in the node pool."
- },
- "name": {
- "description": "The name of the node pool.",
- "type": "string"
- },
- "networkConfig": {
- "$ref": "#/$defs/NodeNetworkConfig",
- "description": "Networking configuration for this NodePool. If specified, it overrides the cluster-level defaults."
- },
- "nodeDrainConfig": {
- "$ref": "#/$defs/NodeDrainConfig",
- "description": "Specifies the node drain configuration for this node pool."
- },
- "placementPolicy": {
- "$ref": "#/$defs/PlacementPolicy",
- "description": "Specifies the node placement policy."
- },
- "podIpv4CidrSize": {
- "description": "Output only. The pod CIDR block size per node in this node pool.",
- "format": "int32",
- "readOnly": true,
- "type": "integer"
- },
- "queuedProvisioning": {
- "$ref": "#/$defs/QueuedProvisioning",
- "description": "Specifies the configuration of queued provisioning."
- },
- "selfLink": {
- "description": "Output only. Server-defined URL for the resource.",
- "readOnly": true,
- "type": "string"
- },
- "status": {
- "description": "Output only. The status of the nodes in this pool instance.",
- "enum": [
- "STATUS_UNSPECIFIED",
- "PROVISIONING",
- "RUNNING",
- "RUNNING_WITH_ERROR",
- "RECONCILING",
- "STOPPING",
- "ERROR"
- ],
- "readOnly": true,
- "type": "string",
- "x-google-enum-descriptions": [
- "Not set.",
- "The PROVISIONING state indicates the node pool is being created.",
- "The RUNNING state indicates the node pool has been created and is fully usable.",
- "The RUNNING_WITH_ERROR state indicates the node pool has been created and is partially usable. Some error state has occurred and some functionality may be impaired. Customer may need to reissue a request or trigger a new update.",
- "The RECONCILING state indicates that some work is actively being done on the node pool, such as upgrading node software. Details can be found in the `statusMessage` field.",
- "The STOPPING state indicates the node pool is being deleted.",
- "The ERROR state indicates the node pool may be unusable. Details can be found in the `statusMessage` field."
- ]
- },
- "statusMessage": {
- "deprecated": true,
- "description": "Output only. Deprecated. Use conditions instead. Additional information about the current status of this node pool instance, if available.",
- "readOnly": true,
- "type": "string"
- },
- "updateInfo": {
- "$ref": "#/$defs/UpdateInfo",
- "description": "Output only. Update info contains relevant information during a node pool update.",
- "readOnly": true
- },
- "upgradeSettings": {
- "$ref": "#/$defs/UpgradeSettings",
- "description": "Upgrade settings control disruption and speed of the upgrade."
- },
- "version": {
- "description": "The version of Kubernetes running on this NodePool's nodes. If unspecified, it defaults as described [here](https://cloud.google.com/kubernetes-engine/versioning#specifying_node_version).",
- "type": "string"
- }
- },
- "type": "object"
- },
- "NodePoolAutoConfig": {
- "description": "Node pool configs that apply to all auto-provisioned node pools in autopilot clusters and node auto-provisioning enabled clusters.",
- "properties": {
- "linuxNodeConfig": {
- "$ref": "#/$defs/LinuxNodeConfig",
- "description": "Output only. Configuration options for Linux nodes.",
- "readOnly": true
- },
- "networkTags": {
- "$ref": "#/$defs/NetworkTags",
- "description": "The list of instance tags applied to all nodes. Tags are used to identify valid sources or targets for network firewalls and are specified by the client during cluster creation. Each tag within the list must comply with RFC1035."
- },
- "nodeKubeletConfig": {
- "$ref": "#/$defs/NodeKubeletConfig",
- "description": "NodeKubeletConfig controls the defaults for autoprovisioned node-pools. Currently only `insecure_kubelet_readonly_port_enabled` can be set here."
- },
- "resourceManagerTags": {
- "$ref": "#/$defs/ResourceManagerTags",
- "description": "Resource manager tag keys and values to be attached to the nodes for managing Compute Engine firewalls using Network Firewall Policies."
- }
- },
- "type": "object"
- },
- "NodePoolAutoscaling": {
- "description": "NodePoolAutoscaling contains information required by cluster autoscaler to adjust the size of the node pool to the current cluster usage.",
- "properties": {
- "autoprovisioned": {
- "description": "Can this node pool be deleted automatically.",
- "type": "boolean"
- },
- "enabled": {
- "description": "Is autoscaling enabled for this node pool.",
- "type": "boolean"
- },
- "locationPolicy": {
- "description": "Location policy used when scaling up a nodepool.",
- "enum": [
- "LOCATION_POLICY_UNSPECIFIED",
- "BALANCED",
- "ANY"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Not set.",
- "BALANCED is a best effort policy that aims to balance the sizes of different zones.",
- "ANY policy picks zones that have the highest capacity available."
- ]
- },
- "maxNodeCount": {
- "description": "Maximum number of nodes for one location in the node pool. Must be >= min_node_count. There has to be enough quota to scale up the cluster.",
- "format": "int32",
- "type": "integer"
- },
- "minNodeCount": {
- "description": "Minimum number of nodes for one location in the node pool. Must be greater than or equal to 0 and less than or equal to max_node_count.",
- "format": "int32",
- "type": "integer"
- },
- "totalMaxNodeCount": {
- "description": "Maximum number of nodes in the node pool. Must be greater than or equal to total_min_node_count. There has to be enough quota to scale up the cluster. The total_*_node_count fields are mutually exclusive with the *_node_count fields.",
- "format": "int32",
- "type": "integer"
- },
- "totalMinNodeCount": {
- "description": "Minimum number of nodes in the node pool. Must be greater than or equal to 0 and less than or equal to total_max_node_count. The total_*_node_count fields are mutually exclusive with the *_node_count fields.",
- "format": "int32",
- "type": "integer"
- }
- },
- "type": "object"
- },
- "NodePoolDefaults": {
- "description": "Subset of Nodepool message that has defaults.",
- "properties": {
- "nodeConfigDefaults": {
- "$ref": "#/$defs/NodeConfigDefaults",
- "description": "Subset of NodeConfig message that has defaults."
- }
- },
- "type": "object"
- },
- "NodePoolLoggingConfig": {
- "description": "NodePoolLoggingConfig specifies logging configuration for nodepools.",
- "properties": {
- "variantConfig": {
- "$ref": "#/$defs/LoggingVariantConfig",
- "description": "Logging variant configuration."
- }
- },
- "type": "object"
- },
- "NodeTaint": {
- "description": "Kubernetes taint is composed of three fields: key, value, and effect. Effect can only be one of three types: NoSchedule, PreferNoSchedule or NoExecute. See [here](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration) for more information, including usage and the valid values.",
- "properties": {
- "effect": {
- "description": "Effect for taint.",
- "enum": [
- "EFFECT_UNSPECIFIED",
- "NO_SCHEDULE",
- "PREFER_NO_SCHEDULE",
- "NO_EXECUTE"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Not set",
- "NoSchedule",
- "PreferNoSchedule",
- "NoExecute"
- ]
- },
- "key": {
- "description": "Key for taint.",
- "type": "string"
- },
- "value": {
- "description": "Value for taint.",
- "type": "string"
- }
- },
- "type": "object"
- },
- "NotificationConfig": {
- "description": "NotificationConfig is the configuration of notifications.",
- "properties": {
- "pubsub": {
- "$ref": "#/$defs/PubSub",
- "description": "Notification config for Pub/Sub."
- }
- },
- "type": "object"
- },
- "OperationError": {
- "description": "OperationError records errors seen from CloudKMS keys encountered during updates to DatabaseEncryption configuration.",
- "properties": {
- "errorMessage": {
- "description": "Description of the error seen during the operation.",
- "type": "string"
- },
- "keyName": {
- "description": "CloudKMS key resource that had the error.",
- "type": "string"
- },
- "timestamp": {
- "description": "Time when the CloudKMS error was seen.",
- "format": "date-time",
- "type": "string"
- }
- },
- "type": "object"
- },
- "ParallelstoreCsiDriverConfig": {
- "description": "Configuration for the Cloud Storage Parallelstore CSI driver.",
- "properties": {
- "enabled": {
- "description": "Whether the Cloud Storage Parallelstore CSI driver is enabled for this cluster.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "ParentProductConfig": {
- "description": "ParentProductConfig is the configuration of the parent product of the cluster. This field is used by Google internal products that are built on top of a GKE cluster and take the ownership of the cluster.",
- "properties": {
- "labels": {
- "additionalProperties": {
- "type": "string"
- },
- "description": "Labels contain the configuration of the parent product.",
- "type": "object"
- },
- "productName": {
- "description": "Name of the parent product associated with the cluster.",
- "type": "string"
- }
- },
- "type": "object"
- },
- "PlacementPolicy": {
- "description": "PlacementPolicy defines the placement policy used by the node pool.",
- "properties": {
- "policyName": {
- "description": "If set, refers to the name of a custom resource policy supplied by the user. The resource policy must be in the same project and region as the node pool. If not found, InvalidArgument error is returned.",
- "type": "string"
- },
- "tpuTopology": {
- "description": "Optional. TPU placement topology for pod slice node pool. https://cloud.google.com/tpu/docs/types-topologies#tpu_topologies",
- "type": "string"
- },
- "type": {
- "description": "The type of placement.",
- "enum": [
- "TYPE_UNSPECIFIED",
- "COMPACT"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "TYPE_UNSPECIFIED specifies no requirements on nodes placement.",
- "COMPACT specifies node placement in the same availability domain to ensure low communication latency."
- ]
- }
- },
- "type": "object"
- },
- "PodAutoscaling": {
- "description": "PodAutoscaling is used for configuration of parameters for workload autoscaling.",
- "properties": {
- "hpaProfile": {
- "description": "Selected Horizontal Pod Autoscaling profile.",
- "enum": [
- "HPA_PROFILE_UNSPECIFIED",
- "NONE",
- "PERFORMANCE"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "HPA_PROFILE_UNSPECIFIED is used when no custom HPA profile is set.",
- "Customers explicitly opt-out of HPA profiles.",
- "PERFORMANCE is used when customers opt-in to the performance HPA profile. In this profile we support a higher number of HPAs per cluster and faster metrics collection for workload autoscaling."
- ]
- }
- },
- "type": "object"
- },
- "PodCIDROverprovisionConfig": {
- "description": "[PRIVATE FIELD] Config for pod CIDR size overprovisioning.",
- "properties": {
- "disable": {
- "description": "Whether Pod CIDR overprovisioning is disabled. Note: Pod CIDR overprovisioning is enabled by default.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "PrivateClusterConfig": {
- "description": "Configuration options for private clusters.",
- "properties": {
- "enablePrivateEndpoint": {
- "deprecated": true,
- "description": "Whether the master's internal IP address is used as the cluster endpoint. Deprecated: Use ControlPlaneEndpointsConfig.IPEndpointsConfig.enable_public_endpoint instead. Note that the value of enable_public_endpoint is reversed: if enable_private_endpoint is false, then enable_public_endpoint will be true.",
- "type": "boolean"
- },
- "enablePrivateNodes": {
- "deprecated": true,
- "description": "Whether nodes have internal IP addresses only. If enabled, all nodes are given only RFC 1918 private addresses and communicate with the master via private networking. Deprecated: Use NetworkConfig.default_enable_private_nodes instead.",
- "type": "boolean"
- },
- "masterGlobalAccessConfig": {
- "$ref": "#/$defs/PrivateClusterMasterGlobalAccessConfig",
- "deprecated": true,
- "description": "Controls master global access settings. Deprecated: Use ControlPlaneEndpointsConfig.IPEndpointsConfig.enable_global_access instead."
- },
- "masterIpv4CidrBlock": {
- "description": "The IP range in CIDR notation to use for the hosted master network. This range will be used for assigning internal IP addresses to the master or set of masters, as well as the ILB VIP. This range must not overlap with any other ranges in use within the cluster's network.",
- "type": "string"
- },
- "peeringName": {
- "description": "Output only. The peering name in the customer VPC used by this cluster.",
- "readOnly": true,
- "type": "string"
- },
- "privateEndpoint": {
- "deprecated": true,
- "description": "Output only. The internal IP address of this cluster's master endpoint. Deprecated: Use ControlPlaneEndpointsConfig.IPEndpointsConfig.private_endpoint instead.",
- "readOnly": true,
- "type": "string"
- },
- "privateEndpointSubnetwork": {
- "deprecated": true,
- "description": "Subnet to provision the master's private endpoint during cluster creation. Specified in projects/*/regions/*/subnetworks/* format. Deprecated: Use ControlPlaneEndpointsConfig.IPEndpointsConfig.private_endpoint_subnetwork instead.",
- "type": "string"
- },
- "publicEndpoint": {
- "deprecated": true,
- "description": "Output only. The external IP address of this cluster's master endpoint. Deprecated:Use ControlPlaneEndpointsConfig.IPEndpointsConfig.public_endpoint instead.",
- "readOnly": true,
- "type": "string"
- }
- },
- "type": "object"
- },
- "PrivateClusterMasterGlobalAccessConfig": {
- "description": "Configuration for controlling master global access settings.",
- "properties": {
- "enabled": {
- "description": "Whenever master is accessible globally or not.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "PrivateRegistryAccessConfig": {
- "description": "PrivateRegistryAccessConfig contains access configuration for private container registries.",
- "properties": {
- "certificateAuthorityDomainConfig": {
- "description": "Private registry access configuration.",
- "items": {
- "$ref": "#/$defs/CertificateAuthorityDomainConfig"
- },
- "type": "array"
- },
- "enabled": {
- "description": "Private registry access is enabled.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "PrivilegedAdmissionConfig": {
- "description": "PrivilegedAdmissionConfig stores the list of authorized allowlist paths for the cluster.",
- "properties": {
- "allowlistPaths": {
- "description": "The customer allowlist Cloud Storage paths for the cluster. These paths are used with the `--autopilot-privileged-admission` flag to authorize privileged workloads in Autopilot clusters. Paths can be GKE-owned, in the format `gke:////`, or customer-owned, in the format `gs:///`. Wildcards (`*`) are supported to authorize all allowlists under specific paths or directories. Example: `gs://my-bucket/*` will authorize all allowlists under the `my-bucket` bucket.",
- "items": {
- "type": "string"
- },
- "type": "array"
- }
- },
- "type": "object"
- },
- "PubSub": {
- "description": "Pub/Sub specific notification config.",
- "properties": {
- "enabled": {
- "description": "Enable notifications for Pub/Sub.",
- "type": "boolean"
- },
- "filter": {
- "$ref": "#/$defs/Filter",
- "description": "Allows filtering to one or more specific event types. If no filter is specified, or if a filter is specified with no event types, all event types will be sent"
- },
- "topic": {
- "description": "The desired Pub/Sub topic to which notifications will be sent by GKE. Format is `projects/{project}/topics/{topic}`.",
- "type": "string"
- }
- },
- "type": "object"
- },
- "QueuedProvisioning": {
- "description": "QueuedProvisioning defines the queued provisioning used by the node pool.",
- "properties": {
- "enabled": {
- "description": "Denotes that this nodepool is QRM specific, meaning nodes can be only obtained through queuing via the Cluster Autoscaler ProvisioningRequest API.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "RBACBindingConfig": {
- "description": "RBACBindingConfig allows user to restrict ClusterRoleBindings an RoleBindings that can be created.",
- "properties": {
- "enableInsecureBindingSystemAuthenticated": {
- "description": "Setting this to true will allow any ClusterRoleBinding and RoleBinding with subjects system:authenticated.",
- "type": "boolean"
- },
- "enableInsecureBindingSystemUnauthenticated": {
- "description": "Setting this to true will allow any ClusterRoleBinding and RoleBinding with subjets system:anonymous or system:unauthenticated.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "RangeInfo": {
- "description": "RangeInfo contains the range name and the range utilization by this cluster.",
- "properties": {
- "rangeName": {
- "description": "Output only. Name of a range.",
- "readOnly": true,
- "type": "string"
- },
- "utilization": {
- "description": "Output only. The utilization of the range.",
- "format": "double",
- "readOnly": true,
- "type": "number"
- }
- },
- "type": "object"
- },
- "RayClusterLoggingConfig": {
- "description": "RayClusterLoggingConfig specifies configuration of Ray logging.",
- "properties": {
- "enabled": {
- "description": "Enable log collection for Ray clusters.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "RayClusterMonitoringConfig": {
- "description": "RayClusterMonitoringConfig specifies monitoring configuration for Ray clusters.",
- "properties": {
- "enabled": {
- "description": "Enable metrics collection for Ray clusters.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "RayOperatorConfig": {
- "description": "Configuration options for the Ray Operator add-on.",
- "properties": {
- "enabled": {
- "description": "Whether the Ray Operator addon is enabled for this cluster.",
- "type": "boolean"
- },
- "rayClusterLoggingConfig": {
- "$ref": "#/$defs/RayClusterLoggingConfig",
- "description": "Optional. Logging configuration for Ray clusters."
- },
- "rayClusterMonitoringConfig": {
- "$ref": "#/$defs/RayClusterMonitoringConfig",
- "description": "Optional. Monitoring configuration for Ray clusters."
- }
- },
- "type": "object"
- },
- "RecurringTimeWindow": {
- "description": "Represents an arbitrary window of time that recurs.",
- "properties": {
- "recurrence": {
- "description": "An RRULE (https://tools.ietf.org/html/rfc5545#section-3.8.5.3) for how this window recurs. They go on for the span of time between the start and end time. For example, to have something repeat every weekday, you'd use: `FREQ=WEEKLY;BYDAY=MO,TU,WE,TH,FR` To repeat some window daily (equivalent to the DailyMaintenanceWindow): `FREQ=DAILY` For the first weekend of every month: `FREQ=MONTHLY;BYSETPOS=1;BYDAY=SA,SU` This specifies how frequently the window starts. Eg, if you wanted to have a 9-5 UTC-4 window every weekday, you'd use something like: ``` start time = 2019-01-01T09:00:00-0400 end time = 2019-01-01T17:00:00-0400 recurrence = FREQ=WEEKLY;BYDAY=MO,TU,WE,TH,FR ``` Windows can span multiple days. Eg, to make the window encompass every weekend from midnight Saturday till the last minute of Sunday UTC: ``` start time = 2019-01-05T00:00:00Z end time = 2019-01-07T23:59:00Z recurrence = FREQ=WEEKLY;BYDAY=SA ``` Note the start and end time's specific dates are largely arbitrary except to specify duration of the window and when it first starts. The FREQ values of HOURLY, MINUTELY, and SECONDLY are not supported.",
- "type": "string"
- },
- "window": {
- "$ref": "#/$defs/TimeWindow",
- "description": "The window of the first recurrence."
- }
- },
- "type": "object"
- },
- "RegistryHeader": {
- "description": "RegistryHeader configures headers for the registry.",
- "properties": {
- "key": {
- "description": "Key configures the header key.",
- "type": "string"
- },
- "value": {
- "description": "Value configures the header value.",
- "items": {
- "type": "string"
- },
- "type": "array"
- }
- },
- "type": "object"
- },
- "RegistryHostConfig": {
- "description": "RegistryHostConfig configures the top-level structure for a single containerd registry server's configuration, which represents one hosts.toml file on the node. It will override the same fqdns in PrivateRegistryAccessConfig.",
- "properties": {
- "hosts": {
- "description": "HostConfig configures a list of host-specific configurations for the server. Each server can have at most 10 host configurations.",
- "items": {
- "$ref": "#/$defs/HostConfig"
- },
- "type": "array"
- },
- "server": {
- "description": "Defines the host name of the registry server, which will be used to create configuration file as /etc/containerd/hosts.d//hosts.toml. It supports fully qualified domain names (FQDN) and IP addresses: Specifying port is supported. Wildcards are NOT supported. Examples: - my.customdomain.com - 10.0.1.2:5000",
- "type": "string"
- }
- },
- "type": "object"
- },
- "ReleaseChannel": {
- "description": "ReleaseChannel indicates which release channel a cluster is subscribed to. Release channels are arranged in order of risk. When a cluster is subscribed to a release channel, Google maintains both the master version and the node version. Node auto-upgrade defaults to true and cannot be disabled.",
- "properties": {
- "channel": {
- "description": "channel specifies which release channel the cluster is subscribed to.",
- "enum": [
- "UNSPECIFIED",
- "RAPID",
- "REGULAR",
- "STABLE",
- "EXTENDED"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "No channel specified.",
- "RAPID channel is offered on an early access basis for customers who want to test new releases. WARNING: Versions available in the RAPID Channel may be subject to unresolved issues with no known workaround and are not subject to any SLAs.",
- "Clusters subscribed to REGULAR receive versions that are considered GA quality. REGULAR is intended for production users who want to take advantage of new features.",
- "Clusters subscribed to STABLE receive versions that are known to be stable and reliable in production.",
- "Clusters subscribed to EXTENDED receive extended support and availability for versions which are known to be stable and reliable in production."
- ]
- }
- },
- "type": "object"
- },
- "ReservationAffinity": {
- "description": "[ReservationAffinity](https://cloud.google.com/compute/docs/instances/reserving-zonal-resources) is the configuration of desired reservation which instances could take capacity from.",
- "properties": {
- "consumeReservationType": {
- "description": "Corresponds to the type of reservation consumption.",
- "enum": [
- "UNSPECIFIED",
- "NO_RESERVATION",
- "ANY_RESERVATION",
- "SPECIFIC_RESERVATION"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value. This should not be used.",
- "Do not consume from any reserved capacity.",
- "Consume any reservation available.",
- "Must consume from a specific reservation. Must specify key value fields for specifying the reservations."
- ]
- },
- "key": {
- "description": "Corresponds to the label key of a reservation resource. To target a SPECIFIC_RESERVATION by name, specify \"compute.googleapis.com/reservation-name\" as the key and specify the name of your reservation as its value.",
- "type": "string"
- },
- "values": {
- "description": "Corresponds to the label value(s) of reservation resource(s).",
- "items": {
- "type": "string"
- },
- "type": "array"
- }
- },
- "type": "object"
- },
- "ResourceLimit": {
- "description": "Contains information about amount of some resource in the cluster. For memory, value should be in GB.",
- "properties": {
- "maximum": {
- "description": "Maximum amount of the resource in the cluster.",
- "format": "int64",
- "type": "string"
- },
- "minimum": {
- "description": "Minimum amount of the resource in the cluster.",
- "format": "int64",
- "type": "string"
- },
- "resourceType": {
- "description": "Resource name \"cpu\", \"memory\" or gpu-specific string.",
- "type": "string"
- }
- },
- "type": "object"
- },
- "ResourceManagerTags": {
- "description": "A map of resource manager tag keys and values to be attached to the nodes for managing Compute Engine firewalls using Network Firewall Policies. Tags must be according to specifications in https://cloud.google.com/vpc/docs/tags-firewalls-overview#specifications. A maximum of 5 tag key-value pairs can be specified. Existing tags will be replaced with new values.",
- "properties": {
- "tags": {
- "additionalProperties": {
- "type": "string"
- },
- "description": "TagKeyValue must be in one of the following formats ([KEY]=[VALUE]) 1. `tagKeys/{tag_key_id}=tagValues/{tag_value_id}` 2. `{org_id}/{tag_key_name}={tag_value_name}` 3. `{project_id}/{tag_key_name}={tag_value_name}`",
- "type": "object"
- }
- },
- "type": "object"
- },
- "ResourceUsageExportConfig": {
- "description": "Configuration for exporting cluster resource usages.",
- "properties": {
- "bigqueryDestination": {
- "$ref": "#/$defs/BigQueryDestination",
- "description": "Configuration to use BigQuery as usage export destination."
- },
- "consumptionMeteringConfig": {
- "$ref": "#/$defs/ConsumptionMeteringConfig",
- "description": "Configuration to enable resource consumption metering."
- },
- "enableNetworkEgressMetering": {
- "description": "Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "RotationConfig": {
- "description": "RotationConfig is config for secret manager auto rotation.",
- "properties": {
- "enabled": {
- "description": "Whether the rotation is enabled.",
- "type": "boolean"
- },
- "rotationInterval": {
- "description": "The interval between two consecutive rotations. Default rotation interval is 2 minutes.",
- "format": "google-duration",
- "type": "string"
- }
- },
- "type": "object"
- },
- "SandboxConfig": {
- "description": "SandboxConfig contains configurations of the sandbox to use for the node.",
- "properties": {
- "type": {
- "description": "Type of the sandbox to use for the node.",
- "enum": [
- "UNSPECIFIED",
- "GVISOR"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value. This should not be used.",
- "Run sandbox using gvisor."
- ]
- }
- },
- "type": "object"
- },
- "ScheduleUpgradeConfig": {
- "description": "Configuration for scheduled upgrades on the cluster.",
- "properties": {
- "enabled": {
- "description": "Optional. Whether or not scheduled upgrades are enabled.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "SecondaryBootDisk": {
- "description": "SecondaryBootDisk represents a persistent disk attached to a node with special configurations based on its mode.",
- "properties": {
- "diskImage": {
- "description": "Fully-qualified resource ID for an existing disk image.",
- "type": "string"
- },
- "mode": {
- "description": "Disk mode (container image cache, etc.)",
- "enum": [
- "MODE_UNSPECIFIED",
- "CONTAINER_IMAGE_CACHE"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "MODE_UNSPECIFIED is when mode is not set.",
- "CONTAINER_IMAGE_CACHE is for using the secondary boot disk as a container image cache."
- ]
- }
- },
- "type": "object"
- },
- "SecondaryBootDiskUpdateStrategy": {
- "description": "SecondaryBootDiskUpdateStrategy is a placeholder which will be extended in the future to define different options for updating secondary boot disks.",
- "type": "object"
- },
- "SecretManagerConfig": {
- "description": "SecretManagerConfig is config for secret manager enablement.",
- "properties": {
- "enabled": {
- "description": "Enable/Disable Secret Manager Config.",
- "type": "boolean"
- },
- "rotationConfig": {
- "$ref": "#/$defs/RotationConfig",
- "description": "Rotation config for secret manager."
- }
- },
- "type": "object"
- },
- "SecurityPostureConfig": {
- "description": "SecurityPostureConfig defines the flags needed to enable/disable features for the Security Posture API.",
- "properties": {
- "mode": {
- "description": "Sets which mode to use for Security Posture features.",
- "enum": [
- "MODE_UNSPECIFIED",
- "DISABLED",
- "BASIC",
- "ENTERPRISE"
- ],
- "type": "string",
- "x-google-enum-deprecated": [
- false,
- false,
- false,
- true
- ],
- "x-google-enum-descriptions": [
- "Default value not specified.",
- "Disables Security Posture features on the cluster.",
- "Applies Security Posture features on the cluster.",
- "Deprecated: Security Posture Enterprise features are no longer supported. For more details, see https://cloud.google.com/kubernetes-engine/docs/deprecations/posture-management-deprecation. Applies the Security Posture off cluster Enterprise level features."
- ]
- },
- "vulnerabilityMode": {
- "description": "Sets which mode to use for vulnerability scanning.",
- "enum": [
- "VULNERABILITY_MODE_UNSPECIFIED",
- "VULNERABILITY_DISABLED",
- "VULNERABILITY_BASIC",
- "VULNERABILITY_ENTERPRISE"
- ],
- "type": "string",
- "x-google-enum-deprecated": [
- false,
- false,
- true,
- false
- ],
- "x-google-enum-descriptions": [
- "Default value not specified.",
- "Disables vulnerability scanning on the cluster.",
- "Deprecated: Basic vulnerability scanning is no longer supported. For more details, see https://cloud.google.com/kubernetes-engine/docs/deprecations/posture-management-deprecation. Applies basic vulnerability scanning on the cluster.",
- "Applies the Security Posture's vulnerability on cluster Enterprise level features."
- ]
- }
- },
- "type": "object"
- },
- "ServiceExternalIPsConfig": {
- "description": "Config to block services with externalIPs field.",
- "properties": {
- "enabled": {
- "description": "Whether Services with ExternalIPs field are allowed or not.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "ShieldedInstanceConfig": {
- "description": "A set of Shielded Instance options.",
- "properties": {
- "enableIntegrityMonitoring": {
- "description": "Defines whether the instance has integrity monitoring enabled. Enables monitoring and attestation of the boot integrity of the instance. The attestation is performed against the integrity policy baseline. This baseline is initially derived from the implicitly trusted boot image when the instance is created.",
- "type": "boolean"
- },
- "enableSecureBoot": {
- "description": "Defines whether the instance has Secure Boot enabled. Secure Boot helps ensure that the system only runs authentic software by verifying the digital signature of all boot components, and halting the boot process if signature verification fails.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "ShieldedNodes": {
- "description": "Configuration of Shielded Nodes feature.",
- "properties": {
- "enabled": {
- "description": "Whether Shielded Nodes features are enabled on all nodes in this cluster.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "SliceControllerConfig": {
- "description": "Configuration for the Slice Controller.",
- "properties": {
- "enabled": {
- "description": "Optional. Indicates whether Slice Controller is enabled in the cluster.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "SoleTenantConfig": {
- "description": "SoleTenantConfig contains the NodeAffinities to specify what shared sole tenant node groups should back the node pool.",
- "properties": {
- "minNodeCpus": {
- "description": "Optional. The minimum number of virtual CPUs this instance will consume when running on a sole-tenant node. This field can only be set if the node pool is created in a shared sole-tenant node group.",
- "format": "int32",
- "type": "integer"
- },
- "nodeAffinities": {
- "description": "NodeAffinities used to match to a shared sole tenant node group.",
- "items": {
- "$ref": "#/$defs/NodeAffinity"
- },
- "type": "array"
- }
- },
- "type": "object"
- },
- "StandardRolloutPolicy": {
- "description": "Standard rollout policy is the default policy for blue-green.",
- "properties": {
- "batchNodeCount": {
- "description": "Number of blue nodes to drain in a batch.",
- "format": "int32",
- "type": "integer"
- },
- "batchPercentage": {
- "description": "Percentage of the blue pool nodes to drain in a batch. The range of this field should be (0.0, 1.0].",
- "format": "float",
- "type": "number"
- },
- "batchSoakDuration": {
- "description": "Soak time after each batch gets drained. Default to zero.",
- "format": "google-duration",
- "type": "string"
- }
- },
- "type": "object"
- },
- "StatefulHAConfig": {
- "description": "Configuration for the Stateful HA add-on.",
- "properties": {
- "enabled": {
- "description": "Whether the Stateful HA add-on is enabled for this cluster.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "StatusCondition": {
- "description": "StatusCondition describes why a cluster or a node pool has a certain status (e.g., ERROR or DEGRADED).",
- "properties": {
- "canonicalCode": {
- "description": "Canonical code of the condition.",
- "enum": [
- "OK",
- "CANCELLED",
- "UNKNOWN",
- "INVALID_ARGUMENT",
- "DEADLINE_EXCEEDED",
- "NOT_FOUND",
- "ALREADY_EXISTS",
- "PERMISSION_DENIED",
- "UNAUTHENTICATED",
- "RESOURCE_EXHAUSTED",
- "FAILED_PRECONDITION",
- "ABORTED",
- "OUT_OF_RANGE",
- "UNIMPLEMENTED",
- "INTERNAL",
- "UNAVAILABLE",
- "DATA_LOSS"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Not an error; returned on success. HTTP Mapping: 200 OK",
- "The operation was cancelled, typically by the caller. HTTP Mapping: 499 Client Closed Request",
- "Unknown error. For example, this error may be returned when a `Status` value received from another address space belongs to an error space that is not known in this address space. Also errors raised by APIs that do not return enough error information may be converted to this error. HTTP Mapping: 500 Internal Server Error",
- "The client specified an invalid argument. Note that this differs from `FAILED_PRECONDITION`. `INVALID_ARGUMENT` indicates arguments that are problematic regardless of the state of the system (e.g., a malformed file name). HTTP Mapping: 400 Bad Request",
- "The deadline expired before the operation could complete. For operations that change the state of the system, this error may be returned even if the operation has completed successfully. For example, a successful response from a server could have been delayed long enough for the deadline to expire. HTTP Mapping: 504 Gateway Timeout",
- "Some requested entity (e.g., file or directory) was not found. Note to server developers: if a request is denied for an entire class of users, such as gradual feature rollout or undocumented allowlist, `NOT_FOUND` may be used. If a request is denied for some users within a class of users, such as user-based access control, `PERMISSION_DENIED` must be used. HTTP Mapping: 404 Not Found",
- "The entity that a client attempted to create (e.g., file or directory) already exists. HTTP Mapping: 409 Conflict",
- "The caller does not have permission to execute the specified operation. `PERMISSION_DENIED` must not be used for rejections caused by exhausting some resource (use `RESOURCE_EXHAUSTED` instead for those errors). `PERMISSION_DENIED` must not be used if the caller can not be identified (use `UNAUTHENTICATED` instead for those errors). This error code does not imply the request is valid or the requested entity exists or satisfies other pre-conditions. HTTP Mapping: 403 Forbidden",
- "The request does not have valid authentication credentials for the operation. HTTP Mapping: 401 Unauthorized",
- "Some resource has been exhausted, perhaps a per-user quota, or perhaps the entire file system is out of space. HTTP Mapping: 429 Too Many Requests",
- "The operation was rejected because the system is not in a state required for the operation's execution. For example, the directory to be deleted is non-empty, an rmdir operation is applied to a non-directory, etc. Service implementors can use the following guidelines to decide between `FAILED_PRECONDITION`, `ABORTED`, and `UNAVAILABLE`: (a) Use `UNAVAILABLE` if the client can retry just the failing call. (b) Use `ABORTED` if the client should retry at a higher level. For example, when a client-specified test-and-set fails, indicating the client should restart a read-modify-write sequence. (c) Use `FAILED_PRECONDITION` if the client should not retry until the system state has been explicitly fixed. For example, if an \"rmdir\" fails because the directory is non-empty, `FAILED_PRECONDITION` should be returned since the client should not retry unless the files are deleted from the directory. HTTP Mapping: 400 Bad Request",
- "The operation was aborted, typically due to a concurrency issue such as a sequencer check failure or transaction abort. See the guidelines above for deciding between `FAILED_PRECONDITION`, `ABORTED`, and `UNAVAILABLE`. HTTP Mapping: 409 Conflict",
- "The operation was attempted past the valid range. E.g., seeking or reading past end-of-file. Unlike `INVALID_ARGUMENT`, this error indicates a problem that may be fixed if the system state changes. For example, a 32-bit file system will generate `INVALID_ARGUMENT` if asked to read at an offset that is not in the range [0,2^32-1], but it will generate `OUT_OF_RANGE` if asked to read from an offset past the current file size. There is a fair bit of overlap between `FAILED_PRECONDITION` and `OUT_OF_RANGE`. We recommend using `OUT_OF_RANGE` (the more specific error) when it applies so that callers who are iterating through a space can easily look for an `OUT_OF_RANGE` error to detect when they are done. HTTP Mapping: 400 Bad Request",
- "The operation is not implemented or is not supported/enabled in this service. HTTP Mapping: 501 Not Implemented",
- "Internal errors. This means that some invariants expected by the underlying system have been broken. This error code is reserved for serious errors. HTTP Mapping: 500 Internal Server Error",
- "The service is currently unavailable. This is most likely a transient condition, which can be corrected by retrying with a backoff. Note that it is not always safe to retry non-idempotent operations. See the guidelines above for deciding between `FAILED_PRECONDITION`, `ABORTED`, and `UNAVAILABLE`. HTTP Mapping: 503 Service Unavailable",
- "Unrecoverable data loss or corruption. HTTP Mapping: 500 Internal Server Error"
- ]
- },
- "code": {
- "deprecated": true,
- "description": "Machine-friendly representation of the condition Deprecated. Use canonical_code instead.",
- "enum": [
- "UNKNOWN",
- "GCE_STOCKOUT",
- "GKE_SERVICE_ACCOUNT_DELETED",
- "GCE_QUOTA_EXCEEDED",
- "SET_BY_OPERATOR",
- "CLOUD_KMS_KEY_ERROR",
- "CA_EXPIRING",
- "NODE_SERVICE_ACCOUNT_MISSING_PERMISSIONS",
- "CLOUD_KMS_KEY_DESTROYED"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "UNKNOWN indicates a generic condition.",
- "GCE_STOCKOUT indicates that Google Compute Engine resources are temporarily unavailable.",
- "GKE_SERVICE_ACCOUNT_DELETED indicates that the user deleted their robot service account.",
- "Google Compute Engine quota was exceeded.",
- "Cluster state was manually changed by an SRE due to a system logic error.",
- "Unable to perform an encrypt operation against the CloudKMS key used for etcd level encryption.",
- "Cluster CA is expiring soon.",
- "Node service account is missing permissions.",
- "Cloud KMS key version used for etcd level encryption has been destroyed. This is a permanent error."
- ]
- },
- "message": {
- "description": "Human-friendly representation of the condition",
- "type": "string"
- }
- },
- "type": "object"
- },
- "SwapConfig": {
- "description": "Configuration for swap memory on a node pool.",
- "properties": {
- "bootDiskProfile": {
- "$ref": "#/$defs/BootDiskProfile",
- "description": "Swap on the node's boot disk."
- },
- "dedicatedLocalSsdProfile": {
- "$ref": "#/$defs/DedicatedLocalSsdProfile",
- "description": "Provisions a new, separate local NVMe SSD exclusively for swap."
- },
- "enabled": {
- "description": "Optional. Enables or disables swap for the node pool.",
- "type": "boolean"
- },
- "encryptionConfig": {
- "$ref": "#/$defs/EncryptionConfig",
- "description": "Optional. If omitted, swap space is encrypted by default."
- },
- "ephemeralLocalSsdProfile": {
- "$ref": "#/$defs/EphemeralLocalSsdProfile",
- "description": "Swap on the local SSD shared with pod ephemeral storage."
- }
- },
- "type": "object"
- },
- "TaintConfig": {
- "description": "TaintConfig contains the configuration for the taints of the node pool.",
- "properties": {
- "architectureTaintBehavior": {
- "description": "Optional. Controls architecture tainting behavior.",
- "enum": [
- "ARCHITECTURE_TAINT_BEHAVIOR_UNSPECIFIED",
- "NONE",
- "ARM"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Specifies that the behavior is unspecified, defaults to ARM.",
- "Disables default architecture taints on the node pool.",
- "Taints all the nodes in the node pool with the default ARM taint."
- ]
- }
- },
- "type": "object"
- },
- "TimeWindow": {
- "description": "Represents an arbitrary window of time.",
- "properties": {
- "endTime": {
- "description": "The time that the window ends. The end time should take place after the start time.",
- "format": "date-time",
- "type": "string"
- },
- "maintenanceExclusionOptions": {
- "$ref": "#/$defs/MaintenanceExclusionOptions",
- "description": "MaintenanceExclusionOptions provides maintenance exclusion related options."
- },
- "startTime": {
- "description": "The time that the window first starts.",
- "format": "date-time",
- "type": "string"
- }
- },
- "type": "object"
- },
- "TopologyManager": {
- "description": "TopologyManager defines the configuration options for Topology Manager feature. See https://kubernetes.io/docs/tasks/administer-cluster/topology-manager/",
- "properties": {
- "policy": {
- "description": "Configures the strategy for resource alignment. Allowed values are: * none: the default policy, and does not perform any topology alignment. * restricted: the topology manager stores the preferred NUMA node affinity for the container, and will reject the pod if the affinity if not preferred. * best-effort: the topology manager stores the preferred NUMA node affinity for the container. If the affinity is not preferred, the topology manager will admit the pod to the node anyway. * single-numa-node: the topology manager determines if the single NUMA node affinity is possible. If it is, Topology Manager will store this and the Hint Providers can then use this information when making the resource allocation decision. If, however, this is not possible then the Topology Manager will reject the pod from the node. This will result in a pod in a Terminated state with a pod admission failure. The default policy value is 'none' if unspecified. Details about each strategy can be found [here](https://kubernetes.io/docs/tasks/administer-cluster/topology-manager/#topology-manager-policies).",
- "type": "string"
- },
- "scope": {
- "description": "The Topology Manager aligns resources in following scopes: * container * pod The default scope is 'container' if unspecified. See https://kubernetes.io/docs/tasks/administer-cluster/topology-manager/#topology-manager-scopes",
- "type": "string"
- }
- },
- "type": "object"
- },
- "UpdateInfo": {
- "description": "UpdateInfo contains resource (instance groups, etc), status and other intermediate information relevant to a node pool upgrade.",
- "properties": {
- "blueGreenInfo": {
- "$ref": "#/$defs/BlueGreenInfo",
- "description": "Information of a blue-green upgrade."
- }
- },
- "type": "object"
- },
- "UpgradeSettings": {
- "description": "These upgrade settings control the level of parallelism and the level of disruption caused by an upgrade. maxUnavailable controls the number of nodes that can be simultaneously unavailable. maxSurge controls the number of additional nodes that can be added to the node pool temporarily for the time of the upgrade to increase the number of available nodes. (maxUnavailable + maxSurge) determines the level of parallelism (how many nodes are being upgraded at the same time). Note: upgrades inevitably introduce some disruption since workloads need to be moved from old nodes to new, upgraded ones. Even if maxUnavailable=0, this holds true. (Disruption stays within the limits of PodDisruptionBudget, if it is configured.) Consider a hypothetical node pool with 5 nodes having maxSurge=2, maxUnavailable=1. This means the upgrade process upgrades 3 nodes simultaneously. It creates 2 additional (upgraded) nodes, then it brings down 3 old (not yet upgraded) nodes at the same time. This ensures that there are always at least 4 nodes available. These upgrade settings configure the upgrade strategy for the node pool. Use strategy to switch between the strategies applied to the node pool. If the strategy is ROLLING, use max_surge and max_unavailable to control the level of parallelism and the level of disruption caused by upgrade. 1. maxSurge controls the number of additional nodes that can be added to the node pool temporarily for the time of the upgrade to increase the number of available nodes. 2. maxUnavailable controls the number of nodes that can be simultaneously unavailable. 3. (maxUnavailable + maxSurge) determines the level of parallelism (how many nodes are being upgraded at the same time). If the strategy is BLUE_GREEN, use blue_green_settings to configure the blue-green upgrade related settings. 1. standard_rollout_policy is the default policy. The policy is used to control the way blue pool gets drained. The draining is executed in the batch mode. The batch size could be specified as either percentage of the node pool size or the number of nodes. batch_soak_duration is the soak time after each batch gets drained. 2. node_pool_soak_duration is the soak time after all blue nodes are drained. After this period, the blue pool nodes will be deleted.",
- "properties": {
- "blueGreenSettings": {
- "$ref": "#/$defs/BlueGreenSettings",
- "description": "Settings for blue-green upgrade strategy."
- },
- "maxSurge": {
- "description": "The maximum number of nodes that can be created beyond the current size of the node pool during the upgrade process.",
- "format": "int32",
- "type": "integer"
- },
- "maxUnavailable": {
- "description": "The maximum number of nodes that can be simultaneously unavailable during the upgrade process. A node is considered available if its status is Ready.",
- "format": "int32",
- "type": "integer"
- },
- "strategy": {
- "description": "Update strategy of the node pool.",
- "enum": [
- "NODE_POOL_UPDATE_STRATEGY_UNSPECIFIED",
- "BLUE_GREEN",
- "SURGE",
- "SHORT_LIVED"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value if unset. GKE internally defaults the update strategy to SURGE for unspecified strategies.",
- "blue-green upgrade.",
- "SURGE is the traditional way of upgrade a node pool. max_surge and max_unavailable determines the level of upgrade parallelism.",
- "SHORT_LIVED is the dedicated upgrade strategy for QueuedProvisioning and flex start nodepools scaled up only by enqueueing to the Dynamic Workload Scheduler (DWS)."
- ]
- }
- },
- "type": "object"
- },
- "UserManagedKeysConfig": {
- "description": "UserManagedKeysConfig holds the resource address to Keys which are used for signing certs and token that are used for communication within cluster.",
- "properties": {
- "aggregationCa": {
- "description": "The Certificate Authority Service caPool to use for the aggregation CA in this cluster.",
- "type": "string"
- },
- "clusterCa": {
- "description": "The Certificate Authority Service caPool to use for the cluster CA in this cluster.",
- "type": "string"
- },
- "controlPlaneDiskEncryptionKey": {
- "description": "The Cloud KMS cryptoKey to use for Confidential Hyperdisk on the control plane nodes.",
- "type": "string"
- },
- "controlPlaneDiskEncryptionKeyVersions": {
- "description": "Output only. All of the versions of the Cloud KMS cryptoKey that are used by Confidential Hyperdisks on the control plane nodes.",
- "items": {
- "type": "string"
- },
- "readOnly": true,
- "type": "array"
- },
- "etcdApiCa": {
- "description": "Resource path of the Certificate Authority Service caPool to use for the etcd API CA in this cluster.",
- "type": "string"
- },
- "etcdPeerCa": {
- "description": "Resource path of the Certificate Authority Service caPool to use for the etcd peer CA in this cluster.",
- "type": "string"
- },
- "gkeopsEtcdBackupEncryptionKey": {
- "description": "Resource path of the Cloud KMS cryptoKey to use for encryption of internal etcd backups.",
- "type": "string"
- },
- "serviceAccountSigningKeys": {
- "description": "The Cloud KMS cryptoKeyVersions to use for signing service account JWTs issued by this cluster. Format: `projects/{project}/locations/{location}/keyRings/{keyring}/cryptoKeys/{cryptoKey}/cryptoKeyVersions/{cryptoKeyVersion}`",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "serviceAccountVerificationKeys": {
- "description": "The Cloud KMS cryptoKeyVersions to use for verifying service account JWTs issued by this cluster. Format: `projects/{project}/locations/{location}/keyRings/{keyring}/cryptoKeys/{cryptoKey}/cryptoKeyVersions/{cryptoKeyVersion}`",
- "items": {
- "type": "string"
- },
- "type": "array"
- }
- },
- "type": "object"
- },
- "VerticalPodAutoscaling": {
- "description": "VerticalPodAutoscaling contains global, per-cluster information required by Vertical Pod Autoscaler to automatically adjust the resources of pods controlled by it.",
- "properties": {
- "enabled": {
- "description": "Enables vertical pod autoscaling.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "VirtualNIC": {
- "description": "Configuration of gVNIC feature.",
- "properties": {
- "enabled": {
- "description": "Whether gVNIC features are enabled in the node pool.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "WindowsNodeConfig": {
- "description": "Parameters that can be configured on Windows nodes. Windows Node Config that define the parameters that will be used to configure the Windows node pool settings.",
- "properties": {
- "osVersion": {
- "description": "OSVersion specifies the Windows node config to be used on the node.",
- "enum": [
- "OS_VERSION_UNSPECIFIED",
- "OS_VERSION_LTSC2019",
- "OS_VERSION_LTSC2022"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "When OSVersion is not specified.",
- "LTSC2019 specifies to use LTSC2019 as the Windows Servercore Base Image.",
- "LTSC2022 specifies to use LTSC2022 as the Windows Servercore Base Image."
- ]
- }
- },
- "type": "object"
- },
- "WorkloadIdentityConfig": {
- "description": "Configuration for the use of Kubernetes Service Accounts in IAM policies.",
- "properties": {
- "workloadPool": {
- "description": "The workload pool to attach all Kubernetes service accounts to.",
- "type": "string"
- }
- },
- "type": "object"
- },
- "WorkloadMetadataConfig": {
- "description": "WorkloadMetadataConfig defines the metadata configuration to expose to workloads on the node pool.",
- "properties": {
- "mode": {
- "description": "Mode is the configuration for how to expose metadata to workloads running on the node pool.",
- "enum": [
- "MODE_UNSPECIFIED",
- "GCE_METADATA",
- "GKE_METADATA"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Not set.",
- "Expose all Compute Engine metadata to pods.",
- "Run the GKE Metadata Server on this node. The GKE Metadata Server exposes a metadata API to workloads that is compatible with the V1 Compute Metadata APIs exposed by the Compute Engine and App Engine Metadata Servers. This feature can only be enabled if Workload Identity is enabled at the cluster level."
- ]
- }
- },
- "type": "object"
- },
- "WorkloadPolicyConfig": {
- "description": "WorkloadPolicyConfig is the configuration related to GCW workload policy",
- "properties": {
- "allowNetAdmin": {
- "description": "If true, workloads can use NET_ADMIN capability.",
- "type": "boolean"
- },
- "autopilotCompatibilityAuditingEnabled": {
- "description": "If true, enables the GCW Auditor that audits workloads on standard clusters.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "WritableCgroups": {
- "description": "Defines writable cgroups configuration.",
- "properties": {
- "enabled": {
- "description": "Optional. Whether writable cgroups is enabled.",
- "type": "boolean"
- }
- },
- "type": "object"
- }
-}Output schema / descriptionPrevious value: -"ListClustersResponse is the result of ListClustersRequest."New value: +"Response for listing clusters in JSON format. The full cluster object can be found at https://cloud.google.com/container-engine/reference/rest/v1/projects.locations.clusters."Output schema / properties / clusters / descriptionPrevious value: -"A list of clusters in the project in the specified zone, or across all ones."New value: +"A string representing the ListClustersResponse object."Output schema / properties / clusters / items / $refRemoved value: -"#/$defs/Cluster"Output schema / properties / clusters / items / typeAdded value: +"string"Output schema / properties / missingZonesRemoved value: -{
- "description": "If any zones are listed here, the list of clusters returned may be missing those zones.",
- "items": {
- "type": "string"
- },
- "type": "array"
-}list_node_pools5 fields changedOutput schema / $defsRemoved value: -{
- "AcceleratorConfig": {
- "description": "AcceleratorConfig represents a Hardware Accelerator request.",
- "properties": {
- "acceleratorCount": {
- "description": "The number of the accelerator cards exposed to an instance.",
- "format": "int64",
- "type": "string"
- },
- "acceleratorType": {
- "description": "The accelerator type resource name. List of supported accelerators [here](https://cloud.google.com/compute/docs/gpus)",
- "type": "string"
- },
- "gpuDriverInstallationConfig": {
- "$ref": "#/$defs/GPUDriverInstallationConfig",
- "description": "The configuration for auto installation of GPU driver."
- },
- "gpuPartitionSize": {
- "description": "Size of partitions to create on the GPU. Valid values are described in the NVIDIA [mig user guide](https://docs.nvidia.com/datacenter/tesla/mig-user-guide/#partitioning).",
- "type": "string"
- },
- "gpuSharingConfig": {
- "$ref": "#/$defs/GPUSharingConfig",
- "description": "The configuration for GPU sharing options."
- }
- },
- "type": "object"
- },
- "AdditionalNodeNetworkConfig": {
- "description": "AdditionalNodeNetworkConfig is the configuration for additional node networks within the NodeNetworkConfig message",
- "properties": {
- "network": {
- "description": "Name of the VPC where the additional interface belongs",
- "type": "string"
- },
- "subnetwork": {
- "description": "Name of the subnetwork where the additional interface belongs",
- "type": "string"
- }
- },
- "type": "object"
- },
- "AdditionalPodNetworkConfig": {
- "description": "AdditionalPodNetworkConfig is the configuration for additional pod networks within the NodeNetworkConfig message",
- "properties": {
- "maxPodsPerNode": {
- "$ref": "#/$defs/MaxPodsConstraint",
- "description": "The maximum number of pods per node which use this pod network."
- },
- "networkAttachment": {
- "description": "The name of the network attachment for pods to communicate to; cannot be specified along with subnetwork or secondary_pod_range.",
- "type": "string"
- },
- "secondaryPodRange": {
- "description": "The name of the secondary range on the subnet which provides IP address for this pod range.",
- "type": "string"
- },
- "subnetwork": {
- "description": "Name of the subnetwork where the additional pod network belongs.",
- "type": "string"
- }
- },
- "type": "object"
- },
- "AdvancedMachineFeatures": {
- "description": "Specifies options for controlling advanced machine features.",
- "properties": {
- "enableNestedVirtualization": {
- "description": "Whether or not to enable nested virtualization (defaults to false).",
- "type": "boolean"
- },
- "performanceMonitoringUnit": {
- "description": "Type of Performance Monitoring Unit (PMU) requested on node pool instances. If unset, PMU will not be available to the node.",
- "enum": [
- "PERFORMANCE_MONITORING_UNIT_UNSPECIFIED",
- "ARCHITECTURAL",
- "STANDARD",
- "ENHANCED"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "PMU not enabled.",
- "Architecturally defined non-LLC events.",
- "Most documented core/L2 events.",
- "Most documented core/L2 and LLC events."
- ]
- },
- "threadsPerCore": {
- "description": "The number of threads per physical core. To disable simultaneous multithreading (SMT) set this to 1. If unset, the maximum number of threads supported per core by the underlying processor is assumed.",
- "format": "int64",
- "type": "string"
- }
- },
- "type": "object"
- },
- "AutoUpgradeOptions": {
- "description": "AutoUpgradeOptions defines the set of options for the user to control how the Auto Upgrades will proceed.",
- "properties": {
- "autoUpgradeStartTime": {
- "description": "Output only. This field is set when upgrades are about to commence with the approximate start time for the upgrades, in [RFC3339](https://www.ietf.org/rfc/rfc3339.txt) text format.",
- "readOnly": true,
- "type": "string"
- },
- "description": {
- "description": "Output only. This field is set when upgrades are about to commence with the description of the upgrade.",
- "readOnly": true,
- "type": "string"
- }
- },
- "type": "object"
- },
- "AutopilotConfig": {
- "description": "AutopilotConfig contains configuration of autopilot feature for this nodepool.",
- "properties": {
- "enabled": {
- "description": "Denotes that nodes belonging to this node pool are Autopilot nodes.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "AutoscaledRolloutPolicy": {
- "description": "Autoscaled rollout policy utilizes the cluster autoscaler during blue-green upgrade to scale both the blue and green pools.",
- "properties": {
- "waitForDrainDuration": {
- "description": "Optional. Time to wait after cordoning the blue pool before draining the nodes. Defaults to 3 days. The value can be set between 0 and 7 days, inclusive.",
- "format": "google-duration",
- "type": "string"
- }
- },
- "type": "object"
- },
- "BestEffortProvisioning": {
- "description": "Best effort provisioning.",
- "properties": {
- "enabled": {
- "description": "When this is enabled, cluster/node pool creations will ignore non-fatal errors like stockout to best provision as many nodes as possible right now and eventually bring up all target number of nodes",
- "type": "boolean"
- },
- "minProvisionNodes": {
- "description": "Minimum number of nodes to be provisioned to be considered as succeeded, and the rest of nodes will be provisioned gradually and eventually when stockout issue has been resolved.",
- "format": "int32",
- "type": "integer"
- }
- },
- "type": "object"
- },
- "BlueGreenInfo": {
- "description": "Information relevant to blue-green upgrade.",
- "properties": {
- "blueInstanceGroupUrls": {
- "description": "The resource URLs of the [managed instance groups] (/compute/docs/instance-groups/creating-groups-of-managed-instances) associated with blue pool.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "bluePoolDeletionStartTime": {
- "description": "Time to start deleting blue pool to complete blue-green upgrade, in [RFC3339](https://www.ietf.org/rfc/rfc3339.txt) text format.",
- "type": "string"
- },
- "greenInstanceGroupUrls": {
- "description": "The resource URLs of the [managed instance groups] (/compute/docs/instance-groups/creating-groups-of-managed-instances) associated with green pool.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "greenPoolVersion": {
- "description": "Version of green pool.",
- "type": "string"
- },
- "phase": {
- "description": "Current blue-green upgrade phase.",
- "enum": [
- "PHASE_UNSPECIFIED",
- "UPDATE_STARTED",
- "CREATING_GREEN_POOL",
- "CORDONING_BLUE_POOL",
- "DRAINING_BLUE_POOL",
- "NODE_POOL_SOAKING",
- "DELETING_BLUE_POOL",
- "ROLLBACK_STARTED"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Unspecified phase.",
- "blue-green upgrade has been initiated.",
- "Start creating green pool nodes.",
- "Start cordoning blue pool nodes.",
- "Start draining blue pool nodes.",
- "Start soaking time after draining entire blue pool.",
- "Start deleting blue nodes.",
- "Rollback has been initiated."
- ]
- }
- },
- "type": "object"
- },
- "BlueGreenSettings": {
- "description": "Settings for blue-green upgrade.",
- "properties": {
- "autoscaledRolloutPolicy": {
- "$ref": "#/$defs/AutoscaledRolloutPolicy",
- "description": "Autoscaled policy for cluster autoscaler enabled blue-green upgrade."
- },
- "nodePoolSoakDuration": {
- "description": "Time needed after draining entire blue pool. After this period, blue pool will be cleaned up.",
- "format": "google-duration",
- "type": "string"
- },
- "standardRolloutPolicy": {
- "$ref": "#/$defs/StandardRolloutPolicy",
- "description": "Standard policy for the blue-green upgrade."
- }
- },
- "type": "object"
- },
- "BootDisk": {
- "description": "BootDisk specifies the boot disk configuration for nodepools.",
- "properties": {
- "diskType": {
- "description": "Disk type of the boot disk. (i.e. Hyperdisk-Balanced, PD-Balanced, etc.)",
- "type": "string"
- },
- "provisionedIops": {
- "description": "For Hyperdisk-Balanced only, the provisioned IOPS config value.",
- "format": "int64",
- "type": "string"
- },
- "provisionedThroughput": {
- "description": "For Hyperdisk-Balanced only, the provisioned throughput config value.",
- "format": "int64",
- "type": "string"
- },
- "sizeGb": {
- "description": "Disk size in GB. Replaces NodeConfig.disk_size_gb",
- "format": "int64",
- "type": "string"
- }
- },
- "type": "object"
- },
- "BootDiskProfile": {
- "description": "Swap on the node's boot disk.",
- "properties": {
- "swapSizeGib": {
- "description": "Specifies the size of the swap space in gibibytes (GiB).",
- "format": "int64",
- "type": "string"
- },
- "swapSizePercent": {
- "description": "Specifies the size of the swap space as a percentage of the boot disk size.",
- "format": "int32",
- "type": "integer"
- }
- },
- "type": "object"
- },
- "CertificateAuthorityDomainConfig": {
- "description": "CertificateAuthorityDomainConfig configures one or more fully qualified domain names (FQDN) to a specific certificate.",
- "properties": {
- "fqdns": {
- "description": "List of fully qualified domain names (FQDN). Specifying port is supported. Wildcards are NOT supported. Examples: - my.customdomain.com - 10.0.1.2:5000",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "gcpSecretManagerCertificateConfig": {
- "$ref": "#/$defs/GCPSecretManagerCertificateConfig",
- "description": "Secret Manager certificate configuration."
- }
- },
- "type": "object"
- },
- "CertificateConfig": {
- "description": "CertificateConfig configures certificate for the registry.",
- "properties": {
- "gcpSecretManagerSecretUri": {
- "description": "The URI configures a secret from [Secret Manager](https://cloud.google.com/secret-manager) in the format \"projects/$PROJECT_ID/secrets/$SECRET_NAME/versions/$VERSION\" for global secret or \"projects/$PROJECT_ID/locations/$REGION/secrets/$SECRET_NAME/versions/$VERSION\" for regional secret. Version can be fixed (e.g. \"2\") or \"latest\"",
- "type": "string"
- }
- },
- "type": "object"
- },
- "CertificateConfigPair": {
- "description": "CertificateConfigPair configures pairs of certificates, which is used for client certificate and key pairs under a registry.",
- "properties": {
- "cert": {
- "$ref": "#/$defs/CertificateConfig",
- "description": "Cert configures the client certificate."
- },
- "key": {
- "$ref": "#/$defs/CertificateConfig",
- "description": "Key configures the client private key. Optional."
- }
- },
- "type": "object"
- },
- "ConfidentialNodes": {
- "description": "ConfidentialNodes is configuration for the confidential nodes feature, which makes nodes run on confidential VMs.",
- "properties": {
- "confidentialInstanceType": {
- "description": "Defines the type of technology used by the confidential node.",
- "enum": [
- "CONFIDENTIAL_INSTANCE_TYPE_UNSPECIFIED",
- "SEV",
- "SEV_SNP",
- "TDX"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "No type specified. Do not use this value.",
- "AMD Secure Encrypted Virtualization.",
- "AMD Secure Encrypted Virtualization - Secure Nested Paging.",
- "Intel Trust Domain eXtension."
- ]
- },
- "enabled": {
- "description": "Whether Confidential Nodes feature is enabled.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "ContainerdConfig": {
- "description": "ContainerdConfig contains configuration to customize containerd.",
- "properties": {
- "privateRegistryAccessConfig": {
- "$ref": "#/$defs/PrivateRegistryAccessConfig",
- "description": "PrivateRegistryAccessConfig is used to configure access configuration for private container registries."
- },
- "registryHosts": {
- "description": "RegistryHostConfig configures containerd registry host configuration. Each registry_hosts represents a hosts.toml file. At most 25 registry_hosts are allowed.",
- "items": {
- "$ref": "#/$defs/RegistryHostConfig"
- },
- "type": "array"
- },
- "writableCgroups": {
- "$ref": "#/$defs/WritableCgroups",
- "description": "Optional. WritableCgroups defines writable cgroups configuration for the node pool."
- }
- },
- "type": "object"
- },
- "CrashLoopBackOffConfig": {
- "description": "Contains config to modify node-level parameters for container restart behavior.",
- "properties": {
- "maxContainerRestartPeriod": {
- "description": "Optional. The maximum duration the backoff delay can accrue to for container restarts, minimum 1 second, maximum 300 seconds. If not set, defaults to the internal crashloopbackoff maximum. The string must be a sequence of decimal numbers, each with optional fraction and a unit suffix, such as \"300ms\". Valid time units are \"ns\", \"us\" (or \"µs\"), \"ms\", \"s\", \"m\", \"h\". See https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#configurable-container-restart-delay for more details.",
- "type": "string"
- }
- },
- "type": "object"
- },
- "DedicatedLocalSsdProfile": {
- "description": "Provisions a new, separate local NVMe SSD exclusively for swap.",
- "properties": {
- "diskCount": {
- "description": "The number of physical local NVMe SSD disks to attach.",
- "format": "int64",
- "type": "string"
- }
- },
- "type": "object"
- },
- "EncryptionConfig": {
- "description": "Defines encryption settings for the swap space.",
- "properties": {
- "disabled": {
- "description": "Optional. If true, swap space will not be encrypted. Defaults to false (encrypted).",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "EphemeralLocalSsdProfile": {
- "description": "Swap on the local SSD shared with pod ephemeral storage.",
- "properties": {
- "swapSizeGib": {
- "description": "Specifies the size of the swap space in gibibytes (GiB).",
- "format": "int64",
- "type": "string"
- },
- "swapSizePercent": {
- "description": "Specifies the size of the swap space as a percentage of the ephemeral local SSD capacity.",
- "format": "int32",
- "type": "integer"
- }
- },
- "type": "object"
- },
- "EphemeralStorageLocalSsdConfig": {
- "description": "EphemeralStorageLocalSsdConfig contains configuration for the node ephemeral storage using Local SSDs.",
- "properties": {
- "dataCacheCount": {
- "description": "Number of local SSDs to use for GKE Data Cache.",
- "format": "int32",
- "type": "integer"
- },
- "localSsdCount": {
- "description": "Number of local SSDs to use to back ephemeral storage. Uses NVMe interfaces. A zero (or unset) value has different meanings depending on machine type being used: 1. For pre-Gen3 machines, which support flexible numbers of local ssds, zero (or unset) means to disable using local SSDs as ephemeral storage. The limit for this value is dependent upon the maximum number of disk available on a machine per zone. See: https://cloud.google.com/compute/docs/disks/local-ssd for more information. 2. For Gen3 machines which dictate a specific number of local ssds, zero (or unset) means to use the default number of local ssds that goes with that machine type. For example, for a c3-standard-8-lssd machine, 2 local ssds would be provisioned. For c3-standard-8 (which doesn't support local ssds), 0 will be provisioned. See https://cloud.google.com/compute/docs/disks/local-ssd#choose_number_local_ssds for more info.",
- "format": "int32",
- "type": "integer"
- }
- },
- "type": "object"
- },
- "EvictionGracePeriod": {
- "description": "Eviction grace periods are grace periods for each eviction signal.",
- "properties": {
- "imagefsAvailable": {
- "description": "Optional. Grace period for eviction due to imagefs available signal. Sample format: \"10s\". Must be >= 0. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "imagefsInodesFree": {
- "description": "Optional. Grace period for eviction due to imagefs inodes free signal. Sample format: \"10s\". Must be >= 0. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "memoryAvailable": {
- "description": "Optional. Grace period for eviction due to memory available signal. Sample format: \"10s\". Must be >= 0. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "nodefsAvailable": {
- "description": "Optional. Grace period for eviction due to nodefs available signal. Sample format: \"10s\". Must be >= 0. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "nodefsInodesFree": {
- "description": "Optional. Grace period for eviction due to nodefs inodes free signal. Sample format: \"10s\". Must be >= 0. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "pidAvailable": {
- "description": "Optional. Grace period for eviction due to pid available signal. Sample format: \"10s\". Must be >= 0. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- }
- },
- "type": "object"
- },
- "EvictionMinimumReclaim": {
- "description": "Eviction minimum reclaims are the resource amounts of minimum reclaims for each eviction signal.",
- "properties": {
- "imagefsAvailable": {
- "description": "Optional. Minimum reclaim for eviction due to imagefs available signal. Only take percentage value for now. Sample format: \"10%\". Must be <=10%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "imagefsInodesFree": {
- "description": "Optional. Minimum reclaim for eviction due to imagefs inodes free signal. Only take percentage value for now. Sample format: \"10%\". Must be <=10%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "memoryAvailable": {
- "description": "Optional. Minimum reclaim for eviction due to memory available signal. Only take percentage value for now. Sample format: \"10%\". Must be <=10%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "nodefsAvailable": {
- "description": "Optional. Minimum reclaim for eviction due to nodefs available signal. Only take percentage value for now. Sample format: \"10%\". Must be <=10%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "nodefsInodesFree": {
- "description": "Optional. Minimum reclaim for eviction due to nodefs inodes free signal. Only take percentage value for now. Sample format: \"10%\". Must be <=10%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "pidAvailable": {
- "description": "Optional. Minimum reclaim for eviction due to pid available signal. Only take percentage value for now. Sample format: \"10%\". Must be <=10%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- }
- },
- "type": "object"
- },
- "EvictionSignals": {
- "description": "Eviction signals are the current state of a particular resource at a specific point in time. The kubelet uses eviction signals to make eviction decisions by comparing the signals to eviction thresholds, which are the minimum amount of the resource that should be available on the node.",
- "properties": {
- "imagefsAvailable": {
- "description": "Optional. Amount of storage available on filesystem that container runtime uses for storing images layers. If the container filesystem and image filesystem are not separate, then imagefs can store both image layers and writeable layers. Defines the amount of \"imagefs.available\" signal in kubelet. Default is unset, if not specified in the kubelet config. It takses percentage value for now. Sample format: \"30%\". Must be >= 15% and <= 50%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "imagefsInodesFree": {
- "description": "Optional. Amount of inodes available on filesystem that container runtime uses for storing images layers. Defines the amount of \"imagefs.inodesFree\" signal in kubelet. Default is unset, if not specified in the kubelet config. Linux only. It takses percentage value for now. Sample format: \"30%\". Must be >= 5% and <= 50%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "memoryAvailable": {
- "description": "Optional. Memory available (i.e. capacity - workingSet), in bytes. Defines the amount of \"memory.available\" signal in kubelet. Default is unset, if not specified in the kubelet config. Format: positive number + unit, e.g. 100Ki, 10Mi, 5Gi. Valid units are Ki, Mi, Gi. Must be >= 100Mi and <= 50% of the node's memory. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "nodefsAvailable": {
- "description": "Optional. Amount of storage available on filesystem that kubelet uses for volumes, daemon logs, etc. Defines the amount of \"nodefs.available\" signal in kubelet. Default is unset, if not specified in the kubelet config. It takses percentage value for now. Sample format: \"30%\". Must be >= 10% and <= 50%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "nodefsInodesFree": {
- "description": "Optional. Amount of inodes available on filesystem that kubelet uses for volumes, daemon logs, etc. Defines the amount of \"nodefs.inodesFree\" signal in kubelet. Default is unset, if not specified in the kubelet config. Linux only. It takses percentage value for now. Sample format: \"30%\". Must be >= 5% and <= 50%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- },
- "pidAvailable": {
- "description": "Optional. Amount of PID available for pod allocation. Defines the amount of \"pid.available\" signal in kubelet. Default is unset, if not specified in the kubelet config. It takses percentage value for now. Sample format: \"30%\". Must be >= 10% and <= 50%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals",
- "type": "string"
- }
- },
- "type": "object"
- },
- "FastSocket": {
- "description": "Configuration of Fast Socket feature.",
- "properties": {
- "enabled": {
- "description": "Whether Fast Socket features are enabled in the node pool.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "GCPSecretManagerCertificateConfig": {
- "description": "GCPSecretManagerCertificateConfig configures a secret from [Secret Manager](https://cloud.google.com/secret-manager).",
- "properties": {
- "secretUri": {
- "description": "Secret URI, in the form \"projects/$PROJECT_ID/secrets/$SECRET_NAME/versions/$VERSION\". Version can be fixed (e.g. \"2\") or \"latest\"",
- "type": "string"
- }
- },
- "type": "object"
- },
- "GPUDirectConfig": {
- "description": "GPUDirectConfig specifies the GPU direct strategy on the node pool.",
- "properties": {
- "gpuDirectStrategy": {
- "description": "The type of GPU direct strategy to enable on the node pool.",
- "enum": [
- "GPU_DIRECT_STRATEGY_UNSPECIFIED",
- "RDMA"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value. No GPU Direct strategy is enabled on the node.",
- "GPUDirect-RDMA on A3 Ultra, and A4 machine types"
- ]
- }
- },
- "type": "object"
- },
- "GPUDriverInstallationConfig": {
- "description": "GPUDriverInstallationConfig specifies the version of GPU driver to be auto installed.",
- "properties": {
- "gpuDriverVersion": {
- "description": "Mode for how the GPU driver is installed.",
- "enum": [
- "GPU_DRIVER_VERSION_UNSPECIFIED",
- "INSTALLATION_DISABLED",
- "DEFAULT",
- "LATEST"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value is to not install any GPU driver.",
- "Disable GPU driver auto installation and needs manual installation",
- "\"Default\" GPU driver in COS and Ubuntu.",
- "\"Latest\" GPU driver in COS."
- ]
- }
- },
- "type": "object"
- },
- "GPUSharingConfig": {
- "description": "GPUSharingConfig represents the GPU sharing configuration for Hardware Accelerators.",
- "properties": {
- "gpuSharingStrategy": {
- "description": "The type of GPU sharing strategy to enable on the GPU node.",
- "enum": [
- "GPU_SHARING_STRATEGY_UNSPECIFIED",
- "TIME_SHARING",
- "MPS"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value.",
- "GPUs are time-shared between containers.",
- "GPUs are shared between containers with NVIDIA MPS."
- ]
- },
- "maxSharedClientsPerGpu": {
- "description": "The max number of containers that can share a physical GPU.",
- "format": "int64",
- "type": "string"
- }
- },
- "type": "object"
- },
- "GcfsConfig": {
- "description": "GcfsConfig contains configurations of Google Container File System (image streaming).",
- "properties": {
- "enabled": {
- "description": "Whether to use GCFS.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "HostConfig": {
- "description": "HostConfig configures the registry host under a given Server.",
- "properties": {
- "ca": {
- "description": "CA configures the registry host certificate.",
- "items": {
- "$ref": "#/$defs/CertificateConfig"
- },
- "type": "array"
- },
- "capabilities": {
- "description": "Capabilities represent the capabilities of the registry host, specifying what operations a host is capable of performing. If not set, containerd enables all capabilities by default.",
- "items": {
- "enum": [
- "HOST_CAPABILITY_UNSPECIFIED",
- "HOST_CAPABILITY_PULL",
- "HOST_CAPABILITY_RESOLVE",
- "HOST_CAPABILITY_PUSH"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "UNKNOWN should never be set.",
- "Pull represents the capability to fetch manifests and blobs by digest.",
- "Resolve represents the capability to fetch manifests by name.",
- "Push represents the capability to push blobs and manifests."
- ]
- },
- "type": "array"
- },
- "client": {
- "description": "Client configures the registry host client certificate and key.",
- "items": {
- "$ref": "#/$defs/CertificateConfigPair"
- },
- "type": "array"
- },
- "dialTimeout": {
- "description": "Specifies the maximum duration allowed for a connection attempt to complete. A shorter timeout helps reduce delays when falling back to the original registry if the mirror is unreachable. Maximum allowed value is 180s. If not set, containerd sets default 30s. The value should be a decimal number of seconds with an `s` suffix.",
- "format": "google-duration",
- "type": "string"
- },
- "header": {
- "description": "Header configures the registry host headers.",
- "items": {
- "$ref": "#/$defs/RegistryHeader"
- },
- "type": "array"
- },
- "host": {
- "description": "Host configures the registry host/mirror. It supports fully qualified domain names (FQDN) and IP addresses: Specifying port is supported. Wildcards are NOT supported. Examples: - my.customdomain.com - 10.0.1.2:5000",
- "type": "string"
- },
- "overridePath": {
- "description": "OverridePath is used to indicate the host's API root endpoint is defined in the URL path rather than by the API specification. This may be used with non-compliant OCI registries which are missing the /v2 prefix. If not set, containerd sets default false.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "HugepagesConfig": {
- "description": "Hugepages amount in both 2m and 1g size",
- "properties": {
- "hugepageSize1g": {
- "description": "Optional. Amount of 1G hugepages",
- "format": "int32",
- "type": "integer"
- },
- "hugepageSize2m": {
- "description": "Optional. Amount of 2M hugepages",
- "format": "int32",
- "type": "integer"
- }
- },
- "type": "object"
- },
- "LinuxNodeConfig": {
- "description": "Parameters that can be configured on Linux nodes.",
- "properties": {
- "cgroupMode": {
- "description": "cgroup_mode specifies the cgroup mode to be used on the node.",
- "enum": [
- "CGROUP_MODE_UNSPECIFIED",
- "CGROUP_MODE_V1",
- "CGROUP_MODE_V2"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "CGROUP_MODE_UNSPECIFIED is when unspecified cgroup configuration is used. The default for the GKE node OS image will be used.",
- "CGROUP_MODE_V1 specifies to use cgroupv1 for the cgroup configuration on the node image.",
- "CGROUP_MODE_V2 specifies to use cgroupv2 for the cgroup configuration on the node image."
- ]
- },
- "hugepages": {
- "$ref": "#/$defs/HugepagesConfig",
- "description": "Optional. Amounts for 2M and 1G hugepages"
- },
- "nodeKernelModuleLoading": {
- "$ref": "#/$defs/NodeKernelModuleLoading",
- "description": "Optional. Configuration for kernel module loading on nodes. When enabled, the node pool will be provisioned with a Container-Optimized OS image that enforces kernel module signature verification."
- },
- "swapConfig": {
- "$ref": "#/$defs/SwapConfig",
- "description": "Optional. Enables and configures swap space on nodes. If omitted, swap is disabled."
- },
- "sysctls": {
- "additionalProperties": {
- "type": "string"
- },
- "description": "The Linux kernel parameters to be applied to the nodes and all pods running on the nodes. The following parameters are supported. net.core.busy_poll net.core.busy_read net.core.netdev_max_backlog net.core.rmem_max net.core.rmem_default net.core.wmem_default net.core.wmem_max net.core.optmem_max net.core.somaxconn net.ipv4.tcp_rmem net.ipv4.tcp_wmem net.ipv4.tcp_tw_reuse net.ipv4.tcp_mtu_probing net.ipv4.tcp_max_orphans net.ipv4.tcp_max_tw_buckets net.ipv4.tcp_syn_retries net.ipv4.tcp_ecn net.ipv4.tcp_congestion_control net.netfilter.nf_conntrack_max net.netfilter.nf_conntrack_buckets net.netfilter.nf_conntrack_tcp_timeout_close_wait net.netfilter.nf_conntrack_tcp_timeout_time_wait net.netfilter.nf_conntrack_tcp_timeout_established net.netfilter.nf_conntrack_acct kernel.shmmni kernel.shmmax kernel.shmall kernel.perf_event_paranoid kernel.sched_rt_runtime_us kernel.softlockup_panic kernel.yama.ptrace_scope kernel.kptr_restrict kernel.dmesg_restrict kernel.sysrq fs.aio-max-nr fs.file-max fs.inotify.max_user_instances fs.inotify.max_user_watches fs.nr_open vm.dirty_background_ratio vm.dirty_background_bytes vm.dirty_expire_centisecs vm.dirty_ratio vm.dirty_bytes vm.dirty_writeback_centisecs vm.max_map_count vm.overcommit_memory vm.overcommit_ratio vm.vfs_cache_pressure vm.swappiness vm.watermark_scale_factor vm.min_free_kbytes",
- "type": "object"
- },
- "transparentHugepageDefrag": {
- "description": "Optional. Defines the transparent hugepage defrag configuration on the node. VM hugepage allocation can be managed by either limiting defragmentation for delayed allocation or skipping it entirely for immediate allocation only. See https://docs.kernel.org/admin-guide/mm/transhuge.html for more details.",
- "enum": [
- "TRANSPARENT_HUGEPAGE_DEFRAG_UNSPECIFIED",
- "TRANSPARENT_HUGEPAGE_DEFRAG_ALWAYS",
- "TRANSPARENT_HUGEPAGE_DEFRAG_DEFER",
- "TRANSPARENT_HUGEPAGE_DEFRAG_DEFER_WITH_MADVISE",
- "TRANSPARENT_HUGEPAGE_DEFRAG_MADVISE",
- "TRANSPARENT_HUGEPAGE_DEFRAG_NEVER"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value. GKE will not modify the kernel configuration.",
- "It means that an application requesting THP will stall on allocation failure and directly reclaim pages and compact memory in an effort to allocate a THP immediately.",
- "It means that an application will wake kswapd in the background to reclaim pages and wake kcompactd to compact memory so that THP is available in the near future. It's the responsibility of khugepaged to then install the THP pages later.",
- "It means that an application will enter direct reclaim and compaction like always, but only for regions that have used madvise(MADV_HUGEPAGE); all other regions will wake kswapd in the background to reclaim pages and wake kcompactd to compact memory so that THP is available in the near future.",
- "It means that an application will enter direct reclaim like always but only for regions that are have used madvise(MADV_HUGEPAGE). This is the default kernel configuration.",
- "It means that an application will never enter direct reclaim or compaction."
- ]
- },
- "transparentHugepageEnabled": {
- "description": "Optional. Transparent hugepage support for anonymous memory can be entirely disabled (mostly for debugging purposes) or only enabled inside MADV_HUGEPAGE regions (to avoid the risk of consuming more memory resources) or enabled system wide. See https://docs.kernel.org/admin-guide/mm/transhuge.html for more details.",
- "enum": [
- "TRANSPARENT_HUGEPAGE_ENABLED_UNSPECIFIED",
- "TRANSPARENT_HUGEPAGE_ENABLED_ALWAYS",
- "TRANSPARENT_HUGEPAGE_ENABLED_MADVISE",
- "TRANSPARENT_HUGEPAGE_ENABLED_NEVER"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value. GKE will not modify the kernel configuration.",
- "Transparent hugepage support for anonymous memory is enabled system wide.",
- "Transparent hugepage support for anonymous memory is enabled inside MADV_HUGEPAGE regions. This is the default kernel configuration.",
- "Transparent hugepage support for anonymous memory is disabled."
- ]
- }
- },
- "type": "object"
- },
- "LocalNvmeSsdBlockConfig": {
- "description": "LocalNvmeSsdBlockConfig contains configuration for using raw-block local NVMe SSDs",
- "properties": {
- "localSsdCount": {
- "description": "Number of local NVMe SSDs to use. The limit for this value is dependent upon the maximum number of disk available on a machine per zone. See: https://cloud.google.com/compute/docs/disks/local-ssd for more information. A zero (or unset) value has different meanings depending on machine type being used: 1. For pre-Gen3 machines, which support flexible numbers of local ssds, zero (or unset) means to disable using local SSDs as ephemeral storage. 2. For Gen3 machines which dictate a specific number of local ssds, zero (or unset) means to use the default number of local ssds that goes with that machine type. For example, for a c3-standard-8-lssd machine, 2 local ssds would be provisioned. For c3-standard-8 (which doesn't support local ssds), 0 will be provisioned. See https://cloud.google.com/compute/docs/disks/local-ssd#choose_number_local_ssds for more info.",
- "format": "int32",
- "type": "integer"
- }
- },
- "type": "object"
- },
- "LoggingVariantConfig": {
- "description": "LoggingVariantConfig specifies the behaviour of the logging component.",
- "properties": {
- "variant": {
- "description": "Logging variant deployed on nodes.",
- "enum": [
- "VARIANT_UNSPECIFIED",
- "DEFAULT",
- "MAX_THROUGHPUT"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value. This shouldn't be used.",
- "default logging variant.",
- "maximum logging throughput variant."
- ]
- }
- },
- "type": "object"
- },
- "MaxPodsConstraint": {
- "description": "Constraints applied to pods.",
- "properties": {
- "maxPodsPerNode": {
- "description": "Constraint enforced on the max num of pods per node.",
- "format": "int64",
- "type": "string"
- }
- },
- "type": "object"
- },
- "MemoryManager": {
- "description": "The option enables the Kubernetes NUMA-aware Memory Manager feature. Detailed description about the feature can be found [here](https://kubernetes.io/docs/tasks/administer-cluster/memory-manager/).",
- "properties": {
- "policy": {
- "description": "Controls the memory management policy on the Node. See https://kubernetes.io/docs/tasks/administer-cluster/memory-manager/#policies The following values are allowed. * \"none\" * \"static\" The default value is 'none' if unspecified.",
- "type": "string"
- }
- },
- "type": "object"
- },
- "NetworkPerformanceConfig": {
- "description": "Configuration of all network bandwidth tiers",
- "properties": {
- "totalEgressBandwidthTier": {
- "description": "Specifies the total network bandwidth tier for the NodePool.",
- "enum": [
- "TIER_UNSPECIFIED",
- "TIER_1"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value",
- "Higher bandwidth, actual values based on VM size."
- ]
- }
- },
- "type": "object"
- },
- "NetworkTierConfig": {
- "description": "NetworkTierConfig contains network tier information.",
- "properties": {
- "networkTier": {
- "description": "Network tier configuration.",
- "enum": [
- "NETWORK_TIER_UNSPECIFIED",
- "NETWORK_TIER_DEFAULT",
- "NETWORK_TIER_PREMIUM",
- "NETWORK_TIER_STANDARD"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "By default, use project-level configuration. When unspecified, the behavior defaults to NETWORK_TIER_DEFAULT. For cluster updates, this implies no action (no-op).",
- "Default network tier. Use project-level configuration. User can specify this value, meaning they want to keep the same behaviour as before cluster level network tier configuration is introduced. This field ensures backward compatibility for the network tier of cluster resources, such as node pools and load balancers, for their external IP addresses.",
- "Premium network tier.",
- "Standard network tier."
- ]
- }
- },
- "type": "object"
- },
- "NodeAffinity": {
- "description": "Specifies the NodeAffinity key, values, and affinity operator according to [shared sole tenant node group affinities](https://cloud.google.com/compute/docs/nodes/sole-tenant-nodes#node_affinity_and_anti-affinity).",
- "properties": {
- "key": {
- "description": "Key for NodeAffinity.",
- "type": "string"
- },
- "operator": {
- "description": "Operator for NodeAffinity.",
- "enum": [
- "OPERATOR_UNSPECIFIED",
- "IN",
- "NOT_IN"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Invalid or unspecified affinity operator.",
- "Affinity operator.",
- "Anti-affinity operator."
- ]
- },
- "values": {
- "description": "Values for NodeAffinity.",
- "items": {
- "type": "string"
- },
- "type": "array"
- }
- },
- "type": "object"
- },
- "NodeConfig": {
- "description": "Parameters that describe the nodes in a cluster. GKE Autopilot clusters do not recognize parameters in `NodeConfig`. Use AutoprovisioningNodePoolDefaults instead.",
- "properties": {
- "accelerators": {
- "description": "A list of hardware accelerators to be attached to each node. See https://cloud.google.com/compute/docs/gpus for more information about support for GPUs.",
- "items": {
- "$ref": "#/$defs/AcceleratorConfig"
- },
- "type": "array"
- },
- "advancedMachineFeatures": {
- "$ref": "#/$defs/AdvancedMachineFeatures",
- "description": "Advanced features for the Compute Engine VM."
- },
- "bootDisk": {
- "$ref": "#/$defs/BootDisk",
- "description": "The boot disk configuration for the node pool."
- },
- "bootDiskKmsKey": {
- "description": " The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption",
- "type": "string"
- },
- "confidentialNodes": {
- "$ref": "#/$defs/ConfidentialNodes",
- "description": "Confidential nodes config. All the nodes in the node pool will be Confidential VM once enabled."
- },
- "consolidationDelay": {
- "description": "Consolidation delay defines duration after which the Cluster Autoscaler can scale down underutilized nodes. If not set, nodes are scaled down by default behavior, i.e. according to the chosen autoscaling profile.",
- "format": "google-duration",
- "type": "string"
- },
- "containerdConfig": {
- "$ref": "#/$defs/ContainerdConfig",
- "description": "Parameters for containerd customization."
- },
- "diskSizeGb": {
- "description": "Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB. If unspecified, the default disk size is 100GB.",
- "format": "int32",
- "type": "integer"
- },
- "diskType": {
- "description": "Type of the disk attached to each node (e.g. 'pd-standard', 'pd-ssd' or 'pd-balanced') If unspecified, the default disk type is 'pd-standard'",
- "type": "string"
- },
- "effectiveCgroupMode": {
- "description": "Output only. effective_cgroup_mode is the cgroup mode actually used by the node pool. It is determined by the cgroup mode specified in the LinuxNodeConfig or the default cgroup mode based on the cluster creation version.",
- "enum": [
- "EFFECTIVE_CGROUP_MODE_UNSPECIFIED",
- "EFFECTIVE_CGROUP_MODE_V1",
- "EFFECTIVE_CGROUP_MODE_V2"
- ],
- "readOnly": true,
- "type": "string",
- "x-google-enum-descriptions": [
- "EFFECTIVE_CGROUP_MODE_UNSPECIFIED means the cgroup configuration for the node pool is unspecified, i.e. the node pool is a Windows node pool.",
- "CGROUP_MODE_V1 means the node pool is configured to use cgroupv1 for the cgroup configuration.",
- "CGROUP_MODE_V2 means the node pool is configured to use cgroupv2 for the cgroup configuration."
- ]
- },
- "enableConfidentialStorage": {
- "description": "Optional. Reserved for future use.",
- "type": "boolean"
- },
- "ephemeralStorageLocalSsdConfig": {
- "$ref": "#/$defs/EphemeralStorageLocalSsdConfig",
- "description": "Parameters for the node ephemeral storage using Local SSDs. If unspecified, ephemeral storage is backed by the boot disk."
- },
- "fastSocket": {
- "$ref": "#/$defs/FastSocket",
- "description": "Enable or disable NCCL fast socket for the node pool."
- },
- "flexStart": {
- "description": "Flex Start flag for enabling Flex Start VM.",
- "type": "boolean"
- },
- "gcfsConfig": {
- "$ref": "#/$defs/GcfsConfig",
- "description": "Google Container File System (image streaming) configs."
- },
- "gpuDirectConfig": {
- "$ref": "#/$defs/GPUDirectConfig",
- "description": "The configuration for GPU Direct"
- },
- "gvnic": {
- "$ref": "#/$defs/VirtualNIC",
- "description": "Enable or disable gvnic in the node pool."
- },
- "imageType": {
- "description": "The image type to use for this node. Note that for a given image type, the latest version of it will be used. Please see https://cloud.google.com/kubernetes-engine/docs/concepts/node-images for available image types.",
- "type": "string"
- },
- "kubeletConfig": {
- "$ref": "#/$defs/NodeKubeletConfig",
- "description": "Node kubelet configs."
- },
- "labels": {
- "additionalProperties": {
- "type": "string"
- },
- "description": "The map of Kubernetes labels (key/value pairs) to be applied to each node. These will added in addition to any default label(s) that Kubernetes may apply to the node. In case of conflict in label keys, the applied set may differ depending on the Kubernetes version -- it's best to assume the behavior is undefined and conflicts should be avoided. For more information, including usage and the valid values, see: https://kubernetes.io/docs/concepts/overview/working-with-objects/labels/",
- "type": "object"
- },
- "linuxNodeConfig": {
- "$ref": "#/$defs/LinuxNodeConfig",
- "description": "Parameters that can be configured on Linux nodes."
- },
- "localNvmeSsdBlockConfig": {
- "$ref": "#/$defs/LocalNvmeSsdBlockConfig",
- "description": "Parameters for using raw-block Local NVMe SSDs."
- },
- "localSsdCount": {
- "description": "The number of local SSD disks to be attached to the node. The limit for this value is dependent upon the maximum number of disks available on a machine per zone. See: https://cloud.google.com/compute/docs/disks/local-ssd for more information.",
- "format": "int32",
- "type": "integer"
- },
- "localSsdEncryptionMode": {
- "description": "Specifies which method should be used for encrypting the Local SSDs attached to the node.",
- "enum": [
- "LOCAL_SSD_ENCRYPTION_MODE_UNSPECIFIED",
- "STANDARD_ENCRYPTION",
- "EPHEMERAL_KEY_ENCRYPTION"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "The given node will be encrypted using keys managed by Google infrastructure and the keys will be deleted when the node is deleted.",
- "The given node will be encrypted using keys managed by Google infrastructure and the keys will be deleted when the node is deleted.",
- "The given node will opt-in for using ephemeral key for encryption of Local SSDs. The Local SSDs will not be able to recover data in case of node crash."
- ]
- },
- "loggingConfig": {
- "$ref": "#/$defs/NodePoolLoggingConfig",
- "description": "Logging configuration."
- },
- "machineType": {
- "description": "The name of a Google Compute Engine [machine type](https://cloud.google.com/compute/docs/machine-types) If unspecified, the default machine type is `e2-medium`.",
- "type": "string"
- },
- "maxRunDuration": {
- "description": "The maximum duration for the nodes to exist. If unspecified, the nodes can exist indefinitely.",
- "format": "google-duration",
- "type": "string"
- },
- "metadata": {
- "additionalProperties": {
- "type": "string"
- },
- "description": "The metadata key/value pairs assigned to instances in the cluster. Keys must conform to the regexp `[a-zA-Z0-9-_]+` and be less than 128 bytes in length. These are reflected as part of a URL in the metadata server. Additionally, to avoid ambiguity, keys must not conflict with any other metadata keys for the project or be one of the reserved keys: - \"cluster-location\" - \"cluster-name\" - \"cluster-uid\" - \"configure-sh\" - \"containerd-configure-sh\" - \"enable-os-login\" - \"gci-ensure-gke-docker\" - \"gci-metrics-enabled\" - \"gci-update-strategy\" - \"instance-template\" - \"kube-env\" - \"startup-script\" - \"user-data\" - \"disable-address-manager\" - \"windows-startup-script-ps1\" - \"common-psm1\" - \"k8s-node-setup-psm1\" - \"install-ssh-psm1\" - \"user-profile-psm1\" Values are free-form strings, and only have meaning as interpreted by the image running in the instance. The only restriction placed on them is that each value's size must be less than or equal to 32 KB. The total size of all keys and values must be less than 512 KB.",
- "type": "object"
- },
- "minCpuPlatform": {
- "description": "Minimum CPU platform to be used by this instance. The instance may be scheduled on the specified or newer CPU platform. Applicable values are the friendly names of CPU platforms, such as `minCpuPlatform: \"Intel Haswell\"` or `minCpuPlatform: \"Intel Sandy Bridge\"`. For more information, read [how to specify min CPU platform](https://cloud.google.com/compute/docs/instances/specify-min-cpu-platform)",
- "type": "string"
- },
- "nodeGroup": {
- "description": "Setting this field will assign instances of this pool to run on the specified node group. This is useful for running workloads on [sole tenant nodes](https://cloud.google.com/compute/docs/nodes/sole-tenant-nodes).",
- "type": "string"
- },
- "oauthScopes": {
- "description": "The set of Google API scopes to be made available on all of the node VMs under the \"default\" service account. The following scopes are recommended, but not required, and by default are not included: * `https://www.googleapis.com/auth/compute` is required for mounting persistent storage on your nodes. * `https://www.googleapis.com/auth/devstorage.read_only` is required for communicating with **gcr.io** (the [Artifact Registry](https://cloud.google.com/artifact-registry/)). If unspecified, no scopes are added, unless Cloud Logging or Cloud Monitoring are enabled, in which case their required scopes will be added.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "preemptible": {
- "description": "Whether the nodes are created as preemptible VM instances. See: https://cloud.google.com/compute/docs/instances/preemptible for more information about preemptible VM instances.",
- "type": "boolean"
- },
- "reservationAffinity": {
- "$ref": "#/$defs/ReservationAffinity",
- "description": "The optional reservation affinity. Setting this field will apply the specified [Zonal Compute Reservation](https://cloud.google.com/compute/docs/instances/reserving-zonal-resources) to this node pool."
- },
- "resourceLabels": {
- "additionalProperties": {
- "type": "string"
- },
- "description": "The resource labels for the node pool to use to annotate any related Google Compute Engine resources.",
- "type": "object"
- },
- "resourceManagerTags": {
- "$ref": "#/$defs/ResourceManagerTags",
- "description": "A map of resource manager tag keys and values to be attached to the nodes."
- },
- "sandboxConfig": {
- "$ref": "#/$defs/SandboxConfig",
- "description": "Sandbox configuration for this node."
- },
- "secondaryBootDiskUpdateStrategy": {
- "$ref": "#/$defs/SecondaryBootDiskUpdateStrategy",
- "description": "Secondary boot disk update strategy."
- },
- "secondaryBootDisks": {
- "description": "List of secondary boot disks attached to the nodes.",
- "items": {
- "$ref": "#/$defs/SecondaryBootDisk"
- },
- "type": "array"
- },
- "serviceAccount": {
- "description": "The Google Cloud Platform Service Account to be used by the node VMs. Specify the email address of the Service Account; otherwise, if no Service Account is specified, the \"default\" service account is used.",
- "type": "string"
- },
- "shieldedInstanceConfig": {
- "$ref": "#/$defs/ShieldedInstanceConfig",
- "description": "Shielded Instance options."
- },
- "soleTenantConfig": {
- "$ref": "#/$defs/SoleTenantConfig",
- "description": "Parameters for node pools to be backed by shared sole tenant node groups."
- },
- "spot": {
- "description": "Spot flag for enabling Spot VM, which is a rebrand of the existing preemptible flag.",
- "type": "boolean"
- },
- "storagePools": {
- "description": "List of Storage Pools where boot disks are provisioned.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "tags": {
- "description": "The list of instance tags applied to all nodes. Tags are used to identify valid sources or targets for network firewalls and are specified by the client during cluster or node pool creation. Each tag within the list must comply with RFC1035.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "taintConfig": {
- "$ref": "#/$defs/TaintConfig",
- "description": "Optional. The taint configuration for the node pool."
- },
- "taints": {
- "description": "List of kubernetes taints to be applied to each node. For more information, including usage and the valid values, see: https://kubernetes.io/docs/concepts/configuration/taint-and-toleration/",
- "items": {
- "$ref": "#/$defs/NodeTaint"
- },
- "type": "array"
- },
- "windowsNodeConfig": {
- "$ref": "#/$defs/WindowsNodeConfig",
- "description": "Parameters that can be configured on Windows nodes."
- },
- "workloadMetadataConfig": {
- "$ref": "#/$defs/WorkloadMetadataConfig",
- "description": "The workload metadata configuration for this node."
- }
- },
- "type": "object"
- },
- "NodeDrainConfig": {
- "description": "NodeDrainConfig contains the node drain related configurations for this nodepool.",
- "properties": {
- "respectPdbDuringNodePoolDeletion": {
- "description": "Whether to respect PDB during node pool deletion.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "NodeKernelModuleLoading": {
- "description": "Configuration for kernel module loading on nodes.",
- "properties": {
- "policy": {
- "description": "Set the node module loading policy for nodes in the node pool.",
- "enum": [
- "POLICY_UNSPECIFIED",
- "ENFORCE_SIGNED_MODULES",
- "DO_NOT_ENFORCE_SIGNED_MODULES"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default behavior. GKE selects the image based on node type. For CPU and TPU nodes, the image will not allow loading external kernel modules. For GPU nodes, the image will allow loading any module, whether it is signed or not.",
- "Enforced signature verification: Node pools will use a Container-Optimized OS image configured to allow loading of *Google-signed* external kernel modules. Loadpin is enabled but configured to exclude modules, and kernel module signature checking is enforced.",
- "Mirrors existing DEFAULT behavior: For CPU and TPU nodes, the image will not allow loading external kernel modules. For GPU nodes, the image will allow loading any module, whether it is signed or not."
- ]
- }
- },
- "type": "object"
- },
- "NodeKubeletConfig": {
- "description": "Node kubelet configs.",
- "properties": {
- "allowedUnsafeSysctls": {
- "description": "Optional. Defines a comma-separated allowlist of unsafe sysctls or sysctl patterns (ending in `*`). The unsafe namespaced sysctl groups are `kernel.shm*`, `kernel.msg*`, `kernel.sem`, `fs.mqueue.*`, and `net.*`. Leaving this allowlist empty means they cannot be set on Pods. To allow certain sysctls or sysctl patterns to be set on Pods, list them separated by commas. For example: `kernel.msg*,net.ipv4.route.min_pmtu`. See https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ for more details.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "containerLogMaxFiles": {
- "description": "Optional. Defines the maximum number of container log files that can be present for a container. See https://kubernetes.io/docs/concepts/cluster-administration/logging/#log-rotation The value must be an integer between 2 and 10, inclusive. The default value is 5 if unspecified.",
- "format": "int32",
- "type": "integer"
- },
- "containerLogMaxSize": {
- "description": "Optional. Defines the maximum size of the container log file before it is rotated. See https://kubernetes.io/docs/concepts/cluster-administration/logging/#log-rotation Valid format is positive number + unit, e.g. 100Ki, 10Mi. Valid units are Ki, Mi, Gi. The value must be between 10Mi and 500Mi, inclusive. Note that the total container log size (container_log_max_size * container_log_max_files) cannot exceed 1% of the total storage of the node, to avoid disk pressure caused by log files. The default value is 10Mi if unspecified.",
- "type": "string"
- },
- "cpuCfsQuota": {
- "description": "Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified.",
- "type": "boolean"
- },
- "cpuCfsQuotaPeriod": {
- "description": "Set the CPU CFS quota period value 'cpu.cfs_period_us'. The string must be a sequence of decimal numbers, each with optional fraction and a unit suffix, such as \"300ms\". Valid time units are \"ns\", \"us\" (or \"µs\"), \"ms\", \"s\", \"m\", \"h\". The value must be a positive duration between 1ms and 1 second, inclusive.",
- "type": "string"
- },
- "cpuManagerPolicy": {
- "description": "Control the CPU management policy on the node. See https://kubernetes.io/docs/tasks/administer-cluster/cpu-management-policies/ The following values are allowed. * \"none\": the default, which represents the existing scheduling behavior. * \"static\": allows pods with certain resource characteristics to be granted increased CPU affinity and exclusivity on the node. The default value is 'none' if unspecified.",
- "type": "string"
- },
- "crashLoopBackOff": {
- "$ref": "#/$defs/CrashLoopBackOffConfig",
- "description": "Optional. Contains configuration options to modify node-level parameters for container restart behavior."
- },
- "evictionMaxPodGracePeriodSeconds": {
- "description": "Optional. eviction_max_pod_grace_period_seconds is the maximum allowed grace period (in seconds) to use when terminating pods in response to a soft eviction threshold being met. This value effectively caps the Pod's terminationGracePeriodSeconds value during soft evictions. Default: 0. Range: [0, 300].",
- "format": "int32",
- "type": "integer"
- },
- "evictionMinimumReclaim": {
- "$ref": "#/$defs/EvictionMinimumReclaim",
- "description": "Optional. eviction_minimum_reclaim is a map of signal names to quantities that defines minimum reclaims, which describe the minimum amount of a given resource the kubelet will reclaim when performing a pod eviction while that resource is under pressure."
- },
- "evictionSoft": {
- "$ref": "#/$defs/EvictionSignals",
- "description": "Optional. eviction_soft is a map of signal names to quantities that defines soft eviction thresholds. Each signal is compared to its corresponding threshold to determine if a pod eviction should occur."
- },
- "evictionSoftGracePeriod": {
- "$ref": "#/$defs/EvictionGracePeriod",
- "description": "Optional. eviction_soft_grace_period is a map of signal names to quantities that defines grace periods for each soft eviction signal. The grace period is the amount of time that a pod must be under pressure before an eviction occurs."
- },
- "imageGcHighThresholdPercent": {
- "description": "Optional. Defines the percent of disk usage after which image garbage collection is always run. The percent is calculated as this field value out of 100. The value must be between 10 and 85, inclusive and greater than image_gc_low_threshold_percent. The default value is 85 if unspecified.",
- "format": "int32",
- "type": "integer"
- },
- "imageGcLowThresholdPercent": {
- "description": "Optional. Defines the percent of disk usage before which image garbage collection is never run. Lowest disk usage to garbage collect to. The percent is calculated as this field value out of 100. The value must be between 10 and 85, inclusive and smaller than image_gc_high_threshold_percent. The default value is 80 if unspecified.",
- "format": "int32",
- "type": "integer"
- },
- "imageMaximumGcAge": {
- "description": "Optional. Defines the maximum age an image can be unused before it is garbage collected. The string must be a sequence of decimal numbers, each with optional fraction and a unit suffix, such as \"300s\", \"1.5h\", and \"2h45m\". Valid time units are \"ns\", \"us\" (or \"µs\"), \"ms\", \"s\", \"m\", \"h\". The value must be a positive duration greater than image_minimum_gc_age or \"0s\". The default value is \"0s\" if unspecified, which disables this field, meaning images won't be garbage collected based on being unused for too long.",
- "type": "string"
- },
- "imageMinimumGcAge": {
- "description": "Optional. Defines the minimum age for an unused image before it is garbage collected. The string must be a sequence of decimal numbers, each with optional fraction and a unit suffix, such as \"300s\", \"1.5h\", and \"2h45m\". Valid time units are \"ns\", \"us\" (or \"µs\"), \"ms\", \"s\", \"m\", \"h\". The value must be a positive duration less than or equal to 2 minutes. The default value is \"2m0s\" if unspecified.",
- "type": "string"
- },
- "insecureKubeletReadonlyPortEnabled": {
- "description": "Enable or disable Kubelet read only port.",
- "type": "boolean"
- },
- "maxParallelImagePulls": {
- "description": "Optional. Defines the maximum number of image pulls in parallel. The range is 2 to 5, inclusive. The default value is 2 or 3 depending on the disk type. See https://kubernetes.io/docs/concepts/containers/images/#maximum-parallel-image-pulls for more details.",
- "format": "int32",
- "type": "integer"
- },
- "memoryManager": {
- "$ref": "#/$defs/MemoryManager",
- "description": "Optional. Controls NUMA-aware Memory Manager configuration on the node. For more information, see: https://kubernetes.io/docs/tasks/administer-cluster/memory-manager/"
- },
- "podPidsLimit": {
- "description": "Set the Pod PID limits. See https://kubernetes.io/docs/concepts/policy/pid-limiting/#pod-pid-limits Controls the maximum number of processes allowed to run in a pod. The value must be greater than or equal to 1024 and less than 4194304.",
- "format": "int64",
- "type": "string"
- },
- "shutdownGracePeriodCriticalPodsSeconds": {
- "description": "Optional. shutdown_grace_period_critical_pods_seconds is the maximum allowed grace period (in seconds) used to terminate critical pods during a node shutdown. This value should be <= shutdown_grace_period_seconds, and is only valid if shutdown_grace_period_seconds is set. https://kubernetes.io/docs/concepts/cluster-administration/node-shutdown/ Range: [0, 120].",
- "format": "int32",
- "type": "integer"
- },
- "shutdownGracePeriodSeconds": {
- "description": "Optional. shutdown_grace_period_seconds is the maximum allowed grace period (in seconds) the total duration that the node should delay the shutdown during a graceful shutdown. This is the total grace period for pod termination for both regular and critical pods. https://kubernetes.io/docs/concepts/cluster-administration/node-shutdown/ If set to 0, node will not enable the graceful node shutdown functionality. This field is only valid for Spot VMs. Allowed values: 0, 30, 120.",
- "format": "int32",
- "type": "integer"
- },
- "singleProcessOomKill": {
- "description": "Optional. Defines whether to enable single process OOM killer. If true, will prevent the memory.oom.group flag from being set for container cgroups in cgroups v2. This causes processes in the container to be OOM killed individually instead of as a group.",
- "type": "boolean"
- },
- "topologyManager": {
- "$ref": "#/$defs/TopologyManager",
- "description": "Optional. Controls Topology Manager configuration on the node. For more information, see: https://kubernetes.io/docs/tasks/administer-cluster/topology-manager/"
- }
- },
- "type": "object"
- },
- "NodeManagement": {
- "description": "NodeManagement defines the set of node management services turned on for the node pool.",
- "properties": {
- "autoRepair": {
- "description": "A flag that specifies whether the node auto-repair is enabled for the node pool. If enabled, the nodes in this node pool will be monitored and, if they fail health checks too many times, an automatic repair action will be triggered.",
- "type": "boolean"
- },
- "autoUpgrade": {
- "description": "A flag that specifies whether node auto-upgrade is enabled for the node pool. If enabled, node auto-upgrade helps keep the nodes in your node pool up to date with the latest release version of Kubernetes.",
- "type": "boolean"
- },
- "upgradeOptions": {
- "$ref": "#/$defs/AutoUpgradeOptions",
- "description": "Specifies the Auto Upgrade knobs for the node pool."
- }
- },
- "type": "object"
- },
- "NodeNetworkConfig": {
- "description": "Parameters for node pool-level network config.",
- "properties": {
- "additionalNodeNetworkConfigs": {
- "description": "We specify the additional node networks for this node pool using this list. Each node network corresponds to an additional interface",
- "items": {
- "$ref": "#/$defs/AdditionalNodeNetworkConfig"
- },
- "type": "array"
- },
- "additionalPodNetworkConfigs": {
- "description": "We specify the additional pod networks for this node pool using this list. Each pod network corresponds to an additional alias IP range for the node",
- "items": {
- "$ref": "#/$defs/AdditionalPodNetworkConfig"
- },
- "type": "array"
- },
- "createPodRange": {
- "description": "Input only. Whether to create a new range for pod IPs in this node pool. Defaults are provided for `pod_range` and `pod_ipv4_cidr_block` if they are not specified. If neither `create_pod_range` or `pod_range` are specified, the cluster-level default (`ip_allocation_policy.cluster_ipv4_cidr_block`) is used. Only applicable if `ip_allocation_policy.use_ip_aliases` is true. This field cannot be changed after the node pool has been created.",
- "type": "boolean",
- "writeOnly": true
- },
- "enablePrivateNodes": {
- "description": "Whether nodes have internal IP addresses only. If enable_private_nodes is not specified, then the value is derived from Cluster.NetworkConfig.default_enable_private_nodes",
- "type": "boolean"
- },
- "networkPerformanceConfig": {
- "$ref": "#/$defs/NetworkPerformanceConfig",
- "description": "Network bandwidth tier configuration."
- },
- "networkTierConfig": {
- "$ref": "#/$defs/NetworkTierConfig",
- "description": "Output only. The network tier configuration for the node pool inherits from the cluster-level configuration and remains immutable throughout the node pool's lifecycle, including during upgrades.",
- "readOnly": true
- },
- "podCidrOverprovisionConfig": {
- "$ref": "#/$defs/PodCIDROverprovisionConfig",
- "description": "[PRIVATE FIELD] Pod CIDR size overprovisioning config for the nodepool. Pod CIDR size per node depends on max_pods_per_node. By default, the value of max_pods_per_node is rounded off to next power of 2 and we then double that to get the size of pod CIDR block per node. Example: max_pods_per_node of 30 would result in 64 IPs (/26). This config can disable the doubling of IPs (we still round off to next power of 2) Example: max_pods_per_node of 30 will result in 32 IPs (/27) when overprovisioning is disabled."
- },
- "podIpv4CidrBlock": {
- "description": "The IP address range for pod IPs in this node pool. Only applicable if `create_pod_range` is true. Set to blank to have a range chosen with the default size. Set to /netmask (e.g. `/14`) to have a range chosen with a specific netmask. Set to a [CIDR](https://en.wikipedia.org/wiki/Classless_Inter-Domain_Routing) notation (e.g. `10.96.0.0/14`) to pick a specific range to use. Only applicable if `ip_allocation_policy.use_ip_aliases` is true. This field cannot be changed after the node pool has been created.",
- "type": "string"
- },
- "podIpv4RangeUtilization": {
- "description": "Output only. The utilization of the IPv4 range for the pod. The ratio is Usage/[Total number of IPs in the secondary range], Usage=numNodes*numZones*podIPsPerNode.",
- "format": "double",
- "readOnly": true,
- "type": "number"
- },
- "podRange": {
- "description": "The ID of the secondary range for pod IPs. If `create_pod_range` is true, this ID is used for the new range. If `create_pod_range` is false, uses an existing secondary range with this ID. Only applicable if `ip_allocation_policy.use_ip_aliases` is true. This field cannot be changed after the node pool has been created.",
- "type": "string"
- },
- "subnetwork": {
- "description": "Optional. The subnetwork name/path for the node pool. Format: projects/{project}/regions/{region}/subnetworks/{subnetwork} If the cluster is associated with multiple subnetworks, the subnetwork can be either: - A user supplied subnetwork name during node pool creation (e.g., `my-subnet`). The name must be between 1 and 63 characters long, start with a letter, contain only letters, numbers, and hyphens, and end with a letter or a number. - A full subnetwork path during node pool creation, such as `projects/gke-project/regions/us-central1/subnetworks/my-subnet` - A subnetwork path picked based on the IP utilization during node pool creation and is immutable.",
- "type": "string"
- }
- },
- "type": "object"
- },
- "NodePool": {
- "description": "NodePool contains the name and configuration for a cluster's node pool. Node pools are a set of nodes (i.e. VM's), with a common configuration and specification, under the control of the cluster master. They may have a set of Kubernetes labels applied to them, which may be used to reference them during pod scheduling. They may also be resized up or down, to accommodate the workload.",
- "properties": {
- "autopilotConfig": {
- "$ref": "#/$defs/AutopilotConfig",
- "description": "Specifies the autopilot configuration for this node pool. This field is exclusively reserved for Cluster Autoscaler."
- },
- "autoscaling": {
- "$ref": "#/$defs/NodePoolAutoscaling",
- "description": "Autoscaler configuration for this NodePool. Autoscaler is enabled only if a valid configuration is present."
- },
- "bestEffortProvisioning": {
- "$ref": "#/$defs/BestEffortProvisioning",
- "description": "Enable best effort provisioning for nodes"
- },
- "conditions": {
- "description": "Which conditions caused the current node pool state.",
- "items": {
- "$ref": "#/$defs/StatusCondition"
- },
- "type": "array"
- },
- "config": {
- "$ref": "#/$defs/NodeConfig",
- "description": "The node configuration of the pool."
- },
- "etag": {
- "description": "This checksum is computed by the server based on the value of node pool fields, and may be sent on update requests to ensure the client has an up-to-date value before proceeding.",
- "type": "string"
- },
- "initialNodeCount": {
- "description": "The initial node count for the pool. You must ensure that your Compute Engine [resource quota](https://cloud.google.com/compute/quotas) is sufficient for this number of instances. You must also have available firewall and routes quota.",
- "format": "int32",
- "type": "integer"
- },
- "instanceGroupUrls": {
- "description": "Output only. The resource URLs of the [managed instance groups](https://cloud.google.com/compute/docs/instance-groups/creating-groups-of-managed-instances) associated with this node pool. During the node pool blue-green upgrade operation, the URLs contain both blue and green resources.",
- "items": {
- "type": "string"
- },
- "readOnly": true,
- "type": "array"
- },
- "locations": {
- "description": "The list of Google Compute Engine [zones](https://cloud.google.com/compute/docs/zones#available) in which the NodePool's nodes should be located. If this value is unspecified during node pool creation, the [Cluster.Locations](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1/projects.locations.clusters#Cluster.FIELDS.locations) value will be used, instead. Warning: changing node pool locations will result in nodes being added and/or removed.",
- "items": {
- "type": "string"
- },
- "type": "array"
- },
- "management": {
- "$ref": "#/$defs/NodeManagement",
- "description": "NodeManagement configuration for this NodePool."
- },
- "maxPodsConstraint": {
- "$ref": "#/$defs/MaxPodsConstraint",
- "description": "The constraint on the maximum number of pods that can be run simultaneously on a node in the node pool."
- },
- "name": {
- "description": "The name of the node pool.",
- "type": "string"
- },
- "networkConfig": {
- "$ref": "#/$defs/NodeNetworkConfig",
- "description": "Networking configuration for this NodePool. If specified, it overrides the cluster-level defaults."
- },
- "nodeDrainConfig": {
- "$ref": "#/$defs/NodeDrainConfig",
- "description": "Specifies the node drain configuration for this node pool."
- },
- "placementPolicy": {
- "$ref": "#/$defs/PlacementPolicy",
- "description": "Specifies the node placement policy."
- },
- "podIpv4CidrSize": {
- "description": "Output only. The pod CIDR block size per node in this node pool.",
- "format": "int32",
- "readOnly": true,
- "type": "integer"
- },
- "queuedProvisioning": {
- "$ref": "#/$defs/QueuedProvisioning",
- "description": "Specifies the configuration of queued provisioning."
- },
- "selfLink": {
- "description": "Output only. Server-defined URL for the resource.",
- "readOnly": true,
- "type": "string"
- },
- "status": {
- "description": "Output only. The status of the nodes in this pool instance.",
- "enum": [
- "STATUS_UNSPECIFIED",
- "PROVISIONING",
- "RUNNING",
- "RUNNING_WITH_ERROR",
- "RECONCILING",
- "STOPPING",
- "ERROR"
- ],
- "readOnly": true,
- "type": "string",
- "x-google-enum-descriptions": [
- "Not set.",
- "The PROVISIONING state indicates the node pool is being created.",
- "The RUNNING state indicates the node pool has been created and is fully usable.",
- "The RUNNING_WITH_ERROR state indicates the node pool has been created and is partially usable. Some error state has occurred and some functionality may be impaired. Customer may need to reissue a request or trigger a new update.",
- "The RECONCILING state indicates that some work is actively being done on the node pool, such as upgrading node software. Details can be found in the `statusMessage` field.",
- "The STOPPING state indicates the node pool is being deleted.",
- "The ERROR state indicates the node pool may be unusable. Details can be found in the `statusMessage` field."
- ]
- },
- "statusMessage": {
- "deprecated": true,
- "description": "Output only. Deprecated. Use conditions instead. Additional information about the current status of this node pool instance, if available.",
- "readOnly": true,
- "type": "string"
- },
- "updateInfo": {
- "$ref": "#/$defs/UpdateInfo",
- "description": "Output only. Update info contains relevant information during a node pool update.",
- "readOnly": true
- },
- "upgradeSettings": {
- "$ref": "#/$defs/UpgradeSettings",
- "description": "Upgrade settings control disruption and speed of the upgrade."
- },
- "version": {
- "description": "The version of Kubernetes running on this NodePool's nodes. If unspecified, it defaults as described [here](https://cloud.google.com/kubernetes-engine/versioning#specifying_node_version).",
- "type": "string"
- }
- },
- "type": "object"
- },
- "NodePoolAutoscaling": {
- "description": "NodePoolAutoscaling contains information required by cluster autoscaler to adjust the size of the node pool to the current cluster usage.",
- "properties": {
- "autoprovisioned": {
- "description": "Can this node pool be deleted automatically.",
- "type": "boolean"
- },
- "enabled": {
- "description": "Is autoscaling enabled for this node pool.",
- "type": "boolean"
- },
- "locationPolicy": {
- "description": "Location policy used when scaling up a nodepool.",
- "enum": [
- "LOCATION_POLICY_UNSPECIFIED",
- "BALANCED",
- "ANY"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Not set.",
- "BALANCED is a best effort policy that aims to balance the sizes of different zones.",
- "ANY policy picks zones that have the highest capacity available."
- ]
- },
- "maxNodeCount": {
- "description": "Maximum number of nodes for one location in the node pool. Must be >= min_node_count. There has to be enough quota to scale up the cluster.",
- "format": "int32",
- "type": "integer"
- },
- "minNodeCount": {
- "description": "Minimum number of nodes for one location in the node pool. Must be greater than or equal to 0 and less than or equal to max_node_count.",
- "format": "int32",
- "type": "integer"
- },
- "totalMaxNodeCount": {
- "description": "Maximum number of nodes in the node pool. Must be greater than or equal to total_min_node_count. There has to be enough quota to scale up the cluster. The total_*_node_count fields are mutually exclusive with the *_node_count fields.",
- "format": "int32",
- "type": "integer"
- },
- "totalMinNodeCount": {
- "description": "Minimum number of nodes in the node pool. Must be greater than or equal to 0 and less than or equal to total_max_node_count. The total_*_node_count fields are mutually exclusive with the *_node_count fields.",
- "format": "int32",
- "type": "integer"
- }
- },
- "type": "object"
- },
- "NodePoolLoggingConfig": {
- "description": "NodePoolLoggingConfig specifies logging configuration for nodepools.",
- "properties": {
- "variantConfig": {
- "$ref": "#/$defs/LoggingVariantConfig",
- "description": "Logging variant configuration."
- }
- },
- "type": "object"
- },
- "NodeTaint": {
- "description": "Kubernetes taint is composed of three fields: key, value, and effect. Effect can only be one of three types: NoSchedule, PreferNoSchedule or NoExecute. See [here](https://kubernetes.io/docs/concepts/configuration/taint-and-toleration) for more information, including usage and the valid values.",
- "properties": {
- "effect": {
- "description": "Effect for taint.",
- "enum": [
- "EFFECT_UNSPECIFIED",
- "NO_SCHEDULE",
- "PREFER_NO_SCHEDULE",
- "NO_EXECUTE"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Not set",
- "NoSchedule",
- "PreferNoSchedule",
- "NoExecute"
- ]
- },
- "key": {
- "description": "Key for taint.",
- "type": "string"
- },
- "value": {
- "description": "Value for taint.",
- "type": "string"
- }
- },
- "type": "object"
- },
- "PlacementPolicy": {
- "description": "PlacementPolicy defines the placement policy used by the node pool.",
- "properties": {
- "policyName": {
- "description": "If set, refers to the name of a custom resource policy supplied by the user. The resource policy must be in the same project and region as the node pool. If not found, InvalidArgument error is returned.",
- "type": "string"
- },
- "tpuTopology": {
- "description": "Optional. TPU placement topology for pod slice node pool. https://cloud.google.com/tpu/docs/types-topologies#tpu_topologies",
- "type": "string"
- },
- "type": {
- "description": "The type of placement.",
- "enum": [
- "TYPE_UNSPECIFIED",
- "COMPACT"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "TYPE_UNSPECIFIED specifies no requirements on nodes placement.",
- "COMPACT specifies node placement in the same availability domain to ensure low communication latency."
- ]
- }
- },
- "type": "object"
- },
- "PodCIDROverprovisionConfig": {
- "description": "[PRIVATE FIELD] Config for pod CIDR size overprovisioning.",
- "properties": {
- "disable": {
- "description": "Whether Pod CIDR overprovisioning is disabled. Note: Pod CIDR overprovisioning is enabled by default.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "PrivateRegistryAccessConfig": {
- "description": "PrivateRegistryAccessConfig contains access configuration for private container registries.",
- "properties": {
- "certificateAuthorityDomainConfig": {
- "description": "Private registry access configuration.",
- "items": {
- "$ref": "#/$defs/CertificateAuthorityDomainConfig"
- },
- "type": "array"
- },
- "enabled": {
- "description": "Private registry access is enabled.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "QueuedProvisioning": {
- "description": "QueuedProvisioning defines the queued provisioning used by the node pool.",
- "properties": {
- "enabled": {
- "description": "Denotes that this nodepool is QRM specific, meaning nodes can be only obtained through queuing via the Cluster Autoscaler ProvisioningRequest API.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "RegistryHeader": {
- "description": "RegistryHeader configures headers for the registry.",
- "properties": {
- "key": {
- "description": "Key configures the header key.",
- "type": "string"
- },
- "value": {
- "description": "Value configures the header value.",
- "items": {
- "type": "string"
- },
- "type": "array"
- }
- },
- "type": "object"
- },
- "RegistryHostConfig": {
- "description": "RegistryHostConfig configures the top-level structure for a single containerd registry server's configuration, which represents one hosts.toml file on the node. It will override the same fqdns in PrivateRegistryAccessConfig.",
- "properties": {
- "hosts": {
- "description": "HostConfig configures a list of host-specific configurations for the server. Each server can have at most 10 host configurations.",
- "items": {
- "$ref": "#/$defs/HostConfig"
- },
- "type": "array"
- },
- "server": {
- "description": "Defines the host name of the registry server, which will be used to create configuration file as /etc/containerd/hosts.d//hosts.toml. It supports fully qualified domain names (FQDN) and IP addresses: Specifying port is supported. Wildcards are NOT supported. Examples: - my.customdomain.com - 10.0.1.2:5000",
- "type": "string"
- }
- },
- "type": "object"
- },
- "ReservationAffinity": {
- "description": "[ReservationAffinity](https://cloud.google.com/compute/docs/instances/reserving-zonal-resources) is the configuration of desired reservation which instances could take capacity from.",
- "properties": {
- "consumeReservationType": {
- "description": "Corresponds to the type of reservation consumption.",
- "enum": [
- "UNSPECIFIED",
- "NO_RESERVATION",
- "ANY_RESERVATION",
- "SPECIFIC_RESERVATION"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value. This should not be used.",
- "Do not consume from any reserved capacity.",
- "Consume any reservation available.",
- "Must consume from a specific reservation. Must specify key value fields for specifying the reservations."
- ]
- },
- "key": {
- "description": "Corresponds to the label key of a reservation resource. To target a SPECIFIC_RESERVATION by name, specify \"compute.googleapis.com/reservation-name\" as the key and specify the name of your reservation as its value.",
- "type": "string"
- },
- "values": {
- "description": "Corresponds to the label value(s) of reservation resource(s).",
- "items": {
- "type": "string"
- },
- "type": "array"
- }
- },
- "type": "object"
- },
- "ResourceManagerTags": {
- "description": "A map of resource manager tag keys and values to be attached to the nodes for managing Compute Engine firewalls using Network Firewall Policies. Tags must be according to specifications in https://cloud.google.com/vpc/docs/tags-firewalls-overview#specifications. A maximum of 5 tag key-value pairs can be specified. Existing tags will be replaced with new values.",
- "properties": {
- "tags": {
- "additionalProperties": {
- "type": "string"
- },
- "description": "TagKeyValue must be in one of the following formats ([KEY]=[VALUE]) 1. `tagKeys/{tag_key_id}=tagValues/{tag_value_id}` 2. `{org_id}/{tag_key_name}={tag_value_name}` 3. `{project_id}/{tag_key_name}={tag_value_name}`",
- "type": "object"
- }
- },
- "type": "object"
- },
- "SandboxConfig": {
- "description": "SandboxConfig contains configurations of the sandbox to use for the node.",
- "properties": {
- "type": {
- "description": "Type of the sandbox to use for the node.",
- "enum": [
- "UNSPECIFIED",
- "GVISOR"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value. This should not be used.",
- "Run sandbox using gvisor."
- ]
- }
- },
- "type": "object"
- },
- "SecondaryBootDisk": {
- "description": "SecondaryBootDisk represents a persistent disk attached to a node with special configurations based on its mode.",
- "properties": {
- "diskImage": {
- "description": "Fully-qualified resource ID for an existing disk image.",
- "type": "string"
- },
- "mode": {
- "description": "Disk mode (container image cache, etc.)",
- "enum": [
- "MODE_UNSPECIFIED",
- "CONTAINER_IMAGE_CACHE"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "MODE_UNSPECIFIED is when mode is not set.",
- "CONTAINER_IMAGE_CACHE is for using the secondary boot disk as a container image cache."
- ]
- }
- },
- "type": "object"
- },
- "SecondaryBootDiskUpdateStrategy": {
- "description": "SecondaryBootDiskUpdateStrategy is a placeholder which will be extended in the future to define different options for updating secondary boot disks.",
- "type": "object"
- },
- "ShieldedInstanceConfig": {
- "description": "A set of Shielded Instance options.",
- "properties": {
- "enableIntegrityMonitoring": {
- "description": "Defines whether the instance has integrity monitoring enabled. Enables monitoring and attestation of the boot integrity of the instance. The attestation is performed against the integrity policy baseline. This baseline is initially derived from the implicitly trusted boot image when the instance is created.",
- "type": "boolean"
- },
- "enableSecureBoot": {
- "description": "Defines whether the instance has Secure Boot enabled. Secure Boot helps ensure that the system only runs authentic software by verifying the digital signature of all boot components, and halting the boot process if signature verification fails.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "SoleTenantConfig": {
- "description": "SoleTenantConfig contains the NodeAffinities to specify what shared sole tenant node groups should back the node pool.",
- "properties": {
- "minNodeCpus": {
- "description": "Optional. The minimum number of virtual CPUs this instance will consume when running on a sole-tenant node. This field can only be set if the node pool is created in a shared sole-tenant node group.",
- "format": "int32",
- "type": "integer"
- },
- "nodeAffinities": {
- "description": "NodeAffinities used to match to a shared sole tenant node group.",
- "items": {
- "$ref": "#/$defs/NodeAffinity"
- },
- "type": "array"
- }
- },
- "type": "object"
- },
- "StandardRolloutPolicy": {
- "description": "Standard rollout policy is the default policy for blue-green.",
- "properties": {
- "batchNodeCount": {
- "description": "Number of blue nodes to drain in a batch.",
- "format": "int32",
- "type": "integer"
- },
- "batchPercentage": {
- "description": "Percentage of the blue pool nodes to drain in a batch. The range of this field should be (0.0, 1.0].",
- "format": "float",
- "type": "number"
- },
- "batchSoakDuration": {
- "description": "Soak time after each batch gets drained. Default to zero.",
- "format": "google-duration",
- "type": "string"
- }
- },
- "type": "object"
- },
- "StatusCondition": {
- "description": "StatusCondition describes why a cluster or a node pool has a certain status (e.g., ERROR or DEGRADED).",
- "properties": {
- "canonicalCode": {
- "description": "Canonical code of the condition.",
- "enum": [
- "OK",
- "CANCELLED",
- "UNKNOWN",
- "INVALID_ARGUMENT",
- "DEADLINE_EXCEEDED",
- "NOT_FOUND",
- "ALREADY_EXISTS",
- "PERMISSION_DENIED",
- "UNAUTHENTICATED",
- "RESOURCE_EXHAUSTED",
- "FAILED_PRECONDITION",
- "ABORTED",
- "OUT_OF_RANGE",
- "UNIMPLEMENTED",
- "INTERNAL",
- "UNAVAILABLE",
- "DATA_LOSS"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Not an error; returned on success. HTTP Mapping: 200 OK",
- "The operation was cancelled, typically by the caller. HTTP Mapping: 499 Client Closed Request",
- "Unknown error. For example, this error may be returned when a `Status` value received from another address space belongs to an error space that is not known in this address space. Also errors raised by APIs that do not return enough error information may be converted to this error. HTTP Mapping: 500 Internal Server Error",
- "The client specified an invalid argument. Note that this differs from `FAILED_PRECONDITION`. `INVALID_ARGUMENT` indicates arguments that are problematic regardless of the state of the system (e.g., a malformed file name). HTTP Mapping: 400 Bad Request",
- "The deadline expired before the operation could complete. For operations that change the state of the system, this error may be returned even if the operation has completed successfully. For example, a successful response from a server could have been delayed long enough for the deadline to expire. HTTP Mapping: 504 Gateway Timeout",
- "Some requested entity (e.g., file or directory) was not found. Note to server developers: if a request is denied for an entire class of users, such as gradual feature rollout or undocumented allowlist, `NOT_FOUND` may be used. If a request is denied for some users within a class of users, such as user-based access control, `PERMISSION_DENIED` must be used. HTTP Mapping: 404 Not Found",
- "The entity that a client attempted to create (e.g., file or directory) already exists. HTTP Mapping: 409 Conflict",
- "The caller does not have permission to execute the specified operation. `PERMISSION_DENIED` must not be used for rejections caused by exhausting some resource (use `RESOURCE_EXHAUSTED` instead for those errors). `PERMISSION_DENIED` must not be used if the caller can not be identified (use `UNAUTHENTICATED` instead for those errors). This error code does not imply the request is valid or the requested entity exists or satisfies other pre-conditions. HTTP Mapping: 403 Forbidden",
- "The request does not have valid authentication credentials for the operation. HTTP Mapping: 401 Unauthorized",
- "Some resource has been exhausted, perhaps a per-user quota, or perhaps the entire file system is out of space. HTTP Mapping: 429 Too Many Requests",
- "The operation was rejected because the system is not in a state required for the operation's execution. For example, the directory to be deleted is non-empty, an rmdir operation is applied to a non-directory, etc. Service implementors can use the following guidelines to decide between `FAILED_PRECONDITION`, `ABORTED`, and `UNAVAILABLE`: (a) Use `UNAVAILABLE` if the client can retry just the failing call. (b) Use `ABORTED` if the client should retry at a higher level. For example, when a client-specified test-and-set fails, indicating the client should restart a read-modify-write sequence. (c) Use `FAILED_PRECONDITION` if the client should not retry until the system state has been explicitly fixed. For example, if an \"rmdir\" fails because the directory is non-empty, `FAILED_PRECONDITION` should be returned since the client should not retry unless the files are deleted from the directory. HTTP Mapping: 400 Bad Request",
- "The operation was aborted, typically due to a concurrency issue such as a sequencer check failure or transaction abort. See the guidelines above for deciding between `FAILED_PRECONDITION`, `ABORTED`, and `UNAVAILABLE`. HTTP Mapping: 409 Conflict",
- "The operation was attempted past the valid range. E.g., seeking or reading past end-of-file. Unlike `INVALID_ARGUMENT`, this error indicates a problem that may be fixed if the system state changes. For example, a 32-bit file system will generate `INVALID_ARGUMENT` if asked to read at an offset that is not in the range [0,2^32-1], but it will generate `OUT_OF_RANGE` if asked to read from an offset past the current file size. There is a fair bit of overlap between `FAILED_PRECONDITION` and `OUT_OF_RANGE`. We recommend using `OUT_OF_RANGE` (the more specific error) when it applies so that callers who are iterating through a space can easily look for an `OUT_OF_RANGE` error to detect when they are done. HTTP Mapping: 400 Bad Request",
- "The operation is not implemented or is not supported/enabled in this service. HTTP Mapping: 501 Not Implemented",
- "Internal errors. This means that some invariants expected by the underlying system have been broken. This error code is reserved for serious errors. HTTP Mapping: 500 Internal Server Error",
- "The service is currently unavailable. This is most likely a transient condition, which can be corrected by retrying with a backoff. Note that it is not always safe to retry non-idempotent operations. See the guidelines above for deciding between `FAILED_PRECONDITION`, `ABORTED`, and `UNAVAILABLE`. HTTP Mapping: 503 Service Unavailable",
- "Unrecoverable data loss or corruption. HTTP Mapping: 500 Internal Server Error"
- ]
- },
- "code": {
- "deprecated": true,
- "description": "Machine-friendly representation of the condition Deprecated. Use canonical_code instead.",
- "enum": [
- "UNKNOWN",
- "GCE_STOCKOUT",
- "GKE_SERVICE_ACCOUNT_DELETED",
- "GCE_QUOTA_EXCEEDED",
- "SET_BY_OPERATOR",
- "CLOUD_KMS_KEY_ERROR",
- "CA_EXPIRING",
- "NODE_SERVICE_ACCOUNT_MISSING_PERMISSIONS",
- "CLOUD_KMS_KEY_DESTROYED"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "UNKNOWN indicates a generic condition.",
- "GCE_STOCKOUT indicates that Google Compute Engine resources are temporarily unavailable.",
- "GKE_SERVICE_ACCOUNT_DELETED indicates that the user deleted their robot service account.",
- "Google Compute Engine quota was exceeded.",
- "Cluster state was manually changed by an SRE due to a system logic error.",
- "Unable to perform an encrypt operation against the CloudKMS key used for etcd level encryption.",
- "Cluster CA is expiring soon.",
- "Node service account is missing permissions.",
- "Cloud KMS key version used for etcd level encryption has been destroyed. This is a permanent error."
- ]
- },
- "message": {
- "description": "Human-friendly representation of the condition",
- "type": "string"
- }
- },
- "type": "object"
- },
- "SwapConfig": {
- "description": "Configuration for swap memory on a node pool.",
- "properties": {
- "bootDiskProfile": {
- "$ref": "#/$defs/BootDiskProfile",
- "description": "Swap on the node's boot disk."
- },
- "dedicatedLocalSsdProfile": {
- "$ref": "#/$defs/DedicatedLocalSsdProfile",
- "description": "Provisions a new, separate local NVMe SSD exclusively for swap."
- },
- "enabled": {
- "description": "Optional. Enables or disables swap for the node pool.",
- "type": "boolean"
- },
- "encryptionConfig": {
- "$ref": "#/$defs/EncryptionConfig",
- "description": "Optional. If omitted, swap space is encrypted by default."
- },
- "ephemeralLocalSsdProfile": {
- "$ref": "#/$defs/EphemeralLocalSsdProfile",
- "description": "Swap on the local SSD shared with pod ephemeral storage."
- }
- },
- "type": "object"
- },
- "TaintConfig": {
- "description": "TaintConfig contains the configuration for the taints of the node pool.",
- "properties": {
- "architectureTaintBehavior": {
- "description": "Optional. Controls architecture tainting behavior.",
- "enum": [
- "ARCHITECTURE_TAINT_BEHAVIOR_UNSPECIFIED",
- "NONE",
- "ARM"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Specifies that the behavior is unspecified, defaults to ARM.",
- "Disables default architecture taints on the node pool.",
- "Taints all the nodes in the node pool with the default ARM taint."
- ]
- }
- },
- "type": "object"
- },
- "TopologyManager": {
- "description": "TopologyManager defines the configuration options for Topology Manager feature. See https://kubernetes.io/docs/tasks/administer-cluster/topology-manager/",
- "properties": {
- "policy": {
- "description": "Configures the strategy for resource alignment. Allowed values are: * none: the default policy, and does not perform any topology alignment. * restricted: the topology manager stores the preferred NUMA node affinity for the container, and will reject the pod if the affinity if not preferred. * best-effort: the topology manager stores the preferred NUMA node affinity for the container. If the affinity is not preferred, the topology manager will admit the pod to the node anyway. * single-numa-node: the topology manager determines if the single NUMA node affinity is possible. If it is, Topology Manager will store this and the Hint Providers can then use this information when making the resource allocation decision. If, however, this is not possible then the Topology Manager will reject the pod from the node. This will result in a pod in a Terminated state with a pod admission failure. The default policy value is 'none' if unspecified. Details about each strategy can be found [here](https://kubernetes.io/docs/tasks/administer-cluster/topology-manager/#topology-manager-policies).",
- "type": "string"
- },
- "scope": {
- "description": "The Topology Manager aligns resources in following scopes: * container * pod The default scope is 'container' if unspecified. See https://kubernetes.io/docs/tasks/administer-cluster/topology-manager/#topology-manager-scopes",
- "type": "string"
- }
- },
- "type": "object"
- },
- "UpdateInfo": {
- "description": "UpdateInfo contains resource (instance groups, etc), status and other intermediate information relevant to a node pool upgrade.",
- "properties": {
- "blueGreenInfo": {
- "$ref": "#/$defs/BlueGreenInfo",
- "description": "Information of a blue-green upgrade."
- }
- },
- "type": "object"
- },
- "UpgradeSettings": {
- "description": "These upgrade settings control the level of parallelism and the level of disruption caused by an upgrade. maxUnavailable controls the number of nodes that can be simultaneously unavailable. maxSurge controls the number of additional nodes that can be added to the node pool temporarily for the time of the upgrade to increase the number of available nodes. (maxUnavailable + maxSurge) determines the level of parallelism (how many nodes are being upgraded at the same time). Note: upgrades inevitably introduce some disruption since workloads need to be moved from old nodes to new, upgraded ones. Even if maxUnavailable=0, this holds true. (Disruption stays within the limits of PodDisruptionBudget, if it is configured.) Consider a hypothetical node pool with 5 nodes having maxSurge=2, maxUnavailable=1. This means the upgrade process upgrades 3 nodes simultaneously. It creates 2 additional (upgraded) nodes, then it brings down 3 old (not yet upgraded) nodes at the same time. This ensures that there are always at least 4 nodes available. These upgrade settings configure the upgrade strategy for the node pool. Use strategy to switch between the strategies applied to the node pool. If the strategy is ROLLING, use max_surge and max_unavailable to control the level of parallelism and the level of disruption caused by upgrade. 1. maxSurge controls the number of additional nodes that can be added to the node pool temporarily for the time of the upgrade to increase the number of available nodes. 2. maxUnavailable controls the number of nodes that can be simultaneously unavailable. 3. (maxUnavailable + maxSurge) determines the level of parallelism (how many nodes are being upgraded at the same time). If the strategy is BLUE_GREEN, use blue_green_settings to configure the blue-green upgrade related settings. 1. standard_rollout_policy is the default policy. The policy is used to control the way blue pool gets drained. The draining is executed in the batch mode. The batch size could be specified as either percentage of the node pool size or the number of nodes. batch_soak_duration is the soak time after each batch gets drained. 2. node_pool_soak_duration is the soak time after all blue nodes are drained. After this period, the blue pool nodes will be deleted.",
- "properties": {
- "blueGreenSettings": {
- "$ref": "#/$defs/BlueGreenSettings",
- "description": "Settings for blue-green upgrade strategy."
- },
- "maxSurge": {
- "description": "The maximum number of nodes that can be created beyond the current size of the node pool during the upgrade process.",
- "format": "int32",
- "type": "integer"
- },
- "maxUnavailable": {
- "description": "The maximum number of nodes that can be simultaneously unavailable during the upgrade process. A node is considered available if its status is Ready.",
- "format": "int32",
- "type": "integer"
- },
- "strategy": {
- "description": "Update strategy of the node pool.",
- "enum": [
- "NODE_POOL_UPDATE_STRATEGY_UNSPECIFIED",
- "BLUE_GREEN",
- "SURGE",
- "SHORT_LIVED"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Default value if unset. GKE internally defaults the update strategy to SURGE for unspecified strategies.",
- "blue-green upgrade.",
- "SURGE is the traditional way of upgrade a node pool. max_surge and max_unavailable determines the level of upgrade parallelism.",
- "SHORT_LIVED is the dedicated upgrade strategy for QueuedProvisioning and flex start nodepools scaled up only by enqueueing to the Dynamic Workload Scheduler (DWS)."
- ]
- }
- },
- "type": "object"
- },
- "VirtualNIC": {
- "description": "Configuration of gVNIC feature.",
- "properties": {
- "enabled": {
- "description": "Whether gVNIC features are enabled in the node pool.",
- "type": "boolean"
- }
- },
- "type": "object"
- },
- "WindowsNodeConfig": {
- "description": "Parameters that can be configured on Windows nodes. Windows Node Config that define the parameters that will be used to configure the Windows node pool settings.",
- "properties": {
- "osVersion": {
- "description": "OSVersion specifies the Windows node config to be used on the node.",
- "enum": [
- "OS_VERSION_UNSPECIFIED",
- "OS_VERSION_LTSC2019",
- "OS_VERSION_LTSC2022"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "When OSVersion is not specified.",
- "LTSC2019 specifies to use LTSC2019 as the Windows Servercore Base Image.",
- "LTSC2022 specifies to use LTSC2022 as the Windows Servercore Base Image."
- ]
- }
- },
- "type": "object"
- },
- "WorkloadMetadataConfig": {
- "description": "WorkloadMetadataConfig defines the metadata configuration to expose to workloads on the node pool.",
- "properties": {
- "mode": {
- "description": "Mode is the configuration for how to expose metadata to workloads running on the node pool.",
- "enum": [
- "MODE_UNSPECIFIED",
- "GCE_METADATA",
- "GKE_METADATA"
- ],
- "type": "string",
- "x-google-enum-descriptions": [
- "Not set.",
- "Expose all Compute Engine metadata to pods.",
- "Run the GKE Metadata Server on this node. The GKE Metadata Server exposes a metadata API to workloads that is compatible with the V1 Compute Metadata APIs exposed by the Compute Engine and App Engine Metadata Servers. This feature can only be enabled if Workload Identity is enabled at the cluster level."
- ]
- }
- },
- "type": "object"
- },
- "WritableCgroups": {
- "description": "Defines writable cgroups configuration.",
- "properties": {
- "enabled": {
- "description": "Optional. Whether writable cgroups is enabled.",
- "type": "boolean"
- }
- },
- "type": "object"
- }
-}Output schema / descriptionPrevious value: -"ListNodePoolsResponse is the result of ListNodePoolsRequest."New value: +"Response for listing node pools in JSON format. The full node pool object can be found at https://docs.cloud.google.com/kubernetes-engine/docs/reference/rest/v1/projects.locations.clusters.nodePools"Output schema / properties / nodePools / descriptionPrevious value: -"A list of node pools for a cluster."New value: +"A string representing the ListNodePoolsResponse object."Output schema / properties / nodePools / items / $refRemoved value: -"#/$defs/NodePool"Output schema / properties / nodePools / items / typeAdded value: +"string"get_cluster2 fields changedOutput schema / $defs / ControlPlaneEgressAdded value: +{
+ "description": "ControlPlaneEgress defines the settings needed to enable control plane egress control.",
+ "properties": {
+ "mode": {
+ "description": "Defines the mode of control plane egress.",
+ "enum": [
+ "MODE_UNSPECIFIED",
+ "VIA_CONTROL_PLANE",
+ "NONE"
+ ],
+ "type": "string",
+ "x-google-enum-descriptions": [
+ "Default value not specified.",
+ "Control plane has public IP and no restriction on egress.",
+ "No public IP on control plane and only internal allowlisted egress."
+ ]
+ }
+ },
+ "type": "object"
+}Output schema / properties / controlPlaneEgressAdded value: +{
+ "$ref": "#/$defs/ControlPlaneEgress",
+ "description": "Configuration for control plane egress control."
+}list_clusters2 fields changedOutput schema / $defs / Cluster / properties / controlPlaneEgressAdded value: +{
+ "$ref": "#/$defs/ControlPlaneEgress",
+ "description": "Configuration for control plane egress control."
+}Output schema / $defs / ControlPlaneEgressAdded value: +{
+ "description": "ControlPlaneEgress defines the settings needed to enable control plane egress control.",
+ "properties": {
+ "mode": {
+ "description": "Defines the mode of control plane egress.",
+ "enum": [
+ "MODE_UNSPECIFIED",
+ "VIA_CONTROL_PLANE",
+ "NONE"
+ ],
+ "type": "string",
+ "x-google-enum-descriptions": [
+ "Default value not specified.",
+ "Control plane has public IP and no restriction on egress.",
+ "No public IP on control plane and only internal allowlisted egress."
+ ]
+ }
+ },
+ "type": "object"
+}get_cluster2 fields changedOutput schema / $defs / ManagedMachineLearningDiagnosticsConfigAdded value: +{
+ "description": "ManagedMachineLearningDiagnosticsConfig is the configuration for the GKE Managed Machine Learning Diagnostics pipeline.",
+ "properties": {
+ "enabled": {
+ "description": "Enable/Disable Managed Machine Learning Diagnostics.",
+ "type": "boolean"
+ }
+ },
+ "type": "object"
+}Output schema / properties / managedMachineLearningDiagnosticsConfigAdded value: +{
+ "$ref": "#/$defs/ManagedMachineLearningDiagnosticsConfig",
+ "description": "Configuration for Managed Machine Learning Diagnostics."
+}list_clusters2 fields changedOutput schema / $defs / Cluster / properties / managedMachineLearningDiagnosticsConfigAdded value: +{
+ "$ref": "#/$defs/ManagedMachineLearningDiagnosticsConfig",
+ "description": "Configuration for Managed Machine Learning Diagnostics."
+}Output schema / $defs / ManagedMachineLearningDiagnosticsConfigAdded value: +{
+ "description": "ManagedMachineLearningDiagnosticsConfig is the configuration for the GKE Managed Machine Learning Diagnostics pipeline.",
+ "properties": {
+ "enabled": {
+ "description": "Enable/Disable Managed Machine Learning Diagnostics.",
+ "type": "boolean"
+ }
+ },
+ "type": "object"
+}get_cluster2 fields changedOutput schema / $defs / Autopilot / properties / clusterPolicyConfigAdded value: +{
+ "$ref": "#/$defs/ClusterPolicyConfig",
+ "description": "ClusterPolicyConfig denotes cluster level policies that are enforced for the cluster."
+}Output schema / $defs / ClusterPolicyConfigAdded value: +{
+ "description": "ClusterPolicyConfig stores the configuration for cluster wide policies.",
+ "properties": {
+ "noStandardNodePools": {
+ "description": "Denotes preventing standard node pools and requiring only autopilot node pools.",
+ "type": "boolean"
+ },
+ "noSystemImpersonation": {
+ "description": "Denotes preventing impersonation and CSRs for GKE System users.",
+ "type": "boolean"
+ },
+ "noSystemMutation": {
+ "description": "Denotes that preventing creation and mutation of resources in GKE managed namespaces and cluster-scoped GKE managed resources .",
+ "type": "boolean"
+ },
+ "noUnsafeWebhooks": {
+ "description": "Denotes preventing unsafe webhooks.",
+ "type": "boolean"
+ }
+ },
+ "type": "object"
+}list_clusters2 fields changedOutput schema / $defs / Autopilot / properties / clusterPolicyConfigAdded value: +{
+ "$ref": "#/$defs/ClusterPolicyConfig",
+ "description": "ClusterPolicyConfig denotes cluster level policies that are enforced for the cluster."
+}Output schema / $defs / ClusterPolicyConfigAdded value: +{
+ "description": "ClusterPolicyConfig stores the configuration for cluster wide policies.",
+ "properties": {
+ "noStandardNodePools": {
+ "description": "Denotes preventing standard node pools and requiring only autopilot node pools.",
+ "type": "boolean"
+ },
+ "noSystemImpersonation": {
+ "description": "Denotes preventing impersonation and CSRs for GKE System users.",
+ "type": "boolean"
+ },
+ "noSystemMutation": {
+ "description": "Denotes that preventing creation and mutation of resources in GKE managed namespaces and cluster-scoped GKE managed resources .",
+ "type": "boolean"
+ },
+ "noUnsafeWebhooks": {
+ "description": "Denotes preventing unsafe webhooks.",
+ "type": "boolean"
+ }
+ },
+ "type": "object"
+}get_cluster6 fields changedOutput schema / $defs / DatabaseEncryption / properties / currentState / enumPrevious value: -[
- "CURRENT_STATE_UNSPECIFIED",
- "CURRENT_STATE_ENCRYPTED",
- "CURRENT_STATE_DECRYPTED",
- "CURRENT_STATE_ENCRYPTION_PENDING",
- "CURRENT_STATE_ENCRYPTION_ERROR",
- "CURRENT_STATE_DECRYPTION_PENDING",
- "CURRENT_STATE_DECRYPTION_ERROR"
-]New value: +[
+ "CURRENT_STATE_UNSPECIFIED",
+ "CURRENT_STATE_ENCRYPTED",
+ "CURRENT_STATE_DECRYPTED",
+ "CURRENT_STATE_ENCRYPTION_PENDING",
+ "CURRENT_STATE_ENCRYPTION_ERROR",
+ "CURRENT_STATE_DECRYPTION_PENDING",
+ "CURRENT_STATE_DECRYPTION_ERROR",
+ "CURRENT_STATE_ALL_OBJECTS_ENCRYPTION_ENABLED",
+ "CURRENT_STATE_ALL_OBJECTS_ENCRYPTION_PENDING",
+ "CURRENT_STATE_ALL_OBJECTS_ENCRYPTION_ERROR"
+]Output schema / $defs / DatabaseEncryption / properties / currentState / x-google-enum-descriptionsPrevious value: -[
- "Should never be set",
- "Secrets in etcd are encrypted.",
- "Secrets in etcd are stored in plain text (at etcd level) - this is unrelated to Compute Engine level full disk encryption.",
- "Encryption (or re-encryption with a different CloudKMS key) of Secrets is in progress.",
- "Encryption (or re-encryption with a different CloudKMS key) of Secrets in etcd encountered an error.",
- "De-crypting Secrets to plain text in etcd is in progress.",
- "De-crypting Secrets to plain text in etcd encountered an error."
-]New value: +[
+ "Should never be set",
+ "Secrets in etcd are encrypted.",
+ "Secrets in etcd are stored in plain text (at etcd level) - this is unrelated to Compute Engine level full disk encryption.",
+ "Encryption (or re-encryption with a different CloudKMS key) of Secrets is in progress.",
+ "Encryption (or re-encryption with a different CloudKMS key) of Secrets in etcd encountered an error.",
+ "De-crypting Secrets to plain text in etcd is in progress.",
+ "De-crypting Secrets to plain text in etcd encountered an error.",
+ "Encryption of all objects in the storage is enabled. It does not guarantee that all objects in the storage are encrypted, but eventually they will be.",
+ "Enablement of the encryption of all objects in storage is pending.",
+ "Enabling encryption of all objects in storage encountered an error."
+]Output schema / $defs / DatabaseEncryption / properties / state / enumPrevious value: -[
- "UNKNOWN",
- "ENCRYPTED",
- "DECRYPTED"
-]New value: +[
+ "UNKNOWN",
+ "ENCRYPTED",
+ "DECRYPTED",
+ "ALL_OBJECTS_ENCRYPTION_ENABLED"
+]Output schema / $defs / DatabaseEncryption / properties / state / x-google-enum-descriptionsPrevious value: -[
- "Should never be set",
- "Secrets in etcd are encrypted.",
- "Secrets in etcd are stored in plain text (at etcd level) - this is unrelated to Compute Engine level full disk encryption."
-]New value: +[
+ "Should never be set",
+ "Secrets in etcd are encrypted.",
+ "Secrets in etcd are stored in plain text (at etcd level) - this is unrelated to Compute Engine level full disk encryption.",
+ "Encryption of all objects in the storage is enabled. There is no guarantee that all objects in the storage are encrypted, but eventually they will be."
+]Output schema / $defs / NodeConfig / properties / taintConfigAdded value: +{
+ "$ref": "#/$defs/TaintConfig",
+ "description": "Optional. The taint configuration for the node pool."
+}Output schema / $defs / TaintConfigAdded value: +{
+ "description": "TaintConfig contains the configuration for the taints of the node pool.",
+ "properties": {
+ "architectureTaintBehavior": {
+ "description": "Optional. Controls architecture tainting behavior.",
+ "enum": [
+ "ARCHITECTURE_TAINT_BEHAVIOR_UNSPECIFIED",
+ "NONE",
+ "ARM"
+ ],
+ "type": "string",
+ "x-google-enum-descriptions": [
+ "Specifies that the behavior is unspecified, defaults to ARM.",
+ "Disables default architecture taints on the node pool.",
+ "Taints all the nodes in the node pool with the default ARM taint."
+ ]
+ }
+ },
+ "type": "object"
+}get_node_pool2 fields changedOutput schema / $defs / NodeConfig / properties / taintConfigAdded value: +{
+ "$ref": "#/$defs/TaintConfig",
+ "description": "Optional. The taint configuration for the node pool."
+}Output schema / $defs / TaintConfigAdded value: +{
+ "description": "TaintConfig contains the configuration for the taints of the node pool.",
+ "properties": {
+ "architectureTaintBehavior": {
+ "description": "Optional. Controls architecture tainting behavior.",
+ "enum": [
+ "ARCHITECTURE_TAINT_BEHAVIOR_UNSPECIFIED",
+ "NONE",
+ "ARM"
+ ],
+ "type": "string",
+ "x-google-enum-descriptions": [
+ "Specifies that the behavior is unspecified, defaults to ARM.",
+ "Disables default architecture taints on the node pool.",
+ "Taints all the nodes in the node pool with the default ARM taint."
+ ]
+ }
+ },
+ "type": "object"
+}list_clusters6 fields changedOutput schema / $defs / DatabaseEncryption / properties / currentState / enumPrevious value: -[
- "CURRENT_STATE_UNSPECIFIED",
- "CURRENT_STATE_ENCRYPTED",
- "CURRENT_STATE_DECRYPTED",
- "CURRENT_STATE_ENCRYPTION_PENDING",
- "CURRENT_STATE_ENCRYPTION_ERROR",
- "CURRENT_STATE_DECRYPTION_PENDING",
- "CURRENT_STATE_DECRYPTION_ERROR"
-]New value: +[
+ "CURRENT_STATE_UNSPECIFIED",
+ "CURRENT_STATE_ENCRYPTED",
+ "CURRENT_STATE_DECRYPTED",
+ "CURRENT_STATE_ENCRYPTION_PENDING",
+ "CURRENT_STATE_ENCRYPTION_ERROR",
+ "CURRENT_STATE_DECRYPTION_PENDING",
+ "CURRENT_STATE_DECRYPTION_ERROR",
+ "CURRENT_STATE_ALL_OBJECTS_ENCRYPTION_ENABLED",
+ "CURRENT_STATE_ALL_OBJECTS_ENCRYPTION_PENDING",
+ "CURRENT_STATE_ALL_OBJECTS_ENCRYPTION_ERROR"
+]Output schema / $defs / DatabaseEncryption / properties / currentState / x-google-enum-descriptionsPrevious value: -[
- "Should never be set",
- "Secrets in etcd are encrypted.",
- "Secrets in etcd are stored in plain text (at etcd level) - this is unrelated to Compute Engine level full disk encryption.",
- "Encryption (or re-encryption with a different CloudKMS key) of Secrets is in progress.",
- "Encryption (or re-encryption with a different CloudKMS key) of Secrets in etcd encountered an error.",
- "De-crypting Secrets to plain text in etcd is in progress.",
- "De-crypting Secrets to plain text in etcd encountered an error."
-]New value: +[
+ "Should never be set",
+ "Secrets in etcd are encrypted.",
+ "Secrets in etcd are stored in plain text (at etcd level) - this is unrelated to Compute Engine level full disk encryption.",
+ "Encryption (or re-encryption with a different CloudKMS key) of Secrets is in progress.",
+ "Encryption (or re-encryption with a different CloudKMS key) of Secrets in etcd encountered an error.",
+ "De-crypting Secrets to plain text in etcd is in progress.",
+ "De-crypting Secrets to plain text in etcd encountered an error.",
+ "Encryption of all objects in the storage is enabled. It does not guarantee that all objects in the storage are encrypted, but eventually they will be.",
+ "Enablement of the encryption of all objects in storage is pending.",
+ "Enabling encryption of all objects in storage encountered an error."
+]Output schema / $defs / DatabaseEncryption / properties / state / enumPrevious value: -[
- "UNKNOWN",
- "ENCRYPTED",
- "DECRYPTED"
-]New value: +[
+ "UNKNOWN",
+ "ENCRYPTED",
+ "DECRYPTED",
+ "ALL_OBJECTS_ENCRYPTION_ENABLED"
+]Output schema / $defs / DatabaseEncryption / properties / state / x-google-enum-descriptionsPrevious value: -[
- "Should never be set",
- "Secrets in etcd are encrypted.",
- "Secrets in etcd are stored in plain text (at etcd level) - this is unrelated to Compute Engine level full disk encryption."
-]New value: +[
+ "Should never be set",
+ "Secrets in etcd are encrypted.",
+ "Secrets in etcd are stored in plain text (at etcd level) - this is unrelated to Compute Engine level full disk encryption.",
+ "Encryption of all objects in the storage is enabled. There is no guarantee that all objects in the storage are encrypted, but eventually they will be."
+]Output schema / $defs / NodeConfig / properties / taintConfigAdded value: +{
+ "$ref": "#/$defs/TaintConfig",
+ "description": "Optional. The taint configuration for the node pool."
+}Output schema / $defs / TaintConfigAdded value: +{
+ "description": "TaintConfig contains the configuration for the taints of the node pool.",
+ "properties": {
+ "architectureTaintBehavior": {
+ "description": "Optional. Controls architecture tainting behavior.",
+ "enum": [
+ "ARCHITECTURE_TAINT_BEHAVIOR_UNSPECIFIED",
+ "NONE",
+ "ARM"
+ ],
+ "type": "string",
+ "x-google-enum-descriptions": [
+ "Specifies that the behavior is unspecified, defaults to ARM.",
+ "Disables default architecture taints on the node pool.",
+ "Taints all the nodes in the node pool with the default ARM taint."
+ ]
+ }
+ },
+ "type": "object"
+}list_node_pools2 fields changedOutput schema / $defs / NodeConfig / properties / taintConfigAdded value: +{
+ "$ref": "#/$defs/TaintConfig",
+ "description": "Optional. The taint configuration for the node pool."
+}Output schema / $defs / TaintConfigAdded value: +{
+ "description": "TaintConfig contains the configuration for the taints of the node pool.",
+ "properties": {
+ "architectureTaintBehavior": {
+ "description": "Optional. Controls architecture tainting behavior.",
+ "enum": [
+ "ARCHITECTURE_TAINT_BEHAVIOR_UNSPECIFIED",
+ "NONE",
+ "ARM"
+ ],
+ "type": "string",
+ "x-google-enum-descriptions": [
+ "Specifies that the behavior is unspecified, defaults to ARM.",
+ "Disables default architecture taints on the node pool.",
+ "Taints all the nodes in the node pool with the default ARM taint."
+ ]
+ }
+ },
+ "type": "object"
+}get_cluster1 field changedOutput schema / $defs / LustreCsiDriverConfig / properties / disableMultiNicAdded value: +{
+ "description": "When set to true, this disables multi-NIC support for the Lustre CSI driver. By default, GKE enables multi-NIC support, which allows the Lustre CSI driver to automatically detect and configure all suitable network interfaces on a node to maximize I/O performance for demanding workloads.",
+ "type": "boolean"
+}list_clusters1 field changedOutput schema / $defs / LustreCsiDriverConfig / properties / disableMultiNicAdded value: +{
+ "description": "When set to true, this disables multi-NIC support for the Lustre CSI driver. By default, GKE enables multi-NIC support, which allows the Lustre CSI driver to automatically detect and configure all suitable network interfaces on a node to maximize I/O performance for demanding workloads.",
+ "type": "boolean"
+}get_cluster2 fields changedOutput schema / $defs / ScheduleUpgradeConfigAdded value: +{
+ "description": "Configuration for scheduled upgrades on the cluster.",
+ "properties": {
+ "enabled": {
+ "description": "Optional. Whether or not scheduled upgrades are enabled.",
+ "type": "boolean"
+ }
+ },
+ "type": "object"
+}Output schema / properties / scheduleUpgradeConfigAdded value: +{
+ "$ref": "#/$defs/ScheduleUpgradeConfig",
+ "description": "Optional. Configuration for scheduled upgrades."
+}list_clusters2 fields changedOutput schema / $defs / Cluster / properties / scheduleUpgradeConfigAdded value: +{
+ "$ref": "#/$defs/ScheduleUpgradeConfig",
+ "description": "Optional. Configuration for scheduled upgrades."
+}Output schema / $defs / ScheduleUpgradeConfigAdded value: +{
+ "description": "Configuration for scheduled upgrades on the cluster.",
+ "properties": {
+ "enabled": {
+ "description": "Optional. Whether or not scheduled upgrades are enabled.",
+ "type": "boolean"
+ }
+ },
+ "type": "object"
+}get_clusterget_node_poolget_operationkube_api_resourceskube_getlist_clusterslist_node_poolslist_operationsClaiming proves that you control a remote MCP connector. It does not move, proxy, or interrupt the server.
Open the connector listing, choose Claim ownership, and sign in to Glama.
Complete one verification method:
GitHub identity — fastest for official registry listings. For a namespace such as io.github.alice/server, link the matching GitHub user, then choose Claim with GitHub. An organization namespace such as io.github.acme/server also needs that organization to have installed the Glama AI GitHub App and approved its permissions, because GitHub discloses organization membership only to apps it has installed. Use HTTP or DNS when it has not.
HTTP challenge — works when you can deploy a public file. Generate a token, publish the exact JSON Glama shows at /.well-known/glama.json on the same origin as the connector, then choose Check HTTP challenge.
DNS challenge — works when you control DNS but cannot change the server. Generate a token, create the exact TXT record Glama shows, wait for it to propagate, then choose Check DNS challenge.
After verification, Glama sends a confirmation email and gives you access to listing details, thumbnails, health checks, and analytics. Keep the HTTP file or DNS record in place: Glama periodically checks it and ownership remains verified while the token is discoverable.
The HTTP ownership file has this structure:
{
"$schema": "https://glama.ai/mcp/schemas/connector.json",
"claim": "glama_claim_..."
}Claim tokens are opaque, stable, and bound to the signed-in Glama account. They contain no email address or other personal information. If Glama can no longer discover a verified HTTP or DNS token, it starts a seven-day grace period before removing claim-based access. Restore the same token during that period to keep ownership verified. Never publish an email address, Glama session token, GitHub token, or connector credential as ownership proof.
If verification fails, confirm that you copied the current token exactly. The HTTP file must be public, return valid JSON with a successful HTTP response, and stay on the connector's origin. DNS changes may need more time to propagate. A claim cannot transfer to a different origin or hostname: if the connector target changes, Glama starts the grace period and the new target must be claimed separately after the previous claim is released.
For a connector linked to the official MCP Registry, registry updates continue to replace its name, description, and URL by default. After claiming, open Manage connector and enable Use Glama listing details as the source of truth if edits made on Glama should be preserved. Categories and thumbnails are always managed on Glama; registry linkage and technical connection settings continue to sync.
Control your server's listing on Glama, including description and metadata
Access analytics and receive server usage reports
Get monitoring and health status updates for your server
Feature your server to boost visibility and reach more users
To improve your MCP server's ranking:
Claim ownership of the server listing
Complete the server profile with an accurate description and thumbnail
Provide a test profile so Glama can connect to and evaluate the server
Keep tool definitions clear and complete to earn a high Tool Definition Quality Score (TDQS)
Route real usage through the Glama Gateway; more recorded successful server uses also improve the ranking
For users:
Full audit trail – every tool call is logged with inputs and outputs for compliance and debugging
Granular tool control – enable or disable individual tools per connector to limit what your AI agents can do
Centralized credential management – store and rotate API keys and OAuth tokens in one place
Change alerts – get notified when a connector changes its schema, adds or removes tools, or updates tool definitions, so nothing breaks silently
For server owners:
Proven adoption – public usage metrics on your listing show real-world traction and build trust with prospective users
Tool-level analytics – see which tools are being used most, helping you prioritize development and documentation
Direct user feedback – users can report issues and suggest improvements through the listing, giving you a channel you would not have otherwise
The connector status is unhealthy when Glama is unable to successfully connect to the server. This can happen for several reasons:
The server is experiencing an outage
The URL of the server is wrong
Credentials required to access the server are missing or invalid
If you are the owner of this MCP connector and would like to make modifications to the listing, including providing test credentials for accessing the server, please contact support@glama.ai.
No comments yet. Be the first to start the discussion!
The Google Compute Engine MCP server is a fully-managed Model Context Protocol server that provides tools to manage Google Compute Engine resources through AI agents. It enables capabilities including instance management (creating, starting, stopping, resetting, listing), disk management, handling instance templates and group managers, viewing machine and accelerator types, managing images, and accessing reservation and commitment information. The server operates as a zero-deployment, enterprise-grade endpoint at https://compute.googleapis.com/mcp with built-in IAM-based security.
The BigQuery remote MCP server is a fully managed service that uses the Model Context Protocol to connect AI applications and LLMs to BigQuery data sources. It provides secure, standardized tools for AI agents to list datasets and tables, retrieve schemas, generate and execute SQL queries through natural language, and analyze data—enabling direct access to enterprise analytics data without requiring manual SQL coding.
The Google Maps MCP server is a fully-managed server provided by the Maps Grounding Lite API that connects AI applications to Google Maps Platform services. It provides three main tools for building LLM applications: searching for places, looking up weather information, and computing routes with details like distance and travel time. The server acts as a proxy that translates Google Maps data into a format that AI applications can understand, enabling agents to accurately answer real-world location and travel queries.
The CustomGPT.ai MCP server is a fully managed, RAG-powered endpoint that connects large language models with private knowledge bases and external data sources. It provides tools for retrieval-augmented generation queries (send_message), data ingestion (upload_file), and source listing, enabling AI agents to query private documents like PDFs with high accuracy and real-time citations.
Add one secure layer between your agents and this server.
Most tools target distinct actions and resources, but a few pairs could confuse agents, such as get_cluster (GKE cluster details) vs get_k8s_cluster_info (kubectl cluster-info), or apply_k8s_manifest vs patch_k8s_resource. Overall, descriptions help clarify the differences.
All tools follow a consistent verb_noun pattern in lowercase snake_case (e.g., create_cluster, list_node_pools, get_k8s_logs). There are no mixed conventions or unpredictable naming variations.
With 23 tools, the server covers both GKE cluster management and in-cluster Kubernetes operations, which justifies the count. It is slightly on the heavier side but remains within a reasonable scope for such a broad domain.
The tool surface covers create, read, update, and list operations for clusters and node pools, but notably lacks delete_cluster and delete_node_pool. This leaves an obvious lifecycle gap that agents cannot work around without additional tooling.
