--- title: "PUT /v1/projects/{projectId}/zones/{zone}/clusters/{clusterId}" method: PUT path: "/v1/projects/{projectId}/zones/{zone}/clusters/{clusterId}" tags: ["projects"] --- # PUT /v1/projects/{projectId}/zones/{zone}/clusters/{clusterId} `PUT /v1/projects/{projectId}/zones/{zone}/clusters/{clusterId}` Updates the settings of a specific cluster. ## Path parameters - `projectId` string, required - `zone` string, required - `clusterId` string, required ## Request body - UpdateClusterRequest — UpdateClusterRequest updates the settings of a cluster. - `zone` string — Deprecated. The name of the Google Compute Engine [zone](https://cloud.google.com/compute/docs/zones#available) in which the cluster resides. This field has been deprecated and replaced by the name field. - `projectId` string — Deprecated. The Google Developers Console [project ID or project number](https://cloud.google.com/resource-manager/docs/creating-managing-projects). This field has been deprecated and replaced by the name field. - `clusterId` string — Deprecated. The name of the cluster to upgrade. This field has been deprecated and replaced by the name field. - `name` string — The name (project, location, cluster) of the cluster to update. Specified in the format `projects/*/locations/*/clusters/*`. - `update` ClusterUpdate — ClusterUpdate describes an update to the cluster. Exactly one update can be applied to a cluster with each request, so at most one field can be provided. - `desiredControlPlaneEndpointsConfig` ControlPlaneEndpointsConfig — Configuration for all of the cluster's control plane endpoints. - `dnsEndpointConfig` DNSEndpointConfig — Describes the configuration of a DNS endpoint. - `enableK8sCertsViaDns` boolean — Controls whether the k8s certs auth is allowed via DNS. - `endpoint` string — Output only. The cluster's DNS endpoint configuration. A DNS format address. This is accessible from the public internet. Ex: uid.us-central1.gke.goog. Always present, but the behavior may change according to the value of DNSEndpointConfig.allow_external_traffic. - `allowExternalTraffic` boolean — Controls whether user traffic is allowed over this endpoint. Note that Google-managed services may still use the endpoint even if this is false. - `enableK8sTokensViaDns` boolean — Controls whether the k8s token auth is allowed via DNS. - `ipEndpointsConfig` IPEndpointsConfig — IP endpoints configuration. - `enabled` boolean — Controls whether to allow direct IP access. - `globalAccess` boolean — Controls whether the control plane's private endpoint is accessible from sources in other regions. It is invalid to specify both PrivateClusterMasterGlobalAccessConfig.enabled and this field at the same time. - `authorizedNetworksConfig` MasterAuthorizedNetworksConfig — Configuration options for the master authorized networks feature. Enabled master authorized networks will disallow all external traffic to access Kubernetes master through HTTPS except traffic from the given CIDR blocks, Google Compute Engine Public IPs and Google Prod IPs. - `enabled` boolean — Whether or not master authorized networks is enabled. - `cidrBlocks` CidrBlock[] — cidr_blocks define up to 50 external networks that could access Kubernetes master through HTTPS. - `displayName` string — display_name is an optional field for users to identify CIDR blocks. - `cidrBlock` string — cidr_block must be specified in CIDR notation. - `gcpPublicCidrsAccessEnabled` boolean — Whether master is accessible via Google Compute Engine Public IP addresses. - `privateEndpointEnforcementEnabled` boolean — Whether master authorized networks is enforced on private endpoint or not. - `publicEndpoint` string — Output only. The external IP address of this cluster's control plane. Only populated if enabled. - `enablePublicEndpoint` boolean — Controls whether the control plane allows access through a public IP. It is invalid to specify both PrivateClusterConfig.enablePrivateEndpoint and this field at the same time. - `privateEndpointSubnetwork` string — Subnet to provision the master's private endpoint during cluster creation. Specified in projects/*/regions/*/subnetworks/* format. It is invalid to specify both PrivateClusterConfig.privateEndpointSubnetwork and this field at the same time. - `privateEndpoint` string — Output only. The internal IP address of this cluster's control plane. Only populated if enabled. - `desiredNodePoolAutoscaling` NodePoolAutoscaling — NodePoolAutoscaling contains information required by cluster autoscaler to adjust the size of the node pool to the current cluster usage. - `locationPolicy` 'LOCATION_POLICY_UNSPECIFIED' | 'BALANCED' | 'ANY' — Location policy used when scaling up a node pool. - `enabled` boolean — Is autoscaling enabled for this node pool. - `totalMinNodeCount` integer — Minimum number of nodes in the node pool. Must be greater than or equal to 0 and less than or equal to total_max_node_count. The total_*_node_count fields are mutually exclusive with the *_node_count fields. - `minNodeCount` integer — Minimum number of nodes for one location in the node pool. Must be greater than or equal to 0 and less than or equal to max_node_count. - `totalMaxNodeCount` integer — Maximum number of nodes in the node pool. Must be greater than or equal to total_min_node_count. There has to be enough quota to scale up the cluster. The total_*_node_count fields are mutually exclusive with the *_node_count fields. - `autoprovisioned` boolean — Can this node pool be deleted automatically. - `maxNodeCount` integer — Maximum number of nodes for one location in the node pool. Must be >= min_node_count. There has to be enough quota to scale up the cluster. - `desiredDnsConfig` DNSConfig — DNSConfig contains the desired set of options for configuring clusterDNS. - `clusterDnsScope` 'DNS_SCOPE_UNSPECIFIED' | 'CLUSTER_SCOPE' | 'VPC_SCOPE' — cluster_dns_scope indicates the scope of access to cluster DNS records. - `additiveVpcScopeDnsDomain` string — Optional. The domain used in Additive VPC scope. - `clusterDns` 'PROVIDER_UNSPECIFIED' | 'PLATFORM_DEFAULT' | 'CLOUD_DNS' | 'KUBE_DNS' — cluster_dns indicates which in-cluster DNS provider should be used. - `clusterDnsDomain` string — cluster_dns_domain is the suffix used for all cluster service records. - `desiredEnableFqdnNetworkPolicy` boolean — Enable/Disable FQDN Network Policy for the cluster. - `userManagedKeysConfig` UserManagedKeysConfig — UserManagedKeysConfig holds the resource address to Keys which are used for signing certs and token that are used for communication within cluster. - `clusterCa` string — The Certificate Authority Service caPool to use for the cluster CA in this cluster. - `etcdPeerCa` string — Resource path of the Certificate Authority Service caPool to use for the etcd peer CA in this cluster. - `serviceAccountSigningKeys` string[] — The Cloud KMS cryptoKeyVersions to use for signing service account JWTs issued by this cluster. Format: `projects/{project}/locations/{location}/keyRings/{keyring}/cryptoKeys/{cryptoKey}/cryptoKeyVersions/{cryptoKeyVersion}` - `gkeopsEtcdBackupEncryptionKey` string — Resource path of the Cloud KMS cryptoKey to use for encryption of internal etcd backups. - `serviceAccountVerificationKeys` string[] — The Cloud KMS cryptoKeyVersions to use for verifying service account JWTs issued by this cluster. Format: `projects/{project}/locations/{location}/keyRings/{keyring}/cryptoKeys/{cryptoKey}/cryptoKeyVersions/{cryptoKeyVersion}` - `controlPlaneDiskEncryptionKey` string — The Cloud KMS cryptoKey to use for Confidential Hyperdisk on the control plane nodes. - `etcdApiCa` string — Resource path of the Certificate Authority Service caPool to use for the etcd API CA in this cluster. - `controlPlaneDiskEncryptionKeyVersions` string[] — Output only. All of the versions of the Cloud KMS cryptoKey that are used by Confidential Hyperdisks on the control plane nodes. - `aggregationCa` string — The Certificate Authority Service caPool to use for the aggregation CA in this cluster. - `desiredFleet` Fleet — Fleet is the fleet configuration for the cluster. - `preRegistered` boolean — Output only. Whether the cluster has been registered through the fleet API. - `membership` string — Output only. The full resource name of the registered fleet membership of the cluster, in the format `//gkehub.googleapis.com/projects/*/locations/*/memberships/*`. - `membershipType` 'MEMBERSHIP_TYPE_UNSPECIFIED' | 'LIGHTWEIGHT' — The type of the cluster's fleet membership. - `project` string — The Fleet host project(project ID or project number) where this cluster will be registered to. This field cannot be changed after the cluster has been registered. - `desiredAutopilotWorkloadPolicyConfig` WorkloadPolicyConfig — WorkloadPolicyConfig is the configuration related to GCW workload policy - `allowNetAdmin` boolean — If true, workloads can use NET_ADMIN capability. - `autopilotCompatibilityAuditingEnabled` boolean — If true, enables the GCW Auditor that audits workloads on standard clusters. - `desiredMasterVersion` string — The Kubernetes version to change the master to. Users may specify either explicit versions offered by Kubernetes Engine or version aliases, which have the following behavior: - "latest": picks the highest valid Kubernetes version - "1.X": picks the highest valid patch+gke.N patch in the 1.X version - "1.X.Y": picks the highest valid gke.N patch in the 1.X.Y version - "1.X.Y-gke.N": picks an explicit Kubernetes version - "-": picks the default Kubernetes version - `desiredStackType` 'STACK_TYPE_UNSPECIFIED' | 'IPV4' | 'IPV4_IPV6' — The desired stack type of the cluster. If a stack type is provided and does not match the current stack type of the cluster, update will attempt to change the stack type to the new type. - `desiredInTransitEncryptionConfig` 'IN_TRANSIT_ENCRYPTION_CONFIG_UNSPECIFIED' | 'IN_TRANSIT_ENCRYPTION_DISABLED' | 'IN_TRANSIT_ENCRYPTION_INTER_NODE_TRANSPARENT' — Specify the details of in-transit encryption. - `desiredImageType` string — The desired image type for the node pool. NOTE: Set the "desired_node_pool" field as well. - `desiredNodePoolAutoConfigKubeletConfig` NodeKubeletConfig — Node kubelet configs. - `insecureKubeletReadonlyPortEnabled` boolean — Enable or disable Kubelet read only port. - `crashLoopBackOff` CrashLoopBackOffConfig — Contains config to modify node-level parameters for container restart behavior. - `maxContainerRestartPeriod` string — Optional. The maximum duration the backoff delay can accrue to for container restarts, minimum 1 second, maximum 300 seconds. If not set, defaults to the internal crashloopbackoff maximum. The string must be a sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". See https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#configurable-container-restart-delay for more details. - `imageGcLowThresholdPercent` integer — Optional. Defines the percent of disk usage before which image garbage collection is never run. Lowest disk usage to garbage collect to. The percent is calculated as this field value out of 100. The value must be between 10 and 85, inclusive and smaller than image_gc_high_threshold_percent. The default value is 80 if unspecified. - `imageMaximumGcAge` string — Optional. Defines the maximum age an image can be unused before it is garbage collected. The string must be a sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300s", "1.5h", and "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". The value must be a positive duration greater than image_minimum_gc_age or "0s". The default value is "0s" if unspecified, which disables this field, meaning images won't be garbage collected based on being unused for too long. - `cpuManagerPolicy` string — Control the CPU management policy on the node. See https://kubernetes.io/docs/tasks/administer-cluster/cpu-management-policies/ The following values are allowed. * "none": the default, which represents the existing scheduling behavior. * "static": allows pods with certain resource characteristics to be granted increased CPU affinity and exclusivity on the node. The default value is 'none' if unspecified. - `cpuCfsQuota` boolean — Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified. - `evictionMinimumReclaim` EvictionMinimumReclaim — Eviction minimum reclaims are the resource amounts of minimum reclaims for each eviction signal. - `memoryAvailable` string — Optional. Minimum reclaim for eviction due to memory available signal. Only take percentage value for now. Sample format: "10%". Must be <=10%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals - `imagefsInodesFree` string — Optional. Minimum reclaim for eviction due to imagefs inodes free signal. Only take percentage value for now. Sample format: "10%". Must be <=10%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals - `nodefsAvailable` string — Optional. Minimum reclaim for eviction due to nodefs available signal. Only take percentage value for now. Sample format: "10%". Must be <=10%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals - `imagefsAvailable` string — Optional. Minimum reclaim for eviction due to imagefs available signal. Only take percentage value for now. Sample format: "10%". Must be <=10%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals - `pidAvailable` string — Optional. Minimum reclaim for eviction due to pid available signal. Only take percentage value for now. Sample format: "10%". Must be <=10%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals - `nodefsInodesFree` string — Optional. Minimum reclaim for eviction due to nodefs inodes free signal. Only take percentage value for now. Sample format: "10%". Must be <=10%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals - `allowedUnsafeSysctls` string[] — Optional. Defines a comma-separated allowlist of unsafe sysctls or sysctl patterns (ending in `*`). The unsafe namespaced sysctl groups are `kernel.shm*`, `kernel.msg*`, `kernel.sem`, `fs.mqueue.*`, and `net.*`. Leaving this allowlist empty means they cannot be set on Pods. To allow certain sysctls or sysctl patterns to be set on Pods, list them separated by commas. For example: `kernel.msg*,net.ipv4.route.min_pmtu`. See https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ for more details. - `evictionSoft` EvictionSignals — Eviction signals are the current state of a particular resource at a specific point in time. The kubelet uses eviction signals to make eviction decisions by comparing the signals to eviction thresholds, which are the minimum amount of the resource that should be available on the node. - `memoryAvailable` string — Optional. Memory available (i.e. capacity - workingSet), in bytes. Defines the amount of "memory.available" signal in kubelet. Default is unset, if not specified in the kubelet config. Format: positive number + unit, e.g. 100Ki, 10Mi, 5Gi. Valid units are Ki, Mi, Gi. Must be >= 100Mi and <= 50% of the node's memory. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals - `imagefsInodesFree` string — Optional. Amount of inodes available on filesystem that container runtime uses for storing images layers. Defines the amount of "imagefs.inodesFree" signal in kubelet. Default is unset, if not specified in the kubelet config. Linux only. It takses percentage value for now. Sample format: "30%". Must be >= 5% and <= 50%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals - `nodefsAvailable` string — Optional. Amount of storage available on filesystem that kubelet uses for volumes, daemon logs, etc. Defines the amount of "nodefs.available" signal in kubelet. Default is unset, if not specified in the kubelet config. It takses percentage value for now. Sample format: "30%". Must be >= 10% and <= 50%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals - `imagefsAvailable` string — Optional. Amount of storage available on filesystem that container runtime uses for storing images layers. If the container filesystem and image filesystem are not separate, then imagefs can store both image layers and writeable layers. Defines the amount of "imagefs.available" signal in kubelet. Default is unset, if not specified in the kubelet config. It takses percentage value for now. Sample format: "30%". Must be >= 15% and <= 50%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals - `pidAvailable` string — Optional. Amount of PID available for pod allocation. Defines the amount of "pid.available" signal in kubelet. Default is unset, if not specified in the kubelet config. It takses percentage value for now. Sample format: "30%". Must be >= 10% and <= 50%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals - `nodefsInodesFree` string — Optional. Amount of inodes available on filesystem that kubelet uses for volumes, daemon logs, etc. Defines the amount of "nodefs.inodesFree" signal in kubelet. Default is unset, if not specified in the kubelet config. Linux only. It takses percentage value for now. Sample format: "30%". Must be >= 5% and <= 50%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals - `podPidsLimit` string, int64 — Set the Pod PID limits. See https://kubernetes.io/docs/concepts/policy/pid-limiting/#pod-pid-limits Controls the maximum number of processes allowed to run in a pod. The value must be greater than or equal to 1024 and less than 4194304. - `imageGcHighThresholdPercent` integer — Optional. Defines the percent of disk usage after which image garbage collection is always run. The percent is calculated as this field value out of 100. The value must be between 10 and 85, inclusive and greater than image_gc_low_threshold_percent. The default value is 85 if unspecified. - `shutdownGracePeriodCriticalPodsSeconds` integer — Optional. shutdown_grace_period_critical_pods_seconds is the maximum allowed grace period (in seconds) used to terminate critical pods during a node shutdown. This value should be <= shutdown_grace_period_seconds, and is only valid if shutdown_grace_period_seconds is set. https://kubernetes.io/docs/concepts/cluster-administration/node-shutdown/ Range: [0, 120]. - `imageMinimumGcAge` string — Optional. Defines the minimum age for an unused image before it is garbage collected. The string must be a sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300s", "1.5h", and "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". The value must be a positive duration less than or equal to 2 minutes. The default value is "2m0s" if unspecified. - `singleProcessOomKill` boolean — Optional. Defines whether to enable single process OOM killer. If true, will prevent the memory.oom.group flag from being set for container cgroups in cgroups v2. This causes processes in the container to be OOM killed individually instead of as a group. - `evictionMaxPodGracePeriodSeconds` integer — Optional. eviction_max_pod_grace_period_seconds is the maximum allowed grace period (in seconds) to use when terminating pods in response to a soft eviction threshold being met. This value effectively caps the Pod's terminationGracePeriodSeconds value during soft evictions. Default: 0. Range: [0, 300]. - `evictionSoftGracePeriod` EvictionGracePeriod — Eviction grace periods are grace periods for each eviction signal. - `nodefsAvailable` string — Optional. Grace period for eviction due to nodefs available signal. Sample format: "10s". Must be >= 0. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals - `imagefsAvailable` string — Optional. Grace period for eviction due to imagefs available signal. Sample format: "10s". Must be >= 0. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals - `pidAvailable` string — Optional. Grace period for eviction due to pid available signal. Sample format: "10s". Must be >= 0. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals - `nodefsInodesFree` string — Optional. Grace period for eviction due to nodefs inodes free signal. Sample format: "10s". Must be >= 0. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals - `memoryAvailable` string — Optional. Grace period for eviction due to memory available signal. Sample format: "10s". Must be >= 0. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals - `imagefsInodesFree` string — Optional. Grace period for eviction due to imagefs inodes free signal. Sample format: "10s". Must be >= 0. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals - `maxParallelImagePulls` integer — Optional. Defines the maximum number of image pulls in parallel. The range is 2 to 5, inclusive. The default value is 2 or 3 depending on the disk type. See https://kubernetes.io/docs/concepts/containers/images/#maximum-parallel-image-pulls for more details. - `containerLogMaxSize` string — Optional. Defines the maximum size of the container log file before it is rotated. See https://kubernetes.io/docs/concepts/cluster-administration/logging/#log-rotation Valid format is positive number + unit, e.g. 100Ki, 10Mi. Valid units are Ki, Mi, Gi. The value must be between 10Mi and 500Mi, inclusive. Note that the total container log size (container_log_max_size * container_log_max_files) cannot exceed 1% of the total storage of the node, to avoid disk pressure caused by log files. The default value is 10Mi if unspecified. - `shutdownGracePeriodSeconds` integer — Optional. shutdown_grace_period_seconds is the maximum allowed grace period (in seconds) the total duration that the node should delay the shutdown during a graceful shutdown. This is the total grace period for pod termination for both regular and critical pods. https://kubernetes.io/docs/concepts/cluster-administration/node-shutdown/ If set to 0, node will not enable the graceful node shutdown functionality. This field is only valid for Spot VMs. Allowed values: 0, 30, 120. - `memoryManager` MemoryManager — The option enables the Kubernetes NUMA-aware Memory Manager feature. Detailed description about the feature can be found [here](https://kubernetes.io/docs/tasks/administer-cluster/memory-manager/). - `policy` string — Controls the memory management policy on the Node. See https://kubernetes.io/docs/tasks/administer-cluster/memory-manager/#policies The following values are allowed. * "none" * "static" The default value is 'none' if unspecified. - `topologyManager` TopologyManager — TopologyManager defines the configuration options for the [`kubelet` Topology Manager component](https://kubernetes.io/docs/tasks/administer-cluster/topology-manager/). For more information about the supported machine types and versions for the Topology Manager in GKE, see [Customizing node system configuration](https://docs.cloud.google.com/kubernetes-engine/docs/how-to/node-system-config#kubelet-resource-managers). - `scope` string — The Topology Manager aligns resources in following scopes: * container * pod The default scope is 'container' if unspecified. See https://kubernetes.io/docs/tasks/administer-cluster/topology-manager/#topology-manager-scopes - `policy` string — Configures the strategy for resource alignment. Allowed values are: * none: the default policy, and does not perform any topology alignment. * restricted: the topology manager stores the preferred NUMA node affinity for the container, and will reject the pod if the affinity if not preferred. * best-effort: the topology manager stores the preferred NUMA node affinity for the container. If the affinity is not preferred, the topology manager will admit the pod to the node anyway. * single-numa-node: the topology manager determines if the single NUMA node affinity is possible. If it is, Topology Manager will store this and the Hint Providers can then use this information when making the resource allocation decision. If, however, this is not possible then the Topology Manager will reject the pod from the node. This will result in a pod in a Terminated state with a pod admission failure. The default policy value is 'none' if unspecified. Details about each strategy can be found [here](https://kubernetes.io/docs/tasks/administer-cluster/topology-manager/#topology-manager-policies). - `cpuCfsQuotaPeriod` string — Set the CPU CFS quota period value 'cpu.cfs_period_us'. The string must be a sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". The value must be a positive duration between 1ms and 1 second, inclusive. - `containerLogMaxFiles` integer — Optional. Defines the maximum number of container log files that can be present for a container. See https://kubernetes.io/docs/concepts/cluster-administration/logging/#log-rotation The value must be an integer between 2 and 10, inclusive. The default value is 5 if unspecified. - `desiredAdditionalIpRangesConfig` DesiredAdditionalIPRangesConfig — DesiredAdditionalIPRangesConfig is a wrapper used for cluster update operation and contains multiple AdditionalIPRangesConfigs. - `additionalIpRangesConfigs` AdditionalIPRangesConfig[] — List of additional IP ranges configs where each AdditionalIPRangesConfig corresponds to one subnetwork's IP ranges - `subnetwork` string — Name of the subnetwork. This can be the full path of the subnetwork or just the name. Example1: my-subnet Example2: projects/gke-project/regions/us-central1/subnetworks/my-subnet - `podIpv4RangeNames` string[] — List of secondary ranges names within this subnetwork that can be used for pod IPs. Example1: gke-pod-range1 Example2: gke-pod-range1,gke-pod-range2 - `status` 'STATUS_UNSPECIFIED' | 'ACTIVE' | 'DRAINING' — Draining status of the additional subnet. - `desiredDisableL4LbFirewallReconciliation` boolean — Enable/Disable L4 LB VPC firewall reconciliation for the cluster. - `desiredDatapathProvider` 'DATAPATH_PROVIDER_UNSPECIFIED' | 'LEGACY_DATAPATH' | 'ADVANCED_DATAPATH' — The desired datapath provider for the cluster. - `desiredGatewayApiConfig` GatewayAPIConfig — GatewayAPIConfig contains the desired config of Gateway API on this cluster. - `channel` 'CHANNEL_UNSPECIFIED' | 'CHANNEL_DISABLED' | 'CHANNEL_EXPERIMENTAL' | 'CHANNEL_STANDARD' — The Gateway API release channel to use for Gateway API. - `desiredEnablePrivateEndpoint` boolean — Enable/Disable private endpoint for the cluster's master. Deprecated: Use desired_control_plane_endpoints_config.ip_endpoints_config.enable_public_endpoint instead. Note that the value of enable_public_endpoint is reversed: if enable_private_endpoint is false, then enable_public_endpoint will be true. - `enableK8sBetaApis` K8sBetaAPIConfig — K8sBetaAPIConfig , configuration for beta APIs - `enabledApis` string[] — Enabled k8s beta APIs. - `desiredRollbackSafeUpgrade` RollbackSafeUpgrade — RollbackSafeUpgrade is the configuration for the rollback safe upgrade. - `controlPlaneSoakDuration` string, google-duration — Optional. A user-defined period for the cluster remains in the rollbackable state. ex: {seconds: 21600}. - `desiredClusterAutoscaling` ClusterAutoscaling — ClusterAutoscaling contains global, per-cluster information required by Cluster Autoscaler to automatically adjust the size of the cluster and create/delete node pools based on the current needs. - `autoprovisioningNodePoolDefaults` AutoprovisioningNodePoolDefaults — AutoprovisioningNodePoolDefaults contains defaults for a node pool created by NAP. - `diskSizeGb` integer — Size of the disk attached to each node, specified in GB. The smallest allowed disk size is 10GB. If unspecified, the default disk size is 100GB. - `management` NodeManagement — NodeManagement defines the set of node management services turned on for the node pool. - `autoRepair` boolean — A flag that specifies whether the node auto-repair is enabled for the node pool. If enabled, the nodes in this node pool will be monitored and, if they fail health checks too many times, an automatic repair action will be triggered. - `upgradeOptions` AutoUpgradeOptions — AutoUpgradeOptions defines the set of options for the user to control how the Auto Upgrades will proceed. - `autoUpgradeStartTime` string — Output only. This field is set when upgrades are about to commence with the approximate start time for the upgrades, in [RFC3339](https://www.ietf.org/rfc/rfc3339.txt) text format. - `description` string — Output only. This field is set when upgrades are about to commence with the description of the upgrade. - `autoUpgrade` boolean — A flag that specifies whether node auto-upgrade is enabled for the node pool. If enabled, node auto-upgrade helps keep the nodes in your node pool up to date with the latest release version of Kubernetes. - `upgradeSettings` UpgradeSettings — These upgrade settings control the level of parallelism and the level of disruption caused by an upgrade. maxUnavailable controls the number of nodes that can be simultaneously unavailable. maxSurge controls the number of additional nodes that can be added to the node pool temporarily for the time of the upgrade to increase the number of available nodes. (maxUnavailable + maxSurge) determines the level of parallelism (how many nodes are being upgraded at the same time). Note: upgrades inevitably introduce some disruption since workloads need to be moved from old nodes to new, upgraded ones. Even if maxUnavailable=0, this holds true. (Disruption stays within the limits of PodDisruptionBudget, if it is configured.) Consider a hypothetical node pool with 5 nodes having maxSurge=2, maxUnavailable=1. This means the upgrade process upgrades 3 nodes simultaneously. It creates 2 additional (upgraded) nodes, then it brings down 3 old (not yet upgraded) nodes at the same time. This ensures that there are always at least 4 nodes available. These upgrade settings configure the upgrade strategy for the node pool. Use strategy to switch between the strategies applied to the node pool. If the strategy is ROLLING, use max_surge and max_unavailable to control the level of parallelism and the level of disruption caused by upgrade. 1. maxSurge controls the number of additional nodes that can be added to the node pool temporarily for the time of the upgrade to increase the number of available nodes. 2. maxUnavailable controls the number of nodes that can be simultaneously unavailable. 3. (maxUnavailable + maxSurge) determines the level of parallelism (how many nodes are being upgraded at the same time). If the strategy is BLUE_GREEN, use blue_green_settings to configure the blue-green upgrade related settings. 1. standard_rollout_policy is the default policy. The policy is used to control the way blue pool gets drained. The draining is executed in the batch mode. The batch size could be specified as either percentage of the node pool size or the number of nodes. batch_soak_duration is the soak time after each batch gets drained. 2. node_pool_soak_duration is the soak time after all blue nodes are drained. After this period, the blue pool nodes will be deleted. - `maxUnavailable` integer — The maximum number of nodes that can be simultaneously unavailable during the upgrade process. A node is considered available if its status is Ready. - `maxSurge` integer — The maximum number of nodes that can be created beyond the current size of the node pool during the upgrade process. - `blueGreenSettings` BlueGreenSettings — Settings for blue-green upgrade. - `standardRolloutPolicy` StandardRolloutPolicy — Standard rollout policy is the default policy for blue-green. - … - `autoscaledRolloutPolicy` AutoscaledRolloutPolicy — Autoscaled rollout policy utilizes the cluster autoscaler during blue-green upgrade to scale both the blue and green pools. - … - `nodePoolSoakDuration` string, google-duration — Time needed after draining entire blue pool. After this period, blue pool will be cleaned up. - `strategy` 'NODE_POOL_UPDATE_STRATEGY_UNSPECIFIED' | 'BLUE_GREEN' | 'SURGE' | 'SHORT_LIVED' — Update strategy of the node pool. - `serviceAccount` string — The Google Cloud Platform Service Account to be used by the node VMs. - `shieldedInstanceConfig` ShieldedInstanceConfig — A set of Shielded Instance options. - `enableIntegrityMonitoring` boolean — Defines whether the instance has integrity monitoring enabled. Enables monitoring and attestation of the boot integrity of the instance. The attestation is performed against the integrity policy baseline. This baseline is initially derived from the implicitly trusted boot image when the instance is created. - `enableSecureBoot` boolean — Defines whether the instance has Secure Boot enabled. Secure Boot helps ensure that the system only runs authentic software by verifying the digital signature of all boot components, and halting the boot process if signature verification fails. - `diskType` string — Type of the disk attached to each node (e.g. 'pd-standard', 'pd-ssd' or 'pd-balanced') If unspecified, the default disk type is 'pd-standard' - `imageType` string — The image type to use for NAP created node. Please see https://cloud.google.com/kubernetes-engine/docs/concepts/node-images for available image types. - `insecureKubeletReadonlyPortEnabled` boolean — DEPRECATED. Use NodePoolAutoConfig.NodeKubeletConfig instead. - `bootDiskKmsKey` string — The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption - `minCpuPlatform` string — Deprecated. Minimum CPU platform to be used for NAP created node pools. The instance may be scheduled on the specified or newer CPU platform. Applicable values are the friendly names of CPU platforms, such as minCpuPlatform: Intel Haswell or minCpuPlatform: Intel Sandy Bridge. For more information, read [how to specify min CPU platform](https://cloud.google.com/compute/docs/instances/specify-min-cpu-platform). This field is deprecated, min_cpu_platform should be specified using `cloud.google.com/requested-min-cpu-platform` label selector on the pod. To unset the min cpu platform field pass "automatic" as field value. - `oauthScopes` string[] — Scopes that are used by NAP when creating node pools. - `defaultComputeClassConfig` DefaultComputeClassConfig — DefaultComputeClassConfig defines default compute class configuration. - `enabled` boolean — Enables default compute class. - `resourceLimits` ResourceLimit[] — Contains global constraints regarding minimum and maximum amount of resources in the cluster. - `resourceType` string — Resource name "cpu", "memory" or gpu-specific string. - `minimum` string, int64 — Minimum amount of the resource in the cluster. - `maximum` string, int64 — Maximum amount of the resource in the cluster. - `autoscalingProfile` 'PROFILE_UNSPECIFIED' | 'OPTIMIZE_UTILIZATION' | 'BALANCED' — Defines autoscaling behaviour. - `autoprovisioningLocations` string[] — The list of Google Compute Engine [zones](https://cloud.google.com/compute/docs/zones#available) in which the NodePool's nodes can be created by NAP. - `enableNodeAutoprovisioning` boolean — Enables automatic node pool creation and deletion. - `autopilotGeneralProfile` 'AUTOPILOT_GENERAL_PROFILE_UNSPECIFIED' | 'NO_PERFORMANCE' | 'NONE' — Autopilot general profile for the cluster, which defines the configuration for the cluster. - `desiredNodeKubeletConfig` NodeKubeletConfig — Node kubelet configs. - `insecureKubeletReadonlyPortEnabled` boolean — Enable or disable Kubelet read only port. - `crashLoopBackOff` CrashLoopBackOffConfig — Contains config to modify node-level parameters for container restart behavior. - `maxContainerRestartPeriod` string — Optional. The maximum duration the backoff delay can accrue to for container restarts, minimum 1 second, maximum 300 seconds. If not set, defaults to the internal crashloopbackoff maximum. The string must be a sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". See https://kubernetes.io/docs/concepts/workloads/pods/pod-lifecycle/#configurable-container-restart-delay for more details. - `imageGcLowThresholdPercent` integer — Optional. Defines the percent of disk usage before which image garbage collection is never run. Lowest disk usage to garbage collect to. The percent is calculated as this field value out of 100. The value must be between 10 and 85, inclusive and smaller than image_gc_high_threshold_percent. The default value is 80 if unspecified. - `imageMaximumGcAge` string — Optional. Defines the maximum age an image can be unused before it is garbage collected. The string must be a sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300s", "1.5h", and "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". The value must be a positive duration greater than image_minimum_gc_age or "0s". The default value is "0s" if unspecified, which disables this field, meaning images won't be garbage collected based on being unused for too long. - `cpuManagerPolicy` string — Control the CPU management policy on the node. See https://kubernetes.io/docs/tasks/administer-cluster/cpu-management-policies/ The following values are allowed. * "none": the default, which represents the existing scheduling behavior. * "static": allows pods with certain resource characteristics to be granted increased CPU affinity and exclusivity on the node. The default value is 'none' if unspecified. - `cpuCfsQuota` boolean — Enable CPU CFS quota enforcement for containers that specify CPU limits. This option is enabled by default which makes kubelet use CFS quota (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to enforce container CPU limits. Otherwise, CPU limits will not be enforced at all. Disable this option to mitigate CPU throttling problems while still having your pods to be in Guaranteed QoS class by specifying the CPU limits. The default value is 'true' if unspecified. - `evictionMinimumReclaim` EvictionMinimumReclaim — Eviction minimum reclaims are the resource amounts of minimum reclaims for each eviction signal. - `memoryAvailable` string — Optional. Minimum reclaim for eviction due to memory available signal. Only take percentage value for now. Sample format: "10%". Must be <=10%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals - `imagefsInodesFree` string — Optional. Minimum reclaim for eviction due to imagefs inodes free signal. Only take percentage value for now. Sample format: "10%". Must be <=10%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals - `nodefsAvailable` string — Optional. Minimum reclaim for eviction due to nodefs available signal. Only take percentage value for now. Sample format: "10%". Must be <=10%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals - `imagefsAvailable` string — Optional. Minimum reclaim for eviction due to imagefs available signal. Only take percentage value for now. Sample format: "10%". Must be <=10%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals - `pidAvailable` string — Optional. Minimum reclaim for eviction due to pid available signal. Only take percentage value for now. Sample format: "10%". Must be <=10%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals - `nodefsInodesFree` string — Optional. Minimum reclaim for eviction due to nodefs inodes free signal. Only take percentage value for now. Sample format: "10%". Must be <=10%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals - `allowedUnsafeSysctls` string[] — Optional. Defines a comma-separated allowlist of unsafe sysctls or sysctl patterns (ending in `*`). The unsafe namespaced sysctl groups are `kernel.shm*`, `kernel.msg*`, `kernel.sem`, `fs.mqueue.*`, and `net.*`. Leaving this allowlist empty means they cannot be set on Pods. To allow certain sysctls or sysctl patterns to be set on Pods, list them separated by commas. For example: `kernel.msg*,net.ipv4.route.min_pmtu`. See https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/ for more details. - `evictionSoft` EvictionSignals — Eviction signals are the current state of a particular resource at a specific point in time. The kubelet uses eviction signals to make eviction decisions by comparing the signals to eviction thresholds, which are the minimum amount of the resource that should be available on the node. - `memoryAvailable` string — Optional. Memory available (i.e. capacity - workingSet), in bytes. Defines the amount of "memory.available" signal in kubelet. Default is unset, if not specified in the kubelet config. Format: positive number + unit, e.g. 100Ki, 10Mi, 5Gi. Valid units are Ki, Mi, Gi. Must be >= 100Mi and <= 50% of the node's memory. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals - `imagefsInodesFree` string — Optional. Amount of inodes available on filesystem that container runtime uses for storing images layers. Defines the amount of "imagefs.inodesFree" signal in kubelet. Default is unset, if not specified in the kubelet config. Linux only. It takses percentage value for now. Sample format: "30%". Must be >= 5% and <= 50%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals - `nodefsAvailable` string — Optional. Amount of storage available on filesystem that kubelet uses for volumes, daemon logs, etc. Defines the amount of "nodefs.available" signal in kubelet. Default is unset, if not specified in the kubelet config. It takses percentage value for now. Sample format: "30%". Must be >= 10% and <= 50%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals - `imagefsAvailable` string — Optional. Amount of storage available on filesystem that container runtime uses for storing images layers. If the container filesystem and image filesystem are not separate, then imagefs can store both image layers and writeable layers. Defines the amount of "imagefs.available" signal in kubelet. Default is unset, if not specified in the kubelet config. It takses percentage value for now. Sample format: "30%". Must be >= 15% and <= 50%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals - `pidAvailable` string — Optional. Amount of PID available for pod allocation. Defines the amount of "pid.available" signal in kubelet. Default is unset, if not specified in the kubelet config. It takses percentage value for now. Sample format: "30%". Must be >= 10% and <= 50%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals - `nodefsInodesFree` string — Optional. Amount of inodes available on filesystem that kubelet uses for volumes, daemon logs, etc. Defines the amount of "nodefs.inodesFree" signal in kubelet. Default is unset, if not specified in the kubelet config. Linux only. It takses percentage value for now. Sample format: "30%". Must be >= 5% and <= 50%. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals - `podPidsLimit` string, int64 — Set the Pod PID limits. See https://kubernetes.io/docs/concepts/policy/pid-limiting/#pod-pid-limits Controls the maximum number of processes allowed to run in a pod. The value must be greater than or equal to 1024 and less than 4194304. - `imageGcHighThresholdPercent` integer — Optional. Defines the percent of disk usage after which image garbage collection is always run. The percent is calculated as this field value out of 100. The value must be between 10 and 85, inclusive and greater than image_gc_low_threshold_percent. The default value is 85 if unspecified. - `shutdownGracePeriodCriticalPodsSeconds` integer — Optional. shutdown_grace_period_critical_pods_seconds is the maximum allowed grace period (in seconds) used to terminate critical pods during a node shutdown. This value should be <= shutdown_grace_period_seconds, and is only valid if shutdown_grace_period_seconds is set. https://kubernetes.io/docs/concepts/cluster-administration/node-shutdown/ Range: [0, 120]. - `imageMinimumGcAge` string — Optional. Defines the minimum age for an unused image before it is garbage collected. The string must be a sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300s", "1.5h", and "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". The value must be a positive duration less than or equal to 2 minutes. The default value is "2m0s" if unspecified. - `singleProcessOomKill` boolean — Optional. Defines whether to enable single process OOM killer. If true, will prevent the memory.oom.group flag from being set for container cgroups in cgroups v2. This causes processes in the container to be OOM killed individually instead of as a group. - `evictionMaxPodGracePeriodSeconds` integer — Optional. eviction_max_pod_grace_period_seconds is the maximum allowed grace period (in seconds) to use when terminating pods in response to a soft eviction threshold being met. This value effectively caps the Pod's terminationGracePeriodSeconds value during soft evictions. Default: 0. Range: [0, 300]. - `evictionSoftGracePeriod` EvictionGracePeriod — Eviction grace periods are grace periods for each eviction signal. - `nodefsAvailable` string — Optional. Grace period for eviction due to nodefs available signal. Sample format: "10s". Must be >= 0. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals - `imagefsAvailable` string — Optional. Grace period for eviction due to imagefs available signal. Sample format: "10s". Must be >= 0. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals - `pidAvailable` string — Optional. Grace period for eviction due to pid available signal. Sample format: "10s". Must be >= 0. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals - `nodefsInodesFree` string — Optional. Grace period for eviction due to nodefs inodes free signal. Sample format: "10s". Must be >= 0. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals - `memoryAvailable` string — Optional. Grace period for eviction due to memory available signal. Sample format: "10s". Must be >= 0. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals - `imagefsInodesFree` string — Optional. Grace period for eviction due to imagefs inodes free signal. Sample format: "10s". Must be >= 0. See https://kubernetes.io/docs/concepts/scheduling-eviction/node-pressure-eviction/#eviction-signals - `maxParallelImagePulls` integer — Optional. Defines the maximum number of image pulls in parallel. The range is 2 to 5, inclusive. The default value is 2 or 3 depending on the disk type. See https://kubernetes.io/docs/concepts/containers/images/#maximum-parallel-image-pulls for more details. - `containerLogMaxSize` string — Optional. Defines the maximum size of the container log file before it is rotated. See https://kubernetes.io/docs/concepts/cluster-administration/logging/#log-rotation Valid format is positive number + unit, e.g. 100Ki, 10Mi. Valid units are Ki, Mi, Gi. The value must be between 10Mi and 500Mi, inclusive. Note that the total container log size (container_log_max_size * container_log_max_files) cannot exceed 1% of the total storage of the node, to avoid disk pressure caused by log files. The default value is 10Mi if unspecified. - `shutdownGracePeriodSeconds` integer — Optional. shutdown_grace_period_seconds is the maximum allowed grace period (in seconds) the total duration that the node should delay the shutdown during a graceful shutdown. This is the total grace period for pod termination for both regular and critical pods. https://kubernetes.io/docs/concepts/cluster-administration/node-shutdown/ If set to 0, node will not enable the graceful node shutdown functionality. This field is only valid for Spot VMs. Allowed values: 0, 30, 120. - `memoryManager` MemoryManager — The option enables the Kubernetes NUMA-aware Memory Manager feature. Detailed description about the feature can be found [here](https://kubernetes.io/docs/tasks/administer-cluster/memory-manager/). - `policy` string — Controls the memory management policy on the Node. See https://kubernetes.io/docs/tasks/administer-cluster/memory-manager/#policies The following values are allowed. * "none" * "static" The default value is 'none' if unspecified. - `topologyManager` TopologyManager — TopologyManager defines the configuration options for the [`kubelet` Topology Manager component](https://kubernetes.io/docs/tasks/administer-cluster/topology-manager/). For more information about the supported machine types and versions for the Topology Manager in GKE, see [Customizing node system configuration](https://docs.cloud.google.com/kubernetes-engine/docs/how-to/node-system-config#kubelet-resource-managers). - `scope` string — The Topology Manager aligns resources in following scopes: * container * pod The default scope is 'container' if unspecified. See https://kubernetes.io/docs/tasks/administer-cluster/topology-manager/#topology-manager-scopes - `policy` string — Configures the strategy for resource alignment. Allowed values are: * none: the default policy, and does not perform any topology alignment. * restricted: the topology manager stores the preferred NUMA node affinity for the container, and will reject the pod if the affinity if not preferred. * best-effort: the topology manager stores the preferred NUMA node affinity for the container. If the affinity is not preferred, the topology manager will admit the pod to the node anyway. * single-numa-node: the topology manager determines if the single NUMA node affinity is possible. If it is, Topology Manager will store this and the Hint Providers can then use this information when making the resource allocation decision. If, however, this is not possible then the Topology Manager will reject the pod from the node. This will result in a pod in a Terminated state with a pod admission failure. The default policy value is 'none' if unspecified. Details about each strategy can be found [here](https://kubernetes.io/docs/tasks/administer-cluster/topology-manager/#topology-manager-policies). - `cpuCfsQuotaPeriod` string — Set the CPU CFS quota period value 'cpu.cfs_period_us'. The string must be a sequence of decimal numbers, each with optional fraction and a unit suffix, such as "300ms". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h". The value must be a positive duration between 1ms and 1 second, inclusive. - `containerLogMaxFiles` integer — Optional. Defines the maximum number of container log files that can be present for a container. See https://kubernetes.io/docs/concepts/cluster-administration/logging/#log-rotation The value must be an integer between 2 and 10, inclusive. The default value is 5 if unspecified. - `desiredAutopilotClusterPolicyConfig` ClusterPolicyConfig — ClusterPolicyConfig stores the configuration for cluster wide policies. - `noSystemMutation` boolean — Denotes that preventing creation and mutation of resources in GKE managed namespaces and cluster-scoped GKE managed resources . - `noSystemImpersonation` boolean — Denotes preventing impersonation and CSRs for GKE System users. - `noUnsafeWebhooks` boolean — Denotes preventing unsafe webhooks. - `noStandardNodePools` boolean — Denotes preventing standard node pools and requiring only autopilot node pools. - `desiredDefaultEnablePrivateNodes` boolean — Override the default setting of whether future created nodes have private IP addresses only, namely NetworkConfig.default_enable_private_nodes - `desiredAutoIpamConfig` AutoIpamConfig — AutoIpamConfig contains all information related to Auto IPAM - `enabled` boolean — The flag that enables Auto IPAM on this cluster - `desiredDatabaseEncryption` DatabaseEncryption — Configuration of etcd encryption. - `state` 'UNKNOWN' | 'ENCRYPTED' | 'DECRYPTED' | 'ALL_OBJECTS_ENCRYPTION_ENABLED' — The desired state of etcd encryption. - `keyName` string — Name of CloudKMS key to use for the encryption of secrets in etcd. Ex. projects/my-project/locations/global/keyRings/my-ring/cryptoKeys/my-key - `currentState` 'CURRENT_STATE_UNSPECIFIED' | 'CURRENT_STATE_ENCRYPTED' | 'CURRENT_STATE_DECRYPTED' | 'CURRENT_STATE_ENCRYPTION_PENDING' | 'CURRENT_STATE_ENCRYPTION_ERROR' | 'CURRENT_STATE_DECRYPTION_PENDING' | 'CURRENT_STATE_DECRYPTION_ERROR' | 'CURRENT_STATE_ALL_OBJECTS_ENCRYPTION_ENABLED' | 'CURRENT_STATE_ALL_OBJECTS_ENCRYPTION_PENDING' | 'CURRENT_STATE_ALL_OBJECTS_ENCRYPTION_ERROR' — Output only. The current state of etcd encryption. - `decryptionKeys` string[] — Output only. Keys in use by the cluster for decrypting existing objects, in addition to the key in `key_name`. Each item is a CloudKMS key resource. - `lastOperationErrors` OperationError[] — Output only. Records errors seen during DatabaseEncryption update operations. - `keyName` string — CloudKMS key resource that had the error. - `errorMessage` string — Description of the error seen during the operation. - `timestamp` string, google-datetime — Time when the CloudKMS error was seen. - `desiredAuthenticatorGroupsConfig` AuthenticatorGroupsConfig — Configuration for returning group information from authenticators. - `securityGroup` string — The name of the security group-of-groups to be used. Only relevant if enabled = true. - `enabled` boolean — Whether this cluster should return group membership lookups during authentication using a group of security groups. - `desiredLoggingService` string — The logging service the cluster should use to write logs. Currently available options: * `logging.googleapis.com/kubernetes` - The Cloud Logging service with a Kubernetes-native resource model * `logging.googleapis.com` - The legacy Cloud Logging service (no longer available as of GKE 1.15). * `none` - no logs will be exported from the cluster. If left as an empty string,`logging.googleapis.com/kubernetes` will be used for GKE 1.14+ or `logging.googleapis.com` for earlier versions. - `desiredPrivateClusterConfig` PrivateClusterConfig — Configuration options for private clusters. - `privateEndpoint` string — Output only. The internal IP address of this cluster's master endpoint. Deprecated: Use ControlPlaneEndpointsConfig.IPEndpointsConfig.private_endpoint instead. - `enablePrivateEndpoint` boolean — Whether the master's internal IP address is used as the cluster endpoint. Deprecated: Use ControlPlaneEndpointsConfig.IPEndpointsConfig.enable_public_endpoint instead. Note that the value of enable_public_endpoint is reversed: if enable_private_endpoint is false, then enable_public_endpoint will be true. - `masterIpv4CidrBlock` string — The IP range in CIDR notation to use for the hosted master network. This range will be used for assigning internal IP addresses to the master or set of masters, as well as the ILB VIP. This range must not overlap with any other ranges in use within the cluster's network. - `privateEndpointSubnetwork` string — Subnet to provision the master's private endpoint during cluster creation. Specified in projects/*/regions/*/subnetworks/* format. Deprecated: Use ControlPlaneEndpointsConfig.IPEndpointsConfig.private_endpoint_subnetwork instead. - `publicEndpoint` string — Output only. The external IP address of this cluster's master endpoint. Deprecated:Use ControlPlaneEndpointsConfig.IPEndpointsConfig.public_endpoint instead. - `peeringName` string — Output only. The peering name in the customer VPC used by this cluster. - `masterGlobalAccessConfig` PrivateClusterMasterGlobalAccessConfig — Configuration for controlling master global access settings. - `enabled` boolean — Whenever master is accessible globally or not. - `enablePrivateNodes` boolean — Whether nodes have internal IP addresses only. If enabled, all nodes are given only RFC 1918 private addresses and communicate with the master via private networking. Deprecated: Use NetworkConfig.default_enable_private_nodes instead. - `desiredNodeCreationConfig` NodeCreationConfig — NodeCreationConfig defines the settings of node creation mode. - `nodeCreationMode` 'MODE_UNSPECIFIED' | 'VIA_KUBELET' | 'VIA_CONTROL_PLANE' — The mode of node creation. - `desiredEmulatedVersion` string — Optional. The desired emulated version for the cluster. - `desiredCompliancePostureConfig` CompliancePostureConfig — Deprecated: Compliance Posture is no longer supported. For more details, see https://cloud.google.com/kubernetes-engine/docs/deprecations/posture-management-deprecation. CompliancePostureConfig defines the settings needed to enable/disable features for the Compliance Posture. - `complianceStandards` ComplianceStandard[] — List of enabled compliance standards. - `standard` string — Name of the compliance standard. - `mode` 'MODE_UNSPECIFIED' | 'DISABLED' | 'ENABLED' — Defines the enablement mode for Compliance Posture. - `desiredUserManagedKeysConfig` UserManagedKeysConfig — UserManagedKeysConfig holds the resource address to Keys which are used for signing certs and token that are used for communication within cluster. - `clusterCa` string — The Certificate Authority Service caPool to use for the cluster CA in this cluster. - `etcdPeerCa` string — Resource path of the Certificate Authority Service caPool to use for the etcd peer CA in this cluster. - `serviceAccountSigningKeys` string[] — The Cloud KMS cryptoKeyVersions to use for signing service account JWTs issued by this cluster. Format: `projects/{project}/locations/{location}/keyRings/{keyring}/cryptoKeys/{cryptoKey}/cryptoKeyVersions/{cryptoKeyVersion}` - `gkeopsEtcdBackupEncryptionKey` string — Resource path of the Cloud KMS cryptoKey to use for encryption of internal etcd backups. - `serviceAccountVerificationKeys` string[] — The Cloud KMS cryptoKeyVersions to use for verifying service account JWTs issued by this cluster. Format: `projects/{project}/locations/{location}/keyRings/{keyring}/cryptoKeys/{cryptoKey}/cryptoKeyVersions/{cryptoKeyVersion}` - `controlPlaneDiskEncryptionKey` string — The Cloud KMS cryptoKey to use for Confidential Hyperdisk on the control plane nodes. - `etcdApiCa` string — Resource path of the Certificate Authority Service caPool to use for the etcd API CA in this cluster. - `controlPlaneDiskEncryptionKeyVersions` string[] — Output only. All of the versions of the Cloud KMS cryptoKey that are used by Confidential Hyperdisks on the control plane nodes. - `aggregationCa` string — The Certificate Authority Service caPool to use for the aggregation CA in this cluster. - `desiredServiceExternalIpsConfig` ServiceExternalIPsConfig — Config to block services with externalIPs field. - `enabled` boolean — Whether Services with ExternalIPs field are allowed or not. - `desiredNodeVersion` string — The Kubernetes version to change the nodes to (typically an upgrade). Users may specify either explicit versions offered by Kubernetes Engine or version aliases, which have the following behavior: - "latest": picks the highest valid Kubernetes version - "1.X": picks the highest valid patch+gke.N patch in the 1.X version - "1.X.Y": picks the highest valid gke.N patch in the 1.X.Y version - "1.X.Y-gke.N": picks an explicit Kubernetes version - "-": picks the Kubernetes master version - `desiredResourceUsageExportConfig` ResourceUsageExportConfig — Configuration for exporting cluster resource usages. - `enableNetworkEgressMetering` boolean — Whether to enable network egress metering for this cluster. If enabled, a daemonset will be created in the cluster to meter network egress traffic. - `bigqueryDestination` BigQueryDestination — Parameters for using BigQuery as the destination of resource usage export. - `datasetId` string — The ID of a BigQuery Dataset. - `consumptionMeteringConfig` ConsumptionMeteringConfig — Parameters for controlling consumption metering. - `enabled` boolean — Whether to enable consumption metering for this cluster. If enabled, a second BigQuery table will be created to hold resource consumption records. - `desiredIntraNodeVisibilityConfig` IntraNodeVisibilityConfig — IntraNodeVisibilityConfig contains the desired config of the intra-node visibility on this cluster. - `enabled` boolean — Enables intra node visibility for this cluster. - `desiredMeshCertificates` MeshCertificates — Configuration for issuance of mTLS keys and certificates to Kubernetes pods. - `enableCertificates` boolean — enable_certificates controls issuance of workload mTLS certificates. If set, the GKE Workload Identity Certificates controller and node agent will be deployed in the cluster, which can then be configured by creating a WorkloadCertificateConfig Custom Resource. Requires Workload Identity (workload_pool must be non-empty). - `desiredParentProductConfig` ParentProductConfig — ParentProductConfig is the configuration of the parent product of the cluster. This field is used by Google internal products that are built on top of a GKE cluster and take the ownership of the cluster. - `productName` string — Name of the parent product associated with the cluster. - `labels` object — Labels contain the configuration of the parent product. - `additionalPodRangesConfig` AdditionalPodRangesConfig — AdditionalPodRangesConfig is the configuration for additional pod secondary ranges supporting the ClusterUpdate message. - `podRangeNames` string[] — Name for pod secondary ipv4 range which has the actual range defined ahead. - `podRangeInfo` RangeInfo[] — Output only. Information for additional pod range. - `rangeName` string — Output only. Name of a range. - `utilization` number, double — Output only. The utilization of the range. - `desiredPrivilegedAdmissionConfig` PrivilegedAdmissionConfig — PrivilegedAdmissionConfig stores the list of authorized allowlist paths for the cluster. - `allowlistPaths` string[] — The customer allowlist Cloud Storage paths for the cluster. These paths are used with the `--autopilot-privileged-admission` flag to authorize privileged workloads in Autopilot clusters. Paths can be GKE-owned, in the format `gke:////`, or customer-owned, in the format `gs:///`. Wildcards (`*`) are supported to authorize all allowlists under specific paths or directories. Example: `gs://my-bucket/*` will authorize all allowlists under the `my-bucket` bucket. - `desiredDefaultSnatStatus` DefaultSnatStatus — DefaultSnatStatus contains the desired state of whether default sNAT should be disabled on the cluster. - `disabled` boolean — Disables cluster default sNAT rules. - `etag` string — The current etag of the cluster. If an etag is provided and does not match the current etag of the cluster, update will be blocked and an ABORTED error will be returned. - `desiredBinaryAuthorization` BinaryAuthorization — Configuration for Binary Authorization. - `enabled` boolean — This field is deprecated. Leave this unset and instead configure BinaryAuthorization using evaluation_mode. If evaluation_mode is set to anything other than EVALUATION_MODE_UNSPECIFIED, this field is ignored. - `evaluationMode` 'EVALUATION_MODE_UNSPECIFIED' | 'DISABLED' | 'PROJECT_SINGLETON_POLICY_ENFORCE' — Mode of operation for binauthz policy evaluation. If unspecified, defaults to DISABLED. - `desiredReleaseChannel` ReleaseChannel — ReleaseChannel indicates which release channel a cluster is subscribed to. Release channels are arranged in order of risk. When a cluster is subscribed to a release channel, Google maintains both the master version and the node version. Node auto-upgrade defaults to true and cannot be disabled. - `channel` 'UNSPECIFIED' | 'RAPID' | 'REGULAR' | 'STABLE' | 'EXTENDED' — channel specifies which release channel the cluster is subscribed to. - `desiredLocations` string[] — The desired list of Google Compute Engine [zones](https://cloud.google.com/compute/docs/zones#available) in which the cluster's nodes should be located. This list must always include the cluster's primary zone. Warning: changing cluster locations will update the locations of all node pools and will result in nodes being added and/or removed. - `desiredControlPlaneEgress` ControlPlaneEgress — ControlPlaneEgress defines the settings needed to enable control plane egress control. - `mode` 'MODE_UNSPECIFIED' | 'VIA_CONTROL_PLANE' | 'NONE' — Defines the mode of control plane egress. - `desiredPrivateIpv6GoogleAccess` 'PRIVATE_IPV6_GOOGLE_ACCESS_UNSPECIFIED' | 'PRIVATE_IPV6_GOOGLE_ACCESS_DISABLED' | 'PRIVATE_IPV6_GOOGLE_ACCESS_TO_GOOGLE' | 'PRIVATE_IPV6_GOOGLE_ACCESS_BIDIRECTIONAL' — The desired state of IPv6 connectivity to Google Services. - `desiredNodePoolLoggingConfig` NodePoolLoggingConfig — NodePoolLoggingConfig specifies logging configuration for node pools. - `variantConfig` LoggingVariantConfig — LoggingVariantConfig specifies the behaviour of the logging component. - `variant` 'VARIANT_UNSPECIFIED' | 'DEFAULT' | 'MAX_THROUGHPUT' — Logging variant deployed on nodes. - `gkeAutoUpgradeConfig` GkeAutoUpgradeConfig — GkeAutoUpgradeConfig is the configuration for GKE auto upgrades. - `patchMode` 'PATCH_MODE_UNSPECIFIED' | 'ACCELERATED' — PatchMode specifies how auto upgrade patch builds should be selected. - `desiredNodePoolAutoConfigResourceManagerTags` ResourceManagerTags — A map of resource manager tag keys and values to be attached to the nodes for managing Compute Engine firewalls using Network Firewall Policies. Tags must be according to specifications in https://cloud.google.com/vpc/docs/tags-firewalls-overview#specifications. A maximum of 5 tag key-value pairs can be specified. Existing tags will be replaced with new values. - `tags` object — TagKeyValue must be in one of the following formats ([KEY]=[VALUE]) 1. `tagKeys/{tag_key_id}=tagValues/{tag_value_id}` 2. `{org_id}/{tag_key_name}={tag_value_name}` 3. `{project_id}/{tag_key_name}={tag_value_name}` - `desiredEnableMultiNetworking` boolean — Enable/Disable Multi-Networking for the cluster - `desiredManagedMachineLearningDiagnosticsConfig` ManagedMachineLearningDiagnosticsConfig — ManagedMachineLearningDiagnosticsConfig is the configuration for the GKE Managed Machine Learning Diagnostics pipeline. - `enabled` boolean — Enable/Disable Managed Machine Learning Diagnostics. - `desiredEnterpriseConfig` DesiredEnterpriseConfig — DesiredEnterpriseConfig is a wrapper used for updating enterprise_config. Deprecated: GKE Enterprise features are now available without an Enterprise tier. - `desiredTier` 'CLUSTER_TIER_UNSPECIFIED' | 'STANDARD' | 'ENTERPRISE' — desired_tier specifies the desired tier of the cluster. - `desiredNetworkPerformanceConfig` ClusterNetworkPerformanceConfig — Configuration of network bandwidth tiers - `totalEgressBandwidthTier` 'TIER_UNSPECIFIED' | 'TIER_1' — Specifies the total network bandwidth tier for NodePools in the cluster. - `desiredAnonymousAuthenticationConfig` AnonymousAuthenticationConfig — AnonymousAuthenticationConfig defines the settings needed to limit endpoints that allow anonymous authentication. - `mode` 'MODE_UNSPECIFIED' | 'ENABLED' | 'LIMITED' — Defines the mode of limiting anonymous access in the cluster. - `desiredWorkloadIdentityConfig` WorkloadIdentityConfig — Configuration for the use of Kubernetes Service Accounts in IAM policies. - `workloadPool` string — The workload pool to attach all Kubernetes service accounts to. - `desiredMonitoringConfig` MonitoringConfig — MonitoringConfig is cluster monitoring configuration. - `managedPrometheusConfig` ManagedPrometheusConfig — ManagedPrometheusConfig defines the configuration for Google Cloud Managed Service for Prometheus. - `enabled` boolean — Enable Managed Collection. - `autoMonitoringConfig` AutoMonitoringConfig — AutoMonitoringConfig defines the configuration for GKE Workload Auto-Monitoring. - `scope` 'SCOPE_UNSPECIFIED' | 'ALL' | 'NONE' — Scope for GKE Workload Auto-Monitoring. - `advancedDatapathObservabilityConfig` AdvancedDatapathObservabilityConfig — AdvancedDatapathObservabilityConfig specifies configuration of observability features of advanced datapath. - `enableMetrics` boolean — Expose flow metrics on nodes - `enableRelay` boolean — Enable Relay component - `relayMode` 'RELAY_MODE_UNSPECIFIED' | 'DISABLED' | 'INTERNAL_VPC_LB' | 'EXTERNAL_LB' — Method used to make Relay available - `componentConfig` MonitoringComponentConfig — MonitoringComponentConfig is cluster monitoring component configuration. - `enableComponents` string[] — Select components to collect metrics. An empty set would disable all monitoring. - `desiredContainerdConfig` ContainerdConfig — ContainerdConfig contains configuration to customize containerd. - `registryHosts` RegistryHostConfig[] — RegistryHostConfig configures containerd registry host configuration. Each registry_hosts represents a hosts.toml file. At most 25 registry_hosts are allowed. - `hosts` HostConfig[] — HostConfig configures a list of host-specific configurations for the server. Each server can have at most 10 host configurations. - `header` RegistryHeader[] — Header configures the registry host headers. - `value` string[] — Value configures the header value. - `key` string — Key configures the header key. - `client` CertificateConfigPair[] — Client configures the registry host client certificate and key. - `cert` CertificateConfig — CertificateConfig configures certificate for the registry. - … - `key` CertificateConfig — CertificateConfig configures certificate for the registry. - … - `overridePath` boolean — OverridePath is used to indicate the host's API root endpoint is defined in the URL path rather than by the API specification. This may be used with non-compliant OCI registries which are missing the /v2 prefix. If not set, containerd sets default false. - `host` string — Host configures the registry host/mirror. It supports fully qualified domain names (FQDNs) and IP addresses. Specifying scheme, port or path is supported. Scheme can only be http or https. Wildcards are NOT supported. Examples: - `my.customdomain.com` - `https://my.customdomain.com/path` - `10.0.1.2:5000` - `capabilities` string[] — Capabilities represent the capabilities of the registry host, specifying what operations a host is capable of performing. If not set, containerd enables all capabilities by default. - `dialTimeout` string, google-duration — Specifies the maximum duration allowed for a connection attempt to complete. A shorter timeout helps reduce delays when falling back to the original registry if the mirror is unreachable. Maximum allowed value is 180s. If not set, containerd sets default 30s. The value should be a decimal number of seconds with an `s` suffix. - `ca` CertificateConfig[] — CA configures the registry host certificate. - `gcpSecretManagerSecretUri` string — The URI configures a secret from [Secret Manager](https://cloud.google.com/secret-manager) in the format "projects/$PROJECT_ID/secrets/$SECRET_NAME/versions/$VERSION" for global secret or "projects/$PROJECT_ID/locations/$REGION/secrets/$SECRET_NAME/versions/$VERSION" for regional secret. Version can be fixed (e.g. "2") or "latest" - `server` string — Defines the host name of the registry server, which will be used to create configuration file as /etc/containerd/hosts.d//hosts.toml. It supports fully qualified domain names (FQDN) and IP addresses: Specifying port is supported, while scheme and path are NOT supported. Wildcards are NOT supported. Examples: - `my.customdomain.com` - `10.0.1.2:5000` - `privateRegistryAccessConfig` PrivateRegistryAccessConfig — PrivateRegistryAccessConfig contains access configuration for private container registries. - `enabled` boolean — Private registry access is enabled. - `certificateAuthorityDomainConfig` CertificateAuthorityDomainConfig[] — Private registry access configuration. - `fqdns` string[] — List of fully qualified domain names (FQDN). Specifying port is supported. Wildcards are NOT supported. Examples: - `my.customdomain.com` - `10.0.1.2:5000` - `gcpSecretManagerCertificateConfig` GCPSecretManagerCertificateConfig — GCPSecretManagerCertificateConfig configures a secret from [Secret Manager](https://cloud.google.com/secret-manager). - `secretUri` string — Secret URI, in the form "projects/$PROJECT_ID/secrets/$SECRET_NAME/versions/$VERSION". Version can be fixed (e.g. "2") or "latest" - `writableCgroups` WritableCgroups — Defines writable cgroups configuration. - `enabled` boolean — Optional. Whether writable cgroups is enabled. - `desiredIdentityServiceConfig` IdentityServiceConfig — IdentityServiceConfig is configuration for Identity Service which allows customers to use external identity providers with the K8S API - `enabled` boolean — Whether to enable the Identity Service component - `desiredNodePoolAutoConfigNetworkTags` NetworkTags — Collection of Compute Engine network tags that can be applied to a node's underlying VM instance. - `tags` string[] — List of network tags. - `removedAdditionalPodRangesConfig` AdditionalPodRangesConfig — AdditionalPodRangesConfig is the configuration for additional pod secondary ranges supporting the ClusterUpdate message. - `podRangeNames` string[] — Name for pod secondary ipv4 range which has the actual range defined ahead. - `podRangeInfo` RangeInfo[] — Output only. Information for additional pod range. - `rangeName` string — Output only. Name of a range. - `utilization` number, double — Output only. The utilization of the range. - `desiredLoggingConfig` LoggingConfig — LoggingConfig is cluster logging configuration. - `componentConfig` LoggingComponentConfig — LoggingComponentConfig is cluster logging component configuration. - `enableComponents` string[] — Select components to collect logs. An empty set would disable all logging. - `desiredNetworkTierConfig` NetworkTierConfig — NetworkTierConfig contains network tier information. - `networkTier` 'NETWORK_TIER_UNSPECIFIED' | 'NETWORK_TIER_DEFAULT' | 'NETWORK_TIER_PREMIUM' | 'NETWORK_TIER_STANDARD' — Network tier configuration. - `desiredL4ilbSubsettingConfig` ILBSubsettingConfig — ILBSubsettingConfig contains the desired config of L4 Internal LoadBalancer subsetting on this cluster. - `enabled` boolean — Enables l4 ILB subsetting for this cluster. - `desiredMasterAuthorizedNetworksConfig` MasterAuthorizedNetworksConfig — Configuration options for the master authorized networks feature. Enabled master authorized networks will disallow all external traffic to access Kubernetes master through HTTPS except traffic from the given CIDR blocks, Google Compute Engine Public IPs and Google Prod IPs. - `enabled` boolean — Whether or not master authorized networks is enabled. - `cidrBlocks` CidrBlock[] — cidr_blocks define up to 50 external networks that could access Kubernetes master through HTTPS. - `displayName` string — display_name is an optional field for users to identify CIDR blocks. - `cidrBlock` string — cidr_block must be specified in CIDR notation. - `gcpPublicCidrsAccessEnabled` boolean — Whether master is accessible via Google Compute Engine Public IP addresses. - `privateEndpointEnforcementEnabled` boolean — Whether master authorized networks is enforced on private endpoint or not. - `desiredGcfsConfig` GcfsConfig — GcfsConfig contains configurations of Google Container File System (image streaming). - `enabled` boolean — Whether to use GCFS. - `desiredRbacBindingConfig` RBACBindingConfig — RBACBindingConfig allows user to restrict ClusterRoleBindings an RoleBindings that can be created. - `enableInsecureBindingSystemAuthenticated` boolean — Setting this to true will allow any ClusterRoleBinding and RoleBinding with subjects system:authenticated. - `enableInsecureBindingSystemUnauthenticated` boolean — Setting this to true will allow any ClusterRoleBinding and RoleBinding with subjets system:anonymous or system:unauthenticated. - `desiredNodePoolId` string — The node pool to be upgraded. This field is mandatory if "desired_node_version", "desired_image_family" or "desired_node_pool_autoscaling" is specified and there is more than one node pool on the cluster. - `desiredSecurityPostureConfig` SecurityPostureConfig — SecurityPostureConfig defines the flags needed to enable/disable features for the Security Posture API. - `mode` 'MODE_UNSPECIFIED' | 'DISABLED' | 'BASIC' | 'ENTERPRISE' — Sets which mode to use for Security Posture features. - `vulnerabilityMode` 'VULNERABILITY_MODE_UNSPECIFIED' | 'VULNERABILITY_DISABLED' | 'VULNERABILITY_BASIC' | 'VULNERABILITY_ENTERPRISE' — Sets which mode to use for vulnerability scanning. - `desiredCostManagementConfig` CostManagementConfig — Configuration for fine-grained cost management feature. - `enabled` boolean — Whether the feature is enabled or not. - `desiredVerticalPodAutoscaling` VerticalPodAutoscaling — VerticalPodAutoscaling contains global, per-cluster information required by Vertical Pod Autoscaler to automatically adjust the resources of pods controlled by it. - `enabled` boolean — Enables vertical pod autoscaling. - `desiredShieldedNodes` ShieldedNodes — Configuration of Shielded Nodes feature. - `enabled` boolean — Whether Shielded Nodes features are enabled on all nodes in this cluster. - `desiredEnableCiliumClusterwideNetworkPolicy` boolean — Enable/Disable Cilium Clusterwide Network Policy for the cluster. - `desiredAddonsConfig` AddonsConfig — Configuration for the addons that can be automatically spun up in the cluster, enabling additional functionality. - `configConnectorConfig` ConfigConnectorConfig — Configuration options for the Config Connector add-on. - `enabled` boolean — Whether Cloud Connector is enabled for this cluster. - `gcpFilestoreCsiDriverConfig` GcpFilestoreCsiDriverConfig — Configuration for the Filestore CSI driver. - `enabled` boolean — Whether the Filestore CSI driver is enabled for this cluster. - `kubernetesDashboard` KubernetesDashboard — Configuration for the Kubernetes Dashboard. - `disabled` boolean — Whether the Kubernetes Dashboard is enabled for this cluster. - `statefulHaConfig` StatefulHAConfig — Configuration for the Stateful HA add-on. - `enabled` boolean — Whether the Stateful HA add-on is enabled for this cluster. - `slurmOperatorConfig` SlurmOperatorConfig — Configuration for the Slurm Operator. - `enabled` boolean — When enabled, it runs a Slurm Operator that manages the set of compute pods for Slurm Cluster. - `nodeReadinessConfig` NodeReadinessConfig — Configuration for the GKE Node Readiness Controller. - `enabled` boolean — Optional. Whether the GKE Node Readiness Controller is enabled for this cluster. - `agentSandboxConfig` AgentSandboxConfig — Configuration for the AgentSandbox addon. - `enabled` boolean — Optional. Whether AgentSandbox is enabled for this cluster. - `horizontalPodAutoscaling` HorizontalPodAutoscaling — Configuration options for the horizontal pod autoscaling feature, which increases or decreases the number of replica pods a replication controller has based on the resource usage of the existing pods. - `disabled` boolean — Whether the Horizontal Pod Autoscaling feature is enabled in the cluster. When enabled, it ensures that metrics are collected into Stackdriver Monitoring. - `gkeBackupAgentConfig` GkeBackupAgentConfig — Configuration for the Backup for GKE Agent. - `enabled` boolean — Whether the Backup for GKE agent is enabled for this cluster. - `networkPolicyConfig` NetworkPolicyConfig — Configuration for NetworkPolicy. This only tracks whether the addon is enabled or not on the Master, it does not track whether network policy is enabled for the nodes. - `disabled` boolean — Whether NetworkPolicy is enabled for this cluster. - `lustreCsiDriverConfig` LustreCsiDriverConfig — Configuration for the Lustre CSI driver. - `enabled` boolean — Whether the Lustre CSI driver is enabled for this cluster. - `enableLegacyLustrePort` boolean — If set to true, the Lustre CSI driver will install Lustre kernel modules using port 6988. This serves as a workaround for a port conflict with the gke-metadata-server. This field is required ONLY under the following conditions: 1. The GKE node version is older than 1.33.2-gke.4655000. 2. You're connecting to a Lustre instance that has the 'gke-support-enabled' flag. Deprecated: This flag is no longer required as of GKE node version 1.33.2-gke.4655000, unless you are connecting to a Lustre instance that has the `gke-support-enabled` flag. - `disableMultiNic` boolean — When set to true, this disables multi-NIC support for the Lustre CSI driver. By default, GKE enables multi-NIC support, which allows the Lustre CSI driver to automatically detect and configure all suitable network interfaces on a node to maximize I/O performance for demanding workloads. - `cloudRunConfig` CloudRunConfig — Configuration options for the Cloud Run feature. - `disabled` boolean — Whether Cloud Run addon is enabled for this cluster. - `loadBalancerType` 'LOAD_BALANCER_TYPE_UNSPECIFIED' | 'LOAD_BALANCER_TYPE_EXTERNAL' | 'LOAD_BALANCER_TYPE_INTERNAL' — Which load balancer type is installed for Cloud Run. - `gcePersistentDiskCsiDriverConfig` GcePersistentDiskCsiDriverConfig — Configuration for the Compute Engine PD CSI driver. - `enabled` boolean — Whether the Compute Engine PD CSI driver is enabled for this cluster. - `httpLoadBalancing` HttpLoadBalancing — Configuration options for the HTTP (L7) load balancing controller addon, which makes it easy to set up HTTP load balancers for services in a cluster. - `disabled` boolean — Whether the HTTP Load Balancing controller is enabled in the cluster. When enabled, it runs a small pod in the cluster that manages the load balancers. - `parallelstoreCsiDriverConfig` ParallelstoreCsiDriverConfig — Configuration for the Cloud Storage Parallelstore CSI driver. - `enabled` boolean — Whether the Cloud Storage Parallelstore CSI driver is enabled for this cluster. - `rayOperatorConfig` RayOperatorConfig — Configuration options for the Ray Operator add-on. - `enabled` boolean — Whether the Ray Operator addon is enabled for this cluster. - `rayClusterMonitoringConfig` RayClusterMonitoringConfig — RayClusterMonitoringConfig specifies monitoring configuration for Ray clusters. - `enabled` boolean — Enable metrics collection for Ray clusters. - `rayClusterLoggingConfig` RayClusterLoggingConfig — RayClusterLoggingConfig specifies configuration of Ray logging. - `enabled` boolean — Enable log collection for Ray clusters. - `sliceControllerConfig` SliceControllerConfig — Configuration for the Slice Controller. - `enabled` boolean — Optional. Indicates whether Slice Controller is enabled in the cluster. - `highScaleCheckpointingConfig` HighScaleCheckpointingConfig — Configuration for the High Scale Checkpointing. - `enabled` boolean — Whether the High Scale Checkpointing is enabled for this cluster. - `dnsCacheConfig` DnsCacheConfig — Configuration for NodeLocal DNSCache - `enabled` boolean — Whether NodeLocal DNSCache is enabled for this cluster. - `gcsFuseCsiDriverConfig` GcsFuseCsiDriverConfig — Configuration for the Cloud Storage Fuse CSI driver. - `enabled` boolean — Whether the Cloud Storage Fuse CSI driver is enabled for this cluster. - `podSnapshotConfig` PodSnapshotConfig — PodSnapshotConfig is the configuration for GKE Pod Snapshots feature. - `enabled` boolean — Whether or not the Pod Snapshots feature is enabled. - `desiredManagedOpentelemetryConfig` ManagedOpenTelemetryConfig — ManagedOpenTelemetryConfig is the configuration for the GKE Managed OpenTelemetry pipeline. - `scope` 'SCOPE_UNSPECIFIED' | 'NONE' | 'COLLECTION_AND_INSTRUMENTATION_COMPONENTS' — Scope of the Managed OpenTelemetry pipeline. - `desiredImageProject` string — The project containing the desired image to use for this node. This is used to create clusters using a custom image. NOTE: Set the "desired_node_pool" field as well. - `desiredNotificationConfig` NotificationConfig — NotificationConfig is the configuration of notifications. - `pubsub` PubSub — Pub/Sub specific notification config. - `enabled` boolean — Enable notifications for Pub/Sub. - `filter` Filter — Allows filtering to one or more specific event types. If event types are present, those and only those event types will be transmitted to the cluster. Other types will be skipped. If no filter is specified, or no event types are present, all event types will be sent - `eventType` string[] — Event types to allowlist. - `topic` string — The desired Pub/Sub topic to which notifications will be sent by GKE. Format is `projects/{project}/topics/{topic}`. - `desiredK8sBetaApis` K8sBetaAPIConfig — K8sBetaAPIConfig , configuration for beta APIs - `enabledApis` string[] — Enabled k8s beta APIs. - `desiredMonitoringService` string — The monitoring service the cluster should use to write metrics. Currently available options: * `monitoring.googleapis.com/kubernetes` - The Cloud Monitoring service with a Kubernetes-native resource model * `monitoring.googleapis.com` - The legacy Cloud Monitoring service (no longer available as of GKE 1.15). * `none` - No metrics will be exported from the cluster. If left as an empty string,`monitoring.googleapis.com/kubernetes` will be used for GKE 1.14+ or `monitoring.googleapis.com` for earlier versions. - `desiredPodAutoscaling` PodAutoscaling — PodAutoscaling is used for configuration of parameters for workload autoscaling. - `hpaProfile` 'HPA_PROFILE_UNSPECIFIED' | 'NONE' | 'PERFORMANCE' — Selected Horizontal Pod Autoscaling profile. - `desiredImage` string — The desired name of the image to use for this node. This is used to create clusters using a custom image. NOTE: Set the "desired_node_pool" field as well. - `desiredSecretManagerConfig` SecretManagerConfig — SecretManagerConfig is config for secret manager enablement. - `rotationConfig` RotationConfig — RotationConfig is config for secret manager auto rotation. - `enabled` boolean — Whether the rotation is enabled. - `rotationInterval` string, google-duration — The interval between two consecutive rotations. Default rotation interval is 2 minutes. - `enabled` boolean — Enable/Disable Secret Manager Config. - `desiredSecretSyncConfig` SecretSyncConfig — Configuration for sync Secret Manager secrets as k8s secrets. - `rotationConfig` SyncRotationConfig — SyncRotationConfig is config for secret manager auto rotation. - `rotationInterval` string, google-duration — The interval between two consecutive rotations. Default rotation interval is 2 minutes. - `enabled` boolean — Whether the rotation is enabled. - `enabled` boolean — Enable/Disable Secret Sync Config. - `desiredNodePoolAutoConfigLinuxNodeConfig` LinuxNodeConfig — Parameters that can be configured on Linux nodes. - `hugepages` HugepagesConfig — Hugepages amount in both 2m and 1g size - `hugepageSize2m` integer — Optional. Amount of 2M hugepages - `hugepageSize1g` integer — Optional. Amount of 1G hugepages - `nodeKernelModuleLoading` NodeKernelModuleLoading — Configuration for kernel module loading on nodes. - `policy` 'POLICY_UNSPECIFIED' | 'ENFORCE_SIGNED_MODULES' | 'DO_NOT_ENFORCE_SIGNED_MODULES' — Set the node module loading policy for nodes in the node pool. - `accurateTimeConfig` AccurateTimeConfig — AccurateTimeConfig contains configuration for the accurate time synchronization feature. - `enablePtpKvmTimeSync` boolean — Enables enhanced time synchronization using PTP-KVM. - `transparentHugepageDefrag` 'TRANSPARENT_HUGEPAGE_DEFRAG_UNSPECIFIED' | 'TRANSPARENT_HUGEPAGE_DEFRAG_ALWAYS' | 'TRANSPARENT_HUGEPAGE_DEFRAG_DEFER' | 'TRANSPARENT_HUGEPAGE_DEFRAG_DEFER_WITH_MADVISE' | 'TRANSPARENT_HUGEPAGE_DEFRAG_MADVISE' | 'TRANSPARENT_HUGEPAGE_DEFRAG_NEVER' — Optional. Defines the transparent hugepage defrag configuration on the node. VM hugepage allocation can be managed by either limiting defragmentation for delayed allocation or skipping it entirely for immediate allocation only. See https://docs.kernel.org/admin-guide/mm/transhuge.html for more details. - `swapConfig` SwapConfig — Configuration for swap memory on a node pool. - `encryptionConfig` EncryptionConfig — Defines encryption settings for the swap space. - `disabled` boolean — Optional. If true, swap space will not be encrypted. Defaults to false (encrypted). - `ephemeralLocalSsdProfile` EphemeralLocalSsdProfile — Swap on the local SSD shared with pod ephemeral storage. - `swapSizeGib` string, int64 — Specifies the size of the swap space in gibibytes (GiB). - `swapSizePercent` integer — Specifies the size of the swap space as a percentage of the ephemeral local SSD capacity. - `enabled` boolean — Optional. Enables or disables swap for the node pool. - `bootDiskProfile` BootDiskProfile — Swap on the node's boot disk. - `swapSizeGib` string, int64 — Specifies the size of the swap space in gibibytes (GiB). - `swapSizePercent` integer — Specifies the size of the swap space as a percentage of the boot disk size. - `dedicatedLocalSsdProfile` DedicatedLocalSsdProfile — Provisions a new, separate local NVMe SSD exclusively for swap. - `diskCount` string, int64 — The number of physical local NVMe SSD disks to attach. - `customNodeInit` CustomNodeInit — Support for running custom init code while bootstrapping nodes. - `initScript` InitScript — InitScript provide a simply bash script to be executed on the node. - `gcsUri` string — The Cloud Storage URI for storing the init script. Format: gs://BUCKET_NAME/OBJECT_NAME The service account on the node pool must have read access to the object. User can't configure both gcs_uri and gcp_secret_manager_secret_uri. - `args` string[] — Optional. The optional arguments line to be passed to the init script. - `gcsGeneration` string, int64 — The generation of the init script stored in Gloud Storage. This is the required field to identify the version of the init script. User can get the genetaion from `gcloud storage objects describe gs://BUCKET_NAME/OBJECT_NAME --format="value(generation)"` or from the "Version history" tab of the object in the Cloud Console UI. - `gcpSecretManagerSecretUri` string — The resource name of the secret manager secret hosting the init script. Both global and regional secrets are supported with format below: Global secret: projects/{project}/secrets/{secret}/versions/{version} Regional secret: projects/{project}/locations/{location}/secrets/{secret}/versions/{version} Example: projects/1234567890/secrets/script_1/versions/1. Accept version number only, not support version alias. User can't configure both gcp_secret_manager_secret_uri and gcs_uri. - `diskIoScheduler` DiskIoScheduler — DiskIoScheduler contains the configuration for the disk IO scheduler. - `nodeSystemIoScheduler` string — Optional. Configures the IO scheduler for the boot disk or ephemeral lssd that runs node system workloads. Supported values are `mq-deadline`, `bfq`, `kyber`, `none`. - `nodeAttachedDiskIoScheduler` string — Optional. Configures the IO scheduler for the attached disks. Supported values are `mq-deadline`, `bfq`, `kyber`, `none`. - `transparentHugepageEnabled` 'TRANSPARENT_HUGEPAGE_ENABLED_UNSPECIFIED' | 'TRANSPARENT_HUGEPAGE_ENABLED_ALWAYS' | 'TRANSPARENT_HUGEPAGE_ENABLED_MADVISE' | 'TRANSPARENT_HUGEPAGE_ENABLED_NEVER' — Optional. Transparent hugepage support for anonymous memory can be entirely disabled (mostly for debugging purposes) or only enabled inside MADV_HUGEPAGE regions (to avoid the risk of consuming more memory resources) or enabled system wide. See https://docs.kernel.org/admin-guide/mm/transhuge.html for more details. - `nodeVfioConfig` NodeVfioConfig — Configuration settings for VFIO (Virtual Function I/O) on a node. VFIO allows safe, unprivileged, userspace drivers to access I/O devices. - `dmaEntryLimit` integer — Optional. Specifies the maximum number of DMA entries (pages) that can be mapped by the VFIO IOMMU type 1 driver for a container. This limit affects the total amount of host memory that can be pinned for direct device access, which is often critical for high-performance devices like TPUs and GPUs. This setting corresponds to the kernel parameter at: `/sys/module/vfio_iommu_type1/parameters/dma_entry_limit`. The default value in the kernel is `65535`. Higher values may be needed for workloads mapping large memory regions. Supported values are integers between `65535` and `4194304`. - `sysctls` object — The Linux kernel parameters to be applied to the nodes and all pods running on the nodes. The following parameters are supported. net.core.busy_poll net.core.busy_read net.core.netdev_max_backlog net.core.rmem_max net.core.rmem_default net.core.wmem_default net.core.wmem_max net.core.optmem_max net.core.somaxconn net.ipv4.neigh.default.gc_thresh1 net.ipv4.neigh.default.gc_thresh2 net.ipv4.neigh.default.gc_thresh3 net.ipv4.tcp_rmem net.ipv4.tcp_wmem net.ipv4.tcp_tw_reuse net.ipv4.tcp_mtu_probing net.ipv4.tcp_max_orphans net.ipv4.tcp_max_tw_buckets net.ipv4.tcp_syn_retries net.ipv4.tcp_ecn net.ipv4.tcp_congestion_control net.netfilter.nf_conntrack_max net.netfilter.nf_conntrack_buckets net.netfilter.nf_conntrack_tcp_timeout_close_wait net.netfilter.nf_conntrack_tcp_timeout_time_wait net.netfilter.nf_conntrack_tcp_timeout_established net.netfilter.nf_conntrack_acct kernel.keys.maxkeys kernel.keys.maxbytes kernel.shmmni kernel.shmmax kernel.shmall kernel.core_pattern kernel.perf_event_paranoid kernel.sched_rt_runtime_us kernel.softlockup_panic kernel.yama.ptrace_scope kernel.kptr_restrict kernel.dmesg_restrict kernel.sysrq fs.aio-max-nr fs.file-max fs.inotify.max_user_instances fs.inotify.max_user_watches fs.nr_open vm.dirty_background_ratio vm.dirty_background_bytes vm.dirty_expire_centisecs vm.dirty_ratio vm.dirty_bytes vm.dirty_writeback_centisecs vm.max_map_count vm.overcommit_memory vm.overcommit_ratio vm.vfs_cache_pressure vm.swappiness vm.watermark_scale_factor vm.min_free_kbytes - `cgroupMode` 'CGROUP_MODE_UNSPECIFIED' | 'CGROUP_MODE_V1' | 'CGROUP_MODE_V2' — cgroup_mode specifies the cgroup mode to be used on the node. ## Response `200` Successful response --- [API](https://skmtc.net/google/apis/container.md) · [All operations](https://skmtc.net/google/apis/container/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/google/container/versions/f20e7f9e2240/schema)