---
title: "POST /v1/projects/{projectId}/zones/{zone}/clusters/{clusterId}:setMasterAuth"
method: POST
path: "/v1/projects/{projectId}/zones/{zone}/clusters/{clusterId}:setMasterAuth"
tags: ["projects"]
---

# POST /v1/projects/{projectId}/zones/{zone}/clusters/{clusterId}:setMasterAuth

`POST /v1/projects/{projectId}/zones/{zone}/clusters/{clusterId}:setMasterAuth`

Sets master auth materials. Currently supports changing the admin password or a specific cluster, either via password generation or explicitly setting the password.

## Path parameters

- `projectId` string, required
- `zone` string, required
- `clusterId` string, required

## Request body

- SetMasterAuthRequest — SetMasterAuthRequest updates the admin password of a cluster.
  - `zone` string — Deprecated. The name of the Google Compute Engine [zone](https://cloud.google.com/compute/docs/zones#available) in which the cluster resides. This field has been deprecated and replaced by the name field.
  - `action` 'UNKNOWN' | 'SET_PASSWORD' | 'GENERATE_PASSWORD' | 'SET_USERNAME' — Required. The exact form of action to be taken on the master auth.
  - `projectId` string — Deprecated. The Google Developers Console [project ID or project number](https://cloud.google.com/resource-manager/docs/creating-managing-projects). This field has been deprecated and replaced by the name field.
  - `clusterId` string — Deprecated. The name of the cluster to upgrade. This field has been deprecated and replaced by the name field.
  - `name` string — The name (project, location, cluster) of the cluster to set auth. Specified in the format `projects/*/locations/*/clusters/*`.
  - `update` MasterAuth — The authentication information for accessing the master endpoint. Authentication can be done using HTTP basic auth or using client certificates.
    - `clientCertificate` string — Output only. Base64-encoded public certificate used by clients to authenticate to the cluster endpoint. Issued only if client_certificate_config is set.
    - `clientKey` string — Output only. Base64-encoded private key used by clients to authenticate to the cluster endpoint.
    - `clientCertificateConfig` ClientCertificateConfig — Configuration for client certificates on the cluster.
      - `issueClientCertificate` boolean — Issue a client certificate.
    - `username` string — The username to use for HTTP basic authentication to the master endpoint. For clusters v1.6.0 and later, basic authentication can be disabled by leaving username unspecified (or setting it to the empty string). Warning: basic authentication is deprecated, and will be removed in GKE control plane versions 1.19 and newer. For a list of recommended authentication methods, see: https://cloud.google.com/kubernetes-engine/docs/how-to/api-server-authentication
    - `clusterCaCertificate` string — Output only. Base64-encoded public certificate that is the root of trust for the cluster.
    - `password` string — The password to use for HTTP basic authentication to the master endpoint. Because the master endpoint is open to the Internet, you should create a strong password. If a password is provided for cluster creation, username must be non-empty. Warning: basic authentication is deprecated, and will be removed in GKE control plane versions 1.19 and newer. For a list of recommended authentication methods, see: https://cloud.google.com/kubernetes-engine/docs/how-to/api-server-authentication

## Response `200`

Successful response

---

[API](https://skmtc.net/google/apis/container.md) · [All operations](https://skmtc.net/google/apis/container/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/google/container/versions/f20e7f9e2240/schema)