--- title: "POST /v2/{+parent}/features" method: POST path: "/v2/{+parent}/features" tags: ["projects"] --- # POST /v2/{+parent}/features `POST /v2/{+parent}/features` Creates membershipFeature under a given parent. ## Path parameters - `parent` string, required ## Query parameters - `featureId` string - `requestId` string ## Request body - MembershipFeature — MembershipFeature represents the settings and status of a Fleet Feature enabled on a single Fleet Membership. - `lifecycleState` LifecycleState — LifecycleState describes the state of a MembershipFeature *resource* in the GkeHub API. See `FeatureState` for the "running state" of the MembershipFeature. - `state` 'STATE_UNSPECIFIED' | 'ENABLING' | 'ACTIVE' | 'DISABLING' | 'UPDATING' | 'SERVICE_UPDATING' — Output only. The current state of the Feature resource in the Hub API. - `deleteTime` string, google-datetime — Output only. When the MembershipFeature resource was deleted. - `name` string — Output only. The resource name of the membershipFeature, in the format: `projects/{project}/locations/{location}/memberships/{membership}/features/{feature}`. Note that `membershipFeatures` is shortened to `features` in the resource name. (see http://go/aip/122#collection-identifiers) - `spec` FeatureSpec — FeatureSpec contains user input per-feature spec information. - `workloadcertificate` WorkloadCertificateSpec — **WorkloadCertificate**: The membership-specific input for WorkloadCertificate feature. - `certificateManagement` 'CERTIFICATE_MANAGEMENT_UNSPECIFIED' | 'DISABLED' | 'ENABLED' — CertificateManagement specifies workload certificate management. - `rbacrolebindingactuation` RBACRoleBindingActuationSpec — **RBAC RoleBinding Actuation**: The membership-specific input for RBACRoleBindingActuation feature. - `servicemesh` ServiceMeshSpec — **Service Mesh**: Spec for a single Membership for the servicemesh feature - `management` 'MANAGEMENT_UNSPECIFIED' | 'MANAGEMENT_AUTOMATIC' | 'MANAGEMENT_MANUAL' | 'MANAGEMENT_NOT_INSTALLED' — Optional. Enables automatic Service Mesh management. - `controlPlane` 'CONTROL_PLANE_MANAGEMENT_UNSPECIFIED' | 'AUTOMATIC' | 'MANUAL' — Deprecated: use `management` instead Enables automatic control plane management. - `defaultChannel` 'CHANNEL_UNSPECIFIED' | 'RAPID' | 'REGULAR' | 'STABLE' — Determines which release channel to use for default injection and service mesh APIs. - `configApi` 'CONFIG_API_UNSPECIFIED' | 'CONFIG_API_ISTIO' | 'CONFIG_API_GATEWAY' — Optional. Specifies the API that will be used for configuring the mesh workloads. - `cloudbuild` CloudBuildSpec — **Cloud Build**: Configurations for each Cloud Build enabled cluster. - `securityPolicy` 'SECURITY_POLICY_UNSPECIFIED' | 'NON_PRIVILEGED' | 'PRIVILEGED' — Whether it is allowed to run the privileged builds on the cluster or not. - `version` string — Version of the cloud build software on the cluster. - `origin` Origin — Origin defines where this FeatureSpec originated from. - `type` 'TYPE_UNSPECIFIED' | 'FLEET' | 'FLEET_OUT_OF_SYNC' | 'USER' — Type specifies which type of origin is set. - `policycontroller` PolicyControllerSpec — **Policy Controller**: Configuration for a single cluster. Intended to parallel the PolicyController CR. - `version` string — Version of Policy Controller installed. - `policyControllerHubConfig` PolicyControllerHubConfig — Configuration for Policy Controller - `referentialRulesEnabled` boolean — Enables the ability to use Constraint Templates that reference to objects other than the object currently being evaluated. - `deploymentConfigs` object — Map of deployment configs to deployments (“admission”, “audit”, “mutation”). - `installSpec` 'INSTALL_SPEC_UNSPECIFIED' | 'INSTALL_SPEC_NOT_INSTALLED' | 'INSTALL_SPEC_ENABLED' | 'INSTALL_SPEC_SUSPENDED' | 'INSTALL_SPEC_DETACHED' — The install_spec represents the intended state specified by the latest request that mutated install_spec in the feature spec, not the lifecycle state of the feature observed by the Hub feature controller that is reported in the feature state. - `monitoring` PolicyControllerMonitoringConfig — MonitoringConfig specifies the backends Policy Controller should export metrics to. For example, to specify metrics should be exported to Cloud Monitoring and Prometheus, specify backends: ["cloudmonitoring", "prometheus"] - `backends` string[] — Specifies the list of backends Policy Controller will export to. An empty list would effectively disable metrics export. - `exemptableNamespaces` string[] — The set of namespaces that are excluded from Policy Controller checks. Namespaces do not need to currently exist on the cluster. - `logDeniesEnabled` boolean — Logs all denies and dry run failures. - `policyContent` PolicyControllerPolicyContentSpec — PolicyContentSpec defines the user's desired content configuration on the cluster. - `bundles` object — map of bundle name to BundleInstallSpec. The bundle name maps to the `bundleName` key in the `policycontroller.gke.io/constraintData` annotation on a constraint. - `templateLibrary` PolicyControllerTemplateLibraryConfig — The config specifying which default library templates to install. - `installation` 'INSTALLATION_UNSPECIFIED' | 'NOT_INSTALLED' | 'ALL' — Configures the manner in which the template library is installed on the cluster. - `constraintViolationLimit` string, int64 — The maximum number of audit violations to be stored in a constraint. If not set, the internal default (currently 20) will be used. - `auditIntervalSeconds` string, int64 — Sets the interval for Policy Controller Audit Scans (in seconds). When set to 0, this disables audit functionality altogether. - `mutationEnabled` boolean — Enables the ability to mutate resources using Policy Controller. - `identityservice` IdentityServiceSpec — **IdentityService**: Configuration for a single membership. - `authMethods` IdentityServiceAuthMethod[] — A member may support multiple auth methods. - `azureadConfig` IdentityServiceAzureADConfig — Configuration for the AzureAD Auth flow. - `groupFormat` string — Optional. Format of the AzureAD groups that the client wants for auth. - `clientId` string — ID for the registered client application that makes authentication requests to the Azure AD identity provider. - `userClaim` string — Optional. Claim in the AzureAD ID Token that holds the user details. - `kubectlRedirectUri` string — The redirect URL that kubectl uses for authorization. - `clientSecret` string — Input only. Unencrypted AzureAD client secret will be passed to the GKE Hub CLH. - `encryptedClientSecret` string, byte — Output only. Encrypted AzureAD client secret. - `tenant` string — Kind of Azure AD account to be authenticated. Supported values are or for accounts belonging to a specific tenant. - `googleConfig` IdentityServiceGoogleConfig — Configuration for the Google Plugin Auth flow. - `disable` boolean — Disable automatic configuration of Google Plugin on supported platforms. - `samlConfig` IdentityServiceSamlConfig — Configuration for the SAML Auth flow. - `identityProviderSsoUri` string — Required. The URI where the SAML IdP exposes the SSO service. - `groupPrefix` string — Optional. Prefix to prepend to group name. - `identityProviderId` string — Required. The entity ID of the SAML IdP. - `userPrefix` string — Optional. Prefix to prepend to user name. - `attributeMapping` object — Optional. The mapping of additional user attributes like nickname, birthday and address etc.. `key` is the name of this additional attribute. `value` is a string presenting as CEL(common expression language, go/cel) used for getting the value from the resources. Take nickname as an example, in this case, `key` is "attribute.nickname" and `value` is "assertion.nickname". - `identityProviderCertificates` string[] — Required. The list of IdP certificates to validate the SAML response against. - `userAttribute` string — Optional. The SAML attribute to read username from. If unspecified, the username will be read from the NameID element of the assertion in SAML response. This value is expected to be a string and will be passed along as-is (with the option of being prefixed by the `user_prefix`). - `groupsAttribute` string — Optional. The SAML attribute to read groups from. This value is expected to be a string and will be passed along as-is (with the option of being prefixed by the `group_prefix`). - `oidcConfig` IdentityServiceOidcConfig — Configuration for OIDC Auth flow. - `certificateAuthorityData` string — PEM-encoded CA for OIDC provider. - `userPrefix` string — Prefix to prepend to user name. - `enableAccessToken` boolean — Enable access token. - `kubectlRedirectUri` string — Registered redirect uri to redirect users going through OAuth flow using kubectl plugin. - `extraParams` string — Comma-separated list of key-value pairs. - `userClaim` string — Claim in OIDC ID token that holds username. - `issuerUri` string — URI for the OIDC provider. This should point to the level below .well-known/openid-configuration. - `clientId` string — ID for OIDC client application. - `groupPrefix` string — Prefix to prepend to group name. - `clientSecret` string — Input only. Unencrypted OIDC client secret will be passed to the GKE Hub CLH. - `scopes` string — Comma-separated list of identifiers. - `encryptedClientSecret` string, byte — Output only. Encrypted OIDC Client secret - `groupsClaim` string — Claim in OIDC ID token that holds group information. - `deployCloudConsoleProxy` boolean — Flag to denote if reverse proxy is used to connect to auth provider. This flag should be set to true when provider is not reachable by Google Cloud Console. - `proxy` string — Proxy server address to use for auth method. - `ldapConfig` IdentityServiceLdapConfig — Configuration for the LDAP Auth flow. - `group` IdentityServiceGroupConfig — Contains the properties for locating and authenticating groups in the directory. - `idAttribute` string — Optional. The identifying name of each group a user belongs to. For example, if this is set to "distinguishedName" then RBACs and other group expectations should be written as full DNs. This defaults to "distinguishedName". - `baseDn` string — Required. The location of the subtree in the LDAP directory to search for group entries. - `filter` string — Optional. Optional filter to be used when searching for groups a user belongs to. This can be used to explicitly match only certain groups in order to reduce the amount of groups returned for each user. This defaults to "(objectClass=Group)". - `serviceAccount` IdentityServiceServiceAccountConfig — Contains the credentials of the service account which is authorized to perform the LDAP search in the directory. The credentials can be supplied by the combination of the DN and password or the client certificate. - `simpleBindCredentials` IdentityServiceSimpleBindCredentials — The structure holds the LDAP simple binding credential. - … - `server` IdentityServiceServerConfig — Server settings for the external LDAP server. - `host` string — Required. Defines the hostname or IP of the LDAP server. Port is optional and will default to 389, if unspecified. For example, "ldap.server.example" or "10.10.10.10:389". - `connectionType` string — Optional. Defines the connection type to communicate with the LDAP server. If `starttls` or `ldaps` is specified, the certificate_authority_data should not be empty. - `certificateAuthorityData` string, byte — Optional. Contains a Base64 encoded, PEM formatted certificate authority certificate for the LDAP server. This must be provided for the "ldaps" and "startTLS" connections. - `user` IdentityServiceUserConfig — Defines where users exist in the LDAP directory. - `idAttribute` string — Optional. Determines which attribute to use as the user's identity after they are authenticated. This is distinct from the loginAttribute field to allow users to login with a username, but then have their actual identifier be an email address or full Distinguished Name (DN). For example, setting loginAttribute to "sAMAccountName" and identifierAttribute to "userPrincipalName" would allow a user to login as "bsmith", but actual RBAC policies for the user would be written as "bsmith@example.com". Using "userPrincipalName" is recommended since this will be unique for each user. This defaults to "userPrincipalName". - `baseDn` string — Required. The location of the subtree in the LDAP directory to search for user entries. - `filter` string — Optional. Filter to apply when searching for the user. This can be used to further restrict the user accounts which are allowed to login. This defaults to "(objectClass=User)". - `loginAttribute` string — Optional. The name of the attribute which matches against the input username. This is used to find the user in the LDAP database e.g. "(=)" and is combined with the optional filter field. This defaults to "userPrincipalName". - `name` string — Identifier for auth config. - `identityServiceOptions` IdentityServiceIdentityServiceOptions — Holds non-protocol-related configuration options. - `sessionDuration` string, google-duration — Determines the lifespan of STS tokens issued by Anthos Identity Service. - `diagnosticInterface` IdentityServiceDiagnosticInterface — Configuration options for the AIS diagnostic interface. - `expirationTime` string, google-datetime — Determines the expiration time of the diagnostic interface enablement. When reached, requests to the interface would be automatically rejected. - `enabled` boolean — Determines whether to enable the diagnostic interface. - `configmanagement` ConfigManagementSpec — **Anthos Config Management**: Configuration for a single cluster. Intended to parallel the ConfigManagement CR. - `policyController` ConfigManagementPolicyController — Configuration for Policy Controller - `exemptableNamespaces` string[] — The set of namespaces that are excluded from Policy Controller checks. Namespaces do not need to currently exist on the cluster. - `monitoring` ConfigManagementPolicyControllerMonitoring — PolicyControllerMonitoring specifies the backends Policy Controller should export metrics to. For example, to specify metrics should be exported to Cloud Monitoring and Prometheus, specify backends: ["cloudmonitoring", "prometheus"] - `backends` string[] — Specifies the list of backends Policy Controller will export to. An empty list would effectively disable metrics export. - `updateTime` string, google-datetime — Output only. Last time this membership spec was updated. - `templateLibraryInstalled` boolean — Installs the default template library along with Policy Controller. - `referentialRulesEnabled` boolean — Enables the ability to use Constraint Templates that reference to objects other than the object currently being evaluated. - `auditIntervalSeconds` string, int64 — Sets the interval for Policy Controller Audit Scans (in seconds). When set to 0, this disables audit functionality altogether. - `mutationEnabled` boolean — Enable or disable mutation in policy controller. If true, mutation CRDs, webhook and controller deployment will be deployed to the cluster. - `enabled` boolean — Enables the installation of Policy Controller. If false, the rest of PolicyController fields take no effect. - `logDeniesEnabled` boolean — Logs all denies and dry run failures. - `binauthz` ConfigManagementBinauthzConfig — Configuration for Binauthz. - `enabled` boolean — Whether binauthz is enabled in this cluster. - `hierarchyController` ConfigManagementHierarchyControllerConfig — Configuration for Hierarchy Controller. - `enabled` boolean — Whether Hierarchy Controller is enabled in this cluster. - `enablePodTreeLabels` boolean — Whether pod tree labels are enabled in this cluster. - `enableHierarchicalResourceQuota` boolean — Whether hierarchical resource quota is enabled in this cluster. - `cluster` string — Optional. User-specified cluster name used by the Config Sync cluster-name-selector annotation or ClusterSelector object, for applying configs to only a subset of clusters. Read more about the cluster-name-selector annotation and ClusterSelector object at https://docs.cloud.google.com/kubernetes-engine/config-sync/docs/how-to/cluster-scoped-objects#limiting-configs. Only set this field if a name different from the cluster's fleet membership name is used by the Config Sync cluster-name-selector annotation or ClusterSelector. - `configSync` ConfigManagementConfigSync — Configuration for Config Sync - `preventDrift` boolean — Optional. Set to true to enable the Config Sync admission webhook to prevent drifts. If set to false, disables the Config Sync admission webhook and does not prevent drifts. Defaults to false. See https://docs.cloud.google.com/kubernetes-engine/config-sync/docs/how-to/prevent-config-drift for details. - `oci` ConfigManagementOciConfig — OCI repo configuration for a single cluster. - `syncWaitSecs` string, int64 — Optional. Period in seconds between consecutive syncs. Default: 15. - `gcpServiceAccountEmail` string — Optional. The Google Cloud Service Account Email used for auth when secret_type is `gcpserviceaccount`. - `secretType` string — Required. Type of secret configured for access to the OCI repo. Must be one of `gcenode`, `gcpserviceaccount`, `k8sserviceaccount` or `none`. The validation of this is case-sensitive. - `syncRepo` string — Required. The OCI image repository URL for the package to sync from. e.g. `LOCATION-docker.pkg.dev/PROJECT_ID/REPOSITORY_NAME/PACKAGE_NAME`. - `policyDir` string — Optional. The absolute path of the directory that contains the local resources. Default: the root directory of the image. - `git` ConfigManagementGitConfig — Git repo configuration for a single cluster. - `syncBranch` string — Optional. The branch of the repository to sync from. Default: master. - `syncWaitSecs` string, int64 — Optional. Period in seconds between consecutive syncs. Default: 15. - `gcpServiceAccountEmail` string — Optional. The Google Cloud Service Account Email used for auth when secret_type is `gcpserviceaccount`. - `httpsProxy` string — Optional. URL for the HTTPS proxy to be used when communicating with the Git repo. Only specify when secret_type is `cookiefile`, `token`, or `none`. - `syncRev` string — Optional. Git revision (tag or hash) to check out. Default HEAD. - `secretType` string — Required. Type of secret configured for access to the Git repo. Must be one of `ssh`, `cookiefile`, `gcenode`, `token`, `gcpserviceaccount`, `githubapp` or `none`. The validation of this is case-sensitive. - `syncRepo` string — Required. The URL of the Git repository to use as the source of truth. - `policyDir` string — Optional. The path within the Git repository that represents the top level of the repo to sync. Default: the root directory of the repository. - `deploymentOverrides` ConfigManagementDeploymentOverride[] — Optional. Configuration for deployment overrides. Applies only to Config Sync deployments with containers that are not a root or namespace reconciler: `reconciler-manager`, `otel-collector`, `resource-group-controller-manager`, `admission-webhook`. To override a root or namespace reconciler, use the rootsync or reposync fields at https://docs.cloud.google.com/kubernetes-engine/config-sync/docs/reference/rootsync-reposync-fields#override-resources instead. - `deploymentNamespace` string — Required. The namespace of the deployment resource to be overridden. - `containers` ConfigManagementContainerOverride[] — Optional. The containers of the deployment resource to be overridden. - `cpuRequest` string — Optional. The cpu request of the container. Use the following CPU resource units: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#meaning-of-cpu. - `containerName` string — Required. The name of the container. - `cpuLimit` string — Optional. The cpu limit of the container. Use the following CPU resource units: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#meaning-of-cpu. - `memoryRequest` string — Optional. The memory request of the container. Use the following memory resource units: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#meaning-of-memory. - `memoryLimit` string — Optional. The memory limit of the container. Use the following memory resource units: https://kubernetes.io/docs/concepts/configuration/manage-resources-containers/#meaning-of-memory. - `deploymentName` string — Required. The name of the deployment resource to be overridden. - `enabled` boolean — Optional. Enables the installation of Config Sync. If set to true, the Feature will manage Config Sync resources, and apply the other ConfigSync fields if they exist. If set to false, the Feature will ignore all other ConfigSync fields and delete the Config Sync resources. If omitted, ConfigSync is considered enabled if the git or oci field is present. - `metricsGcpServiceAccountEmail` string — Optional. The Email of the Google Cloud Service Account (GSA) used for exporting Config Sync metrics to Cloud Monitoring and Cloud Monarch when Workload Identity is enabled. The GSA should have the Monitoring Metric Writer (roles/monitoring.metricWriter) IAM role. The Kubernetes ServiceAccount `default` in the namespace `config-management-monitoring` should be bound to the GSA. Deprecated: If Workload Identity Federation for GKE is enabled, Google Cloud Service Account is no longer needed for exporting Config Sync metrics: https://cloud.google.com/kubernetes-engine/enterprise/config-sync/docs/how-to/monitor-config-sync-cloud-monitoring#custom-monitoring. - `stopSyncing` boolean — Optional. Set to true to stop syncing configs for a single cluster. Default to false. - `sourceFormat` string — Optional. Specifies whether the Config Sync repo is in `hierarchical` or `unstructured` mode. Defaults to `hierarchical`. See https://docs.cloud.google.com/kubernetes-engine/config-sync/docs/concepts/configs#organize-configs for an explanation. - `version` string — Optional. Version of Config Sync to install. Defaults to the latest supported Config Sync version if the config_sync field is enabled. See supported versions at https://cloud.google.com/kubernetes-engine/config-sync/docs/get-support-config-sync#version_support_policy. - `management` 'MANAGEMENT_UNSPECIFIED' | 'MANAGEMENT_AUTOMATIC' | 'MANAGEMENT_MANUAL' — Optional. Deprecated: From version 1.21.0, automatic Feature management is unavailable, and Config Sync only supports manual upgrades. - `state` FeatureState — FeatureState contains high-level state information and per-feature state information for this MembershipFeature. - `servicemesh` ServiceMeshState — **Service Mesh**: State for a single Membership, as analyzed by the Service Mesh Hub Controller. - `controlPlaneManagement` ServiceMeshControlPlaneManagement — Status of control plane management. - `state` 'LIFECYCLE_STATE_UNSPECIFIED' | 'DISABLED' | 'FAILED_PRECONDITION' | 'PROVISIONING' | 'ACTIVE' | 'STALLED' | 'NEEDS_ATTENTION' | 'DEGRADED' | 'DEPROVISIONING' — LifecycleState of control plane management. - `implementation` 'IMPLEMENTATION_UNSPECIFIED' | 'ISTIOD' | 'TRAFFIC_DIRECTOR' | 'UPDATING' — Output only. Implementation of managed control plane. - `details` ServiceMeshStatusDetails[] — Explanation of state. - `code` string — A machine-readable code that further describes a broad status. - `details` string — Human-readable explanation of code. - `configApiVersion` string — The API version (i.e. Istio CRD version) for configuring service mesh in this cluster. This version is influenced by the `default_channel` field. - `analysisMessages` ServiceMeshAnalysisMessage[] — Output only. Results of running Service Mesh analyzers. - `description` string — A human readable description of what the error means. It is suitable for non-internationalize display purposes. - `resourcePaths` string[] — A list of strings specifying the resource identifiers that were the cause of message generation. A "path" here may be: * MEMBERSHIP_ID if the cause is a specific member cluster * MEMBERSHIP_ID/(NAMESPACE\/)?RESOURCETYPE/NAME if the cause is a resource in a cluster - `args` object — A UI can combine these args with a template (based on message_base.type) to produce an internationalized message. - `messageBase` ServiceMeshAnalysisMessageBase — AnalysisMessageBase describes some common information that is needed for all messages. - `type` ServiceMeshType — A unique identifier for the type of message. Display_name is intended to be human-readable, code is intended to be machine readable. There should be a one-to-one mapping between display_name and code. (i.e. do not re-use display_names or codes between message types.) See istio.analysis.v1alpha1.AnalysisMessageBase.Type - `displayName` string — A human-readable name for the message type. e.g. "InternalError", "PodMissingProxy". This should be the same for all messages of the same type. (This corresponds to the `name` field in open-source Istio.) - `code` string — A 7 character code matching `^IST[0-9]{4}$` or `^ASM[0-9]{4}$`, intended to uniquely identify the message type. (e.g. "IST0001" is mapped to the "InternalError" message type.) - `level` 'LEVEL_UNSPECIFIED' | 'ERROR' | 'WARNING' | 'INFO' — Represents how severe a message is. - `documentationUrl` string — A url pointing to the Service Mesh or Istio documentation for this specific error type. - `dataPlaneManagement` ServiceMeshDataPlaneManagement — Status of data plane management. Only reported per-member. - `state` 'LIFECYCLE_STATE_UNSPECIFIED' | 'DISABLED' | 'FAILED_PRECONDITION' | 'PROVISIONING' | 'ACTIVE' | 'STALLED' | 'NEEDS_ATTENTION' | 'DEGRADED' | 'DEPROVISIONING' — Lifecycle status of data plane management. - `details` ServiceMeshStatusDetails[] — Explanation of the status. - `code` string — A machine-readable code that further describes a broad status. - `details` string — Human-readable explanation of code. - `conditions` ServiceMeshCondition[] — Output only. List of conditions reported for this membership. - `documentationLink` string — Links contains actionable information. - `details` string — A short summary about the issue. - `severity` 'SEVERITY_UNSPECIFIED' | 'ERROR' | 'WARNING' | 'INFO' — Severity level of the condition. - `code` 'CODE_UNSPECIFIED' | 'MESH_IAM_PERMISSION_DENIED' | 'MESH_IAM_CROSS_PROJECT_PERMISSION_DENIED' | 'CNI_CONFIG_UNSUPPORTED' | 'GKE_SANDBOX_UNSUPPORTED' | 'NODEPOOL_WORKLOAD_IDENTITY_FEDERATION_REQUIRED' | 'CNI_INSTALLATION_FAILED' | 'CNI_POD_UNSCHEDULABLE' | 'CLUSTER_HAS_ZERO_NODES' | 'CANONICAL_SERVICE_ERROR' | 'UNSUPPORTED_MULTIPLE_CONTROL_PLANES' | 'VPCSC_GA_SUPPORTED' | 'DEPRECATED_SPEC_CONTROL_PLANE_MANAGEMENT' | 'DEPRECATED_SPEC_CONTROL_PLANE_MANAGEMENT_SAFE' | 'CONFIG_APPLY_INTERNAL_ERROR' | 'CONFIG_VALIDATION_ERROR' | 'CONFIG_VALIDATION_WARNING' | 'QUOTA_EXCEEDED_BACKEND_SERVICES' | 'QUOTA_EXCEEDED_HEALTH_CHECKS' | 'QUOTA_EXCEEDED_HTTP_ROUTES' | 'QUOTA_EXCEEDED_TCP_ROUTES' | 'QUOTA_EXCEEDED_TLS_ROUTES' | 'QUOTA_EXCEEDED_TRAFFIC_POLICIES' | 'QUOTA_EXCEEDED_ENDPOINT_POLICIES' | 'QUOTA_EXCEEDED_GATEWAYS' | 'QUOTA_EXCEEDED_MESHES' | 'QUOTA_EXCEEDED_SERVER_TLS_POLICIES' | 'QUOTA_EXCEEDED_CLIENT_TLS_POLICIES' | 'QUOTA_EXCEEDED_SERVICE_LB_POLICIES' | 'QUOTA_EXCEEDED_HTTP_FILTERS' | 'QUOTA_EXCEEDED_TCP_FILTERS' | 'QUOTA_EXCEEDED_NETWORK_ENDPOINT_GROUPS' | 'CONFIG_APPLY_BLOCKED' | 'LEGACY_MC_SECRETS' | 'WORKLOAD_IDENTITY_REQUIRED' | 'NON_STANDARD_BINARY_USAGE' | 'UNSUPPORTED_GATEWAY_CLASS' | 'MANAGED_CNI_NOT_ENABLED' | 'MISSING_CONTROL_PLANE_CONFIG' | 'SHARED_VPC_MISSING_PERMISSIONS' | 'REQUIRED_ORG_POLICY_DISABLED' | 'MODERNIZATION_INCOMPATIBLE_POD_ANNOTATION' | 'MODERNIZATION_INCOMPATIBLE_CONFIG' | 'MODERNIZATION_INCOMPATIBLE_GATEWAY_POD_SCALE' | 'MODERNIZATION_SCHEDULED' | 'MODERNIZATION_IN_PROGRESS' | 'MODERNIZATION_COMPLETED' | 'MODERNIZATION_ABORTED' | 'MODERNIZATION_PREPARING' | 'MODERNIZATION_STALLED' | 'MODERNIZATION_PREPARED' | 'MODERNIZATION_MIGRATING_WORKLOADS' | 'MODERNIZATION_ROLLING_BACK_CLUSTER' | 'MODERNIZATION_WILL_BE_SCHEDULED' | 'MODERNIZATION_MANUAL' | 'MODERNIZATION_ELIGIBLE' | 'MODERNIZATION_MODERNIZING' | 'MODERNIZATION_MODERNIZED_SOAKING' | 'MODERNIZATION_FINALIZED' | 'MODERNIZATION_ROLLING_BACK_FLEET' | 'MODERNIZATION_COMPATIBLE' | 'MODERNIZATION_INCOMPATIBLE' | 'MODERNIZATION_INCOMPATIBLE_FLEET_SCALE' | 'MODERNIZATION_INCOMPATIBLE_FLEET_QUOTA' — Unique identifier of the condition which describes the condition recognizable to the user. - `metering` MeteringState — **Metering**: State for a single membership, analyzed and reported by feature controller. - `lastMeasurementTime` string, google-datetime — The time stamp of the most recent measurement of the number of vCPUs in the cluster. - `preciseLastMeasuredClusterVcpuCapacity` number, float — The vCPUs capacity in the cluster according to the most recent measurement (1/1000 precision). - `configmanagement` ConfigManagementState — **Anthos Config Management**: State for a single cluster. - `hierarchyControllerState` ConfigManagementHierarchyControllerState — State for Hierarchy Controller. - `version` ConfigManagementHierarchyControllerVersion — Version for Hierarchy Controller. - `hnc` string — Version for open source HNC. - `extension` string — Version for Hierarchy Controller extension. - `state` ConfigManagementHierarchyControllerDeploymentState — Deployment state for Hierarchy Controller - `hnc` 'DEPLOYMENT_STATE_UNSPECIFIED' | 'NOT_INSTALLED' | 'INSTALLED' | 'ERROR' | 'PENDING' — The deployment state for open source HNC (e.g. v0.7.0-hc.0). - `extension` 'DEPLOYMENT_STATE_UNSPECIFIED' | 'NOT_INSTALLED' | 'INSTALLED' | 'ERROR' | 'PENDING' — The deployment state for Hierarchy Controller extension (e.g. v0.7.0-hc.1). - `configSyncState` ConfigManagementConfigSyncState — State information for ConfigSync. - `version` ConfigManagementConfigSyncVersion — Specific versioning information pertaining to ConfigSync's Pods. - `resourceGroupControllerManager` string — Version of the deployed resource-group-controller-manager pod - `gitSync` string — Version of the deployed git-sync pod. - `otelCollector` string — Version of the deployed otel-collector pod - `monitor` string — Version of the deployed monitor pod. - `reconcilerManager` string — Version of the deployed reconciler-manager pod. - `syncer` string — Version of the deployed syncer pod. - `admissionWebhook` string — Version of the deployed admission-webhook pod. - `importer` string — Version of the deployed importer pod. - `rootReconciler` string — Version of the deployed reconciler container in root-reconciler pod. - `syncState` ConfigManagementSyncState — State indicating an ACM's progress syncing configurations to a cluster. - `code` 'SYNC_CODE_UNSPECIFIED' | 'SYNCED' | 'PENDING' | 'ERROR' | 'NOT_CONFIGURED' | 'NOT_INSTALLED' | 'UNAUTHORIZED' | 'UNREACHABLE' — Sync status code. - `errors` ConfigManagementSyncError[] — A list of errors resulting from problematic configs. This list will be truncated after 100 errors, although it is unlikely for that many errors to simultaneously exist. - `code` string — An ACM defined error code - `errorMessage` string — A description of the error - `errorResources` ConfigManagementErrorResource[] — A list of config(s) associated with the error, if any - … - `lastSync` string — Deprecated: use last_sync_time instead. Timestamp of when ACM last successfully synced the repo. The time format is specified in https://golang.org/pkg/time/#Time.String - `syncToken` string — Token indicating the state of the syncer. - `lastSyncTime` string, google-datetime — Timestamp type of when ACM last successfully synced the repo. - `sourceToken` string — Token indicating the state of the repo. - `importToken` string — Token indicating the state of the importer. - `rootsyncCrd` 'CRD_STATE_UNSPECIFIED' | 'NOT_INSTALLED' | 'INSTALLED' | 'TERMINATING' | 'INSTALLING' — Output only. The state of the RootSync CRD - `crCount` integer — Output only. The number of RootSync and RepoSync CRs in the cluster. - `clusterLevelStopSyncingState` 'STOP_SYNCING_STATE_UNSPECIFIED' | 'NOT_STOPPED' | 'PENDING' | 'STOPPED' — Output only. Whether syncing resources to the cluster is stopped at the cluster level. - `state` 'STATE_UNSPECIFIED' | 'CONFIG_SYNC_NOT_INSTALLED' | 'CONFIG_SYNC_INSTALLED' | 'CONFIG_SYNC_ERROR' | 'CONFIG_SYNC_PENDING' — Output only. The state of CS This field summarizes the other fields in this message. - `errors` ConfigManagementConfigSyncError[] — Output only. Errors pertaining to the installation of Config Sync. - `errorMessage` string — A string representing the user facing error message - `reposyncCrd` 'CRD_STATE_UNSPECIFIED' | 'NOT_INSTALLED' | 'INSTALLED' | 'TERMINATING' | 'INSTALLING' — Output only. The state of the Reposync CRD - `deploymentState` ConfigManagementConfigSyncDeploymentState — The state of ConfigSync's deployment on a cluster. - `monitor` 'DEPLOYMENT_STATE_UNSPECIFIED' | 'NOT_INSTALLED' | 'INSTALLED' | 'ERROR' | 'PENDING' — Deployment state of the monitor pod. - `reconcilerManager` 'DEPLOYMENT_STATE_UNSPECIFIED' | 'NOT_INSTALLED' | 'INSTALLED' | 'ERROR' | 'PENDING' — Deployment state of reconciler-manager pod. - `importer` 'DEPLOYMENT_STATE_UNSPECIFIED' | 'NOT_INSTALLED' | 'INSTALLED' | 'ERROR' | 'PENDING' — Deployment state of the importer pod. - `rootReconciler` 'DEPLOYMENT_STATE_UNSPECIFIED' | 'NOT_INSTALLED' | 'INSTALLED' | 'ERROR' | 'PENDING' — Deployment state of root-reconciler. - `syncer` 'DEPLOYMENT_STATE_UNSPECIFIED' | 'NOT_INSTALLED' | 'INSTALLED' | 'ERROR' | 'PENDING' — Deployment state of the syncer pod. - `admissionWebhook` 'DEPLOYMENT_STATE_UNSPECIFIED' | 'NOT_INSTALLED' | 'INSTALLED' | 'ERROR' | 'PENDING' — Deployment state of admission-webhook. - `otelCollector` 'DEPLOYMENT_STATE_UNSPECIFIED' | 'NOT_INSTALLED' | 'INSTALLED' | 'ERROR' | 'PENDING' — Deployment state of otel-collector - `resourceGroupControllerManager` 'DEPLOYMENT_STATE_UNSPECIFIED' | 'NOT_INSTALLED' | 'INSTALLED' | 'ERROR' | 'PENDING' — Deployment state of resource-group-controller-manager - `gitSync` 'DEPLOYMENT_STATE_UNSPECIFIED' | 'NOT_INSTALLED' | 'INSTALLED' | 'ERROR' | 'PENDING' — Deployment state of the git-sync pod. - `operatorState` ConfigManagementOperatorState — State information for an ACM's Operator. - `errors` ConfigManagementInstallError[] — Install errors. - `errorMessage` string — A string representing the user facing error message. - `version` string — The semenatic version number of the operator. - `deploymentState` 'DEPLOYMENT_STATE_UNSPECIFIED' | 'NOT_INSTALLED' | 'INSTALLED' | 'ERROR' | 'PENDING' — The state of the Operator's deployment. - `policyControllerState` ConfigManagementPolicyControllerState — State for PolicyControllerState. - `migration` ConfigManagementPolicyControllerMigration — State for the migration of PolicyController from ACM -> PoCo Hub. - `stage` 'STAGE_UNSPECIFIED' | 'ACM_MANAGED' | 'POCO_MANAGED' — Stage of the migration. - `copyTime` string, google-datetime — Last time this membership spec was copied to PoCo feature. - `version` ConfigManagementPolicyControllerVersion — The build version of Gatekeeper Policy Controller is using. - `version` string — The gatekeeper image tag that is composed of ACM version, git tag, build number. - `deploymentState` ConfigManagementGatekeeperDeploymentState — State of Policy Controller installation. - `gatekeeperAudit` 'DEPLOYMENT_STATE_UNSPECIFIED' | 'NOT_INSTALLED' | 'INSTALLED' | 'ERROR' | 'PENDING' — Status of gatekeeper-audit deployment. - `gatekeeperControllerManagerState` 'DEPLOYMENT_STATE_UNSPECIFIED' | 'NOT_INSTALLED' | 'INSTALLED' | 'ERROR' | 'PENDING' — Status of gatekeeper-controller-manager pod. - `gatekeeperMutation` 'DEPLOYMENT_STATE_UNSPECIFIED' | 'NOT_INSTALLED' | 'INSTALLED' | 'ERROR' | 'PENDING' — Status of the pod serving the mutation webhook. - `clusterName` string — Output only. This field is set to the `cluster_name` field of the Membership Spec if it is not empty. Otherwise, it is set to the cluster's fleet membership name. - `kubernetesApiServerVersion` string — Output only. The Kubernetes API server version of the cluster. - `binauthzState` ConfigManagementBinauthzState — State for Binauthz. - `webhook` 'DEPLOYMENT_STATE_UNSPECIFIED' | 'NOT_INSTALLED' | 'INSTALLED' | 'ERROR' | 'PENDING' — The state of the binauthz webhook. - `version` ConfigManagementBinauthzVersion — The version of binauthz. - `webhookVersion` string — The version of the binauthz webhook. - `membershipSpec` ConfigManagementSpec — **Anthos Config Management**: Configuration for a single cluster. Intended to parallel the ConfigManagement CR. - `policyController` ConfigManagementPolicyController — Configuration for Policy Controller - `exemptableNamespaces` string[] — The set of namespaces that are excluded from Policy Controller checks. Namespaces do not need to currently exist on the cluster. - `monitoring` ConfigManagementPolicyControllerMonitoring — PolicyControllerMonitoring specifies the backends Policy Controller should export metrics to. For example, to specify metrics should be exported to Cloud Monitoring and Prometheus, specify backends: ["cloudmonitoring", "prometheus"] - `backends` string[] — Specifies the list of backends Policy Controller will export to. An empty list would effectively disable metrics export. - `updateTime` string, google-datetime — Output only. Last time this membership spec was updated. - `templateLibraryInstalled` boolean — Installs the default template library along with Policy Controller. - `referentialRulesEnabled` boolean — Enables the ability to use Constraint Templates that reference to objects other than the object currently being evaluated. - `auditIntervalSeconds` string, int64 — Sets the interval for Policy Controller Audit Scans (in seconds). When set to 0, this disables audit functionality altogether. - `mutationEnabled` boolean — Enable or disable mutation in policy controller. If true, mutation CRDs, webhook and controller deployment will be deployed to the cluster. - `enabled` boolean — Enables the installation of Policy Controller. If false, the rest of PolicyController fields take no effect. - `logDeniesEnabled` boolean — Logs all denies and dry run failures. - `binauthz` ConfigManagementBinauthzConfig — Configuration for Binauthz. - `enabled` boolean — Whether binauthz is enabled in this cluster. - `hierarchyController` ConfigManagementHierarchyControllerConfig — Configuration for Hierarchy Controller. - `enabled` boolean — Whether Hierarchy Controller is enabled in this cluster. - `enablePodTreeLabels` boolean — Whether pod tree labels are enabled in this cluster. - `enableHierarchicalResourceQuota` boolean — Whether hierarchical resource quota is enabled in this cluster. - `cluster` string — Optional. User-specified cluster name used by the Config Sync cluster-name-selector annotation or ClusterSelector object, for applying configs to only a subset of clusters. Read more about the cluster-name-selector annotation and ClusterSelector object at https://docs.cloud.google.com/kubernetes-engine/config-sync/docs/how-to/cluster-scoped-objects#limiting-configs. Only set this field if a name different from the cluster's fleet membership name is used by the Config Sync cluster-name-selector annotation or ClusterSelector. - `configSync` ConfigManagementConfigSync — Configuration for Config Sync - `preventDrift` boolean — Optional. Set to true to enable the Config Sync admission webhook to prevent drifts. If set to false, disables the Config Sync admission webhook and does not prevent drifts. Defaults to false. See https://docs.cloud.google.com/kubernetes-engine/config-sync/docs/how-to/prevent-config-drift for details. - `oci` ConfigManagementOciConfig — OCI repo configuration for a single cluster. - `syncWaitSecs` string, int64 — Optional. Period in seconds between consecutive syncs. Default: 15. - `gcpServiceAccountEmail` string — Optional. The Google Cloud Service Account Email used for auth when secret_type is `gcpserviceaccount`. - `secretType` string — Required. Type of secret configured for access to the OCI repo. Must be one of `gcenode`, `gcpserviceaccount`, `k8sserviceaccount` or `none`. The validation of this is case-sensitive. - `syncRepo` string — Required. The OCI image repository URL for the package to sync from. e.g. `LOCATION-docker.pkg.dev/PROJECT_ID/REPOSITORY_NAME/PACKAGE_NAME`. - `policyDir` string — Optional. The absolute path of the directory that contains the local resources. Default: the root directory of the image. - `git` ConfigManagementGitConfig — Git repo configuration for a single cluster. - `syncBranch` string — Optional. The branch of the repository to sync from. Default: master. - `syncWaitSecs` string, int64 — Optional. Period in seconds between consecutive syncs. Default: 15. - `gcpServiceAccountEmail` string — Optional. The Google Cloud Service Account Email used for auth when secret_type is `gcpserviceaccount`. - `httpsProxy` string — Optional. URL for the HTTPS proxy to be used when communicating with the Git repo. Only specify when secret_type is `cookiefile`, `token`, or `none`. - `syncRev` string — Optional. Git revision (tag or hash) to check out. Default HEAD. - `secretType` string — Required. Type of secret configured for access to the Git repo. Must be one of `ssh`, `cookiefile`, `gcenode`, `token`, `gcpserviceaccount`, `githubapp` or `none`. The validation of this is case-sensitive. - `syncRepo` string — Required. The URL of the Git repository to use as the source of truth. - `policyDir` string — Optional. The path within the Git repository that represents the top level of the repo to sync. Default: the root directory of the repository. - `deploymentOverrides` ConfigManagementDeploymentOverride[] — Optional. Configuration for deployment overrides. Applies only to Config Sync deployments with containers that are not a root or namespace reconciler: `reconciler-manager`, `otel-collector`, `resource-group-controller-manager`, `admission-webhook`. To override a root or namespace reconciler, use the rootsync or reposync fields at https://docs.cloud.google.com/kubernetes-engine/config-sync/docs/reference/rootsync-reposync-fields#override-resources instead. - `deploymentNamespace` string — Required. The namespace of the deployment resource to be overridden. - `containers` ConfigManagementContainerOverride[] — Optional. The containers of the deployment resource to be overridden. - … - `deploymentName` string — Required. The name of the deployment resource to be overridden. - `enabled` boolean — Optional. Enables the installation of Config Sync. If set to true, the Feature will manage Config Sync resources, and apply the other ConfigSync fields if they exist. If set to false, the Feature will ignore all other ConfigSync fields and delete the Config Sync resources. If omitted, ConfigSync is considered enabled if the git or oci field is present. - `metricsGcpServiceAccountEmail` string — Optional. The Email of the Google Cloud Service Account (GSA) used for exporting Config Sync metrics to Cloud Monitoring and Cloud Monarch when Workload Identity is enabled. The GSA should have the Monitoring Metric Writer (roles/monitoring.metricWriter) IAM role. The Kubernetes ServiceAccount `default` in the namespace `config-management-monitoring` should be bound to the GSA. Deprecated: If Workload Identity Federation for GKE is enabled, Google Cloud Service Account is no longer needed for exporting Config Sync metrics: https://cloud.google.com/kubernetes-engine/enterprise/config-sync/docs/how-to/monitor-config-sync-cloud-monitoring#custom-monitoring. - `stopSyncing` boolean — Optional. Set to true to stop syncing configs for a single cluster. Default to false. - `sourceFormat` string — Optional. Specifies whether the Config Sync repo is in `hierarchical` or `unstructured` mode. Defaults to `hierarchical`. See https://docs.cloud.google.com/kubernetes-engine/config-sync/docs/concepts/configs#organize-configs for an explanation. - `version` string — Optional. Version of Config Sync to install. Defaults to the latest supported Config Sync version if the config_sync field is enabled. See supported versions at https://cloud.google.com/kubernetes-engine/config-sync/docs/get-support-config-sync#version_support_policy. - `management` 'MANAGEMENT_UNSPECIFIED' | 'MANAGEMENT_AUTOMATIC' | 'MANAGEMENT_MANUAL' — Optional. Deprecated: From version 1.21.0, automatic Feature management is unavailable, and Config Sync only supports manual upgrades. - `policycontroller` PolicyControllerState — **Policy Controller**: State for a single cluster. - `state` 'LIFECYCLE_STATE_UNSPECIFIED' | 'NOT_INSTALLED' | 'INSTALLING' | 'ACTIVE' | 'UPDATING' | 'DECOMMISSIONING' | 'CLUSTER_ERROR' | 'HUB_ERROR' | 'SUSPENDED' | 'DETACHED' — The overall Policy Controller lifecycle state observed by the Hub Feature controller. - `policyContentState` PolicyControllerPolicyContentState — The state of the policy controller policy content - `bundleStates` object — The state of the any bundles included in the chosen version of the manifest - `templateLibraryState` PolicyControllerOnClusterState — OnClusterState represents the state of a sub-component of Policy Controller. - `details` string — Surface potential errors or information logs. - `state` 'LIFECYCLE_STATE_UNSPECIFIED' | 'NOT_INSTALLED' | 'INSTALLING' | 'ACTIVE' | 'UPDATING' | 'DECOMMISSIONING' | 'CLUSTER_ERROR' | 'HUB_ERROR' | 'SUSPENDED' | 'DETACHED' — The lifecycle state of this component. - `referentialSyncConfigState` PolicyControllerOnClusterState — OnClusterState represents the state of a sub-component of Policy Controller. - `details` string — Surface potential errors or information logs. - `state` 'LIFECYCLE_STATE_UNSPECIFIED' | 'NOT_INSTALLED' | 'INSTALLING' | 'ACTIVE' | 'UPDATING' | 'DECOMMISSIONING' | 'CLUSTER_ERROR' | 'HUB_ERROR' | 'SUSPENDED' | 'DETACHED' — The lifecycle state of this component. - `componentStates` object — Currently these include (also serving as map keys): 1. "admission" 2. "audit" 3. "mutation" - `appdevexperience` AppDevExperienceState — State for App Dev Exp Feature. - `networkingInstallSucceeded` AppDevExperienceStatus — Status specifies state for the subcomponent. - `description` string — Description is populated if Code is Failed, explaining why it has failed. - `code` 'CODE_UNSPECIFIED' | 'OK' | 'FAILED' | 'UNKNOWN' — Code specifies AppDevExperienceFeature's subcomponent ready state. - `clusterupgrade` ClusterUpgradeState — Per-membership state for this feature. - `ignored` ClusterUpgradeIgnoredMembership — IgnoredMembership represents a membership ignored by the feature. A membership can be ignored because it was manually upgraded to a newer version than RC default. - `ignoredTime` string, google-datetime — Time when the membership was first set to ignored. - `reason` string — Reason why the membership is ignored. - `upgrades` ClusterUpgradeMembershipGKEUpgradeState[] — Actual upgrade state against desired. - `upgrade` ClusterUpgradeGKEUpgrade — GKEUpgrade represents a GKE provided upgrade, e.g., control plane upgrade. - `name` string — Name of the upgrade, e.g., "k8s_control_plane". - `version` string — Version of the upgrade, e.g., "1.22.1-gke.100". - `status` ClusterUpgradeUpgradeStatus — UpgradeStatus provides status information for each upgrade. - `code` 'CODE_UNSPECIFIED' | 'INELIGIBLE' | 'PENDING' | 'IN_PROGRESS' | 'SOAKING' | 'FORCED_SOAKING' | 'COMPLETE' — Status code of the upgrade. - `reason` string — Reason for this status. - `updateTime` string, google-datetime — Last timestamp the status was updated. - `state` State — High-level state of a MembershipFeature. - `code` 'CODE_UNSPECIFIED' | 'OK' | 'WARNING' | 'ERROR' — The high-level, machine-readable status of this MembershipFeature. - `description` string — A human-readable description of the current status. - `updateTime` string, google-datetime — The time this status and any related Feature-specific details were updated. - `identityservice` IdentityServiceState — **IdentityService**: State for a single membership, analyzed and reported by feature controller. - `installedVersion` string — Installed AIS version. This is the AIS version installed on this member. The values makes sense iff state is OK. - `state` 'DEPLOYMENT_STATE_UNSPECIFIED' | 'OK' | 'ERROR' — Deployment state on this member - `failureReason` string — The reason of the failure. - `memberConfig` IdentityServiceSpec — **IdentityService**: Configuration for a single membership. - `authMethods` IdentityServiceAuthMethod[] — A member may support multiple auth methods. - `azureadConfig` IdentityServiceAzureADConfig — Configuration for the AzureAD Auth flow. - `groupFormat` string — Optional. Format of the AzureAD groups that the client wants for auth. - `clientId` string — ID for the registered client application that makes authentication requests to the Azure AD identity provider. - `userClaim` string — Optional. Claim in the AzureAD ID Token that holds the user details. - `kubectlRedirectUri` string — The redirect URL that kubectl uses for authorization. - `clientSecret` string — Input only. Unencrypted AzureAD client secret will be passed to the GKE Hub CLH. - `encryptedClientSecret` string, byte — Output only. Encrypted AzureAD client secret. - `tenant` string — Kind of Azure AD account to be authenticated. Supported values are or for accounts belonging to a specific tenant. - `googleConfig` IdentityServiceGoogleConfig — Configuration for the Google Plugin Auth flow. - `disable` boolean — Disable automatic configuration of Google Plugin on supported platforms. - `samlConfig` IdentityServiceSamlConfig — Configuration for the SAML Auth flow. - `identityProviderSsoUri` string — Required. The URI where the SAML IdP exposes the SSO service. - `groupPrefix` string — Optional. Prefix to prepend to group name. - `identityProviderId` string — Required. The entity ID of the SAML IdP. - `userPrefix` string — Optional. Prefix to prepend to user name. - `attributeMapping` object — Optional. The mapping of additional user attributes like nickname, birthday and address etc.. `key` is the name of this additional attribute. `value` is a string presenting as CEL(common expression language, go/cel) used for getting the value from the resources. Take nickname as an example, in this case, `key` is "attribute.nickname" and `value` is "assertion.nickname". - `identityProviderCertificates` string[] — Required. The list of IdP certificates to validate the SAML response against. - `userAttribute` string — Optional. The SAML attribute to read username from. If unspecified, the username will be read from the NameID element of the assertion in SAML response. This value is expected to be a string and will be passed along as-is (with the option of being prefixed by the `user_prefix`). - `groupsAttribute` string — Optional. The SAML attribute to read groups from. This value is expected to be a string and will be passed along as-is (with the option of being prefixed by the `group_prefix`). - `oidcConfig` IdentityServiceOidcConfig — Configuration for OIDC Auth flow. - `certificateAuthorityData` string — PEM-encoded CA for OIDC provider. - `userPrefix` string — Prefix to prepend to user name. - `enableAccessToken` boolean — Enable access token. - `kubectlRedirectUri` string — Registered redirect uri to redirect users going through OAuth flow using kubectl plugin. - `extraParams` string — Comma-separated list of key-value pairs. - `userClaim` string — Claim in OIDC ID token that holds username. - `issuerUri` string — URI for the OIDC provider. This should point to the level below .well-known/openid-configuration. - `clientId` string — ID for OIDC client application. - `groupPrefix` string — Prefix to prepend to group name. - `clientSecret` string — Input only. Unencrypted OIDC client secret will be passed to the GKE Hub CLH. - `scopes` string — Comma-separated list of identifiers. - `encryptedClientSecret` string, byte — Output only. Encrypted OIDC Client secret - `groupsClaim` string — Claim in OIDC ID token that holds group information. - `deployCloudConsoleProxy` boolean — Flag to denote if reverse proxy is used to connect to auth provider. This flag should be set to true when provider is not reachable by Google Cloud Console. - `proxy` string — Proxy server address to use for auth method. - `ldapConfig` IdentityServiceLdapConfig — Configuration for the LDAP Auth flow. - `group` IdentityServiceGroupConfig — Contains the properties for locating and authenticating groups in the directory. - … - `serviceAccount` IdentityServiceServiceAccountConfig — Contains the credentials of the service account which is authorized to perform the LDAP search in the directory. The credentials can be supplied by the combination of the DN and password or the client certificate. - … - `server` IdentityServiceServerConfig — Server settings for the external LDAP server. - … - `user` IdentityServiceUserConfig — Defines where users exist in the LDAP directory. - … - `name` string — Identifier for auth config. - `identityServiceOptions` IdentityServiceIdentityServiceOptions — Holds non-protocol-related configuration options. - `sessionDuration` string, google-duration — Determines the lifespan of STS tokens issued by Anthos Identity Service. - `diagnosticInterface` IdentityServiceDiagnosticInterface — Configuration options for the AIS diagnostic interface. - `expirationTime` string, google-datetime — Determines the expiration time of the diagnostic interface enablement. When reached, requests to the interface would be automatically rejected. - `enabled` boolean — Determines whether to enable the diagnostic interface. - `rbacrolebindingactuation` RBACRoleBindingActuationState — **RBAC RoleBinding Actuation**: A membership-specific Feature state for the RBACRoleBindingActuation fleet feature. - `rbacrolebindingStates` object — Output only. The state of RBACRoleBindings using custom roles that exist on the cluster, keyed by RBACRoleBinding resource name with format: projects/{project}/locations/{location}/scopes/{scope}/rbacrolebindings/{rbacrolebinding}. - `workloadidentity` WorkloadIdentityState — **WorkloadIdentity**: The membership-specific state for WorkloadIdentity feature. - `description` string — Deprecated, this field will be erased after code is changed to use the new field. - `identityProviderStateDetails` object — The state of the Identity Providers corresponding to the membership. - `createTime` string, google-datetime — Output only. When the MembershipFeature resource was created. - `updateTime` string, google-datetime — Output only. When the MembershipFeature resource was last updated. - `labels` object — Google Cloud labels for this MembershipFeature. ## Response `200` Successful response --- [API](https://skmtc.net/google/apis/gkehub.md) · [All operations](https://skmtc.net/google/apis/gkehub/llms.txt) · [OpenAPI document](https://skmtc-service-staging.skmtc.workers.dev/v1/apis/google/gkehub/versions/a0da00122833/schema)