V2 API Config Schema - Rafay Product Documentation
GKE Schema
Cluster configuration for GKE clusters
| Key | Description | Type |
|---|---|---|
| apiVersion: infra.k8smgmt.io/v2 |
string | |
| kind: Cluster |
string | |
| name: | Cluster name | string |
| description: | Cluster Description | string |
| project: | under which the cluster is created | string |
| labels: {} |
Cluster labels | object |
| annotations: {} |
Cluster annotations | object |
| name: | Blueprint associated with the cluster | string |
| version: | Blueprint version associated with the cluster | string |
| cloudCredentials: | Cloud credentials provider used to create and manage the cluster | string |
| enabled: false |
Enable sharing for this resource. | boolean |
| - name: |
Project name | string |
| type: | Cluster Type Gke | string |
| name: | Cluster name | string |
| description: | Cluster Description | string |
| project: | GCP Project name | string |
| type: | Select the Location type as either zonal or regional for cluster provisioning. Supported values: "zonal" or "regional" | string |
| zone: | in which your cluster should be provisioned | string |
| region: | in which your cluster's control plane and nodes are located. You cannot change the cluster's region once it's created. | string |
| zone: | zone is needed for creating bootstrap node. Optional for GKE cluster itself. | string |
| defaultNodeLocations: | List of zones. Increase availability by providing more than one zone. The same number of nodes will be deployed to each zone in the list. | string[] |
| controlPlaneVersion: | Control plane kubernetes version | string |
| name: | of Network that the Kubernetes cluster is in determines which other Compute Engine resources it is able to communicate with. Network is permanent. | string |
| nodeSubnetName: | Subnetwork to which the Kubernetes cluster will belong. When VPC native is enabled, the subnetwork must contain at least two secondary ranges which are not used by other Kubernetes clusters. Subnet is permanent. | string |
| privacy: | Choose the type of network you want to allow to access your cluster's workloads. Supported values: "private", "public" | string |
| controlPlaneIPRange: | Control plane IP range is for the control plane VPC. The control plane range must not overlap with any subnet in your cluster's VPC. The control plane and your cluster use VPC peering to communicate privately. | string |
| enableAccessControlPlaneExternalIP: false |
Disabling this option locks down external access to the cluster control plane. There is still an external IP address used by Google for cluster management purposes, but the IP address is not accessible to anyone. | boolean |
| enableAccessControlPlaneGlobal: false |
With control plane global access, you can access the control plane's private endpoint from any GCP region or on-premises environment no matter what the private cluster's region is. | boolean |
| disableSNAT: false |
To use Privately Used Public IPs (PUPI) ranges, the default source NAT used for IP masquerading needs to be disabled. | boolean |
| - ports: |
An optional list of ports to which this rule applies. This field is only applicable for the UDP or TCP protocol. Each entry must be either an integer or a range. If not specified, this rule applies to connections through any port. Example inputs include: ["22"], ["80","443"], and ["12345-12349"]. | string[] |
| - description: |
An optional description of this resource. Provide this field when you create the resource. | string |
| - destinationRanges: |
If destination ranges are specified, the firewall rule applies only to traffic that has destination IP address in these ranges. These ranges must be expressed in CIDR format. Only IPv4 is supported. | string[] |
| - name: |
of the resource; provided by the client when the resource is created. The name must be 1-63 characters long, and comply with RFC1035. Specifically, the name must be 1-63 characters long and match the regular expression `a-z?`. The first character must be a lowercase letter, and all following characters (except for the last character) must be a dash, lowercase letter, or digit. The last character must be a lowercase letter or digit. | string |
| - network: |
URL of the network resource for this firewall rule. If not specified when creating a firewall rule, the default network is used: global/networks/default If you choose to specify this field, you can specify the network as a full or partial URL. For example, the following are all valid URLs: - https://www.googleapis.com/compute/v1/projects/myproject/global/networks/my-network - projects/myproject/global/networks/my-network - global/networks/default | string |
| - sourceRanges: |
If source ranges are specified, the firewall rule applies only to traffic that has a source IP address in these ranges. These ranges must be expressed in CIDR format. Only IPv4 is supported. | string[] |
| - targetTags: |
A list of tags that control which instances the firewall rule applies to. If targetTags are specified, then the firewall rule applies only to instances in the VPC network that have one of those tags. If no targetTags are specified, the firewall rule applies to all instances on the specified network. | string[] |
| enableVPCNativeTraffic: false |
This feature uses alias IP and provides a more secure integration with Google Cloud Platform services. | boolean |
| maxPodsPerNode: | This value is used to optimize the partitioning of cluster's IP address range to sub-ranges at node level. | integer |
| - authorizedNetworkName: |
Name of the Authorized Network Example: Corporate Office | string |
| - authorizedNetworkCIDR: |
CIDR Example: 198.51.100.0/24 | string |
| podAddrRange: | All pods in the cluster are assigned an IP address from this range. Enter a range (in CIDR notation) within a network range, a mask, or leave this field blank to use a default range. | string |
| podSecondaryRangeName: | Cluster pods are assigned an IP from the selected node subnet's secondary CIDR address range. | string |
| serviceAddrRange: | Cluster services will be assigned an IP address from this IP address range. Enter a range (in CIDR notation) within a network range, a mask, or leave this field blank to use a default range. | string |
| serviceSecondaryRangeName: | Cluster services are assigned an IP from the selected node subnet's secondary CIDR address range. | string |
| enableWorkloadIdentity: false |
Workload Identity lets you connect securely to Google APIs from Kubernetes Engine workloads. | boolean |
| enableGoogleGroupsforRBAC: false |
Google Groups for RBAC allows you to grant roles to all members of a Google Workspace group. | boolean |
| securityGroup: | Provide the security groups here | string |
| enableLegacyAuthorization: false |
Enable legacy authorization to support in-cluster permissions for existing clusters or workflows. Prevents full RBAC support. | boolean |
| issueClientCertificate: false |
Clients use this base64-encoded public certificate to authenticate to the cluster endpoint. Certificates don’t rotate automatically and are difficult to revoke. | boolean |
| enableCloudLogging: false |
Logging collects logs emitted by your applications and by GKE infrastructure. | boolean |
| cloudLoggingComponents: | List of components for cloud logging. Supported values: "SYSTEM_COMPONENTS", "WORKLOADS" | string[] |
| enableCloudMonitoring: false |
Monitoring collects metrics emitted by your applications and by GKE infrastructure. | boolean |
| cloudMonitoringComponents: | List of components for cloud monitoring. Supported values: "SYSTEM_COMPONENTS" | string[] |
| enableManagedServiceforPrometheus: false |
This option deploys managed collectors for Prometheus metrics within this cluster. These collectors must be configured using PodMonitoring resources. To enable Managed Service for Prometheus here, you'll need. Cluster version of 1.21.4-gke.300 or greater | boolean |
| enableApplicationManagerBeta: false |
Application Manager is a GKE controller for managing the lifecycle of applications. It enables application delivery and updates following Kubernetes and GitOps best practices. | boolean |
| enableBackupforGKE: false |
Backup for GKE allows you to back up and restore GKE workloads. There is no cost for enabling this feature, but you are charged for backups based on the size of the data and the number of pods you protect. | boolean |
| enableComputeEnginePersistentDiskCSIDriver: false |
Enable to automatically deploy and manage the Compute Engine Persistent Disk CSI Driver. This feature is an alternative to using the gcePersistentDisk in-tree volume plugin. | boolean |
| enableFilestoreCSIDriver: false |
Enable to automatically deploy and manage the Filestore CSI Driver. | boolean |
| enableImageStreaming: false |
Image streaming allows your workloads to initialize without waiting for the entire image to download. | boolean |
| - name: |
Node pool names must start with a lowercase letter followed by up to 39 lowercase letters, numbers, or hyphens. They can't end with a hyphen. You cannot change the node pool's name once it's created. | string |
| - nodeVersion: |
Specify Node k8s version | string |
| - size: |
Pod address range limits the maximum size of the cluster. | integer |
| - zone: |
Additional node zones must be from the same region as the original zone. Kubernetes Engine allocates the same resource footprint for each zone. The Node pool setting overrides the defaults set in Cluster basics. | string[] |
| minNodes: | Minimum number of nodes (per zone) | integer |
| maxNodes: | Maximum number of nodes (per zone) | integer |
| imageType: | Choose which operating system image you want to run on each node of this cluster. | string |
| machineType: | Choose the machine type that will best fit the resource needs of your cluster. | string |
| bootDiskType: | Storage space is less expensive for a standard persistent disk. An SSD persistent disk is better for random IOPS or for streaming throughput with low latency. | string |
| bootDiskSize: | Boot disk size is permanent. | integer |
| consumeReservationType: | corresponds to the type of reservation consumption. Out of none, any, specific. | string |
| reservationName: | name of reservation to be consumed. Only mandatory when ConsumeReservationType is set to specific. |
string |
| - type: |
Accelerator type - GPU type | string |
| - count: |
Accelerator count - Number of GPUs | integer |
| strategy: | The strategy to use for sharing GPUs. Example: Time-Sharing | string |
| maxSharedClients: | The max number of clients that can share a physical GPU device. | integer |
| type: | The type of driver installation to use. Example: google-managed or user-managed | string |
| version: | If GPUDriverInstallation type is google-managed then version needs to be specified | string |
| - gpuPartitionSize: |
Size of partitions to create on the GPU. Valid values are described in the guide - https://docs.nvidia.com/datacenter/tesla/mig-user-guide/#partitioning | string |
| maxPodsPerNode: | This value is used to optimize the partitioning of cluster's IP address range to sub-ranges at node level. | integer |
| networkTags: | This value is used to optimize the partitioning of cluster's IP address range to sub-ranges at node level. | string[] |
| enableIntegrityMonitoring: false |
Integrity monitoring lets you monitor and verify the runtime boot integrity of your shielded nodes using Cloud Monitoring. | boolean |
| enableSecureBoot: false |
Integrity monitoring lets you monitor and verify the runtime boot integrity of your shielded nodes using Cloud Monitoring. | boolean |
| - key: |
Key for this kubernetes label | string |
| - value: |
Value for this kubernetes label | string |
| - effect: |
Available effects are `NoSchedule`, `PreferNoSchedule`, `NoExecute` | string |
| - key: |
Key for this Taint effect | string |
| - value: |
Value for this Taint effect | string |
| - key: |
Key for this metadata | string |
| - value: |
Value for this metadata | string |
| autoUpgrade: false |
Whether the nodes will be automatically upgraded. | boolean |
| strategy: | Update strategy of the node pool. Possible values are SURGE and BLUE_GREEN. | string |
| maxSurge: | The maximum number of nodes that can be created beyond the current size of the node pool during the upgrade process. | integer |
| maxUnavailable: | The maximum number of nodes that can be simultaneously unavailable during the upgrade process. A node is considered available if its status is Ready. | integer |
| nodePoolSoakDuration: | Time needed after draining entire blue pool. After this period, blue pool will be cleaned up. | string |
| batchNodeCount: | Number of blue nodes to drain in a batch. | integer |
| batchSoakDuration: | Soak time after each batch gets drained. | string |
| enabled: false |
Enable this option if your infrastructure is running behind a proxy | boolean |
| httpProxy: | Configure proxy information with protocol, host and port information. Ex : http://proxy.example.com:8080/ | string |
| httpsProxy: | Configure proxy information with protocol, host and port information. Ex : https://proxy.example.com:8080/ | string |
| noProxy: | Comma separated list of hosts that need connectivity without proxy. Ex : example.com, 10.96.0.0/12, 10.244.0.0/16 | string |
| proxyAuth: | Proxy Authentication | string |
| allowInsecureBootstrap: false |
Select this option if proxy is terminating/inspecting TLS traffic | boolean |
| bootstrapCA: | Root CA certificate of the proxy | string |
| preBootstrapCommands: | list of commands user wants to execute on target cluster before bootstrapping | string[] |