Skip to content

googleContainerAwsCluster

An Anthos cluster running on AWS.

For more information, see:

Example Usage - basic_aws_cluster

A basic example of a containeraws cluster

/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as google from "./.gen/providers/google";
/*The following providers are missing schema information and might need manual adjustments to synthesize correctly: google.
For a more precise conversion please use the --provider flag in convert.*/
const dataGoogleContainerAwsVersionsVersions =
  new google.dataGoogleContainerAwsVersions.DataGoogleContainerAwsVersions(
    this,
    "versions",
    {
      location: "us-west1",
      project: "my-project-name",
    }
  );
new google.containerAwsCluster.ContainerAwsCluster(this, "primary", {
  annotations: [
    {
      "label-one": "value-one",
    },
  ],
  authorization: [
    {
      admin_users: [
        {
          username: "my@service-account.com",
        },
      ],
    },
  ],
  aws_region: "my-aws-region",
  control_plane: [
    {
      aws_services_authentication: [
        {
          role_arn: "arn:aws:iam::012345678910:role/my--1p-dev-oneplatform",
          role_session_name: "my--1p-dev-session",
        },
      ],
      config_encryption: [
        {
          kms_key_arn:
            "arn:aws:kms:my-aws-region:012345678910:key/12345678-1234-1234-1234-123456789111",
        },
      ],
      database_encryption: [
        {
          kms_key_arn:
            "arn:aws:kms:my-aws-region:012345678910:key/12345678-1234-1234-1234-123456789111",
        },
      ],
      iam_instance_profile: "my--1p-dev-controlplane",
      instance_type: "t3.medium",
      main_volume: [
        {
          iops: 3000,
          kms_key_arn:
            "arn:aws:kms:my-aws-region:012345678910:key/12345678-1234-1234-1234-123456789111",
          size_gib: 10,
          volume_type: "GP3",
        },
      ],
      proxy_config: [
        {
          secret_arn:
            "arn:aws:secretsmanager:us-west-2:126285863215:secret:proxy_config20210824150329476300000001-ABCDEF",
          secret_version: "12345678-ABCD-EFGH-IJKL-987654321098",
        },
      ],
      root_volume: [
        {
          iops: 3000,
          kms_key_arn:
            "arn:aws:kms:my-aws-region:012345678910:key/12345678-1234-1234-1234-123456789111",
          size_gib: 10,
          volume_type: "GP3",
        },
      ],
      security_group_ids: ["sg-00000000000000000"],
      ssh_config: [
        {
          ec2_key_pair: "my--1p-dev-ssh",
        },
      ],
      subnet_ids: ["subnet-00000000000000000"],
      tags: {
        owner: "my@service-account.com",
      },
      version: `\${${dataGoogleContainerAwsVersionsVersions.validVersions.fqn}[0]}`,
    },
  ],
  description: "A sample aws cluster",
  fleet: [
    {
      project: "my-project-number",
    },
  ],
  location: "us-west1",
  name: "name",
  networking: [
    {
      pod_address_cidr_blocks: ["10.2.0.0/16"],
      service_address_cidr_blocks: ["10.1.0.0/16"],
      vpc_id: "vpc-00000000000000000",
    },
  ],
  project: "my-project-name",
});

Argument Reference

The following arguments are supported:

  • authorization - (Required) Configuration related to the cluster RBAC settings.

  • awsRegion - (Required) The AWS region where the cluster runs. Each Google Cloud region supports a subset of nearby AWS regions. You can call to list all supported AWS regions within a given Google Cloud region.

  • controlPlane - (Required) Configuration related to the cluster control plane.

  • fleet - (Required) Fleet configuration.

  • location - (Required) The location for the resource

  • name - (Required) The name of this resource.

  • networking - (Required) Cluster-wide networking configuration.

The authorization block supports:

  • adminUsers - (Required) Users to perform operations as a cluster admin. A managed ClusterRoleBinding will be created to grant the clusterAdmin ClusterRole to the users. Up to ten admin users can be provided. For more info on RBAC, see https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles

The adminUsers block supports:

  • username - (Required) The name of the user, e.g. myGcpId@gmailCom.

The controlPlane block supports:

  • awsServicesAuthentication - (Required) Authentication configuration for management of AWS resources.

  • configEncryption - (Required) The ARN of the AWS KMS key used to encrypt cluster configuration.

  • databaseEncryption - (Required) The ARN of the AWS KMS key used to encrypt cluster secrets.

  • iamInstanceProfile - (Required) The name of the AWS IAM instance pofile to assign to each control plane replica.

  • instancePlacement - (Optional) (Beta only) Details of placement information for an instance.

  • instanceType - (Optional) Optional. The AWS instance type. When unspecified, it defaults to m5Large.

  • mainVolume - (Optional) Optional. Configuration related to the main volume provisioned for each control plane replica. The main volume is in charge of storing all of the cluster's etcd state. Volumes will be provisioned in the availability zone associated with the corresponding subnet. When unspecified, it defaults to 8 GiB with the GP2 volume type.

  • proxyConfig - (Optional) Proxy configuration for outbound HTTP(S) traffic.

  • rootVolume - (Optional) Optional. Configuration related to the root volume provisioned for each control plane replica. Volumes will be provisioned in the availability zone associated with the corresponding subnet. When unspecified, it defaults to 32 GiB with the GP2 volume type.

  • securityGroupIds - (Optional) Optional. The IDs of additional security groups to add to control plane replicas. The Anthos Multi-Cloud API will automatically create and manage security groups with the minimum rules needed for a functioning cluster.

  • sshConfig - (Optional) Optional. SSH configuration for how to access the underlying control plane machines.

  • subnetIds - (Required) The list of subnets where control plane replicas will run. A replica will be provisioned on each subnet and up to three values can be provided. Each subnet must be in a different AWS Availability Zone (AZ).

  • tags - (Optional) Optional. A set of AWS resource tags to propagate to all underlying managed AWS resources. Specify at most 50 pairs containing alphanumerics, spaces, and symbols (.+-=_:@/). Keys can be up to 127 Unicode characters. Values can be up to 255 Unicode characters.

  • version - (Required) The Kubernetes version to run on control plane replicas (e.g. 11910Gke1000). You can list all supported versions on a given Google Cloud region by calling .

The awsServicesAuthentication block supports:

  • roleArn - (Required) The Amazon Resource Name (ARN) of the role that the Anthos Multi-Cloud API will assume when managing AWS resources on your account.

  • roleSessionName - (Optional) Optional. An identifier for the assumed role session. When unspecified, it defaults to multicloudServiceAgent.

The configEncryption block supports:

  • kmsKeyArn - (Required) The ARN of the AWS KMS key used to encrypt cluster configuration.

The databaseEncryption block supports:

  • kmsKeyArn - (Required) The ARN of the AWS KMS key used to encrypt cluster secrets.

The fleet block supports:

  • membership - The name of the managed Hub Membership resource associated to this cluster. Membership names are formatted as projects//locations/global/membership/.

  • project - (Optional) The number of the Fleet host project where this cluster will be registered.

The networking block supports:

  • podAddressCidrBlocks - (Required) All pods in the cluster are assigned an RFC1918 IPv4 address from these ranges. Only a single range is supported. This field cannot be changed after creation.

  • serviceAddressCidrBlocks - (Required) All services in the cluster are assigned an RFC1918 IPv4 address from these ranges. Only a single range is supported. This field cannot be changed after creation.

  • vpcId - (Required) The VPC associated with the cluster. All component clusters (i.e. control plane and node pools) run on a single VPC. This field cannot be changed after creation.

  • annotations - (Optional) Optional. Annotations on the cluster. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Key can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.

  • description - (Optional) Optional. A human readable description of this cluster. Cannot be longer than 255 UTF-8 encoded bytes.

  • loggingConfig - (Optional) (Beta only) Logging configuration.

  • project - (Optional) The project for the resource

The instancePlacement block supports:

  • tenancy - (Optional) The tenancy for the instance. Possible values: TENANCY_UNSPECIFIED, DEFAULT, DEDICATED, HOST

The mainVolume block supports:

  • iops - (Optional) Optional. The number of I/O operations per second (IOPS) to provision for GP3 volume.

  • kmsKeyArn - (Optional) Optional. The Amazon Resource Name (ARN) of the Customer Managed Key (CMK) used to encrypt AWS EBS volumes. If not specified, the default Amazon managed key associated to the AWS region where this cluster runs will be used.

  • sizeGib - (Optional) Optional. The size of the volume, in GiBs. When unspecified, a default value is provided. See the specific reference in the parent resource.

  • volumeType - (Optional) Optional. Type of the EBS volume. When unspecified, it defaults to GP2 volume. Possible values: VOLUME_TYPE_UNSPECIFIED, GP2, GP3

The proxyConfig block supports:

  • secretArn - (Required) The ARN of the AWS Secret Manager secret that contains the HTTP(S) proxy configuration.

  • secretVersion - (Required) The version string of the AWS Secret Manager secret that contains the HTTP(S) proxy configuration.

The rootVolume block supports:

  • iops - (Optional) Optional. The number of I/O operations per second (IOPS) to provision for GP3 volume.

  • kmsKeyArn - (Optional) Optional. The Amazon Resource Name (ARN) of the Customer Managed Key (CMK) used to encrypt AWS EBS volumes. If not specified, the default Amazon managed key associated to the AWS region where this cluster runs will be used.

  • sizeGib - (Optional) Optional. The size of the volume, in GiBs. When unspecified, a default value is provided. See the specific reference in the parent resource.

  • volumeType - (Optional) Optional. Type of the EBS volume. When unspecified, it defaults to GP2 volume. Possible values: VOLUME_TYPE_UNSPECIFIED, GP2, GP3

The sshConfig block supports:

  • ec2KeyPair - (Required) The name of the EC2 key pair used to login into cluster machines.

The loggingConfig block supports:

  • componentConfig - (Optional) Configuration of the logging components.

The componentConfig block supports:

  • enableComponents - (Optional) Components of the logging configuration to be enabled.

Attributes Reference

In addition to the arguments listed above, the following computed attributes are exported:

  • id - an identifier for the resource with format projects/{{project}}/locations/{{location}}/awsClusters/{{name}}

  • createTime - Output only. The time at which this cluster was created.

  • endpoint - Output only. The endpoint of the cluster's API server.

  • etag - Allows clients to perform consistent read-modify-writes through optimistic concurrency control. May be sent on update and delete requests to ensure the client has an up-to-date value before proceeding.

  • reconciling - Output only. If set, there are currently changes in flight to the cluster.

  • state - Output only. The current state of the cluster. Possible values: STATE_UNSPECIFIED, PROVISIONING, RUNNING, RECONCILING, STOPPING, ERROR, DEGRADED

  • uid - Output only. A globally unique identifier for the cluster.

  • updateTime - Output only. The time at which this cluster was last updated.

  • workloadIdentityConfig - Output only. Workload Identity settings.

Timeouts

This resource provides the following Timeouts configuration options:

  • create - Default is 20 minutes.
  • update - Default is 20 minutes.
  • delete - Default is 20 minutes.

Import

Cluster can be imported using any of these accepted formats:

$ terraform import google_container_aws_cluster.default projects/{{project}}/locations/{{location}}/awsClusters/{{name}}
$ terraform import google_container_aws_cluster.default {{project}}/{{location}}/{{name}}
$ terraform import google_container_aws_cluster.default {{location}}/{{name}}