Skip to content

googleContainerAzureCluster

An Anthos cluster running on Azure.

For more information, see:

Example Usage - basic_azure_cluster

A basic example of a containerazure azure cluster

/*Provider bindings are generated by running cdktf get.
See https://cdk.tf/provider-generation for more details.*/
import * as google from "./.gen/providers/google";
/*The following providers are missing schema information and might need manual adjustments to synthesize correctly: google.
For a more precise conversion please use the --provider flag in convert.*/
const googleContainerAzureClientBasic =
  new google.containerAzureClient.ContainerAzureClient(this, "basic", {
    application_id: "12345678-1234-1234-1234-123456789111",
    location: "us-west1",
    name: "client-name",
    project: "my-project-name",
    tenant_id: "12345678-1234-1234-1234-123456789111",
  });
const dataGoogleContainerAzureVersionsVersions =
  new google.dataGoogleContainerAzureVersions.DataGoogleContainerAzureVersions(
    this,
    "versions",
    {
      location: "us-west1",
      project: "my-project-name",
    }
  );
new google.containerAzureCluster.ContainerAzureCluster(this, "primary", {
  authorization: [
    {
      admin_users: [
        {
          username: "mmv2@google.com",
        },
      ],
    },
  ],
  azure_region: "westus2",
  client: `projects/my-project-number/locations/us-west1/azureClients/\${${googleContainerAzureClientBasic.name}}`,
  control_plane: [
    {
      ssh_config: [
        {
          authorized_key:
            "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQC8yaayO6lnb2v+SedxUMa2c8vtIEzCzBjM3EJJsv8Vm9zUDWR7dXWKoNGARUb2mNGXASvI6mFIDXTIlkQ0poDEPpMaXR0g2cb5xT8jAAJq7fqXL3+0rcJhY/uigQ+MrT6s+ub0BFVbsmGHNrMQttXX9gtmwkeAEvj3mra9e5pkNf90qlKnZz6U0SVArxVsLx07vHPHDIYrl0OPG4zUREF52igbBPiNrHJFDQJT/4YlDMJmo/QT/A1D6n9ocemvZSzhRx15/Arjowhr+VVKSbaxzPtEfY0oIg2SrqJnnr/l3Du5qIefwh5VmCZe4xopPUaDDoOIEFriZ88sB+3zz8ib8sk8zJJQCgeP78tQvXCgS+4e5W3TUg9mxjB6KjXTyHIVhDZqhqde0OI3Fy1UuVzRUwnBaLjBnAwP5EoFQGRmDYk/rEYe7HTmovLeEBUDQocBQKT4Ripm/xJkkWY7B07K/tfo56dGUCkvyIVXKBInCh+dLK7gZapnd4UWkY0xBYcwo1geMLRq58iFTLA2j/JmpmHXp7m0l7jJii7d44uD3tTIFYThn7NlOnvhLim/YcBK07GMGIN7XwrrKZKmxXaspw6KBWVhzuw1UPxctxshYEaMLfFg/bwOw8HvMPr9VtrElpSB7oiOh91PDIPdPBgHCi7N2QgQ5l/ZDBHieSpNrQ== thomasrodgers",
        },
      ],
      subnet_id:
        "/subscriptions/12345678-1234-1234-1234-123456789111/resourceGroups/my--dev-byo/providers/Microsoft.Network/virtualNetworks/my--dev-vnet/subnets/default",
      version: `\${${dataGoogleContainerAzureVersionsVersions.validVersions.fqn}[0]}`,
    },
  ],
  fleet: [
    {
      project: "my-project-number",
    },
  ],
  location: "us-west1",
  name: "name",
  networking: [
    {
      pod_address_cidr_blocks: ["10.200.0.0/16"],
      service_address_cidr_blocks: ["10.32.0.0/24"],
      virtual_network_id:
        "/subscriptions/12345678-1234-1234-1234-123456789111/resourceGroups/my--dev-byo/providers/Microsoft.Network/virtualNetworks/my--dev-vnet",
    },
  ],
  project: "my-project-name",
  resource_group_id:
    "/subscriptions/12345678-1234-1234-1234-123456789111/resourceGroups/my--dev-cluster",
});

Argument Reference

The following arguments are supported:

  • authorization - (Required) Configuration related to the cluster RBAC settings.

  • azureRegion - (Required) The Azure region where the cluster runs. Each Google Cloud region supports a subset of nearby Azure regions. You can call to list all supported Azure regions within a given Google Cloud region.

  • controlPlane - (Required) Configuration related to the cluster control plane.

  • fleet - (Required) Fleet configuration.

  • location - (Required) The location for the resource

  • name - (Required) The name of this resource.

  • networking - (Required) Cluster-wide networking configuration.

  • resourceGroupId - (Required) The ARM ID of the resource group where the cluster resources are deployed. For example: /subscriptions/*/resourceGroups/*

The authorization block supports:

  • adminUsers - (Required) Users that can perform operations as a cluster admin. A new ClusterRoleBinding will be created to grant the cluster-admin ClusterRole to the users. Up to ten admin users can be provided. For more info on RBAC, see https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles

The adminUsers block supports:

  • username - (Required) The name of the user, e.g. myGcpId@gmailCom.

The controlPlane block supports:

  • databaseEncryption - (Optional) Optional. Configuration related to application-layer secrets encryption.

  • mainVolume - (Optional) Optional. Configuration related to the main volume provisioned for each control plane replica. The main volume is in charge of storing all of the cluster's etcd state. When unspecified, it defaults to a 8-GiB Azure Disk.

  • proxyConfig - (Optional) Proxy configuration for outbound HTTP(S) traffic.

  • replicaPlacements - (Optional) Configuration for where to place the control plane replicas. Up to three replica placement instances can be specified. If replica_placements is set, the replica placement instances will be applied to the three control plane replicas as evenly as possible.

  • rootVolume - (Optional) Optional. Configuration related to the root volume provisioned for each control plane replica. When unspecified, it defaults to 32-GiB Azure Disk.

  • sshConfig - (Required) SSH configuration for how to access the underlying control plane machines.

  • subnetId - (Required) The ARM ID of the subnet where the control plane VMs are deployed. Example: /subscriptions//resourceGroups//providers/microsoftNetwork/virtualNetworks//subnets/default.

  • tags - (Optional) Optional. A set of tags to apply to all underlying control plane Azure resources.

  • version - (Required) The Kubernetes version to run on control plane replicas (e.g. 11910Gke1000). You can list all supported versions on a given Google Cloud region by calling GetAzureServerConfig.

  • vmSize - (Optional) Optional. The Azure VM size name. Example: standardDs2V2. For available VM sizes, see https://docs.microsoft.com/en-us/azure/virtual-machines/vm-naming-conventions. When unspecified, it defaults to standardDs2V2.

The sshConfig block supports:

  • authorizedKey - (Required) The SSH public key data for VMs managed by Anthos. This accepts the authorized_keys file format used in OpenSSH according to the sshd(8) manual page.

The fleet block supports:

  • membership - The name of the managed Hub Membership resource associated to this cluster. Membership names are formatted as projects//locations/global/membership/.

  • project - (Optional) The number of the Fleet host project where this cluster will be registered.

The networking block supports:

  • podAddressCidrBlocks - (Required) The IP address range of the pods in this cluster, in CIDR notation (e.g. 109600/14). All pods in the cluster get assigned a unique RFC1918 IPv4 address from these ranges. Only a single range is supported. This field cannot be changed after creation.

  • serviceAddressCidrBlocks - (Required) The IP address range for services in this cluster, in CIDR notation (e.g. 109600/14). All services in the cluster get assigned a unique RFC1918 IPv4 address from these ranges. Only a single range is supported. This field cannot be changed after creating a cluster.

  • virtualNetworkId - (Required) The Azure Resource Manager (ARM) ID of the VNet associated with your cluster. All components in the cluster (i.e. control plane and node pools) run on a single VNet. Example: /subscriptions/*/resourceGroups/*/providers/microsoftNetwork/virtualNetworks/* This field cannot be changed after creation.

  • annotations - (Optional) Optional. Annotations on the cluster. This field has the same restrictions as Kubernetes annotations. The total size of all keys and values combined is limited to 256k. Keys can have 2 segments: prefix (optional) and name (required), separated by a slash (/). Prefix must be a DNS subdomain. Name must be 63 characters or less, begin and end with alphanumerics, with dashes (-), underscores (_), dots (.), and alphanumerics between.

  • azureServicesAuthentication - (Optional) Azure authentication configuration for management of Azure resources

  • client - (Optional) Name of the AzureClient. The azureClient resource must reside on the same GCP project and region as the azureCluster. azureClient names are formatted as projects/<projectNumber>/locations/<region>/azureClients/<clientId>. See Resource Names (https:cloud.google.com/apis/design/resource_names) for more details on Google Cloud resource names.

  • description - (Optional) Optional. A human readable description of this cluster. Cannot be longer than 255 UTF-8 encoded bytes.

  • loggingConfig - (Optional) (Beta only) Logging configuration.

  • project - (Optional) The project for the resource

The azureServicesAuthentication block supports:

  • applicationId - (Required) The Azure Active Directory Application ID for Authentication configuration.

  • tenantId - (Required) The Azure Active Directory Tenant ID for Authentication configuration.

The databaseEncryption block supports:

  • keyId - (Required) The ARM ID of the Azure Key Vault key to encrypt / decrypt data. For example: /subscriptions/<subscriptionId>/resourceGroups/<resourceGroupId>/providers/microsoftKeyVault/vaults/<keyVaultId>/keys/<keyName> Encryption will always take the latest version of the key and hence specific version is not supported.

The mainVolume block supports:

  • sizeGib - (Optional) Optional. The size of the disk, in GiBs. When unspecified, a default value is provided. See the specific reference in the parent resource.

The proxyConfig block supports:

  • resourceGroupId - (Required) The ARM ID the of the resource group containing proxy keyvault. Resource group ids are formatted as /subscriptions/<subscriptionId>/resourceGroups/<resourceGroupName>

  • secretId - (Required) The URL the of the proxy setting secret with its version. Secret ids are formatted as https:<keyVaultName>VaultAzureNet/secrets/<secretName>/<secretVersion>.

The replicaPlacements block supports:

  • azureAvailabilityZone - (Required) For a given replica, the Azure availability zone where to provision the control plane VM and the ETCD disk.

  • subnetId - (Required) For a given replica, the ARM ID of the subnet where the control plane VM is deployed. Make sure it's a subnet under the virtual network in the cluster configuration.

The rootVolume block supports:

  • sizeGib - (Optional) Optional. The size of the disk, in GiBs. When unspecified, a default value is provided. See the specific reference in the parent resource.

The loggingConfig block supports:

  • componentConfig - (Optional) Configuration of the logging components.

The componentConfig block supports:

  • enableComponents - (Optional) Components of the logging configuration to be enabled.

Attributes Reference

In addition to the arguments listed above, the following computed attributes are exported:

  • id - an identifier for the resource with format projects/{{project}}/locations/{{location}}/azureClusters/{{name}}

  • createTime - Output only. The time at which this cluster was created.

  • endpoint - Output only. The endpoint of the cluster's API server.

  • etag - Allows clients to perform consistent read-modify-writes through optimistic concurrency control. May be sent on update and delete requests to ensure the client has an up-to-date value before proceeding.

  • reconciling - Output only. If set, there are currently changes in flight to the cluster.

  • state - Output only. The current state of the cluster. Possible values: STATE_UNSPECIFIED, PROVISIONING, RUNNING, RECONCILING, STOPPING, ERROR, DEGRADED

  • uid - Output only. A globally unique identifier for the cluster.

  • updateTime - Output only. The time at which this cluster was last updated.

  • workloadIdentityConfig - Output only. Workload Identity settings.

Timeouts

This resource provides the following Timeouts configuration options:

  • create - Default is 20 minutes.
  • update - Default is 20 minutes.
  • delete - Default is 20 minutes.

Import

Cluster can be imported using any of these accepted formats:

$ terraform import google_container_azure_cluster.default projects/{{project}}/locations/{{location}}/azureClusters/{{name}}
$ terraform import google_container_azure_cluster.default {{project}}/{{location}}/{{name}}
$ terraform import google_container_azure_cluster.default {{location}}/{{name}}