// Copyright 2026 Google LLC

//

// Licensed under the Apache License, Version 2.0 (the "License");

// you may not use this file except in compliance with the License.

// You may obtain a copy of the License at

//

// http://www.apache.org/licenses/LICENSE-2.0

//

// Unless required by applicable law or agreed to in writing, software

// distributed under the License is distributed on an "AS IS" BASIS,

// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.

// See the License for the specific language governing permissions and

// limitations under the License.

syntax = "proto3";

package google.container.v1;

import "google/api/annotations.proto";

import "google/api/client.proto";

import "google/api/field_behavior.proto";

import "google/api/resource.proto";

import "google/protobuf/duration.proto";

import "google/protobuf/empty.proto";

import "google/protobuf/timestamp.proto";

import "google/protobuf/wrappers.proto";

import "google/rpc/code.proto";

import "google/rpc/status.proto";

option csharp_namespace = "Google.Cloud.Container.V1";

option go_package = "cloud.google.com/go/container/apiv1/containerpb;containerpb";

option java_multiple_files = true;

option java_outer_classname = "ClusterServiceProto";

option java_package = "com.google.container.v1";

option php_namespace = "Google\\Cloud\\Container\\V1";

option ruby_package = "Google::Cloud::Container::V1";

option (google.api.resource_definition) = {

type: "pubsub.googleapis.com/Topic"

pattern: "projects/{project}/topics/{topic}"

};

option (google.api.resource_definition) = {

type: "privateca.googleapis.com/CaPool"

pattern: "projects/{project}/locations/{location}/caPools/{ca_pool}"

};

option (google.api.resource_definition) = {

type: "cloudkms.googleapis.com/CryptoKeyVersion"

pattern: "projects/{project}/locations/{location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}/cryptoKeyVersions/{crypto_key_version}"

};

option (google.api.resource_definition) = {

type: "compute.googleapis.com/Subnetwork"

pattern: "projects/{project}/regions/{region}/subnetworks/{subnetwork}"

};

// Google Kubernetes Engine Cluster Manager v1

service ClusterManager {

option (google.api.default_host) = "container.googleapis.com";

option (google.api.oauth_scopes) =

"https://www.googleapis.com/auth/cloud-platform";

// Lists all clusters owned by a project in either the specified zone or all

// zones.

rpc ListClusters(ListClustersRequest) returns (ListClustersResponse) {

option (google.api.http) = {

get: "/v1/{parent=projects/*/locations/*}/clusters"

additional_bindings {

get: "/v1/projects/{project_id}/zones/{zone}/clusters"

}

};

option (google.api.method_signature) = "project_id,zone";

option (google.api.method_signature) = "parent";

}

// Gets the details of a specific cluster.

rpc GetCluster(GetClusterRequest) returns (Cluster) {

option (google.api.http) = {

get: "/v1/{name=projects/*/locations/*/clusters/*}"

additional_bindings {

get: "/v1/projects/{project_id}/zones/{zone}/clusters/{cluster_id}"

}

};

option (google.api.method_signature) = "project_id,zone,cluster_id";

option (google.api.method_signature) = "name";

}

// Creates a cluster, consisting of the specified number and type of Google

// Compute Engine instances.

//

// By default, the cluster is created in the project's

// [default

// network](https://cloud.google.com/compute/docs/networks-and-firewalls#networks).

//

// One firewall is added for the cluster. After cluster creation,

// the kubelet creates routes for each node to allow the containers

// on that node to communicate with all other instances in the

// cluster.

//

// Finally, an entry is added to the project's global metadata indicating

// which CIDR range the cluster is using.

rpc CreateCluster(CreateClusterRequest) returns (Operation) {

option (google.api.http) = {

post: "/v1/{parent=projects/*/locations/*}/clusters"

body: "*"

additional_bindings {

post: "/v1/projects/{project_id}/zones/{zone}/clusters"

body: "*"

}

};

option (google.api.method_signature) = "project_id,zone,cluster";

option (google.api.method_signature) = "parent,cluster";

}

// Updates the settings of a specific cluster.

rpc UpdateCluster(UpdateClusterRequest) returns (Operation) {

option (google.api.http) = {

put: "/v1/{name=projects/*/locations/*/clusters/*}"

body: "*"

additional_bindings {

put: "/v1/projects/{project_id}/zones/{zone}/clusters/{cluster_id}"

body: "*"

}

};

option (google.api.method_signature) = "project_id,zone,cluster_id,update";

option (google.api.method_signature) = "name,update";

}

// Updates the version and/or image type for the specified node pool.

rpc UpdateNodePool(UpdateNodePoolRequest) returns (Operation) {

option (google.api.http) = {

put: "/v1/{name=projects/*/locations/*/clusters/*/nodePools/*}"

body: "*"

additional_bindings {

post: "/v1/projects/{project_id}/zones/{zone}/clusters/{cluster_id}/nodePools/{node_pool_id}/update"

body: "*"

}

};

}

// Sets the autoscaling settings for the specified node pool.

rpc SetNodePoolAutoscaling(SetNodePoolAutoscalingRequest)

returns (Operation) {

option (google.api.http) = {

post: "/v1/{name=projects/*/locations/*/clusters/*/nodePools/*}:setAutoscaling"

body: "*"

additional_bindings {

post: "/v1/projects/{project_id}/zones/{zone}/clusters/{cluster_id}/nodePools/{node_pool_id}/autoscaling"

body: "*"

}

};

}

// Sets the logging service for a specific cluster.

rpc SetLoggingService(SetLoggingServiceRequest) returns (Operation) {

option (google.api.http) = {

post: "/v1/{name=projects/*/locations/*/clusters/*}:setLogging"

body: "*"

additional_bindings {

post: "/v1/projects/{project_id}/zones/{zone}/clusters/{cluster_id}/logging"

body: "*"

}

};

option (google.api.method_signature) =

"project_id,zone,cluster_id,logging_service";

option (google.api.method_signature) = "name,logging_service";

}

// Sets the monitoring service for a specific cluster.

rpc SetMonitoringService(SetMonitoringServiceRequest) returns (Operation) {

option (google.api.http) = {

post: "/v1/{name=projects/*/locations/*/clusters/*}:setMonitoring"

body: "*"

additional_bindings {

post: "/v1/projects/{project_id}/zones/{zone}/clusters/{cluster_id}/monitoring"

body: "*"

}

};

option (google.api.method_signature) =

"project_id,zone,cluster_id,monitoring_service";

option (google.api.method_signature) = "name,monitoring_service";

}

// Sets the addons for a specific cluster.

rpc SetAddonsConfig(SetAddonsConfigRequest) returns (Operation) {

option (google.api.http) = {

post: "/v1/{name=projects/*/locations/*/clusters/*}:setAddons"

body: "*"

additional_bindings {

post: "/v1/projects/{project_id}/zones/{zone}/clusters/{cluster_id}/addons"

body: "*"

}

};

option (google.api.method_signature) =

"project_id,zone,cluster_id,addons_config";

option (google.api.method_signature) = "name,addons_config";

}

// Sets the locations for a specific cluster.

// Deprecated. Use

// [projects.locations.clusters.update](https://cloud.google.com/kubernetes-engine/docs/reference/rest/v1/projects.locations.clusters/update)

// instead.

rpc SetLocations(SetLocationsRequest) returns (Operation) {

option deprecated = true;

option (google.api.http) = {

post: "/v1/{name=projects/*/locations/*/clusters/*}:setLocations"

body: "*"

additional_bindings {

post: "/v1/projects/{project_id}/zones/{zone}/clusters/{cluster_id}/locations"

body: "*"

}

};

option (google.api.method_signature) =

"project_id,zone,cluster_id,locations";

option (google.api.method_signature) = "name,locations";

}

// Updates the master for a specific cluster.

rpc UpdateMaster(UpdateMasterRequest) returns (Operation) {

option (google.api.http) = {

post: "/v1/{name=projects/*/locations/*/clusters/*}:updateMaster"

body: "*"

additional_bindings {

post: "/v1/projects/{project_id}/zones/{zone}/clusters/{cluster_id}/master"

body: "*"

}

};

option (google.api.method_signature) =

"project_id,zone,cluster_id,master_version";

option (google.api.method_signature) = "name,master_version";

}

// Sets master auth materials. Currently supports changing the admin password

// or a specific cluster, either via password generation or explicitly setting

// the password.

rpc SetMasterAuth(SetMasterAuthRequest) returns (Operation) {

option (google.api.http) = {

post: "/v1/{name=projects/*/locations/*/clusters/*}:setMasterAuth"

body: "*"

additional_bindings {

post: "/v1/projects/{project_id}/zones/{zone}/clusters/{cluster_id}:setMasterAuth"

body: "*"

}

};

}

// Deletes the cluster, including the Kubernetes endpoint and all worker

// nodes.

//

// Firewalls and routes that were configured during cluster creation

// are also deleted.

//

// Other Google Compute Engine resources that might be in use by the cluster,

// such as load balancer resources, are not deleted if they weren't present

// when the cluster was initially created.

rpc DeleteCluster(DeleteClusterRequest) returns (Operation) {

option (google.api.http) = {

delete: "/v1/{name=projects/*/locations/*/clusters/*}"

additional_bindings {

delete: "/v1/projects/{project_id}/zones/{zone}/clusters/{cluster_id}"

}

};

option (google.api.method_signature) = "project_id,zone,cluster_id";

option (google.api.method_signature) = "name";

}

// Lists all operations in a project in a specific zone or all zones.

rpc ListOperations(ListOperationsRequest) returns (ListOperationsResponse) {

option (google.api.http) = {

get: "/v1/{parent=projects/*/locations/*}/operations"

additional_bindings {

get: "/v1/projects/{project_id}/zones/{zone}/operations"

}

};

option (google.api.method_signature) = "project_id,zone";

option (google.api.method_signature) = "parent";

}

// Gets the specified operation.

rpc GetOperation(GetOperationRequest) returns (Operation) {

option (google.api.http) = {

get: "/v1/{name=projects/*/locations/*/operations/*}"

additional_bindings {

get: "/v1/projects/{project_id}/zones/{zone}/operations/{operation_id}"

}

};

option (google.api.method_signature) = "project_id,zone,operation_id";

option (google.api.method_signature) = "name";

}

// Cancels the specified operation.

rpc CancelOperation(CancelOperationRequest) returns (google.protobuf.Empty) {

option (google.api.http) = {

post: "/v1/{name=projects/*/locations/*/operations/*}:cancel"

body: "*"

additional_bindings {

post: "/v1/projects/{project_id}/zones/{zone}/operations/{operation_id}:cancel"

body: "*"

}

};

option (google.api.method_signature) = "project_id,zone,operation_id";

option (google.api.method_signature) = "name";

}

// Returns configuration info about the Google Kubernetes Engine service.

rpc GetServerConfig(GetServerConfigRequest) returns (ServerConfig) {

option (google.api.http) = {

get: "/v1/{name=projects/*/locations/*}/serverConfig"

additional_bindings {

get: "/v1/projects/{project_id}/zones/{zone}/serverconfig"

}

};

option (google.api.method_signature) = "project_id,zone";

option (google.api.method_signature) = "name";

}

// Gets the public component of the cluster signing keys in

// JSON Web Key format.

rpc GetJSONWebKeys(GetJSONWebKeysRequest) returns (GetJSONWebKeysResponse) {

option (google.api.http) = {

get: "/v1/{parent=projects/*/locations/*/clusters/*}/jwks"

};

}

// Lists the node pools for a cluster.

rpc ListNodePools(ListNodePoolsRequest) returns (ListNodePoolsResponse) {

option (google.api.http) = {

get: "/v1/{parent=projects/*/locations/*/clusters/*}/nodePools"

additional_bindings {

get: "/v1/projects/{project_id}/zones/{zone}/clusters/{cluster_id}/nodePools"

}

};

option (google.api.method_signature) = "project_id,zone,cluster_id";

option (google.api.method_signature) = "parent";

}

// Retrieves the requested node pool.

rpc GetNodePool(GetNodePoolRequest) returns (NodePool) {

option (google.api.http) = {

get: "/v1/{name=projects/*/locations/*/clusters/*/nodePools/*}"

additional_bindings {

get: "/v1/projects/{project_id}/zones/{zone}/clusters/{cluster_id}/nodePools/{node_pool_id}"

}

};

option (google.api.method_signature) =

"project_id,zone,cluster_id,node_pool_id";

option (google.api.method_signature) = "name";

}

// Creates a node pool for a cluster.

rpc CreateNodePool(CreateNodePoolRequest) returns (Operation) {

option (google.api.http) = {

post: "/v1/{parent=projects/*/locations/*/clusters/*}/nodePools"

body: "*"

additional_bindings {

post: "/v1/projects/{project_id}/zones/{zone}/clusters/{cluster_id}/nodePools"

body: "*"

}

};

option (google.api.method_signature) =

"project_id,zone,cluster_id,node_pool";

option (google.api.method_signature) = "parent,node_pool";

}

// Deletes a node pool from a cluster.

rpc DeleteNodePool(DeleteNodePoolRequest) returns (Operation) {

option (google.api.http) = {

delete: "/v1/{name=projects/*/locations/*/clusters/*/nodePools/*}"

additional_bindings {

delete: "/v1/projects/{project_id}/zones/{zone}/clusters/{cluster_id}/nodePools/{node_pool_id}"

}

};

option (google.api.method_signature) =

"project_id,zone,cluster_id,node_pool_id";

option (google.api.method_signature) = "name";

}

// CompleteNodePoolUpgrade will signal an on-going node pool upgrade to

// complete.

rpc CompleteNodePoolUpgrade(CompleteNodePoolUpgradeRequest)

returns (google.protobuf.Empty) {

option (google.api.http) = {

post: "/v1/{name=projects/*/locations/*/clusters/*/nodePools/*}:completeUpgrade"

body: "*"

};

}

// Rolls back a previously Aborted or Failed NodePool upgrade.

// This makes no changes if the last upgrade successfully completed.

rpc RollbackNodePoolUpgrade(RollbackNodePoolUpgradeRequest)

returns (Operation) {

option (google.api.http) = {

post: "/v1/{name=projects/*/locations/*/clusters/*/nodePools/*}:rollback"

body: "*"

additional_bindings {

post: "/v1/projects/{project_id}/zones/{zone}/clusters/{cluster_id}/nodePools/{node_pool_id}:rollback"

body: "*"

}

};

option (google.api.method_signature) =

"project_id,zone,cluster_id,node_pool_id";

option (google.api.method_signature) = "name";

}

// Sets the NodeManagement options for a node pool.

rpc SetNodePoolManagement(SetNodePoolManagementRequest) returns (Operation) {

option (google.api.http) = {

post: "/v1/{name=projects/*/locations/*/clusters/*/nodePools/*}:setManagement"

body: "*"

additional_bindings {

post: "/v1/projects/{project_id}/zones/{zone}/clusters/{cluster_id}/nodePools/{node_pool_id}/setManagement"

body: "*"

}

};

}

// Sets labels on a cluster.

rpc SetLabels(SetLabelsRequest) returns (Operation) {

option (google.api.http) = {

post: "/v1/{name=projects/*/locations/*/clusters/*}:setResourceLabels"

body: "*"

additional_bindings {

post: "/v1/projects/{project_id}/zones/{zone}/clusters/{cluster_id}/resourceLabels"

body: "*"

}

};

}

// Enables or disables the ABAC authorization mechanism on a cluster.

rpc SetLegacyAbac(SetLegacyAbacRequest) returns (Operation) {

option (google.api.http) = {

post: "/v1/{name=projects/*/locations/*/clusters/*}:setLegacyAbac"

body: "*"

additional_bindings {

post: "/v1/projects/{project_id}/zones/{zone}/clusters/{cluster_id}/legacyAbac"

body: "*"

}

};

option (google.api.method_signature) = "project_id,zone,cluster_id,enabled";

option (google.api.method_signature) = "name,enabled";

}

// Starts master IP rotation.

rpc StartIPRotation(StartIPRotationRequest) returns (Operation) {

option (google.api.http) = {

post: "/v1/{name=projects/*/locations/*/clusters/*}:startIpRotation"

body: "*"

additional_bindings {

post: "/v1/projects/{project_id}/zones/{zone}/clusters/{cluster_id}:startIpRotation"

body: "*"

}

};

option (google.api.method_signature) = "project_id,zone,cluster_id";

option (google.api.method_signature) = "name";

}

// Completes master IP rotation.

rpc CompleteIPRotation(CompleteIPRotationRequest) returns (Operation) {

option (google.api.http) = {

post: "/v1/{name=projects/*/locations/*/clusters/*}:completeIpRotation"

body: "*"

additional_bindings {

post: "/v1/projects/{project_id}/zones/{zone}/clusters/{cluster_id}:completeIpRotation"

body: "*"

}

};

option (google.api.method_signature) = "project_id,zone,cluster_id";

option (google.api.method_signature) = "name";

}

// Sets the size for a specific node pool. The new size will be used for all

// replicas, including future replicas created by modifying

// [NodePool.locations][google.container.v1.NodePool.locations].

rpc SetNodePoolSize(SetNodePoolSizeRequest) returns (Operation) {

option (google.api.http) = {

post: "/v1/{name=projects/*/locations/*/clusters/*/nodePools/*}:setSize"

body: "*"

additional_bindings {

post: "/v1/projects/{project_id}/zones/{zone}/clusters/{cluster_id}/nodePools/{node_pool_id}/setSize"

body: "*"

}

};

}

// Enables or disables Network Policy for a cluster.

rpc SetNetworkPolicy(SetNetworkPolicyRequest) returns (Operation) {

option (google.api.http) = {

post: "/v1/{name=projects/*/locations/*/clusters/*}:setNetworkPolicy"

body: "*"

additional_bindings {

post: "/v1/projects/{project_id}/zones/{zone}/clusters/{cluster_id}:setNetworkPolicy"

body: "*"

}

};

option (google.api.method_signature) =

"project_id,zone,cluster_id,network_policy";

option (google.api.method_signature) = "name,network_policy";

}

// Sets the maintenance policy for a cluster.

rpc SetMaintenancePolicy(SetMaintenancePolicyRequest) returns (Operation) {

option (google.api.http) = {

post: "/v1/{name=projects/*/locations/*/clusters/*}:setMaintenancePolicy"

body: "*"

additional_bindings {

post: "/v1/projects/{project_id}/zones/{zone}/clusters/{cluster_id}:setMaintenancePolicy"

body: "*"

}

};

option (google.api.method_signature) =

"project_id,zone,cluster_id,maintenance_policy";

option (google.api.method_signature) = "name,maintenance_policy";

}

// Lists subnetworks that are usable for creating clusters in a project.

rpc ListUsableSubnetworks(ListUsableSubnetworksRequest)

returns (ListUsableSubnetworksResponse) {

option (google.api.http) = {

get: "/v1/{parent=projects/*}/aggregated/usableSubnetworks"

};

}

// Checks the cluster compatibility with Autopilot mode, and returns a list of

// compatibility issues.

rpc CheckAutopilotCompatibility(CheckAutopilotCompatibilityRequest)

returns (CheckAutopilotCompatibilityResponse) {

option (google.api.http) = {

get: "/v1/{name=projects/*/locations/*/clusters/*}:checkAutopilotCompatibility"

};

}

// Fetch upgrade information of a specific cluster.

rpc FetchClusterUpgradeInfo(FetchClusterUpgradeInfoRequest)

returns (ClusterUpgradeInfo) {

option (google.api.http) = {

get: "/v1/{name=projects/*/locations/*/clusters/*}:fetchClusterUpgradeInfo"

additional_bindings {

get: "/v1/{name=projects/*/zones/*/clusters/*}:fetchClusterUpgradeInfo"

}

};

option (google.api.method_signature) = "name";

}

// Fetch upgrade information of a specific nodepool.

rpc FetchNodePoolUpgradeInfo(FetchNodePoolUpgradeInfoRequest)

returns (NodePoolUpgradeInfo) {

option (google.api.http) = {

get: "/v1/{name=projects/*/locations/*/clusters/*/nodePools/*}:fetchNodePoolUpgradeInfo"

additional_bindings {

get: "/v1/{name=projects/*/zones/*/clusters/*/nodePools/*}:fetchNodePoolUpgradeInfo"

}

};

option (google.api.method_signature) = "name";

}

}

// Parameters that can be configured on Linux nodes.

message LinuxNodeConfig {

// Possible cgroup modes that can be used.

enum CgroupMode {

// CGROUP_MODE_UNSPECIFIED is when unspecified cgroup configuration is used.

// The default for the GKE node OS image will be used.

CGROUP_MODE_UNSPECIFIED = 0;

// CGROUP_MODE_V1 specifies to use cgroupv1 for the cgroup configuration on

// the node image.

CGROUP_MODE_V1 = 1;

// CGROUP_MODE_V2 specifies to use cgroupv2 for the cgroup configuration on

// the node image.

CGROUP_MODE_V2 = 2;

}

// Hugepages amount in both 2m and 1g size

message HugepagesConfig {

// Optional. Amount of 2M hugepages

optional int32 hugepage_size2m = 1 [(google.api.field_behavior) = OPTIONAL];

// Optional. Amount of 1G hugepages

optional int32 hugepage_size1g = 2 [(google.api.field_behavior) = OPTIONAL];

}

// Possible values for transparent hugepage enabled support.

enum TransparentHugepageEnabled {

// Default value. GKE will not modify the kernel configuration.

TRANSPARENT_HUGEPAGE_ENABLED_UNSPECIFIED = 0;

// Transparent hugepage support for anonymous memory is enabled system wide.

TRANSPARENT_HUGEPAGE_ENABLED_ALWAYS = 1;

// Transparent hugepage support for anonymous memory is enabled inside

// MADV_HUGEPAGE regions. This is the default kernel configuration.

TRANSPARENT_HUGEPAGE_ENABLED_MADVISE = 2;

// Transparent hugepage support for anonymous memory is disabled.

TRANSPARENT_HUGEPAGE_ENABLED_NEVER = 3;

}

// Possible values for transparent hugepage defrag support.

enum TransparentHugepageDefrag {

// Default value. GKE will not modify the kernel configuration.

TRANSPARENT_HUGEPAGE_DEFRAG_UNSPECIFIED = 0;

// It means that an application requesting THP will stall on allocation

// failure and directly reclaim pages and compact memory in an effort to

// allocate a THP immediately.

TRANSPARENT_HUGEPAGE_DEFRAG_ALWAYS = 1;

// It means that an application will wake kswapd in the background to

// reclaim pages and wake kcompactd to compact memory so that THP is

// available in the near future. It's the responsibility of khugepaged to

// then install the THP pages later.

TRANSPARENT_HUGEPAGE_DEFRAG_DEFER = 2;

// It means that an application will enter direct reclaim and compaction

// like always, but only for regions that have used madvise(MADV_HUGEPAGE);

// all other regions will wake kswapd in the background to reclaim pages and

// wake kcompactd to compact memory so that THP is available in the near

// future.

TRANSPARENT_HUGEPAGE_DEFRAG_DEFER_WITH_MADVISE = 3;

// It means that an application will enter direct reclaim like always but

// only for regions that are have used madvise(MADV_HUGEPAGE). This is the

// default kernel configuration.

TRANSPARENT_HUGEPAGE_DEFRAG_MADVISE = 4;

// It means that an application will never enter direct reclaim or

// compaction.

TRANSPARENT_HUGEPAGE_DEFRAG_NEVER = 5;

}

// Configuration for swap memory on a node pool.

message SwapConfig {

// Defines encryption settings for the swap space.

message EncryptionConfig {

// Optional. If true, swap space will not be encrypted.

// Defaults to false (encrypted).

optional bool disabled = 1 [(google.api.field_behavior) = OPTIONAL];

}

// Swap on the node's boot disk.

message BootDiskProfile {

// Optional. Specifies the size of the swap space. If omitted, GKE

// determines an optimal size based on node memory.

oneof swap_size {

// Specifies the size of the swap space in gibibytes (GiB).

int64 swap_size_gib = 1;

// Specifies the size of the swap space as a percentage of the boot disk

// size.

int32 swap_size_percent = 2;

}

}

// Swap on the local SSD shared with pod ephemeral storage.

message EphemeralLocalSsdProfile {

// Specifies the size of the swap space to be provisioned.

oneof swap_size {

// Specifies the size of the swap space in gibibytes (GiB).

int64 swap_size_gib = 1;

// Specifies the size of the swap space as a percentage of the ephemeral

// local SSD capacity.

int32 swap_size_percent = 2;

}

}

// Provisions a new, separate local NVMe SSD exclusively for swap.

message DedicatedLocalSsdProfile {

// The number of physical local NVMe SSD disks to attach.

int64 disk_count = 1;

}

// Optional. Enables or disables swap for the node pool.

optional bool enabled = 1 [(google.api.field_behavior) = OPTIONAL];

// Optional. If omitted, swap space is encrypted by default.

optional EncryptionConfig encryption_config = 2

[(google.api.field_behavior) = OPTIONAL];

// Optional. Defines the backing storage for the swap space.

// If omitted, defaults to the 'boot_disk_profile'.

oneof performance_profile {

// Swap on the node's boot disk.

BootDiskProfile boot_disk_profile = 3;

// Swap on the local SSD shared with pod ephemeral storage.

EphemeralLocalSsdProfile ephemeral_local_ssd_profile = 4;

// Provisions a new, separate local NVMe SSD exclusively for swap.

DedicatedLocalSsdProfile dedicated_local_ssd_profile = 5;

}

}

// Configuration for kernel module loading on nodes.

message NodeKernelModuleLoading {

// Defines the kernel module loading policy for nodes in the nodepool.

enum Policy {

// Default behavior. GKE selects the image based on node type.

// For CPU and TPU nodes, the image will not allow loading external

// kernel modules.

// For GPU nodes, the image will allow loading any module, whether it

// is signed or not.

POLICY_UNSPECIFIED = 0;

// Enforced signature verification: Node pools will use a

// Container-Optimized OS image configured to allow loading of

// *Google-signed* external kernel modules.

// Loadpin is enabled but configured to exclude modules, and kernel

// module signature checking is enforced.

ENFORCE_SIGNED_MODULES = 1;

// Mirrors existing DEFAULT behavior:

// For CPU and TPU nodes, the image will not allow loading external

// kernel modules.

// For GPU nodes, the image will allow loading any module, whether it

// is signed or not.

DO_NOT_ENFORCE_SIGNED_MODULES = 2;

}

// Set the node module loading policy for nodes in the node pool.

Policy policy = 1;

}

// The Linux kernel parameters to be applied to the nodes and all pods running

// on the nodes.

//

// The following parameters are supported.

//

// net.core.busy_poll

// net.core.busy_read

// net.core.netdev_max_backlog

// net.core.rmem_max

// net.core.rmem_default

// net.core.wmem_default

// net.core.wmem_max

// net.core.optmem_max

// net.core.somaxconn

// net.ipv4.tcp_rmem

// net.ipv4.tcp_wmem

// net.ipv4.tcp_tw_reuse

// net.ipv4.tcp_mtu_probing

// net.ipv4.tcp_max_orphans

// net.ipv4.tcp_max_tw_buckets

// net.ipv4.tcp_syn_retries

// net.ipv4.tcp_ecn

// net.ipv4.tcp_congestion_control

// net.netfilter.nf_conntrack_max

// net.netfilter.nf_conntrack_buckets

// net.netfilter.nf_conntrack_tcp_timeout_close_wait

// net.netfilter.nf_conntrack_tcp_timeout_time_wait

// net.netfilter.nf_conntrack_tcp_timeout_established

// net.netfilter.nf_conntrack_acct

// kernel.shmmni

// kernel.shmmax

// kernel.shmall

// kernel.perf_event_paranoid

// kernel.sched_rt_runtime_us

// kernel.softlockup_panic

// kernel.yama.ptrace_scope

// kernel.kptr_restrict

// kernel.dmesg_restrict

// kernel.sysrq

// fs.aio-max-nr

// fs.file-max

// fs.inotify.max_user_instances

// fs.inotify.max_user_watches

// fs.nr_open

// vm.dirty_background_ratio

// vm.dirty_background_bytes

// vm.dirty_expire_centisecs

// vm.dirty_ratio

// vm.dirty_bytes

// vm.dirty_writeback_centisecs

// vm.max_map_count

// vm.overcommit_memory

// vm.overcommit_ratio

// vm.vfs_cache_pressure

// vm.swappiness

// vm.watermark_scale_factor

// vm.min_free_kbytes

map<string, string> sysctls = 1;

// cgroup_mode specifies the cgroup mode to be used on the node.

CgroupMode cgroup_mode = 2;

// Optional. Amounts for 2M and 1G hugepages

optional HugepagesConfig hugepages = 3

[(google.api.field_behavior) = OPTIONAL];

// Optional. Transparent hugepage support for anonymous memory can be entirely

// disabled (mostly for debugging purposes) or only enabled inside

// MADV_HUGEPAGE regions (to avoid the risk of consuming more memory

// resources) or enabled system wide.

//

// See https://docs.kernel.org/admin-guide/mm/transhuge.html

// for more details.

TransparentHugepageEnabled transparent_hugepage_enabled = 4

[(google.api.field_behavior) = OPTIONAL];

// Optional. Defines the transparent hugepage defrag configuration on the

// node. VM hugepage allocation can be managed by either limiting

// defragmentation for delayed allocation or skipping it entirely for

// immediate allocation only.

//

// See https://docs.kernel.org/admin-guide/mm/transhuge.html

// for more details.

TransparentHugepageDefrag transparent_hugepage_defrag = 5

[(google.api.field_behavior) = OPTIONAL];

// Optional. Enables and configures swap space on nodes.

// If omitted, swap is disabled.

optional SwapConfig swap_config = 12 [(google.api.field_behavior) = OPTIONAL];

// Optional. Configuration for kernel module loading on nodes.

// When enabled, the node pool will be provisioned with a Container-Optimized

// OS image that enforces kernel module signature verification.

NodeKernelModuleLoading node_kernel_module_loading = 13

[(google.api.field_behavior) = OPTIONAL];

}

// Parameters that can be configured on Windows nodes.

// Windows Node Config that define the parameters that will be used to

// configure the Windows node pool settings.

message WindowsNodeConfig {

// Possible OS version that can be used.

enum OSVersion {

// When OSVersion is not specified.

OS_VERSION_UNSPECIFIED = 0;

// LTSC2019 specifies to use LTSC2019 as the Windows Servercore Base Image.

OS_VERSION_LTSC2019 = 1;

// LTSC2022 specifies to use LTSC2022 as the Windows Servercore Base Image.

OS_VERSION_LTSC2022 = 2;

}

// OSVersion specifies the Windows node config to be used on the node.

OSVersion os_version = 1;

}

// Node kubelet configs.

message NodeKubeletConfig {

// Control the CPU management policy on the node.

// See

// https://kubernetes.io/docs/tasks/administer-cluster/cpu-management-policies/

//

// The following values are allowed.

// * "none": the default, which represents the existing scheduling behavior.

// * "static": allows pods with certain resource characteristics to be granted

// increased CPU affinity and exclusivity on the node.

// The default value is 'none' if unspecified.

string cpu_manager_policy = 1;

// Optional. Controls Topology Manager configuration on the node.

// For more information, see:

// https://kubernetes.io/docs/tasks/administer-cluster/topology-manager/

TopologyManager topology_manager = 8 [(google.api.field_behavior) = OPTIONAL];

// Optional. Controls NUMA-aware Memory Manager configuration on the

// node. For more information, see:

// https://kubernetes.io/docs/tasks/administer-cluster/memory-manager/

MemoryManager memory_manager = 9 [(google.api.field_behavior) = OPTIONAL];

// Enable CPU CFS quota enforcement for containers that specify CPU limits.

//

// This option is enabled by default which makes kubelet use CFS quota

// (https://www.kernel.org/doc/Documentation/scheduler/sched-bwc.txt) to

// enforce container CPU limits. Otherwise, CPU limits will not be enforced at

// all.

//

// Disable this option to mitigate CPU throttling problems while still having

// your pods to be in Guaranteed QoS class by specifying the CPU limits.

//

// The default value is 'true' if unspecified.

google.protobuf.BoolValue cpu_cfs_quota = 2;

// Set the CPU CFS quota period value 'cpu.cfs_period_us'.

//

// The string must be a sequence of decimal numbers, each with optional

// fraction and a unit suffix, such as "300ms".

// Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".

// The value must be a positive duration between 1ms and 1 second, inclusive.

string cpu_cfs_quota_period = 3;

// Set the Pod PID limits. See

// https://kubernetes.io/docs/concepts/policy/pid-limiting/#pod-pid-limits

//

// Controls the maximum number of processes allowed to run in a pod. The value

// must be greater than or equal to 1024 and less than 4194304.

int64 pod_pids_limit = 4;

// Enable or disable Kubelet read only port.

optional bool insecure_kubelet_readonly_port_enabled = 7;

// Optional. Defines the percent of disk usage before which image garbage

// collection is never run. Lowest disk usage to garbage collect to. The

// percent is calculated as this field value out of 100.

//

// The value must be between 10 and 85, inclusive and smaller than

// image_gc_high_threshold_percent.

//

// The default value is 80 if unspecified.

int32 image_gc_low_threshold_percent = 10

[(google.api.field_behavior) = OPTIONAL];

// Optional. Defines the percent of disk usage after which image garbage

// collection is always run. The percent is calculated as this field value out

// of 100.

//

// The value must be between 10 and 85, inclusive and greater than

// image_gc_low_threshold_percent.

//

// The default value is 85 if unspecified.

int32 image_gc_high_threshold_percent = 11

[(google.api.field_behavior) = OPTIONAL];

// Optional. Defines the minimum age for an unused image before it is garbage

// collected.

//

// The string must be a sequence of decimal numbers, each with optional

// fraction and a unit suffix, such as "300s", "1.5h", and "2h45m". Valid time

// units are "ns", "us" (or "µs"), "ms", "s", "m", "h".

//

// The value must be a positive duration less than or equal to 2 minutes.

//

// The default value is "2m0s" if unspecified.

string image_minimum_gc_age = 12 [(google.api.field_behavior) = OPTIONAL];

// Optional. Defines the maximum age an image can be unused before it is

// garbage collected. The string must be a sequence of decimal numbers, each

// with optional fraction and a unit suffix, such as "300s", "1.5h", and

// "2h45m". Valid time units are "ns", "us" (or "µs"), "ms", "s", "m", "h".

//

// The value must be a positive duration greater than image_minimum_gc_age

// or "0s".

//

// The default value is "0s" if unspecified, which disables this field,

// meaning images won't be garbage collected based on being unused for too

// long.

string image_maximum_gc_age = 13 [(google.api.field_behavior) = OPTIONAL];

// Optional. Defines the maximum size of the container log file before it is

// rotated. See

// https://kubernetes.io/docs/concepts/cluster-administration/logging/#log-rotation

//

// Valid format is positive number + unit, e.g. 100Ki, 10Mi. Valid units are

// Ki, Mi, Gi.

// The value must be between 10Mi and 500Mi, inclusive.

//

// Note that the total container log size (container_log_max_size *

// container_log_max_files) cannot exceed 1% of the total

// storage of the node, to avoid disk pressure caused by log files.

//

// The default value is 10Mi if unspecified.

string container_log_max_size = 14 [(google.api.field_behavior) = OPTIONAL];

// Optional. Defines the maximum number of container log files that can be

// present for a container. See

// https://kubernetes.io/docs/concepts/cluster-administration/logging/#log-rotation

//

// The value must be an integer between 2 and 10, inclusive.

// The default value is 5 if unspecified.

int32 container_log_max_files = 15 [(google.api.field_behavior) = OPTIONAL];

// Optional. Defines a comma-separated allowlist of unsafe sysctls or sysctl

// patterns (ending in `*`).

//

// The unsafe namespaced sysctl groups are `kernel.shm*`, `kernel.msg*`,

// `kernel.sem`, `fs.mqueue.*`, and `net.*`. Leaving this allowlist empty

// means they cannot be set on Pods.

//

// To allow certain sysctls or sysctl patterns to be set on Pods, list them

// separated by commas.

// For example: `kernel.msg*,net.ipv4.route.min_pmtu`.

//

// See https://kubernetes.io/docs/tasks/administer-cluster/sysctl-cluster/

// for more details.

repeated string allowed_unsafe_sysctls = 16

[(google.api.field_behavior) = OPTIONAL];

// Optional. eviction_soft is a map of signal names to quantities that defines

// soft eviction thresholds. Each signal is compared to its corresponding

// threshold to determine if a pod eviction should occur.

EvictionSignals eviction_soft = 17 [(google.api.field_behavior) = OPTIONAL];

// Optional. eviction_soft_grace_period is a map of signal names to quantities

// that defines grace periods for each soft eviction signal. The grace period

// is the amount of time that a pod must be under pressure before an eviction

// occurs.

EvictionGracePeriod eviction_soft_grace_period = 18

[(google.api.field_behavior) = OPTIONAL];

// Optional. eviction_minimum_reclaim is a map of signal names to quantities

// that defines minimum reclaims, which describe the minimum amount of a given

// resource the kubelet will reclaim when performing a pod eviction while that

// resource is under pressure.

EvictionMinimumReclaim eviction_minimum_reclaim = 19

[(google.api.field_behavior) = OPTIONAL];

// Optional. eviction_max_pod_grace_period_seconds is the maximum allowed

// grace period (in seconds) to use when terminating pods in response to a

// soft eviction threshold being met. This value effectively caps the Pod's