---
# ----------------------------------------------------------------------------
#
#     ***     AUTO GENERATED CODE    ***    Type: MMv1     ***
#
# ----------------------------------------------------------------------------
#
#     This file is automatically generated by Magic Modules and manual
#     changes will be clobbered when the file is regenerated.
#
#     Please read more about how to change this file in
#     .github/CONTRIBUTING.md.
#
# ----------------------------------------------------------------------------
subcategory: "ContainerAttached"
description: |-
  An Anthos cluster running on customer owned infrastructure.
---

# google\_container\_attached\_cluster

An Anthos cluster running on customer owned infrastructure.


To get more information about Cluster, see:

* [API documentation](https://cloud.google.com/anthos/clusters/docs/multi-cloud/reference/rest)
* How-to Guides
    * [API reference](https://cloud.google.com/anthos/clusters/docs/multi-cloud/reference/rest/v1/projects.locations.attachedClusters)
    * [Multicloud overview](https://cloud.google.com/anthos/clusters/docs/multi-cloud)

<div class = "oics-button" style="float: right; margin: 0 0 -15px">
  <a href="https://console.cloud.google.com/cloudshell/open?cloudshell_git_repo=https%3A%2F%2Fgithub.com%2Fterraform-google-modules%2Fdocs-examples.git&cloudshell_working_dir=container_attached_cluster_basic&cloudshell_image=gcr.io%2Fcloudshell-images%2Fcloudshell%3Alatest&open_in_editor=main.tf&cloudshell_print=.%2Fmotd&cloudshell_tutorial=.%2Ftutorial.md" target="_blank">
    <img alt="Open in Cloud Shell" src="//gstatic.com/cloudssh/images/open-btn.svg" style="max-height: 44px; margin: 32px auto; max-width: 100%;">
  </a>
</div>
## Example Usage - Container Attached Cluster Basic


```hcl
data "google_project" "project" {
}

data "google_container_attached_versions" "versions" {
	location       = "us-west1"
	project        = data.google_project.project.project_id
}

resource "google_container_attached_cluster" "primary" {
  name     = "basic"
  location = "us-west1"
  project = data.google_project.project.project_id
  description = "Test cluster"
  distribution = "aks"
  oidc_config {
      issuer_url = "https://oidc.issuer.url"
  }
  platform_version = data.google_container_attached_versions.versions.valid_versions[0]
  fleet {
    project = "projects/${data.google_project.project.number}"
  }
}
```
<div class = "oics-button" style="float: right; margin: 0 0 -15px">
  <a href="https://console.cloud.google.com/cloudshell/open?cloudshell_git_repo=https%3A%2F%2Fgithub.com%2Fterraform-google-modules%2Fdocs-examples.git&cloudshell_working_dir=container_attached_cluster_full&cloudshell_image=gcr.io%2Fcloudshell-images%2Fcloudshell%3Alatest&open_in_editor=main.tf&cloudshell_print=.%2Fmotd&cloudshell_tutorial=.%2Ftutorial.md" target="_blank">
    <img alt="Open in Cloud Shell" src="//gstatic.com/cloudssh/images/open-btn.svg" style="max-height: 44px; margin: 32px auto; max-width: 100%;">
  </a>
</div>
## Example Usage - Container Attached Cluster Full


```hcl
data "google_project" "project" {
}

data "google_container_attached_versions" "versions" {
	location       = "us-west1"
	project        = data.google_project.project.project_id
}

resource "google_container_attached_cluster" "primary" {
  name     = "basic"
  project = data.google_project.project.project_id
  location = "us-west1"
  description = "Test cluster"
  distribution = "aks"
  annotations = {
    label-one = "value-one"
  }
  authorization {
    admin_users = [ "user1@example.com", "user2@example.com"]
    admin_groups = [ "group1@example.com", "group2@example.com"]
  }
  oidc_config {
      issuer_url = "https://oidc.issuer.url"
      jwks = base64encode("{\"keys\":[{\"use\":\"sig\",\"kty\":\"RSA\",\"kid\":\"testid\",\"alg\":\"RS256\",\"n\":\"somedata\",\"e\":\"AQAB\"}]}")
  }
  platform_version = data.google_container_attached_versions.versions.valid_versions[0]
  fleet {
    project = "projects/${data.google_project.project.number}"
  }
  logging_config {
    component_config {
      enable_components = ["SYSTEM_COMPONENTS", "WORKLOADS"]
    }
  }
  monitoring_config {
    managed_prometheus_config {
      enabled = true
    }
  }
  binary_authorization {
    evaluation_mode = "PROJECT_SINGLETON_POLICY_ENFORCE"
  }
  proxy_config {
    kubernetes_secret {
      name = "proxy-config"
      namespace = "default"
    }
  }
}
```
<div class = "oics-button" style="float: right; margin: 0 0 -15px">
  <a href="https://console.cloud.google.com/cloudshell/open?cloudshell_git_repo=https%3A%2F%2Fgithub.com%2Fterraform-google-modules%2Fdocs-examples.git&cloudshell_working_dir=container_attached_cluster_ignore_errors&cloudshell_image=gcr.io%2Fcloudshell-images%2Fcloudshell%3Alatest&open_in_editor=main.tf&cloudshell_print=.%2Fmotd&cloudshell_tutorial=.%2Ftutorial.md" target="_blank">
    <img alt="Open in Cloud Shell" src="//gstatic.com/cloudssh/images/open-btn.svg" style="max-height: 44px; margin: 32px auto; max-width: 100%;">
  </a>
</div>
## Example Usage - Container Attached Cluster Ignore Errors


```hcl
data "google_project" "project" {
}

data "google_container_attached_versions" "versions" {
	location       = "us-west1"
	project        = data.google_project.project.project_id
}

resource "google_container_attached_cluster" "primary" {
  name     = "basic"
  location = "us-west1"
  project = data.google_project.project.project_id
  description = "Test cluster"
  distribution = "aks"
  oidc_config {
      issuer_url = "https://oidc.issuer.url"
  }
  platform_version = data.google_container_attached_versions.versions.valid_versions[0]
  fleet {
    project = "projects/${data.google_project.project.number}"
  }

  deletion_policy = "DELETE_IGNORE_ERRORS"
}
```

## Argument Reference

The following arguments are supported:


* `location` -
  (Required)
  The location for the resource

* `name` -
  (Required)
  The name of this resource.

* `oidc_config` -
  (Required)
  OIDC discovery information of the target cluster.
  Kubernetes Service Account (KSA) tokens are JWT tokens signed by the cluster
  API server. This fields indicates how GCP services
  validate KSA tokens in order to allow system workloads (such as GKE Connect
  and telemetry agents) to authenticate back to GCP.
  Both clusters with public and private issuer URLs are supported.
  Clusters with public issuers only need to specify the `issuer_url` field
  while clusters with private issuers need to provide both
  `issuer_url` and `jwks`.
  Structure is [documented below](#nested_oidc_config).

* `platform_version` -
  (Required)
  The platform version for the cluster (e.g. `1.23.0-gke.1`).

* `distribution` -
  (Required)
  The Kubernetes distribution of the underlying attached cluster. Supported values:
  "eks", "aks".

* `fleet` -
  (Required)
  Fleet configuration.
  Structure is [documented below](#nested_fleet).


<a name="nested_oidc_config"></a>The `oidc_config` block supports:

* `issuer_url` -
  (Required)
  A JSON Web Token (JWT) issuer URI. `issuer` must start with `https://`

* `jwks` -
  (Optional)
  OIDC verification keys in JWKS format (RFC 7517).

<a name="nested_fleet"></a>The `fleet` block supports:

* `membership` -
  (Output)
  The name of the managed Hub Membership resource associated to this
  cluster. Membership names are formatted as
  projects/<project-number>/locations/global/membership/<cluster-id>.

* `project` -
  (Required)
  The number of the Fleet host project where this cluster will be registered.

- - -


* `description` -
  (Optional)
  A human readable description of this attached cluster. Cannot be longer
  than 255 UTF-8 encoded bytes.

* `annotations` -
  (Optional)
  Optional. Annotations on the cluster. This field has the same
  restrictions as Kubernetes annotations. The total size of all keys and
  values combined is limited to 256k. Key can have 2 segments: prefix (optional)
  and name (required), separated by a slash (/). Prefix must be a DNS subdomain.
  Name must be 63 characters or less, begin and end with alphanumerics,
  with dashes (-), underscores (_), dots (.), and alphanumerics between.

  **Note**: This field is non-authoritative, and will only manage the annotations present in your configuration.
  Please refer to the field `effective_annotations` for all of the annotations present on the resource.

* `logging_config` -
  (Optional)
  Logging configuration.
  Structure is [documented below](#nested_logging_config).

* `authorization` -
  (Optional)
  Configuration related to the cluster RBAC settings.
  Structure is [documented below](#nested_authorization).

* `monitoring_config` -
  (Optional)
  Monitoring configuration.
  Structure is [documented below](#nested_monitoring_config).

* `binary_authorization` -
  (Optional)
  Binary Authorization configuration.
  Structure is [documented below](#nested_binary_authorization).

* `proxy_config` -
  (Optional)
  Support for proxy configuration.
  Structure is [documented below](#nested_proxy_config).

* `project` - (Optional) The ID of the project in which the resource belongs.
    If it is not provided, the provider project is used.

* `deletion_policy` - (Optional) Policy to determine what flags to send on delete.

<a name="nested_logging_config"></a>The `logging_config` block supports:

* `component_config` -
  (Optional)
  The configuration of the logging components
  Structure is [documented below](#nested_component_config).


<a name="nested_component_config"></a>The `component_config` block supports:

* `enable_components` -
  (Optional)
  The components to be enabled.
  Each value may be one of: `SYSTEM_COMPONENTS`, `WORKLOADS`.

<a name="nested_authorization"></a>The `authorization` block supports:

* `admin_users` -
  (Optional)
  Users that can perform operations as a cluster admin. A managed
  ClusterRoleBinding will be created to grant the `cluster-admin` ClusterRole
  to the users. Up to ten admin users can be provided.
  For more info on RBAC, see
  https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles

* `admin_groups` -
  (Optional)
  Groups that can perform operations as a cluster admin. A managed
  ClusterRoleBinding will be created to grant the `cluster-admin` ClusterRole
  to the groups. Up to ten admin groups can be provided.
  For more info on RBAC, see
  https://kubernetes.io/docs/reference/access-authn-authz/rbac/#user-facing-roles

<a name="nested_monitoring_config"></a>The `monitoring_config` block supports:

* `managed_prometheus_config` -
  (Optional)
  Enable Google Cloud Managed Service for Prometheus in the cluster.
  Structure is [documented below](#nested_managed_prometheus_config).


<a name="nested_managed_prometheus_config"></a>The `managed_prometheus_config` block supports:

* `enabled` -
  (Optional)
  Enable Managed Collection.

<a name="nested_binary_authorization"></a>The `binary_authorization` block supports:

* `evaluation_mode` -
  (Optional)
  Configure Binary Authorization evaluation mode.
  Possible values are: `DISABLED`, `PROJECT_SINGLETON_POLICY_ENFORCE`.

<a name="nested_proxy_config"></a>The `proxy_config` block supports:

* `kubernetes_secret` -
  (Optional)
  The Kubernetes Secret resource that contains the HTTP(S) proxy configuration.
  Structure is [documented below](#nested_kubernetes_secret).


<a name="nested_kubernetes_secret"></a>The `kubernetes_secret` block supports:

* `name` -
  (Required)
  Name of the kubernetes secret containing the proxy config.

* `namespace` -
  (Required)
  Namespace of the kubernetes secret containing the proxy config.

## Attributes Reference

In addition to the arguments listed above, the following computed attributes are exported:

* `id` - an identifier for the resource with format `projects/{{project}}/locations/{{location}}/attachedClusters/{{name}}`

* `cluster_region` -
  Output only. The region where this cluster runs.
  For EKS clusters, this is an AWS region. For AKS clusters,
  this is an Azure region.

* `state` -
  The current state of the cluster. Possible values:
  STATE_UNSPECIFIED, PROVISIONING, RUNNING, RECONCILING, STOPPING, ERROR,
  DEGRADED

* `uid` -
  A globally unique identifier for the cluster.

* `reconciling` -
  If set, there are currently changes in flight to the cluster.

* `create_time` -
  Output only. The time at which this cluster was created.

* `update_time` -
  The time at which this cluster was last updated.

* `kubernetes_version` -
  The Kubernetes version of the cluster.

* `workload_identity_config` -
  Workload Identity settings.
  Structure is [documented below](#nested_workload_identity_config).

* `errors` -
  A set of errors found in the cluster.
  Structure is [documented below](#nested_errors).

* `effective_annotations` -
  All of annotations (key/value pairs) present on the resource in GCP, including the annotations configured through Terraform, other clients and services.


<a name="nested_workload_identity_config"></a>The `workload_identity_config` block contains:

* `identity_provider` -
  (Optional)
  The ID of the OIDC Identity Provider (IdP) associated to
  the Workload Identity Pool.

* `issuer_uri` -
  (Optional)
  The OIDC issuer URL for this cluster.

* `workload_pool` -
  (Optional)
  The Workload Identity Pool associated to the cluster.

<a name="nested_errors"></a>The `errors` block contains:

* `message` -
  (Optional)
  Human-friendly description of the error.

## Timeouts

This resource provides the following
[Timeouts](https://developer.hashicorp.com/terraform/plugin/sdkv2/resources/retries-and-customizable-timeouts) configuration options:

- `create` - Default is 20 minutes.
- `update` - Default is 20 minutes.
- `delete` - Default is 20 minutes.

## Import


Cluster can be imported using any of these accepted formats:

* `projects/{{project}}/locations/{{location}}/attachedClusters/{{name}}`
* `{{project}}/{{location}}/{{name}}`
* `{{location}}/{{name}}`


In Terraform v1.5.0 and later, use an [`import` block](https://developer.hashicorp.com/terraform/language/import) to import Cluster using one of the formats above. For example:

```tf
import {
  id = "projects/{{project}}/locations/{{location}}/attachedClusters/{{name}}"
  to = google_container_attached_cluster.default
}
```

When using the [`terraform import` command](https://developer.hashicorp.com/terraform/cli/commands/import), Cluster can be imported using one of the formats above. For example:

```
$ terraform import google_container_attached_cluster.default projects/{{project}}/locations/{{location}}/attachedClusters/{{name}}
$ terraform import google_container_attached_cluster.default {{project}}/{{location}}/{{name}}
$ terraform import google_container_attached_cluster.default {{location}}/{{name}}
```

## User Project Overrides

This resource supports [User Project Overrides](https://registry.terraform.io/providers/hashicorp/google/latest/docs/guides/provider_reference#user_project_override).