{ "$schema": "https://json-schema.org/draft/2020-12/schema", "$id": "https://raw.githubusercontent.com/api-evangelist/harness/main/json-schema/harness-clusters-cluster-update-request-schema.json", "title": "clustersClusterUpdateRequest", "x-generated": "2026-10-04", "x-method": "derived", "x-generator": "derive-json-schema.py", "x-source": "openapi/harness-clusters-api-openapi.yml#/components/schemas/clustersClusterUpdateRequest", "type": "object", "properties": { "cluster": { "$ref": "#/$defs/clustersCluster" }, "updatedFields": { "type": "array", "items": { "type": "string" } }, "updateMask": { "$ref": "#/$defs/protobufFieldMask" }, "tags": { "type": "object", "additionalProperties": { "type": "string" } }, "id": { "$ref": "#/$defs/clustersClusterID" }, "secretExpressions": { "type": "object", "additionalProperties": { "type": "string" }, "description": "Maps credential field names to Harness secret expressions.\nUsed to reference secrets instead of inline plain-text values." } }, "$defs": { "clustersAWSAuthConfig": { "type": "object", "properties": { "clusterName": { "type": "string", "title": "ClusterName contains AWS cluster name" }, "roleARN": { "type": "string", "description": "RoleARN contains optional role ARN. If set then AWS IAM Authenticator assume a role to perform cluster operations instead of the default AWS credential provider chain." } }, "title": "AWSAuthConfig is an AWS IAM authentication configuration" }, "clustersCluster": { "type": "object", "properties": { "server": { "type": "string", "title": "Server is the API server URL of the Kubernetes cluster" }, "name": { "type": "string", "title": "Name of the cluster. If omitted, will use the server address" }, "config": { "$ref": "#/$defs/clustersClusterConfig" }, "connectionState": { "$ref": "#/$defs/commonsConnectionState" }, "serverVersion": { "type": "string", "title": "DEPRECATED: use Info.ServerVersion field instead.\nThe server version" }, "namespaces": { "type": "array", "items": { "type": "string" }, "description": "Holds list of namespaces which are accessible in that cluster. Cluster level resources will be ignored if namespace list is not empty." }, "refreshRequestedAt": { "$ref": "#/$defs/v1Time" }, "info": { "$ref": "#/$defs/clustersClusterInfo" }, "shard_deprecated": { "type": "string", "format": "int64", "description": "DEPRECATED: use Shard field instead.\nShard contains optional shard number. Calculated on the fly by the application controller if not specified." }, "clusterResources": { "type": "boolean", "description": "Indicates if cluster level resources should be managed. This setting is used only if cluster is connected in a namespaced mode." }, "project": { "type": "string", "title": "Reference between project and cluster that allow you automatically to be added as item inside Destinations project entity" }, "labels": { "type": "object", "additionalProperties": { "type": "string" }, "title": "Labels for cluster secret metadata" }, "annotations": { "type": "object", "additionalProperties": { "type": "string" }, "title": "Annotations for cluster secret metadata" }, "type": { "$ref": "#/$defs/clustersClusterType" }, "refreshRequestedAtTs": { "type": "string", "format": "date-time", "title": "refreshRequestedAtTs is the google timestamp variation of refreshRequestedAt" }, "shard": { "type": "string", "format": "int64" } }, "title": "Cluster is the definition of a cluster resource" }, "clustersClusterCacheInfo": { "type": "object", "properties": { "resourcesCount": { "type": "string", "format": "int64", "title": "ResourcesCount holds number of observed Kubernetes resources" }, "apisCount": { "type": "string", "format": "int64", "title": "APIsCount holds number of observed Kubernetes API count" }, "lastCacheSyncTime": { "$ref": "#/$defs/v1Time" }, "lastCacheSyncTimeTs": { "type": "string", "format": "date-time", "title": "lastCacheSyncTimeTs is the google timestamp variation of lastCacheSyncTime" } }, "title": "ClusterCacheInfo contains information about the cluster cache" }, "clustersClusterConfig": { "type": "object", "properties": { "username": { "type": "string", "title": "Server requires Basic authentication" }, "password": { "type": "string" }, "bearerToken": { "type": "string", "description": "Server requires Bearer authentication. This client will not attempt to use\nrefresh tokens for an OAuth2 flow.\nTODO: demonstrate an OAuth2 compatible client." }, "tlsClientConfig": { "$ref": "#/$defs/clustersTLSClientConfig" }, "awsAuthConfig": { "$ref": "#/$defs/clustersAWSAuthConfig" }, "execProviderConfig": { "$ref": "#/$defs/clustersExecProviderConfig" }, "clusterConnectionType": { "type": "string", "title": "Identifies the authentication method used to connect to the cluster" }, "roleARN": { "type": "string", "description": "RoleARN contains optional role ARN. If set then AWS IAM Authenticator assume a role to perform cluster operations instead of the default AWS credential provider chain." }, "awsClusterName": { "type": "string", "description": "AWS Cluster name. If set then AWS CLI EKS token command will be used to access cluster." }, "disableCompression": { "type": "boolean", "description": "DisableCompression bypasses automatic GZip compression requests to the server." }, "proxyUrl": { "type": "string", "title": "ProxyURL is the URL to the proxy to be used for all requests send to the server" } }, "description": "ClusterConfig is the configuration attributes. This structure is subset of the go-client\nrest.Config with annotations added for marshalling." }, "clustersClusterID": { "type": "object", "properties": { "type": { "type": "string", "title": "type is the type of the specified cluster identifier ( \"server\" - default, \"name\" )" }, "value": { "type": "string", "title": "value holds the cluster server URL or cluster name" } }, "title": "ClusterID holds a cluster server URL or cluster name" }, "clustersClusterInfo": { "type": "object", "properties": { "connectionState": { "$ref": "#/$defs/commonsConnectionState" }, "serverVersion": { "type": "string", "title": "ServerVersion contains information about the Kubernetes version of the cluster" }, "cacheInfo": { "$ref": "#/$defs/clustersClusterCacheInfo" }, "applicationsCount": { "type": "string", "format": "int64", "title": "ApplicationsCount is the number of applications managed by Argo CD on the cluster" }, "apiVersions": { "type": "array", "items": { "type": "string" }, "title": "APIVersions contains list of API versions supported by the cluster" } }, "title": "ClusterInfo contains information about the cluster" }, "clustersClusterType": { "type": "string", "enum": [ "CUSTOMER_PROVIDED", "HARNESS_HOSTED" ], "default": "CUSTOMER_PROVIDED" }, "clustersExecProviderConfig": { "type": "object", "properties": { "command": { "type": "string", "title": "Command to execute" }, "args": { "type": "array", "items": { "type": "string" }, "title": "Arguments to pass to the command when executing it" }, "env": { "type": "object", "additionalProperties": { "type": "string" }, "title": "Env defines additional environment variables to expose to the process" }, "apiVersion": { "type": "string", "title": "Preferred input version of the ExecInfo" }, "installHint": { "type": "string", "title": "This text is shown to the user when the executable doesn't seem to be present" } }, "title": "ExecProviderConfig is config used to call an external command to perform cluster authentication\nSee: https://godoc.org/k8s.io/client-go/tools/clientcmd/api#ExecConfig" }, "clustersTLSClientConfig": { "type": "object", "properties": { "insecure": { "type": "boolean", "description": "Insecure specifies that the server should be accessed without verifying the TLS certificate. For testing only." }, "serverName": { "type": "string", "description": "ServerName is passed to the server for SNI and is used in the client to check server\ncertificates against. If ServerName is empty, the hostname used to contact the\nserver is used." }, "certData": { "type": "string", "format": "byte", "title": "CertData holds PEM-encoded bytes (typically read from a client certificate file).\nCertData takes precedence over CertFile" }, "keyData": { "type": "string", "format": "byte", "title": "KeyData holds PEM-encoded bytes (typically read from a client certificate key file).\nKeyData takes precedence over KeyFile" }, "caData": { "type": "string", "format": "byte", "title": "CAData holds PEM-encoded bytes (typically read from a root certificates bundle).\nCAData takes precedence over CAFile" } }, "title": "TLSClientConfig contains settings to enable transport layer security" }, "commonsConnectionState": { "type": "object", "properties": { "status": { "type": "string", "title": "Status contains the current status indicator for the connection" }, "message": { "type": "string", "title": "Message contains human readable information about the connection status" }, "attemptedAt": { "$ref": "#/$defs/v1Time" }, "attemptedAtTs": { "type": "string", "format": "date-time", "title": "attemptedAtTs is the google timestamp variation of attemptedAt" } }, "title": "ConnectionState contains information about remote resource connection state, currently used for clusters and repositories" }, "protobufFieldMask": { "type": "object", "properties": { "paths": { "type": "array", "items": { "type": "string" }, "description": "The set of field mask paths." } }, "description": "paths: \"f.a\"\n paths: \"f.b.d\"\n\nHere `f` represents a field in some root message, `a` and `b`\nfields in the message found in `f`, and `d` a field found in the\nmessage in `f.b`.\n\nField masks are used to specify a subset of fields that should be\nreturned by a get operation or modified by an update operation.\nField masks also have a custom JSON encoding (see below).\n\n# Field Masks in Projections\n\nWhen used in the context of a projection, a response message or\nsub-message is filtered by the API to only contain those fields as\nspecified in the mask. For example, if the mask in the previous\nexample is applied to a response message as follows:\n\n f {\n a : 22\n b {\n d : 1\n x : 2\n }\n y : 13\n }\n z: 8\n\nThe result will not contain specific values for fields x,y and z\n(their value will be set to the default, and omitted in proto text\noutput):\n\n\n f {\n a : 22\n b {\n d : 1\n }\n }\n\nA repeated field is not allowed except at the last position of a\npaths string.\n\nIf a FieldMask object is not present in a get operation, the\noperation applies to all fields (as if a FieldMask of all fields\nhad been specified).\n\nNote that a field mask does not necessarily apply to the\ntop-level response message. In case of a REST get operation, the\nfield mask applies directly to the response, but in case of a REST\nlist operation, the mask instead applies to each individual message\nin the returned resource list. In case of a REST custom method,\nother definitions may be used. Where the mask applies will be\nclearly documented together with its declaration in the API. In\nany case, the effect on the returned resource/resources is required\nbehavior for APIs.\n\n# Field Masks in Update Operations\n\nA field mask in update operations specifies which fields of the\ntargeted resource are going to be updated. The API is required\nto only change the values of the fields as specified in the mask\nand leave the others untouched. If a resource is passed in to\ndescribe the updated values, the API ignores the values of all\nfields not covered by the mask.\n\nIf a repeated field is specified for an update operation, new values will\nbe appended to the existing repeated field in the target resource. Note that\na repeated field is only allowed in the last position of a `paths` string.\n\nIf a sub-message is specified in the last position of the field mask for an\nupdate operation, then new value will be merged into the existing sub-message\nin the target resource.\n\nFor example, given the target message:\n\n f {\n b {\n d: 1\n x: 2\n }\n c: [1]\n }\n\nAnd an update message:\n\n f {\n b {\n d: 10\n }\n c: [2]\n }\n\nthen if the field mask is:\n\n paths: [\"f.b\", \"f.c\"]\n\nthen the result will be:\n\n f {\n b {\n d: 10\n x: 2\n }\n c: [1, 2]\n }\n\nAn implementation may provide options to override this default behavior for\nrepeated and message fields.\n\nNote that libraries which implement FieldMask resolution have various\ndifferent behaviors in the face of empty masks or the special \"*\" mask.\nWhen implementing a service you should confirm these cases have the\nappropriate behavior in the underlying FieldMask library that you desire,\nand you may need to special case those cases in your application code if\nthe underlying field mask library behavior differs from your intended\nservice semantics.\n\nUpdate methods implementing https://google.aip.dev/134\n- MUST support the special value * meaning \"full replace\"\n- MUST treat an omitted field mask as \"replace fields which are present\".\n\nOther methods implementing https://google.aip.dev/157\n- SHOULD support the special value \"*\" to mean \"get all\".\n- MUST treat an omitted field mask to mean \"get all\", unless otherwise\ndocumented.\n\n## Considerations for HTTP REST\n\nThe HTTP kind of an update operation which uses a field mask must\nbe set to PATCH instead of PUT in order to satisfy HTTP semantics\n(PUT must only be used for full updates).\n\n# JSON Encoding of Field Masks\n\nIn JSON, a field mask is encoded as a single string where paths are\nseparated by a comma. Fields name in each path are converted\nto/from lower-camel naming conventions.\n\nAs an example, consider the following message declarations:\n\n message Profile {\n User user = 1;\n Photo photo = 2;\n }\n message User {\n string display_name = 1;\n string address = 2;\n }\n\nIn proto a field mask for `Profile` may look as such:\n\n mask {\n paths: \"user.display_name\"\n paths: \"photo\"\n }\n\nIn JSON, the same mask is represented as below:\n\n {\n mask: \"user.displayName,photo\"\n }\n\n# Field Masks and Oneof Fields\n\nField masks treat fields in oneofs just as regular fields. Consider the\nfollowing message:\n\n message SampleMessage {\n oneof test_oneof {\n string name = 4;\n SubMessage sub_message = 9;\n }\n }\n\nThe field mask can be:\n\n mask {\n paths: \"name\"\n }\n\nOr:\n\n mask {\n paths: \"sub_message\"\n }\n\nNote that oneof type names (\"test_oneof\" in this case) cannot be used in\npaths.\n\n## Field Mask Verification\n\nThe implementation of any API method which has a FieldMask type field in the\nrequest should verify the included field paths, and return an\n`INVALID_ARGUMENT` error if any path is unmappable.", "title": "`FieldMask` represents a set of symbolic field paths, for example:" }, "v1Time": { "type": "object", "properties": { "seconds": { "type": "string", "format": "int64", "description": "Represents seconds of UTC time since Unix epoch\n1970-01-01T00:00:00Z. Must be from 0001-01-01T00:00:00Z to\n9999-12-31T23:59:59Z inclusive." }, "nanos": { "type": "integer", "format": "int32", "description": "Non-negative fractions of a second at nanosecond resolution. Negative\nsecond values with fractions must still have non-negative nanos values\nthat count forward in time. Must be from 0 to 999,999,999\ninclusive. This field may be limited in precision depending on context." } }, "description": "Time is a wrapper around time.Time which supports correct\nmarshaling to YAML and JSON. Wrappers are provided for many\nof the factory methods that the time package offers.\n\n+protobuf.options.marshal=false\n+protobuf.as=Timestamp\n+protobuf.options.(gogoproto.goproto_stringer)=false" } } }