# KubernetesClusters Object

> Source: https://truto.one/docs/api-reference/unified-cloud-infrastructure-api/kubernetesclusters/

Schema for the `KubernetesClusters` resource in **Unified Cloud Infrastructure API**.

## Properties

- **`id`** _(string, required)_
  Truto's stable unified identifier for this object. Opaque; use provider_id to address the object in the provider's own console or API.
- **`provider_id`** _(string)_
  The provider's own identifier, passed through verbatim — a full ARN, resource id, or self-link. Never truncated, prefixed, or normalized.
- **`provider`** _(string)_
  Which cloud this object was read from.
  Allowed: `aws`, `azure`, `gcp`
- **`account`** _(string)_
  The account, subscription or project this object belongs to.
- **`region`** _(string)_
  Where the object is located. 'global' denotes genuinely global resources (e.g. IAM, GCP VPC networks) rather than a guessed region. A substituted region (when none is derivable) is flagged in unreadable_fields.
- **`native_type`** _(string)_
  The provider's own type string, unmodified — for example 'AWS::S3::Bucket', 'aws_iam_role', 'Microsoft.Sql/servers'. Used for display and drill-down.
- **`tags`** _(object)_
  Key-value pairs exactly as the customer set them: no case folding, key/value normalization, or merging of separate provider concepts. An empty object means no tags; tags that could not be read appear in unreadable_fields instead.
- **`collected_at`** _(string)_
  When Truto actually read this object from the provider, in UTC ISO 8601 with the offset present — not the request time, and not a provider timestamp.
- **`updated_at`** _(string)_
  When the object was last modified at the provider, in UTC ISO 8601. Null when the provider does not record one - see unreadable_fields.
- **`created_at`** _(string)_
  When the object was created at the provider, in UTC ISO 8601. Null when the provider does not record one - see unreadable_fields.
- **`unreadable_fields`** _(array<object>)_
  Fields on this object that could not be read, and why. An empty array means everything was read. Use this to tell a real value from a missing one.
  - **`field`** _(string)_
    The property on this resource that could not be read.
  - **`reason`** _(string)_
    Why the field could not be read. available_on_get: Not read on list to keep the list fast; call GET for this resource's id to get it.
    Allowed: `not_supported_by_provider`, `not_configured`, `permission_denied`, `not_collected`, `collection_error`, `partially_collected`, `available_on_get`
  - **`detail`** _(string)_
    Explanation of the reason, where one adds anything.
- **`remote_data`** _(object)_
  Raw data returned from the remote API call.
- **`name`** _(string)_
  The cluster name, verbatim.
- **`status`** _(string)_
  Lifecycle state, normalised. pending: a cluster registered from outside the provider that has not connected yet (on AWS: EKS Connector). provider_status has the provider's value verbatim.
  Allowed: `creating`, `active`, `updating`, `deleting`, `failed`, `pending`, `unknown`
- **`provider_status`** _(string)_
  The provider's own lifecycle state string, verbatim (on AWS EKS: CREATING, ACTIVE, DELETING, FAILED, UPDATING, PENDING).
- **`kubernetes_version`** _(string)_
  The Kubernetes minor version of the control plane, verbatim (for example 1.31).
- **`platform_version`** _(string)_
  The provider's own platform revision of the control plane, verbatim (on AWS: eks.N).
- **`version_support_type`** _(string)_
  The provider's support tier for the Kubernetes version, verbatim (on AWS EKS: STANDARD or EXTENDED - EXTENDED is billed extended support after standard support ends).
- **`endpoint_public_access`** _(boolean)_
  Whether the Kubernetes API endpoint is reachable from the internet. Reachability still depends on public_access_cidrs.
- **`endpoint_private_access`** _(boolean)_
  Whether the Kubernetes API endpoint is reachable from inside the cluster's network.
- **`public_access_cidrs`** _(array<string>)_
  CIDR blocks allowed to reach the public endpoint. ["0.0.0.0/0"] means any address.
- **`secrets_encryption_enabled`** _(boolean)_
  Whether Kubernetes secrets are envelope-encrypted with a key the customer controls (on AWS: an encryptionConfig covering "secrets").
- **`secrets_encryption_key`** _(object)_
  The key that envelope-encrypts Kubernetes secrets. Null when secrets encryption is off.
  - **`id`** _(string)_
    The target's `id`.
- **`control_plane_log_types`** _(array<string>)_
  Control-plane log types that are being exported, verbatim (on AWS EKS: api, audit, authenticator, controllerManager, scheduler). Empty means none.
- **`authentication_mode`** _(string)_
  How the cluster authenticates IAM principals, verbatim (on AWS EKS: API, API_AND_CONFIG_MAP or CONFIG_MAP).
- **`network_boundary`** _(object)_
  The network the cluster runs in.
  - **`id`** _(string)_
    The target's `id`.
- **`subnet_ids`** _(array<string>)_
  Subnets the control plane places its network interfaces in.
- **`attached_rule_sets`** _(array<object>)_
  The firewall rule sets (security groups) on the control plane network interfaces, including the cluster security group the provider creates.
  - **`id`** _(string)_
    The target's `id`.
- **`oidc_issuer`** _(string)_
  The OIDC issuer URL for workload identity federation.
- **`service_role`** _(object)_
  The role the control plane uses to manage provider resources.
  - **`id`** _(string)_
    The target's `id`.
- **`deletion_protection`** _(boolean)_
  Whether the cluster is protected against deletion.
- **`health_issue_codes`** _(array<string>)_
  Codes of the provider's current health issues for the cluster. Empty means healthy.

## Methods

- [GET /unified/cloud-infrastructure/kubernetes_clusters/{id}](/docs/api-reference/unified-cloud-infrastructure-api/kubernetesclusters/get) — Get Kubernetes clusters
- [GET /unified/cloud-infrastructure/kubernetes_clusters](/docs/api-reference/unified-cloud-infrastructure-api/kubernetesclusters/list) — List Kubernetes clusters