constellation/terraform-provider-constellation/docs/resources/cluster.md

---
# generated by https://github.com/hashicorp/terraform-plugin-docs
page_title: "constellation_cluster Resource - constellation"
subcategory: ""
description: |-
  Resource for a Constellation cluster.
---

# constellation_cluster (Resource)

Resource for a Constellation cluster.

## Example Usage

```terraform
// Not up-to-date

data "constellation_attestation" "foo" {} # Fill accordingly for the CSP and attestation variant

data "constellation_image" "bar" {} # Fill accordingly for the CSP

resource "constellation_cluster" "aws_example" {
  csp                                = "aws"
  name                               = "constell"
  uid                                = "deadbeef"
  constellation_microservice_version = "vx.y.z"
  image                              = data.constellation_image.bar.image
  attestation                        = data.constellation_attestation.foo.attestation
  init_secret                        = "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef"
  master_secret                      = "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef"
  master_secret_salt                 = "deadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeefdeadbeef"
  out_of_cluster_endpoint            = "123.123.123.123"
  network_config = {
    ip_cidr_node    = "192.168.176.0/20"
    ip_cidr_service = "10.96.0.0/12"
  }
}
```

<!-- schema generated by tfplugindocs -->
## Schema

### Required

- `attestation` (Attributes) Attestation comprises the measurements and SEV-SNP specific parameters. (see [below for nested schema](#nestedatt--attestation))
- `csp` (String) The Cloud Service Provider (CSP) the cluster should run on.
- `image_reference` (String) Constellation OS image reference to use in the CSP specific reference format. Use the [`constellation_image`](../data-sources/image.md) data source to find the correct image reference for your CSP.
- `image_version` (String) Constellation OS image version to use in the CSP specific reference format. Use the [`constellation_image`](../data-sources/image.md) data source to find the correct image version for your CSP.
- `init_secret` (String) Secret used for initialization of the cluster.
- `master_secret` (String) Hex-encoded 32-byte master secret for the cluster.
- `master_secret_salt` (String) Hex-encoded 32-byte master secret salt for the cluster.
- `measurement_salt` (String) Hex-encoded 32-byte measurement salt for the cluster.
- `name` (String) Name used in the cluster's named resources / cluster name.
- `network_config` (Attributes) Configuration for the cluster's network. (see [below for nested schema](#nestedatt--network_config))
- `out_of_cluster_endpoint` (String) The endpoint of the cluster. Typically, this is the public IP of a loadbalancer.
- `uid` (String) The UID of the cluster.

### Optional

- `azure` (Attributes) Azure-specific configuration. (see [below for nested schema](#nestedatt--azure))
- `constellation_microservice_version` (String) The version of Constellation's microservices used within the cluster. When not set, the provider default version is used.
- `extra_api_server_cert_sans` (List of String) List of additional Subject Alternative Names (SANs) for the API server certificate.
- `extra_microservices` (Attributes) Extra microservice settings. (see [below for nested schema](#nestedatt--extra_microservices))
- `gcp` (Attributes) GCP-specific configuration. (see [below for nested schema](#nestedatt--gcp))
- `in_cluster_endpoint` (String) The endpoint of the cluster. When not set, the out-of-cluster endpoint is used.
- `kubernetes_version` (String) The Kubernetes version to use for the cluster. When not set, version v1.27.8 is used. The supported versions are [v1.26.11 v1.27.8 v1.28.4].

### Read-Only

- `cluster_id` (String) The cluster ID of the cluster.
- `kubeconfig` (String) The kubeconfig of the cluster.
- `owner_id` (String) The owner ID of the cluster.

<a id="nestedatt--attestation"></a>
### Nested Schema for `attestation`

Required:

- `amd_root_key` (String)
- `bootloader_version` (Number)
- `measurements` (Attributes Map) (see [below for nested schema](#nestedatt--attestation--measurements))
- `microcode_version` (Number)
- `snp_version` (Number)
- `tee_version` (Number)
- `variant` (String) Attestation variant the image should work with. Can be one of:
  * `aws-sev-snp`
  * `aws-nitro-tpm`
  * `azure-sev-snp`
  * `gcp-sev-es`

Optional:

- `azure_firmware_signer_config` (Attributes) (see [below for nested schema](#nestedatt--attestation--azure_firmware_signer_config))

<a id="nestedatt--attestation--measurements"></a>
### Nested Schema for `attestation.measurements`

Required:

- `expected` (String)
- `warn_only` (Boolean)


<a id="nestedatt--attestation--azure_firmware_signer_config"></a>
### Nested Schema for `attestation.azure_firmware_signer_config`

Optional:

- `accepted_key_digests` (List of String)
- `enforcement_policy` (String)
- `maa_url` (String)



<a id="nestedatt--network_config"></a>
### Nested Schema for `network_config`

Required:

- `ip_cidr_node` (String) CIDR range of the cluster's node network.
- `ip_cidr_service` (String) CIDR range of the cluster's service network.

Optional:

- `ip_cidr_pod` (String) CIDR range of the cluster's pod network. Only required for clusters running on GCP.


<a id="nestedatt--azure"></a>
### Nested Schema for `azure`

Required:

- `load_balancer_name` (String) Name of the Azure load balancer used by the cluster.
- `location` (String) Azure Location of the cluster.
- `network_security_group_name` (String) Name of the Azure network security group used for the cluster.
- `resource_group` (String) Name of the Azure resource group the cluster resides in.
- `subscription_id` (String) ID of the Azure subscription the cluster resides in.
- `tenant_id` (String) Tenant ID of the Azure account.
- `uami_client_id` (String) Client ID of the User assigned managed identity (UAMI) used within the cluster.
- `uami_resource_id` (String) Resource ID of the User assigned managed identity (UAMI) used within the cluster.


<a id="nestedatt--extra_microservices"></a>
### Nested Schema for `extra_microservices`

Required:

- `csi_driver` (Boolean) Enable Constellation's [encrypted CSI driver](https://docs.edgeless.systems/constellation/workflows/storage).


<a id="nestedatt--gcp"></a>
### Nested Schema for `gcp`

Required:

- `project_id` (String) ID of the GCP project the cluster resides in.
- `service_account_key` (String) Base64-encoded private key JSON object of the service account used within the cluster.