canonical: https://jentic.com/apis/googleapis.com/gkehub

# Google GKE Hub API

GKE Hub is the control plane for managing fleets of Kubernetes clusters across GKE, Anthos, and attached on-prem or multi-cloud clusters. The API manages fleets, memberships, features such as Config Management and Service Mesh, and the bindings that scope namespaces and roles across the fleet. Use it to centralise policy, observability, and configuration for many clusters under one Google Cloud project.

## For AI agents

Manage fleets of Kubernetes clusters, register memberships, and enable cross-cluster features such as Config Management and Service Mesh. Built for platform teams operating multi-cluster Kubernetes.

## Scope

Does not provision clusters, run workloads, or manage IAM directly - use the Container API for cluster lifecycle, GKE On-Prem for on-prem clusters, and Cloud IAM for role bindings.

## Capabilities

- Create and manage fleets that group clusters under a project
- Register a cluster as a fleet membership and generate its connect manifest
- Enable and configure fleet-level features such as Config Management
- Manage namespaces, scopes, and bindings across the fleet
- List long-running operations and cancel them when needed
- Inspect membership health and connection status
- Generate the YAML manifest needed to connect a non-GKE cluster

## Use cases

### Onboard a New Cluster to a Fleet

Platform teams that operate Kubernetes across multiple regions or vendors register every cluster as a fleet membership so policy and observability can be applied uniformly. The GKE Hub API creates the membership and generates the connect manifest YAML that the cluster operator applies to register the cluster with Google Cloud. After registration, the cluster shows up in fleet dashboards.

Example prompt: Call POST /v1/projects/{project}/locations/{location}/memberships, then GET /v1/{name}:generateConnectManifest and supply the manifest to the cluster operator.

### Roll Out Config Management Across the Fleet

GitOps-driven platforms enable Config Management as a fleet feature so every registered cluster pulls policy and configuration from the same Git repo. The features endpoints create or patch the configmanagement feature on the fleet, and individual memberships inherit the configuration. This eliminates per-cluster setup and gives a single point of audit.

Example prompt: Call POST /v1/projects/{project}/locations/{location}/features with featureId configmanagement and a Git source spec, then verify it propagates to all memberships.

### Audit and Drift Detection for Multi-Cluster

Compliance teams need to know which clusters are part of the fleet and what features they have enabled. The list memberships and list features endpoints return that inventory in a single project per location, supporting scheduled audits and drift detection against an expected baseline. Bindings and namespaces are also enumerable for tenant scoping reviews.

Example prompt: Call GET /v1/projects/{project}/locations/{location}/memberships and GET /v1/{parent}/features, then compare against the expected baseline and flag deltas.

### Agent-Driven Multi-Cluster Operations

An AI agent embedded in a platform engineering toolchain can register new clusters and enable fleet features through Jentic. The agent searches for the membership-create operation, loads its schema, and executes it without engineers needing to wire OAuth and connect-manifest fetching by hand.

Example prompt: Use Jentic to search 'register a cluster with gke hub', load the membership create schema, and execute it for a target cluster, then fetch its connect manifest.

## Key endpoints

| Method | Path | Description |
| --- | --- | --- |
| GET | /v1/{+parent}/memberships | List fleet memberships |
| POST | /v1/{+parent}/memberships | Create a fleet membership |
| GET | /v1/{+name}:generateConnectManifest | Generate the connect manifest for a membership |
| GET | /v1/{+parent}/fleets | List fleets in a location |
| POST | /v1/{+parent}/fleets | Create a fleet |
| GET | /v1/{+parent}/features | List fleet-level features |
| POST | /v1/{+parent}/features | Create or enable a fleet-level feature |
| POST | /v1/{+name}:cancel | Cancel a long-running operation |

## Key resources

- **fleets** — Fleet objects that group clusters under a project.
- **memberships** — Per-cluster registration with Hub, including connect manifest generation.
- **features** — Fleet-level features such as Config Management and Service Mesh.
- **namespaces** — Cross-cluster namespace declarations.
- **bindings** — Scope-and-role bindings applied across fleet members.

## Why Jentic

- **Setup:** Wiring the GKE Hub API by hand means standing up Google OAuth 2.0 with a service account, requesting the cloud-platform scope, and polling the long-running membership and feature operations yourself. Through Jentic you install once, import the GKE Hub API from the API Directory, store the service-account credential once, and your agent calls it.
- **Permission scoping:** GKE Hub puts the parent fleet or project in the URL path (/v1/{parent}/memberships, /v1/{parent}/features), so a rule can pin your agent to one fleet: it can register memberships and enable features there and nothing else. You choose the operations it may call, so feature changes are not included unless you add them.
- **Credential handling:** Your Google service-account credential is stored once, encrypted, by your own Jentic One instance and injected at execution time. It never enters the agent's prompt, logs, or context.
- **Discovery method:** Agents search Jentic by intent such as 'register a cluster with GKE Hub' or 'enable config management', and Jentic returns the matching operation with its input schema so the agent calls the right endpoint without browsing the reference docs.

## Related APIs

- **Kubernetes Engine API** — Provisions and operates the GKE clusters that Hub then registers as memberships.
- **Backup for GKE API** — Backs up workloads on clusters that are part of the fleet.
- **GKE On-Prem API** — Manages on-prem Anthos clusters that are commonly registered with Hub.
- **Cloud IAM API** — Configures IAM roles and service accounts used to register and operate Hub.

## FAQ

### What authentication does the GKE Hub API use?

It uses Google OAuth 2.0 with the cloud-platform scope, typically via a service account that has gkehub.admin or similar IAM roles. Through Jentic, those credentials live encrypted in the vault and the agent receives scoped bearer tokens.

### Can I register a non-GKE cluster with GKE Hub?

Yes. Create a membership for the external cluster, call generateConnectManifest, and apply the returned YAML on the cluster to install the Connect agent. The cluster then appears in the fleet alongside GKE clusters.

### What are the rate limits for the GKE Hub API?

Google enforces standard per-project quotas on management calls, typically several hundred requests per minute. Cluster onboarding operations return long-running operations whose duration depends on the cluster, not the API rate.

### How do I enable Config Management on my fleet through Jentic?

Search Jentic for 'enable config management on gke fleet', load the schema for POST /v1/{parent}/features with featureId configmanagement, and execute it with a Git repo source spec.

### Is the GKE Hub API free?

Hub itself has no separate charge, but Anthos features such as Config Management and Service Mesh have their own per-cluster pricing. See the Anthos pricing documentation for current rates.

### Does GKE Hub run my workloads?

No. Hub is the control plane for fleets, memberships, and features. Workloads still run on the underlying GKE, Anthos, or attached clusters.

### Can I limit what my agent is allowed to do with the GKE Hub API?

Yes. Because Jentic One is self-hosted, your own rules decide which GKE Hub operations and credentials the agent may use. Since the API puts the parent fleet or project in the URL path (/v1/{parent}/memberships, /v1/{parent}/features), you can pin the agent to a single fleet so it registers memberships and lists resources there and nowhere else. You choose the exact operations it may call, so it cannot enable or change fleet features unless you explicitly allow those endpoints.