mode property

Output<String> mode
latefinal

The mode for the pool is operating in. Pools with an unspecified mode will operate as if they are in FEDERATION_ONLY mode. > Note This field cannot be changed after the Workload Identity Pool is created. While pulumi preview may show an update if you change this field's value, pulumi up will fail with an API error (such as Error 400: Attempted to update an immutable field.). To specify a different mode, please create a new Workload Identity Pool resource.

  • FEDERATION_ONLY: Pools can only be used for federating external workload identities into Google Cloud. Unless otherwise noted, no structure or format constraints are applied to workload identities in a FEDERATION_ONLY mode pool, and you may not create any resources within the pool besides providers.
  • TRUST_DOMAIN: Pools can be used to assign identities to Google Cloud workloads. All identities within a TRUST_DOMAIN mode pool must consist of a single namespace and individual workload identifier. The subject identifier for all identities must conform to the following format: ns/&lt;namespace&gt;/sa/&lt;workload_identifier&gt;. gcp.iam.WorkloadIdentityPoolProviders cannot be created within TRUST_DOMAIN mode pools.
  • SYSTEM_TRUST_DOMAIN: Pools are managed by Google Cloud services. Neither gcp.iam.WorkloadIdentityPoolNamespaces nor gcp.iam.WorkloadIdentityPoolProviders can be created within SYSTEM_TRUST_DOMAIN mode pools. All identities within a SYSTEM_TRUST_DOMAIN mode pool are in one of the following formats:
  • spiffe://&lt;trust-domain&gt;/ns/&lt;kubernetes-namespace&gt;/sa/&lt;kubernetes-service-account&gt;
  • spiffe://&lt;trust-domain&gt;/resources/&lt;resource-scope&gt;/&lt;resource-name&gt; Possible values are: FEDERATION_ONLY, TRUST_DOMAIN, SYSTEM_TRUST_DOMAIN.

Implementation

late final pulumi.Output<String> mode;