InstanceTemplate
InstanceTemplate is the Schema for the InstanceTemplates API. Manages a VM instance template resource within GCE.
TypeMR
Providerprovider-gcp-compute
Groupcompute.gcp.upbound.io
Scopecluster
Version

1apiVersion: compute.gcp.upbound.io/v1beta1

2kind: InstanceTemplate

apiVersion
string
kind
string
metadata
object
spec
object

InstanceTemplateSpec defines the desired state of InstanceTemplate

deletionPolicy
string
forProvider
required
object

(No description available)

advancedMachineFeatures
array

Configure Nested Virtualisation and Simultaneous Hyper Threading on this VM. Structure is documented below

enableNestedVirtualization
boolean
threadsPerCore
number
visibleCoreCount
number
canIpForward
boolean
confidentialInstanceConfig
array

Enable Confidential Mode on this VM. Structure is documented below

confidentialInstanceType
string
enableConfidentialCompute
boolean
description
string
disk
array

Disks to attach to instances created from this template. This can be specified multiple times for multiple disks. Structure is documented below.

autoDelete
boolean
boot
boolean
deviceName
string
diskEncryptionKey
array

Encrypts or decrypts a disk using a customer-supplied encryption key.

kmsKeySelfLink
string
diskName
string
diskSizeGb
number
diskType
string
interface
string
labels
object
mode
string
provisionedIops
number
resourceManagerTags
object
resourcePolicies
array
  • A list (short name or id) of resource policies to attach to this disk for automatic snapshot creations. Currently a max of 1 resource policy is supported.
source
string
sourceImage
string
sourceImageEncryptionKey
array

The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.

kmsKeySelfLink
string
kmsKeyServiceAccount
string
sourceRef
object

Reference to a Disk in compute to populate source.

name
required
string
policy
object

Policies for referencing.

resolution
string
resolve
string
sourceSelector
object

Selector for a Disk in compute to populate source.

matchControllerRef
boolean
matchLabels
object
policy
object

Policies for selection.

resolution
string
resolve
string
sourceSnapshot
string
sourceSnapshotEncryptionKey
array

The customer-supplied encryption key of the source snapshot. Structure documented below.

kmsKeySelfLink
string
kmsKeyServiceAccount
string
type
string
guestAccelerator
array

List of the type and count of accelerator cards attached to the instance. Structure documented below.

count
number
type
string
instanceDescription
string
labels
object
machineType
string
metadata
object
metadataStartupScript
string
minCpuPlatform
string
name
string
namePrefix
string
networkInterface
array

Networks to attach to instances created from this template. This can be specified multiple times for multiple networks. Structure is documented below.

accessConfig
array

Access configurations, i.e. IPs via which this instance can be accessed via the Internet.g. via tunnel or because it is running on another cloud instance on that network). This block can be repeated multiple times. Structure documented below.

natIp
string
networkTier
string
aliasIpRange
array

An array of alias IP ranges for this network interface. Can only be specified for network interfaces on subnet-mode networks. Structure documented below.

ipCidrRange
string
subnetworkRangeName
string
internalIpv6PrefixLength
number
ipv6AccessConfig
array

An array of IPv6 access configurations for this interface. Currently, only one IPv6 access config, DIRECT_IPV6, is supported. If there is no ipv6AccessConfig specified, then this instance will have no external IPv6 Internet access. Structure documented below.

networkTier
string
ipv6Address
string
network
string
networkIp
string
networkRef
object

Reference to a Network in compute to populate network.

name
required
string
policy
object

Policies for referencing.

resolution
string
resolve
string
networkSelector
object

Selector for a Network in compute to populate network.

matchControllerRef
boolean
matchLabels
object
policy
object

Policies for selection.

resolution
string
resolve
string
nicType
string
queueCount
number
stackType
string
subnetwork
string
subnetworkProject
string
subnetworkRef
object

Reference to a Subnetwork in compute to populate subnetwork.

name
required
string
policy
object

Policies for referencing.

resolution
string
resolve
string
subnetworkSelector
object

Selector for a Subnetwork in compute to populate subnetwork.

matchControllerRef
boolean
matchLabels
object
policy
object

Policies for selection.

resolution
string
resolve
string
networkPerformanceConfig
array

os-features, and network_interface.0.nic-type must be GVNIC in order for this setting to take effect.

totalEgressBandwidthTier
string
project
string
region
string
reservationAffinity
array

Specifies the reservations that this instance can consume from. Structure is documented below.

specificReservation
array

Specifies the label selector for the reservation to use.. Structure is documented below.

key
string
values
array

Corresponds to the label values of a reservation resource.

type
string
resourceManagerTags
object
resourcePolicies
array
  • A list of self_links of resource policies to attach to the instance. Modifying this list will cause the instance to recreate. Currently a max of 1 resource policy is supported.
scheduling
array

The scheduling strategy to use. More details about this configuration option are detailed below.

automaticRestart
boolean
instanceTerminationAction
string
localSsdRecoveryTimeout
array

io/docs/providers/google/guides/provider_versions.html) Specifies the maximum amount of time a Local Ssd Vm should wait while recovery of the Local Ssd state is attempted. Its value should be in between 0 and 168 hours with hour granularity and the default value being 1 hour. Structure is documented below. The local_ssd_recovery_timeout block supports:

nanos
number
seconds
number
maxRunDuration
array

The duration of the instance. Instance will run and be terminated after then, the termination action could be defined in instance_termination_action. Structure is documented below.

nanos
number
seconds
number
minNodeCpus
number
nodeAffinities
array

Specifies node affinities or anti-affinities to determine which sole-tenant nodes your instances and managed instance groups will use as host systems. Read more on sole-tenant node creation here. Structure documented below.

key
string
operator
string
values
array

Corresponds to the label values of a reservation resource.

onHostMaintenance
string
onInstanceStopAction
array

Specifies the action to be performed when the instance is terminated using max_run_duration and STOP instance_termination_action. Only support true discard_local_ssd at this point. Structure is documented below.

discardLocalSsd
boolean
preemptible
boolean
provisioningModel
string
serviceAccount
array

Service account to attach to the instance. Structure is documented below.

email
string
emailRef
object

Reference to a ServiceAccount in cloudplatform to populate email.

name
required
string
policy
object

Policies for referencing.

resolution
string
resolve
string
emailSelector
object

Selector for a ServiceAccount in cloudplatform to populate email.

matchControllerRef
boolean
matchLabels
object
policy
object

Policies for selection.

resolution
string
resolve
string
scopes
array

A list of service scopes. Both OAuth2 URLs and gcloud short names are supported. To allow full access to all Cloud APIs, use the cloud-platform scope. See a complete list of scopes here.

shieldedInstanceConfig
array

Enable Shielded VM on this instance. Shielded VM provides verifiable integrity to prevent against malware and rootkits. Defaults to disabled. Structure is documented below. Note: shielded_instance_config can only be used with boot images with shielded vm support. See the complete list here.

enableIntegrityMonitoring
boolean
enableSecureBoot
boolean
enableVtpm
boolean
tags
array

Tags to attach to the instance.

initProvider
object

THIS IS A BETA FIELD. It will be honored unless the Management Policies feature flag is disabled. InitProvider holds the same fields as ForProvider, with the exception of Identifier and other resource reference fields. The fields that are in InitProvider are merged into ForProvider when the resource is created. The same fields are also added to the terraform ignore_changes hook, to avoid updating them after creation. This is useful for fields that are required on creation, but we do not desire to update them after creation, for example because of an external controller is managing them, like an autoscaler.

advancedMachineFeatures
array

Configure Nested Virtualisation and Simultaneous Hyper Threading on this VM. Structure is documented below

enableNestedVirtualization
boolean
threadsPerCore
number
visibleCoreCount
number
canIpForward
boolean
confidentialInstanceConfig
array

Enable Confidential Mode on this VM. Structure is documented below

confidentialInstanceType
string
enableConfidentialCompute
boolean
description
string
disk
array

Disks to attach to instances created from this template. This can be specified multiple times for multiple disks. Structure is documented below.

autoDelete
boolean
boot
boolean
deviceName
string
diskEncryptionKey
array

Encrypts or decrypts a disk using a customer-supplied encryption key.

kmsKeySelfLink
string
diskName
string
diskSizeGb
number
diskType
string
interface
string
labels
object
mode
string
provisionedIops
number
resourceManagerTags
object
resourcePolicies
array
  • A list (short name or id) of resource policies to attach to this disk for automatic snapshot creations. Currently a max of 1 resource policy is supported.
source
string
sourceImage
string
sourceImageEncryptionKey
array

The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.

kmsKeySelfLink
string
kmsKeyServiceAccount
string
sourceRef
object

Reference to a Disk in compute to populate source.

name
required
string
policy
object

Policies for referencing.

resolution
string
resolve
string
sourceSelector
object

Selector for a Disk in compute to populate source.

matchControllerRef
boolean
matchLabels
object
policy
object

Policies for selection.

resolution
string
resolve
string
sourceSnapshot
string
sourceSnapshotEncryptionKey
array

The customer-supplied encryption key of the source snapshot. Structure documented below.

kmsKeySelfLink
string
kmsKeyServiceAccount
string
type
string
guestAccelerator
array

List of the type and count of accelerator cards attached to the instance. Structure documented below.

count
number
type
string
instanceDescription
string
labels
object
machineType
string
metadata
object
metadataStartupScript
string
minCpuPlatform
string
name
string
namePrefix
string
networkInterface
array

Networks to attach to instances created from this template. This can be specified multiple times for multiple networks. Structure is documented below.

accessConfig
array

Access configurations, i.e. IPs via which this instance can be accessed via the Internet.g. via tunnel or because it is running on another cloud instance on that network). This block can be repeated multiple times. Structure documented below.

natIp
string
networkTier
string
aliasIpRange
array

An array of alias IP ranges for this network interface. Can only be specified for network interfaces on subnet-mode networks. Structure documented below.

ipCidrRange
string
subnetworkRangeName
string
internalIpv6PrefixLength
number
ipv6AccessConfig
array

An array of IPv6 access configurations for this interface. Currently, only one IPv6 access config, DIRECT_IPV6, is supported. If there is no ipv6AccessConfig specified, then this instance will have no external IPv6 Internet access. Structure documented below.

networkTier
string
ipv6Address
string
network
string
networkIp
string
networkRef
object

Reference to a Network in compute to populate network.

name
required
string
policy
object

Policies for referencing.

resolution
string
resolve
string
networkSelector
object

Selector for a Network in compute to populate network.

matchControllerRef
boolean
matchLabels
object
policy
object

Policies for selection.

resolution
string
resolve
string
nicType
string
queueCount
number
stackType
string
subnetwork
string
subnetworkProject
string
subnetworkRef
object

Reference to a Subnetwork in compute to populate subnetwork.

name
required
string
policy
object

Policies for referencing.

resolution
string
resolve
string
subnetworkSelector
object

Selector for a Subnetwork in compute to populate subnetwork.

matchControllerRef
boolean
matchLabels
object
policy
object

Policies for selection.

resolution
string
resolve
string
networkPerformanceConfig
array

os-features, and network_interface.0.nic-type must be GVNIC in order for this setting to take effect.

totalEgressBandwidthTier
string
project
string
region
string
reservationAffinity
array

Specifies the reservations that this instance can consume from. Structure is documented below.

specificReservation
array

Specifies the label selector for the reservation to use.. Structure is documented below.

key
string
values
array

Corresponds to the label values of a reservation resource.

type
string
resourceManagerTags
object
resourcePolicies
array
  • A list of self_links of resource policies to attach to the instance. Modifying this list will cause the instance to recreate. Currently a max of 1 resource policy is supported.
scheduling
array

The scheduling strategy to use. More details about this configuration option are detailed below.

automaticRestart
boolean
instanceTerminationAction
string
localSsdRecoveryTimeout
array

io/docs/providers/google/guides/provider_versions.html) Specifies the maximum amount of time a Local Ssd Vm should wait while recovery of the Local Ssd state is attempted. Its value should be in between 0 and 168 hours with hour granularity and the default value being 1 hour. Structure is documented below. The local_ssd_recovery_timeout block supports:

nanos
number
seconds
number
maxRunDuration
array

The duration of the instance. Instance will run and be terminated after then, the termination action could be defined in instance_termination_action. Structure is documented below.

nanos
number
seconds
number
minNodeCpus
number
nodeAffinities
array

Specifies node affinities or anti-affinities to determine which sole-tenant nodes your instances and managed instance groups will use as host systems. Read more on sole-tenant node creation here. Structure documented below.

key
string
operator
string
values
array

Corresponds to the label values of a reservation resource.

onHostMaintenance
string
onInstanceStopAction
array

Specifies the action to be performed when the instance is terminated using max_run_duration and STOP instance_termination_action. Only support true discard_local_ssd at this point. Structure is documented below.

discardLocalSsd
boolean
preemptible
boolean
provisioningModel
string
serviceAccount
array

Service account to attach to the instance. Structure is documented below.

email
string
emailRef
object

Reference to a ServiceAccount in cloudplatform to populate email.

name
required
string
policy
object

Policies for referencing.

resolution
string
resolve
string
emailSelector
object

Selector for a ServiceAccount in cloudplatform to populate email.

matchControllerRef
boolean
matchLabels
object
policy
object

Policies for selection.

resolution
string
resolve
string
scopes
array

A list of service scopes. Both OAuth2 URLs and gcloud short names are supported. To allow full access to all Cloud APIs, use the cloud-platform scope. See a complete list of scopes here.

shieldedInstanceConfig
array

Enable Shielded VM on this instance. Shielded VM provides verifiable integrity to prevent against malware and rootkits. Defaults to disabled. Structure is documented below. Note: shielded_instance_config can only be used with boot images with shielded vm support. See the complete list here.

enableIntegrityMonitoring
boolean
enableSecureBoot
boolean
enableVtpm
boolean
tags
array

Tags to attach to the instance.

managementPolicies
array

THIS IS A BETA FIELD. It is on by default but can be opted out through a Crossplane feature flag. ManagementPolicies specify the array of actions Crossplane is allowed to take on the managed and external resources. This field is planned to replace the DeletionPolicy field in a future release. Currently, both could be set independently and non-default values would be honored if the feature flag is enabled. If both are custom, the DeletionPolicy field will be ignored. See the design doc for more information: https://github.com/crossplane/crossplane/blob/499895a25d1a1a0ba1604944ef98ac7a1a71f197/design/design-doc-observe-only-resources.md?plain=1#L223 and this one: https://github.com/crossplane/crossplane/blob/444267e84783136daa93568b364a5f01228cacbe/design/one-pager-ignore-changes.md

providerConfigRef
object

ProviderConfigReference specifies how the provider that will be used to create, observe, update, and delete this managed resource should be configured.

name
required
string
policy
object

Policies for referencing.

resolution
string
resolve
string
publishConnectionDetailsTo
object

PublishConnectionDetailsTo specifies the connection secret config which contains a name, metadata and a reference to secret store config to which any connection details for this managed resource should be written. Connection details frequently include the endpoint, username, and password required to connect to the managed resource.

configRef
object

SecretStoreConfigRef specifies which secret store config should be used for this ConnectionSecret.

name
required
string
policy
object

Policies for referencing.

resolution
string
resolve
string
metadata
object

Metadata is the metadata for connection secret.

annotations
object
labels
object
type
string
name
required
string
writeConnectionSecretToRef
object

WriteConnectionSecretToReference specifies the namespace and name of a Secret to which any connection details for this managed resource should be written. Connection details frequently include the endpoint, username, and password required to connect to the managed resource. This field is planned to be replaced in a future release in favor of PublishConnectionDetailsTo. Currently, both could be set independently and connection details would be published to both without affecting each other.

name
required
string
namespace
required
string
status
object

InstanceTemplateStatus defines the observed state of InstanceTemplate.

atProvider
object

(No description available)

advancedMachineFeatures
array

Configure Nested Virtualisation and Simultaneous Hyper Threading on this VM. Structure is documented below

enableNestedVirtualization
boolean
threadsPerCore
number
visibleCoreCount
number
canIpForward
boolean
confidentialInstanceConfig
array

Enable Confidential Mode on this VM. Structure is documented below

confidentialInstanceType
string
enableConfidentialCompute
boolean
description
string
disk
array

Disks to attach to instances created from this template. This can be specified multiple times for multiple disks. Structure is documented below.

autoDelete
boolean
boot
boolean
deviceName
string
diskEncryptionKey
array

Encrypts or decrypts a disk using a customer-supplied encryption key.

kmsKeySelfLink
string
diskName
string
diskSizeGb
number
diskType
string
interface
string
labels
object
mode
string
provisionedIops
number
resourceManagerTags
object
resourcePolicies
array
  • A list (short name or id) of resource policies to attach to this disk for automatic snapshot creations. Currently a max of 1 resource policy is supported.
source
string
sourceImage
string
sourceImageEncryptionKey
array

The customer-supplied encryption key of the source image. Required if the source image is protected by a customer-supplied encryption key.

kmsKeySelfLink
string
kmsKeyServiceAccount
string
sourceSnapshot
string
sourceSnapshotEncryptionKey
array

The customer-supplied encryption key of the source snapshot. Structure documented below.

kmsKeySelfLink
string
kmsKeyServiceAccount
string
type
string
effectiveLabels
object
guestAccelerator
array

List of the type and count of accelerator cards attached to the instance. Structure documented below.

count
number
type
string
id
string
instanceDescription
string
labels
object
machineType
string
metadata
object
metadataFingerprint
string
metadataStartupScript
string
minCpuPlatform
string
name
string
namePrefix
string
networkInterface
array

Networks to attach to instances created from this template. This can be specified multiple times for multiple networks. Structure is documented below.

accessConfig
array

Access configurations, i.e. IPs via which this instance can be accessed via the Internet.g. via tunnel or because it is running on another cloud instance on that network). This block can be repeated multiple times. Structure documented below.

natIp
string
networkTier
string
publicPtrDomainName
string
aliasIpRange
array

An array of alias IP ranges for this network interface. Can only be specified for network interfaces on subnet-mode networks. Structure documented below.

ipCidrRange
string
subnetworkRangeName
string
internalIpv6PrefixLength
number
ipv6AccessConfig
array

An array of IPv6 access configurations for this interface. Currently, only one IPv6 access config, DIRECT_IPV6, is supported. If there is no ipv6AccessConfig specified, then this instance will have no external IPv6 Internet access. Structure documented below.

externalIpv6
string
externalIpv6PrefixLength
string
name
string
networkTier
string
publicPtrDomainName
string
ipv6AccessType
string
ipv6Address
string
name
string
network
string
networkIp
string
nicType
string
queueCount
number
stackType
string
subnetwork
string
subnetworkProject
string
networkPerformanceConfig
array

os-features, and network_interface.0.nic-type must be GVNIC in order for this setting to take effect.

totalEgressBandwidthTier
string
project
string
region
string
reservationAffinity
array

Specifies the reservations that this instance can consume from. Structure is documented below.

specificReservation
array

Specifies the label selector for the reservation to use.. Structure is documented below.

key
string
values
array

Corresponds to the label values of a reservation resource.

type
string
resourceManagerTags
object
resourcePolicies
array
  • A list of self_links of resource policies to attach to the instance. Modifying this list will cause the instance to recreate. Currently a max of 1 resource policy is supported.
scheduling
array

The scheduling strategy to use. More details about this configuration option are detailed below.

automaticRestart
boolean
instanceTerminationAction
string
localSsdRecoveryTimeout
array

io/docs/providers/google/guides/provider_versions.html) Specifies the maximum amount of time a Local Ssd Vm should wait while recovery of the Local Ssd state is attempted. Its value should be in between 0 and 168 hours with hour granularity and the default value being 1 hour. Structure is documented below. The local_ssd_recovery_timeout block supports:

nanos
number
seconds
number
maxRunDuration
array

The duration of the instance. Instance will run and be terminated after then, the termination action could be defined in instance_termination_action. Structure is documented below.

nanos
number
seconds
number
minNodeCpus
number
nodeAffinities
array

Specifies node affinities or anti-affinities to determine which sole-tenant nodes your instances and managed instance groups will use as host systems. Read more on sole-tenant node creation here. Structure documented below.

key
string
operator
string
values
array

Corresponds to the label values of a reservation resource.

onHostMaintenance
string
onInstanceStopAction
array

Specifies the action to be performed when the instance is terminated using max_run_duration and STOP instance_termination_action. Only support true discard_local_ssd at this point. Structure is documented below.

discardLocalSsd
boolean
preemptible
boolean
provisioningModel
string
selfLink
string
selfLinkUnique
string
serviceAccount
array

Service account to attach to the instance. Structure is documented below.

email
string
scopes
array

A list of service scopes. Both OAuth2 URLs and gcloud short names are supported. To allow full access to all Cloud APIs, use the cloud-platform scope. See a complete list of scopes here.

shieldedInstanceConfig
array

Enable Shielded VM on this instance. Shielded VM provides verifiable integrity to prevent against malware and rootkits. Defaults to disabled. Structure is documented below. Note: shielded_instance_config can only be used with boot images with shielded vm support. See the complete list here.

enableIntegrityMonitoring
boolean
enableSecureBoot
boolean
enableVtpm
boolean
tags
array

Tags to attach to the instance.

tagsFingerprint
string
terraformLabels
object
conditions
array

Conditions of the resource.

lastTransitionTime
required
string
message
string
observedGeneration
integer
reason
required
string
status
required
string
type
required
string
observedGeneration
integer
Discover the building blocks for your internal cloud platform.
© 2026 Upbound, Inc.
Solutions
Learn
Company
Community
More