---
title: "POST /v1/projects/{projectsId}/locations/{locationsId}/clusters/{clustersId}:setMasterAuth"
method: POST
path: "/v1/projects/{projectsId}/locations/{locationsId}/clusters/{clustersId}:setMasterAuth"
tags: ["projects"]
---

# POST /v1/projects/{projectsId}/locations/{locationsId}/clusters/{clustersId}:setMasterAuth

`POST /v1/projects/{projectsId}/locations/{locationsId}/clusters/{clustersId}:setMasterAuth`

## Request

- Base URL: `https://container.googleapis.com`
- URL: `https://container.googleapis.com/v1/projects/{projectsId}/locations/{locationsId}/clusters/{clustersId}:setMasterAuth`
- Auth: one of:
  - OAuth 2 and OAuth 2
    - Implicit: `https://accounts.google.com/o/oauth2/auth`
    - Scopes: `https://www.googleapis.com/auth/cloud-platform`
    - Authorization code: `https://accounts.google.com/o/oauth2/auth`
    - Token URL: `https://accounts.google.com/o/oauth2/token` scopes: `https://www.googleapis.com/auth/cloud-platform`
  - OAuth 2 and OAuth 2
    - Implicit: `https://accounts.google.com/o/oauth2/auth`
    - Scopes: `https://www.googleapis.com/auth/container`
    - Authorization code: `https://accounts.google.com/o/oauth2/auth`
    - Token URL: `https://accounts.google.com/o/oauth2/token` scopes: `https://www.googleapis.com/auth/container`

Sets master auth materials. Currently supports changing the admin password or a specific cluster, either via password generation or explicitly setting the password.

## Path parameters

- `projectsId` string, required
- `locationsId` string, required
- `clustersId` string, required

## Request body

- SetMasterAuthRequest: SetMasterAuthRequest updates the admin password of a cluster.
  - `action` 'UNKNOWN' | 'SET_PASSWORD' | 'GENERATE_PASSWORD' | 'SET_USERNAME': Required. The exact form of action to be taken on the master auth.
  - `clusterId` string: Deprecated. The name of the cluster to upgrade. This field has been deprecated and replaced by the name field.
  - `name` string: The name (project, location, cluster) of the cluster to set auth. Specified in the format `projects/*/locations/*/clusters/*`.
  - `projectId` string: Deprecated. The Google Developers Console [project ID or project number](https://cloud.google.com/resource-manager/docs/creating-managing-projects). This field has been deprecated and replaced by the name field.
  - `update` MasterAuth: The authentication information for accessing the master endpoint. Authentication can be done using HTTP basic auth or using client certificates.
    - `clientCertificate` string: Output only. Base64-encoded public certificate used by clients to authenticate to the cluster endpoint. Issued only if client_certificate_config is set.
    - `clientCertificateConfig` ClientCertificateConfig: Configuration for client certificates on the cluster.
      - `issueClientCertificate` boolean: Issue a client certificate.
    - `clientKey` string: Output only. Base64-encoded private key used by clients to authenticate to the cluster endpoint.
    - `clusterCaCertificate` string: Output only. Base64-encoded public certificate that is the root of trust for the cluster.
    - `password` string: The password to use for HTTP basic authentication to the master endpoint. Because the master endpoint is open to the Internet, you should create a strong password. If a password is provided for cluster creation, username must be non-empty. Warning: basic authentication is deprecated, and will be removed in GKE control plane versions 1.19 and newer. For a list of recommended authentication methods, see: https://cloud.google.com/kubernetes-engine/docs/how-to/api-server-authentication
    - `username` string: The username to use for HTTP basic authentication to the master endpoint. For clusters v1.6.0 and later, basic authentication can be disabled by leaving username unspecified (or setting it to the empty string). Warning: basic authentication is deprecated, and will be removed in GKE control plane versions 1.19 and newer. For a list of recommended authentication methods, see: https://cloud.google.com/kubernetes-engine/docs/how-to/api-server-authentication
  - `zone` string: Deprecated. The name of the Google Compute Engine [zone](https://cloud.google.com/compute/docs/zones#available) in which the cluster resides. This field has been deprecated and replaced by the name field.

## Response `200`

Successful response

- Operation: This operation resource represents operations that may have happened or are happening on the cluster. All fields are output only.
  - `clusterConditions` StatusCondition[]: Which conditions caused the current cluster state. Deprecated. Use field error instead.
    - `canonicalCode` 'OK' | 'CANCELLED' | 'UNKNOWN' | 'INVALID_ARGUMENT' | 'DEADLINE_EXCEEDED' | 'NOT_FOUND' | 'ALREADY_EXISTS' | 'PERMISSION_DENIED' | 'UNAUTHENTICATED' | 'RESOURCE_EXHAUSTED' | 'FAILED_PRECONDITION' | 'ABORTED' | 'OUT_OF_RANGE' | 'UNIMPLEMENTED' | 'INTERNAL' | 'UNAVAILABLE' | 'DATA_LOSS': Canonical code of the condition.
    - `code` 'UNKNOWN' | 'GCE_STOCKOUT' | 'GKE_SERVICE_ACCOUNT_DELETED' | 'GCE_QUOTA_EXCEEDED' | 'SET_BY_OPERATOR' | 'CLOUD_KMS_KEY_ERROR' | 'CA_EXPIRING' | 'NODE_SERVICE_ACCOUNT_MISSING_PERMISSIONS' | 'CLOUD_KMS_KEY_DESTROYED': Machine-friendly representation of the condition Deprecated. Use canonical_code instead.
    - `message` string: Human-friendly representation of the condition
  - `detail` string: Output only. Detailed operation progress, if available.
  - `endTime` string: Output only. The time the operation completed, in [RFC3339](https://www.ietf.org/rfc/rfc3339.txt) text format.
  - `error` Status: The `Status` type defines a logical error model that is suitable for different programming environments, including REST APIs and RPC APIs. It is used by [gRPC](https://github.com/grpc). Each `Status` message contains three pieces of data: error code, error message, and error details. You can find out more about this error model and how to work with it in the [API Design Guide](https://cloud.google.com/apis/design/errors).
    - `code` integer: The status code, which should be an enum value of google.rpc.Code.
    - `details` object[]: A list of messages that carry the error details. There is a common set of message types for APIs to use.
    - `message` string: A developer-facing error message, which should be in English. Any user-facing error message should be localized and sent in the google.rpc.Status.details field, or localized by the client.
  - `location` string: Output only. The name of the Google Compute Engine [zone](https://cloud.google.com/compute/docs/regions-zones/regions-zones#available) or [region](https://cloud.google.com/compute/docs/regions-zones/regions-zones#available) in which the cluster resides.
  - `name` string: Output only. The server-assigned ID for the operation.
  - `nodepoolConditions` StatusCondition[]: Which conditions caused the current node pool state. Deprecated. Use field error instead.
    - `canonicalCode` 'OK' | 'CANCELLED' | 'UNKNOWN' | 'INVALID_ARGUMENT' | 'DEADLINE_EXCEEDED' | 'NOT_FOUND' | 'ALREADY_EXISTS' | 'PERMISSION_DENIED' | 'UNAUTHENTICATED' | 'RESOURCE_EXHAUSTED' | 'FAILED_PRECONDITION' | 'ABORTED' | 'OUT_OF_RANGE' | 'UNIMPLEMENTED' | 'INTERNAL' | 'UNAVAILABLE' | 'DATA_LOSS': Canonical code of the condition.
    - `code` 'UNKNOWN' | 'GCE_STOCKOUT' | 'GKE_SERVICE_ACCOUNT_DELETED' | 'GCE_QUOTA_EXCEEDED' | 'SET_BY_OPERATOR' | 'CLOUD_KMS_KEY_ERROR' | 'CA_EXPIRING' | 'NODE_SERVICE_ACCOUNT_MISSING_PERMISSIONS' | 'CLOUD_KMS_KEY_DESTROYED': Machine-friendly representation of the condition Deprecated. Use canonical_code instead.
    - `message` string: Human-friendly representation of the condition
  - `operationType` 'TYPE_UNSPECIFIED' | 'CREATE_CLUSTER' | 'DELETE_CLUSTER' | 'UPGRADE_MASTER' | 'UPGRADE_NODES' | 'REPAIR_CLUSTER' | 'UPDATE_CLUSTER' | 'CREATE_NODE_POOL' | 'DELETE_NODE_POOL' | 'SET_NODE_POOL_MANAGEMENT' | 'AUTO_REPAIR_NODES' | 'AUTO_UPGRADE_NODES' | 'SET_LABELS' | 'SET_MASTER_AUTH' | 'SET_NODE_POOL_SIZE' | 'SET_NETWORK_POLICY' | 'SET_MAINTENANCE_POLICY' | 'RESIZE_CLUSTER' | 'FLEET_FEATURE_UPGRADE': Output only. The operation type.
  - `progress` OperationProgress: Information about operation (or operation stage) progress.
    - `metrics` Metric[]: Progress metric bundle, for example: metrics: [{name: "nodes done", int_value: 15}, {name: "nodes total", int_value: 32}] or metrics: [{name: "progress", double_value: 0.56}, {name: "progress scale", double_value: 1.0}]
      - `doubleValue` number, double: For metrics with floating point value.
      - `intValue` string, int64: For metrics with integer value.
      - `name` string: Required. Metric name, e.g., "nodes total", "percent done".
      - `stringValue` string: For metrics with custom values (ratios, visual progress, etc.).
    - `name` string: A non-parameterized string describing an operation stage. Unset for single-stage operations.
    - `stages` OperationProgress[]: Substages of an operation or a stage.
    - `status` 'STATUS_UNSPECIFIED' | 'PENDING' | 'RUNNING' | 'DONE' | 'ABORTING': Status of an operation stage. Unset for single-stage operations.
  - `selfLink` string: Output only. Server-defined URI for the operation. Example: `https://container.googleapis.com/v1alpha1/projects/123/locations/us-central1/operations/operation-123`.
  - `startTime` string: Output only. The time the operation started, in [RFC3339](https://www.ietf.org/rfc/rfc3339.txt) text format.
  - `status` 'STATUS_UNSPECIFIED' | 'PENDING' | 'RUNNING' | 'DONE' | 'ABORTING': Output only. The current status of the operation.
  - `statusMessage` string: Output only. If an error has occurred, a textual description of the error. Deprecated. Use the field error instead.
  - `targetLink` string: Output only. Server-defined URI for the target of the operation. The format of this is a URI to the resource being modified (such as a cluster, node pool, or node). For node pool repairs, there may be multiple nodes being repaired, but only one will be the target. Examples: - ## `https://container.googleapis.com/v1/projects/123/locations/us-central1/clusters/my-cluster` ## `https://container.googleapis.com/v1/projects/123/zones/us-central1-c/clusters/my-cluster/nodePools/my-np` `https://container.googleapis.com/v1/projects/123/zones/us-central1-c/clusters/my-cluster/nodePools/my-np/node/my-node`
  - `zone` string: Output only. The name of the Google Compute Engine [zone](https://cloud.google.com/compute/docs/zones#available) in which the operation is taking place. This field is deprecated, use location instead.

## Changes

- **2026-11-03** `649eae563481`: 4 info
  - the security scope `https://www.googleapis.com/auth/cloud-platform` was added to the endpoint's security scheme `Oauth2`
  - the security scope `https://www.googleapis.com/auth/cloud-platform` was added to the endpoint's security scheme `Oauth2c`
  - the security scope `https://www.googleapis.com/auth/container` was removed from the endpoint's security scheme `Oauth2`
  - the security scope `https://www.googleapis.com/auth/container` was removed from the endpoint's security scheme `Oauth2c`

[Operation history](https://skmtc.dev/google/apis/container/changes/v1/projects/:projectsId/locations/:locationsId/clusters/:clustersId:setMasterAuth/post.md)

---

[API](https://skmtc.dev/google/apis/container.md) - [All operations](https://skmtc.dev/google/apis/container/llms.txt) - [OpenAPI document](https://skmtc.dev/google/apis/container/revisions/649eae563481?raw)