> This page is for NVIDIA Kubernetes Engine.

> For clean Markdown of any page, append .md to the page URL.
> For a complete documentation index, see https://docs.nvidia.com/nvke/llms.txt.
> For AI client integration (Claude Code, Cursor, etc.), connect to the MCP server at https://docs.nvidia.com/nvke/_mcp/server.

# Update a cluster

PATCH https://nvke.acme.example/api/clusters/{clusterID}
Content-Type: application/json

All fields are optional. See the API description for merge rules.

Returns 400 for, among others: a Kubernetes downgrade, major-version
change, or a jump of more than one minor version; an upgrade that would
leave a worker pool more than 3 minor versions behind;
`enableEtcdEncryption: false` or `enableOidc: false`; combining OIDC or
etcd enablement with a version upgrade; etcd or OIDC enablement on a
cluster that is not provisioned or is deleting; any `network` value;
a control-plane `maxSurge` greater than 1.

Returns 409 when another mutually exclusive cluster operation is in
progress (`etcd_encryption`, `k8s_upgrade`, `cp_nodes_recycling`,
`oidc_enable`), or the control plane is upgrading or recycling nodes.


Reference: https://docs.nvidia.com/nvke/rest-api-reference/clusters/update-cluster

## Authentication

- `Authorization` header (bearer token, required) — A JWT from an issuer the Operator has configured, carried as `Authorization: Bearer <token>`.

## Request

### Path parameters

- `clusterID` (string, required) — Cluster ID.

### Body (application/json)

This endpoint expects an UpdateClusterRequest.

- `enableCPNodeRecycling` (boolean, optional) — Turn automatic control-plane node replacement on or off.
- `controlPlaneKubernetesVersion` (string, optional) — Target control-plane version, as X.Y.Z with no leading "v". Must be newer than the current version by at most one minor version and keep every worker pool within 3 minor versions. The cluster must have controlPlaneVIP configured.
- `enableEtcdEncryption` (boolean, optional) — `true` starts one-way etcd encryption on a provisioned cluster. `false` is rejected. `true` on an already-encrypted cluster does nothing. Other updates return 409 while it runs.
- `enableOidc` (boolean, optional) — `true` starts one-way OIDC authentication enablement. `false` is rejected. Cannot be combined with a control-plane upgrade or etcd enablement. Other updates return 409 while it runs.
- `controlPlaneConfig` (UpdateClusterControlPlaneConfig, optional) — Changes to `release` or the Kubernetes version start a control-plane rollout. All fields are optional. A provider payload that does not match the cluster's provider is rejected with 400. Rollout-triggering changes require controlPlaneVIP. maxSurge alone does not trigger a rollout and remains mutable without a VIP.
- `network` (ClusterNetworkCreateConfig, optional) — The cluster network cannot be changed after creation; any network value in an update is rejected.

## Response

### 200

Update accepted

- `id` (string, required) — Cluster ID.
- `name` (string, required) — Cluster name.
- `controlPlaneKubernetesVersion` (string, required) — Desired control-plane Kubernetes version. The running version is in ControlPlaneStatus.
- `cniPlugin` (string, required) — CNI plugin.
- `cniVersion` (string, required) — CNI version.
- `etcdEncrypted` (boolean, required) — Whether etcd is encrypted at rest.
- `network` (ClusterNetwork, required) — Pod and service network.
- `createdAt` (datetime, required) — Creation time.
- `conditions` (ClusterConditions, required) — Lifecycle conditions.
- `controlPlaneVIP` (string, optional) — API server VIP, if configured.
- `enableCPNodeRecycling` (boolean, optional, default: false) — When true, control-plane upgrades and configuration changes replace nodes automatically. When false, nodes needing replacement are reported as pending and wait for an operator.
- `controlPlaneConfig` (ControlPlaneConfig, optional) — Current control-plane configuration.
- `nico` (NicoClusterProvider, optional) — NICo identifiers.
- `launchLayer` (LaunchLayerClusterProvider, optional) — LaunchLayer identifiers.
- `nodeAgentUpgrade` (NodeAgentUpgradeStatus, optional) — The active agent upgrade and latest retry error.

## Errors

### 400 Bad Request Error

The request failed validation

- `message` (string, required) — What went wrong.

### 401 Unauthorized Error

No valid bearer token was presented.

- `message` (string, required) — What went wrong.

### 403 Forbidden Error

The token verified, but its subject matches no admission rule.

- `message` (string, required) — What went wrong.

### 404 Not Found Error

Cluster not found. No body is returned.

- `any`

### 409 Conflict Error

Another mutually exclusive cluster operation is in progress. The message names the operation (etcd_encryption, k8s_upgrade, cp_nodes_recycling, oidc_enable).

- `message` (string, required) — What went wrong.

## Types

### UpdateClusterControlPlaneConfig

Changes to `release` or the Kubernetes version start a control-plane rollout. All fields are optional. A provider payload that does not match the cluster's provider is rejected with 400. Rollout-triggering changes require controlPlaneVIP. maxSurge alone does not trigger a rollout and remains mutable without a VIP.

- `desiredCount` (integer, optional) — The desired number of cluster-level control plane nodes. Must be at least 1. Increasing the count above 1 requires controlPlaneVIP on the cluster.
- `maxSurge` (integer, optional) — Extra control-plane nodes allowed during a rollout (0 or 1).
- `provisioningMonitorDisabled` (boolean, optional) — When true, nodes stuck in provisioning past the timeout are not replaced automatically.
- `systemReservedMemory` (string, optional) — Memory reserved for system daemons.
- `nico` (NicoControlPlaneProviderUpdate, optional) — Each field has three states: omitted leaves the stored value, a value replaces it, and an empty value clears it. Clearing a required field is rejected.
- `launchLayer` (LaunchLayerControlPlaneProviderUpdate, optional) — All LaunchLayer control-plane fields are fixed at creation: a request carrying one is rejected with 400. A body echoed from GET must have them stripped.
- `nodeAgentConfig` (NodeAgentConfig, optional) — Desired control-plane node-agent configuration.

### ClusterNetworkCreateConfig

Pod and service network. Immutable after creation. Defaults apply when omitted.

- `podCIDR` (string, optional) — Comma-separated IPv4 pod CIDRs. Each must be private, with a prefix length from /12 to /23, and must not overlap the others or the service CIDR. Must have room for a /24 per desired node plus surge. Default 192.168.0.0/16.
- `serviceCIDR` (string, optional) — IPv4 service CIDR, private, /12 to /24. Default 10.96.0.0/12.

### ClusterNetwork

Pod and service network in effect. Both fields are always present.

- `podCIDR` (string, required) — Comma-separated IPv4 pod CIDRs in effect.
- `serviceCIDR` (string, required) — IPv4 service CIDR in effect.

### ClusterConditions

Lifecycle conditions of a cluster. Each is a Condition.

- `provisioning` (Condition, required) — The cluster is provisioning.
- `provisioned` (Condition, required) — The cluster is provisioned.
- `deleting` (Condition, required) — The cluster is being deleted.
- `cpNodesRecycling` (Condition, optional) — Control-plane nodes are being replaced.
- `controlPlaneUpgrading` (Condition, optional) — The control plane is being upgraded.
- `updateInProgress` (UpdateInProgress, optional) — The mutually exclusive cluster operation in progress, if any. Absent when none.
- `updateFailed` (Condition, optional) — The most recent cluster update failed.

### ControlPlaneConfig

The control-plane configuration in effect, including the desired node-agent version.

- `configurationId` (string, optional) — ID of the current configuration snapshot.
- `desiredCount` (integer, optional) — The desired number of cluster-level control plane nodes. Creating a cluster with or increasing this count above 1 requires controlPlaneVIP on the cluster.
- `maxSurge` (integer, optional) — Extra control-plane nodes allowed during a rollout (0 or 1).
- `provisioningMonitorDisabled` (boolean, optional) — When true, nodes stuck in provisioning past the timeout are not replaced automatically.
- `systemReservedMemory` (string, optional) — Memory reserved for system daemons. Nodes reserve 16Gi when omitted.
- `machineAnnotations` (map from string to string, optional) — Annotations applied to control-plane CAPI Machines at creation, including scale-out and replacement Machines. Fixed at cluster creation and not reconciled after provisioning. Keys under nke.nvidia.com, nke.io, nvke.nvidia.com, kubernetes.io, k8s.io, cluster.x-k8s.io and their subdomains require an explicit deployment allowlist entry for this metadata type.
- `machineLabels` (map from string to string, optional) — Labels applied to control-plane CAPI Machines at creation, including scale-out and replacement Machines. Fixed at cluster creation and not reconciled after provisioning. Keys under nke.nvidia.com, nke.io, nvke.nvidia.com, kubernetes.io, k8s.io, cluster.x-k8s.io and their subdomains require an explicit deployment allowlist entry for this metadata type.
- `nodeLabels` (map from string to string, optional) — Labels applied to control-plane nodes, as a map of keys to values. Set at creation.
- `nico` (NicoControlPlaneProvider, optional) — NICo settings for control-plane nodes.
- `launchLayer` (LaunchLayerControlPlaneProvider, optional) — LaunchLayer settings for control-plane nodes.
- `nodeAgentConfig` (NodeAgentConfig, optional) — Desired control-plane node-agent configuration.

### NicoClusterProvider

NICo identifiers for the cluster. Fixed at creation.

- `orgID` (string, optional) — Organization that owns the cluster.
- `siteID` (string, optional) — NICo site ID.
- `vpcID` (string, optional) — NICo VPC ID.

### LaunchLayerClusterProvider

LaunchLayer identifiers for the cluster. Exactly one of vpcID or orgID must be set, and siteID is required. All fields are fixed at creation.

- `siteID` (string, required) — Names the LaunchLayer datahall this cluster's machines come from.
- `vpcID` (string, optional) — An existing LaunchLayer VPC that CAPLL observes but never deletes.
- `orgID` (string, optional) — Organization in which CAPLL creates a VPC when vpcID is omitted.
- `vpcType` (enum, optional) — Network type for a managed or existing VPC. When omitted, CAPLL treats the VPC as VIRTUALIZED. A VIRTUALIZED security group needs a VIRTUALIZED VPC.
  - Allowed values: `BARE_METAL`, `VIRTUALIZED`
- `cloudProviderEnabled` (boolean, optional) — Set true where a cloud controller manager runs, so CAPLL leaves the Node's provider ID to it. NVKE runs no CCM, so true is rejected.
- `owner` (LaunchLayerClusterOwner, optional) — The LaunchLayer identity requests are attributed to.
- `securityGroups` (list of LaunchLayerSecurityGroup, optional) — Security groups CAPLL creates with the cluster and deletes with it.

### NodeAgentUpgradeStatus

The active agent upgrade and latest retry error.

- `nodeId` (string, required) — ID of the selected control-plane node.
- `targetVersion` (string, required) — Exact version accepted for this upgrade.
- `method` (string, required) — Installation method from the controller configuration.
- `phase` (enum, required) — Pending before installation starts. Running includes retries.
  - Allowed values: `Pending`, `Running`
- `errorMessage` (string, required) — Latest failure message while retries continue.

### NicoControlPlaneProviderUpdate

Each field has three states: omitted leaves the stored value, a value replaces it, and an empty value clears it. Clearing a required field is rejected.

- `instanceTypePreference` (list of string, optional) — Ordered list of acceptable NICo instance types; index 0 is the highest priority.
- `subnetIDs` (list of string, optional) — Subnets, for sites without native networking.
- `vpcPrefixIDs` (list of string, optional) — VPC prefixes, for sites with native networking.
- `release` (string, optional) — Name of a release. Changing it starts a control-plane rollout.
- `sshKeyGroupIDs` (list of string, optional) — SSH key groups for node access. Can be updated.

### LaunchLayerControlPlaneProviderUpdate

All LaunchLayer control-plane fields are fixed at creation: a request carrying one is rejected with 400. A body echoed from GET must have them stripped.

### NodeAgentConfig

Desired control-plane node-agent configuration.

- `version` (string, optional) — Exact agent release version. An empty value disables agent convergence.

### Condition

A status, when it last changed, and a message.

- `status` (enum, required) — Condition status.
  - Allowed values: `True`, `False`, `Unknown`
- `lastTransitionTime` (datetime, required) — When the status last changed.
- `message` (string, required) — Human-readable detail. May be empty.

### UpdateInProgress

The mutually exclusive cluster operation in progress. Absent when none.

- `type` (enum, required) — Operation in progress.
  - Allowed values: `etcd_encryption`, `k8s_upgrade`, `cp_nodes_recycling`, `oidc_enable`
- `startedAt` (datetime, required) — Start time.
- `message` (string, optional) — Detail.

### NicoControlPlaneProvider

NICo settings for the control-plane nodes, as reported on read. Requests use NicoControlPlaneProviderCreate and NicoControlPlaneProviderUpdate, which omit the fields that direction cannot set.

- `instanceTypePreference` (list of string, optional) — Ordered list of acceptable NICo instance types; index 0 is the highest priority.
- `subnetIDs` (list of string, optional) — Subnets, for sites without native networking.
- `vpcPrefixIDs` (list of string, optional) — VPC prefixes, for sites with native networking.
- `release` (string, optional) — Name of a release the Operator has supplied to the management plane.
- `diskSelectionStrategy` (enum, optional) — Always smallest for control-plane nodes. Not configurable through the API.
  - Allowed values: `smallest`, `largest`
- `sshKeyGroupIDs` (list of string, optional) — SSH key groups for node access. Can be updated.

### LaunchLayerControlPlaneProvider

LaunchLayer settings for the control-plane nodes. Same shape as LaunchLayerNodePoolProvider — control-plane nodes are still LaunchLayer machines. Fixed at creation.

- `instanceType` (string, required) — Requests capacity of a given shape, for example "vm200".
- `hostOSProfile` (string, optional) — Bare-metal profile, as "\<name>" or "\<name>:\<version>". Mutually exclusive with vmProfile.
- `vmProfile` (string, optional) — Virtual profile, as "\<name>" or "\<name>:\<version>". Mutually exclusive with hostOSProfile.
- `fulfillmentStrategy` (enum, optional) — Controls how the Compute Allocation Operator places the request.
  - Allowed values: `BEST_EFFORT`, `ALL_OR_NOTHING`, `WAIT_FOR_RESOURCE`
- `securityGroupRefs` (LaunchLayerSecurityGroupRefs, optional) — Names of the owning cluster's managed security groups to attach, per network interface. Mutually exclusive with securityGroups (existing group IDs) per interface — CAPLL supports both but NVKE always creates groups through the cluster, so NVKE only exposes refs.

### LaunchLayerClusterOwner

The LaunchLayer identity requests are attributed to.

- `userID` (string, optional) — LaunchLayer user ID.
- `username` (string, optional) — LaunchLayer username.

### LaunchLayerSecurityGroup

A security group LaunchLayer creates with the cluster and deletes with it.

- `name` (string, required) — Security group name, referenced by node pools via securityGroupRefs. A DNS label of at most 24 characters, unique within the cluster.
- `type` (enum, required) — Immutable. A virtual VPC can contain both kinds of groups.
  - Allowed values: `BARE_METAL`, `VIRTUALIZED`
- `networkType` (enum, optional) — Required for a VIRTUALIZED group and rejected for a BARE_METAL group.
  - Allowed values: `primary`, `secondary`

### LaunchLayerSecurityGroupRefs

Names of the owning cluster's managed security groups to attach, per network interface. Mutually exclusive with securityGroups (existing group IDs) per interface — CAPLL supports both but NVKE always creates groups through the cluster, so NVKE only exposes refs.

- `primaryNetworkInterface` (list of string, optional) — Managed security group names to attach to the primary network interface.
- `gpuNetworkInterface` (list of string, optional) — Managed security group names to attach to the GPU network interface.

## Examples

### Control-plane upgrade

**Request**

```json
{
  "enableCPNodeRecycling": true,
  "controlPlaneKubernetesVersion": "1.34.2"
}
```

**Response**

```json
{
  "id": "string",
  "name": "string",
  "controlPlaneKubernetesVersion": "string",
  "cniPlugin": "string",
  "cniVersion": "string",
  "etcdEncrypted": true,
  "network": {
    "podCIDR": "string",
    "serviceCIDR": "string"
  },
  "createdAt": "2024-01-15T09:30:00Z",
  "conditions": {
    "provisioning": {
      "status": "True",
      "lastTransitionTime": "2024-01-15T09:30:00Z",
      "message": "string"
    },
    "provisioned": {
      "status": "True",
      "lastTransitionTime": "2024-01-15T09:30:00Z",
      "message": "string"
    },
    "deleting": {
      "status": "True",
      "lastTransitionTime": "2024-01-15T09:30:00Z",
      "message": "string"
    },
    "cpNodesRecycling": {
      "status": "True",
      "lastTransitionTime": "2024-01-15T09:30:00Z",
      "message": "string"
    },
    "controlPlaneUpgrading": {
      "status": "True",
      "lastTransitionTime": "2024-01-15T09:30:00Z",
      "message": "string"
    },
    "updateInProgress": {
      "type": "etcd_encryption",
      "startedAt": "2024-01-15T09:30:00Z",
      "message": "string"
    },
    "updateFailed": {
      "status": "True",
      "lastTransitionTime": "2024-01-15T09:30:00Z",
      "message": "string"
    }
  },
  "controlPlaneVIP": "string",
  "enableCPNodeRecycling": false,
  "controlPlaneConfig": {
    "configurationId": "string",
    "desiredCount": 1,
    "maxSurge": 1,
    "provisioningMonitorDisabled": true,
    "systemReservedMemory": "string",
    "machineAnnotations": {},
    "machineLabels": {},
    "nodeLabels": {},
    "nico": {
      "instanceTypePreference": [
        "string"
      ],
      "subnetIDs": [
        "string"
      ],
      "vpcPrefixIDs": [
        "string"
      ],
      "release": "example-ubuntu-24.04-amd64",
      "diskSelectionStrategy": "smallest",
      "sshKeyGroupIDs": [
        "string"
      ]
    },
    "launchLayer": {
      "instanceType": "string",
      "hostOSProfile": "string",
      "vmProfile": "string",
      "fulfillmentStrategy": "BEST_EFFORT",
      "securityGroupRefs": {
        "primaryNetworkInterface": [
          "string"
        ],
        "gpuNetworkInterface": [
          "string"
        ]
      }
    },
    "nodeAgentConfig": {
      "version": "string"
    }
  },
  "nico": {
    "orgID": "dipfedrcvjiw",
    "siteID": "string",
    "vpcID": "string"
  },
  "launchLayer": {
    "siteID": "string",
    "vpcID": "string",
    "orgID": "string",
    "vpcType": "BARE_METAL",
    "cloudProviderEnabled": true,
    "owner": {
      "userID": "string",
      "username": "string"
    },
    "securityGroups": [
      {
        "name": "string",
        "type": "BARE_METAL",
        "networkType": "primary"
      }
    ]
  },
  "nodeAgentUpgrade": {
    "nodeId": "string",
    "targetVersion": "string",
    "method": "string",
    "phase": "Pending",
    "errorMessage": "string"
  }
}
```

**SDK Code**

```python Control-plane upgrade
import requests

url = "https://nvke.acme.example/api/clusters/clusterID"

payload = {
    "enableCPNodeRecycling": True,
    "controlPlaneKubernetesVersion": "1.34.2"
}
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.json())
```

```javascript Control-plane upgrade
const url = 'https://nvke.acme.example/api/clusters/clusterID';
const options = {
  method: 'PATCH',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: '{"enableCPNodeRecycling":true,"controlPlaneKubernetesVersion":"1.34.2"}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go Control-plane upgrade
package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://nvke.acme.example/api/clusters/clusterID"

	payload := strings.NewReader("{\n  \"enableCPNodeRecycling\": true,\n  \"controlPlaneKubernetesVersion\": \"1.34.2\"\n}")

	req, _ := http.NewRequest("PATCH", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby Control-plane upgrade
require 'uri'
require 'net/http'

url = URI("https://nvke.acme.example/api/clusters/clusterID")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"enableCPNodeRecycling\": true,\n  \"controlPlaneKubernetesVersion\": \"1.34.2\"\n}"

response = http.request(request)
puts response.read_body
```

```java Control-plane upgrade
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.patch("https://nvke.acme.example/api/clusters/clusterID")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"enableCPNodeRecycling\": true,\n  \"controlPlaneKubernetesVersion\": \"1.34.2\"\n}")
  .asString();
```

```php Control-plane upgrade
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('PATCH', 'https://nvke.acme.example/api/clusters/clusterID', [
  'body' => '{
  "enableCPNodeRecycling": true,
  "controlPlaneKubernetesVersion": "1.34.2"
}',
  'headers' => [
    'Authorization' => 'Bearer <token>',
    'Content-Type' => 'application/json',
  ],
]);

echo $response->getBody();
```

```csharp Control-plane upgrade
using RestSharp;

var client = new RestClient("https://nvke.acme.example/api/clusters/clusterID");
var request = new RestRequest(Method.PATCH);
request.AddHeader("Authorization", "Bearer <token>");
request.AddHeader("Content-Type", "application/json");
request.AddParameter("application/json", "{\n  \"enableCPNodeRecycling\": true,\n  \"controlPlaneKubernetesVersion\": \"1.34.2\"\n}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);
```

```swift Control-plane upgrade
import Foundation

let headers = [
  "Authorization": "Bearer <token>",
  "Content-Type": "application/json"
]
let parameters = [
  "enableCPNodeRecycling": true,
  "controlPlaneKubernetesVersion": "1.34.2"
] as [String : Any]

let postData = JSONSerialization.data(withJSONObject: parameters, options: [])

let request = NSMutableURLRequest(url: NSURL(string: "https://nvke.acme.example/api/clusters/clusterID")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "PATCH"
request.allHTTPHeaderFields = headers
request.httpBody = postData as Data

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```

### Enable OIDC authentication (one-way)

**Request**

```json
{
  "enableOidc": true
}
```

**Response**

```json
{
  "id": "string",
  "name": "string",
  "controlPlaneKubernetesVersion": "string",
  "cniPlugin": "string",
  "cniVersion": "string",
  "etcdEncrypted": true,
  "network": {
    "podCIDR": "string",
    "serviceCIDR": "string"
  },
  "createdAt": "2024-01-15T09:30:00Z",
  "conditions": {
    "provisioning": {
      "status": "True",
      "lastTransitionTime": "2024-01-15T09:30:00Z",
      "message": "string"
    },
    "provisioned": {
      "status": "True",
      "lastTransitionTime": "2024-01-15T09:30:00Z",
      "message": "string"
    },
    "deleting": {
      "status": "True",
      "lastTransitionTime": "2024-01-15T09:30:00Z",
      "message": "string"
    },
    "cpNodesRecycling": {
      "status": "True",
      "lastTransitionTime": "2024-01-15T09:30:00Z",
      "message": "string"
    },
    "controlPlaneUpgrading": {
      "status": "True",
      "lastTransitionTime": "2024-01-15T09:30:00Z",
      "message": "string"
    },
    "updateInProgress": {
      "type": "etcd_encryption",
      "startedAt": "2024-01-15T09:30:00Z",
      "message": "string"
    },
    "updateFailed": {
      "status": "True",
      "lastTransitionTime": "2024-01-15T09:30:00Z",
      "message": "string"
    }
  },
  "controlPlaneVIP": "string",
  "enableCPNodeRecycling": false,
  "controlPlaneConfig": {
    "configurationId": "string",
    "desiredCount": 1,
    "maxSurge": 1,
    "provisioningMonitorDisabled": true,
    "systemReservedMemory": "string",
    "machineAnnotations": {},
    "machineLabels": {},
    "nodeLabels": {},
    "nico": {
      "instanceTypePreference": [
        "string"
      ],
      "subnetIDs": [
        "string"
      ],
      "vpcPrefixIDs": [
        "string"
      ],
      "release": "example-ubuntu-24.04-amd64",
      "diskSelectionStrategy": "smallest",
      "sshKeyGroupIDs": [
        "string"
      ]
    },
    "launchLayer": {
      "instanceType": "string",
      "hostOSProfile": "string",
      "vmProfile": "string",
      "fulfillmentStrategy": "BEST_EFFORT",
      "securityGroupRefs": {
        "primaryNetworkInterface": [
          "string"
        ],
        "gpuNetworkInterface": [
          "string"
        ]
      }
    },
    "nodeAgentConfig": {
      "version": "string"
    }
  },
  "nico": {
    "orgID": "dipfedrcvjiw",
    "siteID": "string",
    "vpcID": "string"
  },
  "launchLayer": {
    "siteID": "string",
    "vpcID": "string",
    "orgID": "string",
    "vpcType": "BARE_METAL",
    "cloudProviderEnabled": true,
    "owner": {
      "userID": "string",
      "username": "string"
    },
    "securityGroups": [
      {
        "name": "string",
        "type": "BARE_METAL",
        "networkType": "primary"
      }
    ]
  },
  "nodeAgentUpgrade": {
    "nodeId": "string",
    "targetVersion": "string",
    "method": "string",
    "phase": "Pending",
    "errorMessage": "string"
  }
}
```

**SDK Code**

```python Enable OIDC authentication (one-way)
import requests

url = "https://nvke.acme.example/api/clusters/clusterID"

payload = { "enableOidc": True }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.json())
```

```javascript Enable OIDC authentication (one-way)
const url = 'https://nvke.acme.example/api/clusters/clusterID';
const options = {
  method: 'PATCH',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: '{"enableOidc":true}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go Enable OIDC authentication (one-way)
package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://nvke.acme.example/api/clusters/clusterID"

	payload := strings.NewReader("{\n  \"enableOidc\": true\n}")

	req, _ := http.NewRequest("PATCH", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby Enable OIDC authentication (one-way)
require 'uri'
require 'net/http'

url = URI("https://nvke.acme.example/api/clusters/clusterID")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"enableOidc\": true\n}"

response = http.request(request)
puts response.read_body
```

```java Enable OIDC authentication (one-way)
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.patch("https://nvke.acme.example/api/clusters/clusterID")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"enableOidc\": true\n}")
  .asString();
```

```php Enable OIDC authentication (one-way)
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('PATCH', 'https://nvke.acme.example/api/clusters/clusterID', [
  'body' => '{
  "enableOidc": true
}',
  'headers' => [
    'Authorization' => 'Bearer <token>',
    'Content-Type' => 'application/json',
  ],
]);

echo $response->getBody();
```

```csharp Enable OIDC authentication (one-way)
using RestSharp;

var client = new RestClient("https://nvke.acme.example/api/clusters/clusterID");
var request = new RestRequest(Method.PATCH);
request.AddHeader("Authorization", "Bearer <token>");
request.AddHeader("Content-Type", "application/json");
request.AddParameter("application/json", "{\n  \"enableOidc\": true\n}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);
```

```swift Enable OIDC authentication (one-way)
import Foundation

let headers = [
  "Authorization": "Bearer <token>",
  "Content-Type": "application/json"
]
let parameters = ["enableOidc": true] as [String : Any]

let postData = JSONSerialization.data(withJSONObject: parameters, options: [])

let request = NSMutableURLRequest(url: NSURL(string: "https://nvke.acme.example/api/clusters/clusterID")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "PATCH"
request.allHTTPHeaderFields = headers
request.httpBody = postData as Data

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```

### Resize the control plane and move it to a new release

**Request**

```json
{
  "controlPlaneConfig": {
    "desiredCount": 5,
    "nico": {
      "release": "example-ubuntu-24.04-amd64-r2"
    }
  }
}
```

**Response**

```json
{
  "id": "string",
  "name": "string",
  "controlPlaneKubernetesVersion": "string",
  "cniPlugin": "string",
  "cniVersion": "string",
  "etcdEncrypted": true,
  "network": {
    "podCIDR": "string",
    "serviceCIDR": "string"
  },
  "createdAt": "2024-01-15T09:30:00Z",
  "conditions": {
    "provisioning": {
      "status": "True",
      "lastTransitionTime": "2024-01-15T09:30:00Z",
      "message": "string"
    },
    "provisioned": {
      "status": "True",
      "lastTransitionTime": "2024-01-15T09:30:00Z",
      "message": "string"
    },
    "deleting": {
      "status": "True",
      "lastTransitionTime": "2024-01-15T09:30:00Z",
      "message": "string"
    },
    "cpNodesRecycling": {
      "status": "True",
      "lastTransitionTime": "2024-01-15T09:30:00Z",
      "message": "string"
    },
    "controlPlaneUpgrading": {
      "status": "True",
      "lastTransitionTime": "2024-01-15T09:30:00Z",
      "message": "string"
    },
    "updateInProgress": {
      "type": "etcd_encryption",
      "startedAt": "2024-01-15T09:30:00Z",
      "message": "string"
    },
    "updateFailed": {
      "status": "True",
      "lastTransitionTime": "2024-01-15T09:30:00Z",
      "message": "string"
    }
  },
  "controlPlaneVIP": "string",
  "enableCPNodeRecycling": false,
  "controlPlaneConfig": {
    "configurationId": "string",
    "desiredCount": 1,
    "maxSurge": 1,
    "provisioningMonitorDisabled": true,
    "systemReservedMemory": "string",
    "machineAnnotations": {},
    "machineLabels": {},
    "nodeLabels": {},
    "nico": {
      "instanceTypePreference": [
        "string"
      ],
      "subnetIDs": [
        "string"
      ],
      "vpcPrefixIDs": [
        "string"
      ],
      "release": "example-ubuntu-24.04-amd64",
      "diskSelectionStrategy": "smallest",
      "sshKeyGroupIDs": [
        "string"
      ]
    },
    "launchLayer": {
      "instanceType": "string",
      "hostOSProfile": "string",
      "vmProfile": "string",
      "fulfillmentStrategy": "BEST_EFFORT",
      "securityGroupRefs": {
        "primaryNetworkInterface": [
          "string"
        ],
        "gpuNetworkInterface": [
          "string"
        ]
      }
    },
    "nodeAgentConfig": {
      "version": "string"
    }
  },
  "nico": {
    "orgID": "dipfedrcvjiw",
    "siteID": "string",
    "vpcID": "string"
  },
  "launchLayer": {
    "siteID": "string",
    "vpcID": "string",
    "orgID": "string",
    "vpcType": "BARE_METAL",
    "cloudProviderEnabled": true,
    "owner": {
      "userID": "string",
      "username": "string"
    },
    "securityGroups": [
      {
        "name": "string",
        "type": "BARE_METAL",
        "networkType": "primary"
      }
    ]
  },
  "nodeAgentUpgrade": {
    "nodeId": "string",
    "targetVersion": "string",
    "method": "string",
    "phase": "Pending",
    "errorMessage": "string"
  }
}
```

**SDK Code**

```python Resize the control plane and move it to a new release
import requests

url = "https://nvke.acme.example/api/clusters/clusterID"

payload = { "controlPlaneConfig": {
        "desiredCount": 5,
        "nico": { "release": "example-ubuntu-24.04-amd64-r2" }
    } }
headers = {
    "Authorization": "Bearer <token>",
    "Content-Type": "application/json"
}

response = requests.patch(url, json=payload, headers=headers)

print(response.json())
```

```javascript Resize the control plane and move it to a new release
const url = 'https://nvke.acme.example/api/clusters/clusterID';
const options = {
  method: 'PATCH',
  headers: {Authorization: 'Bearer <token>', 'Content-Type': 'application/json'},
  body: '{"controlPlaneConfig":{"desiredCount":5,"nico":{"release":"example-ubuntu-24.04-amd64-r2"}}}'
};

try {
  const response = await fetch(url, options);
  const data = await response.json();
  console.log(data);
} catch (error) {
  console.error(error);
}
```

```go Resize the control plane and move it to a new release
package main

import (
	"fmt"
	"strings"
	"net/http"
	"io"
)

func main() {

	url := "https://nvke.acme.example/api/clusters/clusterID"

	payload := strings.NewReader("{\n  \"controlPlaneConfig\": {\n    \"desiredCount\": 5,\n    \"nico\": {\n      \"release\": \"example-ubuntu-24.04-amd64-r2\"\n    }\n  }\n}")

	req, _ := http.NewRequest("PATCH", url, payload)

	req.Header.Add("Authorization", "Bearer <token>")
	req.Header.Add("Content-Type", "application/json")

	res, _ := http.DefaultClient.Do(req)

	defer res.Body.Close()
	body, _ := io.ReadAll(res.Body)

	fmt.Println(res)
	fmt.Println(string(body))

}
```

```ruby Resize the control plane and move it to a new release
require 'uri'
require 'net/http'

url = URI("https://nvke.acme.example/api/clusters/clusterID")

http = Net::HTTP.new(url.host, url.port)
http.use_ssl = true

request = Net::HTTP::Patch.new(url)
request["Authorization"] = 'Bearer <token>'
request["Content-Type"] = 'application/json'
request.body = "{\n  \"controlPlaneConfig\": {\n    \"desiredCount\": 5,\n    \"nico\": {\n      \"release\": \"example-ubuntu-24.04-amd64-r2\"\n    }\n  }\n}"

response = http.request(request)
puts response.read_body
```

```java Resize the control plane and move it to a new release
import com.mashape.unirest.http.HttpResponse;
import com.mashape.unirest.http.Unirest;

HttpResponse<String> response = Unirest.patch("https://nvke.acme.example/api/clusters/clusterID")
  .header("Authorization", "Bearer <token>")
  .header("Content-Type", "application/json")
  .body("{\n  \"controlPlaneConfig\": {\n    \"desiredCount\": 5,\n    \"nico\": {\n      \"release\": \"example-ubuntu-24.04-amd64-r2\"\n    }\n  }\n}")
  .asString();
```

```php Resize the control plane and move it to a new release
<?php
require_once('vendor/autoload.php');

$client = new \GuzzleHttp\Client();

$response = $client->request('PATCH', 'https://nvke.acme.example/api/clusters/clusterID', [
  'body' => '{
  "controlPlaneConfig": {
    "desiredCount": 5,
    "nico": {
      "release": "example-ubuntu-24.04-amd64-r2"
    }
  }
}',
  'headers' => [
    'Authorization' => 'Bearer <token>',
    'Content-Type' => 'application/json',
  ],
]);

echo $response->getBody();
```

```csharp Resize the control plane and move it to a new release
using RestSharp;

var client = new RestClient("https://nvke.acme.example/api/clusters/clusterID");
var request = new RestRequest(Method.PATCH);
request.AddHeader("Authorization", "Bearer <token>");
request.AddHeader("Content-Type", "application/json");
request.AddParameter("application/json", "{\n  \"controlPlaneConfig\": {\n    \"desiredCount\": 5,\n    \"nico\": {\n      \"release\": \"example-ubuntu-24.04-amd64-r2\"\n    }\n  }\n}", ParameterType.RequestBody);
IRestResponse response = client.Execute(request);
```

```swift Resize the control plane and move it to a new release
import Foundation

let headers = [
  "Authorization": "Bearer <token>",
  "Content-Type": "application/json"
]
let parameters = ["controlPlaneConfig": [
    "desiredCount": 5,
    "nico": ["release": "example-ubuntu-24.04-amd64-r2"]
  ]] as [String : Any]

let postData = JSONSerialization.data(withJSONObject: parameters, options: [])

let request = NSMutableURLRequest(url: NSURL(string: "https://nvke.acme.example/api/clusters/clusterID")! as URL,
                                        cachePolicy: .useProtocolCachePolicy,
                                    timeoutInterval: 10.0)
request.httpMethod = "PATCH"
request.allHTTPHeaderFields = headers
request.httpBody = postData as Data

let session = URLSession.shared
let dataTask = session.dataTask(with: request as URLRequest, completionHandler: { (data, response, error) -> Void in
  if (error != nil) {
    print(error as Any)
  } else {
    let httpResponse = response as? HTTPURLResponse
    print(httpResponse)
  }
})

dataTask.resume()
```