Skip to content

Commit 060a1d3

Browse files
Google APIscopybara-github
Google APIs
authored and
copybara-github
committed
fix!: updating metadata messages for all long running operations
This change might be breaking for client libraries in some languages. PiperOrigin-RevId: 419931787
1 parent 79493b1 commit 060a1d3

6 files changed

Lines changed: 62 additions & 40 deletions

File tree

‎google/cloud/networksecurity/v1beta1/authorization_policy.proto‎

Lines changed: 16 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -22,10 +22,11 @@ import "google/protobuf/field_mask.proto";
2222
import "google/protobuf/timestamp.proto";
2323
import "google/api/annotations.proto";
2424

25+
option csharp_namespace = "Google.Cloud.NetworkSecurity.V1Beta1";
2526
option go_package = "google.golang.org/genproto/googleapis/cloud/networksecurity/v1beta1;networksecurity";
2627
option java_multiple_files = true;
28+
option java_outer_classname = "AuthorizationPolicyProto";
2729
option java_package = "com.google.cloud.networksecurity.v1beta1";
28-
option csharp_namespace = "Google.Cloud.NetworkSecurity.V1Beta1";
2930
option php_namespace = "Google\\Cloud\\NetworkSecurity\\V1beta1";
3031
option ruby_package = "Google::Cloud::NetworkSecurity::V1beta1";
3132

@@ -46,12 +47,16 @@ message AuthorizationPolicy {
4647
// Optional. List of peer identities to match for authorization. At least one
4748
// principal should match. Each peer can be an exact match, or a prefix
4849
// match (example, "namespace/*") or a suffix match (example, //
49-
// */service-account") or a presence match "*".
50+
// */service-account") or a presence match "*". Authorization based on the
51+
// principal name without certificate validation (configured by
52+
// ServerTlsPolicy resource) is considered insecure.
5053
repeated string principals = 1 [(google.api.field_behavior) = OPTIONAL];
5154

5255
// Optional. List of CIDR ranges to match based on source IP address. At least one
5356
// IP block should match. Single IP (e.g., "1.2.3.4") and CIDR (e.g.,
54-
// "1.2.3.0/24") are supported.
57+
// "1.2.3.0/24") are supported. Authorization based on source IP alone
58+
// should be avoided. The IP addresses of any load balancers or proxies
59+
// should be considered untrusted.
5560
repeated string ip_blocks = 2 [(google.api.field_behavior) = OPTIONAL];
5661
}
5762

@@ -77,7 +82,7 @@ message AuthorizationPolicy {
7782
string header_name = 1 [(google.api.field_behavior) = REQUIRED];
7883
}
7984

80-
// Required. List of host names to match. Matched against HOST header in
85+
// Required. List of host names to match. Matched against the ":authority" header in
8186
// http requests. At least one host should match. Each host can be an
8287
// exact match, or a prefix match (example "mydomain.*") or a suffix
8388
// match (example // *.myorg.com") or a presence(any) match "*".
@@ -90,9 +95,11 @@ message AuthorizationPolicy {
9095
// match. Should not be set for gRPC services.
9196
repeated string methods = 4 [(google.api.field_behavior) = OPTIONAL];
9297

93-
// Optional. Match against key:value pair in http header. Provides a
94-
// flexible match based on HTTP headers, for potentially
95-
// advanced use cases. At least one header should match.
98+
// Optional. Match against key:value pair in http header. Provides a flexible match
99+
// based on HTTP headers, for potentially advanced use cases. At least one
100+
// header should match. Avoid using header matches to make authorization
101+
// decisions unless there is a strong guarantee that requests arrive
102+
// through a trusted client or proxy.
96103
HttpHeaderMatch http_header_match = 5 [(google.api.field_behavior) = OPTIONAL];
97104
}
98105

@@ -119,6 +126,8 @@ message AuthorizationPolicy {
119126
ALLOW = 1;
120127

121128
// Deny access.
129+
// Deny rules should be avoided unless they are used to provide a default
130+
// "deny all" fallback.
122131
DENY = 2;
123132
}
124133

‎google/cloud/networksecurity/v1beta1/client_tls_policy.proto‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -23,10 +23,11 @@ import "google/protobuf/field_mask.proto";
2323
import "google/protobuf/timestamp.proto";
2424
import "google/api/annotations.proto";
2525

26+
option csharp_namespace = "Google.Cloud.NetworkSecurity.V1Beta1";
2627
option go_package = "google.golang.org/genproto/googleapis/cloud/networksecurity/v1beta1;networksecurity";
2728
option java_multiple_files = true;
29+
option java_outer_classname = "ClientTlsPolicyProto";
2830
option java_package = "com.google.cloud.networksecurity.v1beta1";
29-
option csharp_namespace = "Google.Cloud.NetworkSecurity.V1Beta1";
3031
option php_namespace = "Google\\Cloud\\NetworkSecurity\\V1beta1";
3132
option ruby_package = "Google::Cloud::NetworkSecurity::V1beta1";
3233

‎google/cloud/networksecurity/v1beta1/common.proto‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -20,10 +20,11 @@ import "google/api/field_behavior.proto";
2020
import "google/protobuf/timestamp.proto";
2121
import "google/api/annotations.proto";
2222

23+
option csharp_namespace = "Google.Cloud.NetworkSecurity.V1Beta1";
2324
option go_package = "google.golang.org/genproto/googleapis/cloud/networksecurity/v1beta1;networksecurity";
2425
option java_multiple_files = true;
26+
option java_outer_classname = "CommonProto";
2527
option java_package = "com.google.cloud.networksecurity.v1beta1";
26-
option csharp_namespace = "Google.Cloud.NetworkSecurity.V1Beta1";
2728
option php_namespace = "Google\\Cloud\\NetworkSecurity\\V1beta1";
2829
option ruby_package = "Google::Cloud::NetworkSecurity::V1beta1";
2930

‎google/cloud/networksecurity/v1beta1/network_security.proto‎

Lines changed: 13 additions & 10 deletions
Original file line numberDiff line numberDiff line change
@@ -23,13 +23,16 @@ import "google/cloud/networksecurity/v1beta1/client_tls_policy.proto";
2323
import "google/cloud/networksecurity/v1beta1/server_tls_policy.proto";
2424
import "google/longrunning/operations.proto";
2525

26+
option csharp_namespace = "Google.Cloud.NetworkSecurity.V1Beta1";
2627
option go_package = "google.golang.org/genproto/googleapis/cloud/networksecurity/v1beta1;networksecurity";
2728
option java_multiple_files = true;
2829
option java_package = "com.google.cloud.networksecurity.v1beta1";
29-
option csharp_namespace = "Google.Cloud.NetworkSecurity.V1Beta1";
3030
option php_namespace = "Google\\Cloud\\NetworkSecurity\\V1beta1";
3131
option ruby_package = "Google::Cloud::NetworkSecurity::V1beta1";
3232

33+
// Network Security API provides resources to configure authentication and
34+
// authorization policies. Refer to per API resource documentation for more
35+
// information.
3336
service NetworkSecurity {
3437
option (google.api.default_host) = "networksecurity.googleapis.com";
3538
option (google.api.oauth_scopes) = "https://www.googleapis.com/auth/cloud-platform";
@@ -59,7 +62,7 @@ service NetworkSecurity {
5962
option (google.api.method_signature) = "parent,authorization_policy,authorization_policy_id";
6063
option (google.longrunning.operation_info) = {
6164
response_type: "AuthorizationPolicy"
62-
metadata_type: "OperationMetadata"
65+
metadata_type: "google.cloud.networksecurity.v1beta1.OperationMetadata"
6366
};
6467
}
6568

@@ -72,7 +75,7 @@ service NetworkSecurity {
7275
option (google.api.method_signature) = "authorization_policy,update_mask";
7376
option (google.longrunning.operation_info) = {
7477
response_type: "AuthorizationPolicy"
75-
metadata_type: "OperationMetadata"
78+
metadata_type: "google.cloud.networksecurity.v1beta1.OperationMetadata"
7679
};
7780
}
7881

@@ -84,7 +87,7 @@ service NetworkSecurity {
8487
option (google.api.method_signature) = "name";
8588
option (google.longrunning.operation_info) = {
8689
response_type: "google.protobuf.Empty"
87-
metadata_type: "OperationMetadata"
90+
metadata_type: "google.cloud.networksecurity.v1beta1.OperationMetadata"
8891
};
8992
}
9093

@@ -113,7 +116,7 @@ service NetworkSecurity {
113116
option (google.api.method_signature) = "parent,server_tls_policy,server_tls_policy_id";
114117
option (google.longrunning.operation_info) = {
115118
response_type: "ServerTlsPolicy"
116-
metadata_type: "OperationMetadata"
119+
metadata_type: "google.cloud.networksecurity.v1beta1.OperationMetadata"
117120
};
118121
}
119122

@@ -126,7 +129,7 @@ service NetworkSecurity {
126129
option (google.api.method_signature) = "server_tls_policy,update_mask";
127130
option (google.longrunning.operation_info) = {
128131
response_type: "ServerTlsPolicy"
129-
metadata_type: "OperationMetadata"
132+
metadata_type: "google.cloud.networksecurity.v1beta1.OperationMetadata"
130133
};
131134
}
132135

@@ -138,7 +141,7 @@ service NetworkSecurity {
138141
option (google.api.method_signature) = "name";
139142
option (google.longrunning.operation_info) = {
140143
response_type: "google.protobuf.Empty"
141-
metadata_type: "OperationMetadata"
144+
metadata_type: "google.cloud.networksecurity.v1beta1.OperationMetadata"
142145
};
143146
}
144147

@@ -167,7 +170,7 @@ service NetworkSecurity {
167170
option (google.api.method_signature) = "parent,client_tls_policy,client_tls_policy_id";
168171
option (google.longrunning.operation_info) = {
169172
response_type: "ClientTlsPolicy"
170-
metadata_type: "OperationMetadata"
173+
metadata_type: "google.cloud.networksecurity.v1beta1.OperationMetadata"
171174
};
172175
}
173176

@@ -180,7 +183,7 @@ service NetworkSecurity {
180183
option (google.api.method_signature) = "client_tls_policy,update_mask";
181184
option (google.longrunning.operation_info) = {
182185
response_type: "ClientTlsPolicy"
183-
metadata_type: "OperationMetadata"
186+
metadata_type: "google.cloud.networksecurity.v1beta1.OperationMetadata"
184187
};
185188
}
186189

@@ -192,7 +195,7 @@ service NetworkSecurity {
192195
option (google.api.method_signature) = "name";
193196
option (google.longrunning.operation_info) = {
194197
response_type: "google.protobuf.Empty"
195-
metadata_type: "OperationMetadata"
198+
metadata_type: "google.cloud.networksecurity.v1beta1.OperationMetadata"
196199
};
197200
}
198201
}

‎google/cloud/networksecurity/v1beta1/server_tls_policy.proto‎

Lines changed: 27 additions & 20 deletions
Original file line numberDiff line numberDiff line change
@@ -23,16 +23,18 @@ import "google/protobuf/field_mask.proto";
2323
import "google/protobuf/timestamp.proto";
2424
import "google/api/annotations.proto";
2525

26+
option csharp_namespace = "Google.Cloud.NetworkSecurity.V1Beta1";
2627
option go_package = "google.golang.org/genproto/googleapis/cloud/networksecurity/v1beta1;networksecurity";
2728
option java_multiple_files = true;
29+
option java_outer_classname = "ServerTlsPolicyProto";
2830
option java_package = "com.google.cloud.networksecurity.v1beta1";
29-
option csharp_namespace = "Google.Cloud.NetworkSecurity.V1Beta1";
3031
option php_namespace = "Google\\Cloud\\NetworkSecurity\\V1beta1";
3132
option ruby_package = "Google::Cloud::NetworkSecurity::V1beta1";
3233

3334
// ServerTlsPolicy is a resource that specifies how a server should authenticate
3435
// incoming requests. This resource itself does not affect configuration unless
3536
// it is attached to a target https proxy or endpoint config selector resource.
37+
//
3638
message ServerTlsPolicy {
3739
option (google.api.resource) = {
3840
type: "networksecurity.googleapis.com/ServerTlsPolicy"
@@ -41,45 +43,50 @@ message ServerTlsPolicy {
4143

4244
// Specification of the MTLSPolicy.
4345
message MTLSPolicy {
44-
// Required. Defines the mechanism to obtain the Certificate Authority certificate to
46+
//
47+
// Defines the mechanism to obtain the Certificate Authority certificate to
4548
// validate the client certificate.
46-
repeated ValidationCA client_validation_ca = 1 [(google.api.field_behavior) = REQUIRED];
49+
repeated ValidationCA client_validation_ca = 1;
4750
}
4851

4952
// Required. Name of the ServerTlsPolicy resource. It matches the pattern
5053
// `projects/*/locations/{location}/serverTlsPolicies/{server_tls_policy}`
5154
string name = 1 [(google.api.field_behavior) = REQUIRED];
5255

53-
// Optional. Free-text description of the resource.
54-
string description = 2 [(google.api.field_behavior) = OPTIONAL];
56+
// Free-text description of the resource.
57+
string description = 2;
5558

5659
// Output only. The timestamp when the resource was created.
5760
google.protobuf.Timestamp create_time = 3 [(google.api.field_behavior) = OUTPUT_ONLY];
5861

5962
// Output only. The timestamp when the resource was updated.
6063
google.protobuf.Timestamp update_time = 4 [(google.api.field_behavior) = OUTPUT_ONLY];
6164

62-
// Optional. Set of label tags associated with the resource.
63-
map<string, string> labels = 5 [(google.api.field_behavior) = OPTIONAL];
65+
// Set of label tags associated with the resource.
66+
map<string, string> labels = 5;
6467

65-
// Optional. Determines if server allows plaintext connections. If set to true, server
68+
//
69+
// Determines if server allows plaintext connections. If set to true, server
6670
// allows plain text connections. By default, it is set to false. This setting
67-
// is not exclusive of other encryption modes. For example, if allow_open and
68-
// mtls_policy are set, server allows both plain text and mTLS connections.
69-
// See documentation of other encryption modes to confirm compatibility.
70-
bool allow_open = 6 [(google.api.field_behavior) = OPTIONAL];
71-
72-
// Optional. Defines a mechanism to provision server identity (public and private keys).
73-
// Cannot be combined with allow_open as a permissive mode that allows both
71+
// is not exclusive of other encryption modes. For example, if `allow_open`
72+
// and `mtls_policy` are set, server allows both plain text and mTLS
73+
// connections. See documentation of other encryption modes to confirm
74+
// compatibility.
75+
bool allow_open = 6;
76+
77+
//
78+
// Defines a mechanism to provision server identity (public and private keys).
79+
// Cannot be combined with `allow_open` as a permissive mode that allows both
7480
// plain text and TLS is not supported.
75-
CertificateProvider server_certificate = 7 [(google.api.field_behavior) = OPTIONAL];
81+
CertificateProvider server_certificate = 7;
7682

77-
// Optional. Defines a mechanism to provision peer validation certificates for peer to
83+
//
84+
// Defines a mechanism to provision peer validation certificates for peer to
7885
// peer authentication (Mutual TLS - mTLS). If not specified, client
7986
// certificate will not be requested. The connection is treated as TLS and not
80-
// mTLS. If allow_open and mtls_policy are set, server allows both plain text
81-
// and mTLS connections.
82-
MTLSPolicy mtls_policy = 8 [(google.api.field_behavior) = OPTIONAL];
87+
// mTLS. If `allow_open` and `mtls_policy` are set, server allows both plain
88+
// text and mTLS connections.
89+
MTLSPolicy mtls_policy = 8;
8390
}
8491

8592
// Request used by the ListServerTlsPolicies method.

‎google/cloud/networksecurity/v1beta1/tls.proto‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -19,10 +19,11 @@ package google.cloud.networksecurity.v1beta1;
1919
import "google/api/field_behavior.proto";
2020
import "google/api/annotations.proto";
2121

22+
option csharp_namespace = "Google.Cloud.NetworkSecurity.V1Beta1";
2223
option go_package = "google.golang.org/genproto/googleapis/cloud/networksecurity/v1beta1;networksecurity";
2324
option java_multiple_files = true;
25+
option java_outer_classname = "TlsProto";
2426
option java_package = "com.google.cloud.networksecurity.v1beta1";
25-
option csharp_namespace = "Google.Cloud.NetworkSecurity.V1Beta1";
2627
option php_namespace = "Google\\Cloud\\NetworkSecurity\\V1beta1";
2728
option ruby_package = "Google::Cloud::NetworkSecurity::V1beta1";
2829

0 commit comments

Comments
 (0)