Skip to content

Commit 45500ac

Browse files
Google APIscopybara-github
Google APIs
authored and
copybara-github
committed
feat: add fields and messages for GKE Pods and IP masquerading
docs: update comments PiperOrigin-RevId: 859594094
1 parent 64f7880 commit 45500ac

5 files changed

Lines changed: 194 additions & 34 deletions

File tree

‎google/cloud/networkmanagement/v1beta1/connectivity_test.proto‎

Lines changed: 38 additions & 23 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Copyright 2025 Google LLC
1+
// Copyright 2026 Google LLC
22
//
33
// Licensed under the Apache License, Version 2.0 (the "License");
44
// you may not use this file except in compliance with the License.
@@ -116,21 +116,37 @@ message ConnectivityTest {
116116

117117
// Source or destination of the Connectivity Test.
118118
message Endpoint {
119-
// The type definition of an endpoint's network. Use one of the
120-
// following choices:
119+
// The type of the network of the IP address endpoint. Relevant for the source
120+
// IP address endpoints.
121121
enum NetworkType {
122-
// Default type if unspecified.
122+
// Unspecified. The test will analyze all possible IP address locations.
123+
// This might take longer and produce inaccurate or ambiguous results, so
124+
// prefer specifying an explicit network type.
125+
//
126+
// The `project_id` field should be set to the project where the GCP
127+
// endpoint is located, or where the non-GCP endpoint should be reachable
128+
// from (via routes to non-GCP networks). The project might also be inferred
129+
// from the Connectivity Test project or other projects referenced in the
130+
// request.
123131
NETWORK_TYPE_UNSPECIFIED = 0;
124132

125-
// A network hosted within Google Cloud.
126-
// To receive more detailed output, specify the URI for the source or
127-
// destination network.
133+
// A VPC network. Should be used for internal IP addresses in VPC networks.
134+
// The `network` field should be set to the URI of this network. Only
135+
// endpoints within this network will be considered.
128136
GCP_NETWORK = 1;
129137

130-
// A network hosted outside of Google Cloud.
131-
// This can be an on-premises network, an internet resource or a network
132-
// hosted by another cloud provider.
138+
// A non-GCP network (for example, an on-premises network or another cloud
139+
// provider network). Should be used for internal IP addresses outside of
140+
// Google Cloud. The `network` field should be set to the URI of the VPC
141+
// network containing a corresponding Cloud VPN tunnel, Cloud Interconnect
142+
// VLAN attachment, or a router appliance instance. Only endpoints reachable
143+
// from the provided VPC network via the routes to non-GCP networks will be
144+
// considered.
133145
NON_GCP_NETWORK = 2;
146+
147+
// Internet. Should be used for internet-routable external IP addresses or
148+
// IP addresses for global Google APIs and services.
149+
INTERNET = 3;
134150
}
135151

136152
// Type of the target of a forwarding rule.
@@ -233,6 +249,10 @@ message Endpoint {
233249
// Applicable only to destination endpoint.
234250
string redis_cluster = 18;
235251

252+
// A [GKE Pod](https://cloud.google.com/kubernetes-engine/docs/concepts/pod)
253+
// URI.
254+
string gke_pod = 21;
255+
236256
// A [Cloud Function](https://cloud.google.com/functions). Applicable only to
237257
// source endpoint.
238258
CloudFunctionEndpoint cloud_function = 10;
@@ -247,23 +267,18 @@ message Endpoint {
247267
// Applicable only to source endpoint.
248268
CloudRunRevisionEndpoint cloud_run_revision = 12;
249269

250-
// A VPC network URI.
270+
// A VPC network URI. For source endpoints, used according to the
271+
// `network_type`. For destination endpoints, used only when the source is an
272+
// external IP address endpoint, and the destination is an internal IP address
273+
// endpoint.
251274
string network = 4;
252275

253-
// Type of the network where the endpoint is located.
254-
// Applicable only to source endpoint, as destination network type can be
255-
// inferred from the source.
276+
// For source endpoints, type of the network where the endpoint is located.
277+
// Not relevant for destination endpoints.
256278
NetworkType network_type = 5;
257279

258-
// Project ID where the endpoint is located.
259-
// The project ID can be derived from the URI if you provide a endpoint or
260-
// network URI.
261-
// The following are two cases where you may need to provide the project ID:
262-
// 1. Only the IP address is specified, and the IP address is within a Google
263-
// Cloud project.
264-
// 2. When you are using Shared VPC and the IP address that you provide is
265-
// from the service project. In this case, the network that the IP address
266-
// resides in is defined in the host project.
280+
// For source endpoints, endpoint project ID. Used according to the
281+
// `network_type`. Not relevant for destination endpoints.
267282
string project_id = 6;
268283
}
269284

‎google/cloud/networkmanagement/v1beta1/reachability.proto‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Copyright 2025 Google LLC
1+
// Copyright 2026 Google LLC
22
//
33
// Licensed under the Apache License, Version 2.0 (the "License");
44
// you may not use this file except in compliance with the License.

‎google/cloud/networkmanagement/v1beta1/trace.proto‎

Lines changed: 152 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Copyright 2025 Google LLC
1+
// Copyright 2026 Google LLC
22
//
33
// Licensed under the Apache License, Version 2.0 (the "License");
44
// you may not use this file except in compliance with the License.
@@ -94,6 +94,10 @@ message Step {
9494
// A CloudSQLInstanceInfo is populated with starting instance information.
9595
START_FROM_CLOUD_SQL_INSTANCE = 22;
9696

97+
// Initial state: packet originating from a Google Kubernetes Engine Pod.
98+
// A GkePodInfo is populated with starting Pod information.
99+
START_FROM_GKE_POD = 39;
100+
97101
// Initial state: packet originating from a Redis instance.
98102
// A RedisInstanceInfo is populated with starting instance information.
99103
START_FROM_REDIS_INSTANCE = 32;
@@ -188,6 +192,10 @@ message Step {
188192
// with the translation information.
189193
NAT = 14;
190194

195+
// Transition state: GKE Pod IP masquerading is skipped. The
196+
// `ip_masquerading_skipped` field is populated with the reason.
197+
SKIP_GKE_POD_IP_MASQUERADING = 40;
198+
191199
// Transition state: original connection is terminated and a new proxied
192200
// connection is initiated.
193201
PROXY_CONNECTION = 15;
@@ -292,6 +300,13 @@ message Step {
292300
// Display information of a Google Kubernetes Engine cluster master.
293301
GKEMasterInfo gke_master = 18;
294302

303+
// Display information of a Google Kubernetes Engine Pod.
304+
GkePodInfo gke_pod = 37;
305+
306+
// Display information of the reason why GKE Pod IP masquerading was
307+
// skipped.
308+
IpMasqueradingSkippedInfo ip_masquerading_skipped = 38;
309+
295310
// Display information of a Cloud SQL instance.
296311
CloudSQLInstanceInfo cloud_sql_instance = 19;
297312

@@ -425,16 +440,22 @@ message FirewallInfo {
425440
// rules](https://cloud.google.com/functions/docs/networking/connecting-vpc#restrict-access).
426441
SERVERLESS_VPC_ACCESS_MANAGED_FIREWALL_RULE = 4;
427442

428-
// Global network firewall policy rule.
443+
// User-defined global network firewall policy rule.
429444
// For details, see [Network firewall
430445
// policies](https://cloud.google.com/vpc/docs/network-firewall-policies).
431446
NETWORK_FIREWALL_POLICY_RULE = 5;
432447

433-
// Regional network firewall policy rule.
448+
// User-defined regional network firewall policy rule.
434449
// For details, see [Regional network firewall
435450
// policies](https://cloud.google.com/firewall/docs/regional-firewall-policies).
436451
NETWORK_REGIONAL_FIREWALL_POLICY_RULE = 6;
437452

453+
// System-defined global network firewall policy rule.
454+
SYSTEM_NETWORK_FIREWALL_POLICY_RULE = 7;
455+
456+
// System-defined regional network firewall policy rule.
457+
SYSTEM_REGIONAL_NETWORK_FIREWALL_POLICY_RULE = 8;
458+
438459
// Firewall policy rule containing attributes not yet supported in
439460
// Connectivity tests. Firewall analysis is skipped if such a rule can
440461
// potentially be matched. Please see the [list of unsupported
@@ -1098,6 +1119,9 @@ message DeliverInfo {
10981119

10991120
// Target is a Redis Cluster.
11001121
REDIS_CLUSTER = 17;
1122+
1123+
// Target is a GKE Pod.
1124+
GKE_POD = 19;
11011125
}
11021126

11031127
// Recognized type of a Google Service.
@@ -1265,10 +1289,23 @@ message AbortInfo {
12651289
// required to run the test.
12661290
PERMISSION_DENIED_NO_CLOUD_ROUTER_CONFIGS = 36;
12671291

1268-
// Aborted because no valid source or destination endpoint is derived from
1269-
// the input test request.
1292+
// Aborted because no valid source or destination endpoint can be derived
1293+
// from the test request.
12701294
NO_SOURCE_LOCATION = 5;
12711295

1296+
// Aborted because the source IP address is not contained within the subnet
1297+
// ranges of the provided VPC network.
1298+
NO_SOURCE_GCP_NETWORK_LOCATION = 42;
1299+
1300+
// Aborted because the source IP address is not contained within the
1301+
// destination ranges of the routes towards non-GCP networks in the provided
1302+
// VPC network.
1303+
NO_SOURCE_NON_GCP_NETWORK_LOCATION = 43;
1304+
1305+
// Aborted because the source IP address can't be resolved as an Internet
1306+
// IP address.
1307+
NO_SOURCE_INTERNET_LOCATION = 44;
1308+
12721309
// Aborted because the source or destination endpoint specified in
12731310
// the request is invalid. Some examples:
12741311
// - The request might contain malformed resource URI, project ID, or IP
@@ -1324,6 +1361,11 @@ message AbortInfo {
13241361
// not supported.
13251362
SOURCE_PSC_CLOUD_SQL_UNSUPPORTED = 20;
13261363

1364+
// Aborted because tests with the external database as a source are not
1365+
// supported. In such replication scenarios, the connection is initiated by
1366+
// the Cloud SQL replica instance.
1367+
SOURCE_EXTERNAL_CLOUD_SQL_UNSUPPORTED = 45;
1368+
13271369
// Aborted because tests with a Redis Cluster as a source are not supported.
13281370
SOURCE_REDIS_CLUSTER_UNSUPPORTED = 34;
13291371

@@ -1353,6 +1395,11 @@ message AbortInfo {
13531395
// Aborted because the used protocol is not supported for the used IP
13541396
// version.
13551397
IP_VERSION_PROTOCOL_MISMATCH = 40;
1398+
1399+
// Aborted because selected GKE Pod endpoint location is unknown. This is
1400+
// often the case for "Pending" Pods, which don't have assigned IP addresses
1401+
// yet.
1402+
GKE_POD_UNKNOWN_ENDPOINT_LOCATION = 41;
13561403
}
13571404

13581405
// Causes that the analysis is aborted.
@@ -1423,10 +1470,12 @@ message DropInfo {
14231470
// rule of the internal passthrough load balancer).
14241471
ROUTE_NEXT_HOP_FORWARDING_RULE_TYPE_INVALID = 53;
14251472

1426-
// Packet is sent from the Internet or Google service to the private IPv6
1427-
// address.
1473+
// Packet is sent from the Internet to the private IPv6 address.
14281474
NO_ROUTE_FROM_INTERNET_TO_PRIVATE_IPV6_ADDRESS = 44;
14291475

1476+
// Packet is sent from the Internet to the private IPv4 address.
1477+
NO_ROUTE_FROM_INTERNET_TO_PRIVATE_IPV4_ADDRESS = 109;
1478+
14301479
// Packet is sent from the external IPv6 source address of an instance to
14311480
// the private IPv6 address of an instance.
14321481
NO_ROUTE_FROM_EXTERNAL_IPV6_SOURCE_TO_PRIVATE_IPV6_ADDRESS = 98;
@@ -1484,6 +1533,9 @@ message DropInfo {
14841533
// Packet sent from or to a GKE cluster that is not in running state.
14851534
GKE_CLUSTER_NOT_RUNNING = 27;
14861535

1536+
// Packet sent from or to a GKE Pod that is not in running state.
1537+
GKE_POD_NOT_RUNNING = 103;
1538+
14871539
// Packet sent from or to a Cloud SQL instance that is not in running state.
14881540
CLOUD_SQL_INSTANCE_NOT_RUNNING = 28;
14891541

@@ -1735,6 +1787,10 @@ message DropInfo {
17351787
// dropped due to no matching NAT gateway in the subnet.
17361788
NO_MATCHING_NAT64_GATEWAY = 90;
17371789

1790+
// Packet is dropped due to matching a Private NAT64 gateway with no rules
1791+
// for source IPv6 addresses.
1792+
NO_CONFIGURED_PRIVATE_NAT64_RULE = 107;
1793+
17381794
// Packet is dropped due to being sent to a backend of a passthrough load
17391795
// balancer that doesn't use the same IP version as the frontend.
17401796
LOAD_BALANCER_BACKEND_IP_VERSION_MISMATCH = 96;
@@ -1767,6 +1823,10 @@ message DropInfo {
17671823
// from the region of the next hop of the route matched within this hybrid
17681824
// subnet.
17691825
HYBRID_SUBNET_REGION_MISMATCH = 105;
1826+
1827+
// Packet is dropped because no matching route was found in the hybrid
1828+
// subnet.
1829+
HYBRID_SUBNET_NO_ROUTE = 106;
17701830
}
17711831

17721832
// Cause that the packet is dropped.
@@ -1810,6 +1870,67 @@ message GKEMasterInfo {
18101870
string dns_endpoint = 7;
18111871
}
18121872

1873+
// For display only. Metadata associated with a Google Kubernetes Engine (GKE)
1874+
// Pod.
1875+
message GkePodInfo {
1876+
// URI of a GKE Pod.
1877+
// For Pods in regional Clusters, the URI format is:
1878+
// `projects/{project}/locations/{location}/clusters/{cluster}/k8s/namespaces/{namespace}/pods/{pod}`
1879+
// For Pods in zonal Clusters, the URI format is:
1880+
// `projects/{project}/zones/{zone}/clusters/{cluster}/k8s/namespaces/{namespace}/pods/{pod}`
1881+
string pod_uri = 1;
1882+
1883+
// IP address of a GKE Pod. If the Pod is dual-stack, this is the IP address
1884+
// relevant to the trace.
1885+
string ip_address = 2 [(google.api.field_info).format = IPV4_OR_IPV6];
1886+
1887+
// URI of the network containing the GKE Pod.
1888+
string network_uri = 3;
1889+
}
1890+
1891+
// For display only. Contains information about why IP masquerading was skipped
1892+
// for the packet.
1893+
message IpMasqueradingSkippedInfo {
1894+
// Reason why IP masquerading was skipped.
1895+
enum Reason {
1896+
// Unused default value.
1897+
REASON_UNSPECIFIED = 0;
1898+
1899+
// Masquerading not applied because destination IP is in one of configured
1900+
// non-masquerade ranges.
1901+
DESTINATION_IP_IN_CONFIGURED_NON_MASQUERADE_RANGE = 1;
1902+
1903+
// Masquerading not applied because destination IP is in one of default
1904+
// non-masquerade ranges.
1905+
DESTINATION_IP_IN_DEFAULT_NON_MASQUERADE_RANGE = 2;
1906+
1907+
// Masquerading not applied because destination is on the same Node.
1908+
DESTINATION_ON_SAME_NODE = 3;
1909+
1910+
// Masquerading not applied because ip-masq-agent doesn't exist and default
1911+
// SNAT is disabled.
1912+
DEFAULT_SNAT_DISABLED = 4;
1913+
1914+
// Masquerading not applied because the packet's IP version is IPv6.
1915+
NO_MASQUERADING_FOR_IPV6 = 5;
1916+
1917+
// Masquerading not applied because the source Pod uses the host Node's
1918+
// network namespace, including the Node's IP address.
1919+
POD_USES_NODE_NETWORK_NAMESPACE = 6;
1920+
1921+
// Masquerading not applied because the packet is a return packet.
1922+
NO_MASQUERADING_FOR_RETURN_PACKET = 7;
1923+
}
1924+
1925+
// Reason why IP masquerading was not applied.
1926+
Reason reason = 1;
1927+
1928+
// The matched non-masquerade IP range. Only set if reason is
1929+
// DESTINATION_IP_IN_CONFIGURED_NON_MASQUERADE_RANGE or
1930+
// DESTINATION_IP_IN_DEFAULT_NON_MASQUERADE_RANGE.
1931+
string non_masquerade_range = 2;
1932+
}
1933+
18131934
// For display only. Metadata associated with a Cloud SQL instance.
18141935
message CloudSQLInstanceInfo {
18151936
// Name of a Cloud SQL instance.
@@ -1986,6 +2107,27 @@ message NatInfo {
19862107
GKE_POD_IP_MASQUERADING = 5;
19872108
}
19882109

2110+
// Types of Cloud NAT gateway.
2111+
enum CloudNatGatewayType {
2112+
// Type is unspecified.
2113+
CLOUD_NAT_GATEWAY_TYPE_UNSPECIFIED = 0;
2114+
2115+
// Public NAT gateway.
2116+
PUBLIC_NAT44 = 1;
2117+
2118+
// Public NAT64 gateway.
2119+
PUBLIC_NAT64 = 2;
2120+
2121+
// Private NAT gateway for NCC.
2122+
PRIVATE_NAT_NCC = 3;
2123+
2124+
// Private NAT gateway for hybrid connectivity.
2125+
PRIVATE_NAT_HYBRID = 4;
2126+
2127+
// Private NAT64 gateway.
2128+
PRIVATE_NAT64 = 5;
2129+
}
2130+
19892131
// Type of NAT.
19902132
Type type = 1;
19912133

@@ -2026,6 +2168,9 @@ message NatInfo {
20262168

20272169
// The name of Cloud NAT Gateway. Only valid when type is CLOUD_NAT.
20282170
string nat_gateway_name = 13;
2171+
2172+
// Type of Cloud NAT gateway. Only valid when `type` is CLOUD_NAT.
2173+
CloudNatGatewayType cloud_nat_gateway_type = 14;
20292174
}
20302175

20312176
// For display only. Metadata associated with ProxyConnection.

‎google/cloud/networkmanagement/v1beta1/vpc_flow_logs.proto‎

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Copyright 2025 Google LLC
1+
// Copyright 2026 Google LLC
22
//
33
// Licensed under the Apache License, Version 2.0 (the "License");
44
// you may not use this file except in compliance with the License.
@@ -252,7 +252,7 @@ message ListVpcFlowLogsConfigsRequest {
252252
// Required. The parent resource of the VpcFlowLogsConfig,
253253
// in one of the following formats:
254254
//
255-
// - For project-level resourcs: `projects/{project_id}/locations/global`
255+
// - For project-level resources: `projects/{project_id}/locations/global`
256256
//
257257
// - For organization-level resources:
258258
// `organizations/{organization_id}/locations/global`

0 commit comments

Comments
 (0)