feat: add optional OIDC JWKs field, add http rules, miscellaneous updates

Google APIs · copybara-github · commit caeee139f47d · 2021-02-17T11:03:04.000-08:00
PiperOrigin-RevId: 357987605
diff --git a/google/cloud/gkehub/v1alpha2/gkehub_v1alpha2.yaml b/google/cloud/gkehub/v1alpha2/gkehub_v1alpha2.yaml
@@ -11,6 +11,12 @@ types:
 
 documentation:
   rules:
+  - selector: google.cloud.location.Locations.GetLocation
+    description: Gets information about a location.
+
+  - selector: google.cloud.location.Locations.ListLocations
+    description: Lists information about the supported locations for this service.
+
   - selector: google.iam.v1.IAMPolicy.GetIamPolicy
     description: |-
       Gets the access control policy for a resource. Returns an empty policy
@@ -38,19 +44,55 @@ backend:
   rules:
   - selector: 'google.cloud.gkehub.v1alpha2.GkeHub.*'
     deadline: 60.0
+  - selector: google.cloud.location.Locations.GetLocation
+    deadline: 60.0
+  - selector: google.cloud.location.Locations.ListLocations
+    deadline: 60.0
   - selector: 'google.iam.v1.IAMPolicy.*'
     deadline: 60.0
   - selector: 'google.longrunning.Operations.*'
     deadline: 60.0
   - selector: google.longrunning.Operations.GetOperation
     deadline: 5.0
 
+http:
+  rules:
+  - selector: google.cloud.location.Locations.GetLocation
+    get: '/v1alpha2/{name=projects/*/locations/*}'
+  - selector: google.cloud.location.Locations.ListLocations
+    get: '/v1alpha2/{name=projects/*}/locations'
+  - selector: google.iam.v1.IAMPolicy.GetIamPolicy
+    get: '/v1alpha2/{resource=projects/*/locations/*/memberships/*}:getIamPolicy'
+  - selector: google.iam.v1.IAMPolicy.SetIamPolicy
+    post: '/v1alpha2/{resource=projects/*/locations/*/memberships/*}:setIamPolicy'
+    body: '*'
+  - selector: google.iam.v1.IAMPolicy.TestIamPermissions
+    post: '/v1alpha2/{resource=projects/*/locations/*/memberships/*}:testIamPermissions'
+    body: '*'
+  - selector: google.longrunning.Operations.CancelOperation
+    post: '/v1alpha2/{name=projects/*/locations/*/operations/*}:cancel'
+    body: '*'
+  - selector: google.longrunning.Operations.DeleteOperation
+    delete: '/v1alpha2/{name=projects/*/locations/*/operations/*}'
+  - selector: google.longrunning.Operations.GetOperation
+    get: '/v1alpha2/{name=projects/*/locations/*/operations/*}'
+  - selector: google.longrunning.Operations.ListOperations
+    get: '/v1alpha2/{name=projects/*/locations/*}/operations'
+
 authentication:
   rules:
   - selector: 'google.cloud.gkehub.v1alpha2.GkeHub.*'
     oauth:
       canonical_scopes: |-
         https://www.googleapis.com/auth/cloud-platform
+  - selector: google.cloud.location.Locations.GetLocation
+    oauth:
+      canonical_scopes: |-
+        https://www.googleapis.com/auth/cloud-platform
+  - selector: google.cloud.location.Locations.ListLocations
+    oauth:
+      canonical_scopes: |-
+        https://www.googleapis.com/auth/cloud-platform
   - selector: 'google.iam.v1.IAMPolicy.*'
     oauth:
       canonical_scopes: |-
diff --git a/google/cloud/gkehub/v1alpha2/membership.proto b/google/cloud/gkehub/v1alpha2/membership.proto
@@ -1,4 +1,4 @@
-// Copyright 2020 Google LLC
+// Copyright 2021 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -337,6 +337,12 @@ message Authority {
   // a new issuer (and re-enabling Workload Identity).
   string issuer = 1 [(google.api.field_behavior) = OPTIONAL];
 
+  // Optional. OIDC verification keys for this Membership in JWKS format (RFC 7517).
+  //
+  // When this field is set, OIDC discovery will NOT be performed on `issuer`,
+  // and instead OIDC tokens will be validated using this field.
+  bytes oidc_jwks = 5 [(google.api.field_behavior) = OPTIONAL];
+
   // Output only. An identity provider that reflects the `issuer` in the workload identity
   // pool.
   string identity_provider = 3 [(google.api.field_behavior) = OUTPUT_ONLY];
