Skip to content

Commit db56b14

Browse files
Google APIscopybara-github
Google APIs
authored and
copybara-github
committed
feat: Added support for Azure workload identity federation
feat: Added `reconciling` and `update_time` output fields to Azure Client resource. Added support for Azure workload identity federation to replace Azure client when creating clusters to manage Azure resources. PiperOrigin-RevId: 506534887
1 parent f2c1080 commit db56b14

8 files changed

Lines changed: 59 additions & 28 deletions

File tree

‎google/cloud/gkemulticloud/v1/BUILD.bazel‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -142,6 +142,7 @@ go_gapic_library(
142142
grpc_service_config = "gkemulticloud_grpc_service_config.json",
143143
importpath = "cloud.google.com/go/gkemulticloud/apiv1;gkemulticloud",
144144
metadata = True,
145+
release_level = "beta",
145146
rest_numeric_enums = False,
146147
service_yaml = "gkemulticloud_v1.yaml",
147148
transport = "grpc",

‎google/cloud/gkemulticloud/v1/attached_resources.proto‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ message AttachedCluster {
7070
// `projects/<project-number>/locations/<region>/attachedClusters/<cluster-id>`.
7171
//
7272
// See [Resource Names](https://cloud.google.com/apis/design/resource_names)
73-
// for more details on GCP resource names.
73+
// for more details on Google Cloud Platform resource names.
7474
string name = 1;
7575

7676
// Optional. A human readable description of this cluster.
@@ -180,9 +180,9 @@ message AttachedClusterUser {
180180
// OIDC discovery information of the target cluster.
181181
//
182182
// Kubernetes Service Account (KSA) tokens are JWT tokens signed by the cluster
183-
// API server. This fields indicates how GCP services
183+
// API server. This fields indicates how Google Cloud Platform services
184184
// validate KSA tokens in order to allow system workloads (such as GKE Connect
185-
// and telemetry agents) to authenticate back to GCP.
185+
// and telemetry agents) to authenticate back to Google Cloud Platform.
186186
//
187187
// Both clusters with public and private issuer URLs are supported.
188188
// Clusters with public issuers only need to specify the `issuer_url` field

‎google/cloud/gkemulticloud/v1/attached_service.proto‎

Lines changed: 7 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -42,7 +42,7 @@ service AttachedClusters {
4242

4343
// Creates a new
4444
// [AttachedCluster][google.cloud.gkemulticloud.v1.AttachedCluster] resource
45-
// on a given GCP project and region.
45+
// on a given Google Cloud Platform project and region.
4646
//
4747
// If successful, the response contains a newly created
4848
// [Operation][google.longrunning.Operation] resource that can be
@@ -175,7 +175,7 @@ message GenerateAttachedClusterInstallManifestRequest {
175175
}
176176
];
177177

178-
// Required. A client provided ID the resource. Must be unique within the
178+
// Required. A client provided ID of the resource. Must be unique within the
179179
// parent resource.
180180
//
181181
// The provided ID will be part of the
@@ -188,7 +188,7 @@ message GenerateAttachedClusterInstallManifestRequest {
188188
// When generating an install manifest for importing an existing Membership
189189
// resource, the attached_cluster_id field must be the Membership id.
190190
//
191-
// Membership names are formatted as `resource name formatted as
191+
// Membership names are formatted as
192192
// `projects/<project-id>/locations/<region>/memberships/<membership-id>`.
193193
string attached_cluster_id = 2 [(google.api.field_behavior) = REQUIRED];
194194

@@ -315,7 +315,7 @@ message GetAttachedClusterRequest {
315315
// `projects/<project-id>/locations/<region>/attachedClusters/<cluster-id>`.
316316
//
317317
// See [Resource Names](https://cloud.google.com/apis/design/resource_names)
318-
// for more details on GCP resource names.
318+
// for more details on Google Cloud Platform resource names.
319319
string name = 1 [
320320
(google.api.field_behavior) = REQUIRED,
321321
(google.api.resource_reference) = {
@@ -332,7 +332,7 @@ message ListAttachedClustersRequest {
332332
// Location names are formatted as `projects/<project-id>/locations/<region>`.
333333
//
334334
// See [Resource Names](https://cloud.google.com/apis/design/resource_names)
335-
// for more details on GCP resource names.
335+
// for more details on Google Cloud Platform resource names.
336336
string parent = 1 [
337337
(google.api.field_behavior) = REQUIRED,
338338
(google.api.resource_reference) = {
@@ -358,7 +358,7 @@ message ListAttachedClustersRequest {
358358
// Response message for `AttachedClusters.ListAttachedClusters` method.
359359
message ListAttachedClustersResponse {
360360
// A list of [AttachedCluster][google.cloud.gkemulticloud.v1.AttachedCluster]
361-
// resources in the specified GCP project and region region.
361+
// resources in the specified Google Cloud Platform project and region region.
362362
repeated AttachedCluster attached_clusters = 1;
363363

364364
// Token to retrieve the next page of results, or empty if there are no more
@@ -375,7 +375,7 @@ message DeleteAttachedClusterRequest {
375375
// `projects/<project-id>/locations/<region>/attachedClusters/<cluster-id>`.
376376
//
377377
// See [Resource Names](https://cloud.google.com/apis/design/resource_names)
378-
// for more details on GCP resource names.
378+
// for more details on Google Cloud Platform resource names.
379379
string name = 1 [
380380
(google.api.field_behavior) = REQUIRED,
381381
(google.api.resource_reference) = {

‎google/cloud/gkemulticloud/v1/aws_resources.proto‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ message AwsCluster {
7070
// `projects/<project-number>/locations/<region>/awsClusters/<cluster-id>`.
7171
//
7272
// See [Resource Names](https://cloud.google.com/apis/design/resource_names)
73-
// for more details on GCP resource names.
73+
// for more details on Google Cloud Platform resource names.
7474
string name = 1;
7575

7676
// Optional. A human readable description of this cluster.

‎google/cloud/gkemulticloud/v1/aws_service.proto‎

Lines changed: 5 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -41,7 +41,7 @@ service AwsClusters {
4141
"https://www.googleapis.com/auth/cloud-platform";
4242

4343
// Creates a new [AwsCluster][google.cloud.gkemulticloud.v1.AwsCluster]
44-
// resource on a given GCP project and region.
44+
// resource on a given Google Cloud Platform project and region.
4545
//
4646
// If successful, the response contains a newly created
4747
// [Operation][google.longrunning.Operation] resource that can be
@@ -290,7 +290,7 @@ message GetAwsClusterRequest {
290290
// `projects/<project-id>/locations/<region>/awsClusters/<cluster-id>`.
291291
//
292292
// See [Resource Names](https://cloud.google.com/apis/design/resource_names)
293-
// for more details on GCP resource names.
293+
// for more details on Google Cloud Platform resource names.
294294
string name = 1 [
295295
(google.api.field_behavior) = REQUIRED,
296296
(google.api.resource_reference) = {
@@ -307,7 +307,7 @@ message ListAwsClustersRequest {
307307
// Location names are formatted as `projects/<project-id>/locations/<region>`.
308308
//
309309
// See [Resource Names](https://cloud.google.com/apis/design/resource_names)
310-
// for more details on GCP resource names.
310+
// for more details on Google Cloud Platform resource names.
311311
string parent = 1 [
312312
(google.api.field_behavior) = REQUIRED,
313313
(google.api.resource_reference) = {
@@ -333,7 +333,7 @@ message ListAwsClustersRequest {
333333
// Response message for `AwsClusters.ListAwsClusters` method.
334334
message ListAwsClustersResponse {
335335
// A list of [AwsCluster][google.cloud.gkemulticloud.v1.AwsCluster] resources
336-
// in the specified GCP project and region region.
336+
// in the specified Google Cloud Platform project and region region.
337337
repeated AwsCluster aws_clusters = 1;
338338

339339
// Token to retrieve the next page of results, or empty if there are no more
@@ -350,7 +350,7 @@ message DeleteAwsClusterRequest {
350350
// `projects/<project-id>/locations/<region>/awsClusters/<cluster-id>`.
351351
//
352352
// See [Resource Names](https://cloud.google.com/apis/design/resource_names)
353-
// for more details on GCP resource names.
353+
// for more details on Google Cloud Platform resource names.
354354
string name = 1 [
355355
(google.api.field_behavior) = REQUIRED,
356356
(google.api.resource_reference) = {

‎google/cloud/gkemulticloud/v1/azure_resources.proto‎

Lines changed: 26 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -70,7 +70,7 @@ message AzureCluster {
7070
// `projects/<project-number>/locations/<region>/azureClusters/<cluster-id>`.
7171
//
7272
// See [Resource Names](https://cloud.google.com/apis/design/resource_names)
73-
// for more details on GCP resource names.
73+
// for more details on Google Cloud Platform resource names.
7474
string name = 1;
7575

7676
// Optional. A human readable description of this cluster.
@@ -90,20 +90,20 @@ message AzureCluster {
9090
// `/subscriptions/<subscription-id>/resourceGroups/<resource-group-name>`
9191
string resource_group_id = 17 [(google.api.field_behavior) = REQUIRED];
9292

93-
// Required. Name of the
93+
// Optional. Name of the
9494
// [AzureClient][google.cloud.gkemulticloud.v1.AzureClient] that contains
9595
// authentication configuration for how the Anthos Multi-Cloud API connects to
9696
// Azure APIs.
9797
//
98-
// The `AzureClient` resource must reside on the same GCP project and region
99-
// as the `AzureCluster`.
98+
// The `AzureClient` resource must reside on the same Google Cloud Platform
99+
// project and region as the `AzureCluster`.
100100
//
101101
// `AzureClient` names are formatted as
102102
// `projects/<project-number>/locations/<region>/azureClients/<client-id>`.
103103
//
104104
// See [Resource Names](https://cloud.google.com/apis/design/resource_names)
105105
// for more details on Google Cloud resource names.
106-
string azure_client = 16 [(google.api.field_behavior) = REQUIRED];
106+
string azure_client = 16 [(google.api.field_behavior) = OPTIONAL];
107107

108108
// Required. Cluster-wide networking configuration.
109109
AzureClusterNetworking networking = 4
@@ -115,6 +115,10 @@ message AzureCluster {
115115
// Required. Configuration related to the cluster RBAC settings.
116116
AzureAuthorization authorization = 6 [(google.api.field_behavior) = REQUIRED];
117117

118+
// Optional. Authentication configuration for management of Azure resources.
119+
AzureServicesAuthentication azure_services_authentication = 22
120+
[(google.api.field_behavior) = OPTIONAL];
121+
118122
// Output only. The current state of the cluster.
119123
State state = 7 [(google.api.field_behavior) = OUTPUT_ONLY];
120124

@@ -410,6 +414,9 @@ message AzureClient {
410414
// Required. The Azure Active Directory Application ID.
411415
string application_id = 3 [(google.api.field_behavior) = REQUIRED];
412416

417+
// Output only. If set, there are currently pending changes to the client.
418+
bool reconciling = 9 [(google.api.field_behavior) = OUTPUT_ONLY];
419+
413420
// Optional. Annotations on the resource.
414421
//
415422
// This field has the same restrictions as Kubernetes annotations.
@@ -430,6 +437,10 @@ message AzureClient {
430437
// Output only. The time at which this resource was created.
431438
google.protobuf.Timestamp create_time = 6
432439
[(google.api.field_behavior) = OUTPUT_ONLY];
440+
441+
// Output only. The time at which this client was last updated.
442+
google.protobuf.Timestamp update_time = 10
443+
[(google.api.field_behavior) = OUTPUT_ONLY];
433444
}
434445

435446
// Configuration related to the cluster RBAC settings.
@@ -444,6 +455,15 @@ message AzureAuthorization {
444455
[(google.api.field_behavior) = REQUIRED];
445456
}
446457

458+
// Authentication configuration for the management of Azure resources.
459+
message AzureServicesAuthentication {
460+
// Required. The Azure Active Directory Tenant ID.
461+
string tenant_id = 1 [(google.api.field_behavior) = REQUIRED];
462+
463+
// Required. The Azure Active Directory Application ID.
464+
string application_id = 2 [(google.api.field_behavior) = REQUIRED];
465+
}
466+
447467
// Identities of a user-type subject for Azure clusters.
448468
message AzureClusterUser {
449469
// Required. The name of the user, e.g. `[email protected]`.
@@ -638,7 +658,7 @@ message AzureServerConfig {
638658
// `projects/<project-number>/locations/<region>/azureServerConfig`.
639659
//
640660
// See [Resource Names](https://cloud.google.com/apis/design/resource_names)
641-
// for more details on GCP resource names.
661+
// for more details on Google Cloud Platform resource names.
642662
string name = 1;
643663

644664
// List of valid Kubernetes versions.

‎google/cloud/gkemulticloud/v1/azure_service.proto‎

Lines changed: 9 additions & 6 deletions
Original file line numberDiff line numberDiff line change
@@ -105,7 +105,7 @@ service AzureClusters {
105105
}
106106

107107
// Creates a new [AzureCluster][google.cloud.gkemulticloud.v1.AzureCluster]
108-
// resource on a given GCP project and region.
108+
// resource on a given Google Cloud Platform project and region.
109109
//
110110
// If successful, the response contains a newly created
111111
// [Operation][google.longrunning.Operation] resource that can be
@@ -327,6 +327,9 @@ message UpdateAzureClusterRequest {
327327
// * `annotations`.
328328
// * `authorization.admin_users`.
329329
// * `control_plane.root_volume.size_gib`.
330+
// * `azure_services_authentication`.
331+
// * `azure_services_authentication.tenant_id`.
332+
// * `azure_services_authentication.application_id`.
330333
// * `control_plane.proxy_config`.
331334
// * `control_plane.proxy_config.resource_group_id`.
332335
// * `control_plane.proxy_config.secret_id`.
@@ -347,7 +350,7 @@ message GetAzureClusterRequest {
347350
// `projects/<project-id>/locations/<region>/azureClusters/<cluster-id>`.
348351
//
349352
// See [Resource Names](https://cloud.google.com/apis/design/resource_names)
350-
// for more details on GCP resource names.
353+
// for more details on Google Cloud Platform resource names.
351354
string name = 1 [
352355
(google.api.field_behavior) = REQUIRED,
353356
(google.api.resource_reference) = {
@@ -364,7 +367,7 @@ message ListAzureClustersRequest {
364367
// Location names are formatted as `projects/<project-id>/locations/<region>`.
365368
//
366369
// See [Resource Names](https://cloud.google.com/apis/design/resource_names)
367-
// for more details on GCP resource names.
370+
// for more details on Google Cloud Platform resource names.
368371
string parent = 1 [
369372
(google.api.field_behavior) = REQUIRED,
370373
(google.api.resource_reference) = {
@@ -390,7 +393,7 @@ message ListAzureClustersRequest {
390393
// Response message for `AzureClusters.ListAzureClusters` method.
391394
message ListAzureClustersResponse {
392395
// A list of [AzureCluster][google.cloud.gkemulticloud.v1.AzureCluster]
393-
// resources in the specified GCP project and region region.
396+
// resources in the specified Google Cloud Platform project and region region.
394397
repeated AzureCluster azure_clusters = 1;
395398

396399
// Token to retrieve the next page of results, or empty if there are no more
@@ -407,7 +410,7 @@ message DeleteAzureClusterRequest {
407410
// `projects/<project-id>/locations/<region>/azureClusters/<cluster-id>`.
408411
//
409412
// See [Resource Names](https://cloud.google.com/apis/design/resource_names)
410-
// for more details on GCP resource names.
413+
// for more details on Google Cloud Platform resource names.
411414
string name = 1 [
412415
(google.api.field_behavior) = REQUIRED,
413416
(google.api.resource_reference) = {
@@ -679,7 +682,7 @@ message ListAzureClientsRequest {
679682
// Location names are formatted as `projects/<project-id>/locations/<region>`.
680683
//
681684
// See [Resource Names](https://cloud.google.com/apis/design/resource_names)
682-
// for more details on GCP resource names.
685+
// for more details on Google Cloud Platform resource names.
683686
string parent = 1 [
684687
(google.api.field_behavior) = REQUIRED,
685688
(google.api.resource_reference) = {

‎google/cloud/gkemulticloud/v1/gkemulticloud_v1.yaml‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -68,3 +68,10 @@ authentication:
6868
6969
publishing:
7070
organization: CLIENT_LIBRARY_ORGANIZATION_UNSPECIFIED
71+
new_issue_uri: ''
72+
documentation_uri: ''
73+
api_short_name: ''
74+
github_label: ''
75+
doc_tag_prefix: ''
76+
codeowner_github_teams:
77+
library_settings:

0 commit comments

Comments
 (0)