feat: Add API fields related to GKE Pods and Network Policies

Google APIs · copybara-github · commit edfe7983b9d9 · 2026-02-23T01:04:53.000-08:00
PiperOrigin-RevId: 873925482
diff --git a/google/cloud/networkmanagement/v1beta1/networkmanagement_v1beta1.yaml b/google/cloud/networkmanagement/v1beta1/networkmanagement_v1beta1.yaml
@@ -23,7 +23,15 @@ documentation:
     description: Gets information about a location.
 
   - selector: google.cloud.location.Locations.ListLocations
-    description: Lists information about the supported locations for this service.
+    description: |-
+      Lists information about the supported locations for this service.
+      This method can be called in two ways:
+
+      *   **List all public locations:** Use the path `GET /v1/locations`.
+      *   **List project-visible locations:** Use the path
+      `GET /v1/projects/{project_id}/locations`. This may include public
+      locations as well as private or other locations specifically visible
+      to the project.
 
   - selector: google.iam.v1.IAMPolicy.GetIamPolicy
     description: |-
diff --git a/google/cloud/networkmanagement/v1beta1/trace.proto b/google/cloud/networkmanagement/v1beta1/trace.proto
@@ -180,6 +180,9 @@ message Step {
     // Forwarding state: arriving at a VPC connector.
     ARRIVE_AT_VPC_CONNECTOR = 24;
 
+    // Forwarding state: arriving at a GKE Pod.
+    ARRIVE_AT_GKE_POD = 44;
+
     // Forwarding state: for packets originating from a serverless endpoint
     // forwarded through Direct VPC egress.
     DIRECT_VPC_EGRESS_CONNECTION = 35;
@@ -188,6 +191,10 @@ message Step {
     // forwarded through public (external) connectivity.
     SERVERLESS_EXTERNAL_CONNECTION = 36;
 
+    // Forwarding state: Layer 7 packet inspection by the firewall endpoint
+    // based on the configured security profile group.
+    NGFW_PACKET_INSPECTION = 47;
+
     // Transition state: packet header translated. The `nat` field is populated
     // with the translation information.
     NAT = 14;
@@ -196,6 +203,20 @@ message Step {
     // `ip_masquerading_skipped` field is populated with the reason.
     SKIP_GKE_POD_IP_MASQUERADING = 40;
 
+    // Transition state: GKE Ingress Network Policy is skipped. The
+    // `gke_network_policy_skipped` field is populated with the reason.
+    SKIP_GKE_INGRESS_NETWORK_POLICY = 41;
+
+    // Transition state: GKE Egress Network Policy is skipped. The
+    // `gke_network_policy_skipped` field is populated with the reason.
+    SKIP_GKE_EGRESS_NETWORK_POLICY = 42;
+
+    // Config checking state: verify ingress GKE network policy.
+    APPLY_INGRESS_GKE_NETWORK_POLICY = 45;
+
+    // Config checking state: verify egress GKE network policy.
+    APPLY_EGRESS_GKE_NETWORK_POLICY = 46;
+
     // Transition state: original connection is terminated and a new proxied
     // connection is initiated.
     PROXY_CONNECTION = 15;
@@ -307,6 +328,13 @@ message Step {
     // skipped.
     IpMasqueradingSkippedInfo ip_masquerading_skipped = 38;
 
+    // Display information of a GKE Network Policy.
+    GkeNetworkPolicyInfo gke_network_policy = 39;
+
+    // Display information of the reason why GKE Network Policy evaluation was
+    // skipped.
+    GkeNetworkPolicySkippedInfo gke_network_policy_skipped = 40;
+
     // Display information of a Cloud SQL instance.
     CloudSQLInstanceInfo cloud_sql_instance = 19;
 
@@ -340,6 +368,9 @@ message Step {
     // Display information of a Serverless network endpoint group backend. Used
     // only for return traces.
     ServerlessNegInfo serverless_neg = 29;
+
+    // Display information of a layer 7 packet inspection by the firewall.
+    NgfwPacketInspectionInfo ngfw_packet_inspection = 42;
   }
 }
 
@@ -1827,6 +1858,13 @@ message DropInfo {
     // Packet is dropped because no matching route was found in the hybrid
     // subnet.
     HYBRID_SUBNET_NO_ROUTE = 106;
+
+    // Packet is dropped by GKE Network Policy.
+    GKE_NETWORK_POLICY = 108;
+
+    // Packet is dropped because there is no valid matching route from the
+    // network of the Google-managed service to the destination.
+    NO_VALID_ROUTE_FROM_GOOGLE_MANAGED_NETWORK_TO_DESTINATION = 110;
   }
 
   // Cause that the packet is dropped.
@@ -1931,6 +1969,57 @@ message IpMasqueradingSkippedInfo {
   string non_masquerade_range = 2;
 }
 
+// For display only. Metadata associated with a GKE Network Policy.
+message GkeNetworkPolicyInfo {
+  // The name of the Network Policy.
+  string display_name = 1;
+
+  // The URI of the Network Policy.
+  // Format for a Network Policy in a zonal cluster:
+  // `projects/<project_id>/zones/<zone>/clusters/<cluster>/k8s/namespaces/<namespace>/networking.k8s.io/networkpolicies/<networkpolicy>`
+  // Format for a Network Policy in a regional cluster:
+  // `projects/<project_id>/locations/<location>/clusters/<cluster>/k8s/namespaces/<namespace>/networking.k8s.io/networkpolicies/<networkpolicy>`
+  string uri = 2;
+
+  // Possible values: INGRESS, EGRESS
+  string direction = 3;
+
+  // Possible values: ALLOW, DENY
+  string action = 4;
+}
+
+// For display only. Contains information about why GKE Network Policy
+// evaluation was skipped.
+message GkeNetworkPolicySkippedInfo {
+  enum Reason {
+    // Unused default value.
+    REASON_UNSPECIFIED = 0;
+
+    // Network Policy is disabled on the cluster.
+    NETWORK_POLICY_DISABLED = 1;
+
+    // Ingress traffic to a Pod from a source on the same Node is always
+    // allowed.
+    INGRESS_SOURCE_ON_SAME_NODE = 2;
+
+    // Egress traffic from a Pod that uses the Node's network namespace is not
+    // subject to Network Policy.
+    EGRESS_FROM_NODE_NETWORK_NAMESPACE_POD = 3;
+
+    // Network Policy is not applied to response traffic. This is because GKE
+    // Network Policy evaluation is stateful in both GKE Dataplane V2 (eBPF) and
+    // legacy (iptables) implementations.
+    NETWORK_POLICY_NOT_APPLIED_TO_RESPONSE_TRAFFIC = 4;
+
+    // Network Policy evaluation is currently not supported for clusters with
+    // FQDN Network Policies enabled.
+    NETWORK_POLICY_ANALYSIS_UNSUPPORTED = 100;
+  }
+
+  // Reason why Network Policy evaluation was skipped.
+  Reason reason = 1;
+}
+
 // For display only. Metadata associated with a Cloud SQL instance.
 message CloudSQLInstanceInfo {
   // Name of a Cloud SQL instance.
@@ -2332,3 +2421,11 @@ message ServerlessNegInfo {
   // URI of the serverless network endpoint group.
   string neg_uri = 1;
 }
+
+// For display only. Metadata associated with a layer 7 packet inspection by the
+// firewall.
+message NgfwPacketInspectionInfo {
+  // URI of the security profile group associated with this firewall packet
+  // inspection.
+  string security_profile_group_uri = 1;
+}
