googleapis
Version:
Google APIs Client Library for Node.js
724 lines • 664 kB
TypeScript
import { OAuth2Client, JWT, Compute, UserRefreshClient, BaseExternalAccountClient, GaxiosResponseWithHTTP2, GoogleConfigurable, MethodOptions, StreamMethodOptions, GlobalOptions, GoogleAuth, BodyResponseCallback, APIRequestContext } from 'googleapis-common';
import { Readable } from 'stream';
export declare namespace networkservices_v1 {
export interface Options extends GlobalOptions {
version: 'v1';
}
interface StandardParameters {
/**
* Auth client or API Key for the request
*/
auth?: string | OAuth2Client | JWT | Compute | UserRefreshClient | BaseExternalAccountClient | GoogleAuth;
/**
* V1 error format.
*/
'$.xgafv'?: string;
/**
* OAuth access token.
*/
access_token?: string;
/**
* Data format for response.
*/
alt?: string;
/**
* JSONP
*/
callback?: string;
/**
* Selector specifying which fields to include in a partial response.
*/
fields?: string;
/**
* API key. Your API key identifies your project and provides you with API access, quota, and reports. Required unless you provide an OAuth 2.0 token.
*/
key?: string;
/**
* OAuth 2.0 token for the current user.
*/
oauth_token?: string;
/**
* Returns response with indentations and line breaks.
*/
prettyPrint?: boolean;
/**
* Available to use for quota purposes for server-side applications. Can be any arbitrary string assigned to a user, but should not exceed 40 characters.
*/
quotaUser?: string;
/**
* Legacy upload protocol for media (e.g. "media", "multipart").
*/
uploadType?: string;
/**
* Upload protocol for media (e.g. "raw", "multipart").
*/
upload_protocol?: string;
}
/**
* Network Services API
*
*
*
* @example
* ```js
* const {google} = require('googleapis');
* const networkservices = google.networkservices('v1');
* ```
*/
export class Networkservices {
context: APIRequestContext;
projects: Resource$Projects;
constructor(options: GlobalOptions, google?: GoogleConfigurable);
}
/**
* AgentGateway represents the agent gateway resource.
*/
export interface Schema$AgentGateway {
/**
* Output only. Field for populated AgentGateway card.
*/
agentGatewayCard?: Schema$AgentGatewayAgentGatewayOutputCard;
/**
* Output only. The timestamp when the resource was created.
*/
createTime?: string | null;
/**
* Optional. A free-text description of the resource. Max length 1024 characters.
*/
description?: string | null;
/**
* Optional. Etag of the resource. If this is provided, it must match the server's etag. If the provided etag does not match the server's etag, the request will fail with a 409 ABORTED error.
*/
etag?: string | null;
/**
* Optional. Proxy is orchestrated and managed by GoogleCloud in a tenant project.
*/
googleManaged?: Schema$AgentGatewayGoogleManaged;
/**
* Optional. Set of label tags associated with the AgentGateway resource.
*/
labels?: {
[key: string]: string;
} | null;
/**
* Identifier. Name of the AgentGateway resource. It matches pattern `projects/x/locations/x/agentGateways/`.
*/
name?: string | null;
/**
* Optional. Network configuration for the AgentGateway.
*/
networkConfig?: Schema$AgentGatewayNetworkConfig;
/**
* Optional. Deprecated.
*/
protocols?: string[] | null;
/**
* Optional. A list of Agent registries containing the agents, MCP servers and tools governed by the Agent Gateway. Note: Currently limited to project-scoped registries Must be of format `//agentregistry.googleapis.com/projects/{project\}/locations/{location\}/`
*/
registries?: string[] | null;
/**
* Optional. Attach to existing Application Load Balancers or Secure Web Proxies.
*/
selfManaged?: Schema$AgentGatewaySelfManaged;
/**
* Output only. The timestamp when the resource was updated.
*/
updateTime?: string | null;
}
/**
* AgentGatewayOutputCard contains informational output-only fields
*/
export interface Schema$AgentGatewayAgentGatewayOutputCard {
/**
* Output only. mTLS Endpoint associated with this AgentGateway
*/
mtlsEndpoint?: string | null;
/**
* Output only. Root Certificates for Agents to validate this AgentGateway
*/
rootCertificates?: string[] | null;
/**
* Output only. Service Account used by Service Extensions to operate.
*/
serviceExtensionsServiceAccount?: string | null;
}
/**
* Configuration for Google Managed deployment mode. Proxy is orchestrated and managed by GoogleCloud in a tenant project.
*/
export interface Schema$AgentGatewayGoogleManaged {
/**
* Optional. Operating Mode of Agent Gateway.
*/
governedAccessPath?: string | null;
}
/**
* NetworkConfig contains network configurations for the AgentGateway.
*/
export interface Schema$AgentGatewayNetworkConfig {
/**
* Optional. Optional DNS peering configuration for connectivity to your private VPC network.
*/
dnsPeeringConfig?: Schema$AgentGatewayNetworkConfigDnsPeeringConfig;
/**
* Optional. Optional PSC-Interface network attachment for connectivity to your private VPCs network.
*/
egress?: Schema$AgentGatewayNetworkConfigEgress;
}
/**
* DNS peering config for the user VPC network.
*/
export interface Schema$AgentGatewayNetworkConfigDnsPeeringConfig {
/**
* Required. Domain names for which DNS queries should be forwarded to the target network.
*/
domains?: string[] | null;
/**
* Required. Target network in 'target project' to which DNS queries should be forwarded to. Must be in format of `projects/{project\}/global/networks/{network\}`.
*/
targetNetwork?: string | null;
/**
* Required. Target project ID to which DNS queries should be forwarded to. This can be the same project that contains the AgentGateway or a different project.
*/
targetProject?: string | null;
}
/**
* Configuration for Egress
*/
export interface Schema$AgentGatewayNetworkConfigEgress {
/**
* Optional. The URI of the Network Attachment resource.
*/
networkAttachment?: string | null;
}
/**
* Configuration for Self Managed deployment mode. Attach to existing Application Load Balancers or Secure Web Proxies.
*/
export interface Schema$AgentGatewaySelfManaged {
/**
* Optional. A supported Google Cloud networking proxy in the Project and Location
*/
resourceUri?: string | null;
/**
* Optional. List of supported Google Cloud networking proxies in the Project and Location. resource_uris is mutually exclusive with resource_uri.
*/
resourceUris?: string[] | null;
}
/**
* Specifies the audit configuration for a service. The configuration determines which permission types are logged, and what identities, if any, are exempted from logging. An AuditConfig must have one or more AuditLogConfigs. If there are AuditConfigs for both `allServices` and a specific service, the union of the two AuditConfigs is used for that service: the log_types specified in each AuditConfig are enabled, and the exempted_members in each AuditLogConfig are exempted. Example Policy with multiple AuditConfigs: { "audit_configs": [ { "service": "allServices", "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] \}, { "log_type": "DATA_WRITE" \}, { "log_type": "ADMIN_READ" \} ] \}, { "service": "sampleservice.googleapis.com", "audit_log_configs": [ { "log_type": "DATA_READ" \}, { "log_type": "DATA_WRITE", "exempted_members": [ "user:aliya@example.com" ] \} ] \} ] \} For sampleservice, this policy enables DATA_READ, DATA_WRITE and ADMIN_READ logging. It also exempts `jose@example.com` from DATA_READ logging, and `aliya@example.com` from DATA_WRITE logging.
*/
export interface Schema$AuditConfig {
/**
* The configuration for logging of each type of permission.
*/
auditLogConfigs?: Schema$AuditLogConfig[];
/**
* Specifies a service that will be enabled for audit logging. For example, `storage.googleapis.com`, `cloudsql.googleapis.com`. `allServices` is a special value that covers all services.
*/
service?: string | null;
}
/**
* Provides the configuration for logging a type of permissions. Example: { "audit_log_configs": [ { "log_type": "DATA_READ", "exempted_members": [ "user:jose@example.com" ] \}, { "log_type": "DATA_WRITE" \} ] \} This enables 'DATA_READ' and 'DATA_WRITE' logging, while exempting jose@example.com from DATA_READ logging.
*/
export interface Schema$AuditLogConfig {
/**
* Specifies the identities that do not cause logging for this type of permission. Follows the same format of Binding.members.
*/
exemptedMembers?: string[] | null;
/**
* The log type that this config enables.
*/
logType?: string | null;
}
/**
* `AuthzExtension` is a resource that allows traffic forwarding to a callout backend service to make an authorization decision.
*/
export interface Schema$AuthzExtension {
/**
* Optional. The `:authority` header in the gRPC request sent from Envoy to the extension service. It is required when the `service` field points to a backend service.
*/
authority?: string | null;
/**
* Output only. The timestamp when the resource was created.
*/
createTime?: string | null;
/**
* Optional. A human-readable description of the resource.
*/
description?: string | null;
/**
* Optional. Determines how the proxy behaves if the call to the extension fails or times out. When set to `TRUE`, request or response processing continues without error. Any subsequent extensions in the extension chain are also executed. When set to `FALSE` or the default setting of `FALSE` is used, one of the following happens: * If response headers have not been delivered to the downstream client, a generic 500 error is returned to the client. The error response can be tailored by configuring a custom error response in the load balancer. * If response headers have been delivered, then the HTTP stream to the downstream client is reset.
*/
failOpen?: boolean | null;
/**
* Optional. List of the Envoy attributes to forward to the extension server. The attributes provided here are included as part of the `ProcessingRequest.attributes` field (of type `map`), where the keys are the attribute names. Refer to the [documentation](https://cloud.google.com/service-extensions/docs/cel-matcher-language-reference#attributes) for the names of attributes that can be forwarded. If omitted, no attributes are sent. Each element is a string indicating the attribute name.
*/
forwardAttributes?: string[] | null;
/**
* Optional. List of the HTTP headers to forward to the extension (from the client). If omitted, all headers are sent. Each element is a string indicating the header name.
*/
forwardHeaders?: string[] | null;
/**
* Optional. Set of labels associated with the `AuthzExtension` resource. The format must comply with [the requirements for labels](/compute/docs/labeling-resources#requirements) for Google Cloud resources.
*/
labels?: {
[key: string]: string;
} | null;
/**
* Optional. All backend services and forwarding rules referenced by this extension must share the same load balancing scheme. The supported values are `INTERNAL_MANAGED` and `EXTERNAL_MANAGED`. You can omit this field for `AuthzExtensions` resources that don't reference a backend service. For more information, see [Backend services overview](https://cloud.google.com/load-balancing/docs/backend-service).
*/
loadBalancingScheme?: string | null;
/**
* Optional. The metadata provided here is included as part of the `metadata_context` (of type `google.protobuf.Struct`) in the `ProcessingRequest` message sent to the extension server. The metadata is available under the namespace `com.google.authz_extension.`. The following variables are supported in the metadata Struct: `{forwarding_rule_id\}` - substituted with the forwarding rule's fully qualified resource name.
*/
metadata?: {
[key: string]: any;
} | null;
/**
* Required. Identifier. Name of the `AuthzExtension` resource in the following format: `projects/{project\}/locations/{location\}/authzExtensions/{authz_extension\}`.
*/
name?: string | null;
/**
* Required. The reference to the service that runs the extension. To configure a callout extension: For global AuthzExtension, `service` must be a fully-qualified reference to a [backend service](https://cloud.google.com/compute/docs/reference/rest/v1/backendServices) in the format: `https://www.googleapis.com/compute/v1/projects/{project\}/global/backendServices/{backendService\}`. For regional AuthzExtension, `service` must be a fully-qualified reference to one of the following: * a [backend service](https://cloud.google.com/compute/docs/reference/rest/v1/backendServices) in the format: `https://www.googleapis.com/compute/v1/projects/{project\}/regions/{region\}/backendServices/{backendService\}`. * a fully qualified domain name that can be resolved by the Google Cloud DNS. * `iap.googleapis.com` and it can only be referenced by an AuthzPolicy with the policyProfile set to REQUEST_AUTHZ. * `modelarmor..rep.googleapis.com` and it can only be referenced by an AuthzPolicy with the policyProfile set to CONTENT_AUTHZ.
*/
service?: string | null;
/**
* Required. Specifies the timeout for each individual message on the stream. The timeout must be between 10-10000 milliseconds.
*/
timeout?: string | null;
/**
* Output only. The timestamp when the resource was updated.
*/
updateTime?: string | null;
/**
* Optional. The format of communication supported by the callout extension. This field is supported only for regional `AuthzExtension` resources. If not specified, the default value `EXT_PROC_GRPC` is used. Global `AuthzExtension` resources use the `EXT_PROC_GRPC` wire format.
*/
wireFormat?: string | null;
}
/**
* Associates `members`, or principals, with a `role`.
*/
export interface Schema$Binding {
/**
* The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the principals in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
*/
condition?: Schema$Expr;
/**
* Specifies the principals requesting access for a Google Cloud resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. Does not include identities that come from external identity providers (IdPs) through identity federation. * `user:{emailid\}`: An email address that represents a specific Google account. For example, `alice@example.com` . * `serviceAccount:{emailid\}`: An email address that represents a Google service account. For example, `my-other-app@appspot.gserviceaccount.com`. * `serviceAccount:{projectid\}.svc.id.goog[{namespace\}/{kubernetes-sa\}]`: An identifier for a [Kubernetes service account](https://cloud.google.com/kubernetes-engine/docs/how-to/kubernetes-service-accounts). For example, `my-project.svc.id.goog[my-namespace/my-kubernetes-sa]`. * `group:{emailid\}`: An email address that represents a Google group. For example, `admins@example.com`. * `domain:{domain\}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`. * `principal://iam.googleapis.com/locations/global/workforcePools/{pool_id\}/subject/{subject_attribute_value\}`: A single identity in a workforce identity pool. * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id\}/group/{group_id\}`: All workforce identities in a group. * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id\}/attribute.{attribute_name\}/{attribute_value\}`: All workforce identities with a specific attribute value. * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id\}/x`: All identities in a workforce identity pool. * `principal://iam.googleapis.com/projects/{project_number\}/locations/global/workloadIdentityPools/{pool_id\}/subject/{subject_attribute_value\}`: A single identity in a workload identity pool. * `principalSet://iam.googleapis.com/projects/{project_number\}/locations/global/workloadIdentityPools/{pool_id\}/group/{group_id\}`: A workload identity pool group. * `principalSet://iam.googleapis.com/projects/{project_number\}/locations/global/workloadIdentityPools/{pool_id\}/attribute.{attribute_name\}/{attribute_value\}`: All identities in a workload identity pool with a certain attribute. * `principalSet://iam.googleapis.com/projects/{project_number\}/locations/global/workloadIdentityPools/{pool_id\}/x`: All identities in a workload identity pool. * `deleted:user:{emailid\}?uid={uniqueid\}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `alice@example.com?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid\}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid\}?uid={uniqueid\}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `my-other-app@appspot.gserviceaccount.com?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid\}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid\}?uid={uniqueid\}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `admins@example.com?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid\}` and the recovered group retains the role in the binding. * `deleted:principal://iam.googleapis.com/locations/global/workforcePools/{pool_id\}/subject/{subject_attribute_value\}`: Deleted single identity in a workforce identity pool. For example, `deleted:principal://iam.googleapis.com/locations/global/workforcePools/my-pool-id/subject/my-subject-attribute-value`.
*/
members?: string[] | null;
/**
* Role that is assigned to the list of `members`, or principals. For example, `roles/viewer`, `roles/editor`, or `roles/owner`. For an overview of the IAM roles and permissions, see the [IAM documentation](https://cloud.google.com/iam/docs/roles-overview). For a list of the available pre-defined roles, see [here](https://cloud.google.com/iam/docs/understanding-roles).
*/
role?: string | null;
}
/**
* The request message for Operations.CancelOperation.
*/
export interface Schema$CancelOperationRequest {
}
/**
* A generic empty message that you can re-use to avoid defining duplicated empty messages in your APIs. A typical example is to use it as the request or the response type of an API method. For instance: service Foo { rpc Bar(google.protobuf.Empty) returns (google.protobuf.Empty); \}
*/
export interface Schema$Empty {
}
/**
* A definition of a matcher that selects endpoints to which the policies should be applied.
*/
export interface Schema$EndpointMatcher {
/**
* The matcher is based on node metadata presented by xDS clients.
*/
metadataLabelMatcher?: Schema$EndpointMatcherMetadataLabelMatcher;
}
/**
* The matcher that is based on node metadata presented by xDS clients.
*/
export interface Schema$EndpointMatcherMetadataLabelMatcher {
/**
* Specifies how matching should be done. Supported values are: MATCH_ANY: At least one of the Labels specified in the matcher should match the metadata presented by xDS client. MATCH_ALL: The metadata presented by the xDS client should contain all of the labels specified here. The selection is determined based on the best match. For example, suppose there are three EndpointPolicy resources P1, P2 and P3 and if P1 has a the matcher as MATCH_ANY , P2 has MATCH_ALL , and P3 has MATCH_ALL . If a client with label connects, the config from P1 will be selected. If a client with label connects, the config from P2 will be selected. If a client with label connects, the config from P3 will be selected. If there is more than one best match, (for example, if a config P4 with selector exists and if a client with label connects), pick up the one with older creation time.
*/
metadataLabelMatchCriteria?: string | null;
/**
* The list of label value pairs that must match labels in the provided metadata based on filterMatchCriteria This list can have at most 64 entries. The list can be empty if the match criteria is MATCH_ANY, to specify a wildcard match (i.e this matches any client).
*/
metadataLabels?: Schema$EndpointMatcherMetadataLabelMatcherMetadataLabels[];
}
/**
* Defines a name-pair value for a single label.
*/
export interface Schema$EndpointMatcherMetadataLabelMatcherMetadataLabels {
/**
* Required. Label name presented as key in xDS Node Metadata.
*/
labelName?: string | null;
/**
* Required. Label value presented as value corresponding to the above key, in xDS Node Metadata.
*/
labelValue?: string | null;
}
/**
* EndpointPolicy is a resource that helps apply desired configuration on the endpoints that match specific criteria. For example, this resource can be used to apply "authentication config" an all endpoints that serve on port 8080.
*/
export interface Schema$EndpointPolicy {
/**
* Optional. This field specifies the URL of AuthorizationPolicy resource that applies authorization policies to the inbound traffic at the matched endpoints. Refer to Authorization. If this field is not specified, authorization is disabled(no authz checks) for this endpoint.
*/
authorizationPolicy?: string | null;
/**
* Optional. Deprecated: This field is not used and is a no-op. A URL referring to a ClientTlsPolicy resource. ClientTlsPolicy can be set to specify the authentication for traffic from the proxy to the actual endpoints. More specifically, it is applied to the outgoing traffic from the proxy to the endpoint. This is typically used for sidecar model where the proxy identifies itself as endpoint to the control plane, with the connection between sidecar and endpoint requiring authentication. If this field is not set, authentication is disabled(open). Applicable only when EndpointPolicyType is SIDECAR_PROXY.
*/
clientTlsPolicy?: string | null;
/**
* Output only. The timestamp when the resource was created.
*/
createTime?: string | null;
/**
* Optional. A free-text description of the resource. Max length 1024 characters.
*/
description?: string | null;
/**
* Required. A matcher that selects endpoints to which the policies should be applied.
*/
endpointMatcher?: Schema$EndpointMatcher;
/**
* Optional. Set of label tags associated with the EndpointPolicy resource.
*/
labels?: {
[key: string]: string;
} | null;
/**
* Identifier. Name of the EndpointPolicy resource. It matches pattern `projects/{project\}/locations/x/endpointPolicies/{endpoint_policy\}`.
*/
name?: string | null;
/**
* Optional. A URL referring to ServerTlsPolicy resource. ServerTlsPolicy is used to determine the authentication policy to be applied to terminate the inbound traffic at the identified backends. If this field is not set, authentication is disabled(open) for this endpoint.
*/
serverTlsPolicy?: string | null;
/**
* Optional. Port selector for the (matched) endpoints. If no port selector is provided, the matched config is applied to all ports.
*/
trafficPortSelector?: Schema$TrafficPortSelector;
/**
* Required. The type of endpoint policy. This is primarily used to validate the configuration.
*/
type?: string | null;
/**
* Output only. The timestamp when the resource was updated.
*/
updateTime?: string | null;
}
/**
* Represents a textual expression in the Common Expression Language (CEL) syntax. CEL is a C-like expression language. The syntax and semantics of CEL are documented at https://github.com/google/cel-spec. Example (Comparison): title: "Summary size limit" description: "Determines if a summary is less than 100 chars" expression: "document.summary.size() < 100" Example (Equality): title: "Requestor is owner" description: "Determines if requestor is the document owner" expression: "document.owner == request.auth.claims.email" Example (Logic): title: "Public documents" description: "Determine whether the document should be publicly visible" expression: "document.type != 'private' && document.type != 'internal'" Example (Data Manipulation): title: "Notification string" description: "Create a notification string with a timestamp." expression: "'New message received at ' + string(document.create_time)" The exact variables and functions that may be referenced within an expression are determined by the service that evaluates it. See the service documentation for additional information.
*/
export interface Schema$Expr {
/**
* Optional. Description of the expression. This is a longer text which describes the expression, e.g. when hovered over it in a UI.
*/
description?: string | null;
/**
* Textual representation of an expression in Common Expression Language syntax.
*/
expression?: string | null;
/**
* Optional. String indicating the location of the expression for error reporting, e.g. a file name and a position in the file.
*/
location?: string | null;
/**
* Optional. Title for the expression, i.e. a short string describing its purpose. This can be used e.g. in UIs which allow to enter the expression.
*/
title?: string | null;
}
/**
* A single extension chain wrapper that contains the match conditions and extensions to execute.
*/
export interface Schema$ExtensionChain {
/**
* Required. A set of extensions to execute for the matching request. At least one extension is required. Up to 3 extensions can be defined for each extension chain for `LbTrafficExtension` resource. `LbRouteExtension` and `LbEdgeExtension` chains are limited to 1 extension per extension chain.
*/
extensions?: Schema$ExtensionChainExtension[];
/**
* Required. Conditions under which this chain is invoked for a request.
*/
matchCondition?: Schema$ExtensionChainMatchCondition;
/**
* Required. The name for this extension chain. The name is logged as part of the HTTP request logs. The name must conform with RFC-1034, is restricted to lower-cased letters, numbers and hyphens, and can have a maximum length of 63 characters. Additionally, the first character must be a letter and the last a letter or a number.
*/
name?: string | null;
}
/**
* A single extension in the chain to execute for the matching request.
*/
export interface Schema$ExtensionChainExtension {
/**
* Optional. The `:authority` header in the gRPC request sent from Envoy to the extension service. Required for Callout extensions. This field is not supported for plugin extensions. Setting it results in a validation error.
*/
authority?: string | null;
/**
* Optional. Determines how the proxy behaves if the call to the extension fails or times out. When set to `TRUE`, request or response processing continues without error. Any subsequent extensions in the extension chain are also executed. When set to `FALSE` or the default setting of `FALSE` is used, one of the following happens: * If response headers have not been delivered to the downstream client, a generic 500 error is returned to the client. The error response can be tailored by configuring a custom error response in the load balancer. * If response headers have been delivered, then the HTTP stream to the downstream client is reset.
*/
failOpen?: boolean | null;
/**
* Optional. List of the Envoy attributes to forward to the extension server. The attributes provided here are included as part of the `ProcessingRequest.attributes` field (of type `map`), where the keys are the attribute names. Refer to the [documentation](https://cloud.google.com/service-extensions/docs/cel-matcher-language-reference#attributes) for the names of attributes that can be forwarded. If omitted, no attributes are sent. Each element is a string indicating the attribute name.
*/
forwardAttributes?: string[] | null;
/**
* Optional. List of the HTTP headers to forward to the extension (from the client or backend). If omitted, all headers are sent. Each element is a string indicating the header name.
*/
forwardHeaders?: string[] | null;
/**
* Optional. The metadata provided here is included as part of the `metadata_context` (of type `google.protobuf.Struct`) in the `ProcessingRequest` message sent to the extension server. For `AuthzExtension` resources, the metadata is available under the namespace `com.google.authz_extension.`. For other types of extensions, the metadata is available under the namespace `com.google....`. For example: `com.google.lb_traffic_extension.lbtrafficextension1.chain1.ext1`. The following variables are supported in the metadata: `{forwarding_rule_id\}` - substituted with the forwarding rule's fully qualified resource name. This field must not be set for plugin extensions. Setting it results in a validation error. You can set metadata at either the resource level or the extension level. The extension level metadata is recommended because you can pass a different set of metadata through each extension to the backend. This field is subject to following limitations: * The total size of the metadata must be less than 1KiB. * The total number of keys in the metadata must be less than 16. * The length of each key must be less than 64 characters. * The length of each value must be less than 1024 characters. * All values must be strings.
*/
metadata?: {
[key: string]: any;
} | null;
/**
* Optional. The name for this extension. The name is logged as part of the HTTP request logs. The name must conform with RFC-1034, is restricted to lower-cased letters, numbers and hyphens, and can have a maximum length of 63 characters. Additionally, the first character must be a letter and the last a letter or a number. This field is required except for AuthzExtension.
*/
name?: string | null;
/**
* Optional. When set to `true`, the calls to the extension backend are performed asynchronously, without pausing the processing of the ongoing request. In this mode, only `STREAMED` (default) body processing is supported. Responses, if any, are ignored. Supported by regional `LbTrafficExtension` and `LbRouteExtension` resources.
*/
observabilityMode?: boolean | null;
/**
* Optional. Configures the send mode for request body processing. The field can only be set if `supported_events` includes `REQUEST_BODY`. If `supported_events` includes `REQUEST_BODY`, but `request_body_send_mode` is unset, the default value `STREAMED` is used. When this field is set to `FULL_DUPLEX_STREAMED`, `supported_events` must include both `REQUEST_BODY` and `REQUEST_TRAILERS`. This field can be set only for `LbTrafficExtension` and `LbRouteExtension` resources, and only when the `service` field of the extension points to a `BackendService`. Only `FULL_DUPLEX_STREAMED` mode is supported for `LbRouteExtension` resources.
*/
requestBodySendMode?: string | null;
/**
* Optional. Configures the send mode for response processing. If unspecified, the default value `STREAMED` is used. The field can only be set if `supported_events` includes `RESPONSE_BODY`. If `supported_events` includes `RESPONSE_BODY`, but `response_body_send_mode` is unset, the default value `STREAMED` is used. When this field is set to `FULL_DUPLEX_STREAMED`, `supported_events` must include both `RESPONSE_BODY` and `RESPONSE_TRAILERS`. This field can be set only for `LbTrafficExtension` resources, and only when the `service` field of the extension points to a `BackendService`.
*/
responseBodySendMode?: string | null;
/**
* Required. The reference to the service that runs the extension. To configure a callout extension, `service` must be a fully-qualified reference to a [backend service](https://cloud.google.com/compute/docs/reference/rest/v1/backendServices) in the format: `https://www.googleapis.com/compute/v1/projects/{project\}/regions/{region\}/backendServices/{backendService\}` or `https://www.googleapis.com/compute/v1/projects/{project\}/global/backendServices/{backendService\}`. To configure a plugin extension, `service` must be a reference to a [`WasmPlugin` resource](https://cloud.google.com/service-extensions/docs/reference/rest/v1beta1/projects.locations.wasmPlugins) in the format: `projects/{project\}/locations/{location\}/wasmPlugins/{plugin\}` or `//networkservices.googleapis.com/projects/{project\}/locations/{location\}/wasmPlugins/{wasmPlugin\}`. Plugin extensions are currently supported for the `LbTrafficExtension`, the `LbRouteExtension`, and the `LbEdgeExtension` resources.
*/
service?: string | null;
/**
* Optional. A set of events during request or response processing for which this extension is called. For the `LbTrafficExtension` resource, this field is required. For the `LbRouteExtension` resource, this field is optional. If unspecified, `REQUEST_HEADERS` event is assumed as supported. For the `LbEdgeExtension` resource, this field is required and must only contain `REQUEST_HEADERS` event. For the `AuthzExtension` resource, this field is optional. `REQUEST_HEADERS` is the only supported event. If unspecified, `REQUEST_HEADERS` event is assumed as supported.
*/
supportedEvents?: string[] | null;
/**
* Optional. Specifies the timeout for each individual message on the stream. The timeout must be between `10`-`10000` milliseconds. Required for callout extensions. This field is not supported for plugin extensions. Setting it results in a validation error.
*/
timeout?: string | null;
}
/**
* Conditions under which this chain is invoked for a request.
*/
export interface Schema$ExtensionChainMatchCondition {
/**
* Required. A Common Expression Language (CEL) expression that is used to match requests for which the extension chain is executed. For more information, see [CEL matcher language reference](https://cloud.google.com/service-extensions/docs/cel-matcher-language-reference).
*/
celExpression?: string | null;
}
/**
* Gateway represents the configuration for a proxy, typically a load balancer. It captures the ip:port over which the services are exposed by the proxy, along with any policy configurations. Routes have reference to to Gateways to dictate how requests should be routed by this Gateway.
*/
export interface Schema$Gateway {
/**
* Optional. Zero or one IPv4 or IPv6 address on which the Gateway will receive the traffic. When no address is provided, an IP from the subnetwork is allocated This field only applies to gateways of type 'SECURE_WEB_GATEWAY'. Gateways of type 'OPEN_MESH' listen on 0.0.0.0 for IPv4 and :: for IPv6.
*/
addresses?: string[] | null;
/**
* Optional. If true, the gateway will allow traffic from clients outside of the region where the gateway is located. This field is configurable only for gateways of type SECURE_WEB_GATEWAY.
*/
allowGlobalAccess?: boolean | null;
/**
* Optional. If true, the Gateway will listen on all ports. This is mutually exclusive with the `ports` field. This field only applies to gateways of type 'SECURE_WEB_GATEWAY'.
*/
allPorts?: boolean | null;
/**
* Optional. A fully-qualified Certificates URL reference. The proxy presents a Certificate (selected based on SNI) when establishing a TLS connection. This feature only applies to gateways of type 'SECURE_WEB_GATEWAY'.
*/
certificateUrls?: string[] | null;
/**
* Output only. The timestamp when the resource was created.
*/
createTime?: string | null;
/**
* Optional. A free-text description of the resource. Max length 1024 characters.
*/
description?: string | null;
/**
* Optional. Determines if envoy will insert internal debug headers into upstream requests. Other Envoy headers may still be injected. By default, envoy will not insert any debug headers.
*/
envoyHeaders?: string | null;
/**
* Optional. A fully-qualified GatewaySecurityPolicy URL reference. Defines how a server should apply security policy to inbound (VM to Proxy) initiated connections. For example: `projects/x/locations/x/gatewaySecurityPolicies/swg-policy`. This policy is specific to gateways of type 'SECURE_WEB_GATEWAY'.
*/
gatewaySecurityPolicy?: string | null;
/**
* Optional. The IP Version that will be used by this gateway. Valid options are IPV4 or IPV6. Default is IPV4.
*/
ipVersion?: string | null;
/**
* Optional. Set of label tags associated with the Gateway resource.
*/
labels?: {
[key: string]: string;
} | null;
/**
* Identifier. Name of the Gateway resource. It matches pattern `projects/x/locations/x/gateways/`.
*/
name?: string | null;
/**
* Optional. The relative resource name identifying the VPC network that is using this configuration. For example: `projects/x/global/networks/network-1`. Currently, this field is specific to gateways of type 'SECURE_WEB_GATEWAY'.
*/
network?: string | null;
/**
* Required. One or more port numbers (1-65535), on which the Gateway will receive traffic. The proxy binds to the specified ports. Gateways of type 'SECURE_WEB_GATEWAY' are limited to 5 ports. Gateways of type 'OPEN_MESH' listen on 0.0.0.0 for IPv4 and :: for IPv6 and support multiple ports.
*/
ports?: number[] | null;
/**
* Optional. The routing mode of the Gateway. This field is configurable only for gateways of type SECURE_WEB_GATEWAY. This field is required for gateways of type SECURE_WEB_GATEWAY.
*/
routingMode?: string | null;
/**
* Optional. Scope determines how configuration across multiple Gateway instances are merged. The configuration for multiple Gateway instances with the same scope will be merged as presented as a single configuration to the proxy/load balancer. Max length 64 characters. Scope should start with a letter and can only have letters, numbers, hyphens.
*/
scope?: string | null;
/**
* Output only. Server-defined URL of this resource
*/
selfLink?: string | null;
/**
* Optional. A fully-qualified ServerTLSPolicy URL reference. Specifies how TLS traffic is terminated. If empty, TLS termination is disabled.
*/
serverTlsPolicy?: string | null;
/**
* Optional. The relative resource name identifying the subnetwork in which this SWG is allocated. For example: `projects/x/regions/us-central1/subnetworks/network-1` Currently, this field is specific to gateways of type 'SECURE_WEB_GATEWAY".
*/
subnetwork?: string | null;
/**
* Immutable. The type of the customer managed gateway. This field is required. If unspecified, an error is returned.
*/
type?: string | null;
/**
* Output only. The timestamp when the resource was updated.
*/
updateTime?: string | null;
}
/**
* GatewayRouteView defines view-only resource for Routes to a Gateway
*/
export interface Schema$GatewayRouteView {
/**
* Output only. Identifier. Full path name of the GatewayRouteView resource. Format: projects/{project_number\}/locations/{location\}/gateways/{gateway\}/routeViews/{route_view\}
*/
name?: string | null;
/**
* Output only. The resource id for the route.
*/
routeId?: string | null;
/**
* Output only. Location where the route exists.
*/
routeLocation?: string | null;
/**
* Output only. Project number where the route exists.
*/
routeProjectNumber?: string | null;
/**
* Output only. Type of the route: HttpRoute,GrpcRoute,TcpRoute, or TlsRoute
*/
routeType?: string | null;
}
/**
* GrpcRoute is the resource defining how gRPC traffic routed by a Mesh or Gateway resource is routed.
*/
export interface Schema$GrpcRoute {
/**
* Output only. The timestamp when the resource was created.
*/
createTime?: string | null;
/**
* Optional. A free-text description of the resource. Max length 1024 characters.
*/
description?: string | null;
/**
* Optional. Gateways defines a list of gateways this GrpcRoute is attached to, as one of the routing rules to route the requests served by the gateway. Each gateway reference should match the pattern: `projects/x/locations/x/gateways/`
*/
gateways?: string[] | null;
/**
* Required. Service hostnames with an optional port for which this route describes traffic. Format: [:] Hostname is the fully qualified domain name of a network host. This matches the RFC 1123 definition of a hostname with 2 notable exceptions: - IPs are not allowed. - A hostname may be prefixed with a wildcard label (`*.`). The wildcard label must appear by itself as the first label. Hostname can be "precise" which is a domain name without the terminating dot of a network host (e.g. `foo.example.com`) or "wildcard", which is a domain name prefixed with a single wildcard label (e.g. `*.example.com`). Note that as per RFC1035 and RFC1123, a label must consist of lower case alphanumeric characters or '-', and must start and end with an alphanumeric character. No other punctuation is allowed. The routes associated with a Mesh or Gateway must have unique hostnames. If you attempt to attach multiple routes with conflicting hostnames, the configuration will be rejected. For example, while it is acceptable for routes for the hostnames `*.foo.bar.com` and `*.bar.com` to be associated with the same route, it is not possible to associate two routes both with `*.bar.com` or both with `bar.com`. If a port is specified, then gRPC clients must use the channel URI with the port to match this rule (i.e. "xds:///service:123"), otherwise they must supply the URI without a port (i.e. "xds:///service").
*/
hostnames?: string[] | null;
/**
* Optional. Set of label tags associated with the GrpcRoute resource.
*/
labels?: {
[key: string]: string;
} | null;
/**
* Optional. Meshes defines a list of meshes this GrpcRoute is attached to, as one of the routing rules to route the requests served by the mesh. Each mesh reference should match the pattern: `projects/x/locations/x/meshes/`
*/
meshes?: string[] | null;
/**
* Identifier. Name of the GrpcRoute resource. It matches pattern `projects/x/locations/x/grpcRoutes/`
*/
name?: string | null;
/**
* Required. A list of detailed rules defining how to route traffic. Within a single GrpcRoute, the GrpcRoute.RouteAction associated with the first matching GrpcRoute.RouteRule will be executed. At least one rule must be supplied.
*/
rules?: Schema$GrpcRouteRouteRule[];
/**
* Output only. Server-defined URL of this resource
*/
selfLink?: string | null;
/**
* Output only. The timestamp when the resource was updated.
*/
updateTime?: string | null;
}
/**
* The destination to which traffic will be routed.
*/
export interface Schema$GrpcRouteDestination {
/**
* Required. The URL of a destination service to which to route traffic. Must refer to either a BackendService or ServiceDirectoryService.
*/
serviceName?: string | null;
/**
* Optional. Specifies the proportion of requests forwarded to the backend referenced by the serviceName field. This is computed as: - weight/Sum(weights in this destination list). For non-zero values, there may be some epsilon from the exact proportion defined here depending on the precision an implementation supports. If only one serviceName is specified and it has a weight greater than 0, 100% of the traffic is forwarded to that backend. If weights are specified for any one service name, they need to be specified for all of them. If weights are unspecified for all services, then, traffic is distributed in equal proportions to all of them.
*/
weight?: number | null;
}
/**
* The specification for fault injection introduced into traffic to test the resiliency of clients to destination service failure. As part of fault injection, when clients send requests to a destination, delays can be introduced on a percentage of requests before sending those requests to the destination service. Similarly requests from clients can be aborted by for a percentage of requests.
*/
export interface Schema$GrpcRouteFaultInjectionPolicy {
/**
* The specification for aborting to client requests.
*/
abort?: Schema$GrpcRouteFaultInjectionPolicyAbort;
/**
* The specification for injecting delay to client requests.
*/
delay?: Schema$GrpcRouteFaultInjectionPolicyDelay;
}
/**
* Specification of how client requests are aborted as part of fault injection before being sent to a destination.
*/
export interface Schema$GrpcRouteFaultInjectionPolicyAbort {
/**
* The HTTP status code used to abort the request. The value must be between 200 and 599 inclusive.
*/
httpStatus?: number | null;
/**
* The percentage of traffic which will be aborted. The value must be between [0, 100]
*/
percentage?: number | null;
}
/**
* Specification of how client requests are delayed as part of fault injection before being sent to a destination.
*/
export interface Schema$GrpcRouteFaultInjectionPolicyDelay {
/**
* Specify a fixed delay before forwarding the request.
*/
fixedDelay?: string | null;
/**
* The percentage of traffic on which delay will be injected. The value must be between [0, 100]
*/
percentage?: number | null;
}
/**
* A match against