Skip to content

Commit 29c6482

Browse files
Google APIscopybara-github
Google APIs
authored and
copybara-github
committed
feat: add networksecurity v1 client library
PiperOrigin-RevId: 919268561
1 parent aab1de9 commit 29c6482

6 files changed

Lines changed: 775 additions & 17 deletions

File tree

‎google/cloud/networksecurity/v1/BUILD.bazel‎

Lines changed: 5 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -44,6 +44,7 @@ proto_library(
4444
"security_profile_group_threatprevention.proto",
4545
"security_profile_group_urlfiltering.proto",
4646
"server_tls_policy.proto",
47+
"sse_realm.proto",
4748
"tls.proto",
4849
"tls_inspection_policy.proto",
4950
"url_list.proto",
@@ -127,6 +128,8 @@ java_gapic_test(
127128
"com.google.cloud.networksecurity.v1.NetworkSecurityClientTest",
128129
"com.google.cloud.networksecurity.v1.OrganizationAddressGroupServiceClientTest",
129130
"com.google.cloud.networksecurity.v1.OrganizationSecurityProfileGroupServiceClientTest",
131+
"com.google.cloud.networksecurity.v1.SSERealmServiceClientTest",
132+
"com.google.cloud.networksecurity.v1.SecurityProfileGroupServiceClientTest",
130133
],
131134
runtime_deps = [":networksecurity_java_gapic_test"],
132135
)
@@ -338,7 +341,7 @@ ruby_grpc_library(
338341
ruby_cloud_gapic_library(
339342
name = "networksecurity_ruby_gapic",
340343
srcs = [":networksecurity_proto_with_info"],
341-
extra_protoc_parameters = ["ruby-cloud-gem-name=google-cloud-networksecurity-v1"],
344+
extra_protoc_parameters = ["ruby-cloud-gem-name=google-cloud-network_security-v1"],
342345
grpc_service_config = "networksecurity_v1_grpc_service_config.json",
343346
rest_numeric_enums = True,
344347
service_yaml = "networksecurity_v1.yaml",
@@ -373,6 +376,7 @@ load(
373376

374377
csharp_proto_library(
375378
name = "networksecurity_csharp_proto",
379+
extra_opts = [],
376380
deps = [":networksecurity_proto"],
377381
)
378382

‎google/cloud/networksecurity/v1/authz_policy.proto‎

Lines changed: 22 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -43,15 +43,18 @@ message AuthzPolicy {
4343
// Specifies the set of targets to which this policy should be applied to.
4444
message Target {
4545
// Optional. All gateways and forwarding rules referenced by this policy and
46-
// extensions must share the same load balancing scheme. Supported values:
46+
// extensions must share the same load balancing scheme. Required only when
47+
// targeting forwarding rules. If targeting Secure Web Proxy, this field
48+
// must be `INTERNAL_MANAGED` or not specified. Must not be specified
49+
// when targeting Agent Gateway. Supported values:
4750
// `INTERNAL_MANAGED` and `EXTERNAL_MANAGED`. For more information, refer
4851
// to [Backend services
4952
// overview](https://cloud.google.com/load-balancing/docs/backend-service).
5053
LoadBalancingScheme load_balancing_scheme = 8
5154
[(google.api.field_behavior) = OPTIONAL];
5255

53-
// Required. A list of references to the Forwarding Rules on which this
54-
// policy will be applied.
56+
// Required. A list of references to the Forwarding Rules, Secure Web Proxy
57+
// Gateways, or Agent Gateways on which this policy will be applied.
5558
repeated string resources = 1 [(google.api.field_behavior) = REQUIRED];
5659
}
5760

@@ -340,6 +343,13 @@ message AuthzPolicy {
340343
// request will be denied. This field can be set only for AuthzPolicies
341344
// targeting AgentGateway resources.
342345
MCP mcp = 5 [(google.api.field_behavior) = OPTIONAL];
346+
347+
// Optional. A list of SNIs to match against. The match can be one of
348+
// exact, prefix, suffix, or contains (substring match). If there is no
349+
// SNI (i.e. plaintext HTTP traffic), the request will be denied.
350+
// Matches are always case sensitive unless the ignoreCase is set.
351+
// Limited to 10 SNIs per Authorization Policy.
352+
repeated StringMatch snis = 7 [(google.api.field_behavior) = OPTIONAL];
343353
}
344354

345355
// Optional. Describes properties of one or more targets of a request. At
@@ -500,6 +510,15 @@ message AuthzPolicy {
500510
// to 5 rules.
501511
repeated AuthzRule http_rules = 7 [(google.api.field_behavior) = OPTIONAL];
502512

513+
// Optional. A list of authorization network rules to match against the
514+
// incoming request. A policy match occurs when at least one network rule
515+
// matches the request.
516+
// At least one network rule is required for Allow or Deny Action if no HTTP
517+
// rules are provided. Network rules are mutually exclusive with HTTP rules.
518+
// Limited to 5 rules.
519+
repeated AuthzRule network_rules = 12
520+
[(google.api.field_behavior) = OPTIONAL];
521+
503522
// Required. Can be one of `ALLOW`, `DENY`, `CUSTOM`.
504523
//
505524
// When the action is `CUSTOM`, `customProvider` must be specified.

‎google/cloud/networksecurity/v1/firewall_activation.proto‎

Lines changed: 64 additions & 4 deletions
Original file line numberDiff line numberDiff line change
@@ -53,6 +53,15 @@ service FirewallActivation {
5353
option (google.api.method_signature) = "parent";
5454
}
5555

56+
// Lists FirewallEndpoints in a given project and location.
57+
rpc ListProjectFirewallEndpoints(ListFirewallEndpointsRequest)
58+
returns (ListFirewallEndpointsResponse) {
59+
option (google.api.http) = {
60+
get: "/v1/{parent=projects/*/locations/*}/firewallEndpoints"
61+
};
62+
option (google.api.method_signature) = "parent";
63+
}
64+
5665
// Gets details of a single org Endpoint.
5766
rpc GetFirewallEndpoint(GetFirewallEndpointRequest)
5867
returns (FirewallEndpoint) {
@@ -62,6 +71,15 @@ service FirewallActivation {
6271
option (google.api.method_signature) = "name";
6372
}
6473

74+
// Gets details of a single project Endpoint.
75+
rpc GetProjectFirewallEndpoint(GetFirewallEndpointRequest)
76+
returns (FirewallEndpoint) {
77+
option (google.api.http) = {
78+
get: "/v1/{name=projects/*/locations/*/firewallEndpoints/*}"
79+
};
80+
option (google.api.method_signature) = "name";
81+
}
82+
6583
// Creates a new FirewallEndpoint in a given organization and location.
6684
rpc CreateFirewallEndpoint(CreateFirewallEndpointRequest)
6785
returns (google.longrunning.Operation) {
@@ -77,6 +95,21 @@ service FirewallActivation {
7795
};
7896
}
7997

98+
// Creates a new FirewallEndpoint in a given project and location.
99+
rpc CreateProjectFirewallEndpoint(CreateFirewallEndpointRequest)
100+
returns (google.longrunning.Operation) {
101+
option (google.api.http) = {
102+
post: "/v1/{parent=projects/*/locations/*}/firewallEndpoints"
103+
body: "firewall_endpoint"
104+
};
105+
option (google.api.method_signature) =
106+
"parent,firewall_endpoint,firewall_endpoint_id";
107+
option (google.longrunning.operation_info) = {
108+
response_type: "FirewallEndpoint"
109+
metadata_type: "google.cloud.networksecurity.v1.OperationMetadata"
110+
};
111+
}
112+
80113
// Deletes a single org Endpoint.
81114
rpc DeleteFirewallEndpoint(DeleteFirewallEndpointRequest)
82115
returns (google.longrunning.Operation) {
@@ -90,6 +123,19 @@ service FirewallActivation {
90123
};
91124
}
92125

126+
// Deletes a single project Endpoint.
127+
rpc DeleteProjectFirewallEndpoint(DeleteFirewallEndpointRequest)
128+
returns (google.longrunning.Operation) {
129+
option (google.api.http) = {
130+
delete: "/v1/{name=projects/*/locations/*/firewallEndpoints/*}"
131+
};
132+
option (google.api.method_signature) = "name";
133+
option (google.longrunning.operation_info) = {
134+
response_type: "google.protobuf.Empty"
135+
metadata_type: "google.cloud.networksecurity.v1.OperationMetadata"
136+
};
137+
}
138+
93139
// Update a single org Endpoint.
94140
rpc UpdateFirewallEndpoint(UpdateFirewallEndpointRequest)
95141
returns (google.longrunning.Operation) {
@@ -104,6 +150,20 @@ service FirewallActivation {
104150
};
105151
}
106152

153+
// Update a single project Endpoint.
154+
rpc UpdateProjectFirewallEndpoint(UpdateFirewallEndpointRequest)
155+
returns (google.longrunning.Operation) {
156+
option (google.api.http) = {
157+
patch: "/v1/{firewall_endpoint.name=projects/*/locations/*/firewallEndpoints/*}"
158+
body: "firewall_endpoint"
159+
};
160+
option (google.api.method_signature) = "firewall_endpoint,update_mask";
161+
option (google.longrunning.operation_info) = {
162+
response_type: "FirewallEndpoint"
163+
metadata_type: "google.cloud.networksecurity.v1.OperationMetadata"
164+
};
165+
}
166+
107167
// Lists Associations in a given project and location.
108168
rpc ListFirewallEndpointAssociations(ListFirewallEndpointAssociationsRequest)
109169
returns (ListFirewallEndpointAssociationsResponse) {
@@ -258,10 +318,10 @@ message FirewallEndpoint {
258318
// https://google.aip.dev/128.
259319
bool reconciling = 6 [(google.api.field_behavior) = OUTPUT_ONLY];
260320

261-
// Output only. List of networks that are associated with this endpoint in the
262-
// local zone. This is a projection of the FirewallEndpointAssociations
263-
// pointing at this endpoint. A network will only appear in this list after
264-
// traffic routing is fully configured. Format:
321+
// Output only. Deprecated: List of networks that are associated with this
322+
// endpoint in the local zone. This is a projection of the
323+
// FirewallEndpointAssociations pointing at this endpoint. A network will only
324+
// appear in this list after traffic routing is fully configured. Format:
265325
// projects/{project}/global/networks/{name}.
266326
repeated string associated_networks = 7
267327
[deprecated = true, (google.api.field_behavior) = OUTPUT_ONLY];

‎google/cloud/networksecurity/v1/networksecurity_v1.yaml‎

Lines changed: 50 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -13,6 +13,8 @@ apis:
1313
- name: google.cloud.networksecurity.v1.NetworkSecurity
1414
- name: google.cloud.networksecurity.v1.OrganizationAddressGroupService
1515
- name: google.cloud.networksecurity.v1.OrganizationSecurityProfileGroupService
16+
- name: google.cloud.networksecurity.v1.SSERealmService
17+
- name: google.cloud.networksecurity.v1.SecurityProfileGroupService
1618
- name: google.iam.v1.IAMPolicy
1719
- name: google.longrunning.Operations
1820

@@ -29,9 +31,8 @@ documentation:
2931
Lists information about the supported locations for this service.
3032
3133
This method lists locations based on the resource scope provided in
32-
the [ListLocationsRequest.name] field:
33-
34-
* **Global locations**: If `name` is empty, the method lists the
34+
the [ListLocationsRequest.name][google.cloud.location.ListLocationsRequest.name] field: *
35+
**Global locations**: If `name` is empty, the method lists the
3536
public locations available to all projects. * **Project-specific
3637
locations**: If `name` follows the format
3738
`projects/{project}`, the method lists locations visible to that
@@ -76,12 +77,11 @@ http:
7677
- selector: google.cloud.location.Locations.ListLocations
7778
get: '/v1/{name=projects/*}/locations'
7879
additional_bindings:
79-
- get: '/v1/{name=organizations/*/locations/*}'
80+
- get: '/v1/{name=organizations/*}/locations'
8081
- selector: google.iam.v1.IAMPolicy.GetIamPolicy
8182
get: '/v1/{resource=projects/*/locations/*/addressGroups/*}:getIamPolicy'
8283
additional_bindings:
8384
- get: '/v1/{resource=projects/*/locations/*/authorizationPolicies/*}:getIamPolicy'
84-
- get: '/v1/{resource=organizations/*/locations/*/addressGroups/*}:getIamPolicy'
8585
- get: '/v1/{resource=projects/*/locations/*/serverTlsPolicies/*}:getIamPolicy'
8686
- get: '/v1/{resource=projects/*/locations/*/clientTlsPolicies/*}:getIamPolicy'
8787
- get: '/v1/{resource=projects/*/locations/*/authzPolicies/*}:getIamPolicy'
@@ -91,8 +91,6 @@ http:
9191
additional_bindings:
9292
- post: '/v1/{resource=projects/*/locations/*/authorizationPolicies/*}:setIamPolicy'
9393
body: '*'
94-
- post: '/v1/{resource=organizations/*/locations/*/addressGroups/*}:setIamPolicy'
95-
body: '*'
9694
- post: '/v1/{resource=projects/*/locations/*/serverTlsPolicies/*}:setIamPolicy'
9795
body: '*'
9896
- post: '/v1/{resource=projects/*/locations/*/clientTlsPolicies/*}:setIamPolicy'
@@ -103,10 +101,10 @@ http:
103101
post: '/v1/{resource=projects/*/locations/*/addressGroups/*}:testIamPermissions'
104102
body: '*'
105103
additional_bindings:
106-
- post: '/v1/{resource=projects/*/locations/*/authorizationPolicies/*}:testIamPermissions'
107-
body: '*'
108104
- post: '/v1/{resource=organizations/*/locations/*/addressGroups/*}:testIamPermissions'
109105
body: '*'
106+
- post: '/v1/{resource=projects/*/locations/*/authorizationPolicies/*}:testIamPermissions'
107+
body: '*'
110108
- post: '/v1/{resource=projects/*/locations/*/serverTlsPolicies/*}:testIamPermissions'
111109
body: '*'
112110
- post: '/v1/{resource=projects/*/locations/*/clientTlsPolicies/*}:testIamPermissions'
@@ -174,6 +172,14 @@ authentication:
174172
oauth:
175173
canonical_scopes: |-
176174
https://www.googleapis.com/auth/cloud-platform
175+
- selector: 'google.cloud.networksecurity.v1.SSERealmService.*'
176+
oauth:
177+
canonical_scopes: |-
178+
https://www.googleapis.com/auth/cloud-platform
179+
- selector: 'google.cloud.networksecurity.v1.SecurityProfileGroupService.*'
180+
oauth:
181+
canonical_scopes: |-
182+
https://www.googleapis.com/auth/cloud-platform
177183
- selector: 'google.iam.v1.IAMPolicy.*'
178184
oauth:
179185
canonical_scopes: |-
@@ -190,3 +196,38 @@ publishing:
190196
github_label: 'api: networksecurity'
191197
doc_tag_prefix: networksecurity
192198
organization: CLOUD
199+
library_settings:
200+
- version: google.cloud.networksecurity.v1
201+
launch_stage: GA
202+
java_settings:
203+
common:
204+
destinations:
205+
- PACKAGE_MANAGER
206+
cpp_settings:
207+
common:
208+
destinations:
209+
- PACKAGE_MANAGER
210+
php_settings:
211+
common:
212+
destinations:
213+
- PACKAGE_MANAGER
214+
python_settings:
215+
common:
216+
destinations:
217+
- PACKAGE_MANAGER
218+
node_settings:
219+
common:
220+
destinations:
221+
- PACKAGE_MANAGER
222+
dotnet_settings:
223+
common:
224+
destinations:
225+
- PACKAGE_MANAGER
226+
ruby_settings:
227+
common:
228+
destinations:
229+
- PACKAGE_MANAGER
230+
go_settings:
231+
common:
232+
destinations:
233+
- PACKAGE_MANAGER

0 commit comments

Comments
 (0)