Skip to content

Commit 5601ad3

Browse files
Google APIscopybara-github
Google APIs
authored and
copybara-github
committed
feat: Add support to generate client certificate and get connection info for auth proxy in AlloyDB v1
PiperOrigin-RevId: 568860878
1 parent 4f5c742 commit 5601ad3

3 files changed

Lines changed: 123 additions & 1 deletion

File tree

‎google/cloud/alloydb/v1/alloydb_v1_grpc_service_config.json‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -7,7 +7,9 @@
77
{ "service": "google.cloud.alloydb.v1.AlloyDBAdmin", "method": "GetInstance" },
88
{ "service": "google.cloud.alloydb.v1.AlloyDBAdmin", "method": "ListBackups" },
99
{ "service": "google.cloud.alloydb.v1.AlloyDBAdmin", "method": "GetBackup" },
10-
{ "service": "google.cloud.alloydb.v1.AlloyDBAdmin", "method": "ListSupportedDatabaseFlags" }
10+
{ "service": "google.cloud.alloydb.v1.AlloyDBAdmin", "method": "ListSupportedDatabaseFlags" },
11+
{ "service": "google.cloud.alloydb.v1.AlloyDBAdmin", "method": "GenerateClientCertificate" },
12+
{ "service": "google.cloud.alloydb.v1.AlloyDBAdmin", "method": "GetConnectionInfo" }
1113
],
1214
"timeout": "60s",
1315
"retryPolicy": {

‎google/cloud/alloydb/v1/resources.proto‎

Lines changed: 22 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -862,6 +862,28 @@ message Instance {
862862
[(google.api.field_behavior) = OPTIONAL];
863863
}
864864

865+
// ConnectionInfo singleton resource.
866+
// https://google.aip.dev/156
867+
message ConnectionInfo {
868+
option (google.api.resource) = {
869+
type: "alloydb.googleapis.com/ConnectionInfo"
870+
pattern: "projects/{project}/locations/{location}/clusters/{cluster}/instances/{instance}/connectionInfo"
871+
};
872+
873+
// The name of the ConnectionInfo singleton resource, e.g.:
874+
// projects/{project}/locations/{location}/clusters/*/instances/*/connectionInfo
875+
// This field currently has no semantic meaning.
876+
string name = 1;
877+
878+
// Output only. The private network IP address for the Instance. This is the
879+
// default IP for the instance and is always created (even if enable_public_ip
880+
// is set). This is the connection endpoint for an end-user application.
881+
string ip_address = 2 [(google.api.field_behavior) = OUTPUT_ONLY];
882+
883+
// Output only. The unique ID of the Instance.
884+
string instance_uid = 4 [(google.api.field_behavior) = OUTPUT_ONLY];
885+
}
886+
865887
// Message describing Backup object
866888
message Backup {
867889
option (google.api.resource) = {

‎google/cloud/alloydb/v1/service.proto‎

Lines changed: 98 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -22,6 +22,7 @@ import "google/api/field_behavior.proto";
2222
import "google/api/resource.proto";
2323
import "google/cloud/alloydb/v1/resources.proto";
2424
import "google/longrunning/operations.proto";
25+
import "google/protobuf/duration.proto";
2526
import "google/protobuf/empty.proto";
2627
import "google/protobuf/field_mask.proto";
2728
import "google/protobuf/timestamp.proto";
@@ -346,6 +347,28 @@ service AlloyDBAdmin {
346347
option (google.api.method_signature) = "parent";
347348
}
348349

350+
// Generate a client certificate signed by a Cluster CA.
351+
// The sole purpose of this endpoint is to support AlloyDB connectors and the
352+
// Auth Proxy client. The endpoint's behavior is subject to change without
353+
// notice, so do not rely on its behavior remaining constant. Future changes
354+
// will not break AlloyDB connectors or the Auth Proxy client.
355+
rpc GenerateClientCertificate(GenerateClientCertificateRequest)
356+
returns (GenerateClientCertificateResponse) {
357+
option (google.api.http) = {
358+
post: "/v1/{parent=projects/*/locations/*/clusters/*}:generateClientCertificate"
359+
body: "*"
360+
};
361+
option (google.api.method_signature) = "parent";
362+
}
363+
364+
// Get instance metadata used for a connection.
365+
rpc GetConnectionInfo(GetConnectionInfoRequest) returns (ConnectionInfo) {
366+
option (google.api.http) = {
367+
get: "/v1/{parent=projects/*/locations/*/clusters/*/instances/*}/connectionInfo"
368+
};
369+
option (google.api.method_signature) = "parent";
370+
}
371+
349372
// Lists Users in a given project and location.
350373
rpc ListUsers(ListUsersRequest) returns (ListUsersResponse) {
351374
option (google.api.http) = {
@@ -1300,6 +1323,81 @@ message ListSupportedDatabaseFlagsResponse {
13001323
string next_page_token = 2;
13011324
}
13021325

1326+
// Message for requests to generate a client certificate signed by the Cluster
1327+
// CA.
1328+
message GenerateClientCertificateRequest {
1329+
// Required. The name of the parent resource. The required format is:
1330+
// * projects/{project}/locations/{location}/clusters/{cluster}
1331+
string parent = 1 [
1332+
(google.api.field_behavior) = REQUIRED,
1333+
(google.api.resource_reference) = { type: "alloydb.googleapis.com/Cluster" }
1334+
];
1335+
1336+
// Optional. An optional request ID to identify requests. Specify a unique
1337+
// request ID so that if you must retry your request, the server will know to
1338+
// ignore the request if it has already been completed. The server will
1339+
// guarantee that for at least 60 minutes after the first request.
1340+
//
1341+
// For example, consider a situation where you make an initial request and
1342+
// the request times out. If you make the request again with the same request
1343+
// ID, the server can check if original operation with the same request ID
1344+
// was received, and if so, will ignore the second request. This prevents
1345+
// clients from accidentally creating duplicate commitments.
1346+
//
1347+
// The request ID must be a valid UUID with the exception that zero UUID is
1348+
// not supported (00000000-0000-0000-0000-000000000000).
1349+
string request_id = 2 [(google.api.field_behavior) = OPTIONAL];
1350+
1351+
// Optional. An optional hint to the endpoint to generate the client
1352+
// certificate with the requested duration. The duration can be from 1 hour to
1353+
// 24 hours. The endpoint may or may not honor the hint. If the hint is left
1354+
// unspecified or is not honored, then the endpoint will pick an appropriate
1355+
// default duration.
1356+
google.protobuf.Duration cert_duration = 4
1357+
[(google.api.field_behavior) = OPTIONAL];
1358+
1359+
// Optional. The public key from the client.
1360+
string public_key = 5 [(google.api.field_behavior) = OPTIONAL];
1361+
}
1362+
1363+
// Message returned by a GenerateClientCertificate operation.
1364+
message GenerateClientCertificateResponse {
1365+
// Output only. The pem-encoded chain that may be used to verify the X.509
1366+
// certificate. Expected to be in issuer-to-root order according to RFC 5246.
1367+
repeated string pem_certificate_chain = 2
1368+
[(google.api.field_behavior) = OUTPUT_ONLY];
1369+
1370+
// Optional. The pem-encoded cluster ca X.509 certificate.
1371+
string ca_cert = 3 [(google.api.field_behavior) = OPTIONAL];
1372+
}
1373+
1374+
// Request message for GetConnectionInfo.
1375+
message GetConnectionInfoRequest {
1376+
// Required. The name of the parent resource. The required format is:
1377+
// projects/{project}/locations/{location}/clusters/{cluster}/instances/{instance}
1378+
string parent = 1 [
1379+
(google.api.field_behavior) = REQUIRED,
1380+
(google.api.resource_reference) = {
1381+
type: "alloydb.googleapis.com/Instance"
1382+
}
1383+
];
1384+
1385+
// Optional. An optional request ID to identify requests. Specify a unique
1386+
// request ID so that if you must retry your request, the server will know to
1387+
// ignore the request if it has already been completed. The server will
1388+
// guarantee that for at least 60 minutes after the first request.
1389+
//
1390+
// For example, consider a situation where you make an initial request and
1391+
// the request times out. If you make the request again with the same request
1392+
// ID, the server can check if original operation with the same request ID
1393+
// was received, and if so, will ignore the second request. This prevents
1394+
// clients from accidentally creating duplicate commitments.
1395+
//
1396+
// The request ID must be a valid UUID with the exception that zero UUID is
1397+
// not supported (00000000-0000-0000-0000-000000000000).
1398+
string request_id = 2 [(google.api.field_behavior) = OPTIONAL];
1399+
}
1400+
13031401
// Represents the metadata of the long-running operation.
13041402
message OperationMetadata {
13051403
// Request specific metadata, if any.

0 commit comments

Comments
 (0)