feat: add support for AUTH functionality

Google APIs · copybara-github · commit 7cef847afc65 · 2022-03-15T11:57:17.000-07:00
feat: add support for TLS functionality
feat: add secondary_ip_range field

PiperOrigin-RevId: 434816216
diff --git a/google/cloud/redis/v1/cloud_redis.proto b/google/cloud/redis/v1/cloud_redis.proto
@@ -1,4 +1,4 @@
-// Copyright 2021 Google LLC
+// Copyright 2022 Google LLC
 //
 // Licensed under the Apache License, Version 2.0 (the "License");
 // you may not use this file except in compliance with the License.
@@ -72,6 +72,16 @@ service CloudRedis {
     option (google.api.method_signature) = "name";
   }
 
+  // Gets the AUTH string for a Redis instance. If AUTH is not enabled for the
+  // instance the response will be empty. This information is not included in
+  // the details returned to GetInstance.
+  rpc GetInstanceAuthString(GetInstanceAuthStringRequest) returns (InstanceAuthString) {
+    option (google.api.http) = {
+      get: "/v1/{name=projects/*/locations/*/instances/*}/authString"
+    };
+    option (google.api.method_signature) = "name";
+  }
+
   // Creates a Redis instance based on the specified tier and memory size.
   //
   // By default, the instance is accessible from the project's
@@ -202,7 +212,7 @@ message NodeInfo {
   string zone = 2 [(google.api.field_behavior) = OUTPUT_ONLY];
 }
 
-// A Google Cloud Redis instance.
+// A Memorystore for Redis instance.
 message Instance {
   option (google.api.resource) = {
     type: "redis.googleapis.com/Instance"
@@ -267,18 +277,30 @@ message Instance {
     PRIVATE_SERVICE_ACCESS = 2;
   }
 
+  // Available TLS modes.
+  enum TransitEncryptionMode {
+    // Not set.
+    TRANSIT_ENCRYPTION_MODE_UNSPECIFIED = 0;
+
+    // Client to Server traffic encryption enabled with server authentication.
+    SERVER_AUTHENTICATION = 1;
+
+    // TLS is disabled for the instance.
+    DISABLED = 2;
+  }
+
   // Read replicas mode.
   enum ReadReplicasMode {
-    // If not set, Memorystore Redis backend will pick the mode based on other fields in
-    // the request.
+    // If not set, Memorystore Redis backend will default to
+    // READ_REPLICAS_DISABLED.
     READ_REPLICAS_MODE_UNSPECIFIED = 0;
 
     // If disabled, read endpoint will not be provided and the instance cannot
     // scale up or down the number of replicas.
     READ_REPLICAS_DISABLED = 1;
 
     // If enabled, read endpoint will be provided and the instance can scale
-    // up and down the number of replicas.
+    // up and down the number of replicas. Not valid for basic tier.
     READ_REPLICAS_ENABLED = 2;
   }
 
@@ -333,6 +355,13 @@ message Instance {
   // the default block size is /28.
   string reserved_ip_range = 9 [(google.api.field_behavior) = OPTIONAL];
 
+  // Optional. Additional IP range for node placement. Required when enabling read
+  // replicas on an existing instance. For DIRECT_PEERING mode value must be a
+  // CIDR range of size /28, or "auto". For PRIVATE_SERVICE_ACCESS mode value
+  // must be the name of an allocated address range associated with the private
+  // service access connection, or "auto".
+  string secondary_ip_range = 30 [(google.api.field_behavior) = OPTIONAL];
+
   // Output only. Hostname or IP address of the exposed Redis endpoint used by
   // clients to connect to the service.
   string host = 10 [(google.api.field_behavior) = OUTPUT_ONLY];
@@ -400,9 +429,23 @@ message Instance {
   // If not provided, the connect mode defaults to DIRECT_PEERING.
   ConnectMode connect_mode = 22 [(google.api.field_behavior) = OPTIONAL];
 
-  // Optional. The number of replica nodes. Valid range for standard tier
-  // is [1-5] and defaults to 1. Valid value for basic tier is 0 and defaults
-  // to 0.
+  // Optional. Indicates whether OSS Redis AUTH is enabled for the instance. If set to
+  // "true" AUTH is enabled on the instance. Default value is "false" meaning
+  // AUTH is disabled.
+  bool auth_enabled = 23 [(google.api.field_behavior) = OPTIONAL];
+
+  // Output only. List of server CA certificates for the instance.
+  repeated TlsCertificate server_ca_certs = 25 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Optional. The TLS mode of the Redis instance.
+  // If not provided, TLS is disabled for the instance.
+  TransitEncryptionMode transit_encryption_mode = 26 [(google.api.field_behavior) = OPTIONAL];
+
+  // Optional. The number of replica nodes. The valid range for the Standard Tier with
+  // read replicas enabled is [1-5] and defaults to 2. If read replicas are not
+  // enabled for a Standard Tier instance, the only valid value is 1 and the
+  // default is 1. The valid value for basic tier is 0 and the default is also
+  // 0.
   int32 replica_count = 31 [(google.api.field_behavior) = OPTIONAL];
 
   // Output only. Info per node.
@@ -418,7 +461,7 @@ message Instance {
   // endpoint. Standard tier only. Write requests should target 'port'.
   int32 read_endpoint_port = 34 [(google.api.field_behavior) = OUTPUT_ONLY];
 
-  // Optional. Read replica mode.
+  // Optional. Read replicas mode for the instance. Defaults to READ_REPLICAS_DISABLED.
   ReadReplicasMode read_replicas_mode = 35 [(google.api.field_behavior) = OPTIONAL];
 }
 
@@ -484,6 +527,25 @@ message GetInstanceRequest {
   ];
 }
 
+// Request for [GetInstanceAuthString][google.cloud.redis.v1.CloudRedis.GetInstanceAuthString].
+message GetInstanceAuthStringRequest {
+  // Required. Redis instance resource name using the form:
+  //     `projects/{project_id}/locations/{location_id}/instances/{instance_id}`
+  // where `location_id` refers to a GCP region.
+  string name = 1 [
+    (google.api.field_behavior) = REQUIRED,
+    (google.api.resource_reference) = {
+      type: "redis.googleapis.com/Instance"
+    }
+  ];
+}
+
+// Instance AUTH string details.
+message InstanceAuthString {
+  // AUTH string set on the instance.
+  string auth_string = 1;
+}
+
 // Request for [CreateInstance][google.cloud.redis.v1.CloudRedis.CreateInstance].
 message CreateInstanceRequest {
   // Required. The resource name of the instance location using the form:
@@ -684,3 +746,25 @@ message LocationMetadata {
 message ZoneMetadata {
 
 }
+
+// TlsCertificate Resource
+message TlsCertificate {
+  // Serial number, as extracted from the certificate.
+  string serial_number = 1;
+
+  // PEM representation.
+  string cert = 2;
+
+  // Output only. The time when the certificate was created in [RFC
+  // 3339](https://tools.ietf.org/html/rfc3339) format, for example
+  // `2020-05-18T00:00:00.094Z`.
+  google.protobuf.Timestamp create_time = 3 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Output only. The time when the certificate expires in [RFC
+  // 3339](https://tools.ietf.org/html/rfc3339) format, for example
+  // `2020-05-18T00:00:00.094Z`.
+  google.protobuf.Timestamp expire_time = 4 [(google.api.field_behavior) = OUTPUT_ONLY];
+
+  // Sha1 Fingerprint of the certificate.
+  string sha1_fingerprint = 5;
+}
