google-cloud-binary_authorization-v1beta1 0.18.0 → 0.20.0

data/proto_docs/google/cloud/binaryauthorization/v1beta1/resources.rb

@@ -21,7 +21,8 @@ module Google
   module Cloud
     module BinaryAuthorization
       module V1beta1
-        # A {::Google::Cloud::BinaryAuthorization::V1beta1::Policy policy} for Binary Authorization.
+        # A {::Google::Cloud::BinaryAuthorization::V1beta1::Policy policy} for Binary
+        # Authorization.
         # @!attribute [r] name
         #   @return [::String]
         #     Output only. The resource name, in the format `projects/*/policy`. There is
@@ -51,7 +52,8 @@ module Google
         #     https://cloud.google.com/container-engine/reference/rest/v1/projects.zones.clusters.
         # @!attribute [rw] kubernetes_namespace_admission_rules
         #   @return [::Google::Protobuf::Map{::String => ::Google::Cloud::BinaryAuthorization::V1beta1::AdmissionRule}]
-        #     Optional. Per-kubernetes-namespace admission rules. K8s namespace spec format:
+        #     Optional. Per-kubernetes-namespace admission rules. K8s namespace spec
+        #     format:
         #       `[a-z.-]+`, e.g. `some-namespace`
         # @!attribute [rw] kubernetes_service_account_admission_rules
         #   @return [::Google::Protobuf::Map{::String => ::Google::Cloud::BinaryAuthorization::V1beta1::AdmissionRule}]
@@ -71,6 +73,11 @@ module Google
         # @!attribute [r] update_time
         #   @return [::Google::Protobuf::Timestamp]
         #     Output only. Time when the policy was last updated.
+        # @!attribute [rw] etag
+        #   @return [::String]
+        #     Optional. A checksum, returned by the server, that can be sent on update
+        #     requests to ensure the policy has an up-to-date value before attempting to
+        #     update it. See https://google.aip.dev/154.
         class Policy
           include ::Google::Protobuf::MessageExts
           extend ::Google::Protobuf::MessageExts::ClassMethods
@@ -123,8 +130,10 @@ module Google
           end
         end
 
-        # An {::Google::Cloud::BinaryAuthorization::V1beta1::AdmissionWhitelistPattern admission allowlist pattern} exempts images
-        # from checks by {::Google::Cloud::BinaryAuthorization::V1beta1::AdmissionRule admission rules}.
+        # An [admission allowlist
+        # pattern][google.cloud.binaryauthorization.v1beta1.AdmissionWhitelistPattern]
+        # exempts images from checks by [admission
+        # rules][google.cloud.binaryauthorization.v1beta1.AdmissionRule].
         # @!attribute [rw] name_pattern
         #   @return [::String]
         #     An image name pattern to allowlist, in the form `registry/path/to/image`.
@@ -139,26 +148,20 @@ module Google
           extend ::Google::Protobuf::MessageExts::ClassMethods
         end
 
-        # An {::Google::Cloud::BinaryAuthorization::V1beta1::AdmissionRule admission rule} specifies either that all container images
-        # used in a pod creation request must be attested to by one or more
-        # {::Google::Cloud::BinaryAuthorization::V1beta1::Attestor attestors}, that all pod creations will be allowed, or that all
-        # pod creations will be denied.
+        # An {::Google::Cloud::BinaryAuthorization::V1beta1::AdmissionRule admission rule}
+        # specifies either that all container images used in a pod creation request
+        # must be attested to by one or more
+        # {::Google::Cloud::BinaryAuthorization::V1beta1::Attestor attestors}, that all pod
+        # creations will be allowed, or that all pod creations will be denied.
         #
-        # Images matching an {::Google::Cloud::BinaryAuthorization::V1beta1::AdmissionWhitelistPattern admission allowlist pattern}
+        # Images matching an [admission allowlist
+        # pattern][google.cloud.binaryauthorization.v1beta1.AdmissionWhitelistPattern]
         # are exempted from admission rules and will never block a pod creation.
         # @!attribute [rw] evaluation_mode
         #   @return [::Google::Cloud::BinaryAuthorization::V1beta1::AdmissionRule::EvaluationMode]
         #     Required. How this admission rule will be evaluated.
         # @!attribute [rw] require_attestations_by
         #   @return [::Array<::String>]
-        #     Optional. The resource names of the attestors that must attest to
-        #     a container image, in the format `projects/*/attestors/*`. Each
-        #     attestor must exist before a policy can reference it.  To add an attestor
-        #     to a policy the principal issuing the policy change request must be able
-        #     to read the attestor resource.
-        #
-        #     Note: this field must be non-empty when the evaluation_mode field specifies
-        #     REQUIRE_ATTESTATION, otherwise it must be empty.
         # @!attribute [rw] enforcement_mode
         #   @return [::Google::Cloud::BinaryAuthorization::V1beta1::AdmissionRule::EnforcementMode]
         #     Required. The action when a pod creation is denied by the admission rule.
@@ -182,6 +185,8 @@ module Google
             ALWAYS_DENY = 3
           end
 
+          # TODO(wietse) re-word this text to 'per-image' instead of 'per-pod' and to
+          # allow for three-way evaluation (allow, deny, delegate).
           # Defines the possible actions when a pod creation is denied by an admission
           # rule.
           module EnforcementMode
@@ -197,9 +202,9 @@ module Google
           end
         end
 
-        # An {::Google::Cloud::BinaryAuthorization::V1beta1::Attestor attestor} that attests to container image
-        # artifacts. An existing attestor cannot be modified except where
-        # indicated.
+        # An {::Google::Cloud::BinaryAuthorization::V1beta1::Attestor attestor} that attests
+        # to container image artifacts. An existing attestor cannot be modified except
+        # where indicated.
         # @!attribute [rw] name
         #   @return [::String]
         #     Required. The resource name, in the format:
@@ -214,13 +219,19 @@ module Google
         # @!attribute [r] update_time
         #   @return [::Google::Protobuf::Timestamp]
         #     Output only. Time when the attestor was last updated.
+        # @!attribute [rw] etag
+        #   @return [::String]
+        #     Optional. A checksum, returned by the server, that can be sent on update
+        #     requests to ensure the attestor has an up-to-date value before attempting
+        #     to update it. See https://google.aip.dev/154.
         class Attestor
           include ::Google::Protobuf::MessageExts
           extend ::Google::Protobuf::MessageExts::ClassMethods
         end
 
-        # An {::Google::Cloud::BinaryAuthorization::V1beta1::UserOwnedDrydockNote user owned drydock note} references a Drydock
-        # ATTESTATION_AUTHORITY Note created by the user.
+        # An [user owned drydock
+        # note][google.cloud.binaryauthorization.v1beta1.UserOwnedDrydockNote]
+        # references a Drydock ATTESTATION_AUTHORITY Note created by the user.
         # @!attribute [rw] note_reference
         #   @return [::String]
         #     Required. The Drydock resource name of a ATTESTATION_AUTHORITY Note,
@@ -289,15 +300,27 @@ module Google
             # RSASSA-PSS 2048 bit key with a SHA256 digest.
             RSA_PSS_2048_SHA256 = 1
 
+            # RSASSA-PSS 2048 bit key with a SHA256 digest.
+            RSA_SIGN_PSS_2048_SHA256 = 1
+
             # RSASSA-PSS 3072 bit key with a SHA256 digest.
             RSA_PSS_3072_SHA256 = 2
 
+            # RSASSA-PSS 3072 bit key with a SHA256 digest.
+            RSA_SIGN_PSS_3072_SHA256 = 2
+
             # RSASSA-PSS 4096 bit key with a SHA256 digest.
             RSA_PSS_4096_SHA256 = 3
 
+            # RSASSA-PSS 4096 bit key with a SHA256 digest.
+            RSA_SIGN_PSS_4096_SHA256 = 3
+
             # RSASSA-PSS 4096 bit key with a SHA512 digest.
             RSA_PSS_4096_SHA512 = 4
 
+            # RSASSA-PSS 4096 bit key with a SHA512 digest.
+            RSA_SIGN_PSS_4096_SHA512 = 4
+
             # RSASSA-PKCS1-v1_5 with a 2048 bit key and a SHA256 digest.
             RSA_SIGN_PKCS1_2048_SHA256 = 5
 
@@ -327,11 +350,15 @@ module Google
 
             # ECDSA on the NIST P-521 curve with a SHA512 digest.
             EC_SIGN_P521_SHA512 = 11
+
+            # ML-DSA-65 Post-Quantum Cryptography signature algorithm.
+            ML_DSA_65 = 13
           end
         end
 
-        # An {::Google::Cloud::BinaryAuthorization::V1beta1::AttestorPublicKey attestor public key} that will be used to verify
-        # attestations signed by this attestor.
+        # An [attestor public
+        # key][google.cloud.binaryauthorization.v1beta1.AttestorPublicKey] that will be
+        # used to verify attestations signed by this attestor.
         # @!attribute [rw] comment
         #   @return [::String]
         #     Optional. A descriptive comment. This field may be updated.

data/proto_docs/google/cloud/binaryauthorization/v1beta1/service.rb

@@ -24,8 +24,9 @@ module Google
         # Request message for [BinauthzManagementService.GetPolicy][].
         # @!attribute [rw] name
         #   @return [::String]
-        #     Required. The resource name of the {::Google::Cloud::BinaryAuthorization::V1beta1::Policy policy} to retrieve,
-        #     in the format `projects/*/policy`.
+        #     Required. The resource name of the
+        #     {::Google::Cloud::BinaryAuthorization::V1beta1::Policy policy} to retrieve, in
+        #     the format `projects/*/policy`.
         class GetPolicyRequest
           include ::Google::Protobuf::MessageExts
           extend ::Google::Protobuf::MessageExts::ClassMethods
@@ -34,9 +35,11 @@ module Google
         # Request message for [BinauthzManagementService.UpdatePolicy][].
         # @!attribute [rw] policy
         #   @return [::Google::Cloud::BinaryAuthorization::V1beta1::Policy]
-        #     Required. A new or updated {::Google::Cloud::BinaryAuthorization::V1beta1::Policy policy} value. The service will
-        #     overwrite the {::Google::Cloud::BinaryAuthorization::V1beta1::Policy#name policy name} field with the resource name in
-        #     the request URL, in the format `projects/*/policy`.
+        #     Required. A new or updated
+        #     {::Google::Cloud::BinaryAuthorization::V1beta1::Policy policy} value. The
+        #     service will overwrite the [policy
+        #     name][google.cloud.binaryauthorization.v1beta1.Policy.name] field with the
+        #     resource name in the request URL, in the format `projects/*/policy`.
         class UpdatePolicyRequest
           include ::Google::Protobuf::MessageExts
           extend ::Google::Protobuf::MessageExts::ClassMethods
@@ -45,15 +48,19 @@ module Google
         # Request message for [BinauthzManagementService.CreateAttestor][].
         # @!attribute [rw] parent
         #   @return [::String]
-        #     Required. The parent of this {::Google::Cloud::BinaryAuthorization::V1beta1::Attestor attestor}.
+        #     Required. The parent of this
+        #     {::Google::Cloud::BinaryAuthorization::V1beta1::Attestor attestor}.
         # @!attribute [rw] attestor_id
         #   @return [::String]
-        #     Required. The {::Google::Cloud::BinaryAuthorization::V1beta1::Attestor attestors} ID.
+        #     Required. The
+        #     {::Google::Cloud::BinaryAuthorization::V1beta1::Attestor attestors} ID.
         # @!attribute [rw] attestor
         #   @return [::Google::Cloud::BinaryAuthorization::V1beta1::Attestor]
-        #     Required. The initial {::Google::Cloud::BinaryAuthorization::V1beta1::Attestor attestor} value. The service will
-        #     overwrite the {::Google::Cloud::BinaryAuthorization::V1beta1::Attestor#name attestor name} field with the resource name,
-        #     in the format `projects/*/attestors/*`.
+        #     Required. The initial
+        #     {::Google::Cloud::BinaryAuthorization::V1beta1::Attestor attestor} value. The
+        #     service will overwrite the [attestor
+        #     name][google.cloud.binaryauthorization.v1beta1.Attestor.name] field with
+        #     the resource name, in the format `projects/*/attestors/*`.
         class CreateAttestorRequest
           include ::Google::Protobuf::MessageExts
           extend ::Google::Protobuf::MessageExts::ClassMethods
@@ -62,8 +69,9 @@ module Google
         # Request message for [BinauthzManagementService.GetAttestor][].
         # @!attribute [rw] name
         #   @return [::String]
-        #     Required. The name of the {::Google::Cloud::BinaryAuthorization::V1beta1::Attestor attestor} to retrieve, in the format
-        #     `projects/*/attestors/*`.
+        #     Required. The name of the
+        #     {::Google::Cloud::BinaryAuthorization::V1beta1::Attestor attestor} to retrieve,
+        #     in the format `projects/*/attestors/*`.
         class GetAttestorRequest
           include ::Google::Protobuf::MessageExts
           extend ::Google::Protobuf::MessageExts::ClassMethods
@@ -72,9 +80,12 @@ module Google
         # Request message for [BinauthzManagementService.UpdateAttestor][].
         # @!attribute [rw] attestor
         #   @return [::Google::Cloud::BinaryAuthorization::V1beta1::Attestor]
-        #     Required. The updated {::Google::Cloud::BinaryAuthorization::V1beta1::Attestor attestor} value. The service will
-        #     overwrite the {::Google::Cloud::BinaryAuthorization::V1beta1::Attestor#name attestor name} field with the resource name
-        #     in the request URL, in the format `projects/*/attestors/*`.
+        #     Required. The updated
+        #     {::Google::Cloud::BinaryAuthorization::V1beta1::Attestor attestor} value. The
+        #     service will overwrite the [attestor
+        #     name][google.cloud.binaryauthorization.v1beta1.Attestor.name] field with
+        #     the resource name in the request URL, in the format
+        #     `projects/*/attestors/*`.
         class UpdateAttestorRequest
           include ::Google::Protobuf::MessageExts
           extend ::Google::Protobuf::MessageExts::ClassMethods
@@ -84,7 +95,8 @@ module Google
         # @!attribute [rw] parent
         #   @return [::String]
         #     Required. The resource name of the project associated with the
-        #     {::Google::Cloud::BinaryAuthorization::V1beta1::Attestor attestors}, in the format `projects/*`.
+        #     {::Google::Cloud::BinaryAuthorization::V1beta1::Attestor attestors}, in the
+        #     format `projects/*`.
         # @!attribute [rw] page_size
         #   @return [::Integer]
         #     Requested page size. The server may return fewer results than requested. If
@@ -92,8 +104,9 @@ module Google
         # @!attribute [rw] page_token
         #   @return [::String]
         #     A token identifying a page of results the server should return. Typically,
-        #     this is the value of {::Google::Cloud::BinaryAuthorization::V1beta1::ListAttestorsResponse#next_page_token ListAttestorsResponse.next_page_token} returned
-        #     from the previous call to the `ListAttestors` method.
+        #     this is the value of
+        #     {::Google::Cloud::BinaryAuthorization::V1beta1::ListAttestorsResponse#next_page_token ListAttestorsResponse.next_page_token}
+        #     returned from the previous call to the `ListAttestors` method.
         class ListAttestorsRequest
           include ::Google::Protobuf::MessageExts
           extend ::Google::Protobuf::MessageExts::ClassMethods
@@ -106,8 +119,9 @@ module Google
         # @!attribute [rw] next_page_token
         #   @return [::String]
         #     A token to retrieve the next page of results. Pass this value in the
-        #     {::Google::Cloud::BinaryAuthorization::V1beta1::ListAttestorsRequest#page_token ListAttestorsRequest.page_token} field in the subsequent call to the
-        #     `ListAttestors` method to retrieve the next page of results.
+        #     {::Google::Cloud::BinaryAuthorization::V1beta1::ListAttestorsRequest#page_token ListAttestorsRequest.page_token}
+        #     field in the subsequent call to the `ListAttestors` method to retrieve the
+        #     next page of results.
         class ListAttestorsResponse
           include ::Google::Protobuf::MessageExts
           extend ::Google::Protobuf::MessageExts::ClassMethods
@@ -116,8 +130,9 @@ module Google
         # Request message for [BinauthzManagementService.DeleteAttestor][].
         # @!attribute [rw] name
         #   @return [::String]
-        #     Required. The name of the {::Google::Cloud::BinaryAuthorization::V1beta1::Attestor attestors} to delete, in the format
-        #     `projects/*/attestors/*`.
+        #     Required. The name of the
+        #     {::Google::Cloud::BinaryAuthorization::V1beta1::Attestor attestors} to delete,
+        #     in the format `projects/*/attestors/*`.
         class DeleteAttestorRequest
           include ::Google::Protobuf::MessageExts
           extend ::Google::Protobuf::MessageExts::ClassMethods

data/proto_docs/google/protobuf/field_mask.rb

@@ -0,0 +1,229 @@
+# frozen_string_literal: true
+
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Auto-generated by gapic-generator-ruby. DO NOT EDIT!
+
+
+module Google
+  module Protobuf
+    # `FieldMask` represents a set of symbolic field paths, for example:
+    #
+    #     paths: "f.a"
+    #     paths: "f.b.d"
+    #
+    # Here `f` represents a field in some root message, `a` and `b`
+    # fields in the message found in `f`, and `d` a field found in the
+    # message in `f.b`.
+    #
+    # Field masks are used to specify a subset of fields that should be
+    # returned by a get operation or modified by an update operation.
+    # Field masks also have a custom JSON encoding (see below).
+    #
+    # # Field Masks in Projections
+    #
+    # When used in the context of a projection, a response message or
+    # sub-message is filtered by the API to only contain those fields as
+    # specified in the mask. For example, if the mask in the previous
+    # example is applied to a response message as follows:
+    #
+    #     f {
+    #       a : 22
+    #       b {
+    #         d : 1
+    #         x : 2
+    #       }
+    #       y : 13
+    #     }
+    #     z: 8
+    #
+    # The result will not contain specific values for fields x,y and z
+    # (their value will be set to the default, and omitted in proto text
+    # output):
+    #
+    #
+    #     f {
+    #       a : 22
+    #       b {
+    #         d : 1
+    #       }
+    #     }
+    #
+    # A repeated field is not allowed except at the last position of a
+    # paths string.
+    #
+    # If a FieldMask object is not present in a get operation, the
+    # operation applies to all fields (as if a FieldMask of all fields
+    # had been specified).
+    #
+    # Note that a field mask does not necessarily apply to the
+    # top-level response message. In case of a REST get operation, the
+    # field mask applies directly to the response, but in case of a REST
+    # list operation, the mask instead applies to each individual message
+    # in the returned resource list. In case of a REST custom method,
+    # other definitions may be used. Where the mask applies will be
+    # clearly documented together with its declaration in the API.  In
+    # any case, the effect on the returned resource/resources is required
+    # behavior for APIs.
+    #
+    # # Field Masks in Update Operations
+    #
+    # A field mask in update operations specifies which fields of the
+    # targeted resource are going to be updated. The API is required
+    # to only change the values of the fields as specified in the mask
+    # and leave the others untouched. If a resource is passed in to
+    # describe the updated values, the API ignores the values of all
+    # fields not covered by the mask.
+    #
+    # If a repeated field is specified for an update operation, new values will
+    # be appended to the existing repeated field in the target resource. Note that
+    # a repeated field is only allowed in the last position of a `paths` string.
+    #
+    # If a sub-message is specified in the last position of the field mask for an
+    # update operation, then new value will be merged into the existing sub-message
+    # in the target resource.
+    #
+    # For example, given the target message:
+    #
+    #     f {
+    #       b {
+    #         d: 1
+    #         x: 2
+    #       }
+    #       c: [1]
+    #     }
+    #
+    # And an update message:
+    #
+    #     f {
+    #       b {
+    #         d: 10
+    #       }
+    #       c: [2]
+    #     }
+    #
+    # then if the field mask is:
+    #
+    #  paths: ["f.b", "f.c"]
+    #
+    # then the result will be:
+    #
+    #     f {
+    #       b {
+    #         d: 10
+    #         x: 2
+    #       }
+    #       c: [1, 2]
+    #     }
+    #
+    # An implementation may provide options to override this default behavior for
+    # repeated and message fields.
+    #
+    # In order to reset a field's value to the default, the field must
+    # be in the mask and set to the default value in the provided resource.
+    # Hence, in order to reset all fields of a resource, provide a default
+    # instance of the resource and set all fields in the mask, or do
+    # not provide a mask as described below.
+    #
+    # If a field mask is not present on update, the operation applies to
+    # all fields (as if a field mask of all fields has been specified).
+    # Note that in the presence of schema evolution, this may mean that
+    # fields the client does not know and has therefore not filled into
+    # the request will be reset to their default. If this is unwanted
+    # behavior, a specific service may require a client to always specify
+    # a field mask, producing an error if not.
+    #
+    # As with get operations, the location of the resource which
+    # describes the updated values in the request message depends on the
+    # operation kind. In any case, the effect of the field mask is
+    # required to be honored by the API.
+    #
+    # ## Considerations for HTTP REST
+    #
+    # The HTTP kind of an update operation which uses a field mask must
+    # be set to PATCH instead of PUT in order to satisfy HTTP semantics
+    # (PUT must only be used for full updates).
+    #
+    # # JSON Encoding of Field Masks
+    #
+    # In JSON, a field mask is encoded as a single string where paths are
+    # separated by a comma. Fields name in each path are converted
+    # to/from lower-camel naming conventions.
+    #
+    # As an example, consider the following message declarations:
+    #
+    #     message Profile {
+    #       User user = 1;
+    #       Photo photo = 2;
+    #     }
+    #     message User {
+    #       string display_name = 1;
+    #       string address = 2;
+    #     }
+    #
+    # In proto a field mask for `Profile` may look as such:
+    #
+    #     mask {
+    #       paths: "user.display_name"
+    #       paths: "photo"
+    #     }
+    #
+    # In JSON, the same mask is represented as below:
+    #
+    #     {
+    #       mask: "user.displayName,photo"
+    #     }
+    #
+    # # Field Masks and Oneof Fields
+    #
+    # Field masks treat fields in oneofs just as regular fields. Consider the
+    # following message:
+    #
+    #     message SampleMessage {
+    #       oneof test_oneof {
+    #         string name = 4;
+    #         SubMessage sub_message = 9;
+    #       }
+    #     }
+    #
+    # The field mask can be:
+    #
+    #     mask {
+    #       paths: "name"
+    #     }
+    #
+    # Or:
+    #
+    #     mask {
+    #       paths: "sub_message"
+    #     }
+    #
+    # Note that oneof type names ("test_oneof" in this case) cannot be used in
+    # paths.
+    #
+    # ## Field Mask Verification
+    #
+    # The implementation of any API method which has a FieldMask type field in the
+    # request should verify the included field paths, and return an
+    # `INVALID_ARGUMENT` error if any path is unmappable.
+    # @!attribute [rw] paths
+    #   @return [::Array<::String>]
+    #     The set of field mask paths.
+    class FieldMask
+      include ::Google::Protobuf::MessageExts
+      extend ::Google::Protobuf::MessageExts::ClassMethods
+    end
+  end
+end

data/proto_docs/google/type/expr.rb

@@ -0,0 +1,75 @@
+# frozen_string_literal: true
+
+# Copyright 2026 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     https://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# Auto-generated by gapic-generator-ruby. DO NOT EDIT!
+
+
+module Google
+  module Type
+    # Represents a textual expression in the Common Expression Language (CEL)
+    # syntax. CEL is a C-like expression language. The syntax and semantics of CEL
+    # are documented at https://github.com/google/cel-spec.
+    #
+    # Example (Comparison):
+    #
+    #     title: "Summary size limit"
+    #     description: "Determines if a summary is less than 100 chars"
+    #     expression: "document.summary.size() < 100"
+    #
+    # Example (Equality):
+    #
+    #     title: "Requestor is owner"
+    #     description: "Determines if requestor is the document owner"
+    #     expression: "document.owner == request.auth.claims.email"
+    #
+    # Example (Logic):
+    #
+    #     title: "Public documents"
+    #     description: "Determine whether the document should be publicly visible"
+    #     expression: "document.type != 'private' && document.type != 'internal'"
+    #
+    # Example (Data Manipulation):
+    #
+    #     title: "Notification string"
+    #     description: "Create a notification string with a timestamp."
+    #     expression: "'New message received at ' + string(document.create_time)"
+    #
+    # The exact variables and functions that may be referenced within an expression
+    # are determined by the service that evaluates it. See the service
+    # documentation for additional information.
+    # @!attribute [rw] expression
+    #   @return [::String]
+    #     Textual representation of an expression in Common Expression Language
+    #     syntax.
+    # @!attribute [rw] title
+    #   @return [::String]
+    #     Optional. Title for the expression, i.e. a short string describing
+    #     its purpose. This can be used e.g. in UIs which allow to enter the
+    #     expression.
+    # @!attribute [rw] description
+    #   @return [::String]
+    #     Optional. Description of the expression. This is a longer text which
+    #     describes the expression, e.g. when hovered over it in a UI.
+    # @!attribute [rw] location
+    #   @return [::String]
+    #     Optional. String indicating the location of the expression for error
+    #     reporting, e.g. a file name and a position in the file.
+    class Expr
+      include ::Google::Protobuf::MessageExts
+      extend ::Google::Protobuf::MessageExts::ClassMethods
+    end
+  end
+end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: google-cloud-binary_authorization-v1beta1
 version: !ruby/object:Gem::Version
-  version: 0.18.0
+  version: 0.20.0
 platform: ruby
 authors:
 - Google LLC
@@ -15,14 +15,14 @@ dependencies:
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.2'
+        version: '1.3'
   type: :runtime
   prerelease: false
   version_requirements: !ruby/object:Gem::Requirement
     requirements:
     - - "~>"
       - !ruby/object:Gem::Version
-        version: '1.2'
+        version: '1.3'
 - !ruby/object:Gem::Dependency
   name: google-cloud-errors
   requirement: !ruby/object:Gem::Requirement
@@ -37,6 +37,20 @@ dependencies:
     - - "~>"
       - !ruby/object:Gem::Version
         version: '1.0'
+- !ruby/object:Gem::Dependency
+  name: google-iam-v1
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.3'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - "~>"
+      - !ruby/object:Gem::Version
+        version: '1.3'
 description: Binary Authorization is a service on Google Cloud that provides centralized
   software supply-chain security for applications that run on Google Kubernetes Engine
   (GKE) and GKE on-prem. Note that google-cloud-binary_authorization-v1beta1 is a
@@ -61,6 +75,7 @@ files:
 - lib/google/cloud/binary_authorization/v1beta1/binauthz_management_service/rest.rb
 - lib/google/cloud/binary_authorization/v1beta1/binauthz_management_service/rest/client.rb
 - lib/google/cloud/binary_authorization/v1beta1/binauthz_management_service/rest/service_stub.rb
+- lib/google/cloud/binary_authorization/v1beta1/bindings_override.rb
 - lib/google/cloud/binary_authorization/v1beta1/rest.rb
 - lib/google/cloud/binary_authorization/v1beta1/system_policy.rb
 - lib/google/cloud/binary_authorization/v1beta1/system_policy/client.rb
@@ -84,7 +99,9 @@ files:
 - proto_docs/google/cloud/binaryauthorization/v1beta1/service.rb
 - proto_docs/google/protobuf/duration.rb
 - proto_docs/google/protobuf/empty.rb
+- proto_docs/google/protobuf/field_mask.rb
 - proto_docs/google/protobuf/timestamp.rb
+- proto_docs/google/type/expr.rb
 homepage: https://github.com/googleapis/google-cloud-ruby
 licenses:
 - Apache-2.0
@@ -105,7 +122,7 @@ required_rubygems_version: !ruby/object:Gem::Requirement
 requirements: []
 rubygems_version: 3.6.9
 specification_version: 4
-summary: The management interface for Binary Authorization, a system providing policy
-  control for images deployed to Kubernetes Engine clusters, Anthos clusters on VMware,
-  and Cloud Run.
+summary: The management interface for Binary Authorization, a service that provides
+  policy-based deployment validation and control for images deployed to Google Kubernetes
+  Engine (GKE), Anthos Service Mesh, Anthos Clusters, and Cloud Run.
 test_files: []