google-cloud-org_policy-v2 0.1.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
@@ -0,0 +1,4 @@
1
+ # Organization Policy V2 Protocol Buffer Documentation
2
+
3
+ These files are for the YARD documentation of the generated protobuf files.
4
+ They are not intended to be required or loaded at runtime.
@@ -0,0 +1,65 @@
1
+ # frozen_string_literal: true
2
+
3
+ # Copyright 2021 Google LLC
4
+ #
5
+ # Licensed under the Apache License, Version 2.0 (the "License");
6
+ # you may not use this file except in compliance with the License.
7
+ # You may obtain a copy of the License at
8
+ #
9
+ # https://www.apache.org/licenses/LICENSE-2.0
10
+ #
11
+ # Unless required by applicable law or agreed to in writing, software
12
+ # distributed under the License is distributed on an "AS IS" BASIS,
13
+ # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14
+ # See the License for the specific language governing permissions and
15
+ # limitations under the License.
16
+
17
+ # Auto-generated by gapic-generator-ruby. DO NOT EDIT!
18
+
19
+
20
+ module Google
21
+ module Api
22
+ # An indicator of the behavior of a given field (for example, that a field
23
+ # is required in requests, or given as output but ignored as input).
24
+ # This **does not** change the behavior in protocol buffers itself; it only
25
+ # denotes the behavior and may affect how API tooling handles the field.
26
+ #
27
+ # Note: This enum **may** receive new values in the future.
28
+ module FieldBehavior
29
+ # Conventional default for enums. Do not use this.
30
+ FIELD_BEHAVIOR_UNSPECIFIED = 0
31
+
32
+ # Specifically denotes a field as optional.
33
+ # While all fields in protocol buffers are optional, this may be specified
34
+ # for emphasis if appropriate.
35
+ OPTIONAL = 1
36
+
37
+ # Denotes a field as required.
38
+ # This indicates that the field **must** be provided as part of the request,
39
+ # and failure to do so will cause an error (usually `INVALID_ARGUMENT`).
40
+ REQUIRED = 2
41
+
42
+ # Denotes a field as output only.
43
+ # This indicates that the field is provided in responses, but including the
44
+ # field in a request does nothing (the server *must* ignore it and
45
+ # *must not* throw an error as a result of the field's presence).
46
+ OUTPUT_ONLY = 3
47
+
48
+ # Denotes a field as input only.
49
+ # This indicates that the field is provided in requests, and the
50
+ # corresponding field is not included in output.
51
+ INPUT_ONLY = 4
52
+
53
+ # Denotes a field as immutable.
54
+ # This indicates that the field may be set once in a request to create a
55
+ # resource, but may not be changed thereafter.
56
+ IMMUTABLE = 5
57
+
58
+ # Denotes that a (repeated) field is an unordered list.
59
+ # This indicates that the service may provide the elements of the list
60
+ # in any arbitrary order, rather than the order the user originally
61
+ # provided. Additionally, the list's order may or may not be stable.
62
+ UNORDERED_LIST = 6
63
+ end
64
+ end
65
+ end
@@ -0,0 +1,283 @@
1
+ # frozen_string_literal: true
2
+
3
+ # Copyright 2021 Google LLC
4
+ #
5
+ # Licensed under the Apache License, Version 2.0 (the "License");
6
+ # you may not use this file except in compliance with the License.
7
+ # You may obtain a copy of the License at
8
+ #
9
+ # https://www.apache.org/licenses/LICENSE-2.0
10
+ #
11
+ # Unless required by applicable law or agreed to in writing, software
12
+ # distributed under the License is distributed on an "AS IS" BASIS,
13
+ # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14
+ # See the License for the specific language governing permissions and
15
+ # limitations under the License.
16
+
17
+ # Auto-generated by gapic-generator-ruby. DO NOT EDIT!
18
+
19
+
20
+ module Google
21
+ module Api
22
+ # A simple descriptor of a resource type.
23
+ #
24
+ # ResourceDescriptor annotates a resource message (either by means of a
25
+ # protobuf annotation or use in the service config), and associates the
26
+ # resource's schema, the resource type, and the pattern of the resource name.
27
+ #
28
+ # Example:
29
+ #
30
+ # message Topic {
31
+ # // Indicates this message defines a resource schema.
32
+ # // Declares the resource type in the format of {service}/{kind}.
33
+ # // For Kubernetes resources, the format is {api group}/{kind}.
34
+ # option (google.api.resource) = {
35
+ # type: "pubsub.googleapis.com/Topic"
36
+ # name_descriptor: {
37
+ # pattern: "projects/{project}/topics/{topic}"
38
+ # parent_type: "cloudresourcemanager.googleapis.com/Project"
39
+ # parent_name_extractor: "projects/{project}"
40
+ # }
41
+ # };
42
+ # }
43
+ #
44
+ # The ResourceDescriptor Yaml config will look like:
45
+ #
46
+ # resources:
47
+ # - type: "pubsub.googleapis.com/Topic"
48
+ # name_descriptor:
49
+ # - pattern: "projects/{project}/topics/{topic}"
50
+ # parent_type: "cloudresourcemanager.googleapis.com/Project"
51
+ # parent_name_extractor: "projects/{project}"
52
+ #
53
+ # Sometimes, resources have multiple patterns, typically because they can
54
+ # live under multiple parents.
55
+ #
56
+ # Example:
57
+ #
58
+ # message LogEntry {
59
+ # option (google.api.resource) = {
60
+ # type: "logging.googleapis.com/LogEntry"
61
+ # name_descriptor: {
62
+ # pattern: "projects/{project}/logs/{log}"
63
+ # parent_type: "cloudresourcemanager.googleapis.com/Project"
64
+ # parent_name_extractor: "projects/{project}"
65
+ # }
66
+ # name_descriptor: {
67
+ # pattern: "folders/{folder}/logs/{log}"
68
+ # parent_type: "cloudresourcemanager.googleapis.com/Folder"
69
+ # parent_name_extractor: "folders/{folder}"
70
+ # }
71
+ # name_descriptor: {
72
+ # pattern: "organizations/{organization}/logs/{log}"
73
+ # parent_type: "cloudresourcemanager.googleapis.com/Organization"
74
+ # parent_name_extractor: "organizations/{organization}"
75
+ # }
76
+ # name_descriptor: {
77
+ # pattern: "billingAccounts/{billing_account}/logs/{log}"
78
+ # parent_type: "billing.googleapis.com/BillingAccount"
79
+ # parent_name_extractor: "billingAccounts/{billing_account}"
80
+ # }
81
+ # };
82
+ # }
83
+ #
84
+ # The ResourceDescriptor Yaml config will look like:
85
+ #
86
+ # resources:
87
+ # - type: 'logging.googleapis.com/LogEntry'
88
+ # name_descriptor:
89
+ # - pattern: "projects/{project}/logs/{log}"
90
+ # parent_type: "cloudresourcemanager.googleapis.com/Project"
91
+ # parent_name_extractor: "projects/{project}"
92
+ # - pattern: "folders/{folder}/logs/{log}"
93
+ # parent_type: "cloudresourcemanager.googleapis.com/Folder"
94
+ # parent_name_extractor: "folders/{folder}"
95
+ # - pattern: "organizations/{organization}/logs/{log}"
96
+ # parent_type: "cloudresourcemanager.googleapis.com/Organization"
97
+ # parent_name_extractor: "organizations/{organization}"
98
+ # - pattern: "billingAccounts/{billing_account}/logs/{log}"
99
+ # parent_type: "billing.googleapis.com/BillingAccount"
100
+ # parent_name_extractor: "billingAccounts/{billing_account}"
101
+ #
102
+ # For flexible resources, the resource name doesn't contain parent names, but
103
+ # the resource itself has parents for policy evaluation.
104
+ #
105
+ # Example:
106
+ #
107
+ # message Shelf {
108
+ # option (google.api.resource) = {
109
+ # type: "library.googleapis.com/Shelf"
110
+ # name_descriptor: {
111
+ # pattern: "shelves/{shelf}"
112
+ # parent_type: "cloudresourcemanager.googleapis.com/Project"
113
+ # }
114
+ # name_descriptor: {
115
+ # pattern: "shelves/{shelf}"
116
+ # parent_type: "cloudresourcemanager.googleapis.com/Folder"
117
+ # }
118
+ # };
119
+ # }
120
+ #
121
+ # The ResourceDescriptor Yaml config will look like:
122
+ #
123
+ # resources:
124
+ # - type: 'library.googleapis.com/Shelf'
125
+ # name_descriptor:
126
+ # - pattern: "shelves/{shelf}"
127
+ # parent_type: "cloudresourcemanager.googleapis.com/Project"
128
+ # - pattern: "shelves/{shelf}"
129
+ # parent_type: "cloudresourcemanager.googleapis.com/Folder"
130
+ # @!attribute [rw] type
131
+ # @return [::String]
132
+ # The resource type. It must be in the format of
133
+ # \\{service_name}/\\{resource_type_kind}. The `resource_type_kind` must be
134
+ # singular and must not include version numbers.
135
+ #
136
+ # Example: `storage.googleapis.com/Bucket`
137
+ #
138
+ # The value of the resource_type_kind must follow the regular expression
139
+ # /[A-Za-z][a-zA-Z0-9]+/. It should start with an upper case character and
140
+ # should use PascalCase (UpperCamelCase). The maximum number of
141
+ # characters allowed for the `resource_type_kind` is 100.
142
+ # @!attribute [rw] pattern
143
+ # @return [::Array<::String>]
144
+ # Optional. The relative resource name pattern associated with this resource
145
+ # type. The DNS prefix of the full resource name shouldn't be specified here.
146
+ #
147
+ # The path pattern must follow the syntax, which aligns with HTTP binding
148
+ # syntax:
149
+ #
150
+ # Template = Segment { "/" Segment } ;
151
+ # Segment = LITERAL | Variable ;
152
+ # Variable = "{" LITERAL "}" ;
153
+ #
154
+ # Examples:
155
+ #
156
+ # - "projects/\\{project}/topics/\\{topic}"
157
+ # - "projects/\\{project}/knowledgeBases/\\{knowledge_base}"
158
+ #
159
+ # The components in braces correspond to the IDs for each resource in the
160
+ # hierarchy. It is expected that, if multiple patterns are provided,
161
+ # the same component name (e.g. "project") refers to IDs of the same
162
+ # type of resource.
163
+ # @!attribute [rw] name_field
164
+ # @return [::String]
165
+ # Optional. The field on the resource that designates the resource name
166
+ # field. If omitted, this is assumed to be "name".
167
+ # @!attribute [rw] history
168
+ # @return [::Google::Api::ResourceDescriptor::History]
169
+ # Optional. The historical or future-looking state of the resource pattern.
170
+ #
171
+ # Example:
172
+ #
173
+ # // The InspectTemplate message originally only supported resource
174
+ # // names with organization, and project was added later.
175
+ # message InspectTemplate {
176
+ # option (google.api.resource) = {
177
+ # type: "dlp.googleapis.com/InspectTemplate"
178
+ # pattern:
179
+ # "organizations/{organization}/inspectTemplates/{inspect_template}"
180
+ # pattern: "projects/{project}/inspectTemplates/{inspect_template}"
181
+ # history: ORIGINALLY_SINGLE_PATTERN
182
+ # };
183
+ # }
184
+ # @!attribute [rw] plural
185
+ # @return [::String]
186
+ # The plural name used in the resource name and permission names, such as
187
+ # 'projects' for the resource name of 'projects/\\{project}' and the permission
188
+ # name of 'cloudresourcemanager.googleapis.com/projects.get'. It is the same
189
+ # concept of the `plural` field in k8s CRD spec
190
+ # https://kubernetes.io/docs/tasks/access-kubernetes-api/custom-resources/custom-resource-definitions/
191
+ #
192
+ # Note: The plural form is required even for singleton resources. See
193
+ # https://aip.dev/156
194
+ # @!attribute [rw] singular
195
+ # @return [::String]
196
+ # The same concept of the `singular` field in k8s CRD spec
197
+ # https://kubernetes.io/docs/tasks/access-kubernetes-api/custom-resources/custom-resource-definitions/
198
+ # Such as "project" for the `resourcemanager.googleapis.com/Project` type.
199
+ # @!attribute [rw] style
200
+ # @return [::Array<::Google::Api::ResourceDescriptor::Style>]
201
+ # Style flag(s) for this resource.
202
+ # These indicate that a resource is expected to conform to a given
203
+ # style. See the specific style flags for additional information.
204
+ class ResourceDescriptor
205
+ include ::Google::Protobuf::MessageExts
206
+ extend ::Google::Protobuf::MessageExts::ClassMethods
207
+
208
+ # A description of the historical or future-looking state of the
209
+ # resource pattern.
210
+ module History
211
+ # The "unset" value.
212
+ HISTORY_UNSPECIFIED = 0
213
+
214
+ # The resource originally had one pattern and launched as such, and
215
+ # additional patterns were added later.
216
+ ORIGINALLY_SINGLE_PATTERN = 1
217
+
218
+ # The resource has one pattern, but the API owner expects to add more
219
+ # later. (This is the inverse of ORIGINALLY_SINGLE_PATTERN, and prevents
220
+ # that from being necessary once there are multiple patterns.)
221
+ FUTURE_MULTI_PATTERN = 2
222
+ end
223
+
224
+ # A flag representing a specific style that a resource claims to conform to.
225
+ module Style
226
+ # The unspecified value. Do not use.
227
+ STYLE_UNSPECIFIED = 0
228
+
229
+ # This resource is intended to be "declarative-friendly".
230
+ #
231
+ # Declarative-friendly resources must be more strictly consistent, and
232
+ # setting this to true communicates to tools that this resource should
233
+ # adhere to declarative-friendly expectations.
234
+ #
235
+ # Note: This is used by the API linter (linter.aip.dev) to enable
236
+ # additional checks.
237
+ DECLARATIVE_FRIENDLY = 1
238
+ end
239
+ end
240
+
241
+ # Defines a proto annotation that describes a string field that refers to
242
+ # an API resource.
243
+ # @!attribute [rw] type
244
+ # @return [::String]
245
+ # The resource type that the annotated field references.
246
+ #
247
+ # Example:
248
+ #
249
+ # message Subscription {
250
+ # string topic = 2 [(google.api.resource_reference) = {
251
+ # type: "pubsub.googleapis.com/Topic"
252
+ # }];
253
+ # }
254
+ #
255
+ # Occasionally, a field may reference an arbitrary resource. In this case,
256
+ # APIs use the special value * in their resource reference.
257
+ #
258
+ # Example:
259
+ #
260
+ # message GetIamPolicyRequest {
261
+ # string resource = 2 [(google.api.resource_reference) = {
262
+ # type: "*"
263
+ # }];
264
+ # }
265
+ # @!attribute [rw] child_type
266
+ # @return [::String]
267
+ # The resource type of a child collection that the annotated field
268
+ # references. This is useful for annotating the `parent` field that
269
+ # doesn't have a fixed resource type.
270
+ #
271
+ # Example:
272
+ #
273
+ # message ListLogEntriesRequest {
274
+ # string parent = 1 [(google.api.resource_reference) = {
275
+ # child_type: "logging.googleapis.com/LogEntry"
276
+ # };
277
+ # }
278
+ class ResourceReference
279
+ include ::Google::Protobuf::MessageExts
280
+ extend ::Google::Protobuf::MessageExts::ClassMethods
281
+ end
282
+ end
283
+ end
@@ -0,0 +1,120 @@
1
+ # frozen_string_literal: true
2
+
3
+ # Copyright 2021 Google LLC
4
+ #
5
+ # Licensed under the Apache License, Version 2.0 (the "License");
6
+ # you may not use this file except in compliance with the License.
7
+ # You may obtain a copy of the License at
8
+ #
9
+ # https://www.apache.org/licenses/LICENSE-2.0
10
+ #
11
+ # Unless required by applicable law or agreed to in writing, software
12
+ # distributed under the License is distributed on an "AS IS" BASIS,
13
+ # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14
+ # See the License for the specific language governing permissions and
15
+ # limitations under the License.
16
+
17
+ # Auto-generated by gapic-generator-ruby. DO NOT EDIT!
18
+
19
+
20
+ module Google
21
+ module Cloud
22
+ module OrgPolicy
23
+ module V2
24
+ # A `constraint` describes a way to restrict resource's configuration. For
25
+ # example, you could enforce a constraint that controls which cloud services
26
+ # can be activated across an organization, or whether a Compute Engine instance
27
+ # can have serial port connections established. `Constraints` can be configured
28
+ # by the organization's policy adminstrator to fit the needs of the organzation
29
+ # by setting a `policy` that includes `constraints` at different locations in
30
+ # the organization's resource hierarchy. Policies are inherited down the
31
+ # resource hierarchy from higher levels, but can also be overridden. For
32
+ # details about the inheritance rules please read about
33
+ # [`policies`][google.cloud.OrgPolicy.v2.Policy].
34
+ #
35
+ # `Constraints` have a default behavior determined by the `constraint_default`
36
+ # field, which is the enforcement behavior that is used in the absence of a
37
+ # `policy` being defined or inherited for the resource in question.
38
+ # @!attribute [rw] name
39
+ # @return [::String]
40
+ # Immutable. The resource name of the Constraint. Must be in one of
41
+ # the following forms:
42
+ # * `projects/{project_number}/constraints/{constraint_name}`
43
+ # * `folders/{folder_id}/constraints/{constraint_name}`
44
+ # * `organizations/{organization_id}/constraints/{constraint_name}`
45
+ #
46
+ # For example, "/projects/123/constraints/compute.disableSerialPortAccess".
47
+ # @!attribute [rw] display_name
48
+ # @return [::String]
49
+ # The human readable name.
50
+ #
51
+ # Mutable.
52
+ # @!attribute [rw] description
53
+ # @return [::String]
54
+ # Detailed description of what this `Constraint` controls as well as how and
55
+ # where it is enforced.
56
+ #
57
+ # Mutable.
58
+ # @!attribute [rw] constraint_default
59
+ # @return [::Google::Cloud::OrgPolicy::V2::Constraint::ConstraintDefault]
60
+ # The evaluation behavior of this constraint in the absence of 'Policy'.
61
+ # @!attribute [rw] list_constraint
62
+ # @return [::Google::Cloud::OrgPolicy::V2::Constraint::ListConstraint]
63
+ # Defines this constraint as being a ListConstraint.
64
+ # @!attribute [rw] boolean_constraint
65
+ # @return [::Google::Cloud::OrgPolicy::V2::Constraint::BooleanConstraint]
66
+ # Defines this constraint as being a BooleanConstraint.
67
+ class Constraint
68
+ include ::Google::Protobuf::MessageExts
69
+ extend ::Google::Protobuf::MessageExts::ClassMethods
70
+
71
+ # A `Constraint` that allows or disallows a list of string values, which are
72
+ # configured by an Organization's policy administrator with a `Policy`.
73
+ # @!attribute [rw] supports_in
74
+ # @return [::Boolean]
75
+ # Indicates whether values grouped into categories can be used in
76
+ # `Policy.allowed_values` and `Policy.denied_values`. For example,
77
+ # `"in:Python"` would match any value in the 'Python' group.
78
+ # @!attribute [rw] supports_under
79
+ # @return [::Boolean]
80
+ # Indicates whether subtrees of Cloud Resource Manager resource hierarchy
81
+ # can be used in `Policy.allowed_values` and `Policy.denied_values`. For
82
+ # example, `"under:folders/123"` would match any resource under the
83
+ # 'folders/123' folder.
84
+ class ListConstraint
85
+ include ::Google::Protobuf::MessageExts
86
+ extend ::Google::Protobuf::MessageExts::ClassMethods
87
+ end
88
+
89
+ # A `Constraint` that is either enforced or not.
90
+ #
91
+ # For example a constraint `constraints/compute.disableSerialPortAccess`.
92
+ # If it is enforced on a VM instance, serial port connections will not be
93
+ # opened to that instance.
94
+ class BooleanConstraint
95
+ include ::Google::Protobuf::MessageExts
96
+ extend ::Google::Protobuf::MessageExts::ClassMethods
97
+ end
98
+
99
+ # Specifies the default behavior in the absence of any `Policy` for the
100
+ # `Constraint`. This must not be `CONSTRAINT_DEFAULT_UNSPECIFIED`.
101
+ #
102
+ # Immutable after creation.
103
+ module ConstraintDefault
104
+ # This is only used for distinguishing unset values and should never be
105
+ # used.
106
+ CONSTRAINT_DEFAULT_UNSPECIFIED = 0
107
+
108
+ # Indicate that all values are allowed for list constraints.
109
+ # Indicate that enforcement is off for boolean constraints.
110
+ ALLOW = 1
111
+
112
+ # Indicate that all values are denied for list constraints.
113
+ # Indicate that enforcement is on for boolean constraints.
114
+ DENY = 2
115
+ end
116
+ end
117
+ end
118
+ end
119
+ end
120
+ end