google-cloud-org_policy-v2 0.1.0
This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
- checksums.yaml +7 -0
- data/.yardopts +12 -0
- data/AUTHENTICATION.md +169 -0
- data/LICENSE.md +203 -0
- data/README.md +139 -0
- data/lib/google-cloud-org_policy-v2.rb +21 -0
- data/lib/google/cloud/org_policy/v2.rb +38 -0
- data/lib/google/cloud/org_policy/v2/org_policy.rb +68 -0
- data/lib/google/cloud/org_policy/v2/org_policy/client.rb +948 -0
- data/lib/google/cloud/org_policy/v2/org_policy/credentials.rb +51 -0
- data/lib/google/cloud/org_policy/v2/org_policy/paths.rb +127 -0
- data/lib/google/cloud/org_policy/v2/version.rb +28 -0
- data/lib/google/cloud/orgpolicy/v2/constraint_pb.rb +45 -0
- data/lib/google/cloud/orgpolicy/v2/orgpolicy_pb.rb +103 -0
- data/lib/google/cloud/orgpolicy/v2/orgpolicy_services_pb.rb +101 -0
- data/proto_docs/README.md +4 -0
- data/proto_docs/google/api/field_behavior.rb +65 -0
- data/proto_docs/google/api/resource.rb +283 -0
- data/proto_docs/google/cloud/orgpolicy/v2/constraint.rb +120 -0
- data/proto_docs/google/cloud/orgpolicy/v2/orgpolicy.rb +320 -0
- data/proto_docs/google/protobuf/empty.rb +36 -0
- data/proto_docs/google/protobuf/timestamp.rb +129 -0
- data/proto_docs/google/type/expr.rb +52 -0
- metadata +208 -0
@@ -0,0 +1,65 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
|
3
|
+
# Copyright 2021 Google LLC
|
4
|
+
#
|
5
|
+
# Licensed under the Apache License, Version 2.0 (the "License");
|
6
|
+
# you may not use this file except in compliance with the License.
|
7
|
+
# You may obtain a copy of the License at
|
8
|
+
#
|
9
|
+
# https://www.apache.org/licenses/LICENSE-2.0
|
10
|
+
#
|
11
|
+
# Unless required by applicable law or agreed to in writing, software
|
12
|
+
# distributed under the License is distributed on an "AS IS" BASIS,
|
13
|
+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
14
|
+
# See the License for the specific language governing permissions and
|
15
|
+
# limitations under the License.
|
16
|
+
|
17
|
+
# Auto-generated by gapic-generator-ruby. DO NOT EDIT!
|
18
|
+
|
19
|
+
|
20
|
+
module Google
|
21
|
+
module Api
|
22
|
+
# An indicator of the behavior of a given field (for example, that a field
|
23
|
+
# is required in requests, or given as output but ignored as input).
|
24
|
+
# This **does not** change the behavior in protocol buffers itself; it only
|
25
|
+
# denotes the behavior and may affect how API tooling handles the field.
|
26
|
+
#
|
27
|
+
# Note: This enum **may** receive new values in the future.
|
28
|
+
module FieldBehavior
|
29
|
+
# Conventional default for enums. Do not use this.
|
30
|
+
FIELD_BEHAVIOR_UNSPECIFIED = 0
|
31
|
+
|
32
|
+
# Specifically denotes a field as optional.
|
33
|
+
# While all fields in protocol buffers are optional, this may be specified
|
34
|
+
# for emphasis if appropriate.
|
35
|
+
OPTIONAL = 1
|
36
|
+
|
37
|
+
# Denotes a field as required.
|
38
|
+
# This indicates that the field **must** be provided as part of the request,
|
39
|
+
# and failure to do so will cause an error (usually `INVALID_ARGUMENT`).
|
40
|
+
REQUIRED = 2
|
41
|
+
|
42
|
+
# Denotes a field as output only.
|
43
|
+
# This indicates that the field is provided in responses, but including the
|
44
|
+
# field in a request does nothing (the server *must* ignore it and
|
45
|
+
# *must not* throw an error as a result of the field's presence).
|
46
|
+
OUTPUT_ONLY = 3
|
47
|
+
|
48
|
+
# Denotes a field as input only.
|
49
|
+
# This indicates that the field is provided in requests, and the
|
50
|
+
# corresponding field is not included in output.
|
51
|
+
INPUT_ONLY = 4
|
52
|
+
|
53
|
+
# Denotes a field as immutable.
|
54
|
+
# This indicates that the field may be set once in a request to create a
|
55
|
+
# resource, but may not be changed thereafter.
|
56
|
+
IMMUTABLE = 5
|
57
|
+
|
58
|
+
# Denotes that a (repeated) field is an unordered list.
|
59
|
+
# This indicates that the service may provide the elements of the list
|
60
|
+
# in any arbitrary order, rather than the order the user originally
|
61
|
+
# provided. Additionally, the list's order may or may not be stable.
|
62
|
+
UNORDERED_LIST = 6
|
63
|
+
end
|
64
|
+
end
|
65
|
+
end
|
@@ -0,0 +1,283 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
|
3
|
+
# Copyright 2021 Google LLC
|
4
|
+
#
|
5
|
+
# Licensed under the Apache License, Version 2.0 (the "License");
|
6
|
+
# you may not use this file except in compliance with the License.
|
7
|
+
# You may obtain a copy of the License at
|
8
|
+
#
|
9
|
+
# https://www.apache.org/licenses/LICENSE-2.0
|
10
|
+
#
|
11
|
+
# Unless required by applicable law or agreed to in writing, software
|
12
|
+
# distributed under the License is distributed on an "AS IS" BASIS,
|
13
|
+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
14
|
+
# See the License for the specific language governing permissions and
|
15
|
+
# limitations under the License.
|
16
|
+
|
17
|
+
# Auto-generated by gapic-generator-ruby. DO NOT EDIT!
|
18
|
+
|
19
|
+
|
20
|
+
module Google
|
21
|
+
module Api
|
22
|
+
# A simple descriptor of a resource type.
|
23
|
+
#
|
24
|
+
# ResourceDescriptor annotates a resource message (either by means of a
|
25
|
+
# protobuf annotation or use in the service config), and associates the
|
26
|
+
# resource's schema, the resource type, and the pattern of the resource name.
|
27
|
+
#
|
28
|
+
# Example:
|
29
|
+
#
|
30
|
+
# message Topic {
|
31
|
+
# // Indicates this message defines a resource schema.
|
32
|
+
# // Declares the resource type in the format of {service}/{kind}.
|
33
|
+
# // For Kubernetes resources, the format is {api group}/{kind}.
|
34
|
+
# option (google.api.resource) = {
|
35
|
+
# type: "pubsub.googleapis.com/Topic"
|
36
|
+
# name_descriptor: {
|
37
|
+
# pattern: "projects/{project}/topics/{topic}"
|
38
|
+
# parent_type: "cloudresourcemanager.googleapis.com/Project"
|
39
|
+
# parent_name_extractor: "projects/{project}"
|
40
|
+
# }
|
41
|
+
# };
|
42
|
+
# }
|
43
|
+
#
|
44
|
+
# The ResourceDescriptor Yaml config will look like:
|
45
|
+
#
|
46
|
+
# resources:
|
47
|
+
# - type: "pubsub.googleapis.com/Topic"
|
48
|
+
# name_descriptor:
|
49
|
+
# - pattern: "projects/{project}/topics/{topic}"
|
50
|
+
# parent_type: "cloudresourcemanager.googleapis.com/Project"
|
51
|
+
# parent_name_extractor: "projects/{project}"
|
52
|
+
#
|
53
|
+
# Sometimes, resources have multiple patterns, typically because they can
|
54
|
+
# live under multiple parents.
|
55
|
+
#
|
56
|
+
# Example:
|
57
|
+
#
|
58
|
+
# message LogEntry {
|
59
|
+
# option (google.api.resource) = {
|
60
|
+
# type: "logging.googleapis.com/LogEntry"
|
61
|
+
# name_descriptor: {
|
62
|
+
# pattern: "projects/{project}/logs/{log}"
|
63
|
+
# parent_type: "cloudresourcemanager.googleapis.com/Project"
|
64
|
+
# parent_name_extractor: "projects/{project}"
|
65
|
+
# }
|
66
|
+
# name_descriptor: {
|
67
|
+
# pattern: "folders/{folder}/logs/{log}"
|
68
|
+
# parent_type: "cloudresourcemanager.googleapis.com/Folder"
|
69
|
+
# parent_name_extractor: "folders/{folder}"
|
70
|
+
# }
|
71
|
+
# name_descriptor: {
|
72
|
+
# pattern: "organizations/{organization}/logs/{log}"
|
73
|
+
# parent_type: "cloudresourcemanager.googleapis.com/Organization"
|
74
|
+
# parent_name_extractor: "organizations/{organization}"
|
75
|
+
# }
|
76
|
+
# name_descriptor: {
|
77
|
+
# pattern: "billingAccounts/{billing_account}/logs/{log}"
|
78
|
+
# parent_type: "billing.googleapis.com/BillingAccount"
|
79
|
+
# parent_name_extractor: "billingAccounts/{billing_account}"
|
80
|
+
# }
|
81
|
+
# };
|
82
|
+
# }
|
83
|
+
#
|
84
|
+
# The ResourceDescriptor Yaml config will look like:
|
85
|
+
#
|
86
|
+
# resources:
|
87
|
+
# - type: 'logging.googleapis.com/LogEntry'
|
88
|
+
# name_descriptor:
|
89
|
+
# - pattern: "projects/{project}/logs/{log}"
|
90
|
+
# parent_type: "cloudresourcemanager.googleapis.com/Project"
|
91
|
+
# parent_name_extractor: "projects/{project}"
|
92
|
+
# - pattern: "folders/{folder}/logs/{log}"
|
93
|
+
# parent_type: "cloudresourcemanager.googleapis.com/Folder"
|
94
|
+
# parent_name_extractor: "folders/{folder}"
|
95
|
+
# - pattern: "organizations/{organization}/logs/{log}"
|
96
|
+
# parent_type: "cloudresourcemanager.googleapis.com/Organization"
|
97
|
+
# parent_name_extractor: "organizations/{organization}"
|
98
|
+
# - pattern: "billingAccounts/{billing_account}/logs/{log}"
|
99
|
+
# parent_type: "billing.googleapis.com/BillingAccount"
|
100
|
+
# parent_name_extractor: "billingAccounts/{billing_account}"
|
101
|
+
#
|
102
|
+
# For flexible resources, the resource name doesn't contain parent names, but
|
103
|
+
# the resource itself has parents for policy evaluation.
|
104
|
+
#
|
105
|
+
# Example:
|
106
|
+
#
|
107
|
+
# message Shelf {
|
108
|
+
# option (google.api.resource) = {
|
109
|
+
# type: "library.googleapis.com/Shelf"
|
110
|
+
# name_descriptor: {
|
111
|
+
# pattern: "shelves/{shelf}"
|
112
|
+
# parent_type: "cloudresourcemanager.googleapis.com/Project"
|
113
|
+
# }
|
114
|
+
# name_descriptor: {
|
115
|
+
# pattern: "shelves/{shelf}"
|
116
|
+
# parent_type: "cloudresourcemanager.googleapis.com/Folder"
|
117
|
+
# }
|
118
|
+
# };
|
119
|
+
# }
|
120
|
+
#
|
121
|
+
# The ResourceDescriptor Yaml config will look like:
|
122
|
+
#
|
123
|
+
# resources:
|
124
|
+
# - type: 'library.googleapis.com/Shelf'
|
125
|
+
# name_descriptor:
|
126
|
+
# - pattern: "shelves/{shelf}"
|
127
|
+
# parent_type: "cloudresourcemanager.googleapis.com/Project"
|
128
|
+
# - pattern: "shelves/{shelf}"
|
129
|
+
# parent_type: "cloudresourcemanager.googleapis.com/Folder"
|
130
|
+
# @!attribute [rw] type
|
131
|
+
# @return [::String]
|
132
|
+
# The resource type. It must be in the format of
|
133
|
+
# \\{service_name}/\\{resource_type_kind}. The `resource_type_kind` must be
|
134
|
+
# singular and must not include version numbers.
|
135
|
+
#
|
136
|
+
# Example: `storage.googleapis.com/Bucket`
|
137
|
+
#
|
138
|
+
# The value of the resource_type_kind must follow the regular expression
|
139
|
+
# /[A-Za-z][a-zA-Z0-9]+/. It should start with an upper case character and
|
140
|
+
# should use PascalCase (UpperCamelCase). The maximum number of
|
141
|
+
# characters allowed for the `resource_type_kind` is 100.
|
142
|
+
# @!attribute [rw] pattern
|
143
|
+
# @return [::Array<::String>]
|
144
|
+
# Optional. The relative resource name pattern associated with this resource
|
145
|
+
# type. The DNS prefix of the full resource name shouldn't be specified here.
|
146
|
+
#
|
147
|
+
# The path pattern must follow the syntax, which aligns with HTTP binding
|
148
|
+
# syntax:
|
149
|
+
#
|
150
|
+
# Template = Segment { "/" Segment } ;
|
151
|
+
# Segment = LITERAL | Variable ;
|
152
|
+
# Variable = "{" LITERAL "}" ;
|
153
|
+
#
|
154
|
+
# Examples:
|
155
|
+
#
|
156
|
+
# - "projects/\\{project}/topics/\\{topic}"
|
157
|
+
# - "projects/\\{project}/knowledgeBases/\\{knowledge_base}"
|
158
|
+
#
|
159
|
+
# The components in braces correspond to the IDs for each resource in the
|
160
|
+
# hierarchy. It is expected that, if multiple patterns are provided,
|
161
|
+
# the same component name (e.g. "project") refers to IDs of the same
|
162
|
+
# type of resource.
|
163
|
+
# @!attribute [rw] name_field
|
164
|
+
# @return [::String]
|
165
|
+
# Optional. The field on the resource that designates the resource name
|
166
|
+
# field. If omitted, this is assumed to be "name".
|
167
|
+
# @!attribute [rw] history
|
168
|
+
# @return [::Google::Api::ResourceDescriptor::History]
|
169
|
+
# Optional. The historical or future-looking state of the resource pattern.
|
170
|
+
#
|
171
|
+
# Example:
|
172
|
+
#
|
173
|
+
# // The InspectTemplate message originally only supported resource
|
174
|
+
# // names with organization, and project was added later.
|
175
|
+
# message InspectTemplate {
|
176
|
+
# option (google.api.resource) = {
|
177
|
+
# type: "dlp.googleapis.com/InspectTemplate"
|
178
|
+
# pattern:
|
179
|
+
# "organizations/{organization}/inspectTemplates/{inspect_template}"
|
180
|
+
# pattern: "projects/{project}/inspectTemplates/{inspect_template}"
|
181
|
+
# history: ORIGINALLY_SINGLE_PATTERN
|
182
|
+
# };
|
183
|
+
# }
|
184
|
+
# @!attribute [rw] plural
|
185
|
+
# @return [::String]
|
186
|
+
# The plural name used in the resource name and permission names, such as
|
187
|
+
# 'projects' for the resource name of 'projects/\\{project}' and the permission
|
188
|
+
# name of 'cloudresourcemanager.googleapis.com/projects.get'. It is the same
|
189
|
+
# concept of the `plural` field in k8s CRD spec
|
190
|
+
# https://kubernetes.io/docs/tasks/access-kubernetes-api/custom-resources/custom-resource-definitions/
|
191
|
+
#
|
192
|
+
# Note: The plural form is required even for singleton resources. See
|
193
|
+
# https://aip.dev/156
|
194
|
+
# @!attribute [rw] singular
|
195
|
+
# @return [::String]
|
196
|
+
# The same concept of the `singular` field in k8s CRD spec
|
197
|
+
# https://kubernetes.io/docs/tasks/access-kubernetes-api/custom-resources/custom-resource-definitions/
|
198
|
+
# Such as "project" for the `resourcemanager.googleapis.com/Project` type.
|
199
|
+
# @!attribute [rw] style
|
200
|
+
# @return [::Array<::Google::Api::ResourceDescriptor::Style>]
|
201
|
+
# Style flag(s) for this resource.
|
202
|
+
# These indicate that a resource is expected to conform to a given
|
203
|
+
# style. See the specific style flags for additional information.
|
204
|
+
class ResourceDescriptor
|
205
|
+
include ::Google::Protobuf::MessageExts
|
206
|
+
extend ::Google::Protobuf::MessageExts::ClassMethods
|
207
|
+
|
208
|
+
# A description of the historical or future-looking state of the
|
209
|
+
# resource pattern.
|
210
|
+
module History
|
211
|
+
# The "unset" value.
|
212
|
+
HISTORY_UNSPECIFIED = 0
|
213
|
+
|
214
|
+
# The resource originally had one pattern and launched as such, and
|
215
|
+
# additional patterns were added later.
|
216
|
+
ORIGINALLY_SINGLE_PATTERN = 1
|
217
|
+
|
218
|
+
# The resource has one pattern, but the API owner expects to add more
|
219
|
+
# later. (This is the inverse of ORIGINALLY_SINGLE_PATTERN, and prevents
|
220
|
+
# that from being necessary once there are multiple patterns.)
|
221
|
+
FUTURE_MULTI_PATTERN = 2
|
222
|
+
end
|
223
|
+
|
224
|
+
# A flag representing a specific style that a resource claims to conform to.
|
225
|
+
module Style
|
226
|
+
# The unspecified value. Do not use.
|
227
|
+
STYLE_UNSPECIFIED = 0
|
228
|
+
|
229
|
+
# This resource is intended to be "declarative-friendly".
|
230
|
+
#
|
231
|
+
# Declarative-friendly resources must be more strictly consistent, and
|
232
|
+
# setting this to true communicates to tools that this resource should
|
233
|
+
# adhere to declarative-friendly expectations.
|
234
|
+
#
|
235
|
+
# Note: This is used by the API linter (linter.aip.dev) to enable
|
236
|
+
# additional checks.
|
237
|
+
DECLARATIVE_FRIENDLY = 1
|
238
|
+
end
|
239
|
+
end
|
240
|
+
|
241
|
+
# Defines a proto annotation that describes a string field that refers to
|
242
|
+
# an API resource.
|
243
|
+
# @!attribute [rw] type
|
244
|
+
# @return [::String]
|
245
|
+
# The resource type that the annotated field references.
|
246
|
+
#
|
247
|
+
# Example:
|
248
|
+
#
|
249
|
+
# message Subscription {
|
250
|
+
# string topic = 2 [(google.api.resource_reference) = {
|
251
|
+
# type: "pubsub.googleapis.com/Topic"
|
252
|
+
# }];
|
253
|
+
# }
|
254
|
+
#
|
255
|
+
# Occasionally, a field may reference an arbitrary resource. In this case,
|
256
|
+
# APIs use the special value * in their resource reference.
|
257
|
+
#
|
258
|
+
# Example:
|
259
|
+
#
|
260
|
+
# message GetIamPolicyRequest {
|
261
|
+
# string resource = 2 [(google.api.resource_reference) = {
|
262
|
+
# type: "*"
|
263
|
+
# }];
|
264
|
+
# }
|
265
|
+
# @!attribute [rw] child_type
|
266
|
+
# @return [::String]
|
267
|
+
# The resource type of a child collection that the annotated field
|
268
|
+
# references. This is useful for annotating the `parent` field that
|
269
|
+
# doesn't have a fixed resource type.
|
270
|
+
#
|
271
|
+
# Example:
|
272
|
+
#
|
273
|
+
# message ListLogEntriesRequest {
|
274
|
+
# string parent = 1 [(google.api.resource_reference) = {
|
275
|
+
# child_type: "logging.googleapis.com/LogEntry"
|
276
|
+
# };
|
277
|
+
# }
|
278
|
+
class ResourceReference
|
279
|
+
include ::Google::Protobuf::MessageExts
|
280
|
+
extend ::Google::Protobuf::MessageExts::ClassMethods
|
281
|
+
end
|
282
|
+
end
|
283
|
+
end
|
@@ -0,0 +1,120 @@
|
|
1
|
+
# frozen_string_literal: true
|
2
|
+
|
3
|
+
# Copyright 2021 Google LLC
|
4
|
+
#
|
5
|
+
# Licensed under the Apache License, Version 2.0 (the "License");
|
6
|
+
# you may not use this file except in compliance with the License.
|
7
|
+
# You may obtain a copy of the License at
|
8
|
+
#
|
9
|
+
# https://www.apache.org/licenses/LICENSE-2.0
|
10
|
+
#
|
11
|
+
# Unless required by applicable law or agreed to in writing, software
|
12
|
+
# distributed under the License is distributed on an "AS IS" BASIS,
|
13
|
+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
|
14
|
+
# See the License for the specific language governing permissions and
|
15
|
+
# limitations under the License.
|
16
|
+
|
17
|
+
# Auto-generated by gapic-generator-ruby. DO NOT EDIT!
|
18
|
+
|
19
|
+
|
20
|
+
module Google
|
21
|
+
module Cloud
|
22
|
+
module OrgPolicy
|
23
|
+
module V2
|
24
|
+
# A `constraint` describes a way to restrict resource's configuration. For
|
25
|
+
# example, you could enforce a constraint that controls which cloud services
|
26
|
+
# can be activated across an organization, or whether a Compute Engine instance
|
27
|
+
# can have serial port connections established. `Constraints` can be configured
|
28
|
+
# by the organization's policy adminstrator to fit the needs of the organzation
|
29
|
+
# by setting a `policy` that includes `constraints` at different locations in
|
30
|
+
# the organization's resource hierarchy. Policies are inherited down the
|
31
|
+
# resource hierarchy from higher levels, but can also be overridden. For
|
32
|
+
# details about the inheritance rules please read about
|
33
|
+
# [`policies`][google.cloud.OrgPolicy.v2.Policy].
|
34
|
+
#
|
35
|
+
# `Constraints` have a default behavior determined by the `constraint_default`
|
36
|
+
# field, which is the enforcement behavior that is used in the absence of a
|
37
|
+
# `policy` being defined or inherited for the resource in question.
|
38
|
+
# @!attribute [rw] name
|
39
|
+
# @return [::String]
|
40
|
+
# Immutable. The resource name of the Constraint. Must be in one of
|
41
|
+
# the following forms:
|
42
|
+
# * `projects/{project_number}/constraints/{constraint_name}`
|
43
|
+
# * `folders/{folder_id}/constraints/{constraint_name}`
|
44
|
+
# * `organizations/{organization_id}/constraints/{constraint_name}`
|
45
|
+
#
|
46
|
+
# For example, "/projects/123/constraints/compute.disableSerialPortAccess".
|
47
|
+
# @!attribute [rw] display_name
|
48
|
+
# @return [::String]
|
49
|
+
# The human readable name.
|
50
|
+
#
|
51
|
+
# Mutable.
|
52
|
+
# @!attribute [rw] description
|
53
|
+
# @return [::String]
|
54
|
+
# Detailed description of what this `Constraint` controls as well as how and
|
55
|
+
# where it is enforced.
|
56
|
+
#
|
57
|
+
# Mutable.
|
58
|
+
# @!attribute [rw] constraint_default
|
59
|
+
# @return [::Google::Cloud::OrgPolicy::V2::Constraint::ConstraintDefault]
|
60
|
+
# The evaluation behavior of this constraint in the absence of 'Policy'.
|
61
|
+
# @!attribute [rw] list_constraint
|
62
|
+
# @return [::Google::Cloud::OrgPolicy::V2::Constraint::ListConstraint]
|
63
|
+
# Defines this constraint as being a ListConstraint.
|
64
|
+
# @!attribute [rw] boolean_constraint
|
65
|
+
# @return [::Google::Cloud::OrgPolicy::V2::Constraint::BooleanConstraint]
|
66
|
+
# Defines this constraint as being a BooleanConstraint.
|
67
|
+
class Constraint
|
68
|
+
include ::Google::Protobuf::MessageExts
|
69
|
+
extend ::Google::Protobuf::MessageExts::ClassMethods
|
70
|
+
|
71
|
+
# A `Constraint` that allows or disallows a list of string values, which are
|
72
|
+
# configured by an Organization's policy administrator with a `Policy`.
|
73
|
+
# @!attribute [rw] supports_in
|
74
|
+
# @return [::Boolean]
|
75
|
+
# Indicates whether values grouped into categories can be used in
|
76
|
+
# `Policy.allowed_values` and `Policy.denied_values`. For example,
|
77
|
+
# `"in:Python"` would match any value in the 'Python' group.
|
78
|
+
# @!attribute [rw] supports_under
|
79
|
+
# @return [::Boolean]
|
80
|
+
# Indicates whether subtrees of Cloud Resource Manager resource hierarchy
|
81
|
+
# can be used in `Policy.allowed_values` and `Policy.denied_values`. For
|
82
|
+
# example, `"under:folders/123"` would match any resource under the
|
83
|
+
# 'folders/123' folder.
|
84
|
+
class ListConstraint
|
85
|
+
include ::Google::Protobuf::MessageExts
|
86
|
+
extend ::Google::Protobuf::MessageExts::ClassMethods
|
87
|
+
end
|
88
|
+
|
89
|
+
# A `Constraint` that is either enforced or not.
|
90
|
+
#
|
91
|
+
# For example a constraint `constraints/compute.disableSerialPortAccess`.
|
92
|
+
# If it is enforced on a VM instance, serial port connections will not be
|
93
|
+
# opened to that instance.
|
94
|
+
class BooleanConstraint
|
95
|
+
include ::Google::Protobuf::MessageExts
|
96
|
+
extend ::Google::Protobuf::MessageExts::ClassMethods
|
97
|
+
end
|
98
|
+
|
99
|
+
# Specifies the default behavior in the absence of any `Policy` for the
|
100
|
+
# `Constraint`. This must not be `CONSTRAINT_DEFAULT_UNSPECIFIED`.
|
101
|
+
#
|
102
|
+
# Immutable after creation.
|
103
|
+
module ConstraintDefault
|
104
|
+
# This is only used for distinguishing unset values and should never be
|
105
|
+
# used.
|
106
|
+
CONSTRAINT_DEFAULT_UNSPECIFIED = 0
|
107
|
+
|
108
|
+
# Indicate that all values are allowed for list constraints.
|
109
|
+
# Indicate that enforcement is off for boolean constraints.
|
110
|
+
ALLOW = 1
|
111
|
+
|
112
|
+
# Indicate that all values are denied for list constraints.
|
113
|
+
# Indicate that enforcement is on for boolean constraints.
|
114
|
+
DENY = 2
|
115
|
+
end
|
116
|
+
end
|
117
|
+
end
|
118
|
+
end
|
119
|
+
end
|
120
|
+
end
|