google-cloud-sql-v1 0.8.0 → 0.9.0

data/proto_docs/google/cloud/sql/v1/cloud_sql_instances.rb

@@ -425,6 +425,40 @@ module Google
           extend ::Google::Protobuf::MessageExts::ClassMethods
         end
 
+        # Instance start request.
+        # @!attribute [rw] instance
+        #   @return [::String]
+        #     Required. Cloud SQL instance ID. This does not include the project ID.
+        # @!attribute [rw] project
+        #   @return [::String]
+        #     Required. Project ID of the project that contains the instance to be
+        #     started.
+        # @!attribute [rw] location
+        #   @return [::String]
+        #     Optional. The region of the Cloud SQL instance, for example `us-central1`.
+        #     If omitted, the region is determined from the instance.
+        class SqlInstancesStartRequest
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Instance stop request.
+        # @!attribute [rw] instance
+        #   @return [::String]
+        #     Required. Cloud SQL instance ID. This does not include the project ID.
+        # @!attribute [rw] project
+        #   @return [::String]
+        #     Required. Project ID of the project that contains the instance to be
+        #     stopped.
+        # @!attribute [rw] location
+        #   @return [::String]
+        #     Optional. The region of the Cloud SQL instance, for example `us-central1`.
+        #     If omitted, the region is determined from the instance.
+        class SqlInstancesStopRequest
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
         # Instance restore backup request.
         # @!attribute [rw] instance
         #   @return [::String]
@@ -1484,6 +1518,15 @@ module Google
         #   @return [::Google::Cloud::Sql::V1::DatabaseInstance::DatabaseCenterIntegration]
         #     Optional. State of the Database Center integration for this instance.
         #     When unspecified, Database Center integration is enabled by default.
+        # @!attribute [r] workload_replay_config
+        #   @return [::Google::Cloud::Sql::V1::WorkloadReplayConfig]
+        #     Output only. The workload replay configuration for this instance. This
+        #     field is set only for workload replay instances.
+        # @!attribute [r] workload_capture_config
+        #   @return [::Google::Cloud::Sql::V1::WorkloadCaptureConfig]
+        #     Output only. The workload capture configuration for this instance. This
+        #     field is set only when an active workload capture is present on the
+        #     instance.
         class DatabaseInstance
           include ::Google::Protobuf::MessageExts
           extend ::Google::Protobuf::MessageExts::ClassMethods
@@ -1712,6 +1755,135 @@ module Google
           end
         end
 
+        # The workload replay configuration for a Cloud SQL replay instance.
+        # @!attribute [r] workload_id
+        #   @return [::String]
+        #     Output only. The ID of the captured workload being replayed.
+        # @!attribute [r] source_instance
+        #   @return [::String]
+        #     Output only. The name of the source instance, excluding the project ID,
+        #     where the workload was captured.
+        # @!attribute [r] replay_mode
+        #   @return [::Google::Cloud::Sql::V1::WorkloadReplayConfig::ReplayMode]
+        #     Output only. The mode of the workload replay.
+        # @!attribute [r] state
+        #   @return [::Google::Cloud::Sql::V1::WorkloadReplayConfig::State]
+        #     Output only. The state of the workload replay.
+        # @!attribute [r] start_time
+        #   @return [::Google::Protobuf::Timestamp]
+        #     Output only. The start time of the workload replay.
+        # @!attribute [r] end_time
+        #   @return [::Google::Protobuf::Timestamp]
+        #     Output only. The end time of the workload replay. This field is unset while
+        #     the replay is running.
+        class WorkloadReplayConfig
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+
+          # The mode of workload replay.
+          module ReplayMode
+            # Default value. This value is unused.
+            REPLAY_MODE_UNSPECIFIED = 0
+
+            # Live workload replay mode.
+            LIVE = 1
+
+            # Offline (delayed) workload replay mode.
+            OFFLINE = 2
+          end
+
+          # The state of the workload replay.
+          module State
+            # Default value. This value is unused.
+            STATE_UNSPECIFIED = 0
+
+            # Workload replay is currently running.
+            RUNNING = 1
+
+            # Workload replay completed successfully. Cloud SQL sets this state when
+            # all captured workload files finish replaying or when you explicitly
+            # stop the replay.
+            COMPLETED = 2
+
+            # Workload replay failed.
+            FAILED = 3
+
+            # Workload replay was terminated automatically. Cloud SQL sets this state
+            # when it automatically stops the replay because of a conflicting
+            # operation.
+            TERMINATED = 4
+          end
+        end
+
+        # The workload capture configuration for a Cloud SQL primary instance.
+        # @!attribute [r] workload_id
+        #   @return [::String]
+        #     Output only. The ID of the captured workload.
+        # @!attribute [r] capture_mode
+        #   @return [::Google::Cloud::Sql::V1::WorkloadCaptureConfig::CaptureMode]
+        #     Output only. The mode of the workload capture.
+        # @!attribute [r] state
+        #   @return [::Google::Cloud::Sql::V1::WorkloadCaptureConfig::State]
+        #     Output only. The state of the workload capture.
+        # @!attribute [r] start_time
+        #   @return [::Google::Protobuf::Timestamp]
+        #     Output only. The start time of the workload capture.
+        # @!attribute [r] end_time
+        #   @return [::Google::Protobuf::Timestamp]
+        #     Output only. The end time of the workload capture. This field is unset
+        #     while the capture is running.
+        # @!attribute [r] replay_instance
+        #   @return [::String]
+        #     Output only. The name of the replay instance, excluding the project ID, if
+        #     live replay is enabled.
+        # @!attribute [r] retention_days
+        #   @return [::Integer]
+        #     Output only. The retention period in days for the captured workload.
+        # @!attribute [r] backup_id
+        #   @return [::String]
+        #     Output only. The base backup ID associated with the workload capture.
+        # @!attribute [r] max_capture_duration
+        #   @return [::Google::Protobuf::Duration]
+        #     Output only. The maximum duration for this workload capture.
+        class WorkloadCaptureConfig
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+
+          # The mode of workload capture.
+          module CaptureMode
+            # Default value. This value is unused.
+            CAPTURE_MODE_UNSPECIFIED = 0
+
+            # Captures the workload on the primary instance without live replay.
+            CAPTURE_ONLY = 1
+
+            # Captures the workload and simultaneously replays it on a live replay
+            # instance.
+            CAPTURE_AND_LIVE_REPLAY = 2
+          end
+
+          # The state of the workload capture.
+          module State
+            # Default value. This value is unused.
+            STATE_UNSPECIFIED = 0
+
+            # Workload capture is currently running.
+            RUNNING = 1
+
+            # Workload capture completed successfully. Cloud SQL sets this state when
+            # you explicitly stop the capture.
+            COMPLETED = 2
+
+            # Workload capture failed.
+            FAILED = 3
+
+            # Workload capture was terminated automatically. Cloud SQL sets this state
+            # when it automatically stops the capture because of a conflicting
+            # operation or because the capture reached its maximum duration.
+            TERMINATED = 4
+          end
+        end
+
         # Gemini instance configuration.
         # @!attribute [r] entitled
         #   @return [::Boolean]
@@ -2283,6 +2455,25 @@ module Google
           extend ::Google::Protobuf::MessageExts::ClassMethods
         end
 
+        # Execute SQL statements request.
+        # Execute SQL statements in read-only mode request.
+        # @!attribute [rw] instance
+        #   @return [::String]
+        #     Required. Database instance ID. This does not include the project ID.
+        # @!attribute [rw] project
+        #   @return [::String]
+        #     Required. Project ID of the project that contains the instance.
+        # @!attribute [rw] body
+        #   @return [::Google::Cloud::Sql::V1::ExecuteSqlReadOnlyPayload]
+        #     Required. The request body.
+        # @!attribute [rw] location
+        #   @return [::String]
+        #     Optional. Region of the Cloud SQL instance.
+        class SqlInstancesExecuteSqlReadOnlyRequest
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
         # @!attribute [rw] instance
         #   @return [::String]
         #     Required. Database instance ID. This does not include the project ID.
@@ -2300,6 +2491,47 @@ module Google
           extend ::Google::Protobuf::MessageExts::ClassMethods
         end
 
+        # The request payload used to execute SQL statements in read-only mode.
+        # @!attribute [rw] user
+        #   @return [::String]
+        #     Optional. The name of an existing database user to connect to the database.
+        #     When `auto_iam_authn` is set to true, this field is ignored and the API
+        #     caller's IAM user is used.
+        # @!attribute [rw] sql_statement
+        #   @return [::String]
+        #     Required. SQL statements to run on the database. It can be a single
+        #     statement or a sequence of statements separated by semicolons.
+        # @!attribute [rw] database
+        #   @return [::String]
+        #     Optional. Name of the database on which the statement will be executed.
+        #     For Postgres and SQL Server it's required, for MySQL it's optional.
+        # @!attribute [rw] password_secret_version
+        #   @return [::String]
+        #     Optional. The resource name of the Secret Manager secret holding the
+        #     password for the user to log into the database. The secret should be
+        #     created using the regional endpoint (for API) or from the Regional
+        #     Secrets page (for UI), and stored in the same region as the Cloud SQL
+        #     instance. The expected resource name format is
+        #     `projects/{project}/locations/{location}/secrets/{secret}/versions/{secret_version}`.
+        #     This field is used together with the `user` field.
+        #     The secret resource name will not be stored.
+        #
+        #     Note: The following fields are mutually exclusive: `password_secret_version`, `auto_iam_authn`. If a field in that set is populated, all other fields in the set will automatically be cleared.
+        # @!attribute [rw] auto_iam_authn
+        #   @return [::Boolean]
+        #     Optional. When set to true, the API caller identity associated with the
+        #     request is used for database authentication. The API caller must be an
+        #     IAM user in the database.
+        #
+        #     Note: The following fields are mutually exclusive: `auto_iam_authn`, `password_secret_version`. If a field in that set is populated, all other fields in the set will automatically be cleared.
+        # @!attribute [rw] row_limit
+        #   @return [::Integer]
+        #     Optional. The maximum number of rows returned per SQL statement.
+        class ExecuteSqlReadOnlyPayload
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
         # The request payload used to execute SQL statements.
         # @!attribute [rw] user
         #   @return [::String]
@@ -2367,6 +2599,30 @@ module Google
           end
         end
 
+        # Execute SQL statements response.
+        # Execute SQL statements in read-only mode response.
+        # @!attribute [rw] messages
+        #   @return [::Array<::Google::Cloud::Sql::V1::SqlInstancesExecuteSqlResponse::Message>]
+        #     A list of notices and warnings generated during query execution.
+        #     For PostgreSQL, this includes all notices and warnings.
+        #     For MySQL, this includes warnings generated by the last executed statement.
+        #     To retrieve all warnings for a multi-statement query, `SHOW WARNINGS` must
+        #     be executed after each statement.
+        # @!attribute [rw] metadata
+        #   @return [::Google::Cloud::Sql::V1::Metadata]
+        #     The additional metadata information regarding the execution of the SQL
+        #     statements.
+        # @!attribute [rw] results
+        #   @return [::Array<::Google::Cloud::Sql::V1::QueryResult>]
+        #     The list of results after executing all the SQL statements.
+        # @!attribute [rw] status
+        #   @return [::Google::Rpc::Status]
+        #     Contains the error from the database if the SQL execution failed.
+        class SqlInstancesExecuteSqlReadOnlyResponse
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
         # @!attribute [rw] messages
         #   @return [::Array<::Google::Cloud::Sql::V1::SqlInstancesExecuteSqlResponse::Message>]
         #     A list of notices and warnings generated during query execution.
@@ -2544,6 +2800,48 @@ module Google
           extend ::Google::Protobuf::MessageExts::ClassMethods
         end
 
+        # Request message for SqlInstancesService.ReconcileNetworking.
+        # @!attribute [rw] instance
+        #   @return [::String]
+        #     Required. Cloud SQL instance ID.
+        # @!attribute [rw] project
+        #   @return [::String]
+        #     Required. Project ID of the project that contains the instance.
+        # @!attribute [rw] psc_dns
+        #   @return [::Google::Cloud::Sql::V1::PscDnsReconcileNetworkingRequest]
+        #     Request to recreate Private Service Connect DNS write endpoints and
+        #     reconcile Private Service Connect connectivity infrastructure for the
+        #     instance.
+        # @!attribute [rw] location
+        #   @return [::String]
+        #     Optional. Region of the Cloud SQL instance.
+        class SqlInstancesReconcileNetworkingRequest
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Request parameters specific to PSC DNS networking reconciliation.
+        # @!attribute [rw] networks
+        #   @return [::Array<::String>]
+        #     Optional. List of specific consumer VPC networks to reconcile. They must be
+        #     specified as full resource names (e.g.,
+        #     "projects/my-consumer-project/global/networks/prod-vpc"). If empty,
+        #     recreates Write Endpoints for all the consumer networks associated with
+        #     this instance.
+        # @!attribute [rw] force
+        #   @return [::Boolean]
+        #     Optional. Set `true` to force the reset and reapplication of Private
+        #     Service Connect connectivity infrastructure if standard reconciliation does
+        #     not resolve automated DNS issues. This operation might cause a brief
+        #     disruption in network connectivity for connected VPC networks while
+        #     settings are reapplied. Use this option only when standard reconciliation
+        #     fails to resolve networking issues (for example, if connectivity resources
+        #     are stuck in an updating or creating state).
+        class PscDnsReconcileNetworkingRequest
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
         # External Sync parallel level.
         module ExternalSyncParallelLevel
           # Unknown sync parallel level. Will be defaulted to OPTIMAL.

data/proto_docs/google/cloud/sql/v1/cloud_sql_resources.rb

@@ -1552,6 +1552,10 @@ module Google
 
             # Deletes a Blue-Green deployment.
             DELETE_BLUE_GREEN_DEPLOYMENT = 58
+
+            # Reconciles network infrastructure (e.g. Private Service Connect,
+            # Automated DNS Records).
+            RECONCILE_NETWORKING = 64
           end
 
           # The status of an operation.
@@ -1775,6 +1779,14 @@ module Google
         # @!attribute [rw] insights_config
         #   @return [::Google::Cloud::Sql::V1::InsightsConfig]
         #     Insights configuration, for now relevant only for Postgres.
+        # @!attribute [rw] msdtc_enabled
+        #   @return [::Boolean]
+        #     Optional. Enables Microsoft Distributed Transaction Coordinator (MSDTC) for
+        #     SQL Server.
+        # @!attribute [rw] msdtc_rpc_auth_mode
+        #   @return [::Google::Cloud::Sql::V1::Settings::MsdtcRpcAuthMode]
+        #     Optional. RPC authentication mode for Microsoft Distributed Transaction
+        #     Coordinator (MSDTC).
         # @!attribute [rw] password_validation_policy
         #   @return [::Google::Cloud::Sql::V1::PasswordValidationPolicy]
         #     The local user password validation policy of the instance for PostgreSQL
@@ -1868,6 +1880,10 @@ module Google
         #   @return [::Google::Cloud::Sql::V1::PerformanceCaptureConfig]
         #     Optional. Configuration for Performance Capture, provides diagnostic
         #     metrics during high load situations.
+        # @!attribute [rw] initial_users_config
+        #   @return [::Google::Cloud::Sql::V1::InitialUsersConfig]
+        #     Optional. Input only. Users to be created on the instance during instance
+        #     creation.
         class Settings
           include ::Google::Protobuf::MessageExts
           extend ::Google::Protobuf::MessageExts::ClassMethods
@@ -1896,6 +1912,30 @@ module Google
             ON_DEMAND = 3
           end
 
+          # RPC authentication modes for Microsoft Distributed Transaction Coordinator
+          # (MSDTC).
+          module MsdtcRpcAuthMode
+            # Unspecified RPC authentication mode.
+            MSDTC_RPC_AUTH_MODE_UNSPECIFIED = 0
+
+            # Allow only secure RPC calls. Both servers (caller and receiver) must
+            # successfully verify each other's identities, typically using Active
+            # Directory machine accounts and Kerberos Service Principal Names (SPNs).
+            # This is equivalent to Mutual Authentication in Microsoft SQL Server on
+            # Windows.
+            ALLOW_ONLY_SECURE_RPC_CALLS = 1
+
+            # Similar to Incoming authentication mode in Microsoft SQL Server on
+            # Windows, the caller authenticates to the receiver.
+            # The receiver verifies the caller's identity, but the Receiver does not
+            # authenticate itself back to the caller.
+            FALLBACK_TO_UNSECURE_RPC_IF_NECESSARY = 2
+
+            # No authentication. Highly insecure and thus should only be used on
+            # already secure networks and never over public IP.
+            TURN_OFF_RPC_SECURITY = 3
+          end
+
           # The list of Cloud SQL editions available to users.
           module Edition
             # The instance did not specify the edition.
@@ -2159,6 +2199,59 @@ module Google
           extend ::Google::Protobuf::MessageExts::ClassMethods
         end
 
+        # DNS Entry for the primary instance in a replication topology.
+        # @!attribute [rw] dns
+        #   @return [::String]
+        #     Required. The DNS name.
+        # @!attribute [rw] ipv4_address
+        #   @return [::String]
+        #     Required. The IP address.
+        class DNSEntry
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # A single certificate or key in a customer managed certificate bundle.
+        # @!attribute [rw] certificate_type
+        #   @return [::Google::Cloud::Sql::V1::CertificateType]
+        #     Required. The certificate type.
+        # @!attribute [rw] content
+        #   @return [::String]
+        #     Required. Input only. The PEM-encoded certificate or key content in base64
+        #     format.
+        # @!attribute [r] file_path
+        #   @return [::String]
+        #     Output only. File path of the PEM-encoded certificate or key content on the
+        #     database virtual machine. This path can be used by database extensions or
+        #     plugins (for example, to configure `pglogical` in PostgreSQL) that need to
+        #     reference the certificate or key file directly on the VM's filesystem, ex:
+        #     certs/c1/server-ca.pem
+        class CustomerManagedCertificate
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Customer managed certificate SSL configuration.
+        # @!attribute [r] bundle
+        #   @return [::String]
+        #     Output only. The name of the customer managed certificate configuration.
+        #     This name will be used to identify a certificate bundle.
+        # @!attribute [rw] intent
+        #   @return [::Google::Cloud::Sql::V1::Intent]
+        #     Required. The intent for this customer managed certificate configuration.
+        # @!attribute [rw] primary_dns_record
+        #   @return [::Google::Cloud::Sql::V1::DNSEntry]
+        #     DNS name associated with the primary instance in a replication topology.
+        #     This is needed to insert a DNS entry in a replica VM.
+        # @!attribute [rw] customer_managed_certificates
+        #   @return [::Array<::Google::Cloud::Sql::V1::CustomerManagedCertificate>]
+        #     Required. The server CA certificate, client key and client certificate. You
+        #     can specify up to 3 certificates in a bundle.
+        class CustomerManagedCertificateConfig
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
         # Active Directory configuration, relevant only for Cloud SQL for SQL Server.
         # @!attribute [rw] kind
         #   @return [::String]
@@ -2235,6 +2328,68 @@ module Google
           extend ::Google::Protobuf::MessageExts::ClassMethods
         end
 
+        # Configuration for users created during instance creation.
+        # @!attribute [rw] initial_users
+        #   @return [::Array<::Google::Cloud::Sql::V1::InitialUsersConfig::InitialUser>]
+        #     Optional. List of IAM users to be created during instance creation.
+        #     A maximum of 5 users are allowed.
+        class InitialUsersConfig
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+
+          # Configuration for an IAM user created during instance creation.
+          # @!attribute [rw] name
+          #   @return [::String]
+          #     Required. The name of the user in the Cloud SQL instance.
+          # @!attribute [rw] type
+          #   @return [::Google::Cloud::Sql::V1::InitialUsersConfig::InitialUser::SqlUserType]
+          #     Required. The user type. Cannot be BUILT_IN.
+          # @!attribute [rw] roles
+          #   @return [::Array<::String>]
+          #     Optional. The database roles to be assigned to the user. If empty, will
+          #     grant role `cloudsqlsuperuser`.
+          class InitialUser
+            include ::Google::Protobuf::MessageExts
+            extend ::Google::Protobuf::MessageExts::ClassMethods
+
+            # The user type.
+            module SqlUserType
+              # The database's built-in user type. Not supported for initial user
+              # creation.
+              BUILT_IN = 0
+
+              # Cloud IAM user.
+              # MySQL will truncate the @ and domain when it stores the user.
+              CLOUD_IAM_USER = 1
+
+              # Cloud IAM service account.
+              # For PostgreSQL, omit the .gserviceaccount.com suffix.
+              # MySQL will truncate the @ and domain when it stores the user.
+              CLOUD_IAM_SERVICE_ACCOUNT = 2
+
+              # Cloud IAM group.
+              CLOUD_IAM_GROUP = 3
+
+              # Login for a user that belongs to the Cloud IAM group. Not supported for
+              # initial user creation.
+              CLOUD_IAM_GROUP_USER = 4
+
+              # Login for a service account that belongs to the
+              # Cloud IAM group. Not supported for initial user creation.
+              CLOUD_IAM_GROUP_SERVICE_ACCOUNT = 5
+
+              # Cloud IAM workforce identity.
+              CLOUD_IAM_WORKFORCE_IDENTITY = 6
+
+              # Microsoft Entra ID user. Not supported for initial user creation.
+              ENTRAID_USER = 7
+
+              # Active Directory user. Not supported for initial user creation.
+              ACTIVE_DIRECTORY_USER = 8
+            end
+          end
+        end
+
         # Acquire SSRS lease context.
         # @!attribute [rw] setup_login
         #   @return [::String]
@@ -2373,6 +2528,10 @@ module Google
         #     instance. Each workload capture generates a unique ID in the format
         #     `workload-<epoch_timestamp>` (for example, `workload-1786046400`). Use this
         #     ID to start executing the recorded SQL queries.
+        # @!attribute [r] source_instance
+        #   @return [::String]
+        #     Output only. The name of the source Cloud SQL instance where the workload
+        #     was captured, excluding the project ID (for example, `my-source-instance`).
         class StartWorkloadReplayContext
           include ::Google::Protobuf::MessageExts
           extend ::Google::Protobuf::MessageExts::ClassMethods
@@ -2441,6 +2600,39 @@ module Google
           REPLICA_INCLUDED_SELF_SERVICE_MAINTENANCE = 4
         end
 
+        # Certificate type for customer managed certificates.
+        module CertificateType
+          # Unspecified certificate type.
+          CERTIFICATE_TYPE_UNSPECIFIED = 0
+
+          # The x509 PEM-encoded certificate of the CA that signed the source database
+          # server's certificate.
+          CERTIFICATE_TYPE_PEER_SERVER_CA = 1
+
+          # The unencrypted PKCS#1 or PKCS#8 PEM-encoded private key associated with
+          # the Client Certificate.
+          CERTIFICATE_TYPE_PEER_CLIENT_KEY = 2
+
+          # The x509 PEM-encoded certificate used by the client to authenticate
+          # against the source database server.
+          CERTIFICATE_TYPE_PEER_CLIENT_CERTIFICATE = 3
+        end
+
+        # Intent for the customer managed certificate configuration.
+        module Intent
+          # Unspecified intent.
+          INTENT_UNSPECIFIED = 0
+
+          # Configures customer-managed certificates for pg_logical extension to
+          # achieve mTLS authentication.
+          PG_LOGICAL = 1
+
+          # Configures customer-managed certificates for built-in PostgreSQL native
+          # replication to achieve mTLS authentication. Supported for Cloud SQL for
+          # PostgreSQL 10 and later.
+          NATIVE_REPLICATION = 2
+        end
+
         module SqlBackendType
           # This is an unknown backend type for instance.
           SQL_BACKEND_TYPE_UNSPECIFIED = 0

data/proto_docs/google/cloud/sql/v1/cloud_sql_ssl_certs.rb

@@ -114,6 +114,75 @@ module Google
           include ::Google::Protobuf::MessageExts
           extend ::Google::Protobuf::MessageExts::ClassMethods
         end
+
+        # Request message for SqlSslCertsService.UpdateCustomerManagedCertificate.
+        # @!attribute [rw] instance
+        #   @return [::String]
+        #     Required. Cloud SQL instance ID. This does not include the project ID.
+        # @!attribute [rw] project
+        #   @return [::String]
+        #     Required. Project ID of the project that contains the instance.
+        # @!attribute [rw] customer_managed_certificate_config
+        #   @return [::Google::Cloud::Sql::V1::CustomerManagedCertificateConfig]
+        #     Required. The customer managed certificate bundle SSL configuration to
+        #     update.
+        # @!attribute [rw] update_mask
+        #   @return [::Google::Protobuf::FieldMask]
+        #     Optional. The list of fields to be updated.
+        # @!attribute [rw] allow_missing
+        #   @return [::Boolean]
+        #     Optional. If set to true, and the customer managed certificate bundle
+        #     configuration is not found, a new customer managed certificate bundle
+        #     configuration will be created. In this situation, `update_mask` is ignored.
+        # @!attribute [rw] certificate_bundle
+        #   @return [::String]
+        #     Required. Name tag of the customer managed certificate bundle to update. It
+        #     must start with a letter, be alphanumeric, and have a maximum length of 10
+        #     characters.
+        class UpdateCustomerManagedCertificateRequest
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Request message for SqlSslCertsService.DeleteCustomerManagedCertificate.
+        # @!attribute [rw] instance
+        #   @return [::String]
+        #     Required. Cloud SQL instance ID. This does not include the project ID.
+        # @!attribute [rw] project
+        #   @return [::String]
+        #     Required. Project ID of the project that contains the instance.
+        # @!attribute [rw] certificate_bundle
+        #   @return [::String]
+        #     Required. Name tag of the customer managed certificate bundle to delete. It
+        #     must start with a letter, be alphanumeric, and have a maximum length of 10
+        #     characters.
+        class DeleteCustomerManagedCertificateRequest
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Request message for SqlSslCertsService.ListCustomerManagedCertificates.
+        # @!attribute [rw] instance
+        #   @return [::String]
+        #     Required. Cloud SQL instance ID. This does not include the project ID.
+        # @!attribute [rw] project
+        #   @return [::String]
+        #     Required. Project ID of the project that contains the instance.
+        class ListCustomerManagedCertificatesRequest
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
+
+        # Response message for SqlSslCertsService.ListCustomerManagedCertificates.
+        # @!attribute [rw] customer_managed_certificates
+        #   @return [::Array<::Google::Cloud::Sql::V1::CustomerManagedCertificateConfig>]
+        #     Required. List of customer managed SSL configurations for the instance.
+        #     Note: Sensitive private keys (e.g., PEER_CLIENT_KEY) are redacted in this
+        #     response.
+        class ListCustomerManagedCertificatesResponse
+          include ::Google::Protobuf::MessageExts
+          extend ::Google::Protobuf::MessageExts::ClassMethods
+        end
       end
     end
   end