@alis-build/common-es 1.0.3

package/google/iam/v1beta/workload_identity_pool_pb.d.ts

@@ -0,0 +1,996 @@
+// Copyright 2020 Google LLC
+//
+// Licensed under the Apache License, Version 2.0 (the "License");
+// you may not use this file except in compliance with the License.
+// You may obtain a copy of the License at
+//
+//     http://www.apache.org/licenses/LICENSE-2.0
+//
+// Unless required by applicable law or agreed to in writing, software
+// distributed under the License is distributed on an "AS IS" BASIS,
+// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+// See the License for the specific language governing permissions and
+// limitations under the License.
+
+// @generated by protoc-gen-es v2.11.0 with parameter "target=js+dts"
+// @generated from file google/iam/v1beta/workload_identity_pool.proto (package google.iam.v1beta, syntax proto3)
+/* eslint-disable */
+
+import type { GenEnum, GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv2";
+import type { Message } from "@bufbuild/protobuf";
+import type { FieldMask } from "../../protobuf/field_mask_pb";
+import type { OperationSchema } from "../../longrunning/operations_pb";
+
+/**
+ * Describes the file google/iam/v1beta/workload_identity_pool.proto.
+ */
+export declare const file_google_iam_v1beta_workload_identity_pool: GenFile;
+
+/**
+ * Represents a collection of external workload identities. You can define IAM
+ * policies to grant these identities access to Google Cloud resources.
+ *
+ * @generated from message google.iam.v1beta.WorkloadIdentityPool
+ */
+export declare type WorkloadIdentityPool = Message<"google.iam.v1beta.WorkloadIdentityPool"> & {
+  /**
+   * Output only. The resource name of the pool.
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * A display name for the pool. Cannot exceed 32 characters.
+   *
+   * @generated from field: string display_name = 2;
+   */
+  displayName: string;
+
+  /**
+   * A description of the pool. Cannot exceed 256 characters.
+   *
+   * @generated from field: string description = 3;
+   */
+  description: string;
+
+  /**
+   * Output only. The state of the pool.
+   *
+   * @generated from field: google.iam.v1beta.WorkloadIdentityPool.State state = 4;
+   */
+  state: WorkloadIdentityPool_State;
+
+  /**
+   * Whether the pool is disabled. You cannot use a disabled pool to exchange
+   * tokens, or use existing tokens to access resources. If
+   * the pool is re-enabled, existing tokens grant access again.
+   *
+   * @generated from field: bool disabled = 5;
+   */
+  disabled: boolean;
+};
+
+/**
+ * Describes the message google.iam.v1beta.WorkloadIdentityPool.
+ * Use `create(WorkloadIdentityPoolSchema)` to create a new message.
+ */
+export declare const WorkloadIdentityPoolSchema: GenMessage<WorkloadIdentityPool>;
+
+/**
+ * The current state of the pool.
+ *
+ * @generated from enum google.iam.v1beta.WorkloadIdentityPool.State
+ */
+export enum WorkloadIdentityPool_State {
+  /**
+   * State unspecified.
+   *
+   * @generated from enum value: STATE_UNSPECIFIED = 0;
+   */
+  STATE_UNSPECIFIED = 0,
+
+  /**
+   * The pool is active, and may be used in Google Cloud policies.
+   *
+   * @generated from enum value: ACTIVE = 1;
+   */
+  ACTIVE = 1,
+
+  /**
+   * The pool is soft-deleted. Soft-deleted pools are permanently deleted
+   * after approximately 30 days. You can restore a soft-deleted pool using
+   * [UndeleteWorkloadIdentityPool][google.iam.v1beta.WorkloadIdentityPools.UndeleteWorkloadIdentityPool].
+   *
+   * You cannot reuse the ID of a soft-deleted pool until it is permanently
+   * deleted.
+   *
+   * While a pool is deleted, you cannot use it to exchange tokens, or use
+   * existing tokens to access resources. If the pool is undeleted, existing
+   * tokens grant access again.
+   *
+   * @generated from enum value: DELETED = 2;
+   */
+  DELETED = 2,
+}
+
+/**
+ * Describes the enum google.iam.v1beta.WorkloadIdentityPool.State.
+ */
+export declare const WorkloadIdentityPool_StateSchema: GenEnum<WorkloadIdentityPool_State>;
+
+/**
+ * A configuration for an external identity provider.
+ *
+ * @generated from message google.iam.v1beta.WorkloadIdentityPoolProvider
+ */
+export declare type WorkloadIdentityPoolProvider = Message<"google.iam.v1beta.WorkloadIdentityPoolProvider"> & {
+  /**
+   * Output only. The resource name of the provider.
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+
+  /**
+   * A display name for the provider. Cannot exceed 32 characters.
+   *
+   * @generated from field: string display_name = 2;
+   */
+  displayName: string;
+
+  /**
+   * A description for the provider. Cannot exceed 256 characters.
+   *
+   * @generated from field: string description = 3;
+   */
+  description: string;
+
+  /**
+   * Output only. The state of the provider.
+   *
+   * @generated from field: google.iam.v1beta.WorkloadIdentityPoolProvider.State state = 4;
+   */
+  state: WorkloadIdentityPoolProvider_State;
+
+  /**
+   * Whether the provider is disabled. You cannot use a disabled provider to
+   * exchange tokens. However, existing tokens still grant access.
+   *
+   * @generated from field: bool disabled = 5;
+   */
+  disabled: boolean;
+
+  /**
+   * Maps attributes from authentication credentials issued by an external
+   * identity provider to Google Cloud attributes, such as `subject` and
+   * `segment`.
+   *
+   * Each key must be a string specifying the Google Cloud IAM attribute to
+   * map to.
+   *
+   * The following keys are supported:
+   *
+   * * `google.subject`: The principal IAM is authenticating. You can reference
+   *                     this value in IAM bindings. This is also the
+   *                     subject that appears in Cloud Logging logs.
+   *                     Cannot exceed 127 characters.
+   *
+   * * `google.groups`: Groups the external identity belongs to. You can grant
+   *                    groups access to resources using an IAM `principalSet`
+   *                    binding; access applies to all members of the group.
+   *
+   * You can also provide custom attributes by specifying
+   * `attribute.{custom_attribute}`, where `{custom_attribute}` is the name of
+   * the custom attribute to be mapped. You can define a maximum of 50 custom
+   * attributes. The maximum length of a mapped attribute key is
+   * 100 characters, and the key may only contain the characters [a-z0-9_].
+   *
+   * You can reference these attributes in IAM policies to define fine-grained
+   * access for a workload to Google Cloud resources. For example:
+   *
+   * * `google.subject`:
+   * `principal://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/subject/{value}`
+   *
+   * * `google.groups`:
+   * `principalSet://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/group/{value}`
+   *
+   * * `attribute.{custom_attribute}`:
+   * `principalSet://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/attribute.{custom_attribute}/{value}`
+   *
+   * Each value must be a [Common Expression Language]
+   * (https://opensource.google/projects/cel) function that maps an
+   * identity provider credential to the normalized attribute specified by the
+   * corresponding map key.
+   *
+   * You can use the `assertion` keyword in the expression to access a JSON
+   * representation of the authentication credential issued by the provider.
+   *
+   * The maximum length of an attribute mapping expression is 2048 characters.
+   * When evaluated, the total size of all mapped attributes must not exceed
+   * 8KB.
+   *
+   * For AWS providers, the following rules apply:
+   *
+   * - If no attribute mapping is defined, the following default mapping
+   *   applies:
+   *
+   *   ```
+   *   {
+   *     "google.subject":"assertion.arn",
+   *     "attribute.aws_role":
+   *         "assertion.arn.contains('assumed-role')"
+   *         " ? assertion.arn.extract('{account_arn}assumed-role/')"
+   *         "   + 'assumed-role/'"
+   *         "   + assertion.arn.extract('assumed-role/{role_name}/')"
+   *         " : assertion.arn",
+   *   }
+   *   ```
+   *
+   * - If any custom attribute mappings are defined, they must include a mapping
+   *   to the `google.subject` attribute.
+   *
+   *
+   * For OIDC providers, the following rules apply:
+   *
+   * - Custom attribute mappings must be defined, and must include a mapping to
+   *   the `google.subject` attribute. For example, the following maps the
+   *   `sub` claim of the incoming credential to the `subject` attribute on
+   *   a Google token.
+   *
+   *   ```
+   *   {"google.subject": "assertion.sub"}
+   *   ```
+   *
+   * @generated from field: map<string, string> attribute_mapping = 6;
+   */
+  attributeMapping: { [key: string]: string };
+
+  /**
+   * [A Common Expression Language](https://opensource.google/projects/cel)
+   * expression, in plain text, to restrict what otherwise valid authentication
+   * credentials issued by the provider should not be accepted.
+   *
+   * The expression must output a boolean representing whether to allow the
+   * federation.
+   *
+   * The following keywords may be referenced in the expressions:
+   *
+   * * `assertion`: JSON representing the authentication credential issued by
+   *                the provider.
+   * * `google`: The Google attributes mapped from the assertion in the
+   *             `attribute_mappings`.
+   * * `attribute`: The custom attributes mapped from the assertion in the
+   *                `attribute_mappings`.
+   *
+   * The maximum length of the attribute condition expression is 4096
+   * characters. If unspecified, all valid authentication credential are
+   * accepted.
+   *
+   * The following example shows how to only allow credentials with a mapped
+   * `google.groups` value of `admins`:
+   *
+   * ```
+   * "'admins' in google.groups"
+   * ```
+   *
+   * @generated from field: string attribute_condition = 7;
+   */
+  attributeCondition: string;
+
+  /**
+   * Identity provider configuration types.
+   *
+   * @generated from oneof google.iam.v1beta.WorkloadIdentityPoolProvider.provider_config
+   */
+  providerConfig: {
+    /**
+     * An Amazon Web Services identity provider.
+     *
+     * @generated from field: google.iam.v1beta.WorkloadIdentityPoolProvider.Aws aws = 8;
+     */
+    value: WorkloadIdentityPoolProvider_Aws;
+    case: "aws";
+  } | {
+    /**
+     * An OpenId Connect 1.0 identity provider.
+     *
+     * @generated from field: google.iam.v1beta.WorkloadIdentityPoolProvider.Oidc oidc = 9;
+     */
+    value: WorkloadIdentityPoolProvider_Oidc;
+    case: "oidc";
+  } | { case: undefined; value?: undefined };
+};
+
+/**
+ * Describes the message google.iam.v1beta.WorkloadIdentityPoolProvider.
+ * Use `create(WorkloadIdentityPoolProviderSchema)` to create a new message.
+ */
+export declare const WorkloadIdentityPoolProviderSchema: GenMessage<WorkloadIdentityPoolProvider>;
+
+/**
+ * Represents an Amazon Web Services identity provider.
+ *
+ * @generated from message google.iam.v1beta.WorkloadIdentityPoolProvider.Aws
+ */
+export declare type WorkloadIdentityPoolProvider_Aws = Message<"google.iam.v1beta.WorkloadIdentityPoolProvider.Aws"> & {
+  /**
+   * Required. The AWS account ID.
+   *
+   * @generated from field: string account_id = 1;
+   */
+  accountId: string;
+};
+
+/**
+ * Describes the message google.iam.v1beta.WorkloadIdentityPoolProvider.Aws.
+ * Use `create(WorkloadIdentityPoolProvider_AwsSchema)` to create a new message.
+ */
+export declare const WorkloadIdentityPoolProvider_AwsSchema: GenMessage<WorkloadIdentityPoolProvider_Aws>;
+
+/**
+ * Represents an OpenId Connect 1.0 identity provider.
+ *
+ * @generated from message google.iam.v1beta.WorkloadIdentityPoolProvider.Oidc
+ */
+export declare type WorkloadIdentityPoolProvider_Oidc = Message<"google.iam.v1beta.WorkloadIdentityPoolProvider.Oidc"> & {
+  /**
+   * Required. The OIDC issuer URL.
+   *
+   * @generated from field: string issuer_uri = 1;
+   */
+  issuerUri: string;
+
+  /**
+   * Acceptable values for the `aud` field (audience) in the OIDC token. Token
+   * exchange requests are rejected if the token audience does not match one
+   * of the configured values. Each audience may be at most 256 characters. A
+   * maximum of 10 audiences may be configured.
+   *
+   * If this list is empty, the OIDC token audience must be equal to
+   * the full canonical resource name of the WorkloadIdentityPoolProvider,
+   * with or without the HTTPS prefix. For example:
+   *
+   * ```
+   * //iam.googleapis.com/projects/<project-number>/locations/<location>/workloadIdentityPools/<pool-id>/providers/<provider-id>
+   * https://iam.googleapis.com/projects/<project-number>/locations/<location>/workloadIdentityPools/<pool-id>/providers/<provider-id>
+   * ```
+   *
+   * @generated from field: repeated string allowed_audiences = 2;
+   */
+  allowedAudiences: string[];
+};
+
+/**
+ * Describes the message google.iam.v1beta.WorkloadIdentityPoolProvider.Oidc.
+ * Use `create(WorkloadIdentityPoolProvider_OidcSchema)` to create a new message.
+ */
+export declare const WorkloadIdentityPoolProvider_OidcSchema: GenMessage<WorkloadIdentityPoolProvider_Oidc>;
+
+/**
+ * The current state of the provider.
+ *
+ * @generated from enum google.iam.v1beta.WorkloadIdentityPoolProvider.State
+ */
+export enum WorkloadIdentityPoolProvider_State {
+  /**
+   * State unspecified.
+   *
+   * @generated from enum value: STATE_UNSPECIFIED = 0;
+   */
+  STATE_UNSPECIFIED = 0,
+
+  /**
+   * The provider is active, and may be used to validate authentication
+   * credentials.
+   *
+   * @generated from enum value: ACTIVE = 1;
+   */
+  ACTIVE = 1,
+
+  /**
+   * The provider is soft-deleted. Soft-deleted providers are permanently
+   * deleted after approximately 30 days. You can restore a soft-deleted
+   * provider using
+   * [UndeleteWorkloadIdentityPoolProvider][google.iam.v1beta.WorkloadIdentityPools.UndeleteWorkloadIdentityPoolProvider].
+   *
+   * You cannot reuse the ID of a soft-deleted provider until it is
+   * permanently deleted.
+   *
+   * @generated from enum value: DELETED = 2;
+   */
+  DELETED = 2,
+}
+
+/**
+ * Describes the enum google.iam.v1beta.WorkloadIdentityPoolProvider.State.
+ */
+export declare const WorkloadIdentityPoolProvider_StateSchema: GenEnum<WorkloadIdentityPoolProvider_State>;
+
+/**
+ * Request message for ListWorkloadIdentityPools.
+ *
+ * @generated from message google.iam.v1beta.ListWorkloadIdentityPoolsRequest
+ */
+export declare type ListWorkloadIdentityPoolsRequest = Message<"google.iam.v1beta.ListWorkloadIdentityPoolsRequest"> & {
+  /**
+   * Required. The parent resource to list pools for.
+   *
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * The maximum number of pools to return.
+   * If unspecified, at most 50 pools are returned.
+   * The maximum value is 1000; values above are 1000 truncated to 1000.
+   *
+   * @generated from field: int32 page_size = 2;
+   */
+  pageSize: number;
+
+  /**
+   * A page token, received from a previous `ListWorkloadIdentityPools`
+   * call. Provide this to retrieve the subsequent page.
+   *
+   * @generated from field: string page_token = 3;
+   */
+  pageToken: string;
+
+  /**
+   * Whether to return soft-deleted pools.
+   *
+   * @generated from field: bool show_deleted = 4;
+   */
+  showDeleted: boolean;
+};
+
+/**
+ * Describes the message google.iam.v1beta.ListWorkloadIdentityPoolsRequest.
+ * Use `create(ListWorkloadIdentityPoolsRequestSchema)` to create a new message.
+ */
+export declare const ListWorkloadIdentityPoolsRequestSchema: GenMessage<ListWorkloadIdentityPoolsRequest>;
+
+/**
+ * Response message for ListWorkloadIdentityPools.
+ *
+ * @generated from message google.iam.v1beta.ListWorkloadIdentityPoolsResponse
+ */
+export declare type ListWorkloadIdentityPoolsResponse = Message<"google.iam.v1beta.ListWorkloadIdentityPoolsResponse"> & {
+  /**
+   * A list of pools.
+   *
+   * @generated from field: repeated google.iam.v1beta.WorkloadIdentityPool workload_identity_pools = 1;
+   */
+  workloadIdentityPools: WorkloadIdentityPool[];
+
+  /**
+   * A token, which can be sent as `page_token` to retrieve the next page.
+   * If this field is omitted, there are no subsequent pages.
+   *
+   * @generated from field: string next_page_token = 2;
+   */
+  nextPageToken: string;
+};
+
+/**
+ * Describes the message google.iam.v1beta.ListWorkloadIdentityPoolsResponse.
+ * Use `create(ListWorkloadIdentityPoolsResponseSchema)` to create a new message.
+ */
+export declare const ListWorkloadIdentityPoolsResponseSchema: GenMessage<ListWorkloadIdentityPoolsResponse>;
+
+/**
+ * Request message for GetWorkloadIdentityPool.
+ *
+ * @generated from message google.iam.v1beta.GetWorkloadIdentityPoolRequest
+ */
+export declare type GetWorkloadIdentityPoolRequest = Message<"google.iam.v1beta.GetWorkloadIdentityPoolRequest"> & {
+  /**
+   * Required. The name of the pool to retrieve.
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message google.iam.v1beta.GetWorkloadIdentityPoolRequest.
+ * Use `create(GetWorkloadIdentityPoolRequestSchema)` to create a new message.
+ */
+export declare const GetWorkloadIdentityPoolRequestSchema: GenMessage<GetWorkloadIdentityPoolRequest>;
+
+/**
+ * Request message for CreateWorkloadIdentityPool.
+ *
+ * @generated from message google.iam.v1beta.CreateWorkloadIdentityPoolRequest
+ */
+export declare type CreateWorkloadIdentityPoolRequest = Message<"google.iam.v1beta.CreateWorkloadIdentityPoolRequest"> & {
+  /**
+   * Required. The parent resource to create the pool in. The only supported
+   * location is `global`.
+   *
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * Required. The pool to create.
+   *
+   * @generated from field: google.iam.v1beta.WorkloadIdentityPool workload_identity_pool = 2;
+   */
+  workloadIdentityPool?: WorkloadIdentityPool;
+
+  /**
+   * Required. The ID to use for the pool, which becomes the
+   * final component of the resource name. This value should be 4-32 characters,
+   * and may contain the characters [a-z0-9-]. The prefix `gcp-` is
+   * reserved for use by Google, and may not be specified.
+   *
+   * @generated from field: string workload_identity_pool_id = 3;
+   */
+  workloadIdentityPoolId: string;
+};
+
+/**
+ * Describes the message google.iam.v1beta.CreateWorkloadIdentityPoolRequest.
+ * Use `create(CreateWorkloadIdentityPoolRequestSchema)` to create a new message.
+ */
+export declare const CreateWorkloadIdentityPoolRequestSchema: GenMessage<CreateWorkloadIdentityPoolRequest>;
+
+/**
+ * Request message for UpdateWorkloadIdentityPool.
+ *
+ * @generated from message google.iam.v1beta.UpdateWorkloadIdentityPoolRequest
+ */
+export declare type UpdateWorkloadIdentityPoolRequest = Message<"google.iam.v1beta.UpdateWorkloadIdentityPoolRequest"> & {
+  /**
+   * Required. The pool to update. The `name` field is used to identify the pool.
+   *
+   * @generated from field: google.iam.v1beta.WorkloadIdentityPool workload_identity_pool = 1;
+   */
+  workloadIdentityPool?: WorkloadIdentityPool;
+
+  /**
+   * Required. The list of fields update.
+   *
+   * @generated from field: google.protobuf.FieldMask update_mask = 2;
+   */
+  updateMask?: FieldMask;
+};
+
+/**
+ * Describes the message google.iam.v1beta.UpdateWorkloadIdentityPoolRequest.
+ * Use `create(UpdateWorkloadIdentityPoolRequestSchema)` to create a new message.
+ */
+export declare const UpdateWorkloadIdentityPoolRequestSchema: GenMessage<UpdateWorkloadIdentityPoolRequest>;
+
+/**
+ * Request message for DeleteWorkloadIdentityPool.
+ *
+ * @generated from message google.iam.v1beta.DeleteWorkloadIdentityPoolRequest
+ */
+export declare type DeleteWorkloadIdentityPoolRequest = Message<"google.iam.v1beta.DeleteWorkloadIdentityPoolRequest"> & {
+  /**
+   * Required. The name of the pool to delete.
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message google.iam.v1beta.DeleteWorkloadIdentityPoolRequest.
+ * Use `create(DeleteWorkloadIdentityPoolRequestSchema)` to create a new message.
+ */
+export declare const DeleteWorkloadIdentityPoolRequestSchema: GenMessage<DeleteWorkloadIdentityPoolRequest>;
+
+/**
+ * Request message for UndeleteWorkloadIdentityPool.
+ *
+ * @generated from message google.iam.v1beta.UndeleteWorkloadIdentityPoolRequest
+ */
+export declare type UndeleteWorkloadIdentityPoolRequest = Message<"google.iam.v1beta.UndeleteWorkloadIdentityPoolRequest"> & {
+  /**
+   * Required. The name of the pool to undelete.
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message google.iam.v1beta.UndeleteWorkloadIdentityPoolRequest.
+ * Use `create(UndeleteWorkloadIdentityPoolRequestSchema)` to create a new message.
+ */
+export declare const UndeleteWorkloadIdentityPoolRequestSchema: GenMessage<UndeleteWorkloadIdentityPoolRequest>;
+
+/**
+ * Request message for ListWorkloadIdentityPoolProviders.
+ *
+ * @generated from message google.iam.v1beta.ListWorkloadIdentityPoolProvidersRequest
+ */
+export declare type ListWorkloadIdentityPoolProvidersRequest = Message<"google.iam.v1beta.ListWorkloadIdentityPoolProvidersRequest"> & {
+  /**
+   * Required. The pool to list providers for.
+   *
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * The maximum number of providers to return.
+   * If unspecified, at most 50 providers are returned.
+   * The maximum value is 100; values above 100 are truncated to 100.
+   *
+   * @generated from field: int32 page_size = 2;
+   */
+  pageSize: number;
+
+  /**
+   * A page token, received from a previous
+   * `ListWorkloadIdentityPoolProviders` call. Provide this to retrieve the
+   * subsequent page.
+   *
+   * @generated from field: string page_token = 3;
+   */
+  pageToken: string;
+
+  /**
+   * Whether to return soft-deleted providers.
+   *
+   * @generated from field: bool show_deleted = 4;
+   */
+  showDeleted: boolean;
+};
+
+/**
+ * Describes the message google.iam.v1beta.ListWorkloadIdentityPoolProvidersRequest.
+ * Use `create(ListWorkloadIdentityPoolProvidersRequestSchema)` to create a new message.
+ */
+export declare const ListWorkloadIdentityPoolProvidersRequestSchema: GenMessage<ListWorkloadIdentityPoolProvidersRequest>;
+
+/**
+ * Response message for ListWorkloadIdentityPoolProviders.
+ *
+ * @generated from message google.iam.v1beta.ListWorkloadIdentityPoolProvidersResponse
+ */
+export declare type ListWorkloadIdentityPoolProvidersResponse = Message<"google.iam.v1beta.ListWorkloadIdentityPoolProvidersResponse"> & {
+  /**
+   * A list of providers.
+   *
+   * @generated from field: repeated google.iam.v1beta.WorkloadIdentityPoolProvider workload_identity_pool_providers = 1;
+   */
+  workloadIdentityPoolProviders: WorkloadIdentityPoolProvider[];
+
+  /**
+   * A token, which can be sent as `page_token` to retrieve the next page.
+   * If this field is omitted, there are no subsequent pages.
+   *
+   * @generated from field: string next_page_token = 2;
+   */
+  nextPageToken: string;
+};
+
+/**
+ * Describes the message google.iam.v1beta.ListWorkloadIdentityPoolProvidersResponse.
+ * Use `create(ListWorkloadIdentityPoolProvidersResponseSchema)` to create a new message.
+ */
+export declare const ListWorkloadIdentityPoolProvidersResponseSchema: GenMessage<ListWorkloadIdentityPoolProvidersResponse>;
+
+/**
+ * Request message for GetWorkloadIdentityPoolProvider.
+ *
+ * @generated from message google.iam.v1beta.GetWorkloadIdentityPoolProviderRequest
+ */
+export declare type GetWorkloadIdentityPoolProviderRequest = Message<"google.iam.v1beta.GetWorkloadIdentityPoolProviderRequest"> & {
+  /**
+   * Required. The name of the provider to retrieve.
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message google.iam.v1beta.GetWorkloadIdentityPoolProviderRequest.
+ * Use `create(GetWorkloadIdentityPoolProviderRequestSchema)` to create a new message.
+ */
+export declare const GetWorkloadIdentityPoolProviderRequestSchema: GenMessage<GetWorkloadIdentityPoolProviderRequest>;
+
+/**
+ * Request message for CreateWorkloadIdentityPoolProvider.
+ *
+ * @generated from message google.iam.v1beta.CreateWorkloadIdentityPoolProviderRequest
+ */
+export declare type CreateWorkloadIdentityPoolProviderRequest = Message<"google.iam.v1beta.CreateWorkloadIdentityPoolProviderRequest"> & {
+  /**
+   * Required. The pool to create this provider in.
+   *
+   * @generated from field: string parent = 1;
+   */
+  parent: string;
+
+  /**
+   * Required. The provider to create.
+   *
+   * @generated from field: google.iam.v1beta.WorkloadIdentityPoolProvider workload_identity_pool_provider = 2;
+   */
+  workloadIdentityPoolProvider?: WorkloadIdentityPoolProvider;
+
+  /**
+   * Required. The ID for the provider, which becomes the
+   * final component of the resource name. This value must be 4-32 characters,
+   * and may contain the characters [a-z0-9-]. The prefix `gcp-` is
+   * reserved for use by Google, and may not be specified.
+   *
+   * @generated from field: string workload_identity_pool_provider_id = 3;
+   */
+  workloadIdentityPoolProviderId: string;
+};
+
+/**
+ * Describes the message google.iam.v1beta.CreateWorkloadIdentityPoolProviderRequest.
+ * Use `create(CreateWorkloadIdentityPoolProviderRequestSchema)` to create a new message.
+ */
+export declare const CreateWorkloadIdentityPoolProviderRequestSchema: GenMessage<CreateWorkloadIdentityPoolProviderRequest>;
+
+/**
+ * Request message for UpdateWorkloadIdentityPoolProvider.
+ *
+ * @generated from message google.iam.v1beta.UpdateWorkloadIdentityPoolProviderRequest
+ */
+export declare type UpdateWorkloadIdentityPoolProviderRequest = Message<"google.iam.v1beta.UpdateWorkloadIdentityPoolProviderRequest"> & {
+  /**
+   * Required. The provider to update.
+   *
+   * @generated from field: google.iam.v1beta.WorkloadIdentityPoolProvider workload_identity_pool_provider = 1;
+   */
+  workloadIdentityPoolProvider?: WorkloadIdentityPoolProvider;
+
+  /**
+   * Required. The list of fields to update.
+   *
+   * @generated from field: google.protobuf.FieldMask update_mask = 2;
+   */
+  updateMask?: FieldMask;
+};
+
+/**
+ * Describes the message google.iam.v1beta.UpdateWorkloadIdentityPoolProviderRequest.
+ * Use `create(UpdateWorkloadIdentityPoolProviderRequestSchema)` to create a new message.
+ */
+export declare const UpdateWorkloadIdentityPoolProviderRequestSchema: GenMessage<UpdateWorkloadIdentityPoolProviderRequest>;
+
+/**
+ * Request message for DeleteWorkloadIdentityPoolProvider.
+ *
+ * @generated from message google.iam.v1beta.DeleteWorkloadIdentityPoolProviderRequest
+ */
+export declare type DeleteWorkloadIdentityPoolProviderRequest = Message<"google.iam.v1beta.DeleteWorkloadIdentityPoolProviderRequest"> & {
+  /**
+   * Required. The name of the provider to delete.
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message google.iam.v1beta.DeleteWorkloadIdentityPoolProviderRequest.
+ * Use `create(DeleteWorkloadIdentityPoolProviderRequestSchema)` to create a new message.
+ */
+export declare const DeleteWorkloadIdentityPoolProviderRequestSchema: GenMessage<DeleteWorkloadIdentityPoolProviderRequest>;
+
+/**
+ * Request message for UndeleteWorkloadIdentityPoolProvider.
+ *
+ * @generated from message google.iam.v1beta.UndeleteWorkloadIdentityPoolProviderRequest
+ */
+export declare type UndeleteWorkloadIdentityPoolProviderRequest = Message<"google.iam.v1beta.UndeleteWorkloadIdentityPoolProviderRequest"> & {
+  /**
+   * Required. The name of the provider to undelete.
+   *
+   * @generated from field: string name = 1;
+   */
+  name: string;
+};
+
+/**
+ * Describes the message google.iam.v1beta.UndeleteWorkloadIdentityPoolProviderRequest.
+ * Use `create(UndeleteWorkloadIdentityPoolProviderRequestSchema)` to create a new message.
+ */
+export declare const UndeleteWorkloadIdentityPoolProviderRequestSchema: GenMessage<UndeleteWorkloadIdentityPoolProviderRequest>;
+
+/**
+ * Metadata for long-running WorkloadIdentityPool operations.
+ *
+ * @generated from message google.iam.v1beta.WorkloadIdentityPoolOperationMetadata
+ */
+export declare type WorkloadIdentityPoolOperationMetadata = Message<"google.iam.v1beta.WorkloadIdentityPoolOperationMetadata"> & {
+};
+
+/**
+ * Describes the message google.iam.v1beta.WorkloadIdentityPoolOperationMetadata.
+ * Use `create(WorkloadIdentityPoolOperationMetadataSchema)` to create a new message.
+ */
+export declare const WorkloadIdentityPoolOperationMetadataSchema: GenMessage<WorkloadIdentityPoolOperationMetadata>;
+
+/**
+ * Metadata for long-running WorkloadIdentityPoolProvider operations.
+ *
+ * @generated from message google.iam.v1beta.WorkloadIdentityPoolProviderOperationMetadata
+ */
+export declare type WorkloadIdentityPoolProviderOperationMetadata = Message<"google.iam.v1beta.WorkloadIdentityPoolProviderOperationMetadata"> & {
+};
+
+/**
+ * Describes the message google.iam.v1beta.WorkloadIdentityPoolProviderOperationMetadata.
+ * Use `create(WorkloadIdentityPoolProviderOperationMetadataSchema)` to create a new message.
+ */
+export declare const WorkloadIdentityPoolProviderOperationMetadataSchema: GenMessage<WorkloadIdentityPoolProviderOperationMetadata>;
+
+/**
+ * Manages WorkloadIdentityPools.
+ *
+ * @generated from service google.iam.v1beta.WorkloadIdentityPools
+ */
+export declare const WorkloadIdentityPools: GenService<{
+  /**
+   * Lists all non-deleted
+   * [WorkloadIdentityPool][google.iam.v1beta.WorkloadIdentityPool]s in a
+   * project. If `show_deleted` is set to `true`, then deleted pools are also
+   * listed.
+   *
+   * @generated from rpc google.iam.v1beta.WorkloadIdentityPools.ListWorkloadIdentityPools
+   */
+  listWorkloadIdentityPools: {
+    methodKind: "unary";
+    input: typeof ListWorkloadIdentityPoolsRequestSchema;
+    output: typeof ListWorkloadIdentityPoolsResponseSchema;
+  },
+  /**
+   * Gets an individual
+   * [WorkloadIdentityPool][google.iam.v1beta.WorkloadIdentityPool].
+   *
+   * @generated from rpc google.iam.v1beta.WorkloadIdentityPools.GetWorkloadIdentityPool
+   */
+  getWorkloadIdentityPool: {
+    methodKind: "unary";
+    input: typeof GetWorkloadIdentityPoolRequestSchema;
+    output: typeof WorkloadIdentityPoolSchema;
+  },
+  /**
+   * Creates a new
+   * [WorkloadIdentityPool][google.iam.v1beta.WorkloadIdentityPool].
+   *
+   * You cannot reuse the name of a deleted pool until 30 days after deletion.
+   *
+   * @generated from rpc google.iam.v1beta.WorkloadIdentityPools.CreateWorkloadIdentityPool
+   */
+  createWorkloadIdentityPool: {
+    methodKind: "unary";
+    input: typeof CreateWorkloadIdentityPoolRequestSchema;
+    output: typeof OperationSchema;
+  },
+  /**
+   * Updates an existing
+   * [WorkloadIdentityPool][google.iam.v1beta.WorkloadIdentityPool].
+   *
+   * @generated from rpc google.iam.v1beta.WorkloadIdentityPools.UpdateWorkloadIdentityPool
+   */
+  updateWorkloadIdentityPool: {
+    methodKind: "unary";
+    input: typeof UpdateWorkloadIdentityPoolRequestSchema;
+    output: typeof OperationSchema;
+  },
+  /**
+   * Deletes a
+   * [WorkloadIdentityPool][google.iam.v1beta.WorkloadIdentityPool].
+   *
+   * You cannot use a deleted pool to exchange external
+   * credentials for Google Cloud credentials. However, deletion does
+   * not revoke credentials that have already been issued.
+   * Credentials issued for a deleted pool do not grant access to resources.
+   * If the pool is undeleted, and the credentials are not expired, they
+   * grant access again.
+   * You can undelete a pool for 30 days. After 30 days, deletion is
+   * permanent.
+   * You cannot update deleted pools. However, you can view and list them.
+   *
+   * @generated from rpc google.iam.v1beta.WorkloadIdentityPools.DeleteWorkloadIdentityPool
+   */
+  deleteWorkloadIdentityPool: {
+    methodKind: "unary";
+    input: typeof DeleteWorkloadIdentityPoolRequestSchema;
+    output: typeof OperationSchema;
+  },
+  /**
+   * Undeletes a [WorkloadIdentityPool][google.iam.v1beta.WorkloadIdentityPool],
+   * as long as it was deleted fewer than 30 days ago.
+   *
+   * @generated from rpc google.iam.v1beta.WorkloadIdentityPools.UndeleteWorkloadIdentityPool
+   */
+  undeleteWorkloadIdentityPool: {
+    methodKind: "unary";
+    input: typeof UndeleteWorkloadIdentityPoolRequestSchema;
+    output: typeof OperationSchema;
+  },
+  /**
+   * Lists all non-deleted
+   * [WorkloadIdentityPoolProvider][google.iam.v1beta.WorkloadIdentityPoolProvider]s
+   * in a [WorkloadIdentityPool][google.iam.v1beta.WorkloadIdentityPool].
+   * If `show_deleted` is set to `true`, then deleted providers are also listed.
+   *
+   * @generated from rpc google.iam.v1beta.WorkloadIdentityPools.ListWorkloadIdentityPoolProviders
+   */
+  listWorkloadIdentityPoolProviders: {
+    methodKind: "unary";
+    input: typeof ListWorkloadIdentityPoolProvidersRequestSchema;
+    output: typeof ListWorkloadIdentityPoolProvidersResponseSchema;
+  },
+  /**
+   * Gets an individual
+   * [WorkloadIdentityPoolProvider][google.iam.v1beta.WorkloadIdentityPoolProvider].
+   *
+   * @generated from rpc google.iam.v1beta.WorkloadIdentityPools.GetWorkloadIdentityPoolProvider
+   */
+  getWorkloadIdentityPoolProvider: {
+    methodKind: "unary";
+    input: typeof GetWorkloadIdentityPoolProviderRequestSchema;
+    output: typeof WorkloadIdentityPoolProviderSchema;
+  },
+  /**
+   * Creates a new
+   * [WorkloadIdentityPoolProvider][google.iam.v1beta.WorkloadIdentityProvider]
+   * in a [WorkloadIdentityPool][google.iam.v1beta.WorkloadIdentityPool].
+   *
+   * You cannot reuse the name of a deleted provider until 30 days after
+   * deletion.
+   *
+   * @generated from rpc google.iam.v1beta.WorkloadIdentityPools.CreateWorkloadIdentityPoolProvider
+   */
+  createWorkloadIdentityPoolProvider: {
+    methodKind: "unary";
+    input: typeof CreateWorkloadIdentityPoolProviderRequestSchema;
+    output: typeof OperationSchema;
+  },
+  /**
+   * Updates an existing
+   * [WorkloadIdentityPoolProvider][google.iam.v1beta.WorkloadIdentityProvider].
+   *
+   * @generated from rpc google.iam.v1beta.WorkloadIdentityPools.UpdateWorkloadIdentityPoolProvider
+   */
+  updateWorkloadIdentityPoolProvider: {
+    methodKind: "unary";
+    input: typeof UpdateWorkloadIdentityPoolProviderRequestSchema;
+    output: typeof OperationSchema;
+  },
+  /**
+   * Deletes a
+   * [WorkloadIdentityPoolProvider][google.iam.v1beta.WorkloadIdentityProvider].
+   * Deleting a provider does not revoke credentials that have already been
+   * issued; they continue to grant access.
+   * You can undelete a provider for 30 days. After 30 days, deletion is
+   * permanent.
+   * You cannot update deleted providers. However, you can view and list them.
+   *
+   * @generated from rpc google.iam.v1beta.WorkloadIdentityPools.DeleteWorkloadIdentityPoolProvider
+   */
+  deleteWorkloadIdentityPoolProvider: {
+    methodKind: "unary";
+    input: typeof DeleteWorkloadIdentityPoolProviderRequestSchema;
+    output: typeof OperationSchema;
+  },
+  /**
+   * Undeletes a
+   * [WorkloadIdentityPoolProvider][google.iam.v1beta.WorkloadIdentityProvider],
+   * as long as it was deleted fewer than 30 days ago.
+   *
+   * @generated from rpc google.iam.v1beta.WorkloadIdentityPools.UndeleteWorkloadIdentityPoolProvider
+   */
+  undeleteWorkloadIdentityPoolProvider: {
+    methodKind: "unary";
+    input: typeof UndeleteWorkloadIdentityPoolProviderRequestSchema;
+    output: typeof OperationSchema;
+  },
+}>;