@pulumi/gcp 6.10.0 → 6.12.0

package/types/output.d.ts

@@ -5548,6 +5548,52 @@ export declare namespace cloudfunctions {
         expression: string;
         title: string;
     }
+    interface FunctionSecretEnvironmentVariable {
+        /**
+         * Name of the environment variable.
+         */
+        key: string;
+        /**
+         * Project identifier (due to a known limitation, only project number is supported by this field) of the project that contains the secret. If not set, it will be populated with the function's project, assuming that the secret exists in the same project as of the function.
+         */
+        projectId: string;
+        /**
+         * ID of the secret in secret manager (not the full resource name).
+         */
+        secret: string;
+        /**
+         * Version of the secret (version number or the string "latest"). It is preferable to use "latest" version with secret volumes as secret value changes are reflected immediately.
+         */
+        version: string;
+    }
+    interface FunctionSecretVolume {
+        /**
+         * The path within the container to mount the secret volume. For example, setting the mountPath as "/etc/secrets" would mount the secret value files under the "/etc/secrets" directory. This directory will also be completely shadowed and unavailable to mount any other secrets. Recommended mount paths: "/etc/secrets" Restricted mount paths: "/cloudsql", "/dev/log", "/pod", "/proc", "/var/log".
+         */
+        mountPath: string;
+        /**
+         * Project identifier (due to a known limitation, only project number is supported by this field) of the project that contains the secret. If not set, it will be populated with the function's project, assuming that the secret exists in the same project as of the function.
+         */
+        projectId: string;
+        /**
+         * ID of the secret in secret manager (not the full resource name).
+         */
+        secret: string;
+        /**
+         * List of secret versions to mount for this secret. If empty, the "latest" version of the secret will be made available in a file named after the secret under the mount point. Structure is documented below.
+         */
+        versions?: outputs.cloudfunctions.FunctionSecretVolumeVersion[];
+    }
+    interface FunctionSecretVolumeVersion {
+        /**
+         * Relative path of the file under the mount path where the secret value for this version will be fetched and made available. For example, setting the mountPath as "/etc/secrets" and path as "/secret_foo" would mount the secret value file at "/etc/secrets/secret_foo".
+         */
+        path: string;
+        /**
+         * Version of the secret (version number or the string "latest"). It is preferable to use "latest" version with secret volumes as secret value changes are reflected immediately.
+         */
+        version: string;
+    }
     interface FunctionSourceRepository {
         deployedUrl: string;
         /**
@@ -5577,6 +5623,22 @@ export declare namespace cloudfunctions {
          */
         retry: boolean;
     }
+    interface GetFunctionSecretEnvironmentVariable {
+        key: string;
+        projectId: string;
+        secret: string;
+        version: string;
+    }
+    interface GetFunctionSecretVolume {
+        mountPath: string;
+        projectId: string;
+        secret: string;
+        versions: outputs.cloudfunctions.GetFunctionSecretVolumeVersion[];
+    }
+    interface GetFunctionSecretVolumeVersion {
+        path: string;
+        version: string;
+    }
     interface GetFunctionSourceRepository {
         deployedUrl: string;
         /**
@@ -6349,15 +6411,15 @@ export declare namespace cloudrun {
     }
     interface ServiceTemplateSpecContainerPort {
         /**
-         * Port number.
+         * Port number the container listens on. This must be a valid port number, 0 < x < 65536.
          */
-        containerPort: number;
+        containerPort?: number;
         /**
          * Volume's name.
          */
         name: string;
         /**
-         * Protocol used on port. Defaults to TCP.
+         * Protocol for port. Must be "TCP". Defaults to "TCP".
          */
         protocol?: string;
     }
@@ -7785,6 +7847,16 @@ export declare namespace compute {
          */
         seconds: number;
     }
+    interface BackendServiceIamBindingCondition {
+        description?: string;
+        expression: string;
+        title: string;
+    }
+    interface BackendServiceIamMemberCondition {
+        description?: string;
+        expression: string;
+        title: string;
+    }
     interface BackendServiceIap {
         /**
          * OAuth2 Client ID for IAP
@@ -7916,7 +7988,17 @@ export declare namespace compute {
         seconds: number;
     }
     interface BackendServiceSecuritySettings {
+        /**
+         * ClientTlsPolicy is a resource that specifies how a client should authenticate
+         * connections to backends of a service. This resource itself does not affect
+         * configuration unless it is attached to a backend service resource.
+         */
         clientTlsPolicy: string;
+        /**
+         * A list of alternate names to verify the subject identity in the certificate.
+         * If specified, the client will verify that the server certificate's subject
+         * alt name matches one of the specified values.
+         */
         subjectAltNames: string[];
     }
     interface DiskDiskEncryptionKey {
@@ -11792,18 +11874,15 @@ export declare namespace compute {
          */
         service?: string;
         /**
-         * A template to parse function field from a request URL. URL mask allows
-         * for routing to multiple Cloud Functions without having to create
-         * multiple Network Endpoint Groups and backend services.
-         * For example, request URLs "mydomain.com/function1" and "mydomain.com/function2"
-         * can be backed by the same Serverless NEG with URL mask "/". The URL mask
-         * will parse them to { function = "function1" } and { function = "function2" } respectively.
+         * A template to parse platform-specific fields from a request URL. URL mask allows for routing to multiple resources
+         * on the same serverless platform without having to create multiple Network Endpoint Groups and backend resources.
+         * The fields parsed by this template are platform-specific and are as follows: API Gateway: The gateway ID,
+         * App Engine: The service and version, Cloud Functions: The function name, Cloud Run: The service and tag
          */
         urlMask?: string;
         /**
-         * Optional serving version.
-         * The version must be 1-63 characters long, and comply with RFC1035.
-         * Example value: "v1", "v2".
+         * The optional resource version. The version identified by this value is platform-specific and is follows:
+         * API Gateway: Unused, App Engine: The service version, Cloud Functions: Unused, Cloud Run: The service tag
          */
         version?: string;
     }
@@ -11815,12 +11894,10 @@ export declare namespace compute {
          */
         function?: string;
         /**
-         * A template to parse function field from a request URL. URL mask allows
-         * for routing to multiple Cloud Functions without having to create
-         * multiple Network Endpoint Groups and backend services.
-         * For example, request URLs "mydomain.com/function1" and "mydomain.com/function2"
-         * can be backed by the same Serverless NEG with URL mask "/". The URL mask
-         * will parse them to { function = "function1" } and { function = "function2" } respectively.
+         * A template to parse platform-specific fields from a request URL. URL mask allows for routing to multiple resources
+         * on the same serverless platform without having to create multiple Network Endpoint Groups and backend resources.
+         * The fields parsed by this template are platform-specific and are as follows: API Gateway: The gateway ID,
+         * App Engine: The service and version, Cloud Functions: The function name, Cloud Run: The service and tag
          */
         urlMask?: string;
     }
@@ -11839,15 +11916,38 @@ export declare namespace compute {
          */
         tag?: string;
         /**
-         * A template to parse function field from a request URL. URL mask allows
-         * for routing to multiple Cloud Functions without having to create
-         * multiple Network Endpoint Groups and backend services.
-         * For example, request URLs "mydomain.com/function1" and "mydomain.com/function2"
-         * can be backed by the same Serverless NEG with URL mask "/". The URL mask
-         * will parse them to { function = "function1" } and { function = "function2" } respectively.
+         * A template to parse platform-specific fields from a request URL. URL mask allows for routing to multiple resources
+         * on the same serverless platform without having to create multiple Network Endpoint Groups and backend resources.
+         * The fields parsed by this template are platform-specific and are as follows: API Gateway: The gateway ID,
+         * App Engine: The service and version, Cloud Functions: The function name, Cloud Run: The service and tag
          */
         urlMask?: string;
     }
+    interface RegionNetworkEndpointGroupServerlessDeployment {
+        /**
+         * The platform of the NEG backend target(s). Possible values:
+         * API Gateway: apigateway.googleapis.com
+         */
+        platform: string;
+        /**
+         * The user-defined name of the workload/instance. This value must be provided explicitly or in the urlMask.
+         * The resource identified by this value is platform-specific and is as follows: API Gateway: The gateway ID, App Engine: The service name,
+         * Cloud Functions: The function name, Cloud Run: The service name
+         */
+        resource?: string;
+        /**
+         * A template to parse platform-specific fields from a request URL. URL mask allows for routing to multiple resources
+         * on the same serverless platform without having to create multiple Network Endpoint Groups and backend resources.
+         * The fields parsed by this template are platform-specific and are as follows: API Gateway: The gateway ID,
+         * App Engine: The service and version, Cloud Functions: The function name, Cloud Run: The service and tag
+         */
+        urlMask: string;
+        /**
+         * The optional resource version. The version identified by this value is platform-specific and is follows:
+         * API Gateway: Unused, App Engine: The service version, Cloud Functions: Unused, Cloud Run: The service tag
+         */
+        version?: string;
+    }
     interface RegionPerInstanceConfigPreservedState {
         /**
          * Stateful disks for the instance.
@@ -13541,6 +13641,8 @@ export declare namespace compute {
          * Action to take when `match` matches the request. Valid values:
          * * "allow" : allow access to target
          * * "deny(status)" : deny access to target, returns the  HTTP response code specified (valid values are 403, 404 and 502)
+         * * "rateBasedBan" : limit client traffic to the configured threshold and ban the client if the traffic exceeds the threshold. Configure parameters for this action in RateLimitOptions. Requires rateLimitOptions to be set.
+         * * "threshold" : limit client traffic to the configured threshold. Configure parameters for this action in rateLimitOptions. Requires rateLimitOptions to be set for this.
          */
         action: string;
         /**
@@ -13562,6 +13664,11 @@ export declare namespace compute {
          * Rules are evaluated from highest priority (lowest numerically) to lowest priority (highest numerically) in order.
          */
         priority: number;
+        /**
+         * )
+         * Must be specified if the `action` is "rateBasedBad" or "throttle". Cannot be specified for other actions. Structure is documented below.
+         */
+        rateLimitOptions?: outputs.compute.SecurityPolicyRuleRateLimitOptions;
     }
     interface SecurityPolicyRuleMatch {
         /**
@@ -13598,6 +13705,66 @@ export declare namespace compute {
          */
         expression: string;
     }
+    interface SecurityPolicyRuleRateLimitOptions {
+        /**
+         * Can only be specified if the `action` for the rule is "rateBasedBan".
+         * If specified, determines the time (in seconds) the traffic will continue to be banned by the rate limit after the rate falls below the threshold.
+         */
+        banDurationSec?: number;
+        /**
+         * Can only be specified if the `action` for the rule is "rateBasedBan".
+         * If specified, the key will be banned for the configured 'ban_duration_sec' when the number of requests that exceed the 'rate_limit_threshold' also
+         * exceed this 'ban_threshold'. Structure is documented below.
+         */
+        banThreshold?: outputs.compute.SecurityPolicyRuleRateLimitOptionsBanThreshold;
+        /**
+         * Action to take for requests that are under the configured rate limit threshold. Valid option is "allow" only.
+         */
+        conformAction: string;
+        /**
+         * Determines the key to enforce the rateLimitThreshold on.
+         * Possible values incude "ALL", "ALL_IPS", "HTTP_HEADER", "IP", "XFF_IP". If not specified, defaults to "ALL".
+         */
+        enforceOnKey?: string;
+        /**
+         * Rate limit key name applicable only for HTTP_HEADER key types. Name of the HTTP header whose value is taken as the key value.
+         */
+        enforceOnKeyName?: string;
+        /**
+         * When a request is denied, returns the HTTP response code specified.
+         * Valid options are "deny()" where valid values for status are 403, 404, 429, and 502.
+         */
+        exceedAction: string;
+        exceedRedirectOptions?: outputs.compute.SecurityPolicyRuleRateLimitOptionsExceedRedirectOptions;
+        /**
+         * Threshold at which to begin ratelimiting. Structure is documented below.
+         */
+        rateLimitThreshold: outputs.compute.SecurityPolicyRuleRateLimitOptionsRateLimitThreshold;
+    }
+    interface SecurityPolicyRuleRateLimitOptionsBanThreshold {
+        /**
+         * Number of HTTP(S) requests for calculating the threshold.
+         */
+        count: number;
+        /**
+         * Interval over which the threshold is computed.
+         */
+        intervalSec: number;
+    }
+    interface SecurityPolicyRuleRateLimitOptionsExceedRedirectOptions {
+        target?: string;
+        type: string;
+    }
+    interface SecurityPolicyRuleRateLimitOptionsRateLimitThreshold {
+        /**
+         * Number of HTTP(S) requests for calculating the threshold.
+         */
+        count: number;
+        /**
+         * Interval over which the threshold is computed.
+         */
+        intervalSec: number;
+    }
     interface SecurityScanConfigAuthentication {
         /**
          * Describes authentication configuration that uses a custom account.
@@ -16119,6 +16286,12 @@ export declare namespace container {
          * Whether this cluster should enable the Google Compute Engine Persistent Disk Container Storage Interface (CSI) Driver. Defaults to disabled; set `enabled = true` to enable.
          */
         gcePersistentDiskCsiDriverConfig: outputs.container.ClusterAddonsConfigGcePersistentDiskCsiDriverConfig;
+        /**
+         * The status of the Filestore CSI driver addon,
+         * which allows the usage of filestore instance as volumes.
+         * It is disbaled by default; set `enabled = true` to enable.
+         */
+        gcpFilestoreCsiDriverConfig: outputs.container.ClusterAddonsConfigGcpFilestoreCsiDriverConfig;
         /**
          * The status of the Horizontal Pod Autoscaling
          * addon, which increases or decreases the number of replica pods a replication controller
@@ -16186,6 +16359,13 @@ export declare namespace container {
          */
         enabled: boolean;
     }
+    interface ClusterAddonsConfigGcpFilestoreCsiDriverConfig {
+        /**
+         * Enable the PodSecurityPolicy controller for this cluster.
+         * If enabled, pods must be valid under a PodSecurityPolicy to be created.
+         */
+        enabled: boolean;
+    }
     interface ClusterAddonsConfigHorizontalPodAutoscaling {
         /**
          * The status of the Istio addon, which makes it easy to set up Istio for services in a
@@ -16258,6 +16438,11 @@ export declare namespace container {
         resourceLimits?: outputs.container.ClusterClusterAutoscalingResourceLimit[];
     }
     interface ClusterClusterAutoscalingAutoProvisioningDefaults {
+        /**
+         * The image type to use for this node. Note that changing the image type
+         * will delete and recreate all nodes in the node pool.
+         */
+        imageType?: string;
         /**
          * Minimum CPU platform to be used by this instance.
          * The instance may be scheduled on the specified or newer CPU platform. Applicable
@@ -16461,7 +16646,7 @@ export declare namespace container {
     }
     interface ClusterNodeConfig {
         /**
-         * The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption
+         * The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. For more information about protecting resources with Cloud KMS Keys please see: <https://cloud.google.com/compute/docs/disks/customer-managed-encryption>
          */
         bootDiskKmsKey?: string;
         /**
@@ -16560,8 +16745,7 @@ export declare namespace container {
          */
         preemptible?: boolean;
         /**
-         * ) [GKE Sandbox](https://cloud.google.com/kubernetes-engine/docs/how-to/sandbox-pods) configuration. When enabling this feature you must specify `imageType = "COS_CONTAINERD"` and `nodeVersion = "1.12.7-gke.17"` or later to use it.
-         * >>>>>>> v4.3.0
+         * [GKE Sandbox](https://cloud.google.com/kubernetes-engine/docs/how-to/sandbox-pods) configuration. When enabling this feature you must specify `imageType = "COS_CONTAINERD"` and `nodeVersion = "1.12.7-gke.17"` or later to use it.
          * Structure is documented below.
          */
         sandboxConfig?: outputs.container.ClusterNodeConfigSandboxConfig;
@@ -16769,7 +16953,7 @@ export declare namespace container {
     }
     interface ClusterNodePoolNodeConfig {
         /**
-         * The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. For more information about protecting resources with Cloud KMS Keys please see: https://cloud.google.com/compute/docs/disks/customer-managed-encryption
+         * The Customer Managed Encryption Key used to encrypt the boot disk attached to each node in the node pool. This should be of the form projects/[KEY_PROJECT_ID]/locations/[LOCATION]/keyRings/[RING_NAME]/cryptoKeys/[KEY_NAME]. For more information about protecting resources with Cloud KMS Keys please see: <https://cloud.google.com/compute/docs/disks/customer-managed-encryption>
          */
         bootDiskKmsKey?: string;
         /**
@@ -16868,8 +17052,7 @@ export declare namespace container {
          */
         preemptible?: boolean;
         /**
-         * ) [GKE Sandbox](https://cloud.google.com/kubernetes-engine/docs/how-to/sandbox-pods) configuration. When enabling this feature you must specify `imageType = "COS_CONTAINERD"` and `nodeVersion = "1.12.7-gke.17"` or later to use it.
-         * >>>>>>> v4.3.0
+         * [GKE Sandbox](https://cloud.google.com/kubernetes-engine/docs/how-to/sandbox-pods) configuration. When enabling this feature you must specify `imageType = "COS_CONTAINERD"` and `nodeVersion = "1.12.7-gke.17"` or later to use it.
          * Structure is documented below.
          */
         sandboxConfig?: outputs.container.ClusterNodePoolNodeConfigSandboxConfig;
@@ -17138,6 +17321,7 @@ export declare namespace container {
         configConnectorConfigs: outputs.container.GetClusterAddonsConfigConfigConnectorConfig[];
         dnsCacheConfigs: outputs.container.GetClusterAddonsConfigDnsCacheConfig[];
         gcePersistentDiskCsiDriverConfigs: outputs.container.GetClusterAddonsConfigGcePersistentDiskCsiDriverConfig[];
+        gcpFilestoreCsiDriverConfigs: outputs.container.GetClusterAddonsConfigGcpFilestoreCsiDriverConfig[];
         horizontalPodAutoscalings: outputs.container.GetClusterAddonsConfigHorizontalPodAutoscaling[];
         httpLoadBalancings: outputs.container.GetClusterAddonsConfigHttpLoadBalancing[];
         istioConfigs: outputs.container.GetClusterAddonsConfigIstioConfig[];
@@ -17157,6 +17341,9 @@ export declare namespace container {
     interface GetClusterAddonsConfigGcePersistentDiskCsiDriverConfig {
         enabled: boolean;
     }
+    interface GetClusterAddonsConfigGcpFilestoreCsiDriverConfig {
+        enabled: boolean;
+    }
     interface GetClusterAddonsConfigHorizontalPodAutoscaling {
         disabled: boolean;
     }
@@ -17183,6 +17370,7 @@ export declare namespace container {
         resourceLimits: outputs.container.GetClusterClusterAutoscalingResourceLimit[];
     }
     interface GetClusterClusterAutoscalingAutoProvisioningDefault {
+        imageType: string;
         minCpuPlatform: string;
         oauthScopes: string[];
         serviceAccount: string;
@@ -28241,6 +28429,10 @@ export declare namespace spanner {
 }
 export declare namespace sql {
     interface DatabaseInstanceClone {
+        /**
+         * The name of the allocated ip range for the private ip CloudSQL instance. For example: "google-managed-services-default". If set, the cloned instance ip will be created in the allocated range. The range name must comply with [RFC 1035](https://tools.ietf.org/html/rfc1035). Specifically, the name must be 1-63 characters long and match the regular expression a-z?.
+         */
+        allocatedIpRange?: string;
         /**
          * The timestamp of the point in time that should be restored.
          */
@@ -28394,8 +28586,7 @@ export declare namespace sql {
          */
         backupRetentionSettings: outputs.sql.DatabaseInstanceSettingsBackupConfigurationBackupRetentionSettings;
         /**
-         * True if binary logging is enabled. If
-         * `settings.backup_configuration.enabled` is false, this must be as well.
+         * True if binary logging is enabled.
          * Cannot be used with Postgres.
          */
         binaryLogEnabled?: boolean;
@@ -28464,7 +28655,7 @@ export declare namespace sql {
     }
     interface DatabaseInstanceSettingsIpConfiguration {
         /**
-         * The name of the allocated ip range for the private ip CloudSQL instance. For example: "google-managed-services-default". If set, the instance ip will be created in the allocated range. The range name must comply with [RFC 1035](https://datatracker.ietf.org/doc/html/rfc1035). Specifically, the name must be 1-63 characters long and match the regular expression a-z?.
+         * The name of the allocated ip range for the private ip CloudSQL instance. For example: "google-managed-services-default". If set, the cloned instance ip will be created in the allocated range. The range name must comply with [RFC 1035](https://tools.ietf.org/html/rfc1035). Specifically, the name must be 1-63 characters long and match the regular expression a-z?.
          */
         allocatedIpRange?: string;
         authorizedNetworks?: outputs.sql.DatabaseInstanceSettingsIpConfigurationAuthorizedNetwork[];
@@ -28554,6 +28745,7 @@ export declare namespace sql {
         sha1Fingerprint: string;
     }
     interface GetDatabaseInstanceClone {
+        allocatedIpRange: string;
         pointInTime: string;
         sourceInstanceName: string;
     }
@@ -28963,6 +29155,14 @@ export declare namespace storage {
          * Only objects that satisfy these object conditions are included in the set of data source and data sink objects. Object conditions based on objects' `lastModificationTime` do not exclude objects in a data sink. Structure documented below.
          */
         objectConditions?: outputs.storage.TransferJobTransferSpecObjectConditions;
+        /**
+         * A POSIX data sink. Structure documented below.
+         */
+        posixDataSink?: outputs.storage.TransferJobTransferSpecPosixDataSink;
+        /**
+         * A POSIX filesystem data source. Structure documented below.
+         */
+        posixDataSource?: outputs.storage.TransferJobTransferSpecPosixDataSource;
         /**
          * Characteristics of how to treat files from datasource and sink during job. If the option `deleteObjectsUniqueInSink` is true, object conditions based on objects' `lastModificationTime` are ignored and do not exclude objects in a data source or a data sink. Structure documented below.
          */
@@ -29060,6 +29260,18 @@ export declare namespace storage {
          */
         minTimeElapsedSinceLastModification?: string;
     }
+    interface TransferJobTransferSpecPosixDataSink {
+        /**
+         * Root directory path to the filesystem.
+         */
+        rootDirectory: string;
+    }
+    interface TransferJobTransferSpecPosixDataSource {
+        /**
+         * Root directory path to the filesystem.
+         */
+        rootDirectory: string;
+    }
     interface TransferJobTransferSpecTransferOptions {
         /**
          * Whether objects should be deleted from the source after they are transferred to the sink. Note that this option and `deleteObjectsUniqueInSink` are mutually exclusive.

package/vpcaccess/connector.d.ts

@@ -182,7 +182,7 @@ export declare class Connector extends pulumi.CustomResource {
      */
     readonly name: pulumi.Output<string>;
     /**
-     * Name of the VPC network. Required if `ipCidrRange` is set.
+     * Name or selfLink of the VPC network. Required if `ipCidrRange` is set.
      */
     readonly network: pulumi.Output<string | undefined>;
     /**
@@ -250,7 +250,7 @@ export interface ConnectorState {
      */
     name?: pulumi.Input<string>;
     /**
-     * Name of the VPC network. Required if `ipCidrRange` is set.
+     * Name or selfLink of the VPC network. Required if `ipCidrRange` is set.
      */
     network?: pulumi.Input<string>;
     /**
@@ -310,7 +310,7 @@ export interface ConnectorArgs {
      */
     name?: pulumi.Input<string>;
     /**
-     * Name of the VPC network. Required if `ipCidrRange` is set.
+     * Name or selfLink of the VPC network. Required if `ipCidrRange` is set.
      */
     network?: pulumi.Input<string>;
     /**