From 817f5f4ab3fcce38542404d319e4ee74d914d15c Mon Sep 17 00:00:00 2001 From: Eitan Yarmush Date: Tue, 11 Aug 2026 14:14:38 +0000 Subject: [PATCH] feat(ateapi): add actor egress policy API --- .../internal/controlapi/egress_policy.go | 464 ++++ .../internal/controlapi/egress_policy_test.go | 179 ++ cmd/ateapi/internal/controlapi/service.go | 4 + .../internal/store/ateredis/ateredis.go | 47 + .../internal/store/ateredis/egress_policy.go | 309 +++ .../store/ateredis/egress_policy_test.go | 96 + cmd/ateapi/internal/store/store.go | 13 + cmd/ateapi/main.go | 2 + cmd/atelet/main_test.go | 6 + demos/egress/egress.yaml.tmpl | 1 - .../proto/egresspolicypb/egress_policy.pb.go | 267 +++ .../proto/egresspolicypb/egress_policy.proto | 41 + .../egresspolicypb/egress_policy_grpc.pb.go | 139 ++ internal/proto/egresspolicypb/gen.go | 17 + pkg/proto/ateapipb/ateapi.pb.go | 2033 ++++++++++++++--- pkg/proto/ateapipb/ateapi.proto | 104 + pkg/proto/ateapipb/ateapi_grpc.pb.go | 380 +++ 17 files changed, 3720 insertions(+), 382 deletions(-) create mode 100644 cmd/ateapi/internal/controlapi/egress_policy.go create mode 100644 cmd/ateapi/internal/controlapi/egress_policy_test.go create mode 100644 cmd/ateapi/internal/store/ateredis/egress_policy.go create mode 100644 cmd/ateapi/internal/store/ateredis/egress_policy_test.go create mode 100644 internal/proto/egresspolicypb/egress_policy.pb.go create mode 100644 internal/proto/egresspolicypb/egress_policy.proto create mode 100644 internal/proto/egresspolicypb/egress_policy_grpc.pb.go create mode 100644 internal/proto/egresspolicypb/gen.go diff --git a/cmd/ateapi/internal/controlapi/egress_policy.go b/cmd/ateapi/internal/controlapi/egress_policy.go new file mode 100644 index 000000000..52b3ab35e --- /dev/null +++ b/cmd/ateapi/internal/controlapi/egress_policy.go @@ -0,0 +1,464 @@ +// Copyright 2026 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package controlapi + +import ( + "context" + "errors" + "fmt" + "net/netip" + "slices" + "sort" + "strings" + + "github.com/agent-substrate/substrate/cmd/ateapi/internal/store" + "github.com/agent-substrate/substrate/internal/principal" + "github.com/agent-substrate/substrate/internal/proto/egresspolicypb" + "github.com/agent-substrate/substrate/internal/resources" + "github.com/agent-substrate/substrate/pkg/proto/ateapipb" + "google.golang.org/grpc/codes" + "google.golang.org/grpc/status" + "google.golang.org/protobuf/proto" + "google.golang.org/protobuf/types/known/emptypb" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" + "k8s.io/apimachinery/pkg/util/validation" + "k8s.io/apimachinery/pkg/util/validation/field" +) + +// TODO: Make this configurable when Substrate supports installing the egress gateway outside ate-system. +const egressGatewayPrincipal = "spiffe://cluster.local/ns/ate-system/sa/atenet-egress" + +var ( + egressPolicyMutableFields = mutableFields[*ateapipb.EgressPolicy]{ + "allow_all": func(dst, src *ateapipb.EgressPolicy) { + dst.AllowAll = nil + if src.GetAllowAll() != nil { + dst.AllowAll = &emptypb.Empty{} + } + }, + "rules": func(dst, src *ateapipb.EgressPolicy) { + dst.Rules = proto.Clone(src).(*ateapipb.EgressPolicy).GetRules() + }, + "extensions": func(dst, src *ateapipb.EgressPolicy) { + dst.Extensions = proto.Clone(src).(*ateapipb.EgressPolicy).GetExtensions() + }, + } + credentialMutableFields = mutableFields[*ateapipb.Credential]{ + "kubernetes_secret": func(dst, src *ateapipb.Credential) { + dst.Source = &ateapipb.Credential_KubernetesSecret{KubernetesSecret: proto.Clone(src.GetKubernetesSecret()).(*ateapipb.KubernetesSecretKeySelector)} + }, + } +) + +func (s *Service) GetEgressPolicy(ctx context.Context, req *ateapipb.GetEgressPolicyRequest) (*ateapipb.EgressPolicy, error) { + ref := req.GetEgressPolicy() + if errs := validateScopedRef(ref, field.NewPath("egress_policy")); len(errs) > 0 { + return nil, toGRPCStatusError(errs) + } + policy, err := s.persistence.GetEgressPolicy(ctx, ref.GetAtespace(), ref.GetName()) + return getResource(policy, err, "EgressPolicy", ref) +} + +func (s *Service) CreateEgressPolicy(ctx context.Context, req *ateapipb.CreateEgressPolicyRequest) (*ateapipb.EgressPolicy, error) { + policy := req.GetEgressPolicy() + if errs := validateEgressPolicy(policy); len(errs) > 0 { + return nil, toGRPCStatusError(errs) + } + policy = normalizeEgressPolicy(policy) + actorRef := resources.ActorRefFromObjectRef(policy.GetActor()) + actor, err := s.persistence.GetActor(ctx, actorRef) + if errors.Is(err, store.ErrNotFound) { + return nil, status.Errorf(codes.FailedPrecondition, "target Actor %s/%s does not exist", actorRef.Atespace, actorRef.Name) + } + if err != nil { + return nil, fmt.Errorf("while resolving target Actor: %w", err) + } + created, err := s.persistence.CreateEgressPolicy(ctx, policy, actor.GetMetadata().GetUid()) + return mapResourceWrite(created, err, "EgressPolicy") +} + +func (s *Service) UpdateEgressPolicy(ctx context.Context, req *ateapipb.UpdateEgressPolicyRequest) (*ateapipb.EgressPolicy, error) { + policy := req.GetEgressPolicy() + errs := validateEgressPolicy(policy) + errs = append(errs, validateUpdateMask(req.GetUpdateMask(), egressPolicyMutableFields)...) + if len(errs) > 0 { + return nil, toGRPCStatusError(errs) + } + policy = normalizeEgressPolicy(policy) + md := policy.GetMetadata() + updated, err := s.persistence.UpdateEgressPolicy(ctx, md.GetAtespace(), md.GetName(), func(current *ateapipb.EgressPolicy) error { + if err := checkMetadataPreconditions(current.GetMetadata(), md); err != nil { + return err + } + if !proto.Equal(current.GetActor(), policy.GetActor()) { + return store.ErrFailedPrecondition + } + applyUpdateMask(current, policy, req.GetUpdateMask(), egressPolicyMutableFields) + return nil + }) + return mapResourceWrite(updated, err, "EgressPolicy") +} + +func (s *Service) DeleteEgressPolicy(ctx context.Context, req *ateapipb.DeleteEgressPolicyRequest) (*ateapipb.EgressPolicy, error) { + ref := req.GetEgressPolicy() + if errs := validateScopedRef(ref, field.NewPath("egress_policy")); len(errs) > 0 { + return nil, toGRPCStatusError(errs) + } + deleted, err := s.persistence.DeleteEgressPolicy(ctx, ref.GetAtespace(), ref.GetName()) + return mapResourceWrite(deleted, err, "EgressPolicy") +} + +func (s *Service) ListEgressPolicies(ctx context.Context, req *ateapipb.ListEgressPoliciesRequest) (*ateapipb.ListEgressPoliciesResponse, error) { + if errs := validateScopedList(req.GetAtespace(), req.GetPageSize()); len(errs) > 0 { + return nil, toGRPCStatusError(errs) + } + policies, next, err := s.persistence.ListEgressPolicies(ctx, req.GetAtespace(), effectivePageSize(req.GetPageSize()), req.GetPageToken()) + if err != nil { + return nil, fmt.Errorf("while listing egress policies: %w", err) + } + return &ateapipb.ListEgressPoliciesResponse{EgressPolicies: policies, NextPageToken: next}, nil +} + +func (s *Service) GetCredential(ctx context.Context, req *ateapipb.GetCredentialRequest) (*ateapipb.Credential, error) { + ref := req.GetCredential() + if errs := validateScopedRef(ref, field.NewPath("credential")); len(errs) > 0 { + return nil, toGRPCStatusError(errs) + } + credential, err := s.persistence.GetCredential(ctx, ref.GetAtespace(), ref.GetName()) + return getResource(credential, err, "Credential", ref) +} + +func (s *Service) CreateCredential(ctx context.Context, req *ateapipb.CreateCredentialRequest) (*ateapipb.Credential, error) { + credential := req.GetCredential() + if errs := validateCredential(credential); len(errs) > 0 { + return nil, toGRPCStatusError(errs) + } + atespace := credential.GetMetadata().GetAtespace() + if _, err := s.persistence.GetAtespace(ctx, atespace); errors.Is(err, store.ErrNotFound) { + return nil, status.Errorf(codes.FailedPrecondition, "Atespace %s does not exist", atespace) + } else if err != nil { + return nil, fmt.Errorf("while resolving Atespace: %w", err) + } + created, err := s.persistence.CreateCredential(ctx, credential) + return mapResourceWrite(created, err, "Credential") +} + +func (s *Service) UpdateCredential(ctx context.Context, req *ateapipb.UpdateCredentialRequest) (*ateapipb.Credential, error) { + credential := req.GetCredential() + errs := validateCredential(credential) + errs = append(errs, validateUpdateMask(req.GetUpdateMask(), credentialMutableFields)...) + if len(errs) > 0 { + return nil, toGRPCStatusError(errs) + } + md := credential.GetMetadata() + updated, err := s.persistence.UpdateCredential(ctx, md.GetAtespace(), md.GetName(), func(current *ateapipb.Credential) error { + if err := checkMetadataPreconditions(current.GetMetadata(), md); err != nil { + return err + } + applyUpdateMask(current, credential, req.GetUpdateMask(), credentialMutableFields) + return nil + }) + return mapResourceWrite(updated, err, "Credential") +} + +func (s *Service) DeleteCredential(ctx context.Context, req *ateapipb.DeleteCredentialRequest) (*ateapipb.Credential, error) { + ref := req.GetCredential() + if errs := validateScopedRef(ref, field.NewPath("credential")); len(errs) > 0 { + return nil, toGRPCStatusError(errs) + } + deleted, err := s.persistence.DeleteCredential(ctx, ref.GetAtespace(), ref.GetName()) + return mapResourceWrite(deleted, err, "Credential") +} + +func (s *Service) ListCredentials(ctx context.Context, req *ateapipb.ListCredentialsRequest) (*ateapipb.ListCredentialsResponse, error) { + if errs := validateScopedList(req.GetAtespace(), req.GetPageSize()); len(errs) > 0 { + return nil, toGRPCStatusError(errs) + } + credentials, next, err := s.persistence.ListCredentials(ctx, req.GetAtespace(), effectivePageSize(req.GetPageSize()), req.GetPageToken()) + if err != nil { + return nil, fmt.Errorf("while listing credentials: %w", err) + } + return &ateapipb.ListCredentialsResponse{Credentials: credentials, NextPageToken: next}, nil +} + +func (s *Service) GetEffectiveEgressPolicy(ctx context.Context, req *egresspolicypb.GetEffectiveEgressPolicyRequest) (*egresspolicypb.EffectiveEgressPolicy, error) { + p, ok := principal.FromContext(ctx) + if !ok || p.Kind != principal.KindMTLS || p.ID != egressGatewayPrincipal { + return nil, status.Error(codes.PermissionDenied, "caller is not the egress gateway") + } + if errs := validateScopedRef(req.GetActor(), field.NewPath("actor")); len(errs) > 0 || req.GetActorUid() == "" { + if req.GetActorUid() == "" { + errs = append(errs, field.Required(field.NewPath("actor_uid"), "")) + } + return nil, toGRPCStatusError(errs) + } + actorRef := resources.ActorRefFromObjectRef(req.GetActor()) + actor, err := s.persistence.GetActor(ctx, actorRef) + if errors.Is(err, store.ErrNotFound) { + return nil, status.Error(codes.PermissionDenied, "actor is not authorized for egress") + } + if err != nil { + return nil, status.Errorf(codes.Unavailable, "while resolving actor: %v", err) + } + if actor.GetMetadata().GetUid() != req.GetActorUid() || actor.GetStatus() != ateapipb.Actor_STATUS_RUNNING { + return nil, status.Error(codes.PermissionDenied, "actor is not authorized for egress") + } + policy, err := s.persistence.GetEgressPolicyForActor(ctx, actorRef, req.GetActorUid()) + if errors.Is(err, store.ErrNotFound) { + return &egresspolicypb.EffectiveEgressPolicy{Policy: &ateapipb.EgressPolicy{}}, nil + } + if errors.Is(err, store.ErrUIDConflict) { + return nil, status.Error(codes.PermissionDenied, "actor is not authorized for this egress policy") + } + if err != nil { + return nil, fmt.Errorf("while resolving egress policy: %w", err) + } + response := &egresspolicypb.EffectiveEgressPolicy{Policy: proto.Clone(policy).(*ateapipb.EgressPolicy)} + for _, name := range referencedCredentials(policy) { + credential, err := s.persistence.GetCredential(ctx, actorRef.Atespace, name) + if err != nil { + return nil, status.Errorf(codes.FailedPrecondition, "credential %q cannot be resolved", name) + } + selector := credential.GetKubernetesSecret() + if selector == nil { + return nil, status.Errorf(codes.FailedPrecondition, "credential %q has no Kubernetes secret selector", name) + } + secret, err := s.kubeClient.CoreV1().Secrets(selector.GetNamespace()).Get(ctx, selector.GetName(), metav1.GetOptions{}) + if err != nil { + return nil, status.Errorf(codes.FailedPrecondition, "credential %q cannot be resolved", name) + } + value, ok := secret.Data[selector.GetKey()] + if !ok || !validHeaderValue(value) { + return nil, status.Errorf(codes.FailedPrecondition, "credential %q has no valid value", name) + } + response.Credentials = append(response.Credentials, &egresspolicypb.ResolvedCredential{Name: name, Value: slices.Clone(value)}) + } + return response, nil +} + +func validateEgressPolicy(policy *ateapipb.EgressPolicy) field.ErrorList { + root := field.NewPath("egress_policy") + if policy == nil { + return field.ErrorList{field.Required(root, "")} + } + var errs field.ErrorList + md := policy.GetMetadata() + errs = append(errs, resources.ValidateResourceMetadataRef(md, root.Child("metadata"))...) + actor := policy.GetActor() + errs = append(errs, validateScopedRef(actor, root.Child("actor"))...) + if md != nil && actor != nil && md.GetAtespace() != actor.GetAtespace() { + errs = append(errs, field.Invalid(root.Child("actor", "atespace"), actor.GetAtespace(), "must equal policy atespace")) + } + if policy.GetTarget() == nil { + errs = append(errs, field.Required(root.Child("target"), "")) + } + seenHostnames := map[string]bool{} + for i, rule := range policy.GetRules() { + p := root.Child("rules").Index(i) + switch match := rule.GetMatch().(type) { + case *ateapipb.EgressRule_Hostname: + errs = append(errs, validateHostnameMatch(match.Hostname, p.Child("hostname"))...) + pattern := strings.ToLower(strings.TrimSuffix(match.Hostname.GetPattern(), ".")) + if pattern != "" && seenHostnames[pattern] { + errs = append(errs, field.Duplicate(p.Child("hostname", "pattern"), match.Hostname.GetPattern())) + } + if pattern != "" { + seenHostnames[pattern] = true + } + case *ateapipb.EgressRule_IpBlocks: + if len(match.IpBlocks.GetCidrs()) == 0 { + errs = append(errs, field.Required(p.Child("ip_blocks", "cidrs"), "")) + } + for j, cidr := range match.IpBlocks.GetCidrs() { + prefix, err := netip.ParsePrefix(cidr) + if err != nil || prefix.Masked().String() != cidr { + errs = append(errs, field.Invalid(p.Child("ip_blocks", "cidrs").Index(j), cidr, "must be a canonical IPv4 or IPv6 prefix")) + } + } + default: + errs = append(errs, field.Required(p.Child("match"), "")) + } + } + return errs +} + +func validateHostnameMatch(match *ateapipb.HostnameMatch, p *field.Path) field.ErrorList { + if match == nil { + return field.ErrorList{field.Required(p, "")} + } + pattern := strings.ToLower(strings.TrimSuffix(match.GetPattern(), ".")) + wildcard := strings.HasPrefix(pattern, "*.") + name := strings.TrimPrefix(pattern, "*.") + var errs field.ErrorList + if pattern == "" || len(validation.IsDNS1123Subdomain(name)) != 0 || (strings.Contains(pattern, "*") && !wildcard) { + errs = append(errs, field.Invalid(p.Child("pattern"), match.GetPattern(), "must be an exact DNS hostname or single-label wildcard")) + } + injection := match.GetCredentialInjection() + if wildcard && injection != nil { + errs = append(errs, field.Invalid(p.Child("credential_injection"), injection, "credential injection requires an exact hostname")) + } + if injection != nil { + ip := p.Child("credential_injection") + header := strings.ToLower(injection.GetHeader()) + if !validHeaderName(header) { + errs = append(errs, field.Invalid(ip.Child("header"), injection.GetHeader(), "must be an HTTP header name")) + } + if injection.GetCredential().GetName() == "" { + errs = append(errs, field.Required(ip.Child("credential", "name"), "")) + } else { + errs = append(errs, resources.ValidateResourceName(injection.GetCredential().GetName(), ip.Child("credential", "name"))...) + } + } + return errs +} + +func validateCredential(credential *ateapipb.Credential) field.ErrorList { + root := field.NewPath("credential") + if credential == nil { + return field.ErrorList{field.Required(root, "")} + } + var errs field.ErrorList + errs = append(errs, resources.ValidateResourceMetadataRef(credential.GetMetadata(), root.Child("metadata"))...) + selector := credential.GetKubernetesSecret() + if selector == nil { + return append(errs, field.Required(root.Child("kubernetes_secret"), "")) + } + if selector.GetNamespace() == "" { + errs = append(errs, field.Required(root.Child("kubernetes_secret", "namespace"), "")) + } else if messages := validation.IsDNS1123Label(selector.GetNamespace()); len(messages) != 0 { + errs = append(errs, field.Invalid(root.Child("kubernetes_secret", "namespace"), selector.GetNamespace(), strings.Join(messages, "; "))) + } + if selector.GetName() == "" { + errs = append(errs, field.Required(root.Child("kubernetes_secret", "name"), "")) + } else if messages := validation.IsDNS1123Subdomain(selector.GetName()); len(messages) != 0 { + errs = append(errs, field.Invalid(root.Child("kubernetes_secret", "name"), selector.GetName(), strings.Join(messages, "; "))) + } + if selector.GetKey() == "" { + errs = append(errs, field.Required(root.Child("kubernetes_secret", "key"), "")) + } + return errs +} + +func normalizeEgressPolicy(policy *ateapipb.EgressPolicy) *ateapipb.EgressPolicy { + result := proto.Clone(policy).(*ateapipb.EgressPolicy) + for _, rule := range result.GetRules() { + if hostname := rule.GetHostname(); hostname != nil { + hostname.Pattern = strings.ToLower(strings.TrimSuffix(hostname.GetPattern(), ".")) + if injection := hostname.GetCredentialInjection(); injection != nil { + injection.Header = strings.ToLower(injection.GetHeader()) + } + } + } + return result +} + +func validateScopedRef(ref *ateapipb.ObjectRef, p *field.Path) field.ErrorList { + if ref == nil { + return field.ErrorList{field.Required(p, "")} + } + return resources.ValidateObjectRef(ref, p) +} + +func validateScopedList(atespace string, pageSize int32) field.ErrorList { + var errs field.ErrorList + if atespace != "" { + errs = append(errs, resources.ValidateResourceName(atespace, field.NewPath("atespace"))...) + } + if pageSize < 0 { + errs = append(errs, field.Invalid(field.NewPath("page_size"), pageSize, "must be greater than or equal to 0")) + } + return errs +} + +func checkMetadataPreconditions(current, supplied *ateapipb.ResourceMetadata) error { + if supplied.GetUid() != "" && supplied.GetUid() != current.GetUid() { + return store.ErrUIDConflict + } + if supplied.GetVersion() != 0 && supplied.GetVersion() != current.GetVersion() { + return store.ErrVersionConflict + } + return nil +} + +func getResource[T any](resource T, err error, kind string, ref *ateapipb.ObjectRef) (T, error) { + if errors.Is(err, store.ErrNotFound) { + var zero T + return zero, status.Errorf(codes.NotFound, "%s %s/%s not found", kind, ref.GetAtespace(), ref.GetName()) + } + if err != nil { + var zero T + return zero, fmt.Errorf("while getting %s: %w", kind, err) + } + return resource, nil +} + +func mapResourceWrite[T any](resource T, err error, kind string) (T, error) { + var zero T + switch { + case err == nil: + return resource, nil + case errors.Is(err, store.ErrNotFound): + return zero, status.Errorf(codes.NotFound, "%s not found", kind) + case errors.Is(err, store.ErrAlreadyExists): + return zero, status.Errorf(codes.AlreadyExists, "%s already exists", kind) + case errors.Is(err, store.ErrUIDConflict), errors.Is(err, store.ErrVersionConflict): + return zero, status.Errorf(codes.Aborted, "%s write precondition failed", kind) + case errors.Is(err, store.ErrFailedPrecondition): + return zero, status.Errorf(codes.FailedPrecondition, "%s target is immutable", kind) + default: + return zero, fmt.Errorf("while writing %s: %w", kind, err) + } +} + +func referencedCredentials(policy *ateapipb.EgressPolicy) []string { + set := map[string]bool{} + for _, rule := range policy.GetRules() { + if injection := rule.GetHostname().GetCredentialInjection(); injection != nil { + set[injection.GetCredential().GetName()] = true + } + } + keys := mapsKeys(set) + sort.Strings(keys) + return keys +} + +func mapsKeys(m map[string]bool) []string { + keys := make([]string, 0, len(m)) + for key := range m { + keys = append(keys, key) + } + return keys +} + +func validHeaderName(value string) bool { + if value == "" { + return false + } + for _, c := range []byte(value) { + if !((c >= 'a' && c <= 'z') || (c >= '0' && c <= '9') || strings.ContainsRune("!#$%&'*+-.^_`|~", rune(c))) { + return false + } + } + return true +} + +func validHeaderValue(value []byte) bool { + for _, c := range value { + if c == '\r' || c == '\n' || c == 0 { + return false + } + } + return true +} diff --git a/cmd/ateapi/internal/controlapi/egress_policy_test.go b/cmd/ateapi/internal/controlapi/egress_policy_test.go new file mode 100644 index 000000000..07cbd089b --- /dev/null +++ b/cmd/ateapi/internal/controlapi/egress_policy_test.go @@ -0,0 +1,179 @@ +// Copyright 2026 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package controlapi + +import ( + "context" + "errors" + "testing" + + "github.com/agent-substrate/substrate/cmd/ateapi/internal/store" + "github.com/agent-substrate/substrate/internal/principal" + "github.com/agent-substrate/substrate/internal/proto/egresspolicypb" + "github.com/agent-substrate/substrate/internal/resources" + "github.com/agent-substrate/substrate/pkg/proto/ateapipb" + "google.golang.org/grpc/codes" + "google.golang.org/grpc/status" + "google.golang.org/protobuf/types/known/emptypb" + corev1 "k8s.io/api/core/v1" + metav1 "k8s.io/apimachinery/pkg/apis/meta/v1" +) + +func TestValidateEgressPolicy(t *testing.T) { + valid := &ateapipb.EgressPolicy{ + Metadata: &ateapipb.ResourceMetadata{Atespace: "team-a", Name: "policy"}, + Target: &ateapipb.EgressPolicy_Actor{Actor: &ateapipb.ObjectRef{Atespace: "team-a", Name: "actor"}}, + AllowAll: &emptypb.Empty{}, + Rules: []*ateapipb.EgressRule{ + {Match: &ateapipb.EgressRule_Hostname{Hostname: &ateapipb.HostnameMatch{Pattern: "*.example.com"}}}, + {Match: &ateapipb.EgressRule_IpBlocks{IpBlocks: &ateapipb.IPBlockMatch{Cidrs: []string{"192.0.2.0/24", "2001:db8::/32"}}}}, + }, + } + if errs := validateEgressPolicy(valid); len(errs) != 0 { + t.Fatalf("valid policy rejected: %v", errs) + } + mismatchedAtespace := normalizeEgressPolicy(valid) + mismatchedAtespace.GetActor().Atespace = "team-b" + if errs := validateEgressPolicy(mismatchedAtespace); len(errs) != 1 { + t.Fatalf("cross-Atespace target errors = %v, want 1", errs) + } + + invalid := normalizeEgressPolicy(valid) + invalid.Rules[0].GetHostname().CredentialInjection = &ateapipb.HeaderCredentialInjection{ + Header: "Authorization", Credential: &ateapipb.CredentialReference{Name: "token"}, + } + invalid.Rules[1].GetIpBlocks().Cidrs[0] = "192.0.2.1/24" + if errs := validateEgressPolicy(invalid); len(errs) != 2 { + t.Fatalf("invalid policy errors = %v, want wildcard-injection and noncanonical-CIDR errors", errs) + } +} + +func TestGetEffectiveEgressPolicy(t *testing.T) { + tc := setupTest(t, namespaceForTest("egress-policy")) + defer tc.cleanup() + + actor, err := tc.persistence.CreateActor(t.Context(), &ateapipb.Actor{ + Metadata: &ateapipb.ResourceMetadata{Atespace: testAtespace, Name: "egress-actor"}, + Status: ateapipb.Actor_STATUS_RUNNING, + }) + if err != nil { + t.Fatal(err) + } + secretNamespace := namespaceForTest("egress-secret") + if _, err := tc.k8sClient.CoreV1().Namespaces().Create(t.Context(), &corev1.Namespace{ObjectMeta: metav1.ObjectMeta{Name: secretNamespace}}, metav1.CreateOptions{}); err != nil { + t.Fatal(err) + } + if _, err := tc.k8sClient.CoreV1().Secrets(secretNamespace).Create(t.Context(), &corev1.Secret{ + ObjectMeta: metav1.ObjectMeta{Name: "api-token"}, + Data: map[string][]byte{"authorization": []byte("Bearer resolved")}, + }, metav1.CreateOptions{}); err != nil { + t.Fatal(err) + } + if _, err := tc.service.CreateCredential(t.Context(), &ateapipb.CreateCredentialRequest{Credential: &ateapipb.Credential{ + Metadata: &ateapipb.ResourceMetadata{Atespace: testAtespace, Name: "api-token"}, + Source: &ateapipb.Credential_KubernetesSecret{KubernetesSecret: &ateapipb.KubernetesSecretKeySelector{ + Namespace: secretNamespace, Name: "api-token", Key: "authorization", + }}, + }}); err != nil { + t.Fatal(err) + } + if _, err := tc.service.CreateEgressPolicy(t.Context(), &ateapipb.CreateEgressPolicyRequest{EgressPolicy: &ateapipb.EgressPolicy{ + Metadata: &ateapipb.ResourceMetadata{Atespace: testAtespace, Name: "policy"}, + Target: &ateapipb.EgressPolicy_Actor{Actor: &ateapipb.ObjectRef{Atespace: testAtespace, Name: "egress-actor"}}, + Rules: []*ateapipb.EgressRule{{Match: &ateapipb.EgressRule_Hostname{Hostname: &ateapipb.HostnameMatch{ + Pattern: "api.example.com", + CredentialInjection: &ateapipb.HeaderCredentialInjection{ + Header: "Authorization", Credential: &ateapipb.CredentialReference{Name: "api-token"}, + }, + }}}}, + }}); err != nil { + t.Fatal(err) + } + + ctx := principal.InjectContext(context.Background(), principal.PrincipalInfo{Kind: principal.KindMTLS, ID: egressGatewayPrincipal}) + got, err := tc.service.GetEffectiveEgressPolicy(ctx, &egresspolicypb.GetEffectiveEgressPolicyRequest{ + Actor: &ateapipb.ObjectRef{Atespace: testAtespace, Name: "egress-actor"}, ActorUid: actor.GetMetadata().GetUid(), + }) + if err != nil { + t.Fatal(err) + } + if len(got.GetCredentials()) != 1 || string(got.GetCredentials()[0].GetValue()) != "Bearer resolved" { + t.Fatalf("resolved credentials = %v", got.GetCredentials()) + } + if _, err := tc.persistence.UpdateCredential(t.Context(), testAtespace, "api-token", func(credential *ateapipb.Credential) error { + credential.Source = nil + return nil + }); err != nil { + t.Fatal(err) + } + if _, err := tc.service.GetEffectiveEgressPolicy(ctx, &egresspolicypb.GetEffectiveEgressPolicyRequest{ + Actor: &ateapipb.ObjectRef{Atespace: testAtespace, Name: "egress-actor"}, ActorUid: actor.GetMetadata().GetUid(), + }); status.Code(err) != codes.FailedPrecondition { + t.Fatalf("malformed credential status = %v, want FailedPrecondition", status.Code(err)) + } + if _, err := tc.service.GetEffectiveEgressPolicy(context.Background(), &egresspolicypb.GetEffectiveEgressPolicyRequest{}); err == nil { + t.Fatal("unauthenticated resolver call succeeded") + } +} + +type getActorErrorStore struct { + store.Interface + err error +} + +func (s *getActorErrorStore) GetActor(context.Context, resources.ActorRef) (*ateapipb.Actor, error) { + return nil, s.err +} + +func TestGetEffectiveEgressPolicyActorLookupErrors(t *testing.T) { + fixture := setupTest(t, namespaceForTest("egress-policy-errors")) + defer fixture.cleanup() + + wrapped := &getActorErrorStore{Interface: fixture.persistence} + fixture.service.persistence = wrapped + ctx := principal.InjectContext(context.Background(), principal.PrincipalInfo{Kind: principal.KindMTLS, ID: egressGatewayPrincipal}) + req := &egresspolicypb.GetEffectiveEgressPolicyRequest{ + Actor: &ateapipb.ObjectRef{Atespace: testAtespace, Name: "actor"}, ActorUid: "uid", + } + for _, tc := range []struct { + name string + err error + want codes.Code + }{ + {name: "missing actor", err: store.ErrNotFound, want: codes.PermissionDenied}, + {name: "persistence failure", err: errors.New("redis unavailable"), want: codes.Unavailable}, + } { + t.Run(tc.name, func(t *testing.T) { + wrapped.err = tc.err + _, err := fixture.service.GetEffectiveEgressPolicy(ctx, req) + if status.Code(err) != tc.want { + t.Fatalf("status = %v, want %v", status.Code(err), tc.want) + } + }) + } +} + +func TestCredentialHeaderValueValidation(t *testing.T) { + for _, value := range [][]byte{[]byte("Bearer token"), {0x80, 0x81}} { + if !validHeaderValue(value) { + t.Errorf("validHeaderValue(%q) = false", value) + } + } + for _, value := range [][]byte{[]byte("a\rb"), []byte("a\nb"), {'a', 0, 'b'}} { + if validHeaderValue(value) { + t.Errorf("validHeaderValue(%q) = true", value) + } + } +} diff --git a/cmd/ateapi/internal/controlapi/service.go b/cmd/ateapi/internal/controlapi/service.go index 795347a2e..0289fdc15 100644 --- a/cmd/ateapi/internal/controlapi/service.go +++ b/cmd/ateapi/internal/controlapi/service.go @@ -20,6 +20,7 @@ import ( "github.com/agent-substrate/substrate/cmd/ateapi/internal/store" "github.com/agent-substrate/substrate/cmd/ateapi/internal/workercache" + "github.com/agent-substrate/substrate/internal/proto/egresspolicypb" "github.com/agent-substrate/substrate/internal/volume" "github.com/agent-substrate/substrate/internal/volume/csi" listersv1alpha1 "github.com/agent-substrate/substrate/pkg/client/listers/api/v1alpha1" @@ -31,6 +32,7 @@ import ( // Service implements ateapipb.Control type Service struct { ateapipb.UnimplementedControlServer + egresspolicypb.UnimplementedResolverServer persistence store.Interface workerCache *workercache.Cache dialer *AteletDialer @@ -42,6 +44,7 @@ type Service struct { instruments *Instruments mu sync.RWMutex volumePlugins map[string]volume.VolumePluginControlPlane + kubeClient kubernetes.Interface } var _ ateapipb.ControlServer = (*Service)(nil) @@ -76,6 +79,7 @@ func NewService( dialer: dialer, instruments: instruments, volumePlugins: volumePlugins, + kubeClient: kubeClient, } s.actorWorkflow = NewActorWorkflow(persistence, workerCache, dialer, actorTemplateLister, workerPoolLister, sandboxConfigLister, storageClassLister, kubeClient, instruments, egressGatewayAddress, s) return s diff --git a/cmd/ateapi/internal/store/ateredis/ateredis.go b/cmd/ateapi/internal/store/ateredis/ateredis.go index 6ab62b769..e66e0f67d 100644 --- a/cmd/ateapi/internal/store/ateredis/ateredis.go +++ b/cmd/ateapi/internal/store/ateredis/ateredis.go @@ -107,6 +107,37 @@ func actorScanPattern(atespace string) string { return "actor:" + atespace + ":*" } +func egressPolicyDBKey(atespace, name string) string { + return "egress-policy:{" + atespace + "}:" + name +} + +func egressPolicyScanPattern(atespace string) string { + if atespace == "" { + return "egress-policy:*" + } + return "egress-policy:{" + atespace + "}:*" +} + +func egressPolicyActorIndexDBKey(actorRef resources.ActorRef) string { + return "egress-policy-actor:{" + actorRef.Atespace + "}:" + actorRef.Name +} + +func credentialDBKey(atespace, name string) string { + return "credential:" + atespace + ":" + name +} + +func credentialScanPattern(atespace string) string { + if atespace == "" { + return "credential:*" + } + return "credential:" + atespace + ":*" +} + +type egressPolicyActorIndex struct { + PolicyName string `json:"policyName"` + ActorUID string `json:"actorUid"` +} + func actorSnapshotDBKey(atespace, name string) string { return "actor-snapshot:" + atespace + ":" + name } @@ -232,6 +263,15 @@ func (s *Persistence) DeleteAtespace(ctx context.Context, name string) (*ateapip if hasTags { return nil, store.ErrFailedPrecondition } + for _, pattern := range []string{egressPolicyScanPattern(name), credentialScanPattern(name)} { + hasResource, err := s.hasMatching(ctx, pattern) + if err != nil { + return nil, fmt.Errorf("while checking egress resources: %w", err) + } + if hasResource { + return nil, store.ErrFailedPrecondition + } + } if err := s.rdb.Del(ctx, dbKey).Err(); err != nil { return nil, fmt.Errorf("while deleting atespace key %q: %w", dbKey, err) } @@ -750,6 +790,13 @@ func (s *Persistence) DeleteActor(ctx context.Context, actorRef resources.ActorR } return nil, err } + // The policy is UID-pinned and therefore already inert after deletion. + // Remove it eagerly so a replacement Actor can create its own policy. + if policy, policyErr := s.GetEgressPolicyForActor(ctx, actorRef, deleted.GetMetadata().GetUid()); policyErr == nil { + if _, policyErr := s.DeleteEgressPolicy(ctx, actorRef.Atespace, policy.GetMetadata().GetName()); policyErr != nil { + slog.WarnContext(ctx, "failed to clean up deleted Actor's egress policy", slog.Any("err", policyErr)) + } + } return deleted, nil } diff --git a/cmd/ateapi/internal/store/ateredis/egress_policy.go b/cmd/ateapi/internal/store/ateredis/egress_policy.go new file mode 100644 index 000000000..cd618204b --- /dev/null +++ b/cmd/ateapi/internal/store/ateredis/egress_policy.go @@ -0,0 +1,309 @@ +// Copyright 2026 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package ateredis + +import ( + "context" + "encoding/json" + "errors" + "fmt" + + "github.com/agent-substrate/substrate/cmd/ateapi/internal/store" + "github.com/agent-substrate/substrate/internal/resources" + "github.com/agent-substrate/substrate/pkg/proto/ateapipb" + "github.com/redis/go-redis/v9" + "google.golang.org/protobuf/encoding/protojson" + "google.golang.org/protobuf/proto" +) + +const egressUpdateMaxAttempts = 5 + +func (s *Persistence) GetEgressPolicy(ctx context.Context, atespace, name string) (*ateapipb.EgressPolicy, error) { + dbKey := egressPolicyDBKey(atespace, name) + b, err := s.rdb.Get(ctx, dbKey).Bytes() + if err != nil { + if errors.Is(err, redis.Nil) { + return nil, store.ErrNotFound + } + return nil, fmt.Errorf("while getting egress policy key %q: %w", dbKey, err) + } + policy := &ateapipb.EgressPolicy{} + if err := protojson.Unmarshal(b, policy); err != nil { + return nil, fmt.Errorf("while unmarshaling egress policy: %w", err) + } + return policy, nil +} + +func (s *Persistence) GetEgressPolicyForActor(ctx context.Context, actorRef resources.ActorRef, actorUID string) (*ateapipb.EgressPolicy, error) { + b, err := s.rdb.Get(ctx, egressPolicyActorIndexDBKey(actorRef)).Bytes() + if errors.Is(err, redis.Nil) { + return nil, store.ErrNotFound + } + if err != nil { + return nil, fmt.Errorf("while resolving actor egress policy: %w", err) + } + var idx egressPolicyActorIndex + if err := json.Unmarshal(b, &idx); err != nil { + return nil, fmt.Errorf("while decoding actor egress policy index: %w", err) + } + if idx.ActorUID != actorUID { + return nil, store.ErrUIDConflict + } + return s.GetEgressPolicy(ctx, actorRef.Atespace, idx.PolicyName) +} + +func (s *Persistence) CreateEgressPolicy(ctx context.Context, policy *ateapipb.EgressPolicy, actorUID string) (*ateapipb.EgressPolicy, error) { + dbPolicy := proto.Clone(policy).(*ateapipb.EgressPolicy) + dbPolicy.Metadata = newCreateMetadata(policy.GetMetadata().GetAtespace(), policy.GetMetadata().GetName()) + policyBytes, err := protojson.Marshal(dbPolicy) + if err != nil { + return nil, fmt.Errorf("while marshaling egress policy: %w", err) + } + idxBytes, err := json.Marshal(egressPolicyActorIndex{PolicyName: dbPolicy.GetMetadata().GetName(), ActorUID: actorUID}) + if err != nil { + return nil, fmt.Errorf("while marshaling actor egress policy index: %w", err) + } + policyKey := egressPolicyDBKey(dbPolicy.GetMetadata().GetAtespace(), dbPolicy.GetMetadata().GetName()) + actorRef := resources.ActorRefFromObjectRef(dbPolicy.GetActor()) + indexKey := egressPolicyActorIndexDBKey(actorRef) + + for range egressUpdateMaxAttempts { + err := s.rdb.Watch(ctx, func(tx *redis.Tx) error { + n, err := tx.Exists(ctx, policyKey, indexKey).Result() + if err != nil { + return err + } + if n != 0 { + return store.ErrAlreadyExists + } + _, err = tx.TxPipelined(ctx, func(pipe redis.Pipeliner) error { + pipe.Set(ctx, policyKey, policyBytes, 0) + pipe.Set(ctx, indexKey, idxBytes, 0) + return nil + }) + return err + }, policyKey, indexKey) + switch { + case err == nil: + return dbPolicy, nil + case errors.Is(err, store.ErrAlreadyExists): + return nil, store.ErrAlreadyExists + case errors.Is(err, redis.TxFailedErr): + continue + default: + return nil, fmt.Errorf("while creating egress policy: %w", err) + } + } + return nil, store.ErrVersionConflict +} + +func (s *Persistence) UpdateEgressPolicy(ctx context.Context, atespace, name string, mutate func(*ateapipb.EgressPolicy) error) (*ateapipb.EgressPolicy, error) { + dbKey := egressPolicyDBKey(atespace, name) + for range egressUpdateMaxAttempts { + var dbPolicy *ateapipb.EgressPolicy + var abortErr error + err := s.rdb.Watch(ctx, func(tx *redis.Tx) error { + currentVal, err := tx.Get(ctx, dbKey).Bytes() + if err != nil { + if errors.Is(err, redis.Nil) { + return store.ErrNotFound + } + return fmt.Errorf("while getting egress policy: %w", err) + } + current := &ateapipb.EgressPolicy{} + if err := protojson.Unmarshal(currentVal, current); err != nil { + return fmt.Errorf("while unmarshaling egress policy: %w", err) + } + before := proto.Clone(current).(*ateapipb.EgressPolicy) + if err := mutate(current); err != nil { + abortErr = err + return err + } + if !proto.Equal(before.GetActor(), current.GetActor()) { + abortErr = store.ErrFailedPrecondition + return abortErr + } + current.Metadata = newUpdateMetadata(before.GetMetadata()) + newVal, err := protojson.Marshal(current) + if err != nil { + return fmt.Errorf("while marshaling egress policy: %w", err) + } + if _, err := tx.TxPipelined(ctx, func(pipe redis.Pipeliner) error { + pipe.Set(ctx, dbKey, newVal, 0) + return nil + }); err != nil { + return err + } + dbPolicy = current + return nil + }, dbKey) + + switch { + case err == nil: + return dbPolicy, nil + case abortErr != nil: + return nil, abortErr + case errors.Is(err, store.ErrNotFound): + return nil, store.ErrNotFound + case errors.Is(err, redis.TxFailedErr): + continue + default: + return nil, fmt.Errorf("while executing update egress policy transaction: %w", err) + } + } + return nil, store.ErrVersionConflict +} + +func (s *Persistence) DeleteEgressPolicy(ctx context.Context, atespace, name string) (*ateapipb.EgressPolicy, error) { + policy, err := s.GetEgressPolicy(ctx, atespace, name) + if err != nil { + return nil, err + } + policyKey := egressPolicyDBKey(atespace, name) + indexKey := egressPolicyActorIndexDBKey(resources.ActorRefFromObjectRef(policy.GetActor())) + if err := s.rdb.Del(ctx, policyKey, indexKey).Err(); err != nil { + return nil, fmt.Errorf("while deleting egress policy: %w", err) + } + return policy, nil +} + +func (s *Persistence) ListEgressPolicies(ctx context.Context, atespace string, pageSize int32, pageToken string) ([]*ateapipb.EgressPolicy, string, error) { + var result []*ateapipb.EgressPolicy + next, err := s.listPage(ctx, egressPolicyScanPattern(atespace), pageSize, pageToken, func(ctx context.Context, master *redis.Client, keys []string) (int, error) { + policies, err := fetchProtos(ctx, master, keys, func() *ateapipb.EgressPolicy { return &ateapipb.EgressPolicy{} }) + if err != nil { + return 0, err + } + result = append(result, policies...) + return len(policies), nil + }) + if err != nil { + return nil, "", err + } + return result, next, nil +} + +func (s *Persistence) GetCredential(ctx context.Context, atespace, name string) (*ateapipb.Credential, error) { + dbKey := credentialDBKey(atespace, name) + b, err := s.rdb.Get(ctx, dbKey).Bytes() + if err != nil { + if errors.Is(err, redis.Nil) { + return nil, store.ErrNotFound + } + return nil, fmt.Errorf("while getting credential key %q: %w", dbKey, err) + } + credential := &ateapipb.Credential{} + if err := protojson.Unmarshal(b, credential); err != nil { + return nil, fmt.Errorf("while unmarshaling credential: %w", err) + } + return credential, nil +} + +func (s *Persistence) CreateCredential(ctx context.Context, credential *ateapipb.Credential) (*ateapipb.Credential, error) { + dbCredential := proto.Clone(credential).(*ateapipb.Credential) + dbCredential.Metadata = newCreateMetadata(credential.GetMetadata().GetAtespace(), credential.GetMetadata().GetName()) + b, err := protojson.Marshal(dbCredential) + if err != nil { + return nil, fmt.Errorf("while marshaling credential: %w", err) + } + created, err := s.rdb.SetNX(ctx, credentialDBKey(dbCredential.GetMetadata().GetAtespace(), dbCredential.GetMetadata().GetName()), b, 0).Result() + if err != nil { + return nil, fmt.Errorf("while creating credential: %w", err) + } + if !created { + return nil, store.ErrAlreadyExists + } + return dbCredential, nil +} + +func (s *Persistence) UpdateCredential(ctx context.Context, atespace, name string, mutate func(*ateapipb.Credential) error) (*ateapipb.Credential, error) { + dbKey := credentialDBKey(atespace, name) + for range egressUpdateMaxAttempts { + var dbCredential *ateapipb.Credential + var abortErr error + err := s.rdb.Watch(ctx, func(tx *redis.Tx) error { + currentVal, err := tx.Get(ctx, dbKey).Bytes() + if err != nil { + if errors.Is(err, redis.Nil) { + return store.ErrNotFound + } + return fmt.Errorf("while getting credential: %w", err) + } + current := &ateapipb.Credential{} + if err := protojson.Unmarshal(currentVal, current); err != nil { + return fmt.Errorf("while unmarshaling credential: %w", err) + } + before := proto.Clone(current).(*ateapipb.Credential) + if err := mutate(current); err != nil { + abortErr = err + return err + } + current.Metadata = newUpdateMetadata(before.GetMetadata()) + newVal, err := protojson.Marshal(current) + if err != nil { + return fmt.Errorf("while marshaling credential: %w", err) + } + if _, err := tx.TxPipelined(ctx, func(pipe redis.Pipeliner) error { + pipe.Set(ctx, dbKey, newVal, 0) + return nil + }); err != nil { + return err + } + dbCredential = current + return nil + }, dbKey) + + switch { + case err == nil: + return dbCredential, nil + case abortErr != nil: + return nil, abortErr + case errors.Is(err, store.ErrNotFound): + return nil, store.ErrNotFound + case errors.Is(err, redis.TxFailedErr): + continue + default: + return nil, fmt.Errorf("while executing update credential transaction: %w", err) + } + } + return nil, store.ErrVersionConflict +} + +func (s *Persistence) DeleteCredential(ctx context.Context, atespace, name string) (*ateapipb.Credential, error) { + credential, err := s.GetCredential(ctx, atespace, name) + if err != nil { + return nil, err + } + if err := s.rdb.Del(ctx, credentialDBKey(atespace, name)).Err(); err != nil { + return nil, fmt.Errorf("while deleting credential: %w", err) + } + return credential, nil +} + +func (s *Persistence) ListCredentials(ctx context.Context, atespace string, pageSize int32, pageToken string) ([]*ateapipb.Credential, string, error) { + var result []*ateapipb.Credential + next, err := s.listPage(ctx, credentialScanPattern(atespace), pageSize, pageToken, func(ctx context.Context, master *redis.Client, keys []string) (int, error) { + credentials, err := fetchProtos(ctx, master, keys, func() *ateapipb.Credential { return &ateapipb.Credential{} }) + if err != nil { + return 0, err + } + result = append(result, credentials...) + return len(credentials), nil + }) + if err != nil { + return nil, "", err + } + return result, next, nil +} diff --git a/cmd/ateapi/internal/store/ateredis/egress_policy_test.go b/cmd/ateapi/internal/store/ateredis/egress_policy_test.go new file mode 100644 index 000000000..25f06dfe2 --- /dev/null +++ b/cmd/ateapi/internal/store/ateredis/egress_policy_test.go @@ -0,0 +1,96 @@ +// Copyright 2026 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package ateredis + +import ( + "errors" + "testing" + + "github.com/agent-substrate/substrate/cmd/ateapi/internal/store" + "github.com/agent-substrate/substrate/internal/resources" + "github.com/agent-substrate/substrate/pkg/proto/ateapipb" +) + +func TestEgressPolicyActorIndex(t *testing.T) { + _, s, ctx := setupTest(t) + policy := testEgressPolicy("policy-a", "actor-a") + created, err := s.CreateEgressPolicy(ctx, policy, "actor-uid-a") + if err != nil { + t.Fatalf("CreateEgressPolicy: %v", err) + } + if created.GetMetadata().GetUid() == "" || created.GetMetadata().GetVersion() != 1 { + t.Fatalf("created metadata = %v", created.GetMetadata()) + } + + actorRef := resources.ActorRef{Atespace: testAtespace, Name: "actor-a"} + got, err := s.GetEgressPolicyForActor(ctx, actorRef, "actor-uid-a") + if err != nil || got.GetMetadata().GetName() != "policy-a" { + t.Fatalf("GetEgressPolicyForActor = %v, %v", got, err) + } + if _, err := s.GetEgressPolicyForActor(ctx, actorRef, "replacement-uid"); !errors.Is(err, store.ErrUIDConflict) { + t.Fatalf("stale Actor UID error = %v, want ErrUIDConflict", err) + } +} + +func TestEgressPolicyOnePerActor(t *testing.T) { + _, s, ctx := setupTest(t) + if _, err := s.CreateEgressPolicy(ctx, testEgressPolicy("policy-a", "actor-a"), "uid"); err != nil { + t.Fatal(err) + } + if _, err := s.CreateEgressPolicy(ctx, testEgressPolicy("policy-b", "actor-a"), "uid"); !errors.Is(err, store.ErrAlreadyExists) { + t.Fatalf("second policy error = %v, want ErrAlreadyExists", err) + } + if _, err := s.DeleteEgressPolicy(ctx, testAtespace, "policy-a"); err != nil { + t.Fatal(err) + } + if _, err := s.CreateEgressPolicy(ctx, testEgressPolicy("policy-b", "actor-a"), "uid"); err != nil { + t.Fatalf("policy after delete: %v", err) + } +} + +func TestCredentialCRUD(t *testing.T) { + _, s, ctx := setupTest(t) + credential := &ateapipb.Credential{ + Metadata: &ateapipb.ResourceMetadata{Atespace: testAtespace, Name: "token"}, + Source: &ateapipb.Credential_KubernetesSecret{KubernetesSecret: &ateapipb.KubernetesSecretKeySelector{ + Namespace: "secrets", Name: "api", Key: "token", + }}, + } + _, err := s.CreateCredential(ctx, credential) + if err != nil { + t.Fatal(err) + } + updated, err := s.UpdateCredential(ctx, testAtespace, "token", func(current *ateapipb.Credential) error { + current.GetKubernetesSecret().Key = "authorization" + return nil + }) + if err != nil || updated.GetKubernetesSecret().GetKey() != "authorization" || updated.GetMetadata().GetVersion() != 2 { + t.Fatalf("UpdateCredential = %v, %v", updated, err) + } + listed, _, err := s.ListCredentials(ctx, testAtespace, 10, "") + if err != nil || len(listed) != 1 { + t.Fatalf("ListCredentials = %v, %v", listed, err) + } +} + +func testEgressPolicy(name, actor string) *ateapipb.EgressPolicy { + return &ateapipb.EgressPolicy{ + Metadata: &ateapipb.ResourceMetadata{Atespace: testAtespace, Name: name}, + Target: &ateapipb.EgressPolicy_Actor{Actor: &ateapipb.ObjectRef{Atespace: testAtespace, Name: actor}}, + Rules: []*ateapipb.EgressRule{{ + Match: &ateapipb.EgressRule_Hostname{Hostname: &ateapipb.HostnameMatch{Pattern: "example.com"}}, + }}, + } +} diff --git a/cmd/ateapi/internal/store/store.go b/cmd/ateapi/internal/store/store.go index 9c020d183..818d8ceea 100644 --- a/cmd/ateapi/internal/store/store.go +++ b/cmd/ateapi/internal/store/store.go @@ -80,6 +80,19 @@ type Interface interface { // empty. Returns a page of actors and a next page token. ListActors(ctx context.Context, atespace string, pageSize int32, pageToken string) ([]*ateapipb.Actor, string, error) + GetEgressPolicy(ctx context.Context, atespace, name string) (*ateapipb.EgressPolicy, error) + GetEgressPolicyForActor(ctx context.Context, actorRef resources.ActorRef, actorUID string) (*ateapipb.EgressPolicy, error) + CreateEgressPolicy(ctx context.Context, egressPolicy *ateapipb.EgressPolicy, actorUID string) (*ateapipb.EgressPolicy, error) + UpdateEgressPolicy(ctx context.Context, atespace, name string, mutate func(*ateapipb.EgressPolicy) error) (*ateapipb.EgressPolicy, error) + DeleteEgressPolicy(ctx context.Context, atespace, name string) (*ateapipb.EgressPolicy, error) + ListEgressPolicies(ctx context.Context, atespace string, pageSize int32, pageToken string) ([]*ateapipb.EgressPolicy, string, error) + + GetCredential(ctx context.Context, atespace, name string) (*ateapipb.Credential, error) + CreateCredential(ctx context.Context, credential *ateapipb.Credential) (*ateapipb.Credential, error) + UpdateCredential(ctx context.Context, atespace, name string, mutate func(*ateapipb.Credential) error) (*ateapipb.Credential, error) + DeleteCredential(ctx context.Context, atespace, name string) (*ateapipb.Credential, error) + ListCredentials(ctx context.Context, atespace string, pageSize int32, pageToken string) ([]*ateapipb.Credential, string, error) + // Creates an immutable ActorSnapshot. The caller sets snapshot_uri; the // store keeps no location of its own. CreateActorSnapshot(ctx context.Context, snapshot *ateapipb.ActorSnapshot) (*ateapipb.ActorSnapshot, error) diff --git a/cmd/ateapi/main.go b/cmd/ateapi/main.go index bbd40e9df..c853e3e5d 100644 --- a/cmd/ateapi/main.go +++ b/cmd/ateapi/main.go @@ -38,6 +38,7 @@ import ( "github.com/agent-substrate/substrate/internal/ateapiauth" "github.com/agent-substrate/substrate/internal/ateinterceptors" "github.com/agent-substrate/substrate/internal/credbundle" + "github.com/agent-substrate/substrate/internal/proto/egresspolicypb" "github.com/agent-substrate/substrate/internal/serverboot" "github.com/agent-substrate/substrate/internal/version" "github.com/agent-substrate/substrate/internal/volume" @@ -234,6 +235,7 @@ func main() { ) reflection.Register(mux) ateapipb.RegisterControlServer(mux, sm) + egresspolicypb.RegisterResolverServer(mux, sm) ateapipb.RegisterActorIdentityServer(mux, actorIdentitySrv) ateapipb.RegisterDebugServer(mux, debugSrv) diff --git a/cmd/atelet/main_test.go b/cmd/atelet/main_test.go index 6115cb363..a8e13b8eb 100644 --- a/cmd/atelet/main_test.go +++ b/cmd/atelet/main_test.go @@ -1320,6 +1320,7 @@ func TestUploadLocalCheckpointDir(t *testing.T) { fullRec := func(class string) sandboxAssetsRecord { return sandboxAssetsRecord{ SandboxClass: class, + PauseImage: "pause@sha256:abc", SnapshotFiles: []string{"config.json", "memory-ranges", ateompath.DurableDirTarFile}, Scope: ateattr.SnapshotScopeFull, } @@ -1397,6 +1398,7 @@ func TestUploadLocalCheckpointDir(t *testing.T) { dir := filepath.Join(t.TempDir(), "pause-snap-1") writeLocalSnapshot(t, dir, sandboxAssetsRecord{ SandboxClass: "gvisor", + PauseImage: "pause@sha256:abc", SnapshotFiles: []string{"checkpoint.img"}, Scope: ateattr.SnapshotScopeFull, }, map[string]string{"checkpoint.img": "img"}) @@ -1414,6 +1416,7 @@ func TestUploadLocalCheckpointDir(t *testing.T) { dir := filepath.Join(t.TempDir(), "pause-snap-1") writeLocalSnapshot(t, dir, sandboxAssetsRecord{ SandboxClass: "microvm", + PauseImage: "pause@sha256:abc", SnapshotFiles: []string{"config.json", "memory-ranges"}, Scope: ateattr.SnapshotScopeFull, }, map[string]string{"config.json": "cfg", "memory-ranges": "mem"}) @@ -1431,6 +1434,7 @@ func TestUploadLocalCheckpointDir(t *testing.T) { dir := filepath.Join(t.TempDir(), "pause-snap-1") writeLocalSnapshot(t, dir, sandboxAssetsRecord{ SandboxClass: "mystery", + PauseImage: "pause@sha256:abc", SnapshotFiles: []string{ateompath.DurableDirTarFile}, Scope: ateattr.SnapshotScopeFull, }, map[string]string{ateompath.DurableDirTarFile: "data"}) @@ -1448,6 +1452,7 @@ func TestUploadLocalCheckpointDir(t *testing.T) { dir := filepath.Join(t.TempDir(), "pause-snap-1") writeLocalSnapshot(t, dir, sandboxAssetsRecord{ SandboxClass: "microvm", + PauseImage: "pause@sha256:abc", SnapshotFiles: []string{ateompath.DurableDirTarFile}, Scope: ateattr.SnapshotScopeData, }, map[string]string{ateompath.DurableDirTarFile: "data"}) @@ -1464,6 +1469,7 @@ func TestUploadLocalCheckpointDir(t *testing.T) { dir := filepath.Join(t.TempDir(), "pause-snap-1") writeLocalSnapshot(t, dir, sandboxAssetsRecord{ SandboxClass: "microvm", + PauseImage: "pause@sha256:abc", SnapshotFiles: []string{ateompath.DurableDirTarFile}, }, map[string]string{ateompath.DurableDirTarFile: "data"}) diff --git a/demos/egress/egress.yaml.tmpl b/demos/egress/egress.yaml.tmpl index e6f9b080f..b37a1f5d6 100644 --- a/demos/egress/egress.yaml.tmpl +++ b/demos/egress/egress.yaml.tmpl @@ -38,7 +38,6 @@ metadata: name: egress namespace: ate-demo-egress spec: - pauseImage: "registry.k8s.io/pause:3.10.2@sha256:f548e0e8e3dc1896ca956272154dde3314e8cc4fde0a57577ee9fa1c63f5baf4" containers: - name: egress image: ko://github.com/agent-substrate/substrate/demos/egress diff --git a/internal/proto/egresspolicypb/egress_policy.pb.go b/internal/proto/egresspolicypb/egress_policy.pb.go new file mode 100644 index 000000000..89d9a85ec --- /dev/null +++ b/internal/proto/egresspolicypb/egress_policy.pb.go @@ -0,0 +1,267 @@ +// Copyright 2026 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +// Code generated by protoc-gen-go. DO NOT EDIT. +// versions: +// protoc-gen-go v1.36.11-devel +// protoc v4.25.3 +// source: egress_policy.proto + +package egresspolicypb + +import ( + ateapipb "github.com/agent-substrate/substrate/pkg/proto/ateapipb" + protoreflect "google.golang.org/protobuf/reflect/protoreflect" + protoimpl "google.golang.org/protobuf/runtime/protoimpl" + reflect "reflect" + sync "sync" + unsafe "unsafe" +) + +const ( + // Verify that this generated code is sufficiently up-to-date. + _ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion) + // Verify that runtime/protoimpl is sufficiently up-to-date. + _ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20) +) + +type GetEffectiveEgressPolicyRequest struct { + state protoimpl.MessageState `protogen:"open.v1"` + Actor *ateapipb.ObjectRef `protobuf:"bytes,1,opt,name=actor,proto3" json:"actor,omitempty"` + ActorUid string `protobuf:"bytes,2,opt,name=actor_uid,json=actorUid,proto3" json:"actor_uid,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *GetEffectiveEgressPolicyRequest) Reset() { + *x = GetEffectiveEgressPolicyRequest{} + mi := &file_egress_policy_proto_msgTypes[0] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *GetEffectiveEgressPolicyRequest) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*GetEffectiveEgressPolicyRequest) ProtoMessage() {} + +func (x *GetEffectiveEgressPolicyRequest) ProtoReflect() protoreflect.Message { + mi := &file_egress_policy_proto_msgTypes[0] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use GetEffectiveEgressPolicyRequest.ProtoReflect.Descriptor instead. +func (*GetEffectiveEgressPolicyRequest) Descriptor() ([]byte, []int) { + return file_egress_policy_proto_rawDescGZIP(), []int{0} +} + +func (x *GetEffectiveEgressPolicyRequest) GetActor() *ateapipb.ObjectRef { + if x != nil { + return x.Actor + } + return nil +} + +func (x *GetEffectiveEgressPolicyRequest) GetActorUid() string { + if x != nil { + return x.ActorUid + } + return "" +} + +type EffectiveEgressPolicy struct { + state protoimpl.MessageState `protogen:"open.v1"` + Policy *ateapipb.EgressPolicy `protobuf:"bytes,1,opt,name=policy,proto3" json:"policy,omitempty"` + Credentials []*ResolvedCredential `protobuf:"bytes,2,rep,name=credentials,proto3" json:"credentials,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *EffectiveEgressPolicy) Reset() { + *x = EffectiveEgressPolicy{} + mi := &file_egress_policy_proto_msgTypes[1] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *EffectiveEgressPolicy) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*EffectiveEgressPolicy) ProtoMessage() {} + +func (x *EffectiveEgressPolicy) ProtoReflect() protoreflect.Message { + mi := &file_egress_policy_proto_msgTypes[1] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use EffectiveEgressPolicy.ProtoReflect.Descriptor instead. +func (*EffectiveEgressPolicy) Descriptor() ([]byte, []int) { + return file_egress_policy_proto_rawDescGZIP(), []int{1} +} + +func (x *EffectiveEgressPolicy) GetPolicy() *ateapipb.EgressPolicy { + if x != nil { + return x.Policy + } + return nil +} + +func (x *EffectiveEgressPolicy) GetCredentials() []*ResolvedCredential { + if x != nil { + return x.Credentials + } + return nil +} + +type ResolvedCredential struct { + state protoimpl.MessageState `protogen:"open.v1"` + Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` + Value []byte `protobuf:"bytes,2,opt,name=value,proto3" json:"value,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *ResolvedCredential) Reset() { + *x = ResolvedCredential{} + mi := &file_egress_policy_proto_msgTypes[2] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *ResolvedCredential) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*ResolvedCredential) ProtoMessage() {} + +func (x *ResolvedCredential) ProtoReflect() protoreflect.Message { + mi := &file_egress_policy_proto_msgTypes[2] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use ResolvedCredential.ProtoReflect.Descriptor instead. +func (*ResolvedCredential) Descriptor() ([]byte, []int) { + return file_egress_policy_proto_rawDescGZIP(), []int{2} +} + +func (x *ResolvedCredential) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *ResolvedCredential) GetValue() []byte { + if x != nil { + return x.Value + } + return nil +} + +var File_egress_policy_proto protoreflect.FileDescriptor + +const file_egress_policy_proto_rawDesc = "" + + "\n" + + "\x13egress_policy.proto\x12\fegresspolicy\x1a\x1fpkg/proto/ateapipb/ateapi.proto\"g\n" + + "\x1fGetEffectiveEgressPolicyRequest\x12'\n" + + "\x05actor\x18\x01 \x01(\v2\x11.ateapi.ObjectRefR\x05actor\x12\x1b\n" + + "\tactor_uid\x18\x02 \x01(\tR\bactorUid\"\x89\x01\n" + + "\x15EffectiveEgressPolicy\x12,\n" + + "\x06policy\x18\x01 \x01(\v2\x14.ateapi.EgressPolicyR\x06policy\x12B\n" + + "\vcredentials\x18\x02 \x03(\v2 .egresspolicy.ResolvedCredentialR\vcredentials\">\n" + + "\x12ResolvedCredential\x12\x12\n" + + "\x04name\x18\x01 \x01(\tR\x04name\x12\x14\n" + + "\x05value\x18\x02 \x01(\fR\x05value2|\n" + + "\bResolver\x12p\n" + + "\x18GetEffectiveEgressPolicy\x12-.egresspolicy.GetEffectiveEgressPolicyRequest\x1a#.egresspolicy.EffectiveEgressPolicy\"\x00BDZBgithub.com/agent-substrate/substrate/internal/proto/egresspolicypbb\x06proto3" + +var ( + file_egress_policy_proto_rawDescOnce sync.Once + file_egress_policy_proto_rawDescData []byte +) + +func file_egress_policy_proto_rawDescGZIP() []byte { + file_egress_policy_proto_rawDescOnce.Do(func() { + file_egress_policy_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_egress_policy_proto_rawDesc), len(file_egress_policy_proto_rawDesc))) + }) + return file_egress_policy_proto_rawDescData +} + +var file_egress_policy_proto_msgTypes = make([]protoimpl.MessageInfo, 3) +var file_egress_policy_proto_goTypes = []any{ + (*GetEffectiveEgressPolicyRequest)(nil), // 0: egresspolicy.GetEffectiveEgressPolicyRequest + (*EffectiveEgressPolicy)(nil), // 1: egresspolicy.EffectiveEgressPolicy + (*ResolvedCredential)(nil), // 2: egresspolicy.ResolvedCredential + (*ateapipb.ObjectRef)(nil), // 3: ateapi.ObjectRef + (*ateapipb.EgressPolicy)(nil), // 4: ateapi.EgressPolicy +} +var file_egress_policy_proto_depIdxs = []int32{ + 3, // 0: egresspolicy.GetEffectiveEgressPolicyRequest.actor:type_name -> ateapi.ObjectRef + 4, // 1: egresspolicy.EffectiveEgressPolicy.policy:type_name -> ateapi.EgressPolicy + 2, // 2: egresspolicy.EffectiveEgressPolicy.credentials:type_name -> egresspolicy.ResolvedCredential + 0, // 3: egresspolicy.Resolver.GetEffectiveEgressPolicy:input_type -> egresspolicy.GetEffectiveEgressPolicyRequest + 1, // 4: egresspolicy.Resolver.GetEffectiveEgressPolicy:output_type -> egresspolicy.EffectiveEgressPolicy + 4, // [4:5] is the sub-list for method output_type + 3, // [3:4] is the sub-list for method input_type + 3, // [3:3] is the sub-list for extension type_name + 3, // [3:3] is the sub-list for extension extendee + 0, // [0:3] is the sub-list for field type_name +} + +func init() { file_egress_policy_proto_init() } +func file_egress_policy_proto_init() { + if File_egress_policy_proto != nil { + return + } + type x struct{} + out := protoimpl.TypeBuilder{ + File: protoimpl.DescBuilder{ + GoPackagePath: reflect.TypeOf(x{}).PkgPath(), + RawDescriptor: unsafe.Slice(unsafe.StringData(file_egress_policy_proto_rawDesc), len(file_egress_policy_proto_rawDesc)), + NumEnums: 0, + NumMessages: 3, + NumExtensions: 0, + NumServices: 1, + }, + GoTypes: file_egress_policy_proto_goTypes, + DependencyIndexes: file_egress_policy_proto_depIdxs, + MessageInfos: file_egress_policy_proto_msgTypes, + }.Build() + File_egress_policy_proto = out.File + file_egress_policy_proto_goTypes = nil + file_egress_policy_proto_depIdxs = nil +} diff --git a/internal/proto/egresspolicypb/egress_policy.proto b/internal/proto/egresspolicypb/egress_policy.proto new file mode 100644 index 000000000..c83b1b711 --- /dev/null +++ b/internal/proto/egresspolicypb/egress_policy.proto @@ -0,0 +1,41 @@ +// Copyright 2026 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +syntax = "proto3"; + +package egresspolicy; + +import "pkg/proto/ateapipb/ateapi.proto"; + +option go_package = "github.com/agent-substrate/substrate/internal/proto/egresspolicypb"; + +// Resolver is an internal, secret-bearing API used only by the egress gateway. +service Resolver { + rpc GetEffectiveEgressPolicy(GetEffectiveEgressPolicyRequest) returns (EffectiveEgressPolicy) {} +} + +message GetEffectiveEgressPolicyRequest { + ateapi.ObjectRef actor = 1; + string actor_uid = 2; +} + +message EffectiveEgressPolicy { + ateapi.EgressPolicy policy = 1; + repeated ResolvedCredential credentials = 2; +} + +message ResolvedCredential { + string name = 1; + bytes value = 2; +} diff --git a/internal/proto/egresspolicypb/egress_policy_grpc.pb.go b/internal/proto/egresspolicypb/egress_policy_grpc.pb.go new file mode 100644 index 000000000..f3ff861f1 --- /dev/null +++ b/internal/proto/egresspolicypb/egress_policy_grpc.pb.go @@ -0,0 +1,139 @@ +// Copyright 2026 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +// Code generated by protoc-gen-go-grpc. DO NOT EDIT. +// versions: +// - protoc-gen-go-grpc v1.6.1 +// - protoc v4.25.3 +// source: egress_policy.proto + +package egresspolicypb + +import ( + context "context" + grpc "google.golang.org/grpc" + codes "google.golang.org/grpc/codes" + status "google.golang.org/grpc/status" +) + +// This is a compile-time assertion to ensure that this generated file +// is compatible with the grpc package it is being compiled against. +// Requires gRPC-Go v1.64.0 or later. +const _ = grpc.SupportPackageIsVersion9 + +const ( + Resolver_GetEffectiveEgressPolicy_FullMethodName = "/egresspolicy.Resolver/GetEffectiveEgressPolicy" +) + +// ResolverClient is the client API for Resolver service. +// +// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream. +// +// Resolver is an internal, secret-bearing API used only by the egress gateway. +type ResolverClient interface { + GetEffectiveEgressPolicy(ctx context.Context, in *GetEffectiveEgressPolicyRequest, opts ...grpc.CallOption) (*EffectiveEgressPolicy, error) +} + +type resolverClient struct { + cc grpc.ClientConnInterface +} + +func NewResolverClient(cc grpc.ClientConnInterface) ResolverClient { + return &resolverClient{cc} +} + +func (c *resolverClient) GetEffectiveEgressPolicy(ctx context.Context, in *GetEffectiveEgressPolicyRequest, opts ...grpc.CallOption) (*EffectiveEgressPolicy, error) { + cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) + out := new(EffectiveEgressPolicy) + err := c.cc.Invoke(ctx, Resolver_GetEffectiveEgressPolicy_FullMethodName, in, out, cOpts...) + if err != nil { + return nil, err + } + return out, nil +} + +// ResolverServer is the server API for Resolver service. +// All implementations must embed UnimplementedResolverServer +// for forward compatibility. +// +// Resolver is an internal, secret-bearing API used only by the egress gateway. +type ResolverServer interface { + GetEffectiveEgressPolicy(context.Context, *GetEffectiveEgressPolicyRequest) (*EffectiveEgressPolicy, error) + mustEmbedUnimplementedResolverServer() +} + +// UnimplementedResolverServer must be embedded to have +// forward compatible implementations. +// +// NOTE: this should be embedded by value instead of pointer to avoid a nil +// pointer dereference when methods are called. +type UnimplementedResolverServer struct{} + +func (UnimplementedResolverServer) GetEffectiveEgressPolicy(context.Context, *GetEffectiveEgressPolicyRequest) (*EffectiveEgressPolicy, error) { + return nil, status.Error(codes.Unimplemented, "method GetEffectiveEgressPolicy not implemented") +} +func (UnimplementedResolverServer) mustEmbedUnimplementedResolverServer() {} +func (UnimplementedResolverServer) testEmbeddedByValue() {} + +// UnsafeResolverServer may be embedded to opt out of forward compatibility for this service. +// Use of this interface is not recommended, as added methods to ResolverServer will +// result in compilation errors. +type UnsafeResolverServer interface { + mustEmbedUnimplementedResolverServer() +} + +func RegisterResolverServer(s grpc.ServiceRegistrar, srv ResolverServer) { + // If the following call panics, it indicates UnimplementedResolverServer was + // embedded by pointer and is nil. This will cause panics if an + // unimplemented method is ever invoked, so we test this at initialization + // time to prevent it from happening at runtime later due to I/O. + if t, ok := srv.(interface{ testEmbeddedByValue() }); ok { + t.testEmbeddedByValue() + } + s.RegisterService(&Resolver_ServiceDesc, srv) +} + +func _Resolver_GetEffectiveEgressPolicy_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { + in := new(GetEffectiveEgressPolicyRequest) + if err := dec(in); err != nil { + return nil, err + } + if interceptor == nil { + return srv.(ResolverServer).GetEffectiveEgressPolicy(ctx, in) + } + info := &grpc.UnaryServerInfo{ + Server: srv, + FullMethod: Resolver_GetEffectiveEgressPolicy_FullMethodName, + } + handler := func(ctx context.Context, req interface{}) (interface{}, error) { + return srv.(ResolverServer).GetEffectiveEgressPolicy(ctx, req.(*GetEffectiveEgressPolicyRequest)) + } + return interceptor(ctx, in, info, handler) +} + +// Resolver_ServiceDesc is the grpc.ServiceDesc for Resolver service. +// It's only intended for direct use with grpc.RegisterService, +// and not to be introspected or modified (even as a copy) +var Resolver_ServiceDesc = grpc.ServiceDesc{ + ServiceName: "egresspolicy.Resolver", + HandlerType: (*ResolverServer)(nil), + Methods: []grpc.MethodDesc{ + { + MethodName: "GetEffectiveEgressPolicy", + Handler: _Resolver_GetEffectiveEgressPolicy_Handler, + }, + }, + Streams: []grpc.StreamDesc{}, + Metadata: "egress_policy.proto", +} diff --git a/internal/proto/egresspolicypb/gen.go b/internal/proto/egresspolicypb/gen.go new file mode 100644 index 000000000..e18feb099 --- /dev/null +++ b/internal/proto/egresspolicypb/gen.go @@ -0,0 +1,17 @@ +// Copyright 2026 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package egresspolicypb + +//go:generate bash -c "../../../hack/protoc.sh -I . -I ../../.. --plugin=protoc-gen-go=$(bash ../../../hack/run-tool.sh --print-bin-path protoc-gen-go) --plugin=protoc-gen-go-grpc=$(bash ../../../hack/run-tool.sh --print-bin-path protoc-gen-go-grpc) --go_out=paths=source_relative:. --go-grpc_out=paths=source_relative:. egress_policy.proto" diff --git a/pkg/proto/ateapipb/ateapi.pb.go b/pkg/proto/ateapipb/ateapi.pb.go index 87b290519..4e6485015 100644 --- a/pkg/proto/ateapipb/ateapi.pb.go +++ b/pkg/proto/ateapipb/ateapi.pb.go @@ -23,6 +23,8 @@ package ateapipb import ( protoreflect "google.golang.org/protobuf/reflect/protoreflect" protoimpl "google.golang.org/protobuf/runtime/protoimpl" + anypb "google.golang.org/protobuf/types/known/anypb" + emptypb "google.golang.org/protobuf/types/known/emptypb" fieldmaskpb "google.golang.org/protobuf/types/known/fieldmaskpb" timestamppb "google.golang.org/protobuf/types/known/timestamppb" reflect "reflect" @@ -352,7 +354,7 @@ func (x Worker_State) Number() protoreflect.EnumNumber { // Deprecated: Use Worker_State.Descriptor instead. func (Worker_State) EnumDescriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{36, 0} + return file_ateapi_proto_rawDescGZIP(), []int{56, 0} } type LocalSnapshotInfo struct { @@ -1086,32 +1088,40 @@ func (x *Atespace) GetMetadata() *ResourceMetadata { return nil } -// ObjectRef references a Substrate resource by its (atespace, name) identity. -type ObjectRef struct { - state protoimpl.MessageState `protogen:"open.v1"` - // The atespace where the resource lives. Empty if the resource is global-scoped. - Atespace string `protobuf:"bytes,1,opt,name=atespace,proto3" json:"atespace,omitempty"` - // The name of the resource. Required. Unique within an atespace, or globally - // unique if the resource is global-scoped. - Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"` +// EgressPolicy is Atespace-scoped and grants one Actor in the same Atespace +// access to destinations. A matching rule authorizes its destination. The +// optional allow_all baseline authorizes every destination but does not stop +// matching rules from applying their effects. With neither, traffic is denied. +type EgressPolicy struct { + state protoimpl.MessageState `protogen:"open.v1"` + Metadata *ResourceMetadata `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"` + // Types that are valid to be assigned to Target: + // + // *EgressPolicy_Actor + Target isEgressPolicy_Target `protobuf_oneof:"target"` + AllowAll *emptypb.Empty `protobuf:"bytes,3,opt,name=allow_all,json=allowAll,proto3" json:"allow_all,omitempty"` + Rules []*EgressRule `protobuf:"bytes,4,rep,name=rules,proto3" json:"rules,omitempty"` + // Every extension is required. An enforcement point that does not + // understand one must fail closed. + Extensions []*anypb.Any `protobuf:"bytes,5,rep,name=extensions,proto3" json:"extensions,omitempty"` unknownFields protoimpl.UnknownFields sizeCache protoimpl.SizeCache } -func (x *ObjectRef) Reset() { - *x = ObjectRef{} +func (x *EgressPolicy) Reset() { + *x = EgressPolicy{} mi := &file_ateapi_proto_msgTypes[9] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } -func (x *ObjectRef) String() string { +func (x *EgressPolicy) String() string { return protoimpl.X.MessageStringOf(x) } -func (*ObjectRef) ProtoMessage() {} +func (*EgressPolicy) ProtoMessage() {} -func (x *ObjectRef) ProtoReflect() protoreflect.Message { +func (x *EgressPolicy) ProtoReflect() protoreflect.Message { mi := &file_ateapi_proto_msgTypes[9] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) @@ -1123,52 +1133,90 @@ func (x *ObjectRef) ProtoReflect() protoreflect.Message { return mi.MessageOf(x) } -// Deprecated: Use ObjectRef.ProtoReflect.Descriptor instead. -func (*ObjectRef) Descriptor() ([]byte, []int) { +// Deprecated: Use EgressPolicy.ProtoReflect.Descriptor instead. +func (*EgressPolicy) Descriptor() ([]byte, []int) { return file_ateapi_proto_rawDescGZIP(), []int{9} } -func (x *ObjectRef) GetAtespace() string { +func (x *EgressPolicy) GetMetadata() *ResourceMetadata { if x != nil { - return x.Atespace + return x.Metadata } - return "" + return nil } -func (x *ObjectRef) GetName() string { +func (x *EgressPolicy) GetTarget() isEgressPolicy_Target { if x != nil { - return x.Name + return x.Target } - return "" + return nil } -// ActorSnapshotRef addresses a snapshot by its canonical identity or by an -// Atespace-owned tag. Tag addresses remain stable when tags are published. -type ActorSnapshotRef struct { +func (x *EgressPolicy) GetActor() *ObjectRef { + if x != nil { + if x, ok := x.Target.(*EgressPolicy_Actor); ok { + return x.Actor + } + } + return nil +} + +func (x *EgressPolicy) GetAllowAll() *emptypb.Empty { + if x != nil { + return x.AllowAll + } + return nil +} + +func (x *EgressPolicy) GetRules() []*EgressRule { + if x != nil { + return x.Rules + } + return nil +} + +func (x *EgressPolicy) GetExtensions() []*anypb.Any { + if x != nil { + return x.Extensions + } + return nil +} + +type isEgressPolicy_Target interface { + isEgressPolicy_Target() +} + +type EgressPolicy_Actor struct { + Actor *ObjectRef `protobuf:"bytes,2,opt,name=actor,proto3,oneof"` +} + +func (*EgressPolicy_Actor) isEgressPolicy_Target() {} + +type EgressRule struct { state protoimpl.MessageState `protogen:"open.v1"` - // Types that are valid to be assigned to Reference: + // Types that are valid to be assigned to Match: // - // *ActorSnapshotRef_Snapshot - // *ActorSnapshotRef_Tag - Reference isActorSnapshotRef_Reference `protobuf_oneof:"reference"` + // *EgressRule_Hostname + // *EgressRule_IpBlocks + Match isEgressRule_Match `protobuf_oneof:"match"` unknownFields protoimpl.UnknownFields sizeCache protoimpl.SizeCache } -func (x *ActorSnapshotRef) Reset() { - *x = ActorSnapshotRef{} +func (x *EgressRule) Reset() { + *x = EgressRule{} mi := &file_ateapi_proto_msgTypes[10] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } -func (x *ActorSnapshotRef) String() string { +func (x *EgressRule) String() string { return protoimpl.X.MessageStringOf(x) } -func (*ActorSnapshotRef) ProtoMessage() {} +func (*EgressRule) ProtoMessage() {} -func (x *ActorSnapshotRef) ProtoReflect() protoreflect.Message { +func (x *EgressRule) ProtoReflect() protoreflect.Message { mi := &file_ateapi_proto_msgTypes[10] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) @@ -1180,74 +1228,75 @@ func (x *ActorSnapshotRef) ProtoReflect() protoreflect.Message { return mi.MessageOf(x) } -// Deprecated: Use ActorSnapshotRef.ProtoReflect.Descriptor instead. -func (*ActorSnapshotRef) Descriptor() ([]byte, []int) { +// Deprecated: Use EgressRule.ProtoReflect.Descriptor instead. +func (*EgressRule) Descriptor() ([]byte, []int) { return file_ateapi_proto_rawDescGZIP(), []int{10} } -func (x *ActorSnapshotRef) GetReference() isActorSnapshotRef_Reference { +func (x *EgressRule) GetMatch() isEgressRule_Match { if x != nil { - return x.Reference + return x.Match } return nil } -func (x *ActorSnapshotRef) GetSnapshot() *ObjectRef { +func (x *EgressRule) GetHostname() *HostnameMatch { if x != nil { - if x, ok := x.Reference.(*ActorSnapshotRef_Snapshot); ok { - return x.Snapshot + if x, ok := x.Match.(*EgressRule_Hostname); ok { + return x.Hostname } } return nil } -func (x *ActorSnapshotRef) GetTag() *ObjectRef { +func (x *EgressRule) GetIpBlocks() *IPBlockMatch { if x != nil { - if x, ok := x.Reference.(*ActorSnapshotRef_Tag); ok { - return x.Tag + if x, ok := x.Match.(*EgressRule_IpBlocks); ok { + return x.IpBlocks } } return nil } -type isActorSnapshotRef_Reference interface { - isActorSnapshotRef_Reference() +type isEgressRule_Match interface { + isEgressRule_Match() } -type ActorSnapshotRef_Snapshot struct { - Snapshot *ObjectRef `protobuf:"bytes,1,opt,name=snapshot,proto3,oneof"` +type EgressRule_Hostname struct { + Hostname *HostnameMatch `protobuf:"bytes,1,opt,name=hostname,proto3,oneof"` } -type ActorSnapshotRef_Tag struct { - Tag *ObjectRef `protobuf:"bytes,2,opt,name=tag,proto3,oneof"` +type EgressRule_IpBlocks struct { + IpBlocks *IPBlockMatch `protobuf:"bytes,2,opt,name=ip_blocks,json=ipBlocks,proto3,oneof"` } -func (*ActorSnapshotRef_Snapshot) isActorSnapshotRef_Reference() {} +func (*EgressRule_Hostname) isEgressRule_Match() {} -func (*ActorSnapshotRef_Tag) isActorSnapshotRef_Reference() {} +func (*EgressRule_IpBlocks) isEgressRule_Match() {} -type CreateAtespaceRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // The atespace to create. - Atespace *Atespace `protobuf:"bytes,1,opt,name=atespace,proto3" json:"atespace,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache +type HostnameMatch struct { + state protoimpl.MessageState `protogen:"open.v1"` + Pattern string `protobuf:"bytes,1,opt,name=pattern,proto3" json:"pattern,omitempty"` + // Credential injection requires an exact hostname match. + CredentialInjection *HeaderCredentialInjection `protobuf:"bytes,2,opt,name=credential_injection,json=credentialInjection,proto3" json:"credential_injection,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache } -func (x *CreateAtespaceRequest) Reset() { - *x = CreateAtespaceRequest{} +func (x *HostnameMatch) Reset() { + *x = HostnameMatch{} mi := &file_ateapi_proto_msgTypes[11] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } -func (x *CreateAtespaceRequest) String() string { +func (x *HostnameMatch) String() string { return protoimpl.X.MessageStringOf(x) } -func (*CreateAtespaceRequest) ProtoMessage() {} +func (*HostnameMatch) ProtoMessage() {} -func (x *CreateAtespaceRequest) ProtoReflect() protoreflect.Message { +func (x *HostnameMatch) ProtoReflect() protoreflect.Message { mi := &file_ateapi_proto_msgTypes[11] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) @@ -1259,40 +1308,1091 @@ func (x *CreateAtespaceRequest) ProtoReflect() protoreflect.Message { return mi.MessageOf(x) } -// Deprecated: Use CreateAtespaceRequest.ProtoReflect.Descriptor instead. -func (*CreateAtespaceRequest) Descriptor() ([]byte, []int) { +// Deprecated: Use HostnameMatch.ProtoReflect.Descriptor instead. +func (*HostnameMatch) Descriptor() ([]byte, []int) { return file_ateapi_proto_rawDescGZIP(), []int{11} } -func (x *CreateAtespaceRequest) GetAtespace() *Atespace { +func (x *HostnameMatch) GetPattern() string { + if x != nil { + return x.Pattern + } + return "" +} + +func (x *HostnameMatch) GetCredentialInjection() *HeaderCredentialInjection { + if x != nil { + return x.CredentialInjection + } + return nil +} + +type IPBlockMatch struct { + state protoimpl.MessageState `protogen:"open.v1"` + Cidrs []string `protobuf:"bytes,1,rep,name=cidrs,proto3" json:"cidrs,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *IPBlockMatch) Reset() { + *x = IPBlockMatch{} + mi := &file_ateapi_proto_msgTypes[12] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *IPBlockMatch) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*IPBlockMatch) ProtoMessage() {} + +func (x *IPBlockMatch) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[12] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use IPBlockMatch.ProtoReflect.Descriptor instead. +func (*IPBlockMatch) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{12} +} + +func (x *IPBlockMatch) GetCidrs() []string { + if x != nil { + return x.Cidrs + } + return nil +} + +type HeaderCredentialInjection struct { + state protoimpl.MessageState `protogen:"open.v1"` + Header string `protobuf:"bytes,1,opt,name=header,proto3" json:"header,omitempty"` + Credential *CredentialReference `protobuf:"bytes,2,opt,name=credential,proto3" json:"credential,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *HeaderCredentialInjection) Reset() { + *x = HeaderCredentialInjection{} + mi := &file_ateapi_proto_msgTypes[13] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *HeaderCredentialInjection) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*HeaderCredentialInjection) ProtoMessage() {} + +func (x *HeaderCredentialInjection) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[13] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use HeaderCredentialInjection.ProtoReflect.Descriptor instead. +func (*HeaderCredentialInjection) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{13} +} + +func (x *HeaderCredentialInjection) GetHeader() string { + if x != nil { + return x.Header + } + return "" +} + +func (x *HeaderCredentialInjection) GetCredential() *CredentialReference { + if x != nil { + return x.Credential + } + return nil +} + +type CredentialReference struct { + state protoimpl.MessageState `protogen:"open.v1"` + // Resolves in the policy's Atespace. + Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *CredentialReference) Reset() { + *x = CredentialReference{} + mi := &file_ateapi_proto_msgTypes[14] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *CredentialReference) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*CredentialReference) ProtoMessage() {} + +func (x *CredentialReference) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[14] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use CredentialReference.ProtoReflect.Descriptor instead. +func (*CredentialReference) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{14} +} + +func (x *CredentialReference) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +type Credential struct { + state protoimpl.MessageState `protogen:"open.v1"` + Metadata *ResourceMetadata `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"` + // Types that are valid to be assigned to Source: + // + // *Credential_KubernetesSecret + Source isCredential_Source `protobuf_oneof:"source"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *Credential) Reset() { + *x = Credential{} + mi := &file_ateapi_proto_msgTypes[15] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *Credential) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*Credential) ProtoMessage() {} + +func (x *Credential) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[15] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use Credential.ProtoReflect.Descriptor instead. +func (*Credential) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{15} +} + +func (x *Credential) GetMetadata() *ResourceMetadata { + if x != nil { + return x.Metadata + } + return nil +} + +func (x *Credential) GetSource() isCredential_Source { + if x != nil { + return x.Source + } + return nil +} + +func (x *Credential) GetKubernetesSecret() *KubernetesSecretKeySelector { + if x != nil { + if x, ok := x.Source.(*Credential_KubernetesSecret); ok { + return x.KubernetesSecret + } + } + return nil +} + +type isCredential_Source interface { + isCredential_Source() +} + +type Credential_KubernetesSecret struct { + KubernetesSecret *KubernetesSecretKeySelector `protobuf:"bytes,2,opt,name=kubernetes_secret,json=kubernetesSecret,proto3,oneof"` +} + +func (*Credential_KubernetesSecret) isCredential_Source() {} + +type KubernetesSecretKeySelector struct { + state protoimpl.MessageState `protogen:"open.v1"` + Namespace string `protobuf:"bytes,1,opt,name=namespace,proto3" json:"namespace,omitempty"` + Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"` + Key string `protobuf:"bytes,3,opt,name=key,proto3" json:"key,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *KubernetesSecretKeySelector) Reset() { + *x = KubernetesSecretKeySelector{} + mi := &file_ateapi_proto_msgTypes[16] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *KubernetesSecretKeySelector) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*KubernetesSecretKeySelector) ProtoMessage() {} + +func (x *KubernetesSecretKeySelector) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[16] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use KubernetesSecretKeySelector.ProtoReflect.Descriptor instead. +func (*KubernetesSecretKeySelector) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{16} +} + +func (x *KubernetesSecretKeySelector) GetNamespace() string { + if x != nil { + return x.Namespace + } + return "" +} + +func (x *KubernetesSecretKeySelector) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +func (x *KubernetesSecretKeySelector) GetKey() string { + if x != nil { + return x.Key + } + return "" +} + +// ObjectRef references a Substrate resource by its (atespace, name) identity. +type ObjectRef struct { + state protoimpl.MessageState `protogen:"open.v1"` + // The atespace where the resource lives. Empty if the resource is global-scoped. + Atespace string `protobuf:"bytes,1,opt,name=atespace,proto3" json:"atespace,omitempty"` + // The name of the resource. Required. Unique within an atespace, or globally + // unique if the resource is global-scoped. + Name string `protobuf:"bytes,2,opt,name=name,proto3" json:"name,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *ObjectRef) Reset() { + *x = ObjectRef{} + mi := &file_ateapi_proto_msgTypes[17] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *ObjectRef) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*ObjectRef) ProtoMessage() {} + +func (x *ObjectRef) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[17] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use ObjectRef.ProtoReflect.Descriptor instead. +func (*ObjectRef) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{17} +} + +func (x *ObjectRef) GetAtespace() string { + if x != nil { + return x.Atespace + } + return "" +} + +func (x *ObjectRef) GetName() string { + if x != nil { + return x.Name + } + return "" +} + +// ActorSnapshotRef addresses a snapshot by its canonical identity or by an +// Atespace-owned tag. Tag addresses remain stable when tags are published. +type ActorSnapshotRef struct { + state protoimpl.MessageState `protogen:"open.v1"` + // Types that are valid to be assigned to Reference: + // + // *ActorSnapshotRef_Snapshot + // *ActorSnapshotRef_Tag + Reference isActorSnapshotRef_Reference `protobuf_oneof:"reference"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *ActorSnapshotRef) Reset() { + *x = ActorSnapshotRef{} + mi := &file_ateapi_proto_msgTypes[18] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *ActorSnapshotRef) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*ActorSnapshotRef) ProtoMessage() {} + +func (x *ActorSnapshotRef) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[18] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use ActorSnapshotRef.ProtoReflect.Descriptor instead. +func (*ActorSnapshotRef) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{18} +} + +func (x *ActorSnapshotRef) GetReference() isActorSnapshotRef_Reference { + if x != nil { + return x.Reference + } + return nil +} + +func (x *ActorSnapshotRef) GetSnapshot() *ObjectRef { + if x != nil { + if x, ok := x.Reference.(*ActorSnapshotRef_Snapshot); ok { + return x.Snapshot + } + } + return nil +} + +func (x *ActorSnapshotRef) GetTag() *ObjectRef { + if x != nil { + if x, ok := x.Reference.(*ActorSnapshotRef_Tag); ok { + return x.Tag + } + } + return nil +} + +type isActorSnapshotRef_Reference interface { + isActorSnapshotRef_Reference() +} + +type ActorSnapshotRef_Snapshot struct { + Snapshot *ObjectRef `protobuf:"bytes,1,opt,name=snapshot,proto3,oneof"` +} + +type ActorSnapshotRef_Tag struct { + Tag *ObjectRef `protobuf:"bytes,2,opt,name=tag,proto3,oneof"` +} + +func (*ActorSnapshotRef_Snapshot) isActorSnapshotRef_Reference() {} + +func (*ActorSnapshotRef_Tag) isActorSnapshotRef_Reference() {} + +type CreateAtespaceRequest struct { + state protoimpl.MessageState `protogen:"open.v1"` + // The atespace to create. + Atespace *Atespace `protobuf:"bytes,1,opt,name=atespace,proto3" json:"atespace,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *CreateAtespaceRequest) Reset() { + *x = CreateAtespaceRequest{} + mi := &file_ateapi_proto_msgTypes[19] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *CreateAtespaceRequest) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*CreateAtespaceRequest) ProtoMessage() {} + +func (x *CreateAtespaceRequest) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[19] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use CreateAtespaceRequest.ProtoReflect.Descriptor instead. +func (*CreateAtespaceRequest) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{19} +} + +func (x *CreateAtespaceRequest) GetAtespace() *Atespace { + if x != nil { + return x.Atespace + } + return nil +} + +type GetAtespaceRequest struct { + state protoimpl.MessageState `protogen:"open.v1"` + Atespace *ObjectRef `protobuf:"bytes,1,opt,name=atespace,proto3" json:"atespace,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *GetAtespaceRequest) Reset() { + *x = GetAtespaceRequest{} + mi := &file_ateapi_proto_msgTypes[20] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *GetAtespaceRequest) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*GetAtespaceRequest) ProtoMessage() {} + +func (x *GetAtespaceRequest) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[20] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use GetAtespaceRequest.ProtoReflect.Descriptor instead. +func (*GetAtespaceRequest) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{20} +} + +func (x *GetAtespaceRequest) GetAtespace() *ObjectRef { + if x != nil { + return x.Atespace + } + return nil +} + +type ListAtespacesRequest struct { + state protoimpl.MessageState `protogen:"open.v1"` + // Requested page size; the server may return fewer, or occasionally + // slightly more. If unspecified, defaults to a server-chosen value; + // values above 1000 are coerced to 1000. + PageSize int32 `protobuf:"varint,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"` + // Pagination token from a previous ListAtespaces response. + // Omit or leave empty for the first request. + PageToken string `protobuf:"bytes,2,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *ListAtespacesRequest) Reset() { + *x = ListAtespacesRequest{} + mi := &file_ateapi_proto_msgTypes[21] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *ListAtespacesRequest) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*ListAtespacesRequest) ProtoMessage() {} + +func (x *ListAtespacesRequest) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[21] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use ListAtespacesRequest.ProtoReflect.Descriptor instead. +func (*ListAtespacesRequest) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{21} +} + +func (x *ListAtespacesRequest) GetPageSize() int32 { + if x != nil { + return x.PageSize + } + return 0 +} + +func (x *ListAtespacesRequest) GetPageToken() string { + if x != nil { + return x.PageToken + } + return "" +} + +type ListAtespacesResponse struct { + state protoimpl.MessageState `protogen:"open.v1"` + // The page of atespaces. This list may be empty even if there are more results. + Atespaces []*Atespace `protobuf:"bytes,1,rep,name=atespaces,proto3" json:"atespaces,omitempty"` + // Pagination token for the next page. Empty if this is the last page. + NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *ListAtespacesResponse) Reset() { + *x = ListAtespacesResponse{} + mi := &file_ateapi_proto_msgTypes[22] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *ListAtespacesResponse) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*ListAtespacesResponse) ProtoMessage() {} + +func (x *ListAtespacesResponse) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[22] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use ListAtespacesResponse.ProtoReflect.Descriptor instead. +func (*ListAtespacesResponse) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{22} +} + +func (x *ListAtespacesResponse) GetAtespaces() []*Atespace { + if x != nil { + return x.Atespaces + } + return nil +} + +func (x *ListAtespacesResponse) GetNextPageToken() string { + if x != nil { + return x.NextPageToken + } + return "" +} + +type DeleteAtespaceRequest struct { + state protoimpl.MessageState `protogen:"open.v1"` + Atespace *ObjectRef `protobuf:"bytes,1,opt,name=atespace,proto3" json:"atespace,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *DeleteAtespaceRequest) Reset() { + *x = DeleteAtespaceRequest{} + mi := &file_ateapi_proto_msgTypes[23] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *DeleteAtespaceRequest) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*DeleteAtespaceRequest) ProtoMessage() {} + +func (x *DeleteAtespaceRequest) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[23] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use DeleteAtespaceRequest.ProtoReflect.Descriptor instead. +func (*DeleteAtespaceRequest) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{23} +} + +func (x *DeleteAtespaceRequest) GetAtespace() *ObjectRef { + if x != nil { + return x.Atespace + } + return nil +} + +type GetEgressPolicyRequest struct { + state protoimpl.MessageState `protogen:"open.v1"` + EgressPolicy *ObjectRef `protobuf:"bytes,1,opt,name=egress_policy,json=egressPolicy,proto3" json:"egress_policy,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *GetEgressPolicyRequest) Reset() { + *x = GetEgressPolicyRequest{} + mi := &file_ateapi_proto_msgTypes[24] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *GetEgressPolicyRequest) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*GetEgressPolicyRequest) ProtoMessage() {} + +func (x *GetEgressPolicyRequest) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[24] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use GetEgressPolicyRequest.ProtoReflect.Descriptor instead. +func (*GetEgressPolicyRequest) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{24} +} + +func (x *GetEgressPolicyRequest) GetEgressPolicy() *ObjectRef { + if x != nil { + return x.EgressPolicy + } + return nil +} + +type CreateEgressPolicyRequest struct { + state protoimpl.MessageState `protogen:"open.v1"` + EgressPolicy *EgressPolicy `protobuf:"bytes,1,opt,name=egress_policy,json=egressPolicy,proto3" json:"egress_policy,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *CreateEgressPolicyRequest) Reset() { + *x = CreateEgressPolicyRequest{} + mi := &file_ateapi_proto_msgTypes[25] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *CreateEgressPolicyRequest) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*CreateEgressPolicyRequest) ProtoMessage() {} + +func (x *CreateEgressPolicyRequest) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[25] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use CreateEgressPolicyRequest.ProtoReflect.Descriptor instead. +func (*CreateEgressPolicyRequest) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{25} +} + +func (x *CreateEgressPolicyRequest) GetEgressPolicy() *EgressPolicy { + if x != nil { + return x.EgressPolicy + } + return nil +} + +type UpdateEgressPolicyRequest struct { + state protoimpl.MessageState `protogen:"open.v1"` + EgressPolicy *EgressPolicy `protobuf:"bytes,1,opt,name=egress_policy,json=egressPolicy,proto3" json:"egress_policy,omitempty"` + UpdateMask *fieldmaskpb.FieldMask `protobuf:"bytes,2,opt,name=update_mask,json=updateMask,proto3" json:"update_mask,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *UpdateEgressPolicyRequest) Reset() { + *x = UpdateEgressPolicyRequest{} + mi := &file_ateapi_proto_msgTypes[26] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *UpdateEgressPolicyRequest) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*UpdateEgressPolicyRequest) ProtoMessage() {} + +func (x *UpdateEgressPolicyRequest) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[26] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use UpdateEgressPolicyRequest.ProtoReflect.Descriptor instead. +func (*UpdateEgressPolicyRequest) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{26} +} + +func (x *UpdateEgressPolicyRequest) GetEgressPolicy() *EgressPolicy { + if x != nil { + return x.EgressPolicy + } + return nil +} + +func (x *UpdateEgressPolicyRequest) GetUpdateMask() *fieldmaskpb.FieldMask { + if x != nil { + return x.UpdateMask + } + return nil +} + +type DeleteEgressPolicyRequest struct { + state protoimpl.MessageState `protogen:"open.v1"` + EgressPolicy *ObjectRef `protobuf:"bytes,1,opt,name=egress_policy,json=egressPolicy,proto3" json:"egress_policy,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *DeleteEgressPolicyRequest) Reset() { + *x = DeleteEgressPolicyRequest{} + mi := &file_ateapi_proto_msgTypes[27] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *DeleteEgressPolicyRequest) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*DeleteEgressPolicyRequest) ProtoMessage() {} + +func (x *DeleteEgressPolicyRequest) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[27] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use DeleteEgressPolicyRequest.ProtoReflect.Descriptor instead. +func (*DeleteEgressPolicyRequest) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{27} +} + +func (x *DeleteEgressPolicyRequest) GetEgressPolicy() *ObjectRef { + if x != nil { + return x.EgressPolicy + } + return nil +} + +type ListEgressPoliciesRequest struct { + state protoimpl.MessageState `protogen:"open.v1"` + Atespace string `protobuf:"bytes,1,opt,name=atespace,proto3" json:"atespace,omitempty"` + PageSize int32 `protobuf:"varint,2,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"` + PageToken string `protobuf:"bytes,3,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *ListEgressPoliciesRequest) Reset() { + *x = ListEgressPoliciesRequest{} + mi := &file_ateapi_proto_msgTypes[28] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *ListEgressPoliciesRequest) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*ListEgressPoliciesRequest) ProtoMessage() {} + +func (x *ListEgressPoliciesRequest) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[28] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use ListEgressPoliciesRequest.ProtoReflect.Descriptor instead. +func (*ListEgressPoliciesRequest) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{28} +} + +func (x *ListEgressPoliciesRequest) GetAtespace() string { + if x != nil { + return x.Atespace + } + return "" +} + +func (x *ListEgressPoliciesRequest) GetPageSize() int32 { + if x != nil { + return x.PageSize + } + return 0 +} + +func (x *ListEgressPoliciesRequest) GetPageToken() string { + if x != nil { + return x.PageToken + } + return "" +} + +type ListEgressPoliciesResponse struct { + state protoimpl.MessageState `protogen:"open.v1"` + EgressPolicies []*EgressPolicy `protobuf:"bytes,1,rep,name=egress_policies,json=egressPolicies,proto3" json:"egress_policies,omitempty"` + NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *ListEgressPoliciesResponse) Reset() { + *x = ListEgressPoliciesResponse{} + mi := &file_ateapi_proto_msgTypes[29] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *ListEgressPoliciesResponse) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*ListEgressPoliciesResponse) ProtoMessage() {} + +func (x *ListEgressPoliciesResponse) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[29] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use ListEgressPoliciesResponse.ProtoReflect.Descriptor instead. +func (*ListEgressPoliciesResponse) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{29} +} + +func (x *ListEgressPoliciesResponse) GetEgressPolicies() []*EgressPolicy { + if x != nil { + return x.EgressPolicies + } + return nil +} + +func (x *ListEgressPoliciesResponse) GetNextPageToken() string { + if x != nil { + return x.NextPageToken + } + return "" +} + +type GetCredentialRequest struct { + state protoimpl.MessageState `protogen:"open.v1"` + Credential *ObjectRef `protobuf:"bytes,1,opt,name=credential,proto3" json:"credential,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *GetCredentialRequest) Reset() { + *x = GetCredentialRequest{} + mi := &file_ateapi_proto_msgTypes[30] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *GetCredentialRequest) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*GetCredentialRequest) ProtoMessage() {} + +func (x *GetCredentialRequest) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[30] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use GetCredentialRequest.ProtoReflect.Descriptor instead. +func (*GetCredentialRequest) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{30} +} + +func (x *GetCredentialRequest) GetCredential() *ObjectRef { + if x != nil { + return x.Credential + } + return nil +} + +type CreateCredentialRequest struct { + state protoimpl.MessageState `protogen:"open.v1"` + Credential *Credential `protobuf:"bytes,1,opt,name=credential,proto3" json:"credential,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *CreateCredentialRequest) Reset() { + *x = CreateCredentialRequest{} + mi := &file_ateapi_proto_msgTypes[31] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *CreateCredentialRequest) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*CreateCredentialRequest) ProtoMessage() {} + +func (x *CreateCredentialRequest) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[31] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use CreateCredentialRequest.ProtoReflect.Descriptor instead. +func (*CreateCredentialRequest) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{31} +} + +func (x *CreateCredentialRequest) GetCredential() *Credential { if x != nil { - return x.Atespace + return x.Credential } return nil } -type GetAtespaceRequest struct { +type UpdateCredentialRequest struct { state protoimpl.MessageState `protogen:"open.v1"` - Atespace *ObjectRef `protobuf:"bytes,1,opt,name=atespace,proto3" json:"atespace,omitempty"` + Credential *Credential `protobuf:"bytes,1,opt,name=credential,proto3" json:"credential,omitempty"` + UpdateMask *fieldmaskpb.FieldMask `protobuf:"bytes,2,opt,name=update_mask,json=updateMask,proto3" json:"update_mask,omitempty"` unknownFields protoimpl.UnknownFields sizeCache protoimpl.SizeCache } -func (x *GetAtespaceRequest) Reset() { - *x = GetAtespaceRequest{} - mi := &file_ateapi_proto_msgTypes[12] +func (x *UpdateCredentialRequest) Reset() { + *x = UpdateCredentialRequest{} + mi := &file_ateapi_proto_msgTypes[32] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } -func (x *GetAtespaceRequest) String() string { +func (x *UpdateCredentialRequest) String() string { return protoimpl.X.MessageStringOf(x) } -func (*GetAtespaceRequest) ProtoMessage() {} +func (*UpdateCredentialRequest) ProtoMessage() {} -func (x *GetAtespaceRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[12] +func (x *UpdateCredentialRequest) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[32] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1303,46 +2403,47 @@ func (x *GetAtespaceRequest) ProtoReflect() protoreflect.Message { return mi.MessageOf(x) } -// Deprecated: Use GetAtespaceRequest.ProtoReflect.Descriptor instead. -func (*GetAtespaceRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{12} +// Deprecated: Use UpdateCredentialRequest.ProtoReflect.Descriptor instead. +func (*UpdateCredentialRequest) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{32} } -func (x *GetAtespaceRequest) GetAtespace() *ObjectRef { +func (x *UpdateCredentialRequest) GetCredential() *Credential { if x != nil { - return x.Atespace + return x.Credential } return nil } -type ListAtespacesRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Requested page size; the server may return fewer, or occasionally - // slightly more. If unspecified, defaults to a server-chosen value; - // values above 1000 are coerced to 1000. - PageSize int32 `protobuf:"varint,1,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"` - // Pagination token from a previous ListAtespaces response. - // Omit or leave empty for the first request. - PageToken string `protobuf:"bytes,2,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"` +func (x *UpdateCredentialRequest) GetUpdateMask() *fieldmaskpb.FieldMask { + if x != nil { + return x.UpdateMask + } + return nil +} + +type DeleteCredentialRequest struct { + state protoimpl.MessageState `protogen:"open.v1"` + Credential *ObjectRef `protobuf:"bytes,1,opt,name=credential,proto3" json:"credential,omitempty"` unknownFields protoimpl.UnknownFields sizeCache protoimpl.SizeCache } -func (x *ListAtespacesRequest) Reset() { - *x = ListAtespacesRequest{} - mi := &file_ateapi_proto_msgTypes[13] +func (x *DeleteCredentialRequest) Reset() { + *x = DeleteCredentialRequest{} + mi := &file_ateapi_proto_msgTypes[33] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } -func (x *ListAtespacesRequest) String() string { +func (x *DeleteCredentialRequest) String() string { return protoimpl.X.MessageStringOf(x) } -func (*ListAtespacesRequest) ProtoMessage() {} +func (*DeleteCredentialRequest) ProtoMessage() {} -func (x *ListAtespacesRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[13] +func (x *DeleteCredentialRequest) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[33] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1353,50 +2454,42 @@ func (x *ListAtespacesRequest) ProtoReflect() protoreflect.Message { return mi.MessageOf(x) } -// Deprecated: Use ListAtespacesRequest.ProtoReflect.Descriptor instead. -func (*ListAtespacesRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{13} -} - -func (x *ListAtespacesRequest) GetPageSize() int32 { - if x != nil { - return x.PageSize - } - return 0 +// Deprecated: Use DeleteCredentialRequest.ProtoReflect.Descriptor instead. +func (*DeleteCredentialRequest) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{33} } -func (x *ListAtespacesRequest) GetPageToken() string { +func (x *DeleteCredentialRequest) GetCredential() *ObjectRef { if x != nil { - return x.PageToken + return x.Credential } - return "" + return nil } -type ListAtespacesResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // The page of atespaces. This list may be empty even if there are more results. - Atespaces []*Atespace `protobuf:"bytes,1,rep,name=atespaces,proto3" json:"atespaces,omitempty"` - // Pagination token for the next page. Empty if this is the last page. - NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"` +type ListCredentialsRequest struct { + state protoimpl.MessageState `protogen:"open.v1"` + Atespace string `protobuf:"bytes,1,opt,name=atespace,proto3" json:"atespace,omitempty"` + PageSize int32 `protobuf:"varint,2,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"` + PageToken string `protobuf:"bytes,3,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"` unknownFields protoimpl.UnknownFields sizeCache protoimpl.SizeCache } -func (x *ListAtespacesResponse) Reset() { - *x = ListAtespacesResponse{} - mi := &file_ateapi_proto_msgTypes[14] +func (x *ListCredentialsRequest) Reset() { + *x = ListCredentialsRequest{} + mi := &file_ateapi_proto_msgTypes[34] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } -func (x *ListAtespacesResponse) String() string { +func (x *ListCredentialsRequest) String() string { return protoimpl.X.MessageStringOf(x) } -func (*ListAtespacesResponse) ProtoMessage() {} +func (*ListCredentialsRequest) ProtoMessage() {} -func (x *ListAtespacesResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[14] +func (x *ListCredentialsRequest) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[34] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1407,47 +2500,55 @@ func (x *ListAtespacesResponse) ProtoReflect() protoreflect.Message { return mi.MessageOf(x) } -// Deprecated: Use ListAtespacesResponse.ProtoReflect.Descriptor instead. -func (*ListAtespacesResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{14} +// Deprecated: Use ListCredentialsRequest.ProtoReflect.Descriptor instead. +func (*ListCredentialsRequest) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{34} } -func (x *ListAtespacesResponse) GetAtespaces() []*Atespace { +func (x *ListCredentialsRequest) GetAtespace() string { if x != nil { - return x.Atespaces + return x.Atespace } - return nil + return "" } -func (x *ListAtespacesResponse) GetNextPageToken() string { +func (x *ListCredentialsRequest) GetPageSize() int32 { if x != nil { - return x.NextPageToken + return x.PageSize + } + return 0 +} + +func (x *ListCredentialsRequest) GetPageToken() string { + if x != nil { + return x.PageToken } return "" } -type DeleteAtespaceRequest struct { +type ListCredentialsResponse struct { state protoimpl.MessageState `protogen:"open.v1"` - Atespace *ObjectRef `protobuf:"bytes,1,opt,name=atespace,proto3" json:"atespace,omitempty"` + Credentials []*Credential `protobuf:"bytes,1,rep,name=credentials,proto3" json:"credentials,omitempty"` + NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"` unknownFields protoimpl.UnknownFields sizeCache protoimpl.SizeCache } -func (x *DeleteAtespaceRequest) Reset() { - *x = DeleteAtespaceRequest{} - mi := &file_ateapi_proto_msgTypes[15] +func (x *ListCredentialsResponse) Reset() { + *x = ListCredentialsResponse{} + mi := &file_ateapi_proto_msgTypes[35] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } -func (x *DeleteAtespaceRequest) String() string { +func (x *ListCredentialsResponse) String() string { return protoimpl.X.MessageStringOf(x) } -func (*DeleteAtespaceRequest) ProtoMessage() {} +func (*ListCredentialsResponse) ProtoMessage() {} -func (x *DeleteAtespaceRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[15] +func (x *ListCredentialsResponse) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[35] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1458,18 +2559,25 @@ func (x *DeleteAtespaceRequest) ProtoReflect() protoreflect.Message { return mi.MessageOf(x) } -// Deprecated: Use DeleteAtespaceRequest.ProtoReflect.Descriptor instead. -func (*DeleteAtespaceRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{15} +// Deprecated: Use ListCredentialsResponse.ProtoReflect.Descriptor instead. +func (*ListCredentialsResponse) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{35} } -func (x *DeleteAtespaceRequest) GetAtespace() *ObjectRef { +func (x *ListCredentialsResponse) GetCredentials() []*Credential { if x != nil { - return x.Atespace + return x.Credentials } return nil } +func (x *ListCredentialsResponse) GetNextPageToken() string { + if x != nil { + return x.NextPageToken + } + return "" +} + type GetActorRequest struct { state protoimpl.MessageState `protogen:"open.v1"` Actor *ObjectRef `protobuf:"bytes,1,opt,name=actor,proto3" json:"actor,omitempty"` @@ -1479,7 +2587,7 @@ type GetActorRequest struct { func (x *GetActorRequest) Reset() { *x = GetActorRequest{} - mi := &file_ateapi_proto_msgTypes[16] + mi := &file_ateapi_proto_msgTypes[36] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1491,7 +2599,7 @@ func (x *GetActorRequest) String() string { func (*GetActorRequest) ProtoMessage() {} func (x *GetActorRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[16] + mi := &file_ateapi_proto_msgTypes[36] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1504,7 +2612,7 @@ func (x *GetActorRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetActorRequest.ProtoReflect.Descriptor instead. func (*GetActorRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{16} + return file_ateapi_proto_rawDescGZIP(), []int{36} } func (x *GetActorRequest) GetActor() *ObjectRef { @@ -1527,7 +2635,7 @@ type CreateActorRequest struct { func (x *CreateActorRequest) Reset() { *x = CreateActorRequest{} - mi := &file_ateapi_proto_msgTypes[17] + mi := &file_ateapi_proto_msgTypes[37] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1539,7 +2647,7 @@ func (x *CreateActorRequest) String() string { func (*CreateActorRequest) ProtoMessage() {} func (x *CreateActorRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[17] + mi := &file_ateapi_proto_msgTypes[37] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1552,7 +2660,7 @@ func (x *CreateActorRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use CreateActorRequest.ProtoReflect.Descriptor instead. func (*CreateActorRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{17} + return file_ateapi_proto_rawDescGZIP(), []int{37} } func (x *CreateActorRequest) GetActor() *Actor { @@ -1591,7 +2699,7 @@ type UpdateActorRequest struct { func (x *UpdateActorRequest) Reset() { *x = UpdateActorRequest{} - mi := &file_ateapi_proto_msgTypes[18] + mi := &file_ateapi_proto_msgTypes[38] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1603,7 +2711,7 @@ func (x *UpdateActorRequest) String() string { func (*UpdateActorRequest) ProtoMessage() {} func (x *UpdateActorRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[18] + mi := &file_ateapi_proto_msgTypes[38] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1616,7 +2724,7 @@ func (x *UpdateActorRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use UpdateActorRequest.ProtoReflect.Descriptor instead. func (*UpdateActorRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{18} + return file_ateapi_proto_rawDescGZIP(), []int{38} } func (x *UpdateActorRequest) GetActor() *Actor { @@ -1642,7 +2750,7 @@ type SuspendActorRequest struct { func (x *SuspendActorRequest) Reset() { *x = SuspendActorRequest{} - mi := &file_ateapi_proto_msgTypes[19] + mi := &file_ateapi_proto_msgTypes[39] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1654,7 +2762,7 @@ func (x *SuspendActorRequest) String() string { func (*SuspendActorRequest) ProtoMessage() {} func (x *SuspendActorRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[19] + mi := &file_ateapi_proto_msgTypes[39] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1667,7 +2775,7 @@ func (x *SuspendActorRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use SuspendActorRequest.ProtoReflect.Descriptor instead. func (*SuspendActorRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{19} + return file_ateapi_proto_rawDescGZIP(), []int{39} } func (x *SuspendActorRequest) GetActor() *ObjectRef { @@ -1686,7 +2794,7 @@ type SuspendActorResponse struct { func (x *SuspendActorResponse) Reset() { *x = SuspendActorResponse{} - mi := &file_ateapi_proto_msgTypes[20] + mi := &file_ateapi_proto_msgTypes[40] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1698,7 +2806,7 @@ func (x *SuspendActorResponse) String() string { func (*SuspendActorResponse) ProtoMessage() {} func (x *SuspendActorResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[20] + mi := &file_ateapi_proto_msgTypes[40] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1711,7 +2819,7 @@ func (x *SuspendActorResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use SuspendActorResponse.ProtoReflect.Descriptor instead. func (*SuspendActorResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{20} + return file_ateapi_proto_rawDescGZIP(), []int{40} } func (x *SuspendActorResponse) GetActor() *Actor { @@ -1730,7 +2838,7 @@ type PauseActorRequest struct { func (x *PauseActorRequest) Reset() { *x = PauseActorRequest{} - mi := &file_ateapi_proto_msgTypes[21] + mi := &file_ateapi_proto_msgTypes[41] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1742,7 +2850,7 @@ func (x *PauseActorRequest) String() string { func (*PauseActorRequest) ProtoMessage() {} func (x *PauseActorRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[21] + mi := &file_ateapi_proto_msgTypes[41] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1755,7 +2863,7 @@ func (x *PauseActorRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use PauseActorRequest.ProtoReflect.Descriptor instead. func (*PauseActorRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{21} + return file_ateapi_proto_rawDescGZIP(), []int{41} } func (x *PauseActorRequest) GetActor() *ObjectRef { @@ -1774,7 +2882,7 @@ type PauseActorResponse struct { func (x *PauseActorResponse) Reset() { *x = PauseActorResponse{} - mi := &file_ateapi_proto_msgTypes[22] + mi := &file_ateapi_proto_msgTypes[42] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1786,7 +2894,7 @@ func (x *PauseActorResponse) String() string { func (*PauseActorResponse) ProtoMessage() {} func (x *PauseActorResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[22] + mi := &file_ateapi_proto_msgTypes[42] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1799,7 +2907,7 @@ func (x *PauseActorResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use PauseActorResponse.ProtoReflect.Descriptor instead. func (*PauseActorResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{22} + return file_ateapi_proto_rawDescGZIP(), []int{42} } func (x *PauseActorResponse) GetActor() *Actor { @@ -1820,7 +2928,7 @@ type ResumeActorRequest struct { func (x *ResumeActorRequest) Reset() { *x = ResumeActorRequest{} - mi := &file_ateapi_proto_msgTypes[23] + mi := &file_ateapi_proto_msgTypes[43] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1832,7 +2940,7 @@ func (x *ResumeActorRequest) String() string { func (*ResumeActorRequest) ProtoMessage() {} func (x *ResumeActorRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[23] + mi := &file_ateapi_proto_msgTypes[43] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1845,7 +2953,7 @@ func (x *ResumeActorRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ResumeActorRequest.ProtoReflect.Descriptor instead. func (*ResumeActorRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{23} + return file_ateapi_proto_rawDescGZIP(), []int{43} } func (x *ResumeActorRequest) GetActor() *ObjectRef { @@ -1874,7 +2982,7 @@ type ResumeActorResponse struct { func (x *ResumeActorResponse) Reset() { *x = ResumeActorResponse{} - mi := &file_ateapi_proto_msgTypes[24] + mi := &file_ateapi_proto_msgTypes[44] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1886,7 +2994,7 @@ func (x *ResumeActorResponse) String() string { func (*ResumeActorResponse) ProtoMessage() {} func (x *ResumeActorResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[24] + mi := &file_ateapi_proto_msgTypes[44] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1899,7 +3007,7 @@ func (x *ResumeActorResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ResumeActorResponse.ProtoReflect.Descriptor instead. func (*ResumeActorResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{24} + return file_ateapi_proto_rawDescGZIP(), []int{44} } func (x *ResumeActorResponse) GetActor() *Actor { @@ -1925,7 +3033,7 @@ type DeleteActorRequest struct { func (x *DeleteActorRequest) Reset() { *x = DeleteActorRequest{} - mi := &file_ateapi_proto_msgTypes[25] + mi := &file_ateapi_proto_msgTypes[45] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1937,7 +3045,7 @@ func (x *DeleteActorRequest) String() string { func (*DeleteActorRequest) ProtoMessage() {} func (x *DeleteActorRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[25] + mi := &file_ateapi_proto_msgTypes[45] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1950,7 +3058,7 @@ func (x *DeleteActorRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteActorRequest.ProtoReflect.Descriptor instead. func (*DeleteActorRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{25} + return file_ateapi_proto_rawDescGZIP(), []int{45} } func (x *DeleteActorRequest) GetActor() *ObjectRef { @@ -1969,7 +3077,7 @@ type GetActorSnapshotRequest struct { func (x *GetActorSnapshotRequest) Reset() { *x = GetActorSnapshotRequest{} - mi := &file_ateapi_proto_msgTypes[26] + mi := &file_ateapi_proto_msgTypes[46] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1981,7 +3089,7 @@ func (x *GetActorSnapshotRequest) String() string { func (*GetActorSnapshotRequest) ProtoMessage() {} func (x *GetActorSnapshotRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[26] + mi := &file_ateapi_proto_msgTypes[46] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1994,7 +3102,7 @@ func (x *GetActorSnapshotRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetActorSnapshotRequest.ProtoReflect.Descriptor instead. func (*GetActorSnapshotRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{26} + return file_ateapi_proto_rawDescGZIP(), []int{46} } func (x *GetActorSnapshotRequest) GetSnapshot() *ActorSnapshotRef { @@ -2015,7 +3123,7 @@ type ListActorSnapshotsRequest struct { func (x *ListActorSnapshotsRequest) Reset() { *x = ListActorSnapshotsRequest{} - mi := &file_ateapi_proto_msgTypes[27] + mi := &file_ateapi_proto_msgTypes[47] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2027,7 +3135,7 @@ func (x *ListActorSnapshotsRequest) String() string { func (*ListActorSnapshotsRequest) ProtoMessage() {} func (x *ListActorSnapshotsRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[27] + mi := &file_ateapi_proto_msgTypes[47] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2040,7 +3148,7 @@ func (x *ListActorSnapshotsRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ListActorSnapshotsRequest.ProtoReflect.Descriptor instead. func (*ListActorSnapshotsRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{27} + return file_ateapi_proto_rawDescGZIP(), []int{47} } func (x *ListActorSnapshotsRequest) GetAtespace() string { @@ -2074,7 +3182,7 @@ type ListActorSnapshotsResponse struct { func (x *ListActorSnapshotsResponse) Reset() { *x = ListActorSnapshotsResponse{} - mi := &file_ateapi_proto_msgTypes[28] + mi := &file_ateapi_proto_msgTypes[48] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2086,7 +3194,7 @@ func (x *ListActorSnapshotsResponse) String() string { func (*ListActorSnapshotsResponse) ProtoMessage() {} func (x *ListActorSnapshotsResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[28] + mi := &file_ateapi_proto_msgTypes[48] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2099,7 +3207,7 @@ func (x *ListActorSnapshotsResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ListActorSnapshotsResponse.ProtoReflect.Descriptor instead. func (*ListActorSnapshotsResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{28} + return file_ateapi_proto_rawDescGZIP(), []int{48} } func (x *ListActorSnapshotsResponse) GetSnapshots() []*ActorSnapshot { @@ -2126,7 +3234,7 @@ type TagActorSnapshotRequest struct { func (x *TagActorSnapshotRequest) Reset() { *x = TagActorSnapshotRequest{} - mi := &file_ateapi_proto_msgTypes[29] + mi := &file_ateapi_proto_msgTypes[49] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2138,7 +3246,7 @@ func (x *TagActorSnapshotRequest) String() string { func (*TagActorSnapshotRequest) ProtoMessage() {} func (x *TagActorSnapshotRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[29] + mi := &file_ateapi_proto_msgTypes[49] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2151,7 +3259,7 @@ func (x *TagActorSnapshotRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use TagActorSnapshotRequest.ProtoReflect.Descriptor instead. func (*TagActorSnapshotRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{29} + return file_ateapi_proto_rawDescGZIP(), []int{49} } func (x *TagActorSnapshotRequest) GetSnapshot() *ActorSnapshotRef { @@ -2189,7 +3297,7 @@ type UpdateActorSnapshotTagRequest struct { func (x *UpdateActorSnapshotTagRequest) Reset() { *x = UpdateActorSnapshotTagRequest{} - mi := &file_ateapi_proto_msgTypes[30] + mi := &file_ateapi_proto_msgTypes[50] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2201,7 +3309,7 @@ func (x *UpdateActorSnapshotTagRequest) String() string { func (*UpdateActorSnapshotTagRequest) ProtoMessage() {} func (x *UpdateActorSnapshotTagRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[30] + mi := &file_ateapi_proto_msgTypes[50] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2214,7 +3322,7 @@ func (x *UpdateActorSnapshotTagRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use UpdateActorSnapshotTagRequest.ProtoReflect.Descriptor instead. func (*UpdateActorSnapshotTagRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{30} + return file_ateapi_proto_rawDescGZIP(), []int{50} } func (x *UpdateActorSnapshotTagRequest) GetTag() *ActorSnapshotTag { @@ -2240,7 +3348,7 @@ type DeleteActorSnapshotTagRequest struct { func (x *DeleteActorSnapshotTagRequest) Reset() { *x = DeleteActorSnapshotTagRequest{} - mi := &file_ateapi_proto_msgTypes[31] + mi := &file_ateapi_proto_msgTypes[51] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2252,7 +3360,7 @@ func (x *DeleteActorSnapshotTagRequest) String() string { func (*DeleteActorSnapshotTagRequest) ProtoMessage() {} func (x *DeleteActorSnapshotTagRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[31] + mi := &file_ateapi_proto_msgTypes[51] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2265,7 +3373,7 @@ func (x *DeleteActorSnapshotTagRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteActorSnapshotTagRequest.ProtoReflect.Descriptor instead. func (*DeleteActorSnapshotTagRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{31} + return file_ateapi_proto_rawDescGZIP(), []int{51} } func (x *DeleteActorSnapshotTagRequest) GetTag() *ObjectRef { @@ -2290,7 +3398,7 @@ type ListWorkersRequest struct { func (x *ListWorkersRequest) Reset() { *x = ListWorkersRequest{} - mi := &file_ateapi_proto_msgTypes[32] + mi := &file_ateapi_proto_msgTypes[52] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2302,7 +3410,7 @@ func (x *ListWorkersRequest) String() string { func (*ListWorkersRequest) ProtoMessage() {} func (x *ListWorkersRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[32] + mi := &file_ateapi_proto_msgTypes[52] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2315,7 +3423,7 @@ func (x *ListWorkersRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ListWorkersRequest.ProtoReflect.Descriptor instead. func (*ListWorkersRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{32} + return file_ateapi_proto_rawDescGZIP(), []int{52} } func (x *ListWorkersRequest) GetPageSize() int32 { @@ -2344,7 +3452,7 @@ type ListWorkersResponse struct { func (x *ListWorkersResponse) Reset() { *x = ListWorkersResponse{} - mi := &file_ateapi_proto_msgTypes[33] + mi := &file_ateapi_proto_msgTypes[53] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2356,7 +3464,7 @@ func (x *ListWorkersResponse) String() string { func (*ListWorkersResponse) ProtoMessage() {} func (x *ListWorkersResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[33] + mi := &file_ateapi_proto_msgTypes[53] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2369,7 +3477,7 @@ func (x *ListWorkersResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ListWorkersResponse.ProtoReflect.Descriptor instead. func (*ListWorkersResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{33} + return file_ateapi_proto_rawDescGZIP(), []int{53} } func (x *ListWorkersResponse) GetWorkers() []*Worker { @@ -2405,7 +3513,7 @@ type ListActorsRequest struct { func (x *ListActorsRequest) Reset() { *x = ListActorsRequest{} - mi := &file_ateapi_proto_msgTypes[34] + mi := &file_ateapi_proto_msgTypes[54] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2417,7 +3525,7 @@ func (x *ListActorsRequest) String() string { func (*ListActorsRequest) ProtoMessage() {} func (x *ListActorsRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[34] + mi := &file_ateapi_proto_msgTypes[54] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2430,7 +3538,7 @@ func (x *ListActorsRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ListActorsRequest.ProtoReflect.Descriptor instead. func (*ListActorsRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{34} + return file_ateapi_proto_rawDescGZIP(), []int{54} } func (x *ListActorsRequest) GetAtespace() string { @@ -2466,7 +3574,7 @@ type ListActorsResponse struct { func (x *ListActorsResponse) Reset() { *x = ListActorsResponse{} - mi := &file_ateapi_proto_msgTypes[35] + mi := &file_ateapi_proto_msgTypes[55] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2478,7 +3586,7 @@ func (x *ListActorsResponse) String() string { func (*ListActorsResponse) ProtoMessage() {} func (x *ListActorsResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[35] + mi := &file_ateapi_proto_msgTypes[55] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2491,7 +3599,7 @@ func (x *ListActorsResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ListActorsResponse.ProtoReflect.Descriptor instead. func (*ListActorsResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{35} + return file_ateapi_proto_rawDescGZIP(), []int{55} } func (x *ListActorsResponse) GetActors() []*Actor { @@ -2527,7 +3635,7 @@ type Worker struct { func (x *Worker) Reset() { *x = Worker{} - mi := &file_ateapi_proto_msgTypes[36] + mi := &file_ateapi_proto_msgTypes[56] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2539,7 +3647,7 @@ func (x *Worker) String() string { func (*Worker) ProtoMessage() {} func (x *Worker) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[36] + mi := &file_ateapi_proto_msgTypes[56] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2552,7 +3660,7 @@ func (x *Worker) ProtoReflect() protoreflect.Message { // Deprecated: Use Worker.ProtoReflect.Descriptor instead. func (*Worker) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{36} + return file_ateapi_proto_rawDescGZIP(), []int{56} } func (x *Worker) GetWorkerNamespace() string { @@ -2643,7 +3751,7 @@ type Assignment struct { func (x *Assignment) Reset() { *x = Assignment{} - mi := &file_ateapi_proto_msgTypes[37] + mi := &file_ateapi_proto_msgTypes[57] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2655,7 +3763,7 @@ func (x *Assignment) String() string { func (*Assignment) ProtoMessage() {} func (x *Assignment) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[37] + mi := &file_ateapi_proto_msgTypes[57] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2668,7 +3776,7 @@ func (x *Assignment) ProtoReflect() protoreflect.Message { // Deprecated: Use Assignment.ProtoReflect.Descriptor instead. func (*Assignment) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{37} + return file_ateapi_proto_rawDescGZIP(), []int{57} } func (x *Assignment) GetActorTemplate() *KubeNamespacedObjectRef { @@ -2702,7 +3810,7 @@ type KubeNamespacedObjectRef struct { func (x *KubeNamespacedObjectRef) Reset() { *x = KubeNamespacedObjectRef{} - mi := &file_ateapi_proto_msgTypes[38] + mi := &file_ateapi_proto_msgTypes[58] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2714,7 +3822,7 @@ func (x *KubeNamespacedObjectRef) String() string { func (*KubeNamespacedObjectRef) ProtoMessage() {} func (x *KubeNamespacedObjectRef) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[38] + mi := &file_ateapi_proto_msgTypes[58] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2727,7 +3835,7 @@ func (x *KubeNamespacedObjectRef) ProtoReflect() protoreflect.Message { // Deprecated: Use KubeNamespacedObjectRef.ProtoReflect.Descriptor instead. func (*KubeNamespacedObjectRef) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{38} + return file_ateapi_proto_rawDescGZIP(), []int{58} } func (x *KubeNamespacedObjectRef) GetNamespace() string { @@ -2752,7 +3860,7 @@ type DebugClearRequest struct { func (x *DebugClearRequest) Reset() { *x = DebugClearRequest{} - mi := &file_ateapi_proto_msgTypes[39] + mi := &file_ateapi_proto_msgTypes[59] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2764,7 +3872,7 @@ func (x *DebugClearRequest) String() string { func (*DebugClearRequest) ProtoMessage() {} func (x *DebugClearRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[39] + mi := &file_ateapi_proto_msgTypes[59] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2777,7 +3885,7 @@ func (x *DebugClearRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DebugClearRequest.ProtoReflect.Descriptor instead. func (*DebugClearRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{39} + return file_ateapi_proto_rawDescGZIP(), []int{59} } type DebugClearResponse struct { @@ -2788,7 +3896,7 @@ type DebugClearResponse struct { func (x *DebugClearResponse) Reset() { *x = DebugClearResponse{} - mi := &file_ateapi_proto_msgTypes[40] + mi := &file_ateapi_proto_msgTypes[60] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2800,7 +3908,7 @@ func (x *DebugClearResponse) String() string { func (*DebugClearResponse) ProtoMessage() {} func (x *DebugClearResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[40] + mi := &file_ateapi_proto_msgTypes[60] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2813,7 +3921,7 @@ func (x *DebugClearResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use DebugClearResponse.ProtoReflect.Descriptor instead. func (*DebugClearResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{40} + return file_ateapi_proto_rawDescGZIP(), []int{60} } type MintJWTRequest struct { @@ -2828,7 +3936,7 @@ type MintJWTRequest struct { func (x *MintJWTRequest) Reset() { *x = MintJWTRequest{} - mi := &file_ateapi_proto_msgTypes[41] + mi := &file_ateapi_proto_msgTypes[61] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2840,7 +3948,7 @@ func (x *MintJWTRequest) String() string { func (*MintJWTRequest) ProtoMessage() {} func (x *MintJWTRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[41] + mi := &file_ateapi_proto_msgTypes[61] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2853,7 +3961,7 @@ func (x *MintJWTRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use MintJWTRequest.ProtoReflect.Descriptor instead. func (*MintJWTRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{41} + return file_ateapi_proto_rawDescGZIP(), []int{61} } func (x *MintJWTRequest) GetAudience() []string { @@ -2914,7 +4022,7 @@ type MintJWTResponse struct { func (x *MintJWTResponse) Reset() { *x = MintJWTResponse{} - mi := &file_ateapi_proto_msgTypes[42] + mi := &file_ateapi_proto_msgTypes[62] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2926,7 +4034,7 @@ func (x *MintJWTResponse) String() string { func (*MintJWTResponse) ProtoMessage() {} func (x *MintJWTResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[42] + mi := &file_ateapi_proto_msgTypes[62] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2939,7 +4047,7 @@ func (x *MintJWTResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use MintJWTResponse.ProtoReflect.Descriptor instead. func (*MintJWTResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{42} + return file_ateapi_proto_rawDescGZIP(), []int{62} } func (x *MintJWTResponse) GetActorJwt() string { @@ -2971,7 +4079,7 @@ type MintCertRequest struct { func (x *MintCertRequest) Reset() { *x = MintCertRequest{} - mi := &file_ateapi_proto_msgTypes[43] + mi := &file_ateapi_proto_msgTypes[63] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2983,7 +4091,7 @@ func (x *MintCertRequest) String() string { func (*MintCertRequest) ProtoMessage() {} func (x *MintCertRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[43] + mi := &file_ateapi_proto_msgTypes[63] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2996,7 +4104,7 @@ func (x *MintCertRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use MintCertRequest.ProtoReflect.Descriptor instead. func (*MintCertRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{43} + return file_ateapi_proto_rawDescGZIP(), []int{63} } func (x *MintCertRequest) GetWorkerNamespace() string { @@ -3053,7 +4161,7 @@ type MintCertResponse struct { func (x *MintCertResponse) Reset() { *x = MintCertResponse{} - mi := &file_ateapi_proto_msgTypes[44] + mi := &file_ateapi_proto_msgTypes[64] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -3065,7 +4173,7 @@ func (x *MintCertResponse) String() string { func (*MintCertResponse) ProtoMessage() {} func (x *MintCertResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[44] + mi := &file_ateapi_proto_msgTypes[64] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -3078,7 +4186,7 @@ func (x *MintCertResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use MintCertResponse.ProtoReflect.Descriptor instead. func (*MintCertResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{44} + return file_ateapi_proto_rawDescGZIP(), []int{64} } func (x *MintCertResponse) GetActorCertificates() [][]byte { @@ -3092,7 +4200,7 @@ var File_ateapi_proto protoreflect.FileDescriptor const file_ateapi_proto_rawDesc = "" + "\n" + - "\fateapi.proto\x12\x06ateapi\x1a google/protobuf/field_mask.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"\xbd\x01\n" + + "\fateapi.proto\x12\x06ateapi\x1a google/protobuf/field_mask.proto\x1a\x19google/protobuf/any.proto\x1a\x1bgoogle/protobuf/empty.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"\xbd\x01\n" + "\x11LocalSnapshotInfo\x12#\n" + "\rsnapshot_name\x18\x01 \x01(\tR\fsnapshotName\x12@\n" + "\x1dnode_vms_with_local_snapshots\x18\x02 \x03(\tR\x19nodeVmsWithLocalSnapshots\x12A\n" + @@ -3174,7 +4282,42 @@ const file_ateapi_proto_rawDesc = "" + "\bsnapshot\x18\x02 \x01(\v2\x11.ateapi.ObjectRefR\bsnapshot\x123\n" + "\x05scope\x18\x03 \x01(\x0e2\x1d.ateapi.ActorSnapshotTagScopeR\x05scope\"@\n" + "\bAtespace\x124\n" + - "\bmetadata\x18\x01 \x01(\v2\x18.ateapi.ResourceMetadataR\bmetadata\";\n" + + "\bmetadata\x18\x01 \x01(\v2\x18.ateapi.ResourceMetadataR\bmetadata\"\x8e\x02\n" + + "\fEgressPolicy\x124\n" + + "\bmetadata\x18\x01 \x01(\v2\x18.ateapi.ResourceMetadataR\bmetadata\x12)\n" + + "\x05actor\x18\x02 \x01(\v2\x11.ateapi.ObjectRefH\x00R\x05actor\x123\n" + + "\tallow_all\x18\x03 \x01(\v2\x16.google.protobuf.EmptyR\ballowAll\x12(\n" + + "\x05rules\x18\x04 \x03(\v2\x12.ateapi.EgressRuleR\x05rules\x124\n" + + "\n" + + "extensions\x18\x05 \x03(\v2\x14.google.protobuf.AnyR\n" + + "extensionsB\b\n" + + "\x06target\"\x7f\n" + + "\n" + + "EgressRule\x123\n" + + "\bhostname\x18\x01 \x01(\v2\x15.ateapi.HostnameMatchH\x00R\bhostname\x123\n" + + "\tip_blocks\x18\x02 \x01(\v2\x14.ateapi.IPBlockMatchH\x00R\bipBlocksB\a\n" + + "\x05match\"\x7f\n" + + "\rHostnameMatch\x12\x18\n" + + "\apattern\x18\x01 \x01(\tR\apattern\x12T\n" + + "\x14credential_injection\x18\x02 \x01(\v2!.ateapi.HeaderCredentialInjectionR\x13credentialInjection\"$\n" + + "\fIPBlockMatch\x12\x14\n" + + "\x05cidrs\x18\x01 \x03(\tR\x05cidrs\"p\n" + + "\x19HeaderCredentialInjection\x12\x16\n" + + "\x06header\x18\x01 \x01(\tR\x06header\x12;\n" + + "\n" + + "credential\x18\x02 \x01(\v2\x1b.ateapi.CredentialReferenceR\n" + + "credential\")\n" + + "\x13CredentialReference\x12\x12\n" + + "\x04name\x18\x01 \x01(\tR\x04name\"\xa0\x01\n" + + "\n" + + "Credential\x124\n" + + "\bmetadata\x18\x01 \x01(\v2\x18.ateapi.ResourceMetadataR\bmetadata\x12R\n" + + "\x11kubernetes_secret\x18\x02 \x01(\v2#.ateapi.KubernetesSecretKeySelectorH\x00R\x10kubernetesSecretB\b\n" + + "\x06source\"a\n" + + "\x1bKubernetesSecretKeySelector\x12\x1c\n" + + "\tnamespace\x18\x01 \x01(\tR\tnamespace\x12\x12\n" + + "\x04name\x18\x02 \x01(\tR\x04name\x12\x10\n" + + "\x03key\x18\x03 \x01(\tR\x03key\";\n" + "\tObjectRef\x12\x1a\n" + "\batespace\x18\x01 \x01(\tR\batespace\x12\x12\n" + "\x04name\x18\x02 \x01(\tR\x04name\"w\n" + @@ -3194,7 +4337,51 @@ const file_ateapi_proto_rawDesc = "" + "\tatespaces\x18\x01 \x03(\v2\x10.ateapi.AtespaceR\tatespaces\x12&\n" + "\x0fnext_page_token\x18\x02 \x01(\tR\rnextPageToken\"F\n" + "\x15DeleteAtespaceRequest\x12-\n" + - "\batespace\x18\x01 \x01(\v2\x11.ateapi.ObjectRefR\batespace\":\n" + + "\batespace\x18\x01 \x01(\v2\x11.ateapi.ObjectRefR\batespace\"P\n" + + "\x16GetEgressPolicyRequest\x126\n" + + "\regress_policy\x18\x01 \x01(\v2\x11.ateapi.ObjectRefR\fegressPolicy\"V\n" + + "\x19CreateEgressPolicyRequest\x129\n" + + "\regress_policy\x18\x01 \x01(\v2\x14.ateapi.EgressPolicyR\fegressPolicy\"\x93\x01\n" + + "\x19UpdateEgressPolicyRequest\x129\n" + + "\regress_policy\x18\x01 \x01(\v2\x14.ateapi.EgressPolicyR\fegressPolicy\x12;\n" + + "\vupdate_mask\x18\x02 \x01(\v2\x1a.google.protobuf.FieldMaskR\n" + + "updateMask\"S\n" + + "\x19DeleteEgressPolicyRequest\x126\n" + + "\regress_policy\x18\x01 \x01(\v2\x11.ateapi.ObjectRefR\fegressPolicy\"s\n" + + "\x19ListEgressPoliciesRequest\x12\x1a\n" + + "\batespace\x18\x01 \x01(\tR\batespace\x12\x1b\n" + + "\tpage_size\x18\x02 \x01(\x05R\bpageSize\x12\x1d\n" + + "\n" + + "page_token\x18\x03 \x01(\tR\tpageToken\"\x83\x01\n" + + "\x1aListEgressPoliciesResponse\x12=\n" + + "\x0fegress_policies\x18\x01 \x03(\v2\x14.ateapi.EgressPolicyR\x0eegressPolicies\x12&\n" + + "\x0fnext_page_token\x18\x02 \x01(\tR\rnextPageToken\"I\n" + + "\x14GetCredentialRequest\x121\n" + + "\n" + + "credential\x18\x01 \x01(\v2\x11.ateapi.ObjectRefR\n" + + "credential\"M\n" + + "\x17CreateCredentialRequest\x122\n" + + "\n" + + "credential\x18\x01 \x01(\v2\x12.ateapi.CredentialR\n" + + "credential\"\x8a\x01\n" + + "\x17UpdateCredentialRequest\x122\n" + + "\n" + + "credential\x18\x01 \x01(\v2\x12.ateapi.CredentialR\n" + + "credential\x12;\n" + + "\vupdate_mask\x18\x02 \x01(\v2\x1a.google.protobuf.FieldMaskR\n" + + "updateMask\"L\n" + + "\x17DeleteCredentialRequest\x121\n" + + "\n" + + "credential\x18\x01 \x01(\v2\x11.ateapi.ObjectRefR\n" + + "credential\"p\n" + + "\x16ListCredentialsRequest\x12\x1a\n" + + "\batespace\x18\x01 \x01(\tR\batespace\x12\x1b\n" + + "\tpage_size\x18\x02 \x01(\x05R\bpageSize\x12\x1d\n" + + "\n" + + "page_token\x18\x03 \x01(\tR\tpageToken\"w\n" + + "\x17ListCredentialsResponse\x124\n" + + "\vcredentials\x18\x01 \x03(\v2\x12.ateapi.CredentialR\vcredentials\x12&\n" + + "\x0fnext_page_token\x18\x02 \x01(\tR\rnextPageToken\":\n" + "\x0fGetActorRequest\x12'\n" + "\x05actor\x18\x01 \x01(\v2\x11.ateapi.ObjectRefR\x05actor\"|\n" + "\x12CreateActorRequest\x12#\n" + @@ -3315,8 +4502,7 @@ const file_ateapi_proto_rawDesc = "" + "\"ACTOR_SNAPSHOT_TAG_SCOPE_PUBLISHED\x10\x01*k\n" + "\x17ActorCertificatePurpose\x12)\n" + "%ACTOR_CERTIFICATE_PURPOSE_UNSPECIFIED\x10\x00\x12%\n" + - "!ACTOR_CERTIFICATE_PURPOSE_ATUNNEL\x10\x012\xb3\n" + - "\n" + + "!ACTOR_CERTIFICATE_PURPOSE_ATUNNEL\x10\x012\xcc\x10\n" + "\aControl\x124\n" + "\bGetActor\x12\x17.ateapi.GetActorRequest\x1a\r.ateapi.Actor\"\x00\x12:\n" + "\vCreateActor\x12\x1a.ateapi.CreateActorRequest\x1a\r.ateapi.Actor\"\x00\x12:\n" + @@ -3337,7 +4523,17 @@ const file_ateapi_proto_rawDesc = "" + "\x0eCreateAtespace\x12\x1d.ateapi.CreateAtespaceRequest\x1a\x10.ateapi.Atespace\"\x00\x12=\n" + "\vGetAtespace\x12\x1a.ateapi.GetAtespaceRequest\x1a\x10.ateapi.Atespace\"\x00\x12N\n" + "\rListAtespaces\x12\x1c.ateapi.ListAtespacesRequest\x1a\x1d.ateapi.ListAtespacesResponse\"\x00\x12C\n" + - "\x0eDeleteAtespace\x12\x1d.ateapi.DeleteAtespaceRequest\x1a\x10.ateapi.Atespace\"\x002N\n" + + "\x0eDeleteAtespace\x12\x1d.ateapi.DeleteAtespaceRequest\x1a\x10.ateapi.Atespace\"\x00\x12I\n" + + "\x0fGetEgressPolicy\x12\x1e.ateapi.GetEgressPolicyRequest\x1a\x14.ateapi.EgressPolicy\"\x00\x12O\n" + + "\x12CreateEgressPolicy\x12!.ateapi.CreateEgressPolicyRequest\x1a\x14.ateapi.EgressPolicy\"\x00\x12O\n" + + "\x12UpdateEgressPolicy\x12!.ateapi.UpdateEgressPolicyRequest\x1a\x14.ateapi.EgressPolicy\"\x00\x12O\n" + + "\x12DeleteEgressPolicy\x12!.ateapi.DeleteEgressPolicyRequest\x1a\x14.ateapi.EgressPolicy\"\x00\x12]\n" + + "\x12ListEgressPolicies\x12!.ateapi.ListEgressPoliciesRequest\x1a\".ateapi.ListEgressPoliciesResponse\"\x00\x12C\n" + + "\rGetCredential\x12\x1c.ateapi.GetCredentialRequest\x1a\x12.ateapi.Credential\"\x00\x12I\n" + + "\x10CreateCredential\x12\x1f.ateapi.CreateCredentialRequest\x1a\x12.ateapi.Credential\"\x00\x12I\n" + + "\x10UpdateCredential\x12\x1f.ateapi.UpdateCredentialRequest\x1a\x12.ateapi.Credential\"\x00\x12I\n" + + "\x10DeleteCredential\x12\x1f.ateapi.DeleteCredentialRequest\x1a\x12.ateapi.Credential\"\x00\x12T\n" + + "\x0fListCredentials\x12\x1e.ateapi.ListCredentialsRequest\x1a\x1f.ateapi.ListCredentialsResponse\"\x002N\n" + "\x05Debug\x12E\n" + "\n" + "DebugClear\x12\x19.ateapi.DebugClearRequest\x1a\x1a.ateapi.DebugClearResponse\"\x002\x8a\x01\n" + @@ -3358,7 +4554,7 @@ func file_ateapi_proto_rawDescGZIP() []byte { } var file_ateapi_proto_enumTypes = make([]protoimpl.EnumInfo, 6) -var file_ateapi_proto_msgTypes = make([]protoimpl.MessageInfo, 48) +var file_ateapi_proto_msgTypes = make([]protoimpl.MessageInfo, 68) var file_ateapi_proto_goTypes = []any{ (SnapshotContentScope)(0), // 0: ateapi.SnapshotContentScope (ActorSnapshotTagScope)(0), // 1: ateapi.ActorSnapshotTagScope @@ -3375,149 +4571,214 @@ var file_ateapi_proto_goTypes = []any{ (*ActorSnapshot)(nil), // 12: ateapi.ActorSnapshot (*ActorSnapshotTag)(nil), // 13: ateapi.ActorSnapshotTag (*Atespace)(nil), // 14: ateapi.Atespace - (*ObjectRef)(nil), // 15: ateapi.ObjectRef - (*ActorSnapshotRef)(nil), // 16: ateapi.ActorSnapshotRef - (*CreateAtespaceRequest)(nil), // 17: ateapi.CreateAtespaceRequest - (*GetAtespaceRequest)(nil), // 18: ateapi.GetAtespaceRequest - (*ListAtespacesRequest)(nil), // 19: ateapi.ListAtespacesRequest - (*ListAtespacesResponse)(nil), // 20: ateapi.ListAtespacesResponse - (*DeleteAtespaceRequest)(nil), // 21: ateapi.DeleteAtespaceRequest - (*GetActorRequest)(nil), // 22: ateapi.GetActorRequest - (*CreateActorRequest)(nil), // 23: ateapi.CreateActorRequest - (*UpdateActorRequest)(nil), // 24: ateapi.UpdateActorRequest - (*SuspendActorRequest)(nil), // 25: ateapi.SuspendActorRequest - (*SuspendActorResponse)(nil), // 26: ateapi.SuspendActorResponse - (*PauseActorRequest)(nil), // 27: ateapi.PauseActorRequest - (*PauseActorResponse)(nil), // 28: ateapi.PauseActorResponse - (*ResumeActorRequest)(nil), // 29: ateapi.ResumeActorRequest - (*ResumeActorResponse)(nil), // 30: ateapi.ResumeActorResponse - (*DeleteActorRequest)(nil), // 31: ateapi.DeleteActorRequest - (*GetActorSnapshotRequest)(nil), // 32: ateapi.GetActorSnapshotRequest - (*ListActorSnapshotsRequest)(nil), // 33: ateapi.ListActorSnapshotsRequest - (*ListActorSnapshotsResponse)(nil), // 34: ateapi.ListActorSnapshotsResponse - (*TagActorSnapshotRequest)(nil), // 35: ateapi.TagActorSnapshotRequest - (*UpdateActorSnapshotTagRequest)(nil), // 36: ateapi.UpdateActorSnapshotTagRequest - (*DeleteActorSnapshotTagRequest)(nil), // 37: ateapi.DeleteActorSnapshotTagRequest - (*ListWorkersRequest)(nil), // 38: ateapi.ListWorkersRequest - (*ListWorkersResponse)(nil), // 39: ateapi.ListWorkersResponse - (*ListActorsRequest)(nil), // 40: ateapi.ListActorsRequest - (*ListActorsResponse)(nil), // 41: ateapi.ListActorsResponse - (*Worker)(nil), // 42: ateapi.Worker - (*Assignment)(nil), // 43: ateapi.Assignment - (*KubeNamespacedObjectRef)(nil), // 44: ateapi.KubeNamespacedObjectRef - (*DebugClearRequest)(nil), // 45: ateapi.DebugClearRequest - (*DebugClearResponse)(nil), // 46: ateapi.DebugClearResponse - (*MintJWTRequest)(nil), // 47: ateapi.MintJWTRequest - (*MintJWTResponse)(nil), // 48: ateapi.MintJWTResponse - (*MintCertRequest)(nil), // 49: ateapi.MintCertRequest - (*MintCertResponse)(nil), // 50: ateapi.MintCertResponse - nil, // 51: ateapi.Selector.MatchLabelsEntry - nil, // 52: ateapi.ExternalVolume.VolumeContextEntry - nil, // 53: ateapi.Worker.LabelsEntry - (*timestamppb.Timestamp)(nil), // 54: google.protobuf.Timestamp - (*fieldmaskpb.FieldMask)(nil), // 55: google.protobuf.FieldMask + (*EgressPolicy)(nil), // 15: ateapi.EgressPolicy + (*EgressRule)(nil), // 16: ateapi.EgressRule + (*HostnameMatch)(nil), // 17: ateapi.HostnameMatch + (*IPBlockMatch)(nil), // 18: ateapi.IPBlockMatch + (*HeaderCredentialInjection)(nil), // 19: ateapi.HeaderCredentialInjection + (*CredentialReference)(nil), // 20: ateapi.CredentialReference + (*Credential)(nil), // 21: ateapi.Credential + (*KubernetesSecretKeySelector)(nil), // 22: ateapi.KubernetesSecretKeySelector + (*ObjectRef)(nil), // 23: ateapi.ObjectRef + (*ActorSnapshotRef)(nil), // 24: ateapi.ActorSnapshotRef + (*CreateAtespaceRequest)(nil), // 25: ateapi.CreateAtespaceRequest + (*GetAtespaceRequest)(nil), // 26: ateapi.GetAtespaceRequest + (*ListAtespacesRequest)(nil), // 27: ateapi.ListAtespacesRequest + (*ListAtespacesResponse)(nil), // 28: ateapi.ListAtespacesResponse + (*DeleteAtespaceRequest)(nil), // 29: ateapi.DeleteAtespaceRequest + (*GetEgressPolicyRequest)(nil), // 30: ateapi.GetEgressPolicyRequest + (*CreateEgressPolicyRequest)(nil), // 31: ateapi.CreateEgressPolicyRequest + (*UpdateEgressPolicyRequest)(nil), // 32: ateapi.UpdateEgressPolicyRequest + (*DeleteEgressPolicyRequest)(nil), // 33: ateapi.DeleteEgressPolicyRequest + (*ListEgressPoliciesRequest)(nil), // 34: ateapi.ListEgressPoliciesRequest + (*ListEgressPoliciesResponse)(nil), // 35: ateapi.ListEgressPoliciesResponse + (*GetCredentialRequest)(nil), // 36: ateapi.GetCredentialRequest + (*CreateCredentialRequest)(nil), // 37: ateapi.CreateCredentialRequest + (*UpdateCredentialRequest)(nil), // 38: ateapi.UpdateCredentialRequest + (*DeleteCredentialRequest)(nil), // 39: ateapi.DeleteCredentialRequest + (*ListCredentialsRequest)(nil), // 40: ateapi.ListCredentialsRequest + (*ListCredentialsResponse)(nil), // 41: ateapi.ListCredentialsResponse + (*GetActorRequest)(nil), // 42: ateapi.GetActorRequest + (*CreateActorRequest)(nil), // 43: ateapi.CreateActorRequest + (*UpdateActorRequest)(nil), // 44: ateapi.UpdateActorRequest + (*SuspendActorRequest)(nil), // 45: ateapi.SuspendActorRequest + (*SuspendActorResponse)(nil), // 46: ateapi.SuspendActorResponse + (*PauseActorRequest)(nil), // 47: ateapi.PauseActorRequest + (*PauseActorResponse)(nil), // 48: ateapi.PauseActorResponse + (*ResumeActorRequest)(nil), // 49: ateapi.ResumeActorRequest + (*ResumeActorResponse)(nil), // 50: ateapi.ResumeActorResponse + (*DeleteActorRequest)(nil), // 51: ateapi.DeleteActorRequest + (*GetActorSnapshotRequest)(nil), // 52: ateapi.GetActorSnapshotRequest + (*ListActorSnapshotsRequest)(nil), // 53: ateapi.ListActorSnapshotsRequest + (*ListActorSnapshotsResponse)(nil), // 54: ateapi.ListActorSnapshotsResponse + (*TagActorSnapshotRequest)(nil), // 55: ateapi.TagActorSnapshotRequest + (*UpdateActorSnapshotTagRequest)(nil), // 56: ateapi.UpdateActorSnapshotTagRequest + (*DeleteActorSnapshotTagRequest)(nil), // 57: ateapi.DeleteActorSnapshotTagRequest + (*ListWorkersRequest)(nil), // 58: ateapi.ListWorkersRequest + (*ListWorkersResponse)(nil), // 59: ateapi.ListWorkersResponse + (*ListActorsRequest)(nil), // 60: ateapi.ListActorsRequest + (*ListActorsResponse)(nil), // 61: ateapi.ListActorsResponse + (*Worker)(nil), // 62: ateapi.Worker + (*Assignment)(nil), // 63: ateapi.Assignment + (*KubeNamespacedObjectRef)(nil), // 64: ateapi.KubeNamespacedObjectRef + (*DebugClearRequest)(nil), // 65: ateapi.DebugClearRequest + (*DebugClearResponse)(nil), // 66: ateapi.DebugClearResponse + (*MintJWTRequest)(nil), // 67: ateapi.MintJWTRequest + (*MintJWTResponse)(nil), // 68: ateapi.MintJWTResponse + (*MintCertRequest)(nil), // 69: ateapi.MintCertRequest + (*MintCertResponse)(nil), // 70: ateapi.MintCertResponse + nil, // 71: ateapi.Selector.MatchLabelsEntry + nil, // 72: ateapi.ExternalVolume.VolumeContextEntry + nil, // 73: ateapi.Worker.LabelsEntry + (*timestamppb.Timestamp)(nil), // 74: google.protobuf.Timestamp + (*emptypb.Empty)(nil), // 75: google.protobuf.Empty + (*anypb.Any)(nil), // 76: google.protobuf.Any + (*fieldmaskpb.FieldMask)(nil), // 77: google.protobuf.FieldMask } var file_ateapi_proto_depIdxs = []int32{ - 0, // 0: ateapi.LocalSnapshotInfo.content_scope:type_name -> ateapi.SnapshotContentScope - 51, // 1: ateapi.Selector.match_labels:type_name -> ateapi.Selector.MatchLabelsEntry - 54, // 2: ateapi.ResourceMetadata.create_time:type_name -> google.protobuf.Timestamp - 54, // 3: ateapi.ResourceMetadata.update_time:type_name -> google.protobuf.Timestamp - 3, // 4: ateapi.ExternalVolume.status:type_name -> ateapi.ExternalVolume.Status - 52, // 5: ateapi.ExternalVolume.volume_context:type_name -> ateapi.ExternalVolume.VolumeContextEntry - 8, // 6: ateapi.Actor.metadata:type_name -> ateapi.ResourceMetadata - 4, // 7: ateapi.Actor.status:type_name -> ateapi.Actor.Status - 11, // 8: ateapi.Actor.worker_assignment:type_name -> ateapi.WorkerAssignment - 7, // 9: ateapi.Actor.worker_selector:type_name -> ateapi.Selector - 15, // 10: ateapi.Actor.latest_snapshot:type_name -> ateapi.ObjectRef - 6, // 11: ateapi.Actor.local_snapshot_info:type_name -> ateapi.LocalSnapshotInfo - 9, // 12: ateapi.Actor.actor_volumes:type_name -> ateapi.ExternalVolume - 8, // 13: ateapi.ActorSnapshot.metadata:type_name -> ateapi.ResourceMetadata - 15, // 14: ateapi.ActorSnapshot.source_actor:type_name -> ateapi.ObjectRef - 0, // 15: ateapi.ActorSnapshot.content_scope:type_name -> ateapi.SnapshotContentScope - 8, // 16: ateapi.ActorSnapshotTag.metadata:type_name -> ateapi.ResourceMetadata - 15, // 17: ateapi.ActorSnapshotTag.snapshot:type_name -> ateapi.ObjectRef - 1, // 18: ateapi.ActorSnapshotTag.scope:type_name -> ateapi.ActorSnapshotTagScope - 8, // 19: ateapi.Atespace.metadata:type_name -> ateapi.ResourceMetadata - 15, // 20: ateapi.ActorSnapshotRef.snapshot:type_name -> ateapi.ObjectRef - 15, // 21: ateapi.ActorSnapshotRef.tag:type_name -> ateapi.ObjectRef - 14, // 22: ateapi.CreateAtespaceRequest.atespace:type_name -> ateapi.Atespace - 15, // 23: ateapi.GetAtespaceRequest.atespace:type_name -> ateapi.ObjectRef - 14, // 24: ateapi.ListAtespacesResponse.atespaces:type_name -> ateapi.Atespace - 15, // 25: ateapi.DeleteAtespaceRequest.atespace:type_name -> ateapi.ObjectRef - 15, // 26: ateapi.GetActorRequest.actor:type_name -> ateapi.ObjectRef - 10, // 27: ateapi.CreateActorRequest.actor:type_name -> ateapi.Actor - 16, // 28: ateapi.CreateActorRequest.source_snapshot:type_name -> ateapi.ActorSnapshotRef - 10, // 29: ateapi.UpdateActorRequest.actor:type_name -> ateapi.Actor - 55, // 30: ateapi.UpdateActorRequest.update_mask:type_name -> google.protobuf.FieldMask - 15, // 31: ateapi.SuspendActorRequest.actor:type_name -> ateapi.ObjectRef - 10, // 32: ateapi.SuspendActorResponse.actor:type_name -> ateapi.Actor - 15, // 33: ateapi.PauseActorRequest.actor:type_name -> ateapi.ObjectRef - 10, // 34: ateapi.PauseActorResponse.actor:type_name -> ateapi.Actor - 15, // 35: ateapi.ResumeActorRequest.actor:type_name -> ateapi.ObjectRef - 10, // 36: ateapi.ResumeActorResponse.actor:type_name -> ateapi.Actor - 15, // 37: ateapi.DeleteActorRequest.actor:type_name -> ateapi.ObjectRef - 16, // 38: ateapi.GetActorSnapshotRequest.snapshot:type_name -> ateapi.ActorSnapshotRef - 12, // 39: ateapi.ListActorSnapshotsResponse.snapshots:type_name -> ateapi.ActorSnapshot - 16, // 40: ateapi.TagActorSnapshotRequest.snapshot:type_name -> ateapi.ActorSnapshotRef - 13, // 41: ateapi.TagActorSnapshotRequest.tag:type_name -> ateapi.ActorSnapshotTag - 13, // 42: ateapi.UpdateActorSnapshotTagRequest.tag:type_name -> ateapi.ActorSnapshotTag - 55, // 43: ateapi.UpdateActorSnapshotTagRequest.update_mask:type_name -> google.protobuf.FieldMask - 15, // 44: ateapi.DeleteActorSnapshotTagRequest.tag:type_name -> ateapi.ObjectRef - 42, // 45: ateapi.ListWorkersResponse.workers:type_name -> ateapi.Worker - 10, // 46: ateapi.ListActorsResponse.actors:type_name -> ateapi.Actor - 43, // 47: ateapi.Worker.assignment:type_name -> ateapi.Assignment - 53, // 48: ateapi.Worker.labels:type_name -> ateapi.Worker.LabelsEntry - 5, // 49: ateapi.Worker.state:type_name -> ateapi.Worker.State - 44, // 50: ateapi.Assignment.actor_template:type_name -> ateapi.KubeNamespacedObjectRef - 15, // 51: ateapi.Assignment.actor:type_name -> ateapi.ObjectRef - 2, // 52: ateapi.MintCertRequest.purpose:type_name -> ateapi.ActorCertificatePurpose - 22, // 53: ateapi.Control.GetActor:input_type -> ateapi.GetActorRequest - 23, // 54: ateapi.Control.CreateActor:input_type -> ateapi.CreateActorRequest - 24, // 55: ateapi.Control.UpdateActor:input_type -> ateapi.UpdateActorRequest - 25, // 56: ateapi.Control.SuspendActor:input_type -> ateapi.SuspendActorRequest - 27, // 57: ateapi.Control.PauseActor:input_type -> ateapi.PauseActorRequest - 29, // 58: ateapi.Control.ResumeActor:input_type -> ateapi.ResumeActorRequest - 31, // 59: ateapi.Control.DeleteActor:input_type -> ateapi.DeleteActorRequest - 32, // 60: ateapi.Control.GetActorSnapshot:input_type -> ateapi.GetActorSnapshotRequest - 33, // 61: ateapi.Control.ListActorSnapshots:input_type -> ateapi.ListActorSnapshotsRequest - 35, // 62: ateapi.Control.TagActorSnapshot:input_type -> ateapi.TagActorSnapshotRequest - 36, // 63: ateapi.Control.UpdateActorSnapshotTag:input_type -> ateapi.UpdateActorSnapshotTagRequest - 37, // 64: ateapi.Control.DeleteActorSnapshotTag:input_type -> ateapi.DeleteActorSnapshotTagRequest - 38, // 65: ateapi.Control.ListWorkers:input_type -> ateapi.ListWorkersRequest - 40, // 66: ateapi.Control.ListActors:input_type -> ateapi.ListActorsRequest - 17, // 67: ateapi.Control.CreateAtespace:input_type -> ateapi.CreateAtespaceRequest - 18, // 68: ateapi.Control.GetAtespace:input_type -> ateapi.GetAtespaceRequest - 19, // 69: ateapi.Control.ListAtespaces:input_type -> ateapi.ListAtespacesRequest - 21, // 70: ateapi.Control.DeleteAtespace:input_type -> ateapi.DeleteAtespaceRequest - 45, // 71: ateapi.Debug.DebugClear:input_type -> ateapi.DebugClearRequest - 47, // 72: ateapi.ActorIdentity.MintJWT:input_type -> ateapi.MintJWTRequest - 49, // 73: ateapi.ActorIdentity.MintCert:input_type -> ateapi.MintCertRequest - 10, // 74: ateapi.Control.GetActor:output_type -> ateapi.Actor - 10, // 75: ateapi.Control.CreateActor:output_type -> ateapi.Actor - 10, // 76: ateapi.Control.UpdateActor:output_type -> ateapi.Actor - 26, // 77: ateapi.Control.SuspendActor:output_type -> ateapi.SuspendActorResponse - 28, // 78: ateapi.Control.PauseActor:output_type -> ateapi.PauseActorResponse - 30, // 79: ateapi.Control.ResumeActor:output_type -> ateapi.ResumeActorResponse - 10, // 80: ateapi.Control.DeleteActor:output_type -> ateapi.Actor - 12, // 81: ateapi.Control.GetActorSnapshot:output_type -> ateapi.ActorSnapshot - 34, // 82: ateapi.Control.ListActorSnapshots:output_type -> ateapi.ListActorSnapshotsResponse - 13, // 83: ateapi.Control.TagActorSnapshot:output_type -> ateapi.ActorSnapshotTag - 13, // 84: ateapi.Control.UpdateActorSnapshotTag:output_type -> ateapi.ActorSnapshotTag - 13, // 85: ateapi.Control.DeleteActorSnapshotTag:output_type -> ateapi.ActorSnapshotTag - 39, // 86: ateapi.Control.ListWorkers:output_type -> ateapi.ListWorkersResponse - 41, // 87: ateapi.Control.ListActors:output_type -> ateapi.ListActorsResponse - 14, // 88: ateapi.Control.CreateAtespace:output_type -> ateapi.Atespace - 14, // 89: ateapi.Control.GetAtespace:output_type -> ateapi.Atespace - 20, // 90: ateapi.Control.ListAtespaces:output_type -> ateapi.ListAtespacesResponse - 14, // 91: ateapi.Control.DeleteAtespace:output_type -> ateapi.Atespace - 46, // 92: ateapi.Debug.DebugClear:output_type -> ateapi.DebugClearResponse - 48, // 93: ateapi.ActorIdentity.MintJWT:output_type -> ateapi.MintJWTResponse - 50, // 94: ateapi.ActorIdentity.MintCert:output_type -> ateapi.MintCertResponse - 74, // [74:95] is the sub-list for method output_type - 53, // [53:74] is the sub-list for method input_type - 53, // [53:53] is the sub-list for extension type_name - 53, // [53:53] is the sub-list for extension extendee - 0, // [0:53] is the sub-list for field type_name + 0, // 0: ateapi.LocalSnapshotInfo.content_scope:type_name -> ateapi.SnapshotContentScope + 71, // 1: ateapi.Selector.match_labels:type_name -> ateapi.Selector.MatchLabelsEntry + 74, // 2: ateapi.ResourceMetadata.create_time:type_name -> google.protobuf.Timestamp + 74, // 3: ateapi.ResourceMetadata.update_time:type_name -> google.protobuf.Timestamp + 3, // 4: ateapi.ExternalVolume.status:type_name -> ateapi.ExternalVolume.Status + 72, // 5: ateapi.ExternalVolume.volume_context:type_name -> ateapi.ExternalVolume.VolumeContextEntry + 8, // 6: ateapi.Actor.metadata:type_name -> ateapi.ResourceMetadata + 4, // 7: ateapi.Actor.status:type_name -> ateapi.Actor.Status + 11, // 8: ateapi.Actor.worker_assignment:type_name -> ateapi.WorkerAssignment + 7, // 9: ateapi.Actor.worker_selector:type_name -> ateapi.Selector + 23, // 10: ateapi.Actor.latest_snapshot:type_name -> ateapi.ObjectRef + 6, // 11: ateapi.Actor.local_snapshot_info:type_name -> ateapi.LocalSnapshotInfo + 9, // 12: ateapi.Actor.actor_volumes:type_name -> ateapi.ExternalVolume + 8, // 13: ateapi.ActorSnapshot.metadata:type_name -> ateapi.ResourceMetadata + 23, // 14: ateapi.ActorSnapshot.source_actor:type_name -> ateapi.ObjectRef + 0, // 15: ateapi.ActorSnapshot.content_scope:type_name -> ateapi.SnapshotContentScope + 8, // 16: ateapi.ActorSnapshotTag.metadata:type_name -> ateapi.ResourceMetadata + 23, // 17: ateapi.ActorSnapshotTag.snapshot:type_name -> ateapi.ObjectRef + 1, // 18: ateapi.ActorSnapshotTag.scope:type_name -> ateapi.ActorSnapshotTagScope + 8, // 19: ateapi.Atespace.metadata:type_name -> ateapi.ResourceMetadata + 8, // 20: ateapi.EgressPolicy.metadata:type_name -> ateapi.ResourceMetadata + 23, // 21: ateapi.EgressPolicy.actor:type_name -> ateapi.ObjectRef + 75, // 22: ateapi.EgressPolicy.allow_all:type_name -> google.protobuf.Empty + 16, // 23: ateapi.EgressPolicy.rules:type_name -> ateapi.EgressRule + 76, // 24: ateapi.EgressPolicy.extensions:type_name -> google.protobuf.Any + 17, // 25: ateapi.EgressRule.hostname:type_name -> ateapi.HostnameMatch + 18, // 26: ateapi.EgressRule.ip_blocks:type_name -> ateapi.IPBlockMatch + 19, // 27: ateapi.HostnameMatch.credential_injection:type_name -> ateapi.HeaderCredentialInjection + 20, // 28: ateapi.HeaderCredentialInjection.credential:type_name -> ateapi.CredentialReference + 8, // 29: ateapi.Credential.metadata:type_name -> ateapi.ResourceMetadata + 22, // 30: ateapi.Credential.kubernetes_secret:type_name -> ateapi.KubernetesSecretKeySelector + 23, // 31: ateapi.ActorSnapshotRef.snapshot:type_name -> ateapi.ObjectRef + 23, // 32: ateapi.ActorSnapshotRef.tag:type_name -> ateapi.ObjectRef + 14, // 33: ateapi.CreateAtespaceRequest.atespace:type_name -> ateapi.Atespace + 23, // 34: ateapi.GetAtespaceRequest.atespace:type_name -> ateapi.ObjectRef + 14, // 35: ateapi.ListAtespacesResponse.atespaces:type_name -> ateapi.Atespace + 23, // 36: ateapi.DeleteAtespaceRequest.atespace:type_name -> ateapi.ObjectRef + 23, // 37: ateapi.GetEgressPolicyRequest.egress_policy:type_name -> ateapi.ObjectRef + 15, // 38: ateapi.CreateEgressPolicyRequest.egress_policy:type_name -> ateapi.EgressPolicy + 15, // 39: ateapi.UpdateEgressPolicyRequest.egress_policy:type_name -> ateapi.EgressPolicy + 77, // 40: ateapi.UpdateEgressPolicyRequest.update_mask:type_name -> google.protobuf.FieldMask + 23, // 41: ateapi.DeleteEgressPolicyRequest.egress_policy:type_name -> ateapi.ObjectRef + 15, // 42: ateapi.ListEgressPoliciesResponse.egress_policies:type_name -> ateapi.EgressPolicy + 23, // 43: ateapi.GetCredentialRequest.credential:type_name -> ateapi.ObjectRef + 21, // 44: ateapi.CreateCredentialRequest.credential:type_name -> ateapi.Credential + 21, // 45: ateapi.UpdateCredentialRequest.credential:type_name -> ateapi.Credential + 77, // 46: ateapi.UpdateCredentialRequest.update_mask:type_name -> google.protobuf.FieldMask + 23, // 47: ateapi.DeleteCredentialRequest.credential:type_name -> ateapi.ObjectRef + 21, // 48: ateapi.ListCredentialsResponse.credentials:type_name -> ateapi.Credential + 23, // 49: ateapi.GetActorRequest.actor:type_name -> ateapi.ObjectRef + 10, // 50: ateapi.CreateActorRequest.actor:type_name -> ateapi.Actor + 24, // 51: ateapi.CreateActorRequest.source_snapshot:type_name -> ateapi.ActorSnapshotRef + 10, // 52: ateapi.UpdateActorRequest.actor:type_name -> ateapi.Actor + 77, // 53: ateapi.UpdateActorRequest.update_mask:type_name -> google.protobuf.FieldMask + 23, // 54: ateapi.SuspendActorRequest.actor:type_name -> ateapi.ObjectRef + 10, // 55: ateapi.SuspendActorResponse.actor:type_name -> ateapi.Actor + 23, // 56: ateapi.PauseActorRequest.actor:type_name -> ateapi.ObjectRef + 10, // 57: ateapi.PauseActorResponse.actor:type_name -> ateapi.Actor + 23, // 58: ateapi.ResumeActorRequest.actor:type_name -> ateapi.ObjectRef + 10, // 59: ateapi.ResumeActorResponse.actor:type_name -> ateapi.Actor + 23, // 60: ateapi.DeleteActorRequest.actor:type_name -> ateapi.ObjectRef + 24, // 61: ateapi.GetActorSnapshotRequest.snapshot:type_name -> ateapi.ActorSnapshotRef + 12, // 62: ateapi.ListActorSnapshotsResponse.snapshots:type_name -> ateapi.ActorSnapshot + 24, // 63: ateapi.TagActorSnapshotRequest.snapshot:type_name -> ateapi.ActorSnapshotRef + 13, // 64: ateapi.TagActorSnapshotRequest.tag:type_name -> ateapi.ActorSnapshotTag + 13, // 65: ateapi.UpdateActorSnapshotTagRequest.tag:type_name -> ateapi.ActorSnapshotTag + 77, // 66: ateapi.UpdateActorSnapshotTagRequest.update_mask:type_name -> google.protobuf.FieldMask + 23, // 67: ateapi.DeleteActorSnapshotTagRequest.tag:type_name -> ateapi.ObjectRef + 62, // 68: ateapi.ListWorkersResponse.workers:type_name -> ateapi.Worker + 10, // 69: ateapi.ListActorsResponse.actors:type_name -> ateapi.Actor + 63, // 70: ateapi.Worker.assignment:type_name -> ateapi.Assignment + 73, // 71: ateapi.Worker.labels:type_name -> ateapi.Worker.LabelsEntry + 5, // 72: ateapi.Worker.state:type_name -> ateapi.Worker.State + 64, // 73: ateapi.Assignment.actor_template:type_name -> ateapi.KubeNamespacedObjectRef + 23, // 74: ateapi.Assignment.actor:type_name -> ateapi.ObjectRef + 2, // 75: ateapi.MintCertRequest.purpose:type_name -> ateapi.ActorCertificatePurpose + 42, // 76: ateapi.Control.GetActor:input_type -> ateapi.GetActorRequest + 43, // 77: ateapi.Control.CreateActor:input_type -> ateapi.CreateActorRequest + 44, // 78: ateapi.Control.UpdateActor:input_type -> ateapi.UpdateActorRequest + 45, // 79: ateapi.Control.SuspendActor:input_type -> ateapi.SuspendActorRequest + 47, // 80: ateapi.Control.PauseActor:input_type -> ateapi.PauseActorRequest + 49, // 81: ateapi.Control.ResumeActor:input_type -> ateapi.ResumeActorRequest + 51, // 82: ateapi.Control.DeleteActor:input_type -> ateapi.DeleteActorRequest + 52, // 83: ateapi.Control.GetActorSnapshot:input_type -> ateapi.GetActorSnapshotRequest + 53, // 84: ateapi.Control.ListActorSnapshots:input_type -> ateapi.ListActorSnapshotsRequest + 55, // 85: ateapi.Control.TagActorSnapshot:input_type -> ateapi.TagActorSnapshotRequest + 56, // 86: ateapi.Control.UpdateActorSnapshotTag:input_type -> ateapi.UpdateActorSnapshotTagRequest + 57, // 87: ateapi.Control.DeleteActorSnapshotTag:input_type -> ateapi.DeleteActorSnapshotTagRequest + 58, // 88: ateapi.Control.ListWorkers:input_type -> ateapi.ListWorkersRequest + 60, // 89: ateapi.Control.ListActors:input_type -> ateapi.ListActorsRequest + 25, // 90: ateapi.Control.CreateAtespace:input_type -> ateapi.CreateAtespaceRequest + 26, // 91: ateapi.Control.GetAtespace:input_type -> ateapi.GetAtespaceRequest + 27, // 92: ateapi.Control.ListAtespaces:input_type -> ateapi.ListAtespacesRequest + 29, // 93: ateapi.Control.DeleteAtespace:input_type -> ateapi.DeleteAtespaceRequest + 30, // 94: ateapi.Control.GetEgressPolicy:input_type -> ateapi.GetEgressPolicyRequest + 31, // 95: ateapi.Control.CreateEgressPolicy:input_type -> ateapi.CreateEgressPolicyRequest + 32, // 96: ateapi.Control.UpdateEgressPolicy:input_type -> ateapi.UpdateEgressPolicyRequest + 33, // 97: ateapi.Control.DeleteEgressPolicy:input_type -> ateapi.DeleteEgressPolicyRequest + 34, // 98: ateapi.Control.ListEgressPolicies:input_type -> ateapi.ListEgressPoliciesRequest + 36, // 99: ateapi.Control.GetCredential:input_type -> ateapi.GetCredentialRequest + 37, // 100: ateapi.Control.CreateCredential:input_type -> ateapi.CreateCredentialRequest + 38, // 101: ateapi.Control.UpdateCredential:input_type -> ateapi.UpdateCredentialRequest + 39, // 102: ateapi.Control.DeleteCredential:input_type -> ateapi.DeleteCredentialRequest + 40, // 103: ateapi.Control.ListCredentials:input_type -> ateapi.ListCredentialsRequest + 65, // 104: ateapi.Debug.DebugClear:input_type -> ateapi.DebugClearRequest + 67, // 105: ateapi.ActorIdentity.MintJWT:input_type -> ateapi.MintJWTRequest + 69, // 106: ateapi.ActorIdentity.MintCert:input_type -> ateapi.MintCertRequest + 10, // 107: ateapi.Control.GetActor:output_type -> ateapi.Actor + 10, // 108: ateapi.Control.CreateActor:output_type -> ateapi.Actor + 10, // 109: ateapi.Control.UpdateActor:output_type -> ateapi.Actor + 46, // 110: ateapi.Control.SuspendActor:output_type -> ateapi.SuspendActorResponse + 48, // 111: ateapi.Control.PauseActor:output_type -> ateapi.PauseActorResponse + 50, // 112: ateapi.Control.ResumeActor:output_type -> ateapi.ResumeActorResponse + 10, // 113: ateapi.Control.DeleteActor:output_type -> ateapi.Actor + 12, // 114: ateapi.Control.GetActorSnapshot:output_type -> ateapi.ActorSnapshot + 54, // 115: ateapi.Control.ListActorSnapshots:output_type -> ateapi.ListActorSnapshotsResponse + 13, // 116: ateapi.Control.TagActorSnapshot:output_type -> ateapi.ActorSnapshotTag + 13, // 117: ateapi.Control.UpdateActorSnapshotTag:output_type -> ateapi.ActorSnapshotTag + 13, // 118: ateapi.Control.DeleteActorSnapshotTag:output_type -> ateapi.ActorSnapshotTag + 59, // 119: ateapi.Control.ListWorkers:output_type -> ateapi.ListWorkersResponse + 61, // 120: ateapi.Control.ListActors:output_type -> ateapi.ListActorsResponse + 14, // 121: ateapi.Control.CreateAtespace:output_type -> ateapi.Atespace + 14, // 122: ateapi.Control.GetAtespace:output_type -> ateapi.Atespace + 28, // 123: ateapi.Control.ListAtespaces:output_type -> ateapi.ListAtespacesResponse + 14, // 124: ateapi.Control.DeleteAtespace:output_type -> ateapi.Atespace + 15, // 125: ateapi.Control.GetEgressPolicy:output_type -> ateapi.EgressPolicy + 15, // 126: ateapi.Control.CreateEgressPolicy:output_type -> ateapi.EgressPolicy + 15, // 127: ateapi.Control.UpdateEgressPolicy:output_type -> ateapi.EgressPolicy + 15, // 128: ateapi.Control.DeleteEgressPolicy:output_type -> ateapi.EgressPolicy + 35, // 129: ateapi.Control.ListEgressPolicies:output_type -> ateapi.ListEgressPoliciesResponse + 21, // 130: ateapi.Control.GetCredential:output_type -> ateapi.Credential + 21, // 131: ateapi.Control.CreateCredential:output_type -> ateapi.Credential + 21, // 132: ateapi.Control.UpdateCredential:output_type -> ateapi.Credential + 21, // 133: ateapi.Control.DeleteCredential:output_type -> ateapi.Credential + 41, // 134: ateapi.Control.ListCredentials:output_type -> ateapi.ListCredentialsResponse + 66, // 135: ateapi.Debug.DebugClear:output_type -> ateapi.DebugClearResponse + 68, // 136: ateapi.ActorIdentity.MintJWT:output_type -> ateapi.MintJWTResponse + 70, // 137: ateapi.ActorIdentity.MintCert:output_type -> ateapi.MintCertResponse + 107, // [107:138] is the sub-list for method output_type + 76, // [76:107] is the sub-list for method input_type + 76, // [76:76] is the sub-list for extension type_name + 76, // [76:76] is the sub-list for extension extendee + 0, // [0:76] is the sub-list for field type_name } func init() { file_ateapi_proto_init() } @@ -3525,7 +4786,17 @@ func file_ateapi_proto_init() { if File_ateapi_proto != nil { return } + file_ateapi_proto_msgTypes[9].OneofWrappers = []any{ + (*EgressPolicy_Actor)(nil), + } file_ateapi_proto_msgTypes[10].OneofWrappers = []any{ + (*EgressRule_Hostname)(nil), + (*EgressRule_IpBlocks)(nil), + } + file_ateapi_proto_msgTypes[15].OneofWrappers = []any{ + (*Credential_KubernetesSecret)(nil), + } + file_ateapi_proto_msgTypes[18].OneofWrappers = []any{ (*ActorSnapshotRef_Snapshot)(nil), (*ActorSnapshotRef_Tag)(nil), } @@ -3535,7 +4806,7 @@ func file_ateapi_proto_init() { GoPackagePath: reflect.TypeOf(x{}).PkgPath(), RawDescriptor: unsafe.Slice(unsafe.StringData(file_ateapi_proto_rawDesc), len(file_ateapi_proto_rawDesc)), NumEnums: 6, - NumMessages: 48, + NumMessages: 68, NumExtensions: 0, NumServices: 3, }, diff --git a/pkg/proto/ateapipb/ateapi.proto b/pkg/proto/ateapipb/ateapi.proto index 1ee06ddea..b727ae2a2 100644 --- a/pkg/proto/ateapipb/ateapi.proto +++ b/pkg/proto/ateapipb/ateapi.proto @@ -17,6 +17,8 @@ syntax = "proto3"; package ateapi; import "google/protobuf/field_mask.proto"; +import "google/protobuf/any.proto"; +import "google/protobuf/empty.proto"; import "google/protobuf/timestamp.proto"; option go_package = "github.com/agent-substrate/substrate/pkg/proto/ateapipb"; @@ -80,6 +82,18 @@ service Control { // Delete an empty Atespace. Rejects (FailedPrecondition) if any Actors or // ActorSnapshotTags remain. rpc DeleteAtespace(DeleteAtespaceRequest) returns (Atespace) {} + + rpc GetEgressPolicy(GetEgressPolicyRequest) returns (EgressPolicy) {} + rpc CreateEgressPolicy(CreateEgressPolicyRequest) returns (EgressPolicy) {} + rpc UpdateEgressPolicy(UpdateEgressPolicyRequest) returns (EgressPolicy) {} + rpc DeleteEgressPolicy(DeleteEgressPolicyRequest) returns (EgressPolicy) {} + rpc ListEgressPolicies(ListEgressPoliciesRequest) returns (ListEgressPoliciesResponse) {} + + rpc GetCredential(GetCredentialRequest) returns (Credential) {} + rpc CreateCredential(CreateCredentialRequest) returns (Credential) {} + rpc UpdateCredential(UpdateCredentialRequest) returns (Credential) {} + rpc DeleteCredential(DeleteCredentialRequest) returns (Credential) {} + rpc ListCredentials(ListCredentialsRequest) returns (ListCredentialsResponse) {} } message LocalSnapshotInfo { @@ -260,6 +274,62 @@ message Atespace { ResourceMetadata metadata = 1; } +// EgressPolicy is Atespace-scoped and grants one Actor in the same Atespace +// access to destinations. A matching rule authorizes its destination. The +// optional allow_all baseline authorizes every destination but does not stop +// matching rules from applying their effects. With neither, traffic is denied. +message EgressPolicy { + ResourceMetadata metadata = 1; + oneof target { + ObjectRef actor = 2; + } + google.protobuf.Empty allow_all = 3; + repeated EgressRule rules = 4; + // Every extension is required. An enforcement point that does not + // understand one must fail closed. + repeated google.protobuf.Any extensions = 5; +} + +message EgressRule { + oneof match { + HostnameMatch hostname = 1; + IPBlockMatch ip_blocks = 2; + } +} + +message HostnameMatch { + string pattern = 1; + // Credential injection requires an exact hostname match. + HeaderCredentialInjection credential_injection = 2; +} + +message IPBlockMatch { + repeated string cidrs = 1; +} + +message HeaderCredentialInjection { + string header = 1; + CredentialReference credential = 2; +} + +message CredentialReference { + // Resolves in the policy's Atespace. + string name = 1; +} + +message Credential { + ResourceMetadata metadata = 1; + oneof source { + KubernetesSecretKeySelector kubernetes_secret = 2; + } +} + +message KubernetesSecretKeySelector { + string namespace = 1; + string name = 2; + string key = 3; +} + // ObjectRef references a Substrate resource by its (atespace, name) identity. message ObjectRef { // The atespace where the resource lives. Empty if the resource is global-scoped. @@ -310,6 +380,40 @@ message DeleteAtespaceRequest { ObjectRef atespace = 1; } +message GetEgressPolicyRequest { ObjectRef egress_policy = 1; } +message CreateEgressPolicyRequest { EgressPolicy egress_policy = 1; } +message UpdateEgressPolicyRequest { + EgressPolicy egress_policy = 1; + google.protobuf.FieldMask update_mask = 2; +} +message DeleteEgressPolicyRequest { ObjectRef egress_policy = 1; } +message ListEgressPoliciesRequest { + string atespace = 1; + int32 page_size = 2; + string page_token = 3; +} +message ListEgressPoliciesResponse { + repeated EgressPolicy egress_policies = 1; + string next_page_token = 2; +} + +message GetCredentialRequest { ObjectRef credential = 1; } +message CreateCredentialRequest { Credential credential = 1; } +message UpdateCredentialRequest { + Credential credential = 1; + google.protobuf.FieldMask update_mask = 2; +} +message DeleteCredentialRequest { ObjectRef credential = 1; } +message ListCredentialsRequest { + string atespace = 1; + int32 page_size = 2; + string page_token = 3; +} +message ListCredentialsResponse { + repeated Credential credentials = 1; + string next_page_token = 2; +} + message GetActorRequest { ObjectRef actor = 1; } diff --git a/pkg/proto/ateapipb/ateapi_grpc.pb.go b/pkg/proto/ateapipb/ateapi_grpc.pb.go index ba01c0194..afeff9457 100644 --- a/pkg/proto/ateapipb/ateapi_grpc.pb.go +++ b/pkg/proto/ateapipb/ateapi_grpc.pb.go @@ -51,6 +51,16 @@ const ( Control_GetAtespace_FullMethodName = "/ateapi.Control/GetAtespace" Control_ListAtespaces_FullMethodName = "/ateapi.Control/ListAtespaces" Control_DeleteAtespace_FullMethodName = "/ateapi.Control/DeleteAtespace" + Control_GetEgressPolicy_FullMethodName = "/ateapi.Control/GetEgressPolicy" + Control_CreateEgressPolicy_FullMethodName = "/ateapi.Control/CreateEgressPolicy" + Control_UpdateEgressPolicy_FullMethodName = "/ateapi.Control/UpdateEgressPolicy" + Control_DeleteEgressPolicy_FullMethodName = "/ateapi.Control/DeleteEgressPolicy" + Control_ListEgressPolicies_FullMethodName = "/ateapi.Control/ListEgressPolicies" + Control_GetCredential_FullMethodName = "/ateapi.Control/GetCredential" + Control_CreateCredential_FullMethodName = "/ateapi.Control/CreateCredential" + Control_UpdateCredential_FullMethodName = "/ateapi.Control/UpdateCredential" + Control_DeleteCredential_FullMethodName = "/ateapi.Control/DeleteCredential" + Control_ListCredentials_FullMethodName = "/ateapi.Control/ListCredentials" ) // ControlClient is the client API for Control service. @@ -99,6 +109,16 @@ type ControlClient interface { // Delete an empty Atespace. Rejects (FailedPrecondition) if any Actors or // ActorSnapshotTags remain. DeleteAtespace(ctx context.Context, in *DeleteAtespaceRequest, opts ...grpc.CallOption) (*Atespace, error) + GetEgressPolicy(ctx context.Context, in *GetEgressPolicyRequest, opts ...grpc.CallOption) (*EgressPolicy, error) + CreateEgressPolicy(ctx context.Context, in *CreateEgressPolicyRequest, opts ...grpc.CallOption) (*EgressPolicy, error) + UpdateEgressPolicy(ctx context.Context, in *UpdateEgressPolicyRequest, opts ...grpc.CallOption) (*EgressPolicy, error) + DeleteEgressPolicy(ctx context.Context, in *DeleteEgressPolicyRequest, opts ...grpc.CallOption) (*EgressPolicy, error) + ListEgressPolicies(ctx context.Context, in *ListEgressPoliciesRequest, opts ...grpc.CallOption) (*ListEgressPoliciesResponse, error) + GetCredential(ctx context.Context, in *GetCredentialRequest, opts ...grpc.CallOption) (*Credential, error) + CreateCredential(ctx context.Context, in *CreateCredentialRequest, opts ...grpc.CallOption) (*Credential, error) + UpdateCredential(ctx context.Context, in *UpdateCredentialRequest, opts ...grpc.CallOption) (*Credential, error) + DeleteCredential(ctx context.Context, in *DeleteCredentialRequest, opts ...grpc.CallOption) (*Credential, error) + ListCredentials(ctx context.Context, in *ListCredentialsRequest, opts ...grpc.CallOption) (*ListCredentialsResponse, error) } type controlClient struct { @@ -289,6 +309,106 @@ func (c *controlClient) DeleteAtespace(ctx context.Context, in *DeleteAtespaceRe return out, nil } +func (c *controlClient) GetEgressPolicy(ctx context.Context, in *GetEgressPolicyRequest, opts ...grpc.CallOption) (*EgressPolicy, error) { + cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) + out := new(EgressPolicy) + err := c.cc.Invoke(ctx, Control_GetEgressPolicy_FullMethodName, in, out, cOpts...) + if err != nil { + return nil, err + } + return out, nil +} + +func (c *controlClient) CreateEgressPolicy(ctx context.Context, in *CreateEgressPolicyRequest, opts ...grpc.CallOption) (*EgressPolicy, error) { + cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) + out := new(EgressPolicy) + err := c.cc.Invoke(ctx, Control_CreateEgressPolicy_FullMethodName, in, out, cOpts...) + if err != nil { + return nil, err + } + return out, nil +} + +func (c *controlClient) UpdateEgressPolicy(ctx context.Context, in *UpdateEgressPolicyRequest, opts ...grpc.CallOption) (*EgressPolicy, error) { + cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) + out := new(EgressPolicy) + err := c.cc.Invoke(ctx, Control_UpdateEgressPolicy_FullMethodName, in, out, cOpts...) + if err != nil { + return nil, err + } + return out, nil +} + +func (c *controlClient) DeleteEgressPolicy(ctx context.Context, in *DeleteEgressPolicyRequest, opts ...grpc.CallOption) (*EgressPolicy, error) { + cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) + out := new(EgressPolicy) + err := c.cc.Invoke(ctx, Control_DeleteEgressPolicy_FullMethodName, in, out, cOpts...) + if err != nil { + return nil, err + } + return out, nil +} + +func (c *controlClient) ListEgressPolicies(ctx context.Context, in *ListEgressPoliciesRequest, opts ...grpc.CallOption) (*ListEgressPoliciesResponse, error) { + cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) + out := new(ListEgressPoliciesResponse) + err := c.cc.Invoke(ctx, Control_ListEgressPolicies_FullMethodName, in, out, cOpts...) + if err != nil { + return nil, err + } + return out, nil +} + +func (c *controlClient) GetCredential(ctx context.Context, in *GetCredentialRequest, opts ...grpc.CallOption) (*Credential, error) { + cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) + out := new(Credential) + err := c.cc.Invoke(ctx, Control_GetCredential_FullMethodName, in, out, cOpts...) + if err != nil { + return nil, err + } + return out, nil +} + +func (c *controlClient) CreateCredential(ctx context.Context, in *CreateCredentialRequest, opts ...grpc.CallOption) (*Credential, error) { + cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) + out := new(Credential) + err := c.cc.Invoke(ctx, Control_CreateCredential_FullMethodName, in, out, cOpts...) + if err != nil { + return nil, err + } + return out, nil +} + +func (c *controlClient) UpdateCredential(ctx context.Context, in *UpdateCredentialRequest, opts ...grpc.CallOption) (*Credential, error) { + cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) + out := new(Credential) + err := c.cc.Invoke(ctx, Control_UpdateCredential_FullMethodName, in, out, cOpts...) + if err != nil { + return nil, err + } + return out, nil +} + +func (c *controlClient) DeleteCredential(ctx context.Context, in *DeleteCredentialRequest, opts ...grpc.CallOption) (*Credential, error) { + cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) + out := new(Credential) + err := c.cc.Invoke(ctx, Control_DeleteCredential_FullMethodName, in, out, cOpts...) + if err != nil { + return nil, err + } + return out, nil +} + +func (c *controlClient) ListCredentials(ctx context.Context, in *ListCredentialsRequest, opts ...grpc.CallOption) (*ListCredentialsResponse, error) { + cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) + out := new(ListCredentialsResponse) + err := c.cc.Invoke(ctx, Control_ListCredentials_FullMethodName, in, out, cOpts...) + if err != nil { + return nil, err + } + return out, nil +} + // ControlServer is the server API for Control service. // All implementations must embed UnimplementedControlServer // for forward compatibility. @@ -335,6 +455,16 @@ type ControlServer interface { // Delete an empty Atespace. Rejects (FailedPrecondition) if any Actors or // ActorSnapshotTags remain. DeleteAtespace(context.Context, *DeleteAtespaceRequest) (*Atespace, error) + GetEgressPolicy(context.Context, *GetEgressPolicyRequest) (*EgressPolicy, error) + CreateEgressPolicy(context.Context, *CreateEgressPolicyRequest) (*EgressPolicy, error) + UpdateEgressPolicy(context.Context, *UpdateEgressPolicyRequest) (*EgressPolicy, error) + DeleteEgressPolicy(context.Context, *DeleteEgressPolicyRequest) (*EgressPolicy, error) + ListEgressPolicies(context.Context, *ListEgressPoliciesRequest) (*ListEgressPoliciesResponse, error) + GetCredential(context.Context, *GetCredentialRequest) (*Credential, error) + CreateCredential(context.Context, *CreateCredentialRequest) (*Credential, error) + UpdateCredential(context.Context, *UpdateCredentialRequest) (*Credential, error) + DeleteCredential(context.Context, *DeleteCredentialRequest) (*Credential, error) + ListCredentials(context.Context, *ListCredentialsRequest) (*ListCredentialsResponse, error) mustEmbedUnimplementedControlServer() } @@ -399,6 +529,36 @@ func (UnimplementedControlServer) ListAtespaces(context.Context, *ListAtespacesR func (UnimplementedControlServer) DeleteAtespace(context.Context, *DeleteAtespaceRequest) (*Atespace, error) { return nil, status.Error(codes.Unimplemented, "method DeleteAtespace not implemented") } +func (UnimplementedControlServer) GetEgressPolicy(context.Context, *GetEgressPolicyRequest) (*EgressPolicy, error) { + return nil, status.Error(codes.Unimplemented, "method GetEgressPolicy not implemented") +} +func (UnimplementedControlServer) CreateEgressPolicy(context.Context, *CreateEgressPolicyRequest) (*EgressPolicy, error) { + return nil, status.Error(codes.Unimplemented, "method CreateEgressPolicy not implemented") +} +func (UnimplementedControlServer) UpdateEgressPolicy(context.Context, *UpdateEgressPolicyRequest) (*EgressPolicy, error) { + return nil, status.Error(codes.Unimplemented, "method UpdateEgressPolicy not implemented") +} +func (UnimplementedControlServer) DeleteEgressPolicy(context.Context, *DeleteEgressPolicyRequest) (*EgressPolicy, error) { + return nil, status.Error(codes.Unimplemented, "method DeleteEgressPolicy not implemented") +} +func (UnimplementedControlServer) ListEgressPolicies(context.Context, *ListEgressPoliciesRequest) (*ListEgressPoliciesResponse, error) { + return nil, status.Error(codes.Unimplemented, "method ListEgressPolicies not implemented") +} +func (UnimplementedControlServer) GetCredential(context.Context, *GetCredentialRequest) (*Credential, error) { + return nil, status.Error(codes.Unimplemented, "method GetCredential not implemented") +} +func (UnimplementedControlServer) CreateCredential(context.Context, *CreateCredentialRequest) (*Credential, error) { + return nil, status.Error(codes.Unimplemented, "method CreateCredential not implemented") +} +func (UnimplementedControlServer) UpdateCredential(context.Context, *UpdateCredentialRequest) (*Credential, error) { + return nil, status.Error(codes.Unimplemented, "method UpdateCredential not implemented") +} +func (UnimplementedControlServer) DeleteCredential(context.Context, *DeleteCredentialRequest) (*Credential, error) { + return nil, status.Error(codes.Unimplemented, "method DeleteCredential not implemented") +} +func (UnimplementedControlServer) ListCredentials(context.Context, *ListCredentialsRequest) (*ListCredentialsResponse, error) { + return nil, status.Error(codes.Unimplemented, "method ListCredentials not implemented") +} func (UnimplementedControlServer) mustEmbedUnimplementedControlServer() {} func (UnimplementedControlServer) testEmbeddedByValue() {} @@ -744,6 +904,186 @@ func _Control_DeleteAtespace_Handler(srv interface{}, ctx context.Context, dec f return interceptor(ctx, in, info, handler) } +func _Control_GetEgressPolicy_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { + in := new(GetEgressPolicyRequest) + if err := dec(in); err != nil { + return nil, err + } + if interceptor == nil { + return srv.(ControlServer).GetEgressPolicy(ctx, in) + } + info := &grpc.UnaryServerInfo{ + Server: srv, + FullMethod: Control_GetEgressPolicy_FullMethodName, + } + handler := func(ctx context.Context, req interface{}) (interface{}, error) { + return srv.(ControlServer).GetEgressPolicy(ctx, req.(*GetEgressPolicyRequest)) + } + return interceptor(ctx, in, info, handler) +} + +func _Control_CreateEgressPolicy_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { + in := new(CreateEgressPolicyRequest) + if err := dec(in); err != nil { + return nil, err + } + if interceptor == nil { + return srv.(ControlServer).CreateEgressPolicy(ctx, in) + } + info := &grpc.UnaryServerInfo{ + Server: srv, + FullMethod: Control_CreateEgressPolicy_FullMethodName, + } + handler := func(ctx context.Context, req interface{}) (interface{}, error) { + return srv.(ControlServer).CreateEgressPolicy(ctx, req.(*CreateEgressPolicyRequest)) + } + return interceptor(ctx, in, info, handler) +} + +func _Control_UpdateEgressPolicy_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { + in := new(UpdateEgressPolicyRequest) + if err := dec(in); err != nil { + return nil, err + } + if interceptor == nil { + return srv.(ControlServer).UpdateEgressPolicy(ctx, in) + } + info := &grpc.UnaryServerInfo{ + Server: srv, + FullMethod: Control_UpdateEgressPolicy_FullMethodName, + } + handler := func(ctx context.Context, req interface{}) (interface{}, error) { + return srv.(ControlServer).UpdateEgressPolicy(ctx, req.(*UpdateEgressPolicyRequest)) + } + return interceptor(ctx, in, info, handler) +} + +func _Control_DeleteEgressPolicy_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { + in := new(DeleteEgressPolicyRequest) + if err := dec(in); err != nil { + return nil, err + } + if interceptor == nil { + return srv.(ControlServer).DeleteEgressPolicy(ctx, in) + } + info := &grpc.UnaryServerInfo{ + Server: srv, + FullMethod: Control_DeleteEgressPolicy_FullMethodName, + } + handler := func(ctx context.Context, req interface{}) (interface{}, error) { + return srv.(ControlServer).DeleteEgressPolicy(ctx, req.(*DeleteEgressPolicyRequest)) + } + return interceptor(ctx, in, info, handler) +} + +func _Control_ListEgressPolicies_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { + in := new(ListEgressPoliciesRequest) + if err := dec(in); err != nil { + return nil, err + } + if interceptor == nil { + return srv.(ControlServer).ListEgressPolicies(ctx, in) + } + info := &grpc.UnaryServerInfo{ + Server: srv, + FullMethod: Control_ListEgressPolicies_FullMethodName, + } + handler := func(ctx context.Context, req interface{}) (interface{}, error) { + return srv.(ControlServer).ListEgressPolicies(ctx, req.(*ListEgressPoliciesRequest)) + } + return interceptor(ctx, in, info, handler) +} + +func _Control_GetCredential_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { + in := new(GetCredentialRequest) + if err := dec(in); err != nil { + return nil, err + } + if interceptor == nil { + return srv.(ControlServer).GetCredential(ctx, in) + } + info := &grpc.UnaryServerInfo{ + Server: srv, + FullMethod: Control_GetCredential_FullMethodName, + } + handler := func(ctx context.Context, req interface{}) (interface{}, error) { + return srv.(ControlServer).GetCredential(ctx, req.(*GetCredentialRequest)) + } + return interceptor(ctx, in, info, handler) +} + +func _Control_CreateCredential_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { + in := new(CreateCredentialRequest) + if err := dec(in); err != nil { + return nil, err + } + if interceptor == nil { + return srv.(ControlServer).CreateCredential(ctx, in) + } + info := &grpc.UnaryServerInfo{ + Server: srv, + FullMethod: Control_CreateCredential_FullMethodName, + } + handler := func(ctx context.Context, req interface{}) (interface{}, error) { + return srv.(ControlServer).CreateCredential(ctx, req.(*CreateCredentialRequest)) + } + return interceptor(ctx, in, info, handler) +} + +func _Control_UpdateCredential_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { + in := new(UpdateCredentialRequest) + if err := dec(in); err != nil { + return nil, err + } + if interceptor == nil { + return srv.(ControlServer).UpdateCredential(ctx, in) + } + info := &grpc.UnaryServerInfo{ + Server: srv, + FullMethod: Control_UpdateCredential_FullMethodName, + } + handler := func(ctx context.Context, req interface{}) (interface{}, error) { + return srv.(ControlServer).UpdateCredential(ctx, req.(*UpdateCredentialRequest)) + } + return interceptor(ctx, in, info, handler) +} + +func _Control_DeleteCredential_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { + in := new(DeleteCredentialRequest) + if err := dec(in); err != nil { + return nil, err + } + if interceptor == nil { + return srv.(ControlServer).DeleteCredential(ctx, in) + } + info := &grpc.UnaryServerInfo{ + Server: srv, + FullMethod: Control_DeleteCredential_FullMethodName, + } + handler := func(ctx context.Context, req interface{}) (interface{}, error) { + return srv.(ControlServer).DeleteCredential(ctx, req.(*DeleteCredentialRequest)) + } + return interceptor(ctx, in, info, handler) +} + +func _Control_ListCredentials_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { + in := new(ListCredentialsRequest) + if err := dec(in); err != nil { + return nil, err + } + if interceptor == nil { + return srv.(ControlServer).ListCredentials(ctx, in) + } + info := &grpc.UnaryServerInfo{ + Server: srv, + FullMethod: Control_ListCredentials_FullMethodName, + } + handler := func(ctx context.Context, req interface{}) (interface{}, error) { + return srv.(ControlServer).ListCredentials(ctx, req.(*ListCredentialsRequest)) + } + return interceptor(ctx, in, info, handler) +} + // Control_ServiceDesc is the grpc.ServiceDesc for Control service. // It's only intended for direct use with grpc.RegisterService, // and not to be introspected or modified (even as a copy) @@ -823,6 +1163,46 @@ var Control_ServiceDesc = grpc.ServiceDesc{ MethodName: "DeleteAtespace", Handler: _Control_DeleteAtespace_Handler, }, + { + MethodName: "GetEgressPolicy", + Handler: _Control_GetEgressPolicy_Handler, + }, + { + MethodName: "CreateEgressPolicy", + Handler: _Control_CreateEgressPolicy_Handler, + }, + { + MethodName: "UpdateEgressPolicy", + Handler: _Control_UpdateEgressPolicy_Handler, + }, + { + MethodName: "DeleteEgressPolicy", + Handler: _Control_DeleteEgressPolicy_Handler, + }, + { + MethodName: "ListEgressPolicies", + Handler: _Control_ListEgressPolicies_Handler, + }, + { + MethodName: "GetCredential", + Handler: _Control_GetCredential_Handler, + }, + { + MethodName: "CreateCredential", + Handler: _Control_CreateCredential_Handler, + }, + { + MethodName: "UpdateCredential", + Handler: _Control_UpdateCredential_Handler, + }, + { + MethodName: "DeleteCredential", + Handler: _Control_DeleteCredential_Handler, + }, + { + MethodName: "ListCredentials", + Handler: _Control_ListCredentials_Handler, + }, }, Streams: []grpc.StreamDesc{}, Metadata: "ateapi.proto",