From 43043af8a336916a265a8ecb4f32548331aeedc0 Mon Sep 17 00:00:00 2001 From: Eitan Yarmush Date: Tue, 11 Aug 2026 14:14:38 +0000 Subject: [PATCH 1/9] feat(ateapi): add actor egress policy API Signed-off-by: Eitan Yarmush --- .../internal/controlapi/egress_policy.go | 339 +++ .../internal/controlapi/egress_policy_test.go | 222 ++ cmd/ateapi/internal/controlapi/service.go | 7 + cmd/ateapi/internal/store/atepg/atepg.go | 2 +- .../internal/store/atepg/egress_policy.go | 141 ++ cmd/ateapi/internal/store/atepg/schema.go | 10 + .../internal/store/ateredis/ateredis.go | 2 +- .../internal/store/ateredis/egress_policy.go | 216 ++ cmd/ateapi/internal/store/store.go | 12 + .../internal/store/storecontract/contract.go | 105 + cmd/ateapi/main.go | 2 + internal/proto/ateompb/ateom_grpc.pb.go | 8 +- .../proto/egresspolicypb/egress_policy.pb.go | 201 ++ .../proto/egresspolicypb/egress_policy.proto | 35 + .../egresspolicypb/egress_policy_grpc.pb.go | 139 ++ internal/proto/egresspolicypb/gen.go | 17 + pkg/proto/ateapipb/ateapi.pb.go | 1998 ++++++++++++----- pkg/proto/ateapipb/ateapi.proto | 130 ++ pkg/proto/ateapipb/ateapi_grpc.pb.go | 178 +- 19 files changed, 3155 insertions(+), 609 deletions(-) create mode 100644 cmd/ateapi/internal/controlapi/egress_policy.go create mode 100644 cmd/ateapi/internal/controlapi/egress_policy_test.go create mode 100644 cmd/ateapi/internal/store/atepg/egress_policy.go create mode 100644 cmd/ateapi/internal/store/ateredis/egress_policy.go create mode 100644 internal/proto/egresspolicypb/egress_policy.pb.go create mode 100644 internal/proto/egresspolicypb/egress_policy.proto create mode 100644 internal/proto/egresspolicypb/egress_policy_grpc.pb.go create mode 100644 internal/proto/egresspolicypb/gen.go diff --git a/cmd/ateapi/internal/controlapi/egress_policy.go b/cmd/ateapi/internal/controlapi/egress_policy.go new file mode 100644 index 0000000000..e9cf3ab4ca --- /dev/null +++ b/cmd/ateapi/internal/controlapi/egress_policy.go @@ -0,0 +1,339 @@ +// Copyright 2026 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package controlapi + +import ( + "context" + "errors" + "fmt" + "net/netip" + "net/url" + "strings" + + "github.com/agent-substrate/substrate/cmd/ateapi/internal/store" + "github.com/agent-substrate/substrate/internal/principal" + "github.com/agent-substrate/substrate/internal/proto/egresspolicypb" + "github.com/agent-substrate/substrate/internal/resources" + "github.com/agent-substrate/substrate/pkg/proto/ateapipb" + "google.golang.org/grpc/codes" + "google.golang.org/grpc/status" + "google.golang.org/protobuf/proto" + "k8s.io/apimachinery/pkg/util/validation" + "k8s.io/apimachinery/pkg/util/validation/field" +) + +// TODO: Make the gateway namespace and service account configurable when the +// egress gateway deployment supports that configuration. +const egressGatewayPrincipal = "spiffe://cluster.local/ns/ate-system/sa/atenet-egress" + +func (s *Service) GetActorEgressPolicy(ctx context.Context, req *ateapipb.GetActorEgressPolicyRequest) (*ateapipb.GetActorEgressPolicyResponse, error) { + if errs := validateActorRef(req.GetActor(), field.NewPath("actor")); len(errs) > 0 { + return nil, toGRPCStatusError(errs) + } + policy, err := s.persistence.GetEgressPolicy(ctx, resources.ActorRefFromObjectRef(req.GetActor())) + if errors.Is(err, store.ErrNotFound) { + if _, actorErr := s.persistence.GetActor(ctx, resources.ActorRefFromObjectRef(req.GetActor())); errors.Is(actorErr, store.ErrNotFound) { + return nil, status.Error(codes.NotFound, "Actor not found") + } else if actorErr != nil { + return nil, fmt.Errorf("while getting parent Actor: %w", actorErr) + } + return &ateapipb.GetActorEgressPolicyResponse{}, nil + } + if err != nil { + return nil, fmt.Errorf("while getting Actor egress policy: %w", err) + } + return &ateapipb.GetActorEgressPolicyResponse{EgressPolicies: []*ateapipb.EgressPolicy{policy}}, nil +} + +func (s *Service) SetActorEgressPolicy(ctx context.Context, req *ateapipb.SetActorEgressPolicyRequest) (*ateapipb.EgressPolicy, error) { + var errs field.ErrorList + errs = append(errs, validateActorRef(req.GetActor(), field.NewPath("actor"))...) + policy := req.GetEgressPolicy() + errs = append(errs, validateEgressPolicy(policy, policy.GetVersion() > 0)...) + if len(errs) > 0 { + return nil, toGRPCStatusError(errs) + } + actorRef := resources.ActorRefFromObjectRef(req.GetActor()) + in := normalizeEgressPolicy(policy) + if in.GetVersion() == 0 { + created, err := s.persistence.CreateEgressPolicy(ctx, actorRef, in) + return mapEgressPolicyWrite(created, err) + } + updated, err := s.persistence.UpdateEgressPolicy(ctx, actorRef, in.GetVersion(), func(toUpdate *ateapipb.EgressPolicy) error { + toUpdate.Rules = in.GetRules() + return nil + }) + return mapEgressPolicyWrite(updated, err) +} + +func (s *Service) DeleteActorEgressPolicy(ctx context.Context, req *ateapipb.DeleteActorEgressPolicyRequest) (*ateapipb.EgressPolicy, error) { + if errs := validateActorRef(req.GetActor(), field.NewPath("actor")); len(errs) > 0 { + return nil, toGRPCStatusError(errs) + } + policy, err := s.persistence.DeleteEgressPolicy(ctx, resources.ActorRefFromObjectRef(req.GetActor())) + return mapEgressPolicyWrite(policy, err) +} + +func (s *Service) GetEffectiveEgressPolicy(ctx context.Context, req *egresspolicypb.GetEffectiveEgressPolicyRequest) (*egresspolicypb.EffectiveEgressPolicy, error) { + info, ok := principal.FromContext(ctx) + if !ok || info.Kind != principal.KindMTLS || info.ID != egressGatewayPrincipal { + return nil, status.Error(codes.PermissionDenied, "caller is not the egress gateway") + } + var errs field.ErrorList + errs = append(errs, validateActorRef(req.GetActor(), field.NewPath("actor"))...) + if req.GetActorUid() == "" { + errs = append(errs, field.Required(field.NewPath("actor_uid"), "")) + } + if len(errs) > 0 { + return nil, toGRPCStatusError(errs) + } + actorRef := resources.ActorRefFromObjectRef(req.GetActor()) + actor, err := s.persistence.GetActor(ctx, actorRef) + if errors.Is(err, store.ErrNotFound) { + return nil, status.Error(codes.PermissionDenied, "actor is not authorized for egress") + } + if err != nil { + return nil, status.Errorf(codes.Unavailable, "resolving actor: %v", err) + } + if actor.GetMetadata().GetUid() != req.GetActorUid() || actor.GetStatus().GetState() != ateapipb.ActorState_ACTOR_STATE_RUNNING { + return nil, status.Error(codes.PermissionDenied, "actor is not authorized for egress") + } + policy, err := s.persistence.ResolveEgressPolicy(ctx, actorRef, req.GetActorUid()) + if errors.Is(err, store.ErrNotFound) { + return &egresspolicypb.EffectiveEgressPolicy{Policy: &ateapipb.EgressPolicy{}}, nil + } + if err != nil { + return nil, status.Errorf(codes.Unavailable, "resolving egress policy: %v", err) + } + return &egresspolicypb.EffectiveEgressPolicy{Policy: policy}, nil +} + +func validateActorRef(ref *ateapipb.ObjectRef, p *field.Path) field.ErrorList { + if ref == nil { + return field.ErrorList{field.Required(p, "")} + } + return resources.ValidateObjectRef(ref, p) +} + +func validateEgressPolicy(policy *ateapipb.EgressPolicy, requireVersion bool) field.ErrorList { + root := field.NewPath("egress_policy") + if policy == nil { + return field.ErrorList{field.Required(root, "")} + } + var errs field.ErrorList + if requireVersion && policy.GetVersion() <= 0 { + errs = append(errs, field.Required(root.Child("version"), "must be greater than zero")) + } + if !requireVersion && policy.GetVersion() != 0 { + errs = append(errs, field.Invalid(root.Child("version"), policy.GetVersion(), "must be zero when creating")) + } + seenHeaders := map[string]bool{} + for i, rule := range policy.GetRules() { + rulePath := root.Child("rules").Index(i) + if rule == nil { + errs = append(errs, field.Required(rulePath, "")) + continue + } + if len(rule.GetAllow()) == 0 { + errs = append(errs, field.Required(rulePath.Child("allow"), "")) + } + seenMatches := map[string]bool{} + onlyExactHostnames := len(rule.GetAllow()) > 0 + for j, match := range rule.GetAllow() { + matchPath := rulePath.Child("allow").Index(j) + key, exactHostname, matchErrs := validateEgressMatch(match, matchPath) + errs = append(errs, matchErrs...) + onlyExactHostnames = onlyExactHostnames && exactHostname + if key != "" && seenMatches[key] { + errs = append(errs, field.Duplicate(matchPath, key)) + } + seenMatches[key] = key != "" + } + effects := rule.GetEffects() + if effects == nil { + continue + } + if (len(effects.GetInjectStaticHeader()) > 0 || effects.GetInjectActorJwt() != nil) && !onlyExactHostnames { + errs = append(errs, field.Invalid(rulePath.Child("effects"), effects, "credential-bearing effects require only exact hostname predicates")) + } + for j, injection := range effects.GetInjectStaticHeader() { + p := rulePath.Child("effects", "inject_static_header").Index(j) + errs = append(errs, validateStaticHeaderInjection(injection, p)...) + errs = append(errs, recordInjectionHeader(injection.GetHeader(), p.Child("header"), seenHeaders)...) + } + if injection := effects.GetInjectActorJwt(); injection != nil { + p := rulePath.Child("effects", "inject_actor_jwt") + errs = append(errs, validateActorTokenInjection(injection, p)...) + errs = append(errs, recordInjectionHeader(injection.GetHeader(), p.Child("header"), seenHeaders)...) + } + } + return errs +} + +func validateEgressMatch(match *ateapipb.EgressMatch, p *field.Path) (string, bool, field.ErrorList) { + if match == nil || match.GetPredicate() == nil { + return "", false, field.ErrorList{field.Required(p.Child("predicate"), "")} + } + switch predicate := match.GetPredicate().(type) { + case *ateapipb.EgressMatch_All: + return "all", false, nil + case *ateapipb.EgressMatch_Hostname: + normalized, wildcard, errs := validateHostnameMatch(predicate.Hostname, p.Child("hostname")) + return "hostname:" + normalized, normalized != "" && !wildcard, errs + case *ateapipb.EgressMatch_IpBlock: + cidrPath := p.Child("ip_block", "cidr") + cidr := predicate.IpBlock.GetCidr() + prefix, err := netip.ParsePrefix(cidr) + if err != nil || prefix.Masked().String() != cidr { + return "", false, field.ErrorList{field.Invalid(cidrPath, cidr, "must be a canonical IPv4 or IPv6 prefix")} + } + return "ip:" + cidr, false, nil + default: + return "", false, field.ErrorList{field.NotSupported(p.Child("predicate"), fmt.Sprintf("%T", predicate), []string{"all", "hostname", "ip_block"})} + } +} + +func validateHostnameMatch(match *ateapipb.HostnameMatch, p *field.Path) (string, bool, field.ErrorList) { + if match == nil { + return "", false, field.ErrorList{field.Required(p, "")} + } + raw := match.GetPattern() + normalized := strings.ToLower(strings.TrimSuffix(raw, ".")) + wildcard := strings.HasPrefix(normalized, "*.") + name := strings.TrimPrefix(normalized, "*.") + invalid := raw == "" || strings.HasSuffix(raw, "..") || (strings.Contains(normalized, "*") && !wildcard) || len(validation.IsDNS1123Subdomain(name)) != 0 + if _, err := netip.ParseAddr(name); err == nil { + invalid = true + } + if invalid { + return normalized, wildcard, field.ErrorList{field.Invalid(p.Child("pattern"), raw, "must be an exact ASCII DNS hostname or complete leftmost-label wildcard")} + } + return normalized, wildcard, nil +} + +func validateStaticHeaderInjection(injection *ateapipb.StaticHeaderInjection, p *field.Path) field.ErrorList { + if injection == nil { + return field.ErrorList{field.Required(p, "")} + } + var errs field.ErrorList + if !validHeaderName(injection.GetHeader()) { + errs = append(errs, field.Invalid(p.Child("header"), injection.GetHeader(), "must be an HTTP header name")) + } + if !validHeaderValue(injection.GetPrefix()) { + errs = append(errs, field.Invalid(p.Child("prefix"), injection.GetPrefix(), "must not contain CR, LF, or NUL")) + } + if !validCredentialURI(injection.GetCredentialUri()) { + errs = append(errs, field.Invalid(p.Child("credential_uri"), injection.GetCredentialUri(), "must be substrate-secret:////")) + } + return errs +} + +func validateActorTokenInjection(injection *ateapipb.ActorTokenInjection, p *field.Path) field.ErrorList { + var errs field.ErrorList + if !validHeaderName(injection.GetHeader()) { + errs = append(errs, field.Invalid(p.Child("header"), injection.GetHeader(), "must be an HTTP header name")) + } + if exchange := injection.GetRfc_8693Exchange(); exchange != nil { + u, err := url.Parse(exchange.GetUrl()) + if err != nil || u.Scheme != "https" || u.Host == "" || u.User != nil || u.Fragment != "" { + errs = append(errs, field.Invalid(p.Child("rfc_8693_exchange", "url"), exchange.GetUrl(), "must be an HTTPS URL without user information or a fragment")) + } + } + return errs +} + +func recordInjectionHeader(header string, p *field.Path, seen map[string]bool) field.ErrorList { + normalized := strings.ToLower(header) + if normalized == "" || !validHeaderName(normalized) { + return nil + } + if seen[normalized] { + return field.ErrorList{field.Duplicate(p, header)} + } + seen[normalized] = true + return nil +} + +func validCredentialURI(raw string) bool { + u, err := url.Parse(raw) + if err != nil || u.Scheme != "substrate-secret" || u.Host == "" || u.Host != u.Hostname() || u.User != nil || u.RawQuery != "" || u.Fragment != "" || len(validation.IsDNS1123Subdomain(u.Host)) != 0 { + return false + } + escapedPath := u.EscapedPath() + if !strings.HasPrefix(escapedPath, "/") || strings.HasSuffix(escapedPath, "/") { + return false + } + parts := strings.Split(strings.TrimPrefix(escapedPath, "/"), "/") + if len(parts) < 2 { + return false + } + for _, part := range parts { + if part == "" { + return false + } + } + return true +} + +func validHeaderName(value string) bool { + if value == "" { + return false + } + for _, c := range []byte(value) { + if !((c >= 'a' && c <= 'z') || (c >= 'A' && c <= 'Z') || (c >= '0' && c <= '9') || strings.ContainsRune("!#$%&'*+-.^_`|~", rune(c))) { + return false + } + } + return true +} + +func validHeaderValue(value string) bool { + return !strings.ContainsAny(value, "\r\n\x00") +} + +func normalizeEgressPolicy(policy *ateapipb.EgressPolicy) *ateapipb.EgressPolicy { + result := proto.Clone(policy).(*ateapipb.EgressPolicy) + for _, rule := range result.GetRules() { + for _, match := range rule.GetAllow() { + if hostname := match.GetHostname(); hostname != nil { + hostname.Pattern = strings.ToLower(strings.TrimSuffix(hostname.GetPattern(), ".")) + } + } + for _, injection := range rule.GetEffects().GetInjectStaticHeader() { + injection.Header = strings.ToLower(injection.GetHeader()) + } + if injection := rule.GetEffects().GetInjectActorJwt(); injection != nil { + injection.Header = strings.ToLower(injection.GetHeader()) + } + } + return result +} + +func mapEgressPolicyWrite(policy *ateapipb.EgressPolicy, err error) (*ateapipb.EgressPolicy, error) { + switch { + case err == nil: + return policy, nil + case errors.Is(err, store.ErrNotFound): + return nil, status.Error(codes.NotFound, "EgressPolicy not found") + case errors.Is(err, store.ErrAlreadyExists): + return nil, status.Error(codes.AlreadyExists, "EgressPolicy already exists") + case errors.Is(err, store.ErrVersionConflict): + return nil, status.Error(codes.Aborted, "EgressPolicy version conflict") + case errors.Is(err, store.ErrFailedPrecondition): + return nil, status.Error(codes.FailedPrecondition, "parent Actor does not exist") + default: + return nil, fmt.Errorf("while writing EgressPolicy: %w", err) + } +} diff --git a/cmd/ateapi/internal/controlapi/egress_policy_test.go b/cmd/ateapi/internal/controlapi/egress_policy_test.go new file mode 100644 index 0000000000..4ba848aeda --- /dev/null +++ b/cmd/ateapi/internal/controlapi/egress_policy_test.go @@ -0,0 +1,222 @@ +// Copyright 2026 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package controlapi + +import ( + "context" + "errors" + "testing" + + "github.com/agent-substrate/substrate/cmd/ateapi/internal/store" + "github.com/agent-substrate/substrate/cmd/ateapi/internal/store/storetest" + "github.com/agent-substrate/substrate/internal/principal" + "github.com/agent-substrate/substrate/internal/proto/egresspolicypb" + "github.com/agent-substrate/substrate/internal/resources" + "github.com/agent-substrate/substrate/pkg/proto/ateapipb" + "google.golang.org/grpc/codes" + "google.golang.org/grpc/status" + "google.golang.org/protobuf/proto" +) + +func TestValidateEgressPolicy(t *testing.T) { + valid := &ateapipb.EgressPolicy{Rules: []*ateapipb.EgressRule{{ + Allow: []*ateapipb.EgressMatch{{Predicate: &ateapipb.EgressMatch_Hostname{Hostname: &ateapipb.HostnameMatch{Pattern: "api.example.com"}}}}, + Effects: &ateapipb.EgressRuleEffects{InjectStaticHeader: []*ateapipb.StaticHeaderInjection{{ + Header: "Authorization", Prefix: "Bearer ", CredentialUri: "substrate-secret://kubernetes.io/provider/ns/name", + }}}, + }}} + if errs := validateEgressPolicy(valid, false); len(errs) != 0 { + t.Fatalf("valid policy rejected: %v", errs) + } + + tests := []struct { + name string + mutate func(*ateapipb.EgressPolicy) + }{ + {name: "empty allow", mutate: func(p *ateapipb.EgressPolicy) { p.Rules[0].Allow = nil }}, + {name: "wildcard credential effect", mutate: func(p *ateapipb.EgressPolicy) { p.Rules[0].Allow[0].GetHostname().Pattern = "*.example.com" }}, + {name: "noncanonical CIDR", mutate: func(p *ateapipb.EgressPolicy) { + p.Rules[0].Allow[0].Predicate = &ateapipb.EgressMatch_IpBlock{IpBlock: &ateapipb.IPBlockMatch{Cidr: "192.0.2.1/24"}} + }}, + {name: "invalid credential URI", mutate: func(p *ateapipb.EgressPolicy) { + p.Rules[0].Effects.InjectStaticHeader[0].CredentialUri = "https://example.com/secret" + }}, + {name: "create with version", mutate: func(p *ateapipb.EgressPolicy) { p.Version = 1 }}, + } + for _, tc := range tests { + t.Run(tc.name, func(t *testing.T) { + policy := proto.Clone(valid).(*ateapipb.EgressPolicy) + tc.mutate(policy) + if errs := validateEgressPolicy(policy, false); len(errs) == 0 { + t.Fatal("invalid policy accepted") + } + }) + } + + update := proto.Clone(valid).(*ateapipb.EgressPolicy) + if errs := validateEgressPolicy(update, true); len(errs) == 0 { + t.Fatal("update without version accepted") + } +} + +func TestGetEffectiveEgressPolicy(t *testing.T) { + persistence, cleanup := storetest.SetupTestStore(t) + defer cleanup() + service := &Service{persistence: persistence} + actor, err := persistence.CreateActor(t.Context(), &ateapipb.Actor{ + Metadata: &ateapipb.ResourceMetadata{Atespace: testAtespace, Name: "egress-actor"}, + Status: &ateapipb.ActorStatus{State: ateapipb.ActorState_ACTOR_STATE_RUNNING}, + }) + if err != nil { + t.Fatal(err) + } + request := &egresspolicypb.GetEffectiveEgressPolicyRequest{ + Actor: &ateapipb.ObjectRef{Atespace: testAtespace, Name: "egress-actor"}, ActorUid: actor.GetMetadata().GetUid(), + } + ctx := principal.InjectContext(context.Background(), principal.PrincipalInfo{Kind: principal.KindMTLS, ID: egressGatewayPrincipal}) + + listed, err := service.GetActorEgressPolicy(t.Context(), &ateapipb.GetActorEgressPolicyRequest{Actor: request.GetActor()}) + if err != nil || len(listed.GetEgressPolicies()) != 0 { + t.Fatalf("policies before set = %v, %v; want empty", listed, err) + } + if _, err := service.GetActorEgressPolicy(t.Context(), &ateapipb.GetActorEgressPolicyRequest{ + Actor: &ateapipb.ObjectRef{Atespace: testAtespace, Name: "missing-actor"}, + }); status.Code(err) != codes.NotFound { + t.Fatalf("missing parent status = %v, want NotFound", status.Code(err)) + } + empty, err := service.GetEffectiveEgressPolicy(ctx, request) + if err != nil || len(empty.GetPolicy().GetRules()) != 0 { + t.Fatalf("missing policy = %v, %v; want deny-all policy", empty, err) + } + created, err := service.SetActorEgressPolicy(t.Context(), &ateapipb.SetActorEgressPolicyRequest{ + Actor: request.GetActor(), + EgressPolicy: &ateapipb.EgressPolicy{Rules: []*ateapipb.EgressRule{{ + Allow: []*ateapipb.EgressMatch{{Predicate: &ateapipb.EgressMatch_Hostname{Hostname: &ateapipb.HostnameMatch{Pattern: "API.EXAMPLE.COM."}}}}, + Effects: &ateapipb.EgressRuleEffects{InjectStaticHeader: []*ateapipb.StaticHeaderInjection{{ + Header: "Authorization", Prefix: "Bearer ", CredentialUri: "substrate-secret://kubernetes.io/provider/ns/name", + }}}, + }}}, + }) + if err != nil { + t.Fatal(err) + } + if _, err := service.SetActorEgressPolicy(t.Context(), &ateapipb.SetActorEgressPolicyRequest{ + Actor: request.GetActor(), EgressPolicy: &ateapipb.EgressPolicy{}, + }); status.Code(err) != codes.AlreadyExists { + t.Fatalf("create collision status = %v, want AlreadyExists", status.Code(err)) + } + if created.GetRules()[0].GetAllow()[0].GetHostname().GetPattern() != "api.example.com" || created.GetRules()[0].GetEffects().GetInjectStaticHeader()[0].GetHeader() != "authorization" { + t.Fatalf("policy was not normalized: %v", created) + } + listed, err = service.GetActorEgressPolicy(t.Context(), &ateapipb.GetActorEgressPolicyRequest{Actor: request.GetActor()}) + if err != nil || len(listed.GetEgressPolicies()) != 1 || !proto.Equal(listed.GetEgressPolicies()[0], created) { + t.Fatalf("policies after set = %v, %v; want one document", listed, err) + } + replacement := proto.Clone(created).(*ateapipb.EgressPolicy) + replacement.Rules = nil + updated, err := service.SetActorEgressPolicy(t.Context(), &ateapipb.SetActorEgressPolicyRequest{Actor: request.GetActor(), EgressPolicy: replacement}) + if err != nil || updated.GetVersion() != 2 || len(updated.GetRules()) != 0 { + t.Fatalf("replacement = %v, %v; want empty version 2", updated, err) + } + if _, err := service.SetActorEgressPolicy(t.Context(), &ateapipb.SetActorEgressPolicyRequest{ + Actor: request.GetActor(), EgressPolicy: replacement, + }); status.Code(err) != codes.Aborted { + t.Fatalf("stale replacement status = %v, want Aborted", status.Code(err)) + } + created = updated + got, err := service.GetEffectiveEgressPolicy(ctx, request) + if err != nil || !proto.Equal(got.GetPolicy(), created) { + t.Fatalf("effective policy = %v, %v; want %v", got, err, created) + } + if _, err := service.GetEffectiveEgressPolicy(context.Background(), request); status.Code(err) != codes.PermissionDenied { + t.Fatalf("unauthorized resolver status = %v, want PermissionDenied", status.Code(err)) + } + wrongUID := proto.Clone(request).(*egresspolicypb.GetEffectiveEgressPolicyRequest) + wrongUID.ActorUid = "replacement-uid" + if _, err := service.GetEffectiveEgressPolicy(ctx, wrongUID); status.Code(err) != codes.PermissionDenied { + t.Fatalf("wrong Actor UID status = %v, want PermissionDenied", status.Code(err)) + } +} + +type getActorErrorStore struct { + store.Interface + err error +} + +func (s *getActorErrorStore) GetActor(context.Context, resources.ActorRef) (*ateapipb.Actor, error) { + return nil, s.err +} + +func TestGetEffectiveEgressPolicyActorLookupErrors(t *testing.T) { + persistence, cleanup := storetest.SetupTestStore(t) + defer cleanup() + wrapped := &getActorErrorStore{Interface: persistence} + service := &Service{persistence: wrapped} + ctx := principal.InjectContext(context.Background(), principal.PrincipalInfo{Kind: principal.KindMTLS, ID: egressGatewayPrincipal}) + req := &egresspolicypb.GetEffectiveEgressPolicyRequest{ + Actor: &ateapipb.ObjectRef{Atespace: testAtespace, Name: "actor"}, ActorUid: "uid", + } + for _, tc := range []struct { + name string + err error + want codes.Code + }{ + {name: "missing actor", err: store.ErrNotFound, want: codes.PermissionDenied}, + {name: "persistence failure", err: errors.New("store unavailable"), want: codes.Unavailable}, + } { + t.Run(tc.name, func(t *testing.T) { + wrapped.err = tc.err + _, err := service.GetEffectiveEgressPolicy(ctx, req) + if status.Code(err) != tc.want { + t.Fatalf("status = %v, want %v", status.Code(err), tc.want) + } + }) + } +} + +func TestCredentialURIValidation(t *testing.T) { + for _, uri := range []string{ + "substrate-secret://kubernetes.io/provider/ns/name", + "substrate-secret://vault.example/provider/secret", + } { + if !validCredentialURI(uri) { + t.Errorf("validCredentialURI(%q) = false", uri) + } + } + for _, uri := range []string{ + "https://kubernetes.io/provider/ns/name", + "substrate-secret://kubernetes.io/provider", + "substrate-secret://kubernetes.io//provider/secret", + "substrate-secret://kubernetes.io/provider/secret/", + "substrate-secret://kubernetes.io:443/provider/secret", + } { + if validCredentialURI(uri) { + t.Errorf("validCredentialURI(%q) = true", uri) + } + } +} + +func TestHeaderValueValidation(t *testing.T) { + for _, value := range []string{"Bearer token", "\u0080\u0081"} { + if !validHeaderValue(value) { + t.Errorf("validHeaderValue(%q) = false", value) + } + } + for _, value := range []string{"a\rb", "a\nb", "a\x00b"} { + if validHeaderValue(value) { + t.Errorf("validHeaderValue(%q) = true", value) + } + } +} diff --git a/cmd/ateapi/internal/controlapi/service.go b/cmd/ateapi/internal/controlapi/service.go index c50ccb755f..131b0f0575 100644 --- a/cmd/ateapi/internal/controlapi/service.go +++ b/cmd/ateapi/internal/controlapi/service.go @@ -20,6 +20,7 @@ import ( "github.com/agent-substrate/substrate/cmd/ateapi/internal/store" "github.com/agent-substrate/substrate/cmd/ateapi/internal/workercache" + "github.com/agent-substrate/substrate/internal/proto/egresspolicypb" "github.com/agent-substrate/substrate/internal/resources" "github.com/agent-substrate/substrate/internal/volume" "github.com/agent-substrate/substrate/internal/volume/csi" @@ -31,6 +32,7 @@ import ( // Service implements ateapipb.Control type Service struct { ateapipb.UnimplementedControlServer + egresspolicypb.UnimplementedResolverServer persistence serviceStore workerCache *workercache.Cache dialer *AteletDialer @@ -87,6 +89,11 @@ type serviceStore interface { GetActor(ctx context.Context, actorRef resources.ActorRef) (*ateapipb.Actor, error) UpdateActor(ctx context.Context, actorRef resources.ActorRef, precondition store.Precondition, mutate func(toUpdate *ateapipb.Actor) error) (*ateapipb.Actor, error) ListActors(ctx context.Context, atespace string, opts store.ListOptions) (store.ListResponse[*ateapipb.Actor], error) + CreateEgressPolicy(ctx context.Context, actorRef resources.ActorRef, policy *ateapipb.EgressPolicy) (*ateapipb.EgressPolicy, error) + GetEgressPolicy(ctx context.Context, actorRef resources.ActorRef) (*ateapipb.EgressPolicy, error) + ResolveEgressPolicy(ctx context.Context, actorRef resources.ActorRef, actorUID string) (*ateapipb.EgressPolicy, error) + UpdateEgressPolicy(ctx context.Context, actorRef resources.ActorRef, expectedVersion int64, mutate func(*ateapipb.EgressPolicy) error) (*ateapipb.EgressPolicy, error) + DeleteEgressPolicy(ctx context.Context, actorRef resources.ActorRef) (*ateapipb.EgressPolicy, error) GetActorSnapshot(ctx context.Context, atespace, name string) (*ateapipb.ActorSnapshot, error) ListActorSnapshots(ctx context.Context, atespace string, opts store.ListOptions) (store.ListResponse[*ateapipb.ActorSnapshot], error) CreateActorSnapshotTag(ctx context.Context, atespace, name string, tag *ateapipb.ActorSnapshotTag) (*ateapipb.ActorSnapshotTag, error) diff --git a/cmd/ateapi/internal/store/atepg/atepg.go b/cmd/ateapi/internal/store/atepg/atepg.go index e64f7194c1..5b14fd78eb 100644 --- a/cmd/ateapi/internal/store/atepg/atepg.go +++ b/cmd/ateapi/internal/store/atepg/atepg.go @@ -1509,7 +1509,7 @@ func (p *Persistence) releaseLease(ctx context.Context, key, token string) error // --- Debug --- func (p *Persistence) DebugClearAll(ctx context.Context) error { - if _, err := p.pool.Exec(ctx, `TRUNCATE atespaces, actors, actor_templates, actor_snapshots, actor_snapshot_tags, workers, leases`); err != nil { + if _, err := p.pool.Exec(ctx, `TRUNCATE atespaces, actors, actor_egress_policies, actor_templates, actor_snapshots, actor_snapshot_tags, workers, leases`); err != nil { return fmt.Errorf("truncating tables: %w", err) } return nil diff --git a/cmd/ateapi/internal/store/atepg/egress_policy.go b/cmd/ateapi/internal/store/atepg/egress_policy.go new file mode 100644 index 0000000000..58ab500ee4 --- /dev/null +++ b/cmd/ateapi/internal/store/atepg/egress_policy.go @@ -0,0 +1,141 @@ +// Copyright 2026 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package atepg + +import ( + "context" + "errors" + "fmt" + + "github.com/agent-substrate/substrate/cmd/ateapi/internal/store" + "github.com/agent-substrate/substrate/internal/resources" + "github.com/agent-substrate/substrate/pkg/proto/ateapipb" + "github.com/jackc/pgx/v5" + "google.golang.org/protobuf/proto" +) + +func (p *Persistence) CreateEgressPolicy(ctx context.Context, actorRef resources.ActorRef, policy *ateapipb.EgressPolicy) (*ateapipb.EgressPolicy, error) { + dbPolicy := proto.Clone(policy).(*ateapipb.EgressPolicy) + dbPolicy.Version = 1 + protoBytes, err := proto.Marshal(dbPolicy) + if err != nil { + return nil, fmt.Errorf("marshaling egress policy: %w", err) + } + _, err = p.pool.Exec(ctx, ` + INSERT INTO actor_egress_policies (atespace, actor_name, version, proto) + VALUES ($1, $2, $3, $4)`, actorRef.Atespace, actorRef.Name, dbPolicy.GetVersion(), protoBytes) + if err != nil { + if isUniqueViolation(err) { + return nil, store.ErrAlreadyExists + } + if isForeignKeyViolation(err) { + return nil, store.ErrFailedPrecondition + } + return nil, fmt.Errorf("inserting egress policy for %s: %w", actorRef, err) + } + return dbPolicy, nil +} + +func (p *Persistence) GetEgressPolicy(ctx context.Context, actorRef resources.ActorRef) (*ateapipb.EgressPolicy, error) { + return getEgressPolicyRow(ctx, p.pool, ` + SELECT version, proto FROM actor_egress_policies + WHERE atespace = $1 AND actor_name = $2`, actorRef.Atespace, actorRef.Name) +} + +func (p *Persistence) ResolveEgressPolicy(ctx context.Context, actorRef resources.ActorRef, actorUID string) (*ateapipb.EgressPolicy, error) { + return getEgressPolicyRow(ctx, p.pool, ` + SELECT p.version, p.proto + FROM actor_egress_policies AS p + JOIN actors AS a ON a.atespace = p.atespace AND a.name = p.actor_name + WHERE p.atespace = $1 AND p.actor_name = $2 AND a.uid = $3`, actorRef.Atespace, actorRef.Name, actorUID) +} + +func (p *Persistence) UpdateEgressPolicy(ctx context.Context, actorRef resources.ActorRef, expectedVersion int64, mutate func(*ateapipb.EgressPolicy) error) (*ateapipb.EgressPolicy, error) { + if expectedVersion <= 0 { + return nil, store.ErrPreconditionRequired + } + tx, err := p.pool.Begin(ctx) + if err != nil { + return nil, fmt.Errorf("beginning egress policy update: %w", err) + } + defer tx.Rollback(ctx) //nolint:errcheck // no-op once committed + + current, err := getEgressPolicyRow(ctx, tx, ` + SELECT version, proto FROM actor_egress_policies + WHERE atespace = $1 AND actor_name = $2 FOR UPDATE`, actorRef.Atespace, actorRef.Name) + if err != nil { + return nil, err + } + if current.GetVersion() != expectedVersion { + return nil, store.ErrVersionConflict + } + updated := proto.Clone(current).(*ateapipb.EgressPolicy) + if err := mutate(updated); err != nil { + return nil, err + } + updated.Version = current.GetVersion() + 1 + protoBytes, err := proto.Marshal(updated) + if err != nil { + return nil, fmt.Errorf("marshaling updated egress policy: %w", err) + } + if _, err := tx.Exec(ctx, ` + UPDATE actor_egress_policies SET version = $3, proto = $4 + WHERE atespace = $1 AND actor_name = $2`, actorRef.Atespace, actorRef.Name, updated.GetVersion(), protoBytes); err != nil { + return nil, fmt.Errorf("updating egress policy for %s: %w", actorRef, err) + } + if err := tx.Commit(ctx); err != nil { + return nil, fmt.Errorf("committing egress policy update: %w", err) + } + return updated, nil +} + +func (p *Persistence) DeleteEgressPolicy(ctx context.Context, actorRef resources.ActorRef) (*ateapipb.EgressPolicy, error) { + var version int64 + var protoBytes []byte + err := p.pool.QueryRow(ctx, ` + DELETE FROM actor_egress_policies + WHERE atespace = $1 AND actor_name = $2 + RETURNING version, proto`, actorRef.Atespace, actorRef.Name).Scan(&version, &protoBytes) + if errors.Is(err, pgx.ErrNoRows) { + return nil, store.ErrNotFound + } + if err != nil { + return nil, fmt.Errorf("deleting egress policy for %s: %w", actorRef, err) + } + return unmarshalEgressPolicy(version, protoBytes) +} + +func getEgressPolicyRow(ctx context.Context, q querier, query string, args ...any) (*ateapipb.EgressPolicy, error) { + var version int64 + var protoBytes []byte + if err := q.QueryRow(ctx, query, args...).Scan(&version, &protoBytes); err != nil { + if errors.Is(err, pgx.ErrNoRows) { + return nil, store.ErrNotFound + } + return nil, fmt.Errorf("getting egress policy: %w", err) + } + return unmarshalEgressPolicy(version, protoBytes) +} + +func unmarshalEgressPolicy(version int64, protoBytes []byte) (*ateapipb.EgressPolicy, error) { + policy := &ateapipb.EgressPolicy{} + if err := proto.Unmarshal(protoBytes, policy); err != nil { + return nil, fmt.Errorf("unmarshaling egress policy: %w", err) + } + if policy.GetVersion() != version { + return nil, fmt.Errorf("egress policy proto version %d does not match column version %d", policy.GetVersion(), version) + } + return policy, nil +} diff --git a/cmd/ateapi/internal/store/atepg/schema.go b/cmd/ateapi/internal/store/atepg/schema.go index 48ca4a0f5e..2605ebbc5f 100644 --- a/cmd/ateapi/internal/store/atepg/schema.go +++ b/cmd/ateapi/internal/store/atepg/schema.go @@ -44,6 +44,16 @@ CREATE TABLE IF NOT EXISTS actors ( PRIMARY KEY (atespace, name) ); +CREATE TABLE IF NOT EXISTS actor_egress_policies ( + atespace text NOT NULL, + actor_name text NOT NULL, + version bigint NOT NULL, + proto bytea NOT NULL, + PRIMARY KEY (atespace, actor_name), + FOREIGN KEY (atespace, actor_name) + REFERENCES actors(atespace, name) ON DELETE CASCADE +); + CREATE TABLE IF NOT EXISTS actor_templates ( atespace text NOT NULL REFERENCES atespaces(name) ON DELETE RESTRICT, diff --git a/cmd/ateapi/internal/store/ateredis/ateredis.go b/cmd/ateapi/internal/store/ateredis/ateredis.go index 65767f7a92..fb980f6547 100644 --- a/cmd/ateapi/internal/store/ateredis/ateredis.go +++ b/cmd/ateapi/internal/store/ateredis/ateredis.go @@ -995,7 +995,7 @@ func (s *Persistence) DeleteActor(ctx context.Context, actorRef resources.ActorR } if _, err := tx.TxPipelined(ctx, func(pipe redis.Pipeliner) error { - pipe.Del(ctx, dbKey) + pipe.Del(ctx, dbKey, egressPolicyDBKey(actorRef)) return nil }); err != nil { return err diff --git a/cmd/ateapi/internal/store/ateredis/egress_policy.go b/cmd/ateapi/internal/store/ateredis/egress_policy.go new file mode 100644 index 0000000000..c26beeaee8 --- /dev/null +++ b/cmd/ateapi/internal/store/ateredis/egress_policy.go @@ -0,0 +1,216 @@ +// Copyright 2026 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package ateredis + +import ( + "context" + "encoding/json" + "errors" + "fmt" + + "github.com/agent-substrate/substrate/cmd/ateapi/internal/store" + "github.com/agent-substrate/substrate/internal/resources" + "github.com/agent-substrate/substrate/pkg/proto/ateapipb" + "github.com/redis/go-redis/v9" + "google.golang.org/protobuf/encoding/protojson" + "google.golang.org/protobuf/proto" +) + +type egressPolicyRecord struct { + ActorUID string + Policy *ateapipb.EgressPolicy +} + +type egressPolicyJSON struct { + ActorUID string `json:"actor_uid"` + Policy json.RawMessage `json:"policy"` +} + +// egressPolicyDBKey shares the parent Actor's Redis Cluster hash slot so the +// two keys can participate in one transaction. +func egressPolicyDBKey(actorRef resources.ActorRef) string { + return "actor-egress-policy:{" + actorDBKey(actorRef) + "}" +} + +func (s *Persistence) CreateEgressPolicy(ctx context.Context, actorRef resources.ActorRef, policy *ateapipb.EgressPolicy) (*ateapipb.EgressPolicy, error) { + actorKey := actorDBKey(actorRef) + policyKey := egressPolicyDBKey(actorRef) + for range updateMaxAttempts { + var created *ateapipb.EgressPolicy + err := s.rdb.Watch(ctx, func(tx *redis.Tx) error { + actorBytes, err := tx.Get(ctx, actorKey).Bytes() + if errors.Is(err, redis.Nil) { + return store.ErrFailedPrecondition + } + if err != nil { + return err + } + actor := &ateapipb.Actor{} + if err := protojson.Unmarshal(actorBytes, actor); err != nil { + return fmt.Errorf("while unmarshaling parent actor: %w", err) + } + exists, err := tx.Exists(ctx, policyKey).Result() + if err != nil { + return err + } + if exists != 0 { + return store.ErrAlreadyExists + } + + created = proto.Clone(policy).(*ateapipb.EgressPolicy) + created.Version = 1 + recordBytes, err := marshalEgressPolicyRecord(actor.GetMetadata().GetUid(), created) + if err != nil { + return err + } + _, err = tx.TxPipelined(ctx, func(pipe redis.Pipeliner) error { + pipe.Set(ctx, policyKey, recordBytes, 0) + return nil + }) + return err + }, actorKey, policyKey) + switch { + case err == nil: + return created, nil + case errors.Is(err, store.ErrAlreadyExists), errors.Is(err, store.ErrFailedPrecondition): + return nil, err + case errors.Is(err, redis.TxFailedErr): + continue + default: + return nil, fmt.Errorf("while creating egress policy for %s: %w", actorRef, err) + } + } + return nil, store.ErrVersionConflict +} + +func (s *Persistence) GetEgressPolicy(ctx context.Context, actorRef resources.ActorRef) (*ateapipb.EgressPolicy, error) { + record, err := s.getEgressPolicyRecord(ctx, actorRef) + if err != nil { + return nil, err + } + return record.Policy, nil +} + +func (s *Persistence) ResolveEgressPolicy(ctx context.Context, actorRef resources.ActorRef, actorUID string) (*ateapipb.EgressPolicy, error) { + record, err := s.getEgressPolicyRecord(ctx, actorRef) + if err != nil { + return nil, err + } + if record.ActorUID != actorUID { + return nil, store.ErrNotFound + } + return record.Policy, nil +} + +func (s *Persistence) UpdateEgressPolicy(ctx context.Context, actorRef resources.ActorRef, expectedVersion int64, mutate func(*ateapipb.EgressPolicy) error) (*ateapipb.EgressPolicy, error) { + if expectedVersion <= 0 { + return nil, store.ErrPreconditionRequired + } + policyKey := egressPolicyDBKey(actorRef) + for range updateMaxAttempts { + var updated *ateapipb.EgressPolicy + var mutationErr error + err := s.rdb.Watch(ctx, func(tx *redis.Tx) error { + recordBytes, err := tx.Get(ctx, policyKey).Bytes() + if errors.Is(err, redis.Nil) { + return store.ErrNotFound + } + if err != nil { + return err + } + record, err := unmarshalEgressPolicyRecord(recordBytes) + if err != nil { + return err + } + if record.Policy.GetVersion() != expectedVersion { + return store.ErrVersionConflict + } + updated = proto.Clone(record.Policy).(*ateapipb.EgressPolicy) + if err := mutate(updated); err != nil { + mutationErr = err + return err + } + updated.Version = record.Policy.GetVersion() + 1 + updatedBytes, err := marshalEgressPolicyRecord(record.ActorUID, updated) + if err != nil { + return err + } + _, err = tx.TxPipelined(ctx, func(pipe redis.Pipeliner) error { + pipe.Set(ctx, policyKey, updatedBytes, 0) + return nil + }) + return err + }, policyKey) + switch { + case err == nil: + return updated, nil + case mutationErr != nil: + return nil, mutationErr + case errors.Is(err, store.ErrNotFound), errors.Is(err, store.ErrVersionConflict): + return nil, err + case errors.Is(err, redis.TxFailedErr): + continue + default: + return nil, fmt.Errorf("while updating egress policy for %s: %w", actorRef, err) + } + } + return nil, store.ErrVersionConflict +} + +func (s *Persistence) DeleteEgressPolicy(ctx context.Context, actorRef resources.ActorRef) (*ateapipb.EgressPolicy, error) { + policy, err := s.GetEgressPolicy(ctx, actorRef) + if err != nil { + return nil, err + } + if err := s.rdb.Del(ctx, egressPolicyDBKey(actorRef)).Err(); err != nil { + return nil, fmt.Errorf("while deleting egress policy for %s: %w", actorRef, err) + } + return policy, nil +} + +func (s *Persistence) getEgressPolicyRecord(ctx context.Context, actorRef resources.ActorRef) (*egressPolicyRecord, error) { + b, err := s.rdb.Get(ctx, egressPolicyDBKey(actorRef)).Bytes() + if errors.Is(err, redis.Nil) { + return nil, store.ErrNotFound + } + if err != nil { + return nil, fmt.Errorf("while getting egress policy for %s: %w", actorRef, err) + } + return unmarshalEgressPolicyRecord(b) +} + +func marshalEgressPolicyRecord(actorUID string, policy *ateapipb.EgressPolicy) ([]byte, error) { + policyBytes, err := protojson.Marshal(policy) + if err != nil { + return nil, fmt.Errorf("while marshaling egress policy: %w", err) + } + b, err := json.Marshal(&egressPolicyJSON{ActorUID: actorUID, Policy: policyBytes}) + if err != nil { + return nil, fmt.Errorf("while marshaling egress policy record: %w", err) + } + return b, nil +} + +func unmarshalEgressPolicyRecord(b []byte) (*egressPolicyRecord, error) { + stored := &egressPolicyJSON{} + if err := json.Unmarshal(b, stored); err != nil { + return nil, fmt.Errorf("while unmarshaling egress policy record: %w", err) + } + policy := &ateapipb.EgressPolicy{} + if err := protojson.Unmarshal(stored.Policy, policy); err != nil { + return nil, fmt.Errorf("while unmarshaling egress policy: %w", err) + } + return &egressPolicyRecord{ActorUID: stored.ActorUID, Policy: policy}, nil +} diff --git a/cmd/ateapi/internal/store/store.go b/cmd/ateapi/internal/store/store.go index b012be2c0d..6adef6517e 100644 --- a/cmd/ateapi/internal/store/store.go +++ b/cmd/ateapi/internal/store/store.go @@ -98,6 +98,18 @@ type Interface interface { // missing, or ErrFailedPrecondition if not already deleting. DeleteActor(ctx context.Context, actorRef resources.ActorRef) (*ateapipb.Actor, error) + // Creates the 1:1 policy subresource for an existing Actor. + CreateEgressPolicy(ctx context.Context, actorRef resources.ActorRef, policy *ateapipb.EgressPolicy) (*ateapipb.EgressPolicy, error) + // Fetches an Actor's policy subresource. + GetEgressPolicy(ctx context.Context, actorRef resources.ActorRef) (*ateapipb.EgressPolicy, error) + // Resolves a policy only when it belongs to the expected Actor incarnation. + ResolveEgressPolicy(ctx context.Context, actorRef resources.ActorRef, actorUID string) (*ateapipb.EgressPolicy, error) + // Transactionally updates an Actor's policy when its current version matches + // expectedVersion. + UpdateEgressPolicy(ctx context.Context, actorRef resources.ActorRef, expectedVersion int64, mutate func(*ateapipb.EgressPolicy) error) (*ateapipb.EgressPolicy, error) + // Deletes and returns an Actor's policy subresource. + DeleteEgressPolicy(ctx context.Context, actorRef resources.ActorRef) (*ateapipb.EgressPolicy, error) + // Creates an immutable ActorSnapshot. The caller sets snapshot_uri; the // store keeps no location of its own. CreateActorSnapshot(ctx context.Context, snapshot *ateapipb.ActorSnapshot) (*ateapipb.ActorSnapshot, error) diff --git a/cmd/ateapi/internal/store/storecontract/contract.go b/cmd/ateapi/internal/store/storecontract/contract.go index 5b13c3f64f..706196153e 100644 --- a/cmd/ateapi/internal/store/storecontract/contract.go +++ b/cmd/ateapi/internal/store/storecontract/contract.go @@ -26,6 +26,7 @@ import ( "github.com/google/go-cmp/cmp" "google.golang.org/protobuf/proto" "google.golang.org/protobuf/testing/protocmp" + "google.golang.org/protobuf/types/known/emptypb" "google.golang.org/protobuf/types/known/timestamppb" "github.com/agent-substrate/substrate/cmd/ateapi/internal/store" @@ -134,6 +135,7 @@ func receiveEvent(t *testing.T, ch <-chan store.WorkerEvent) store.WorkerEvent { // each backend's own test file for that. func RunContractTests(t *testing.T, setup func(t *testing.T) store.Interface) { runActorContractTests(t, setup) + runEgressPolicyContractTests(t, setup) runWorkerContractTests(t, setup) runAtespaceContractTests(t, setup) runActorTemplateContractTests(t, setup) @@ -143,6 +145,109 @@ func RunContractTests(t *testing.T, setup func(t *testing.T) store.Interface) { runDebugContractTests(t, setup) } +func runEgressPolicyContractTests(t *testing.T, setup func(t *testing.T) store.Interface) { + t.Helper() + + t.Run("EgressPolicy_Lifecycle", func(t *testing.T) { + s := setup(t) + ctx := context.Background() + mustCreateAtespace(t, s, testAtespace) + actor, err := s.CreateActor(ctx, &ateapipb.Actor{ + Metadata: &ateapipb.ResourceMetadata{Atespace: testAtespace, Name: "session-1"}, + Status: &ateapipb.ActorStatus{State: ateapipb.ActorState_ACTOR_STATE_RUNNING}, + }) + if err != nil { + t.Fatal(err) + } + actorRef := resources.ActorRefFromActor(actor) + policy := &ateapipb.EgressPolicy{Rules: []*ateapipb.EgressRule{{Allow: []*ateapipb.EgressMatch{{ + Predicate: &ateapipb.EgressMatch_Hostname{Hostname: &ateapipb.HostnameMatch{Pattern: "api.example.com"}}, + }}}}} + + created, err := s.CreateEgressPolicy(ctx, actorRef, policy) + if err != nil { + t.Fatalf("CreateEgressPolicy failed: %v", err) + } + if created.GetVersion() != 1 || policy.GetVersion() != 0 { + t.Fatalf("created version = %d, input version = %d; want 1, 0", created.GetVersion(), policy.GetVersion()) + } + if _, err := s.CreateEgressPolicy(ctx, actorRef, policy); !errors.Is(err, store.ErrAlreadyExists) { + t.Fatalf("duplicate create error = %v, want ErrAlreadyExists", err) + } + got, err := s.GetEgressPolicy(ctx, actorRef) + if err != nil || !proto.Equal(got, created) { + t.Fatalf("GetEgressPolicy = %v, %v; want %v", got, err, created) + } + resolved, err := s.ResolveEgressPolicy(ctx, actorRef, actor.GetMetadata().GetUid()) + if err != nil || !proto.Equal(resolved, created) { + t.Fatalf("ResolveEgressPolicy = %v, %v; want %v", resolved, err, created) + } + if _, err := s.ResolveEgressPolicy(ctx, actorRef, "replacement-uid"); !errors.Is(err, store.ErrNotFound) { + t.Fatalf("wrong Actor UID error = %v, want ErrNotFound", err) + } + if _, err := s.UpdateEgressPolicy(ctx, actorRef, 0, func(*ateapipb.EgressPolicy) error { return nil }); !errors.Is(err, store.ErrPreconditionRequired) { + t.Fatalf("unguarded update error = %v, want ErrPreconditionRequired", err) + } + if _, err := s.UpdateEgressPolicy(ctx, actorRef, 99, func(*ateapipb.EgressPolicy) error { return nil }); !errors.Is(err, store.ErrVersionConflict) { + t.Fatalf("stale update error = %v, want ErrVersionConflict", err) + } + updated, err := s.UpdateEgressPolicy(ctx, actorRef, 1, func(policy *ateapipb.EgressPolicy) error { + policy.Rules = []*ateapipb.EgressRule{{Allow: []*ateapipb.EgressMatch{{Predicate: &ateapipb.EgressMatch_All{All: &emptypb.Empty{}}}}}} + return nil + }) + if err != nil || updated.GetVersion() != 2 { + t.Fatalf("UpdateEgressPolicy = %v, %v; want version 2", updated, err) + } + deleted, err := s.DeleteEgressPolicy(ctx, actorRef) + if err != nil || !proto.Equal(deleted, updated) { + t.Fatalf("DeleteEgressPolicy = %v, %v; want %v", deleted, err, updated) + } + if _, err := s.GetEgressPolicy(ctx, actorRef); !errors.Is(err, store.ErrNotFound) { + t.Fatalf("GetEgressPolicy after delete error = %v, want ErrNotFound", err) + } + }) + + t.Run("EgressPolicy_ActorLifecycle", func(t *testing.T) { + s := setup(t) + ctx := context.Background() + mustCreateAtespace(t, s, testAtespace) + actorRef := resources.ActorRef{Atespace: testAtespace, Name: "session-1"} + policy := &ateapipb.EgressPolicy{} + if _, err := s.CreateEgressPolicy(ctx, actorRef, policy); !errors.Is(err, store.ErrFailedPrecondition) { + t.Fatalf("policy without Actor error = %v, want ErrFailedPrecondition", err) + } + actor, err := s.CreateActor(ctx, &ateapipb.Actor{ + Metadata: &ateapipb.ResourceMetadata{Atespace: testAtespace, Name: actorRef.Name}, + Status: &ateapipb.ActorStatus{State: ateapipb.ActorState_ACTOR_STATE_DELETING}, + }) + if err != nil { + t.Fatal(err) + } + if _, err := s.CreateEgressPolicy(ctx, actorRef, policy); err != nil { + t.Fatal(err) + } + if _, err := s.DeleteActor(ctx, actorRef); err != nil { + t.Fatal(err) + } + if _, err := s.GetEgressPolicy(ctx, actorRef); !errors.Is(err, store.ErrNotFound) { + t.Fatalf("policy after Actor deletion error = %v, want ErrNotFound", err) + } + replacement, err := s.CreateActor(ctx, &ateapipb.Actor{ + Metadata: &ateapipb.ResourceMetadata{Atespace: testAtespace, Name: actorRef.Name}, + Status: &ateapipb.ActorStatus{State: ateapipb.ActorState_ACTOR_STATE_RUNNING}, + }) + if err != nil { + t.Fatal(err) + } + if replacement.GetMetadata().GetUid() == actor.GetMetadata().GetUid() { + t.Fatal("replacement Actor reused UID") + } + if _, err := s.ResolveEgressPolicy(ctx, actorRef, replacement.GetMetadata().GetUid()); !errors.Is(err, store.ErrNotFound) { + t.Fatalf("replacement Actor inherited policy: %v", err) + } + }) +} + func runListOptionsContractTests(t *testing.T, setup func(t *testing.T) store.Interface) { t.Helper() diff --git a/cmd/ateapi/main.go b/cmd/ateapi/main.go index 345ea631f0..4828c320b6 100644 --- a/cmd/ateapi/main.go +++ b/cmd/ateapi/main.go @@ -37,6 +37,7 @@ import ( "github.com/agent-substrate/substrate/internal/ateapiauth" "github.com/agent-substrate/substrate/internal/ateinterceptors" "github.com/agent-substrate/substrate/internal/credbundle" + "github.com/agent-substrate/substrate/internal/proto/egresspolicypb" "github.com/agent-substrate/substrate/internal/serverboot" "github.com/agent-substrate/substrate/internal/version" "github.com/agent-substrate/substrate/internal/volume" @@ -230,6 +231,7 @@ func main() { ) reflection.Register(mux) ateapipb.RegisterControlServer(mux, sm) + egresspolicypb.RegisterResolverServer(mux, sm) ateapipb.RegisterActorIdentityServer(mux, actorIdentitySrv) ateapipb.RegisterDebugServer(mux, debugSrv) diff --git a/internal/proto/ateompb/ateom_grpc.pb.go b/internal/proto/ateompb/ateom_grpc.pb.go index 5001e15460..4d230adf97 100644 --- a/internal/proto/ateompb/ateom_grpc.pb.go +++ b/internal/proto/ateompb/ateom_grpc.pb.go @@ -85,12 +85,12 @@ type AteomClient interface { // Two ways it declines to give a sample, and they ask different things of the // caller: // - // - NOT_FOUND -- this ateom is not executing the actor in the request. It + // * NOT_FOUND -- this ateom is not executing the actor in the request. It // may be "available", or a recycled worker may have moved on to a // different actor. Retrying on the same timer will not change the answer: // the caller's worker-to-actor mapping is stale and wants re-resolving. // - // - FAILED_PRECONDITION -- this ateom is executing the requested actor but + // * FAILED_PRECONDITION -- this ateom is executing the requested actor but // has no sample to give yet. It accepts an actor before the sandbox it // will measure exists, so a poll landing in the boot lands here. Read it // as "no numbers right now", not as "the actor is gone": it is transient, @@ -238,12 +238,12 @@ type AteomServer interface { // Two ways it declines to give a sample, and they ask different things of the // caller: // - // - NOT_FOUND -- this ateom is not executing the actor in the request. It + // * NOT_FOUND -- this ateom is not executing the actor in the request. It // may be "available", or a recycled worker may have moved on to a // different actor. Retrying on the same timer will not change the answer: // the caller's worker-to-actor mapping is stale and wants re-resolving. // - // - FAILED_PRECONDITION -- this ateom is executing the requested actor but + // * FAILED_PRECONDITION -- this ateom is executing the requested actor but // has no sample to give yet. It accepts an actor before the sandbox it // will measure exists, so a poll landing in the boot lands here. Read it // as "no numbers right now", not as "the actor is gone": it is transient, diff --git a/internal/proto/egresspolicypb/egress_policy.pb.go b/internal/proto/egresspolicypb/egress_policy.pb.go new file mode 100644 index 0000000000..fb97b82173 --- /dev/null +++ b/internal/proto/egresspolicypb/egress_policy.pb.go @@ -0,0 +1,201 @@ +// Copyright 2026 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +// Code generated by protoc-gen-go. DO NOT EDIT. +// versions: +// protoc-gen-go v1.36.11-devel +// protoc v4.25.3 +// source: egress_policy.proto + +package egresspolicypb + +import ( + ateapipb "github.com/agent-substrate/substrate/pkg/proto/ateapipb" + protoreflect "google.golang.org/protobuf/reflect/protoreflect" + protoimpl "google.golang.org/protobuf/runtime/protoimpl" + reflect "reflect" + sync "sync" + unsafe "unsafe" +) + +const ( + // Verify that this generated code is sufficiently up-to-date. + _ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion) + // Verify that runtime/protoimpl is sufficiently up-to-date. + _ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20) +) + +type GetEffectiveEgressPolicyRequest struct { + state protoimpl.MessageState `protogen:"open.v1"` + Actor *ateapipb.ObjectRef `protobuf:"bytes,1,opt,name=actor,proto3" json:"actor,omitempty"` + ActorUid string `protobuf:"bytes,2,opt,name=actor_uid,json=actorUid,proto3" json:"actor_uid,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *GetEffectiveEgressPolicyRequest) Reset() { + *x = GetEffectiveEgressPolicyRequest{} + mi := &file_egress_policy_proto_msgTypes[0] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *GetEffectiveEgressPolicyRequest) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*GetEffectiveEgressPolicyRequest) ProtoMessage() {} + +func (x *GetEffectiveEgressPolicyRequest) ProtoReflect() protoreflect.Message { + mi := &file_egress_policy_proto_msgTypes[0] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use GetEffectiveEgressPolicyRequest.ProtoReflect.Descriptor instead. +func (*GetEffectiveEgressPolicyRequest) Descriptor() ([]byte, []int) { + return file_egress_policy_proto_rawDescGZIP(), []int{0} +} + +func (x *GetEffectiveEgressPolicyRequest) GetActor() *ateapipb.ObjectRef { + if x != nil { + return x.Actor + } + return nil +} + +func (x *GetEffectiveEgressPolicyRequest) GetActorUid() string { + if x != nil { + return x.ActorUid + } + return "" +} + +type EffectiveEgressPolicy struct { + state protoimpl.MessageState `protogen:"open.v1"` + Policy *ateapipb.EgressPolicy `protobuf:"bytes,1,opt,name=policy,proto3" json:"policy,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *EffectiveEgressPolicy) Reset() { + *x = EffectiveEgressPolicy{} + mi := &file_egress_policy_proto_msgTypes[1] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *EffectiveEgressPolicy) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*EffectiveEgressPolicy) ProtoMessage() {} + +func (x *EffectiveEgressPolicy) ProtoReflect() protoreflect.Message { + mi := &file_egress_policy_proto_msgTypes[1] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use EffectiveEgressPolicy.ProtoReflect.Descriptor instead. +func (*EffectiveEgressPolicy) Descriptor() ([]byte, []int) { + return file_egress_policy_proto_rawDescGZIP(), []int{1} +} + +func (x *EffectiveEgressPolicy) GetPolicy() *ateapipb.EgressPolicy { + if x != nil { + return x.Policy + } + return nil +} + +var File_egress_policy_proto protoreflect.FileDescriptor + +const file_egress_policy_proto_rawDesc = "" + + "\n" + + "\x13egress_policy.proto\x12\fegresspolicy\x1a\x1fpkg/proto/ateapipb/ateapi.proto\"g\n" + + "\x1fGetEffectiveEgressPolicyRequest\x12'\n" + + "\x05actor\x18\x01 \x01(\v2\x11.ateapi.ObjectRefR\x05actor\x12\x1b\n" + + "\tactor_uid\x18\x02 \x01(\tR\bactorUid\"E\n" + + "\x15EffectiveEgressPolicy\x12,\n" + + "\x06policy\x18\x01 \x01(\v2\x14.ateapi.EgressPolicyR\x06policy2|\n" + + "\bResolver\x12p\n" + + "\x18GetEffectiveEgressPolicy\x12-.egresspolicy.GetEffectiveEgressPolicyRequest\x1a#.egresspolicy.EffectiveEgressPolicy\"\x00BDZBgithub.com/agent-substrate/substrate/internal/proto/egresspolicypbb\x06proto3" + +var ( + file_egress_policy_proto_rawDescOnce sync.Once + file_egress_policy_proto_rawDescData []byte +) + +func file_egress_policy_proto_rawDescGZIP() []byte { + file_egress_policy_proto_rawDescOnce.Do(func() { + file_egress_policy_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_egress_policy_proto_rawDesc), len(file_egress_policy_proto_rawDesc))) + }) + return file_egress_policy_proto_rawDescData +} + +var file_egress_policy_proto_msgTypes = make([]protoimpl.MessageInfo, 2) +var file_egress_policy_proto_goTypes = []any{ + (*GetEffectiveEgressPolicyRequest)(nil), // 0: egresspolicy.GetEffectiveEgressPolicyRequest + (*EffectiveEgressPolicy)(nil), // 1: egresspolicy.EffectiveEgressPolicy + (*ateapipb.ObjectRef)(nil), // 2: ateapi.ObjectRef + (*ateapipb.EgressPolicy)(nil), // 3: ateapi.EgressPolicy +} +var file_egress_policy_proto_depIdxs = []int32{ + 2, // 0: egresspolicy.GetEffectiveEgressPolicyRequest.actor:type_name -> ateapi.ObjectRef + 3, // 1: egresspolicy.EffectiveEgressPolicy.policy:type_name -> ateapi.EgressPolicy + 0, // 2: egresspolicy.Resolver.GetEffectiveEgressPolicy:input_type -> egresspolicy.GetEffectiveEgressPolicyRequest + 1, // 3: egresspolicy.Resolver.GetEffectiveEgressPolicy:output_type -> egresspolicy.EffectiveEgressPolicy + 3, // [3:4] is the sub-list for method output_type + 2, // [2:3] is the sub-list for method input_type + 2, // [2:2] is the sub-list for extension type_name + 2, // [2:2] is the sub-list for extension extendee + 0, // [0:2] is the sub-list for field type_name +} + +func init() { file_egress_policy_proto_init() } +func file_egress_policy_proto_init() { + if File_egress_policy_proto != nil { + return + } + type x struct{} + out := protoimpl.TypeBuilder{ + File: protoimpl.DescBuilder{ + GoPackagePath: reflect.TypeOf(x{}).PkgPath(), + RawDescriptor: unsafe.Slice(unsafe.StringData(file_egress_policy_proto_rawDesc), len(file_egress_policy_proto_rawDesc)), + NumEnums: 0, + NumMessages: 2, + NumExtensions: 0, + NumServices: 1, + }, + GoTypes: file_egress_policy_proto_goTypes, + DependencyIndexes: file_egress_policy_proto_depIdxs, + MessageInfos: file_egress_policy_proto_msgTypes, + }.Build() + File_egress_policy_proto = out.File + file_egress_policy_proto_goTypes = nil + file_egress_policy_proto_depIdxs = nil +} diff --git a/internal/proto/egresspolicypb/egress_policy.proto b/internal/proto/egresspolicypb/egress_policy.proto new file mode 100644 index 0000000000..e19d05f624 --- /dev/null +++ b/internal/proto/egresspolicypb/egress_policy.proto @@ -0,0 +1,35 @@ +// Copyright 2026 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +syntax = "proto3"; + +package egresspolicy; + +import "pkg/proto/ateapipb/ateapi.proto"; + +option go_package = "github.com/agent-substrate/substrate/internal/proto/egresspolicypb"; + +// Resolver is an internal API used only by the egress gateway. +service Resolver { + rpc GetEffectiveEgressPolicy(GetEffectiveEgressPolicyRequest) returns (EffectiveEgressPolicy) {} +} + +message GetEffectiveEgressPolicyRequest { + ateapi.ObjectRef actor = 1; + string actor_uid = 2; +} + +message EffectiveEgressPolicy { + ateapi.EgressPolicy policy = 1; +} diff --git a/internal/proto/egresspolicypb/egress_policy_grpc.pb.go b/internal/proto/egresspolicypb/egress_policy_grpc.pb.go new file mode 100644 index 0000000000..e6d5eddb85 --- /dev/null +++ b/internal/proto/egresspolicypb/egress_policy_grpc.pb.go @@ -0,0 +1,139 @@ +// Copyright 2026 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +// Code generated by protoc-gen-go-grpc. DO NOT EDIT. +// versions: +// - protoc-gen-go-grpc v1.6.1 +// - protoc v4.25.3 +// source: egress_policy.proto + +package egresspolicypb + +import ( + context "context" + grpc "google.golang.org/grpc" + codes "google.golang.org/grpc/codes" + status "google.golang.org/grpc/status" +) + +// This is a compile-time assertion to ensure that this generated file +// is compatible with the grpc package it is being compiled against. +// Requires gRPC-Go v1.64.0 or later. +const _ = grpc.SupportPackageIsVersion9 + +const ( + Resolver_GetEffectiveEgressPolicy_FullMethodName = "/egresspolicy.Resolver/GetEffectiveEgressPolicy" +) + +// ResolverClient is the client API for Resolver service. +// +// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream. +// +// Resolver is an internal API used only by the egress gateway. +type ResolverClient interface { + GetEffectiveEgressPolicy(ctx context.Context, in *GetEffectiveEgressPolicyRequest, opts ...grpc.CallOption) (*EffectiveEgressPolicy, error) +} + +type resolverClient struct { + cc grpc.ClientConnInterface +} + +func NewResolverClient(cc grpc.ClientConnInterface) ResolverClient { + return &resolverClient{cc} +} + +func (c *resolverClient) GetEffectiveEgressPolicy(ctx context.Context, in *GetEffectiveEgressPolicyRequest, opts ...grpc.CallOption) (*EffectiveEgressPolicy, error) { + cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) + out := new(EffectiveEgressPolicy) + err := c.cc.Invoke(ctx, Resolver_GetEffectiveEgressPolicy_FullMethodName, in, out, cOpts...) + if err != nil { + return nil, err + } + return out, nil +} + +// ResolverServer is the server API for Resolver service. +// All implementations must embed UnimplementedResolverServer +// for forward compatibility. +// +// Resolver is an internal API used only by the egress gateway. +type ResolverServer interface { + GetEffectiveEgressPolicy(context.Context, *GetEffectiveEgressPolicyRequest) (*EffectiveEgressPolicy, error) + mustEmbedUnimplementedResolverServer() +} + +// UnimplementedResolverServer must be embedded to have +// forward compatible implementations. +// +// NOTE: this should be embedded by value instead of pointer to avoid a nil +// pointer dereference when methods are called. +type UnimplementedResolverServer struct{} + +func (UnimplementedResolverServer) GetEffectiveEgressPolicy(context.Context, *GetEffectiveEgressPolicyRequest) (*EffectiveEgressPolicy, error) { + return nil, status.Error(codes.Unimplemented, "method GetEffectiveEgressPolicy not implemented") +} +func (UnimplementedResolverServer) mustEmbedUnimplementedResolverServer() {} +func (UnimplementedResolverServer) testEmbeddedByValue() {} + +// UnsafeResolverServer may be embedded to opt out of forward compatibility for this service. +// Use of this interface is not recommended, as added methods to ResolverServer will +// result in compilation errors. +type UnsafeResolverServer interface { + mustEmbedUnimplementedResolverServer() +} + +func RegisterResolverServer(s grpc.ServiceRegistrar, srv ResolverServer) { + // If the following call panics, it indicates UnimplementedResolverServer was + // embedded by pointer and is nil. This will cause panics if an + // unimplemented method is ever invoked, so we test this at initialization + // time to prevent it from happening at runtime later due to I/O. + if t, ok := srv.(interface{ testEmbeddedByValue() }); ok { + t.testEmbeddedByValue() + } + s.RegisterService(&Resolver_ServiceDesc, srv) +} + +func _Resolver_GetEffectiveEgressPolicy_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { + in := new(GetEffectiveEgressPolicyRequest) + if err := dec(in); err != nil { + return nil, err + } + if interceptor == nil { + return srv.(ResolverServer).GetEffectiveEgressPolicy(ctx, in) + } + info := &grpc.UnaryServerInfo{ + Server: srv, + FullMethod: Resolver_GetEffectiveEgressPolicy_FullMethodName, + } + handler := func(ctx context.Context, req interface{}) (interface{}, error) { + return srv.(ResolverServer).GetEffectiveEgressPolicy(ctx, req.(*GetEffectiveEgressPolicyRequest)) + } + return interceptor(ctx, in, info, handler) +} + +// Resolver_ServiceDesc is the grpc.ServiceDesc for Resolver service. +// It's only intended for direct use with grpc.RegisterService, +// and not to be introspected or modified (even as a copy) +var Resolver_ServiceDesc = grpc.ServiceDesc{ + ServiceName: "egresspolicy.Resolver", + HandlerType: (*ResolverServer)(nil), + Methods: []grpc.MethodDesc{ + { + MethodName: "GetEffectiveEgressPolicy", + Handler: _Resolver_GetEffectiveEgressPolicy_Handler, + }, + }, + Streams: []grpc.StreamDesc{}, + Metadata: "egress_policy.proto", +} diff --git a/internal/proto/egresspolicypb/gen.go b/internal/proto/egresspolicypb/gen.go new file mode 100644 index 0000000000..e18feb0997 --- /dev/null +++ b/internal/proto/egresspolicypb/gen.go @@ -0,0 +1,17 @@ +// Copyright 2026 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package egresspolicypb + +//go:generate bash -c "../../../hack/protoc.sh -I . -I ../../.. --plugin=protoc-gen-go=$(bash ../../../hack/run-tool.sh --print-bin-path protoc-gen-go) --plugin=protoc-gen-go-grpc=$(bash ../../../hack/run-tool.sh --print-bin-path protoc-gen-go-grpc) --go_out=paths=source_relative:. --go-grpc_out=paths=source_relative:. egress_policy.proto" diff --git a/pkg/proto/ateapipb/ateapi.pb.go b/pkg/proto/ateapipb/ateapi.pb.go index 1bdfb5058a..1ddb4e6daf 100644 --- a/pkg/proto/ateapipb/ateapi.pb.go +++ b/pkg/proto/ateapipb/ateapi.pb.go @@ -23,6 +23,7 @@ package ateapipb import ( protoreflect "google.golang.org/protobuf/reflect/protoreflect" protoimpl "google.golang.org/protobuf/runtime/protoimpl" + emptypb "google.golang.org/protobuf/types/known/emptypb" fieldmaskpb "google.golang.org/protobuf/types/known/fieldmaskpb" timestamppb "google.golang.org/protobuf/types/known/timestamppb" reflect "reflect" @@ -913,6 +914,583 @@ func (x *Actor) GetStatus() *ActorStatus { return nil } +// EgressPolicy is a policy document nested under an Actor. All documents for +// an Actor comprise one logical policy and have the same evaluation semantics +// as one document containing their combined rules. V0 permits one implicitly +// named document per Actor. +type EgressPolicy struct { + state protoimpl.MessageState `protogen:"open.v1"` + // Server-assigned revision, increased on every mutation. + Version int64 `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"` + // A request is authorized when at least one rule matches. Effects from all + // matching rules are then applied once per rule. Rule order has no meaning. + // An empty rule list denies all traffic. + Rules []*EgressRule `protobuf:"bytes,2,rep,name=rules,proto3" json:"rules,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *EgressPolicy) Reset() { + *x = EgressPolicy{} + mi := &file_ateapi_proto_msgTypes[5] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *EgressPolicy) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*EgressPolicy) ProtoMessage() {} + +func (x *EgressPolicy) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[5] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use EgressPolicy.ProtoReflect.Descriptor instead. +func (*EgressPolicy) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{5} +} + +func (x *EgressPolicy) GetVersion() int64 { + if x != nil { + return x.Version + } + return 0 +} + +func (x *EgressPolicy) GetRules() []*EgressRule { + if x != nil { + return x.Rules + } + return nil +} + +type EgressRule struct { + state protoimpl.MessageState `protogen:"open.v1"` + // Entries are ORed. The rule matches when any entry matches. + Allow []*EgressMatch `protobuf:"bytes,1,rep,name=allow,proto3" json:"allow,omitempty"` + // Effects do not authorize traffic. They are applied only after at least one + // rule authorizes the request. + Effects *EgressRuleEffects `protobuf:"bytes,2,opt,name=effects,proto3" json:"effects,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *EgressRule) Reset() { + *x = EgressRule{} + mi := &file_ateapi_proto_msgTypes[6] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *EgressRule) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*EgressRule) ProtoMessage() {} + +func (x *EgressRule) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[6] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use EgressRule.ProtoReflect.Descriptor instead. +func (*EgressRule) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{6} +} + +func (x *EgressRule) GetAllow() []*EgressMatch { + if x != nil { + return x.Allow + } + return nil +} + +func (x *EgressRule) GetEffects() *EgressRuleEffects { + if x != nil { + return x.Effects + } + return nil +} + +type EgressMatch struct { + state protoimpl.MessageState `protogen:"open.v1"` + // Types that are valid to be assigned to Predicate: + // + // *EgressMatch_All + // *EgressMatch_Hostname + // *EgressMatch_IpBlock + Predicate isEgressMatch_Predicate `protobuf_oneof:"predicate"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *EgressMatch) Reset() { + *x = EgressMatch{} + mi := &file_ateapi_proto_msgTypes[7] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *EgressMatch) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*EgressMatch) ProtoMessage() {} + +func (x *EgressMatch) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[7] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use EgressMatch.ProtoReflect.Descriptor instead. +func (*EgressMatch) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{7} +} + +func (x *EgressMatch) GetPredicate() isEgressMatch_Predicate { + if x != nil { + return x.Predicate + } + return nil +} + +func (x *EgressMatch) GetAll() *emptypb.Empty { + if x != nil { + if x, ok := x.Predicate.(*EgressMatch_All); ok { + return x.All + } + } + return nil +} + +func (x *EgressMatch) GetHostname() *HostnameMatch { + if x != nil { + if x, ok := x.Predicate.(*EgressMatch_Hostname); ok { + return x.Hostname + } + } + return nil +} + +func (x *EgressMatch) GetIpBlock() *IPBlockMatch { + if x != nil { + if x, ok := x.Predicate.(*EgressMatch_IpBlock); ok { + return x.IpBlock + } + } + return nil +} + +type isEgressMatch_Predicate interface { + isEgressMatch_Predicate() +} + +type EgressMatch_All struct { + All *emptypb.Empty `protobuf:"bytes,1,opt,name=all,proto3,oneof"` +} + +type EgressMatch_Hostname struct { + Hostname *HostnameMatch `protobuf:"bytes,2,opt,name=hostname,proto3,oneof"` +} + +type EgressMatch_IpBlock struct { + IpBlock *IPBlockMatch `protobuf:"bytes,3,opt,name=ip_block,json=ipBlock,proto3,oneof"` +} + +func (*EgressMatch_All) isEgressMatch_Predicate() {} + +func (*EgressMatch_Hostname) isEgressMatch_Predicate() {} + +func (*EgressMatch_IpBlock) isEgressMatch_Predicate() {} + +type HostnameMatch struct { + state protoimpl.MessageState `protogen:"open.v1"` + // An ASCII DNS name, or a wildcard in the complete leftmost label. + // + // The pattern and candidate hostname are normalized to lowercase. One + // trailing dot is permitted and removed. An optional port is removed from an + // HTTP authority before candidate normalization. All labels must be non-empty + // DNS labels of at most 63 characters, containing only ASCII letters, digits, + // and hyphens, and must start and end with a letter or digit. The normalized + // name must be at most 253 characters. + // + // A pattern without a wildcard matches only the complete normalized name. + // "*.example.com" matches exactly one non-empty label, such as + // "api.example.com". It does not match "example.com" or + // "nested.api.example.com". No other wildcard syntax is accepted. + // + // The pattern must not be a URL, IP literal, host:port authority, or Unicode + // U-label. An IP-literal candidate never matches. Internationalized names + // must use their ASCII IDNA A-label form; no Unicode conversion is done. + // Empty labels, malformed authorities, and more than one trailing dot are + // invalid and fail closed. + Pattern string `protobuf:"bytes,1,opt,name=pattern,proto3" json:"pattern,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *HostnameMatch) Reset() { + *x = HostnameMatch{} + mi := &file_ateapi_proto_msgTypes[8] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *HostnameMatch) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*HostnameMatch) ProtoMessage() {} + +func (x *HostnameMatch) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[8] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use HostnameMatch.ProtoReflect.Descriptor instead. +func (*HostnameMatch) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{8} +} + +func (x *HostnameMatch) GetPattern() string { + if x != nil { + return x.Pattern + } + return "" +} + +type IPBlockMatch struct { + state protoimpl.MessageState `protogen:"open.v1"` + // A canonical IPv4 or IPv6 CIDR prefix. The predicate matches when the + // original destination IP belongs to the prefix. + Cidr string `protobuf:"bytes,1,opt,name=cidr,proto3" json:"cidr,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *IPBlockMatch) Reset() { + *x = IPBlockMatch{} + mi := &file_ateapi_proto_msgTypes[9] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *IPBlockMatch) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*IPBlockMatch) ProtoMessage() {} + +func (x *IPBlockMatch) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[9] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use IPBlockMatch.ProtoReflect.Descriptor instead. +func (*IPBlockMatch) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{9} +} + +func (x *IPBlockMatch) GetCidr() string { + if x != nil { + return x.Cidr + } + return "" +} + +type EgressRuleEffects struct { + state protoimpl.MessageState `protogen:"open.v1"` + // These fields are not mutually exclusive. No two effects in a policy may + // target the same case-insensitive header. + InjectStaticHeader []*StaticHeaderInjection `protobuf:"bytes,1,rep,name=inject_static_header,json=injectStaticHeader,proto3" json:"inject_static_header,omitempty"` + InjectActorJwt *ActorTokenInjection `protobuf:"bytes,2,opt,name=inject_actor_jwt,json=injectActorJwt,proto3" json:"inject_actor_jwt,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *EgressRuleEffects) Reset() { + *x = EgressRuleEffects{} + mi := &file_ateapi_proto_msgTypes[10] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *EgressRuleEffects) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*EgressRuleEffects) ProtoMessage() {} + +func (x *EgressRuleEffects) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[10] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use EgressRuleEffects.ProtoReflect.Descriptor instead. +func (*EgressRuleEffects) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{10} +} + +func (x *EgressRuleEffects) GetInjectStaticHeader() []*StaticHeaderInjection { + if x != nil { + return x.InjectStaticHeader + } + return nil +} + +func (x *EgressRuleEffects) GetInjectActorJwt() *ActorTokenInjection { + if x != nil { + return x.InjectActorJwt + } + return nil +} + +type StaticHeaderInjection struct { + state protoimpl.MessageState `protogen:"open.v1"` + Header string `protobuf:"bytes,1,opt,name=header,proto3" json:"header,omitempty"` + // For example, "Bearer " for the Authorization header. + Prefix string `protobuf:"bytes,2,opt,name=prefix,proto3" json:"prefix,omitempty"` + // Source-agnostic reference interpreted by a registered credential provider: + // substrate-secret://// + CredentialUri string `protobuf:"bytes,3,opt,name=credential_uri,json=credentialUri,proto3" json:"credential_uri,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *StaticHeaderInjection) Reset() { + *x = StaticHeaderInjection{} + mi := &file_ateapi_proto_msgTypes[11] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *StaticHeaderInjection) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*StaticHeaderInjection) ProtoMessage() {} + +func (x *StaticHeaderInjection) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[11] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use StaticHeaderInjection.ProtoReflect.Descriptor instead. +func (*StaticHeaderInjection) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{11} +} + +func (x *StaticHeaderInjection) GetHeader() string { + if x != nil { + return x.Header + } + return "" +} + +func (x *StaticHeaderInjection) GetPrefix() string { + if x != nil { + return x.Prefix + } + return "" +} + +func (x *StaticHeaderInjection) GetCredentialUri() string { + if x != nil { + return x.CredentialUri + } + return "" +} + +type ActorTokenInjection struct { + state protoimpl.MessageState `protogen:"open.v1"` + Header string `protobuf:"bytes,1,opt,name=header,proto3" json:"header,omitempty"` + Audiences []string `protobuf:"bytes,2,rep,name=audiences,proto3" json:"audiences,omitempty"` + // When present, exchanges the Actor JWT at an RFC 8693 endpoint and injects + // the result. A returned expires_in value controls caching of the token. + Rfc_8693Exchange *RFC8693ExchangeParameters `protobuf:"bytes,3,opt,name=rfc_8693_exchange,json=rfc8693Exchange,proto3" json:"rfc_8693_exchange,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *ActorTokenInjection) Reset() { + *x = ActorTokenInjection{} + mi := &file_ateapi_proto_msgTypes[12] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *ActorTokenInjection) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*ActorTokenInjection) ProtoMessage() {} + +func (x *ActorTokenInjection) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[12] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use ActorTokenInjection.ProtoReflect.Descriptor instead. +func (*ActorTokenInjection) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{12} +} + +func (x *ActorTokenInjection) GetHeader() string { + if x != nil { + return x.Header + } + return "" +} + +func (x *ActorTokenInjection) GetAudiences() []string { + if x != nil { + return x.Audiences + } + return nil +} + +func (x *ActorTokenInjection) GetRfc_8693Exchange() *RFC8693ExchangeParameters { + if x != nil { + return x.Rfc_8693Exchange + } + return nil +} + +type RFC8693ExchangeParameters struct { + state protoimpl.MessageState `protogen:"open.v1"` + Url string `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"` + Resources []string `protobuf:"bytes,2,rep,name=resources,proto3" json:"resources,omitempty"` + Audiences []string `protobuf:"bytes,3,rep,name=audiences,proto3" json:"audiences,omitempty"` + Scope string `protobuf:"bytes,4,opt,name=scope,proto3" json:"scope,omitempty"` + RequestedTokenType string `protobuf:"bytes,5,opt,name=requested_token_type,json=requestedTokenType,proto3" json:"requested_token_type,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *RFC8693ExchangeParameters) Reset() { + *x = RFC8693ExchangeParameters{} + mi := &file_ateapi_proto_msgTypes[13] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *RFC8693ExchangeParameters) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*RFC8693ExchangeParameters) ProtoMessage() {} + +func (x *RFC8693ExchangeParameters) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[13] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use RFC8693ExchangeParameters.ProtoReflect.Descriptor instead. +func (*RFC8693ExchangeParameters) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{13} +} + +func (x *RFC8693ExchangeParameters) GetUrl() string { + if x != nil { + return x.Url + } + return "" +} + +func (x *RFC8693ExchangeParameters) GetResources() []string { + if x != nil { + return x.Resources + } + return nil +} + +func (x *RFC8693ExchangeParameters) GetAudiences() []string { + if x != nil { + return x.Audiences + } + return nil +} + +func (x *RFC8693ExchangeParameters) GetScope() string { + if x != nil { + return x.Scope + } + return "" +} + +func (x *RFC8693ExchangeParameters) GetRequestedTokenType() string { + if x != nil { + return x.RequestedTokenType + } + return "" +} + type ActorStatus struct { state protoimpl.MessageState `protogen:"open.v1"` State ActorState `protobuf:"varint,1,opt,name=state,proto3,enum=ateapi.ActorState" json:"state,omitempty"` @@ -939,7 +1517,7 @@ type ActorStatus struct { func (x *ActorStatus) Reset() { *x = ActorStatus{} - mi := &file_ateapi_proto_msgTypes[5] + mi := &file_ateapi_proto_msgTypes[14] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -951,7 +1529,7 @@ func (x *ActorStatus) String() string { func (*ActorStatus) ProtoMessage() {} func (x *ActorStatus) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[5] + mi := &file_ateapi_proto_msgTypes[14] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -964,7 +1542,7 @@ func (x *ActorStatus) ProtoReflect() protoreflect.Message { // Deprecated: Use ActorStatus.ProtoReflect.Descriptor instead. func (*ActorStatus) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{5} + return file_ateapi_proto_rawDescGZIP(), []int{14} } func (x *ActorStatus) GetState() ActorState { @@ -1045,7 +1623,7 @@ type ActorSourceSnapshotStatus struct { func (x *ActorSourceSnapshotStatus) Reset() { *x = ActorSourceSnapshotStatus{} - mi := &file_ateapi_proto_msgTypes[6] + mi := &file_ateapi_proto_msgTypes[15] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1057,7 +1635,7 @@ func (x *ActorSourceSnapshotStatus) String() string { func (*ActorSourceSnapshotStatus) ProtoMessage() {} func (x *ActorSourceSnapshotStatus) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[6] + mi := &file_ateapi_proto_msgTypes[15] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1070,7 +1648,7 @@ func (x *ActorSourceSnapshotStatus) ProtoReflect() protoreflect.Message { // Deprecated: Use ActorSourceSnapshotStatus.ProtoReflect.Descriptor instead. func (*ActorSourceSnapshotStatus) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{6} + return file_ateapi_proto_rawDescGZIP(), []int{15} } func (x *ActorSourceSnapshotStatus) GetSnapshot() *ObjectRef { @@ -1120,7 +1698,7 @@ type WorkerAssignment struct { func (x *WorkerAssignment) Reset() { *x = WorkerAssignment{} - mi := &file_ateapi_proto_msgTypes[7] + mi := &file_ateapi_proto_msgTypes[16] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1132,7 +1710,7 @@ func (x *WorkerAssignment) String() string { func (*WorkerAssignment) ProtoMessage() {} func (x *WorkerAssignment) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[7] + mi := &file_ateapi_proto_msgTypes[16] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1145,7 +1723,7 @@ func (x *WorkerAssignment) ProtoReflect() protoreflect.Message { // Deprecated: Use WorkerAssignment.ProtoReflect.Descriptor instead. func (*WorkerAssignment) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{7} + return file_ateapi_proto_rawDescGZIP(), []int{16} } func (x *WorkerAssignment) GetWorker() *ObjectRef { @@ -1202,7 +1780,7 @@ type ActorSnapshot struct { func (x *ActorSnapshot) Reset() { *x = ActorSnapshot{} - mi := &file_ateapi_proto_msgTypes[8] + mi := &file_ateapi_proto_msgTypes[17] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1214,7 +1792,7 @@ func (x *ActorSnapshot) String() string { func (*ActorSnapshot) ProtoMessage() {} func (x *ActorSnapshot) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[8] + mi := &file_ateapi_proto_msgTypes[17] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1227,7 +1805,7 @@ func (x *ActorSnapshot) ProtoReflect() protoreflect.Message { // Deprecated: Use ActorSnapshot.ProtoReflect.Descriptor instead. func (*ActorSnapshot) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{8} + return file_ateapi_proto_rawDescGZIP(), []int{17} } func (x *ActorSnapshot) GetMetadata() *ResourceMetadata { @@ -1262,7 +1840,7 @@ type ActorSnapshotStatus struct { func (x *ActorSnapshotStatus) Reset() { *x = ActorSnapshotStatus{} - mi := &file_ateapi_proto_msgTypes[9] + mi := &file_ateapi_proto_msgTypes[18] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1274,7 +1852,7 @@ func (x *ActorSnapshotStatus) String() string { func (*ActorSnapshotStatus) ProtoMessage() {} func (x *ActorSnapshotStatus) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[9] + mi := &file_ateapi_proto_msgTypes[18] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1287,7 +1865,7 @@ func (x *ActorSnapshotStatus) ProtoReflect() protoreflect.Message { // Deprecated: Use ActorSnapshotStatus.ProtoReflect.Descriptor instead. func (*ActorSnapshotStatus) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{9} + return file_ateapi_proto_rawDescGZIP(), []int{18} } func (x *ActorSnapshotStatus) GetSourceActor() *ObjectRef { @@ -1367,7 +1945,7 @@ type ActorSnapshotTag struct { func (x *ActorSnapshotTag) Reset() { *x = ActorSnapshotTag{} - mi := &file_ateapi_proto_msgTypes[10] + mi := &file_ateapi_proto_msgTypes[19] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1379,7 +1957,7 @@ func (x *ActorSnapshotTag) String() string { func (*ActorSnapshotTag) ProtoMessage() {} func (x *ActorSnapshotTag) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[10] + mi := &file_ateapi_proto_msgTypes[19] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1392,7 +1970,7 @@ func (x *ActorSnapshotTag) ProtoReflect() protoreflect.Message { // Deprecated: Use ActorSnapshotTag.ProtoReflect.Descriptor instead. func (*ActorSnapshotTag) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{10} + return file_ateapi_proto_rawDescGZIP(), []int{19} } func (x *ActorSnapshotTag) GetMetadata() *ResourceMetadata { @@ -1428,7 +2006,7 @@ type Atespace struct { func (x *Atespace) Reset() { *x = Atespace{} - mi := &file_ateapi_proto_msgTypes[11] + mi := &file_ateapi_proto_msgTypes[20] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1440,7 +2018,7 @@ func (x *Atespace) String() string { func (*Atespace) ProtoMessage() {} func (x *Atespace) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[11] + mi := &file_ateapi_proto_msgTypes[20] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1453,7 +2031,7 @@ func (x *Atespace) ProtoReflect() protoreflect.Message { // Deprecated: Use Atespace.ProtoReflect.Descriptor instead. func (*Atespace) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{11} + return file_ateapi_proto_rawDescGZIP(), []int{20} } func (x *Atespace) GetMetadata() *ResourceMetadata { @@ -1477,7 +2055,7 @@ type ObjectRef struct { func (x *ObjectRef) Reset() { *x = ObjectRef{} - mi := &file_ateapi_proto_msgTypes[12] + mi := &file_ateapi_proto_msgTypes[21] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1489,7 +2067,7 @@ func (x *ObjectRef) String() string { func (*ObjectRef) ProtoMessage() {} func (x *ObjectRef) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[12] + mi := &file_ateapi_proto_msgTypes[21] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1502,7 +2080,7 @@ func (x *ObjectRef) ProtoReflect() protoreflect.Message { // Deprecated: Use ObjectRef.ProtoReflect.Descriptor instead. func (*ObjectRef) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{12} + return file_ateapi_proto_rawDescGZIP(), []int{21} } func (x *ObjectRef) GetAtespace() string { @@ -1540,7 +2118,7 @@ type ActorTemplate struct { func (x *ActorTemplate) Reset() { *x = ActorTemplate{} - mi := &file_ateapi_proto_msgTypes[13] + mi := &file_ateapi_proto_msgTypes[22] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1552,7 +2130,7 @@ func (x *ActorTemplate) String() string { func (*ActorTemplate) ProtoMessage() {} func (x *ActorTemplate) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[13] + mi := &file_ateapi_proto_msgTypes[22] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1565,7 +2143,7 @@ func (x *ActorTemplate) ProtoReflect() protoreflect.Message { // Deprecated: Use ActorTemplate.ProtoReflect.Descriptor instead. func (*ActorTemplate) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{13} + return file_ateapi_proto_rawDescGZIP(), []int{22} } func (x *ActorTemplate) GetMetadata() *ResourceMetadata { @@ -1633,7 +2211,7 @@ type Resources struct { func (x *Resources) Reset() { *x = Resources{} - mi := &file_ateapi_proto_msgTypes[14] + mi := &file_ateapi_proto_msgTypes[23] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1645,7 +2223,7 @@ func (x *Resources) String() string { func (*Resources) ProtoMessage() {} func (x *Resources) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[14] + mi := &file_ateapi_proto_msgTypes[23] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1658,7 +2236,7 @@ func (x *Resources) ProtoReflect() protoreflect.Message { // Deprecated: Use Resources.ProtoReflect.Descriptor instead. func (*Resources) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{14} + return file_ateapi_proto_rawDescGZIP(), []int{23} } func (x *Resources) GetLimits() []*Limits { @@ -1678,7 +2256,7 @@ type Limits struct { func (x *Limits) Reset() { *x = Limits{} - mi := &file_ateapi_proto_msgTypes[15] + mi := &file_ateapi_proto_msgTypes[24] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1690,7 +2268,7 @@ func (x *Limits) String() string { func (*Limits) ProtoMessage() {} func (x *Limits) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[15] + mi := &file_ateapi_proto_msgTypes[24] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1703,7 +2281,7 @@ func (x *Limits) ProtoReflect() protoreflect.Message { // Deprecated: Use Limits.ProtoReflect.Descriptor instead. func (*Limits) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{15} + return file_ateapi_proto_rawDescGZIP(), []int{24} } func (x *Limits) GetName() string { @@ -1742,7 +2320,7 @@ type ActorTemplateStatus struct { func (x *ActorTemplateStatus) Reset() { *x = ActorTemplateStatus{} - mi := &file_ateapi_proto_msgTypes[16] + mi := &file_ateapi_proto_msgTypes[25] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1754,7 +2332,7 @@ func (x *ActorTemplateStatus) String() string { func (*ActorTemplateStatus) ProtoMessage() {} func (x *ActorTemplateStatus) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[16] + mi := &file_ateapi_proto_msgTypes[25] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1767,7 +2345,7 @@ func (x *ActorTemplateStatus) ProtoReflect() protoreflect.Message { // Deprecated: Use ActorTemplateStatus.ProtoReflect.Descriptor instead. func (*ActorTemplateStatus) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{16} + return file_ateapi_proto_rawDescGZIP(), []int{25} } func (x *ActorTemplateStatus) GetPhase() ActorTemplatePhase { @@ -1813,7 +2391,7 @@ type SandboxConfig struct { func (x *SandboxConfig) Reset() { *x = SandboxConfig{} - mi := &file_ateapi_proto_msgTypes[17] + mi := &file_ateapi_proto_msgTypes[26] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1825,7 +2403,7 @@ func (x *SandboxConfig) String() string { func (*SandboxConfig) ProtoMessage() {} func (x *SandboxConfig) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[17] + mi := &file_ateapi_proto_msgTypes[26] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1838,7 +2416,7 @@ func (x *SandboxConfig) ProtoReflect() protoreflect.Message { // Deprecated: Use SandboxConfig.ProtoReflect.Descriptor instead. func (*SandboxConfig) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{17} + return file_ateapi_proto_rawDescGZIP(), []int{26} } func (x *SandboxConfig) GetSandboxClass() SandboxClass { @@ -1874,7 +2452,7 @@ type SnapshotsConfig struct { func (x *SnapshotsConfig) Reset() { *x = SnapshotsConfig{} - mi := &file_ateapi_proto_msgTypes[18] + mi := &file_ateapi_proto_msgTypes[27] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1886,7 +2464,7 @@ func (x *SnapshotsConfig) String() string { func (*SnapshotsConfig) ProtoMessage() {} func (x *SnapshotsConfig) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[18] + mi := &file_ateapi_proto_msgTypes[27] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1899,7 +2477,7 @@ func (x *SnapshotsConfig) ProtoReflect() protoreflect.Message { // Deprecated: Use SnapshotsConfig.ProtoReflect.Descriptor instead. func (*SnapshotsConfig) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{18} + return file_ateapi_proto_rawDescGZIP(), []int{27} } func (x *SnapshotsConfig) GetOnPause() SnapshotContentScope { @@ -1945,7 +2523,7 @@ type OnResumeConfig struct { func (x *OnResumeConfig) Reset() { *x = OnResumeConfig{} - mi := &file_ateapi_proto_msgTypes[19] + mi := &file_ateapi_proto_msgTypes[28] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1957,7 +2535,7 @@ func (x *OnResumeConfig) String() string { func (*OnResumeConfig) ProtoMessage() {} func (x *OnResumeConfig) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[19] + mi := &file_ateapi_proto_msgTypes[28] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1970,7 +2548,7 @@ func (x *OnResumeConfig) ProtoReflect() protoreflect.Message { // Deprecated: Use OnResumeConfig.ProtoReflect.Descriptor instead. func (*OnResumeConfig) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{19} + return file_ateapi_proto_rawDescGZIP(), []int{28} } func (x *OnResumeConfig) GetFromData() ResumeSource { @@ -2003,7 +2581,7 @@ type Container struct { func (x *Container) Reset() { *x = Container{} - mi := &file_ateapi_proto_msgTypes[20] + mi := &file_ateapi_proto_msgTypes[29] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2015,7 +2593,7 @@ func (x *Container) String() string { func (*Container) ProtoMessage() {} func (x *Container) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[20] + mi := &file_ateapi_proto_msgTypes[29] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2028,7 +2606,7 @@ func (x *Container) ProtoReflect() protoreflect.Message { // Deprecated: Use Container.ProtoReflect.Descriptor instead. func (*Container) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{20} + return file_ateapi_proto_rawDescGZIP(), []int{29} } func (x *Container) GetName() string { @@ -2094,7 +2672,7 @@ type EnvVar struct { func (x *EnvVar) Reset() { *x = EnvVar{} - mi := &file_ateapi_proto_msgTypes[21] + mi := &file_ateapi_proto_msgTypes[30] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2106,7 +2684,7 @@ func (x *EnvVar) String() string { func (*EnvVar) ProtoMessage() {} func (x *EnvVar) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[21] + mi := &file_ateapi_proto_msgTypes[30] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2119,7 +2697,7 @@ func (x *EnvVar) ProtoReflect() protoreflect.Message { // Deprecated: Use EnvVar.ProtoReflect.Descriptor instead. func (*EnvVar) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{21} + return file_ateapi_proto_rawDescGZIP(), []int{30} } func (x *EnvVar) GetName() string { @@ -2150,7 +2728,7 @@ type ContainerReadyz struct { func (x *ContainerReadyz) Reset() { *x = ContainerReadyz{} - mi := &file_ateapi_proto_msgTypes[22] + mi := &file_ateapi_proto_msgTypes[31] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2162,7 +2740,7 @@ func (x *ContainerReadyz) String() string { func (*ContainerReadyz) ProtoMessage() {} func (x *ContainerReadyz) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[22] + mi := &file_ateapi_proto_msgTypes[31] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2175,7 +2753,7 @@ func (x *ContainerReadyz) ProtoReflect() protoreflect.Message { // Deprecated: Use ContainerReadyz.ProtoReflect.Descriptor instead. func (*ContainerReadyz) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{22} + return file_ateapi_proto_rawDescGZIP(), []int{31} } func (x *ContainerReadyz) GetHttpGet() *HTTPGetAction { @@ -2204,7 +2782,7 @@ type HTTPGetAction struct { func (x *HTTPGetAction) Reset() { *x = HTTPGetAction{} - mi := &file_ateapi_proto_msgTypes[23] + mi := &file_ateapi_proto_msgTypes[32] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2216,7 +2794,7 @@ func (x *HTTPGetAction) String() string { func (*HTTPGetAction) ProtoMessage() {} func (x *HTTPGetAction) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[23] + mi := &file_ateapi_proto_msgTypes[32] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2229,7 +2807,7 @@ func (x *HTTPGetAction) ProtoReflect() protoreflect.Message { // Deprecated: Use HTTPGetAction.ProtoReflect.Descriptor instead. func (*HTTPGetAction) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{23} + return file_ateapi_proto_rawDescGZIP(), []int{32} } func (x *HTTPGetAction) GetPath() string { @@ -2262,7 +2840,7 @@ type Volume struct { func (x *Volume) Reset() { *x = Volume{} - mi := &file_ateapi_proto_msgTypes[24] + mi := &file_ateapi_proto_msgTypes[33] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2274,7 +2852,7 @@ func (x *Volume) String() string { func (*Volume) ProtoMessage() {} func (x *Volume) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[24] + mi := &file_ateapi_proto_msgTypes[33] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2287,7 +2865,7 @@ func (x *Volume) ProtoReflect() protoreflect.Message { // Deprecated: Use Volume.ProtoReflect.Descriptor instead. func (*Volume) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{24} + return file_ateapi_proto_rawDescGZIP(), []int{33} } func (x *Volume) GetName() string { @@ -2328,7 +2906,7 @@ type DurableDirVolumeSource struct { func (x *DurableDirVolumeSource) Reset() { *x = DurableDirVolumeSource{} - mi := &file_ateapi_proto_msgTypes[25] + mi := &file_ateapi_proto_msgTypes[34] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2340,7 +2918,7 @@ func (x *DurableDirVolumeSource) String() string { func (*DurableDirVolumeSource) ProtoMessage() {} func (x *DurableDirVolumeSource) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[25] + mi := &file_ateapi_proto_msgTypes[34] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2353,7 +2931,7 @@ func (x *DurableDirVolumeSource) ProtoReflect() protoreflect.Message { // Deprecated: Use DurableDirVolumeSource.ProtoReflect.Descriptor instead. func (*DurableDirVolumeSource) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{25} + return file_ateapi_proto_rawDescGZIP(), []int{34} } // ExternalVolumeTemplate provisions an external volume per actor; the volume @@ -2372,7 +2950,7 @@ type ExternalVolumeTemplate struct { func (x *ExternalVolumeTemplate) Reset() { *x = ExternalVolumeTemplate{} - mi := &file_ateapi_proto_msgTypes[26] + mi := &file_ateapi_proto_msgTypes[35] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2384,7 +2962,7 @@ func (x *ExternalVolumeTemplate) String() string { func (*ExternalVolumeTemplate) ProtoMessage() {} func (x *ExternalVolumeTemplate) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[26] + mi := &file_ateapi_proto_msgTypes[35] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2397,7 +2975,7 @@ func (x *ExternalVolumeTemplate) ProtoReflect() protoreflect.Message { // Deprecated: Use ExternalVolumeTemplate.ProtoReflect.Descriptor instead. func (*ExternalVolumeTemplate) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{26} + return file_ateapi_proto_rawDescGZIP(), []int{35} } func (x *ExternalVolumeTemplate) GetCapacity() string { @@ -2427,7 +3005,7 @@ type VolumeMount struct { func (x *VolumeMount) Reset() { *x = VolumeMount{} - mi := &file_ateapi_proto_msgTypes[27] + mi := &file_ateapi_proto_msgTypes[36] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2439,7 +3017,7 @@ func (x *VolumeMount) String() string { func (*VolumeMount) ProtoMessage() {} func (x *VolumeMount) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[27] + mi := &file_ateapi_proto_msgTypes[36] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2452,7 +3030,7 @@ func (x *VolumeMount) ProtoReflect() protoreflect.Message { // Deprecated: Use VolumeMount.ProtoReflect.Descriptor instead. func (*VolumeMount) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{27} + return file_ateapi_proto_rawDescGZIP(), []int{36} } func (x *VolumeMount) GetName() string { @@ -2486,7 +3064,7 @@ type SandboxAssets struct { func (x *SandboxAssets) Reset() { *x = SandboxAssets{} - mi := &file_ateapi_proto_msgTypes[28] + mi := &file_ateapi_proto_msgTypes[37] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2498,7 +3076,7 @@ func (x *SandboxAssets) String() string { func (*SandboxAssets) ProtoMessage() {} func (x *SandboxAssets) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[28] + mi := &file_ateapi_proto_msgTypes[37] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2511,7 +3089,7 @@ func (x *SandboxAssets) ProtoReflect() protoreflect.Message { // Deprecated: Use SandboxAssets.ProtoReflect.Descriptor instead. func (*SandboxAssets) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{28} + return file_ateapi_proto_rawDescGZIP(), []int{37} } func (x *SandboxAssets) GetSandboxClass() SandboxClass { @@ -2545,7 +3123,7 @@ type ArchAssets struct { func (x *ArchAssets) Reset() { *x = ArchAssets{} - mi := &file_ateapi_proto_msgTypes[29] + mi := &file_ateapi_proto_msgTypes[38] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2557,7 +3135,7 @@ func (x *ArchAssets) String() string { func (*ArchAssets) ProtoMessage() {} func (x *ArchAssets) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[29] + mi := &file_ateapi_proto_msgTypes[38] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2570,7 +3148,7 @@ func (x *ArchAssets) ProtoReflect() protoreflect.Message { // Deprecated: Use ArchAssets.ProtoReflect.Descriptor instead. func (*ArchAssets) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{29} + return file_ateapi_proto_rawDescGZIP(), []int{38} } func (x *ArchAssets) GetFiles() map[string]*AssetFile { @@ -2594,7 +3172,7 @@ type AssetFile struct { func (x *AssetFile) Reset() { *x = AssetFile{} - mi := &file_ateapi_proto_msgTypes[30] + mi := &file_ateapi_proto_msgTypes[39] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2606,7 +3184,7 @@ func (x *AssetFile) String() string { func (*AssetFile) ProtoMessage() {} func (x *AssetFile) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[30] + mi := &file_ateapi_proto_msgTypes[39] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2619,7 +3197,7 @@ func (x *AssetFile) ProtoReflect() protoreflect.Message { // Deprecated: Use AssetFile.ProtoReflect.Descriptor instead. func (*AssetFile) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{30} + return file_ateapi_proto_rawDescGZIP(), []int{39} } func (x *AssetFile) GetUrl() string { @@ -2646,7 +3224,7 @@ type CreateAtespaceRequest struct { func (x *CreateAtespaceRequest) Reset() { *x = CreateAtespaceRequest{} - mi := &file_ateapi_proto_msgTypes[31] + mi := &file_ateapi_proto_msgTypes[40] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2658,7 +3236,7 @@ func (x *CreateAtespaceRequest) String() string { func (*CreateAtespaceRequest) ProtoMessage() {} func (x *CreateAtespaceRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[31] + mi := &file_ateapi_proto_msgTypes[40] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2671,7 +3249,7 @@ func (x *CreateAtespaceRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use CreateAtespaceRequest.ProtoReflect.Descriptor instead. func (*CreateAtespaceRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{31} + return file_ateapi_proto_rawDescGZIP(), []int{40} } func (x *CreateAtespaceRequest) GetAtespace() *Atespace { @@ -2690,7 +3268,7 @@ type GetAtespaceRequest struct { func (x *GetAtespaceRequest) Reset() { *x = GetAtespaceRequest{} - mi := &file_ateapi_proto_msgTypes[32] + mi := &file_ateapi_proto_msgTypes[41] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2702,7 +3280,7 @@ func (x *GetAtespaceRequest) String() string { func (*GetAtespaceRequest) ProtoMessage() {} func (x *GetAtespaceRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[32] + mi := &file_ateapi_proto_msgTypes[41] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2715,7 +3293,7 @@ func (x *GetAtespaceRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetAtespaceRequest.ProtoReflect.Descriptor instead. func (*GetAtespaceRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{32} + return file_ateapi_proto_rawDescGZIP(), []int{41} } func (x *GetAtespaceRequest) GetAtespace() *ObjectRef { @@ -2740,7 +3318,7 @@ type ListAtespacesRequest struct { func (x *ListAtespacesRequest) Reset() { *x = ListAtespacesRequest{} - mi := &file_ateapi_proto_msgTypes[33] + mi := &file_ateapi_proto_msgTypes[42] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2752,7 +3330,7 @@ func (x *ListAtespacesRequest) String() string { func (*ListAtespacesRequest) ProtoMessage() {} func (x *ListAtespacesRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[33] + mi := &file_ateapi_proto_msgTypes[42] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2765,7 +3343,7 @@ func (x *ListAtespacesRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ListAtespacesRequest.ProtoReflect.Descriptor instead. func (*ListAtespacesRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{33} + return file_ateapi_proto_rawDescGZIP(), []int{42} } func (x *ListAtespacesRequest) GetPageSize() int32 { @@ -2794,7 +3372,7 @@ type ListAtespacesResponse struct { func (x *ListAtespacesResponse) Reset() { *x = ListAtespacesResponse{} - mi := &file_ateapi_proto_msgTypes[34] + mi := &file_ateapi_proto_msgTypes[43] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2806,7 +3384,7 @@ func (x *ListAtespacesResponse) String() string { func (*ListAtespacesResponse) ProtoMessage() {} func (x *ListAtespacesResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[34] + mi := &file_ateapi_proto_msgTypes[43] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2819,7 +3397,7 @@ func (x *ListAtespacesResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ListAtespacesResponse.ProtoReflect.Descriptor instead. func (*ListAtespacesResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{34} + return file_ateapi_proto_rawDescGZIP(), []int{43} } func (x *ListAtespacesResponse) GetAtespaces() []*Atespace { @@ -2845,7 +3423,7 @@ type DeleteAtespaceRequest struct { func (x *DeleteAtespaceRequest) Reset() { *x = DeleteAtespaceRequest{} - mi := &file_ateapi_proto_msgTypes[35] + mi := &file_ateapi_proto_msgTypes[44] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2857,7 +3435,7 @@ func (x *DeleteAtespaceRequest) String() string { func (*DeleteAtespaceRequest) ProtoMessage() {} func (x *DeleteAtespaceRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[35] + mi := &file_ateapi_proto_msgTypes[44] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2870,7 +3448,7 @@ func (x *DeleteAtespaceRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteAtespaceRequest.ProtoReflect.Descriptor instead. func (*DeleteAtespaceRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{35} + return file_ateapi_proto_rawDescGZIP(), []int{44} } func (x *DeleteAtespaceRequest) GetAtespace() *ObjectRef { @@ -2892,7 +3470,7 @@ type CreateActorTemplateRequest struct { func (x *CreateActorTemplateRequest) Reset() { *x = CreateActorTemplateRequest{} - mi := &file_ateapi_proto_msgTypes[36] + mi := &file_ateapi_proto_msgTypes[45] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2904,7 +3482,7 @@ func (x *CreateActorTemplateRequest) String() string { func (*CreateActorTemplateRequest) ProtoMessage() {} func (x *CreateActorTemplateRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[36] + mi := &file_ateapi_proto_msgTypes[45] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2917,7 +3495,7 @@ func (x *CreateActorTemplateRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use CreateActorTemplateRequest.ProtoReflect.Descriptor instead. func (*CreateActorTemplateRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{36} + return file_ateapi_proto_rawDescGZIP(), []int{45} } func (x *CreateActorTemplateRequest) GetActorTemplate() *ActorTemplate { @@ -2936,7 +3514,7 @@ type GetActorTemplateRequest struct { func (x *GetActorTemplateRequest) Reset() { *x = GetActorTemplateRequest{} - mi := &file_ateapi_proto_msgTypes[37] + mi := &file_ateapi_proto_msgTypes[46] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2948,7 +3526,7 @@ func (x *GetActorTemplateRequest) String() string { func (*GetActorTemplateRequest) ProtoMessage() {} func (x *GetActorTemplateRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[37] + mi := &file_ateapi_proto_msgTypes[46] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2961,7 +3539,7 @@ func (x *GetActorTemplateRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetActorTemplateRequest.ProtoReflect.Descriptor instead. func (*GetActorTemplateRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{37} + return file_ateapi_proto_rawDescGZIP(), []int{46} } func (x *GetActorTemplateRequest) GetActorTemplate() *ObjectRef { @@ -2989,7 +3567,7 @@ type ListActorTemplatesRequest struct { func (x *ListActorTemplatesRequest) Reset() { *x = ListActorTemplatesRequest{} - mi := &file_ateapi_proto_msgTypes[38] + mi := &file_ateapi_proto_msgTypes[47] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -3001,7 +3579,7 @@ func (x *ListActorTemplatesRequest) String() string { func (*ListActorTemplatesRequest) ProtoMessage() {} func (x *ListActorTemplatesRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[38] + mi := &file_ateapi_proto_msgTypes[47] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -3014,7 +3592,7 @@ func (x *ListActorTemplatesRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ListActorTemplatesRequest.ProtoReflect.Descriptor instead. func (*ListActorTemplatesRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{38} + return file_ateapi_proto_rawDescGZIP(), []int{47} } func (x *ListActorTemplatesRequest) GetAtespace() string { @@ -3051,7 +3629,7 @@ type ListActorTemplatesResponse struct { func (x *ListActorTemplatesResponse) Reset() { *x = ListActorTemplatesResponse{} - mi := &file_ateapi_proto_msgTypes[39] + mi := &file_ateapi_proto_msgTypes[48] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -3063,7 +3641,7 @@ func (x *ListActorTemplatesResponse) String() string { func (*ListActorTemplatesResponse) ProtoMessage() {} func (x *ListActorTemplatesResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[39] + mi := &file_ateapi_proto_msgTypes[48] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -3076,7 +3654,7 @@ func (x *ListActorTemplatesResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ListActorTemplatesResponse.ProtoReflect.Descriptor instead. func (*ListActorTemplatesResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{39} + return file_ateapi_proto_rawDescGZIP(), []int{48} } func (x *ListActorTemplatesResponse) GetActorTemplates() []*ActorTemplate { @@ -3102,7 +3680,7 @@ type DeleteActorTemplateRequest struct { func (x *DeleteActorTemplateRequest) Reset() { *x = DeleteActorTemplateRequest{} - mi := &file_ateapi_proto_msgTypes[40] + mi := &file_ateapi_proto_msgTypes[49] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -3114,7 +3692,7 @@ func (x *DeleteActorTemplateRequest) String() string { func (*DeleteActorTemplateRequest) ProtoMessage() {} func (x *DeleteActorTemplateRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[40] + mi := &file_ateapi_proto_msgTypes[49] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -3127,7 +3705,7 @@ func (x *DeleteActorTemplateRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteActorTemplateRequest.ProtoReflect.Descriptor instead. func (*DeleteActorTemplateRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{40} + return file_ateapi_proto_rawDescGZIP(), []int{49} } func (x *DeleteActorTemplateRequest) GetActorTemplate() *ObjectRef { @@ -3146,7 +3724,7 @@ type GetActorRequest struct { func (x *GetActorRequest) Reset() { *x = GetActorRequest{} - mi := &file_ateapi_proto_msgTypes[41] + mi := &file_ateapi_proto_msgTypes[50] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -3158,7 +3736,7 @@ func (x *GetActorRequest) String() string { func (*GetActorRequest) ProtoMessage() {} func (x *GetActorRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[41] + mi := &file_ateapi_proto_msgTypes[50] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -3171,7 +3749,7 @@ func (x *GetActorRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetActorRequest.ProtoReflect.Descriptor instead. func (*GetActorRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{41} + return file_ateapi_proto_rawDescGZIP(), []int{50} } func (x *GetActorRequest) GetActor() *ObjectRef { @@ -3192,7 +3770,7 @@ type CreateActorRequest struct { func (x *CreateActorRequest) Reset() { *x = CreateActorRequest{} - mi := &file_ateapi_proto_msgTypes[42] + mi := &file_ateapi_proto_msgTypes[51] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -3204,7 +3782,7 @@ func (x *CreateActorRequest) String() string { func (*CreateActorRequest) ProtoMessage() {} func (x *CreateActorRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[42] + mi := &file_ateapi_proto_msgTypes[51] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -3217,7 +3795,7 @@ func (x *CreateActorRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use CreateActorRequest.ProtoReflect.Descriptor instead. func (*CreateActorRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{42} + return file_ateapi_proto_rawDescGZIP(), []int{51} } func (x *CreateActorRequest) GetActor() *Actor { @@ -3248,7 +3826,7 @@ type UpdateActorRequest struct { func (x *UpdateActorRequest) Reset() { *x = UpdateActorRequest{} - mi := &file_ateapi_proto_msgTypes[43] + mi := &file_ateapi_proto_msgTypes[52] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -3260,7 +3838,7 @@ func (x *UpdateActorRequest) String() string { func (*UpdateActorRequest) ProtoMessage() {} func (x *UpdateActorRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[43] + mi := &file_ateapi_proto_msgTypes[52] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -3273,7 +3851,7 @@ func (x *UpdateActorRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use UpdateActorRequest.ProtoReflect.Descriptor instead. func (*UpdateActorRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{43} + return file_ateapi_proto_rawDescGZIP(), []int{52} } func (x *UpdateActorRequest) GetActor() *Actor { @@ -3299,7 +3877,7 @@ type SuspendActorRequest struct { func (x *SuspendActorRequest) Reset() { *x = SuspendActorRequest{} - mi := &file_ateapi_proto_msgTypes[44] + mi := &file_ateapi_proto_msgTypes[53] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -3311,7 +3889,7 @@ func (x *SuspendActorRequest) String() string { func (*SuspendActorRequest) ProtoMessage() {} func (x *SuspendActorRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[44] + mi := &file_ateapi_proto_msgTypes[53] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -3324,7 +3902,7 @@ func (x *SuspendActorRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use SuspendActorRequest.ProtoReflect.Descriptor instead. func (*SuspendActorRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{44} + return file_ateapi_proto_rawDescGZIP(), []int{53} } func (x *SuspendActorRequest) GetActor() *ObjectRef { @@ -3343,7 +3921,7 @@ type SuspendActorResponse struct { func (x *SuspendActorResponse) Reset() { *x = SuspendActorResponse{} - mi := &file_ateapi_proto_msgTypes[45] + mi := &file_ateapi_proto_msgTypes[54] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -3355,7 +3933,7 @@ func (x *SuspendActorResponse) String() string { func (*SuspendActorResponse) ProtoMessage() {} func (x *SuspendActorResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[45] + mi := &file_ateapi_proto_msgTypes[54] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -3368,7 +3946,7 @@ func (x *SuspendActorResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use SuspendActorResponse.ProtoReflect.Descriptor instead. func (*SuspendActorResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{45} + return file_ateapi_proto_rawDescGZIP(), []int{54} } func (x *SuspendActorResponse) GetActor() *Actor { @@ -3385,21 +3963,217 @@ type PauseActorRequest struct { sizeCache protoimpl.SizeCache } -func (x *PauseActorRequest) Reset() { - *x = PauseActorRequest{} - mi := &file_ateapi_proto_msgTypes[46] +func (x *PauseActorRequest) Reset() { + *x = PauseActorRequest{} + mi := &file_ateapi_proto_msgTypes[55] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *PauseActorRequest) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*PauseActorRequest) ProtoMessage() {} + +func (x *PauseActorRequest) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[55] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use PauseActorRequest.ProtoReflect.Descriptor instead. +func (*PauseActorRequest) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{55} +} + +func (x *PauseActorRequest) GetActor() *ObjectRef { + if x != nil { + return x.Actor + } + return nil +} + +type PauseActorResponse struct { + state protoimpl.MessageState `protogen:"open.v1"` + Actor *Actor `protobuf:"bytes,1,opt,name=actor,proto3" json:"actor,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *PauseActorResponse) Reset() { + *x = PauseActorResponse{} + mi := &file_ateapi_proto_msgTypes[56] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *PauseActorResponse) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*PauseActorResponse) ProtoMessage() {} + +func (x *PauseActorResponse) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[56] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use PauseActorResponse.ProtoReflect.Descriptor instead. +func (*PauseActorResponse) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{56} +} + +func (x *PauseActorResponse) GetActor() *Actor { + if x != nil { + return x.Actor + } + return nil +} + +type ResumeActorRequest struct { + state protoimpl.MessageState `protogen:"open.v1"` + Actor *ObjectRef `protobuf:"bytes,1,opt,name=actor,proto3" json:"actor,omitempty"` + // If true, skip golden snapshot and boot the workload from scratch. + Boot bool `protobuf:"varint,2,opt,name=boot,proto3" json:"boot,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *ResumeActorRequest) Reset() { + *x = ResumeActorRequest{} + mi := &file_ateapi_proto_msgTypes[57] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *ResumeActorRequest) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*ResumeActorRequest) ProtoMessage() {} + +func (x *ResumeActorRequest) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[57] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use ResumeActorRequest.ProtoReflect.Descriptor instead. +func (*ResumeActorRequest) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{57} +} + +func (x *ResumeActorRequest) GetActor() *ObjectRef { + if x != nil { + return x.Actor + } + return nil +} + +func (x *ResumeActorRequest) GetBoot() bool { + if x != nil { + return x.Boot + } + return false +} + +type ResumeActorResponse struct { + state protoimpl.MessageState `protogen:"open.v1"` + Actor *Actor `protobuf:"bytes,1,opt,name=actor,proto3" json:"actor,omitempty"` + // True if a resume workflow was executed to activate the actor. + // False if the actor was already RUNNING. + Resumed bool `protobuf:"varint,2,opt,name=resumed,proto3" json:"resumed,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *ResumeActorResponse) Reset() { + *x = ResumeActorResponse{} + mi := &file_ateapi_proto_msgTypes[58] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *ResumeActorResponse) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*ResumeActorResponse) ProtoMessage() {} + +func (x *ResumeActorResponse) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[58] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use ResumeActorResponse.ProtoReflect.Descriptor instead. +func (*ResumeActorResponse) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{58} +} + +func (x *ResumeActorResponse) GetActor() *Actor { + if x != nil { + return x.Actor + } + return nil +} + +func (x *ResumeActorResponse) GetResumed() bool { + if x != nil { + return x.Resumed + } + return false +} + +type DeleteActorRequest struct { + state protoimpl.MessageState `protogen:"open.v1"` + Actor *ObjectRef `protobuf:"bytes,1,opt,name=actor,proto3" json:"actor,omitempty"` + AnyState bool `protobuf:"varint,2,opt,name=any_state,json=anyState,proto3" json:"any_state,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *DeleteActorRequest) Reset() { + *x = DeleteActorRequest{} + mi := &file_ateapi_proto_msgTypes[59] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } -func (x *PauseActorRequest) String() string { +func (x *DeleteActorRequest) String() string { return protoimpl.X.MessageStringOf(x) } -func (*PauseActorRequest) ProtoMessage() {} +func (*DeleteActorRequest) ProtoMessage() {} -func (x *PauseActorRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[46] +func (x *DeleteActorRequest) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[59] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -3410,40 +4184,47 @@ func (x *PauseActorRequest) ProtoReflect() protoreflect.Message { return mi.MessageOf(x) } -// Deprecated: Use PauseActorRequest.ProtoReflect.Descriptor instead. -func (*PauseActorRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{46} +// Deprecated: Use DeleteActorRequest.ProtoReflect.Descriptor instead. +func (*DeleteActorRequest) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{59} } -func (x *PauseActorRequest) GetActor() *ObjectRef { +func (x *DeleteActorRequest) GetActor() *ObjectRef { if x != nil { return x.Actor } return nil } -type PauseActorResponse struct { +func (x *DeleteActorRequest) GetAnyState() bool { + if x != nil { + return x.AnyState + } + return false +} + +type GetActorEgressPolicyRequest struct { state protoimpl.MessageState `protogen:"open.v1"` - Actor *Actor `protobuf:"bytes,1,opt,name=actor,proto3" json:"actor,omitempty"` + Actor *ObjectRef `protobuf:"bytes,1,opt,name=actor,proto3" json:"actor,omitempty"` unknownFields protoimpl.UnknownFields sizeCache protoimpl.SizeCache } -func (x *PauseActorResponse) Reset() { - *x = PauseActorResponse{} - mi := &file_ateapi_proto_msgTypes[47] +func (x *GetActorEgressPolicyRequest) Reset() { + *x = GetActorEgressPolicyRequest{} + mi := &file_ateapi_proto_msgTypes[60] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } -func (x *PauseActorResponse) String() string { +func (x *GetActorEgressPolicyRequest) String() string { return protoimpl.X.MessageStringOf(x) } -func (*PauseActorResponse) ProtoMessage() {} +func (*GetActorEgressPolicyRequest) ProtoMessage() {} -func (x *PauseActorResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[47] +func (x *GetActorEgressPolicyRequest) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[60] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -3454,42 +4235,41 @@ func (x *PauseActorResponse) ProtoReflect() protoreflect.Message { return mi.MessageOf(x) } -// Deprecated: Use PauseActorResponse.ProtoReflect.Descriptor instead. -func (*PauseActorResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{47} +// Deprecated: Use GetActorEgressPolicyRequest.ProtoReflect.Descriptor instead. +func (*GetActorEgressPolicyRequest) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{60} } -func (x *PauseActorResponse) GetActor() *Actor { +func (x *GetActorEgressPolicyRequest) GetActor() *ObjectRef { if x != nil { return x.Actor } return nil } -type ResumeActorRequest struct { +type GetActorEgressPolicyResponse struct { state protoimpl.MessageState `protogen:"open.v1"` - Actor *ObjectRef `protobuf:"bytes,1,opt,name=actor,proto3" json:"actor,omitempty"` - // If true, skip golden snapshot and boot the workload from scratch. - Boot bool `protobuf:"varint,2,opt,name=boot,proto3" json:"boot,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache + // Empty when the Actor has no policy. V0 returns at most one document. + EgressPolicies []*EgressPolicy `protobuf:"bytes,1,rep,name=egress_policies,json=egressPolicies,proto3" json:"egress_policies,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache } -func (x *ResumeActorRequest) Reset() { - *x = ResumeActorRequest{} - mi := &file_ateapi_proto_msgTypes[48] +func (x *GetActorEgressPolicyResponse) Reset() { + *x = GetActorEgressPolicyResponse{} + mi := &file_ateapi_proto_msgTypes[61] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } -func (x *ResumeActorRequest) String() string { +func (x *GetActorEgressPolicyResponse) String() string { return protoimpl.X.MessageStringOf(x) } -func (*ResumeActorRequest) ProtoMessage() {} +func (*GetActorEgressPolicyResponse) ProtoMessage() {} -func (x *ResumeActorRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[48] +func (x *GetActorEgressPolicyResponse) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[61] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -3500,50 +4280,44 @@ func (x *ResumeActorRequest) ProtoReflect() protoreflect.Message { return mi.MessageOf(x) } -// Deprecated: Use ResumeActorRequest.ProtoReflect.Descriptor instead. -func (*ResumeActorRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{48} +// Deprecated: Use GetActorEgressPolicyResponse.ProtoReflect.Descriptor instead. +func (*GetActorEgressPolicyResponse) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{61} } -func (x *ResumeActorRequest) GetActor() *ObjectRef { +func (x *GetActorEgressPolicyResponse) GetEgressPolicies() []*EgressPolicy { if x != nil { - return x.Actor + return x.EgressPolicies } return nil } -func (x *ResumeActorRequest) GetBoot() bool { - if x != nil { - return x.Boot - } - return false -} - -type ResumeActorResponse struct { +type SetActorEgressPolicyRequest struct { state protoimpl.MessageState `protogen:"open.v1"` - Actor *Actor `protobuf:"bytes,1,opt,name=actor,proto3" json:"actor,omitempty"` - // True if a resume workflow was executed to activate the actor. - // False if the actor was already RUNNING. - Resumed bool `protobuf:"varint,2,opt,name=resumed,proto3" json:"resumed,omitempty"` + // Parent Actor. V0 assigns the policy document's identity implicitly. + Actor *ObjectRef `protobuf:"bytes,1,opt,name=actor,proto3" json:"actor,omitempty"` + // Full replacement. A zero version creates the document and fails if one + // already exists. A non-zero version replaces only the observed revision. + EgressPolicy *EgressPolicy `protobuf:"bytes,2,opt,name=egress_policy,json=egressPolicy,proto3" json:"egress_policy,omitempty"` unknownFields protoimpl.UnknownFields sizeCache protoimpl.SizeCache } -func (x *ResumeActorResponse) Reset() { - *x = ResumeActorResponse{} - mi := &file_ateapi_proto_msgTypes[49] +func (x *SetActorEgressPolicyRequest) Reset() { + *x = SetActorEgressPolicyRequest{} + mi := &file_ateapi_proto_msgTypes[62] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } -func (x *ResumeActorResponse) String() string { +func (x *SetActorEgressPolicyRequest) String() string { return protoimpl.X.MessageStringOf(x) } -func (*ResumeActorResponse) ProtoMessage() {} +func (*SetActorEgressPolicyRequest) ProtoMessage() {} -func (x *ResumeActorResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[49] +func (x *SetActorEgressPolicyRequest) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[62] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -3554,48 +4328,47 @@ func (x *ResumeActorResponse) ProtoReflect() protoreflect.Message { return mi.MessageOf(x) } -// Deprecated: Use ResumeActorResponse.ProtoReflect.Descriptor instead. -func (*ResumeActorResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{49} +// Deprecated: Use SetActorEgressPolicyRequest.ProtoReflect.Descriptor instead. +func (*SetActorEgressPolicyRequest) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{62} } -func (x *ResumeActorResponse) GetActor() *Actor { +func (x *SetActorEgressPolicyRequest) GetActor() *ObjectRef { if x != nil { return x.Actor } return nil } -func (x *ResumeActorResponse) GetResumed() bool { +func (x *SetActorEgressPolicyRequest) GetEgressPolicy() *EgressPolicy { if x != nil { - return x.Resumed + return x.EgressPolicy } - return false + return nil } -type DeleteActorRequest struct { +type DeleteActorEgressPolicyRequest struct { state protoimpl.MessageState `protogen:"open.v1"` Actor *ObjectRef `protobuf:"bytes,1,opt,name=actor,proto3" json:"actor,omitempty"` - AnyState bool `protobuf:"varint,2,opt,name=any_state,json=anyState,proto3" json:"any_state,omitempty"` unknownFields protoimpl.UnknownFields sizeCache protoimpl.SizeCache } -func (x *DeleteActorRequest) Reset() { - *x = DeleteActorRequest{} - mi := &file_ateapi_proto_msgTypes[50] +func (x *DeleteActorEgressPolicyRequest) Reset() { + *x = DeleteActorEgressPolicyRequest{} + mi := &file_ateapi_proto_msgTypes[63] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } -func (x *DeleteActorRequest) String() string { +func (x *DeleteActorEgressPolicyRequest) String() string { return protoimpl.X.MessageStringOf(x) } -func (*DeleteActorRequest) ProtoMessage() {} +func (*DeleteActorEgressPolicyRequest) ProtoMessage() {} -func (x *DeleteActorRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[50] +func (x *DeleteActorEgressPolicyRequest) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[63] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -3606,25 +4379,18 @@ func (x *DeleteActorRequest) ProtoReflect() protoreflect.Message { return mi.MessageOf(x) } -// Deprecated: Use DeleteActorRequest.ProtoReflect.Descriptor instead. -func (*DeleteActorRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{50} +// Deprecated: Use DeleteActorEgressPolicyRequest.ProtoReflect.Descriptor instead. +func (*DeleteActorEgressPolicyRequest) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{63} } -func (x *DeleteActorRequest) GetActor() *ObjectRef { +func (x *DeleteActorEgressPolicyRequest) GetActor() *ObjectRef { if x != nil { return x.Actor } return nil } -func (x *DeleteActorRequest) GetAnyState() bool { - if x != nil { - return x.AnyState - } - return false -} - type GetActorSnapshotRequest struct { state protoimpl.MessageState `protogen:"open.v1"` Snapshot *ObjectRef `protobuf:"bytes,1,opt,name=snapshot,proto3" json:"snapshot,omitempty"` @@ -3634,7 +4400,7 @@ type GetActorSnapshotRequest struct { func (x *GetActorSnapshotRequest) Reset() { *x = GetActorSnapshotRequest{} - mi := &file_ateapi_proto_msgTypes[51] + mi := &file_ateapi_proto_msgTypes[64] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -3646,7 +4412,7 @@ func (x *GetActorSnapshotRequest) String() string { func (*GetActorSnapshotRequest) ProtoMessage() {} func (x *GetActorSnapshotRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[51] + mi := &file_ateapi_proto_msgTypes[64] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -3659,7 +4425,7 @@ func (x *GetActorSnapshotRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetActorSnapshotRequest.ProtoReflect.Descriptor instead. func (*GetActorSnapshotRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{51} + return file_ateapi_proto_rawDescGZIP(), []int{64} } func (x *GetActorSnapshotRequest) GetSnapshot() *ObjectRef { @@ -3678,7 +4444,7 @@ type GetActorSnapshotTagRequest struct { func (x *GetActorSnapshotTagRequest) Reset() { *x = GetActorSnapshotTagRequest{} - mi := &file_ateapi_proto_msgTypes[52] + mi := &file_ateapi_proto_msgTypes[65] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -3690,7 +4456,7 @@ func (x *GetActorSnapshotTagRequest) String() string { func (*GetActorSnapshotTagRequest) ProtoMessage() {} func (x *GetActorSnapshotTagRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[52] + mi := &file_ateapi_proto_msgTypes[65] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -3703,7 +4469,7 @@ func (x *GetActorSnapshotTagRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetActorSnapshotTagRequest.ProtoReflect.Descriptor instead. func (*GetActorSnapshotTagRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{52} + return file_ateapi_proto_rawDescGZIP(), []int{65} } func (x *GetActorSnapshotTagRequest) GetTag() *ObjectRef { @@ -3724,7 +4490,7 @@ type ListActorSnapshotsRequest struct { func (x *ListActorSnapshotsRequest) Reset() { *x = ListActorSnapshotsRequest{} - mi := &file_ateapi_proto_msgTypes[53] + mi := &file_ateapi_proto_msgTypes[66] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -3736,7 +4502,7 @@ func (x *ListActorSnapshotsRequest) String() string { func (*ListActorSnapshotsRequest) ProtoMessage() {} func (x *ListActorSnapshotsRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[53] + mi := &file_ateapi_proto_msgTypes[66] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -3749,7 +4515,7 @@ func (x *ListActorSnapshotsRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ListActorSnapshotsRequest.ProtoReflect.Descriptor instead. func (*ListActorSnapshotsRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{53} + return file_ateapi_proto_rawDescGZIP(), []int{66} } func (x *ListActorSnapshotsRequest) GetAtespace() string { @@ -3783,7 +4549,7 @@ type ListActorSnapshotsResponse struct { func (x *ListActorSnapshotsResponse) Reset() { *x = ListActorSnapshotsResponse{} - mi := &file_ateapi_proto_msgTypes[54] + mi := &file_ateapi_proto_msgTypes[67] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -3795,7 +4561,7 @@ func (x *ListActorSnapshotsResponse) String() string { func (*ListActorSnapshotsResponse) ProtoMessage() {} func (x *ListActorSnapshotsResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[54] + mi := &file_ateapi_proto_msgTypes[67] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -3808,7 +4574,7 @@ func (x *ListActorSnapshotsResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ListActorSnapshotsResponse.ProtoReflect.Descriptor instead. func (*ListActorSnapshotsResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{54} + return file_ateapi_proto_rawDescGZIP(), []int{67} } func (x *ListActorSnapshotsResponse) GetSnapshots() []*ActorSnapshot { @@ -3835,7 +4601,7 @@ type CreateActorSnapshotTagRequest struct { func (x *CreateActorSnapshotTagRequest) Reset() { *x = CreateActorSnapshotTagRequest{} - mi := &file_ateapi_proto_msgTypes[55] + mi := &file_ateapi_proto_msgTypes[68] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -3847,7 +4613,7 @@ func (x *CreateActorSnapshotTagRequest) String() string { func (*CreateActorSnapshotTagRequest) ProtoMessage() {} func (x *CreateActorSnapshotTagRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[55] + mi := &file_ateapi_proto_msgTypes[68] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -3860,7 +4626,7 @@ func (x *CreateActorSnapshotTagRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use CreateActorSnapshotTagRequest.ProtoReflect.Descriptor instead. func (*CreateActorSnapshotTagRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{55} + return file_ateapi_proto_rawDescGZIP(), []int{68} } func (x *CreateActorSnapshotTagRequest) GetActorSnapshotTag() *ActorSnapshotTag { @@ -3890,7 +4656,7 @@ type UpdateActorSnapshotTagRequest struct { func (x *UpdateActorSnapshotTagRequest) Reset() { *x = UpdateActorSnapshotTagRequest{} - mi := &file_ateapi_proto_msgTypes[56] + mi := &file_ateapi_proto_msgTypes[69] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -3902,7 +4668,7 @@ func (x *UpdateActorSnapshotTagRequest) String() string { func (*UpdateActorSnapshotTagRequest) ProtoMessage() {} func (x *UpdateActorSnapshotTagRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[56] + mi := &file_ateapi_proto_msgTypes[69] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -3915,7 +4681,7 @@ func (x *UpdateActorSnapshotTagRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use UpdateActorSnapshotTagRequest.ProtoReflect.Descriptor instead. func (*UpdateActorSnapshotTagRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{56} + return file_ateapi_proto_rawDescGZIP(), []int{69} } func (x *UpdateActorSnapshotTagRequest) GetTag() *ActorSnapshotTag { @@ -3941,7 +4707,7 @@ type DeleteActorSnapshotTagRequest struct { func (x *DeleteActorSnapshotTagRequest) Reset() { *x = DeleteActorSnapshotTagRequest{} - mi := &file_ateapi_proto_msgTypes[57] + mi := &file_ateapi_proto_msgTypes[70] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -3953,7 +4719,7 @@ func (x *DeleteActorSnapshotTagRequest) String() string { func (*DeleteActorSnapshotTagRequest) ProtoMessage() {} func (x *DeleteActorSnapshotTagRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[57] + mi := &file_ateapi_proto_msgTypes[70] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -3966,7 +4732,7 @@ func (x *DeleteActorSnapshotTagRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteActorSnapshotTagRequest.ProtoReflect.Descriptor instead. func (*DeleteActorSnapshotTagRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{57} + return file_ateapi_proto_rawDescGZIP(), []int{70} } func (x *DeleteActorSnapshotTagRequest) GetTag() *ObjectRef { @@ -3996,7 +4762,7 @@ type DeleteOptions struct { func (x *DeleteOptions) Reset() { *x = DeleteOptions{} - mi := &file_ateapi_proto_msgTypes[58] + mi := &file_ateapi_proto_msgTypes[71] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4008,7 +4774,7 @@ func (x *DeleteOptions) String() string { func (*DeleteOptions) ProtoMessage() {} func (x *DeleteOptions) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[58] + mi := &file_ateapi_proto_msgTypes[71] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4021,7 +4787,7 @@ func (x *DeleteOptions) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteOptions.ProtoReflect.Descriptor instead. func (*DeleteOptions) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{58} + return file_ateapi_proto_rawDescGZIP(), []int{71} } func (x *DeleteOptions) GetVersion() int64 { @@ -4053,7 +4819,7 @@ type ListWorkersRequest struct { func (x *ListWorkersRequest) Reset() { *x = ListWorkersRequest{} - mi := &file_ateapi_proto_msgTypes[59] + mi := &file_ateapi_proto_msgTypes[72] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4065,7 +4831,7 @@ func (x *ListWorkersRequest) String() string { func (*ListWorkersRequest) ProtoMessage() {} func (x *ListWorkersRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[59] + mi := &file_ateapi_proto_msgTypes[72] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4078,7 +4844,7 @@ func (x *ListWorkersRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ListWorkersRequest.ProtoReflect.Descriptor instead. func (*ListWorkersRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{59} + return file_ateapi_proto_rawDescGZIP(), []int{72} } func (x *ListWorkersRequest) GetPageSize() int32 { @@ -4107,7 +4873,7 @@ type ListWorkersResponse struct { func (x *ListWorkersResponse) Reset() { *x = ListWorkersResponse{} - mi := &file_ateapi_proto_msgTypes[60] + mi := &file_ateapi_proto_msgTypes[73] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4119,7 +4885,7 @@ func (x *ListWorkersResponse) String() string { func (*ListWorkersResponse) ProtoMessage() {} func (x *ListWorkersResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[60] + mi := &file_ateapi_proto_msgTypes[73] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4132,7 +4898,7 @@ func (x *ListWorkersResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ListWorkersResponse.ProtoReflect.Descriptor instead. func (*ListWorkersResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{60} + return file_ateapi_proto_rawDescGZIP(), []int{73} } func (x *ListWorkersResponse) GetWorkers() []*Worker { @@ -4159,7 +4925,7 @@ type GetWorkerRequest struct { func (x *GetWorkerRequest) Reset() { *x = GetWorkerRequest{} - mi := &file_ateapi_proto_msgTypes[61] + mi := &file_ateapi_proto_msgTypes[74] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4171,7 +4937,7 @@ func (x *GetWorkerRequest) String() string { func (*GetWorkerRequest) ProtoMessage() {} func (x *GetWorkerRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[61] + mi := &file_ateapi_proto_msgTypes[74] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4184,7 +4950,7 @@ func (x *GetWorkerRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetWorkerRequest.ProtoReflect.Descriptor instead. func (*GetWorkerRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{61} + return file_ateapi_proto_rawDescGZIP(), []int{74} } func (x *GetWorkerRequest) GetWorker() *ObjectRef { @@ -4204,7 +4970,7 @@ type CreateWorkerRequest struct { func (x *CreateWorkerRequest) Reset() { *x = CreateWorkerRequest{} - mi := &file_ateapi_proto_msgTypes[62] + mi := &file_ateapi_proto_msgTypes[75] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4216,7 +4982,7 @@ func (x *CreateWorkerRequest) String() string { func (*CreateWorkerRequest) ProtoMessage() {} func (x *CreateWorkerRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[62] + mi := &file_ateapi_proto_msgTypes[75] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4229,7 +4995,7 @@ func (x *CreateWorkerRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use CreateWorkerRequest.ProtoReflect.Descriptor instead. func (*CreateWorkerRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{62} + return file_ateapi_proto_rawDescGZIP(), []int{75} } func (x *CreateWorkerRequest) GetWorker() *Worker { @@ -4258,7 +5024,7 @@ type UpdateWorkerRequest struct { func (x *UpdateWorkerRequest) Reset() { *x = UpdateWorkerRequest{} - mi := &file_ateapi_proto_msgTypes[63] + mi := &file_ateapi_proto_msgTypes[76] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4270,7 +5036,7 @@ func (x *UpdateWorkerRequest) String() string { func (*UpdateWorkerRequest) ProtoMessage() {} func (x *UpdateWorkerRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[63] + mi := &file_ateapi_proto_msgTypes[76] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4283,7 +5049,7 @@ func (x *UpdateWorkerRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use UpdateWorkerRequest.ProtoReflect.Descriptor instead. func (*UpdateWorkerRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{63} + return file_ateapi_proto_rawDescGZIP(), []int{76} } func (x *UpdateWorkerRequest) GetWorker() *Worker { @@ -4312,7 +5078,7 @@ type DeleteWorkerRequest struct { func (x *DeleteWorkerRequest) Reset() { *x = DeleteWorkerRequest{} - mi := &file_ateapi_proto_msgTypes[64] + mi := &file_ateapi_proto_msgTypes[77] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4324,7 +5090,7 @@ func (x *DeleteWorkerRequest) String() string { func (*DeleteWorkerRequest) ProtoMessage() {} func (x *DeleteWorkerRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[64] + mi := &file_ateapi_proto_msgTypes[77] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4337,7 +5103,7 @@ func (x *DeleteWorkerRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteWorkerRequest.ProtoReflect.Descriptor instead. func (*DeleteWorkerRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{64} + return file_ateapi_proto_rawDescGZIP(), []int{77} } func (x *DeleteWorkerRequest) GetWorker() *ObjectRef { @@ -4364,7 +5130,7 @@ type DrainWorkerRequest struct { func (x *DrainWorkerRequest) Reset() { *x = DrainWorkerRequest{} - mi := &file_ateapi_proto_msgTypes[65] + mi := &file_ateapi_proto_msgTypes[78] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4376,7 +5142,7 @@ func (x *DrainWorkerRequest) String() string { func (*DrainWorkerRequest) ProtoMessage() {} func (x *DrainWorkerRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[65] + mi := &file_ateapi_proto_msgTypes[78] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4389,7 +5155,7 @@ func (x *DrainWorkerRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DrainWorkerRequest.ProtoReflect.Descriptor instead. func (*DrainWorkerRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{65} + return file_ateapi_proto_rawDescGZIP(), []int{78} } func (x *DrainWorkerRequest) GetWorker() *ObjectRef { @@ -4418,7 +5184,7 @@ type ListActorsRequest struct { func (x *ListActorsRequest) Reset() { *x = ListActorsRequest{} - mi := &file_ateapi_proto_msgTypes[66] + mi := &file_ateapi_proto_msgTypes[79] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4430,7 +5196,7 @@ func (x *ListActorsRequest) String() string { func (*ListActorsRequest) ProtoMessage() {} func (x *ListActorsRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[66] + mi := &file_ateapi_proto_msgTypes[79] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4443,7 +5209,7 @@ func (x *ListActorsRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ListActorsRequest.ProtoReflect.Descriptor instead. func (*ListActorsRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{66} + return file_ateapi_proto_rawDescGZIP(), []int{79} } func (x *ListActorsRequest) GetAtespace() string { @@ -4479,7 +5245,7 @@ type ListActorsResponse struct { func (x *ListActorsResponse) Reset() { *x = ListActorsResponse{} - mi := &file_ateapi_proto_msgTypes[67] + mi := &file_ateapi_proto_msgTypes[80] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4491,7 +5257,7 @@ func (x *ListActorsResponse) String() string { func (*ListActorsResponse) ProtoMessage() {} func (x *ListActorsResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[67] + mi := &file_ateapi_proto_msgTypes[80] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4504,7 +5270,7 @@ func (x *ListActorsResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ListActorsResponse.ProtoReflect.Descriptor instead. func (*ListActorsResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{67} + return file_ateapi_proto_rawDescGZIP(), []int{80} } func (x *ListActorsResponse) GetActors() []*Actor { @@ -4549,7 +5315,7 @@ type Worker struct { func (x *Worker) Reset() { *x = Worker{} - mi := &file_ateapi_proto_msgTypes[68] + mi := &file_ateapi_proto_msgTypes[81] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4561,7 +5327,7 @@ func (x *Worker) String() string { func (*Worker) ProtoMessage() {} func (x *Worker) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[68] + mi := &file_ateapi_proto_msgTypes[81] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4574,7 +5340,7 @@ func (x *Worker) ProtoReflect() protoreflect.Message { // Deprecated: Use Worker.ProtoReflect.Descriptor instead. func (*Worker) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{68} + return file_ateapi_proto_rawDescGZIP(), []int{81} } func (x *Worker) GetMetadata() *ResourceMetadata { @@ -4665,7 +5431,7 @@ type WorkerStatus struct { func (x *WorkerStatus) Reset() { *x = WorkerStatus{} - mi := &file_ateapi_proto_msgTypes[69] + mi := &file_ateapi_proto_msgTypes[82] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4677,7 +5443,7 @@ func (x *WorkerStatus) String() string { func (*WorkerStatus) ProtoMessage() {} func (x *WorkerStatus) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[69] + mi := &file_ateapi_proto_msgTypes[82] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4690,7 +5456,7 @@ func (x *WorkerStatus) ProtoReflect() protoreflect.Message { // Deprecated: Use WorkerStatus.ProtoReflect.Descriptor instead. func (*WorkerStatus) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{69} + return file_ateapi_proto_rawDescGZIP(), []int{82} } func (x *WorkerStatus) GetState() WorkerState { @@ -4723,7 +5489,7 @@ type WorkerCapacity struct { func (x *WorkerCapacity) Reset() { *x = WorkerCapacity{} - mi := &file_ateapi_proto_msgTypes[70] + mi := &file_ateapi_proto_msgTypes[83] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4735,7 +5501,7 @@ func (x *WorkerCapacity) String() string { func (*WorkerCapacity) ProtoMessage() {} func (x *WorkerCapacity) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[70] + mi := &file_ateapi_proto_msgTypes[83] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4748,7 +5514,7 @@ func (x *WorkerCapacity) ProtoReflect() protoreflect.Message { // Deprecated: Use WorkerCapacity.ProtoReflect.Descriptor instead. func (*WorkerCapacity) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{70} + return file_ateapi_proto_rawDescGZIP(), []int{83} } func (x *WorkerCapacity) GetCpuMilli() int64 { @@ -4780,7 +5546,7 @@ type ActorAssignment struct { func (x *ActorAssignment) Reset() { *x = ActorAssignment{} - mi := &file_ateapi_proto_msgTypes[71] + mi := &file_ateapi_proto_msgTypes[84] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4792,7 +5558,7 @@ func (x *ActorAssignment) String() string { func (*ActorAssignment) ProtoMessage() {} func (x *ActorAssignment) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[71] + mi := &file_ateapi_proto_msgTypes[84] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4805,7 +5571,7 @@ func (x *ActorAssignment) ProtoReflect() protoreflect.Message { // Deprecated: Use ActorAssignment.ProtoReflect.Descriptor instead. func (*ActorAssignment) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{71} + return file_ateapi_proto_rawDescGZIP(), []int{84} } func (x *ActorAssignment) GetActorTemplate() *KubeNamespacedObjectRef { @@ -4839,7 +5605,7 @@ type KubeNamespacedObjectRef struct { func (x *KubeNamespacedObjectRef) Reset() { *x = KubeNamespacedObjectRef{} - mi := &file_ateapi_proto_msgTypes[72] + mi := &file_ateapi_proto_msgTypes[85] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4851,7 +5617,7 @@ func (x *KubeNamespacedObjectRef) String() string { func (*KubeNamespacedObjectRef) ProtoMessage() {} func (x *KubeNamespacedObjectRef) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[72] + mi := &file_ateapi_proto_msgTypes[85] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4864,7 +5630,7 @@ func (x *KubeNamespacedObjectRef) ProtoReflect() protoreflect.Message { // Deprecated: Use KubeNamespacedObjectRef.ProtoReflect.Descriptor instead. func (*KubeNamespacedObjectRef) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{72} + return file_ateapi_proto_rawDescGZIP(), []int{85} } func (x *KubeNamespacedObjectRef) GetNamespace() string { @@ -4889,7 +5655,7 @@ type DebugClearRequest struct { func (x *DebugClearRequest) Reset() { *x = DebugClearRequest{} - mi := &file_ateapi_proto_msgTypes[73] + mi := &file_ateapi_proto_msgTypes[86] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4901,7 +5667,7 @@ func (x *DebugClearRequest) String() string { func (*DebugClearRequest) ProtoMessage() {} func (x *DebugClearRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[73] + mi := &file_ateapi_proto_msgTypes[86] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4914,7 +5680,7 @@ func (x *DebugClearRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DebugClearRequest.ProtoReflect.Descriptor instead. func (*DebugClearRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{73} + return file_ateapi_proto_rawDescGZIP(), []int{86} } type DebugClearResponse struct { @@ -4925,7 +5691,7 @@ type DebugClearResponse struct { func (x *DebugClearResponse) Reset() { *x = DebugClearResponse{} - mi := &file_ateapi_proto_msgTypes[74] + mi := &file_ateapi_proto_msgTypes[87] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4937,7 +5703,7 @@ func (x *DebugClearResponse) String() string { func (*DebugClearResponse) ProtoMessage() {} func (x *DebugClearResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[74] + mi := &file_ateapi_proto_msgTypes[87] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4950,7 +5716,7 @@ func (x *DebugClearResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use DebugClearResponse.ProtoReflect.Descriptor instead. func (*DebugClearResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{74} + return file_ateapi_proto_rawDescGZIP(), []int{87} } type MintJWTRequest struct { @@ -4965,7 +5731,7 @@ type MintJWTRequest struct { func (x *MintJWTRequest) Reset() { *x = MintJWTRequest{} - mi := &file_ateapi_proto_msgTypes[75] + mi := &file_ateapi_proto_msgTypes[88] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4977,7 +5743,7 @@ func (x *MintJWTRequest) String() string { func (*MintJWTRequest) ProtoMessage() {} func (x *MintJWTRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[75] + mi := &file_ateapi_proto_msgTypes[88] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4990,7 +5756,7 @@ func (x *MintJWTRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use MintJWTRequest.ProtoReflect.Descriptor instead. func (*MintJWTRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{75} + return file_ateapi_proto_rawDescGZIP(), []int{88} } func (x *MintJWTRequest) GetAudience() []string { @@ -5029,21 +5795,19 @@ type MintJWTResponse struct { // // Claims: // - // - iss: Issuer - a valid URL where a relying party can fetch the OIDC - // discovery documents. - // - sub: Subject - a string expressing the identity carried in the - // + // * iss: Issuer - a valid URL where a relying party can fetch the OIDC + // discovery documents. + // * sub: Subject - a string expressing the identity carried in the // credential. Format - // - // `atespaces:${atespace}:actors:${actorname}`. - // - aud: Audience - a string identifying the service this token will be used - // to authenticate to. - // - nbf: Not Before - a numeric unix timestamp - // - exp: Expiration - a numeric unix timestamp - // - iat: Issued At - a numeric unix timestamp - // - `ate.dev`: Ate/Substrate Extension - JSON object - // - atespace: (string) The atespace the actor belongs to - // - actorName: (string) The actor's name, unique within its atespace + // `atespaces:${atespace}:actors:${actorname}`. + // * aud: Audience - a string identifying the service this token will be used + // to authenticate to. + // * nbf: Not Before - a numeric unix timestamp + // * exp: Expiration - a numeric unix timestamp + // * iat: Issued At - a numeric unix timestamp + // * `ate.dev`: Ate/Substrate Extension - JSON object + // * atespace: (string) The atespace the actor belongs to + // * actorName: (string) The actor's name, unique within its atespace ActorJwt string `protobuf:"bytes,1,opt,name=actor_jwt,json=actorJwt,proto3" json:"actor_jwt,omitempty"` unknownFields protoimpl.UnknownFields sizeCache protoimpl.SizeCache @@ -5051,7 +5815,7 @@ type MintJWTResponse struct { func (x *MintJWTResponse) Reset() { *x = MintJWTResponse{} - mi := &file_ateapi_proto_msgTypes[76] + mi := &file_ateapi_proto_msgTypes[89] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5063,7 +5827,7 @@ func (x *MintJWTResponse) String() string { func (*MintJWTResponse) ProtoMessage() {} func (x *MintJWTResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[76] + mi := &file_ateapi_proto_msgTypes[89] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5076,7 +5840,7 @@ func (x *MintJWTResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use MintJWTResponse.ProtoReflect.Descriptor instead. func (*MintJWTResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{76} + return file_ateapi_proto_rawDescGZIP(), []int{89} } func (x *MintJWTResponse) GetActorJwt() string { @@ -5111,7 +5875,7 @@ type MintCertRequest struct { func (x *MintCertRequest) Reset() { *x = MintCertRequest{} - mi := &file_ateapi_proto_msgTypes[77] + mi := &file_ateapi_proto_msgTypes[90] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5123,7 +5887,7 @@ func (x *MintCertRequest) String() string { func (*MintCertRequest) ProtoMessage() {} func (x *MintCertRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[77] + mi := &file_ateapi_proto_msgTypes[90] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5136,7 +5900,7 @@ func (x *MintCertRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use MintCertRequest.ProtoReflect.Descriptor instead. func (*MintCertRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{77} + return file_ateapi_proto_rawDescGZIP(), []int{90} } func (x *MintCertRequest) GetWorker() *ObjectRef { @@ -5179,7 +5943,7 @@ type MintCertResponse struct { func (x *MintCertResponse) Reset() { *x = MintCertResponse{} - mi := &file_ateapi_proto_msgTypes[78] + mi := &file_ateapi_proto_msgTypes[91] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5191,7 +5955,7 @@ func (x *MintCertResponse) String() string { func (*MintCertResponse) ProtoMessage() {} func (x *MintCertResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[78] + mi := &file_ateapi_proto_msgTypes[91] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5204,7 +5968,7 @@ func (x *MintCertResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use MintCertResponse.ProtoReflect.Descriptor instead. func (*MintCertResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{78} + return file_ateapi_proto_rawDescGZIP(), []int{91} } func (x *MintCertResponse) GetActorCertificates() [][]byte { @@ -5218,7 +5982,7 @@ var File_ateapi_proto protoreflect.FileDescriptor const file_ateapi_proto_rawDesc = "" + "\n" + - "\fateapi.proto\x12\x06ateapi\x1a google/protobuf/field_mask.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"\xbd\x01\n" + + "\fateapi.proto\x12\x06ateapi\x1a google/protobuf/field_mask.proto\x1a\x1bgoogle/protobuf/empty.proto\x1a\x1fgoogle/protobuf/timestamp.proto\"\xbd\x01\n" + "\x11LocalSnapshotInfo\x12#\n" + "\rsnapshot_name\x18\x01 \x01(\tR\fsnapshotName\x12@\n" + "\x1dnode_vms_with_local_snapshots\x18\x02 \x03(\tR\x19nodeVmsWithLocalSnapshots\x12A\n" + @@ -5260,7 +6024,40 @@ const file_ateapi_proto_rawDesc = "" + "\x0eactor_template\x18\x04 \x01(\v2\x11.ateapi.ObjectRefR\ractorTemplate\x129\n" + "\x0fworker_selector\x18\x05 \x01(\v2\x10.ateapi.SelectorR\x0eworkerSelector\x12A\n" + "\x13source_snapshot_tag\x18\x06 \x01(\v2\x11.ateapi.ObjectRefR\x11sourceSnapshotTag\x12+\n" + - "\x06status\x18\a \x01(\v2\x13.ateapi.ActorStatusR\x06status\"\xe8\x04\n" + + "\x06status\x18\a \x01(\v2\x13.ateapi.ActorStatusR\x06status\"R\n" + + "\fEgressPolicy\x12\x18\n" + + "\aversion\x18\x01 \x01(\x03R\aversion\x12(\n" + + "\x05rules\x18\x02 \x03(\v2\x12.ateapi.EgressRuleR\x05rules\"l\n" + + "\n" + + "EgressRule\x12)\n" + + "\x05allow\x18\x01 \x03(\v2\x13.ateapi.EgressMatchR\x05allow\x123\n" + + "\aeffects\x18\x02 \x01(\v2\x19.ateapi.EgressRuleEffectsR\aeffects\"\xae\x01\n" + + "\vEgressMatch\x12*\n" + + "\x03all\x18\x01 \x01(\v2\x16.google.protobuf.EmptyH\x00R\x03all\x123\n" + + "\bhostname\x18\x02 \x01(\v2\x15.ateapi.HostnameMatchH\x00R\bhostname\x121\n" + + "\bip_block\x18\x03 \x01(\v2\x14.ateapi.IPBlockMatchH\x00R\aipBlockB\v\n" + + "\tpredicate\")\n" + + "\rHostnameMatch\x12\x18\n" + + "\apattern\x18\x01 \x01(\tR\apattern\"\"\n" + + "\fIPBlockMatch\x12\x12\n" + + "\x04cidr\x18\x01 \x01(\tR\x04cidr\"\xab\x01\n" + + "\x11EgressRuleEffects\x12O\n" + + "\x14inject_static_header\x18\x01 \x03(\v2\x1d.ateapi.StaticHeaderInjectionR\x12injectStaticHeader\x12E\n" + + "\x10inject_actor_jwt\x18\x02 \x01(\v2\x1b.ateapi.ActorTokenInjectionR\x0einjectActorJwt\"n\n" + + "\x15StaticHeaderInjection\x12\x16\n" + + "\x06header\x18\x01 \x01(\tR\x06header\x12\x16\n" + + "\x06prefix\x18\x02 \x01(\tR\x06prefix\x12%\n" + + "\x0ecredential_uri\x18\x03 \x01(\tR\rcredentialUri\"\x9a\x01\n" + + "\x13ActorTokenInjection\x12\x16\n" + + "\x06header\x18\x01 \x01(\tR\x06header\x12\x1c\n" + + "\taudiences\x18\x02 \x03(\tR\taudiences\x12M\n" + + "\x11rfc_8693_exchange\x18\x03 \x01(\v2!.ateapi.RFC8693ExchangeParametersR\x0frfc8693Exchange\"\xb1\x01\n" + + "\x19RFC8693ExchangeParameters\x12\x10\n" + + "\x03url\x18\x01 \x01(\tR\x03url\x12\x1c\n" + + "\tresources\x18\x02 \x03(\tR\tresources\x12\x1c\n" + + "\taudiences\x18\x03 \x03(\tR\taudiences\x12\x14\n" + + "\x05scope\x18\x04 \x01(\tR\x05scope\x120\n" + + "\x14requested_token_type\x18\x05 \x01(\tR\x12requestedTokenType\"\xe8\x04\n" + "\vActorStatus\x12(\n" + "\x05state\x18\x01 \x01(\x0e2\x12.ateapi.ActorStateR\x05state\x12E\n" + "\x11worker_assignment\x18\x02 \x01(\v2\x18.ateapi.WorkerAssignmentR\x10workerAssignment\x129\n" + @@ -5437,7 +6234,16 @@ const file_ateapi_proto_rawDesc = "" + "\aresumed\x18\x02 \x01(\bR\aresumed\"Z\n" + "\x12DeleteActorRequest\x12'\n" + "\x05actor\x18\x01 \x01(\v2\x11.ateapi.ObjectRefR\x05actor\x12\x1b\n" + - "\tany_state\x18\x02 \x01(\bR\banyState\"H\n" + + "\tany_state\x18\x02 \x01(\bR\banyState\"F\n" + + "\x1bGetActorEgressPolicyRequest\x12'\n" + + "\x05actor\x18\x01 \x01(\v2\x11.ateapi.ObjectRefR\x05actor\"]\n" + + "\x1cGetActorEgressPolicyResponse\x12=\n" + + "\x0fegress_policies\x18\x01 \x03(\v2\x14.ateapi.EgressPolicyR\x0eegressPolicies\"\x81\x01\n" + + "\x1bSetActorEgressPolicyRequest\x12'\n" + + "\x05actor\x18\x01 \x01(\v2\x11.ateapi.ObjectRefR\x05actor\x129\n" + + "\regress_policy\x18\x02 \x01(\v2\x14.ateapi.EgressPolicyR\fegressPolicy\"I\n" + + "\x1eDeleteActorEgressPolicyRequest\x12'\n" + + "\x05actor\x18\x01 \x01(\v2\x11.ateapi.ObjectRefR\x05actor\"H\n" + "\x17GetActorSnapshotRequest\x12-\n" + "\bsnapshot\x18\x01 \x01(\v2\x11.ateapi.ObjectRefR\bsnapshot\"A\n" + "\x1aGetActorSnapshotTagRequest\x12#\n" + @@ -5579,7 +6385,7 @@ const file_ateapi_proto_rawDesc = "" + "\x15WORKER_STATE_DRAINING\x10\x02*k\n" + "\x17ActorCertificatePurpose\x12)\n" + "%ACTOR_CERTIFICATE_PURPOSE_UNSPECIFIED\x10\x00\x12%\n" + - "!ACTOR_CERTIFICATE_PURPOSE_ATUNNEL\x10\x012\x9e\x10\n" + + "!ACTOR_CERTIFICATE_PURPOSE_ATUNNEL\x10\x012\xb3\x12\n" + "\aControl\x124\n" + "\bGetActor\x12\x17.ateapi.GetActorRequest\x1a\r.ateapi.Actor\"\x00\x12:\n" + "\vCreateActor\x12\x1a.ateapi.CreateActorRequest\x1a\r.ateapi.Actor\"\x00\x12:\n" + @@ -5588,7 +6394,10 @@ const file_ateapi_proto_rawDesc = "" + "\n" + "PauseActor\x12\x19.ateapi.PauseActorRequest\x1a\x1a.ateapi.PauseActorResponse\"\x00\x12H\n" + "\vResumeActor\x12\x1a.ateapi.ResumeActorRequest\x1a\x1b.ateapi.ResumeActorResponse\"\x00\x12:\n" + - "\vDeleteActor\x12\x1a.ateapi.DeleteActorRequest\x1a\r.ateapi.Actor\"\x00\x12L\n" + + "\vDeleteActor\x12\x1a.ateapi.DeleteActorRequest\x1a\r.ateapi.Actor\"\x00\x12c\n" + + "\x14GetActorEgressPolicy\x12#.ateapi.GetActorEgressPolicyRequest\x1a$.ateapi.GetActorEgressPolicyResponse\"\x00\x12S\n" + + "\x14SetActorEgressPolicy\x12#.ateapi.SetActorEgressPolicyRequest\x1a\x14.ateapi.EgressPolicy\"\x00\x12Y\n" + + "\x17DeleteActorEgressPolicy\x12&.ateapi.DeleteActorEgressPolicyRequest\x1a\x14.ateapi.EgressPolicy\"\x00\x12L\n" + "\x10GetActorSnapshot\x12\x1f.ateapi.GetActorSnapshotRequest\x1a\x15.ateapi.ActorSnapshot\"\x00\x12U\n" + "\x13GetActorSnapshotTag\x12\".ateapi.GetActorSnapshotTagRequest\x1a\x18.ateapi.ActorSnapshotTag\"\x00\x12]\n" + "\x12ListActorSnapshots\x12!.ateapi.ListActorSnapshotsRequest\x1a\".ateapi.ListActorSnapshotsResponse\"\x00\x12[\n" + @@ -5631,273 +6440,307 @@ func file_ateapi_proto_rawDescGZIP() []byte { } var file_ateapi_proto_enumTypes = make([]protoimpl.EnumInfo, 9) -var file_ateapi_proto_msgTypes = make([]protoimpl.MessageInfo, 84) +var file_ateapi_proto_msgTypes = make([]protoimpl.MessageInfo, 97) var file_ateapi_proto_goTypes = []any{ - (SnapshotContentScope)(0), // 0: ateapi.SnapshotContentScope - (ActorSnapshotTagScope)(0), // 1: ateapi.ActorSnapshotTagScope - (ActorState)(0), // 2: ateapi.ActorState - (SandboxClass)(0), // 3: ateapi.SandboxClass - (ActorTemplatePhase)(0), // 4: ateapi.ActorTemplatePhase - (ResumeSource)(0), // 5: ateapi.ResumeSource - (WorkerState)(0), // 6: ateapi.WorkerState - (ActorCertificatePurpose)(0), // 7: ateapi.ActorCertificatePurpose - (ExternalVolume_Status)(0), // 8: ateapi.ExternalVolume.Status - (*LocalSnapshotInfo)(nil), // 9: ateapi.LocalSnapshotInfo - (*Selector)(nil), // 10: ateapi.Selector - (*ResourceMetadata)(nil), // 11: ateapi.ResourceMetadata - (*ExternalVolume)(nil), // 12: ateapi.ExternalVolume - (*Actor)(nil), // 13: ateapi.Actor - (*ActorStatus)(nil), // 14: ateapi.ActorStatus - (*ActorSourceSnapshotStatus)(nil), // 15: ateapi.ActorSourceSnapshotStatus - (*WorkerAssignment)(nil), // 16: ateapi.WorkerAssignment - (*ActorSnapshot)(nil), // 17: ateapi.ActorSnapshot - (*ActorSnapshotStatus)(nil), // 18: ateapi.ActorSnapshotStatus - (*ActorSnapshotTag)(nil), // 19: ateapi.ActorSnapshotTag - (*Atespace)(nil), // 20: ateapi.Atespace - (*ObjectRef)(nil), // 21: ateapi.ObjectRef - (*ActorTemplate)(nil), // 22: ateapi.ActorTemplate - (*Resources)(nil), // 23: ateapi.Resources - (*Limits)(nil), // 24: ateapi.Limits - (*ActorTemplateStatus)(nil), // 25: ateapi.ActorTemplateStatus - (*SandboxConfig)(nil), // 26: ateapi.SandboxConfig - (*SnapshotsConfig)(nil), // 27: ateapi.SnapshotsConfig - (*OnResumeConfig)(nil), // 28: ateapi.OnResumeConfig - (*Container)(nil), // 29: ateapi.Container - (*EnvVar)(nil), // 30: ateapi.EnvVar - (*ContainerReadyz)(nil), // 31: ateapi.ContainerReadyz - (*HTTPGetAction)(nil), // 32: ateapi.HTTPGetAction - (*Volume)(nil), // 33: ateapi.Volume - (*DurableDirVolumeSource)(nil), // 34: ateapi.DurableDirVolumeSource - (*ExternalVolumeTemplate)(nil), // 35: ateapi.ExternalVolumeTemplate - (*VolumeMount)(nil), // 36: ateapi.VolumeMount - (*SandboxAssets)(nil), // 37: ateapi.SandboxAssets - (*ArchAssets)(nil), // 38: ateapi.ArchAssets - (*AssetFile)(nil), // 39: ateapi.AssetFile - (*CreateAtespaceRequest)(nil), // 40: ateapi.CreateAtespaceRequest - (*GetAtespaceRequest)(nil), // 41: ateapi.GetAtespaceRequest - (*ListAtespacesRequest)(nil), // 42: ateapi.ListAtespacesRequest - (*ListAtespacesResponse)(nil), // 43: ateapi.ListAtespacesResponse - (*DeleteAtespaceRequest)(nil), // 44: ateapi.DeleteAtespaceRequest - (*CreateActorTemplateRequest)(nil), // 45: ateapi.CreateActorTemplateRequest - (*GetActorTemplateRequest)(nil), // 46: ateapi.GetActorTemplateRequest - (*ListActorTemplatesRequest)(nil), // 47: ateapi.ListActorTemplatesRequest - (*ListActorTemplatesResponse)(nil), // 48: ateapi.ListActorTemplatesResponse - (*DeleteActorTemplateRequest)(nil), // 49: ateapi.DeleteActorTemplateRequest - (*GetActorRequest)(nil), // 50: ateapi.GetActorRequest - (*CreateActorRequest)(nil), // 51: ateapi.CreateActorRequest - (*UpdateActorRequest)(nil), // 52: ateapi.UpdateActorRequest - (*SuspendActorRequest)(nil), // 53: ateapi.SuspendActorRequest - (*SuspendActorResponse)(nil), // 54: ateapi.SuspendActorResponse - (*PauseActorRequest)(nil), // 55: ateapi.PauseActorRequest - (*PauseActorResponse)(nil), // 56: ateapi.PauseActorResponse - (*ResumeActorRequest)(nil), // 57: ateapi.ResumeActorRequest - (*ResumeActorResponse)(nil), // 58: ateapi.ResumeActorResponse - (*DeleteActorRequest)(nil), // 59: ateapi.DeleteActorRequest - (*GetActorSnapshotRequest)(nil), // 60: ateapi.GetActorSnapshotRequest - (*GetActorSnapshotTagRequest)(nil), // 61: ateapi.GetActorSnapshotTagRequest - (*ListActorSnapshotsRequest)(nil), // 62: ateapi.ListActorSnapshotsRequest - (*ListActorSnapshotsResponse)(nil), // 63: ateapi.ListActorSnapshotsResponse - (*CreateActorSnapshotTagRequest)(nil), // 64: ateapi.CreateActorSnapshotTagRequest - (*UpdateActorSnapshotTagRequest)(nil), // 65: ateapi.UpdateActorSnapshotTagRequest - (*DeleteActorSnapshotTagRequest)(nil), // 66: ateapi.DeleteActorSnapshotTagRequest - (*DeleteOptions)(nil), // 67: ateapi.DeleteOptions - (*ListWorkersRequest)(nil), // 68: ateapi.ListWorkersRequest - (*ListWorkersResponse)(nil), // 69: ateapi.ListWorkersResponse - (*GetWorkerRequest)(nil), // 70: ateapi.GetWorkerRequest - (*CreateWorkerRequest)(nil), // 71: ateapi.CreateWorkerRequest - (*UpdateWorkerRequest)(nil), // 72: ateapi.UpdateWorkerRequest - (*DeleteWorkerRequest)(nil), // 73: ateapi.DeleteWorkerRequest - (*DrainWorkerRequest)(nil), // 74: ateapi.DrainWorkerRequest - (*ListActorsRequest)(nil), // 75: ateapi.ListActorsRequest - (*ListActorsResponse)(nil), // 76: ateapi.ListActorsResponse - (*Worker)(nil), // 77: ateapi.Worker - (*WorkerStatus)(nil), // 78: ateapi.WorkerStatus - (*WorkerCapacity)(nil), // 79: ateapi.WorkerCapacity - (*ActorAssignment)(nil), // 80: ateapi.ActorAssignment - (*KubeNamespacedObjectRef)(nil), // 81: ateapi.KubeNamespacedObjectRef - (*DebugClearRequest)(nil), // 82: ateapi.DebugClearRequest - (*DebugClearResponse)(nil), // 83: ateapi.DebugClearResponse - (*MintJWTRequest)(nil), // 84: ateapi.MintJWTRequest - (*MintJWTResponse)(nil), // 85: ateapi.MintJWTResponse - (*MintCertRequest)(nil), // 86: ateapi.MintCertRequest - (*MintCertResponse)(nil), // 87: ateapi.MintCertResponse - nil, // 88: ateapi.Selector.MatchLabelsEntry - nil, // 89: ateapi.ExternalVolume.VolumeContextEntry - nil, // 90: ateapi.SandboxAssets.AssetsEntry - nil, // 91: ateapi.ArchAssets.FilesEntry - nil, // 92: ateapi.Worker.LabelsEntry - (*timestamppb.Timestamp)(nil), // 93: google.protobuf.Timestamp - (*fieldmaskpb.FieldMask)(nil), // 94: google.protobuf.FieldMask + (SnapshotContentScope)(0), // 0: ateapi.SnapshotContentScope + (ActorSnapshotTagScope)(0), // 1: ateapi.ActorSnapshotTagScope + (ActorState)(0), // 2: ateapi.ActorState + (SandboxClass)(0), // 3: ateapi.SandboxClass + (ActorTemplatePhase)(0), // 4: ateapi.ActorTemplatePhase + (ResumeSource)(0), // 5: ateapi.ResumeSource + (WorkerState)(0), // 6: ateapi.WorkerState + (ActorCertificatePurpose)(0), // 7: ateapi.ActorCertificatePurpose + (ExternalVolume_Status)(0), // 8: ateapi.ExternalVolume.Status + (*LocalSnapshotInfo)(nil), // 9: ateapi.LocalSnapshotInfo + (*Selector)(nil), // 10: ateapi.Selector + (*ResourceMetadata)(nil), // 11: ateapi.ResourceMetadata + (*ExternalVolume)(nil), // 12: ateapi.ExternalVolume + (*Actor)(nil), // 13: ateapi.Actor + (*EgressPolicy)(nil), // 14: ateapi.EgressPolicy + (*EgressRule)(nil), // 15: ateapi.EgressRule + (*EgressMatch)(nil), // 16: ateapi.EgressMatch + (*HostnameMatch)(nil), // 17: ateapi.HostnameMatch + (*IPBlockMatch)(nil), // 18: ateapi.IPBlockMatch + (*EgressRuleEffects)(nil), // 19: ateapi.EgressRuleEffects + (*StaticHeaderInjection)(nil), // 20: ateapi.StaticHeaderInjection + (*ActorTokenInjection)(nil), // 21: ateapi.ActorTokenInjection + (*RFC8693ExchangeParameters)(nil), // 22: ateapi.RFC8693ExchangeParameters + (*ActorStatus)(nil), // 23: ateapi.ActorStatus + (*ActorSourceSnapshotStatus)(nil), // 24: ateapi.ActorSourceSnapshotStatus + (*WorkerAssignment)(nil), // 25: ateapi.WorkerAssignment + (*ActorSnapshot)(nil), // 26: ateapi.ActorSnapshot + (*ActorSnapshotStatus)(nil), // 27: ateapi.ActorSnapshotStatus + (*ActorSnapshotTag)(nil), // 28: ateapi.ActorSnapshotTag + (*Atespace)(nil), // 29: ateapi.Atespace + (*ObjectRef)(nil), // 30: ateapi.ObjectRef + (*ActorTemplate)(nil), // 31: ateapi.ActorTemplate + (*Resources)(nil), // 32: ateapi.Resources + (*Limits)(nil), // 33: ateapi.Limits + (*ActorTemplateStatus)(nil), // 34: ateapi.ActorTemplateStatus + (*SandboxConfig)(nil), // 35: ateapi.SandboxConfig + (*SnapshotsConfig)(nil), // 36: ateapi.SnapshotsConfig + (*OnResumeConfig)(nil), // 37: ateapi.OnResumeConfig + (*Container)(nil), // 38: ateapi.Container + (*EnvVar)(nil), // 39: ateapi.EnvVar + (*ContainerReadyz)(nil), // 40: ateapi.ContainerReadyz + (*HTTPGetAction)(nil), // 41: ateapi.HTTPGetAction + (*Volume)(nil), // 42: ateapi.Volume + (*DurableDirVolumeSource)(nil), // 43: ateapi.DurableDirVolumeSource + (*ExternalVolumeTemplate)(nil), // 44: ateapi.ExternalVolumeTemplate + (*VolumeMount)(nil), // 45: ateapi.VolumeMount + (*SandboxAssets)(nil), // 46: ateapi.SandboxAssets + (*ArchAssets)(nil), // 47: ateapi.ArchAssets + (*AssetFile)(nil), // 48: ateapi.AssetFile + (*CreateAtespaceRequest)(nil), // 49: ateapi.CreateAtespaceRequest + (*GetAtespaceRequest)(nil), // 50: ateapi.GetAtespaceRequest + (*ListAtespacesRequest)(nil), // 51: ateapi.ListAtespacesRequest + (*ListAtespacesResponse)(nil), // 52: ateapi.ListAtespacesResponse + (*DeleteAtespaceRequest)(nil), // 53: ateapi.DeleteAtespaceRequest + (*CreateActorTemplateRequest)(nil), // 54: ateapi.CreateActorTemplateRequest + (*GetActorTemplateRequest)(nil), // 55: ateapi.GetActorTemplateRequest + (*ListActorTemplatesRequest)(nil), // 56: ateapi.ListActorTemplatesRequest + (*ListActorTemplatesResponse)(nil), // 57: ateapi.ListActorTemplatesResponse + (*DeleteActorTemplateRequest)(nil), // 58: ateapi.DeleteActorTemplateRequest + (*GetActorRequest)(nil), // 59: ateapi.GetActorRequest + (*CreateActorRequest)(nil), // 60: ateapi.CreateActorRequest + (*UpdateActorRequest)(nil), // 61: ateapi.UpdateActorRequest + (*SuspendActorRequest)(nil), // 62: ateapi.SuspendActorRequest + (*SuspendActorResponse)(nil), // 63: ateapi.SuspendActorResponse + (*PauseActorRequest)(nil), // 64: ateapi.PauseActorRequest + (*PauseActorResponse)(nil), // 65: ateapi.PauseActorResponse + (*ResumeActorRequest)(nil), // 66: ateapi.ResumeActorRequest + (*ResumeActorResponse)(nil), // 67: ateapi.ResumeActorResponse + (*DeleteActorRequest)(nil), // 68: ateapi.DeleteActorRequest + (*GetActorEgressPolicyRequest)(nil), // 69: ateapi.GetActorEgressPolicyRequest + (*GetActorEgressPolicyResponse)(nil), // 70: ateapi.GetActorEgressPolicyResponse + (*SetActorEgressPolicyRequest)(nil), // 71: ateapi.SetActorEgressPolicyRequest + (*DeleteActorEgressPolicyRequest)(nil), // 72: ateapi.DeleteActorEgressPolicyRequest + (*GetActorSnapshotRequest)(nil), // 73: ateapi.GetActorSnapshotRequest + (*GetActorSnapshotTagRequest)(nil), // 74: ateapi.GetActorSnapshotTagRequest + (*ListActorSnapshotsRequest)(nil), // 75: ateapi.ListActorSnapshotsRequest + (*ListActorSnapshotsResponse)(nil), // 76: ateapi.ListActorSnapshotsResponse + (*CreateActorSnapshotTagRequest)(nil), // 77: ateapi.CreateActorSnapshotTagRequest + (*UpdateActorSnapshotTagRequest)(nil), // 78: ateapi.UpdateActorSnapshotTagRequest + (*DeleteActorSnapshotTagRequest)(nil), // 79: ateapi.DeleteActorSnapshotTagRequest + (*DeleteOptions)(nil), // 80: ateapi.DeleteOptions + (*ListWorkersRequest)(nil), // 81: ateapi.ListWorkersRequest + (*ListWorkersResponse)(nil), // 82: ateapi.ListWorkersResponse + (*GetWorkerRequest)(nil), // 83: ateapi.GetWorkerRequest + (*CreateWorkerRequest)(nil), // 84: ateapi.CreateWorkerRequest + (*UpdateWorkerRequest)(nil), // 85: ateapi.UpdateWorkerRequest + (*DeleteWorkerRequest)(nil), // 86: ateapi.DeleteWorkerRequest + (*DrainWorkerRequest)(nil), // 87: ateapi.DrainWorkerRequest + (*ListActorsRequest)(nil), // 88: ateapi.ListActorsRequest + (*ListActorsResponse)(nil), // 89: ateapi.ListActorsResponse + (*Worker)(nil), // 90: ateapi.Worker + (*WorkerStatus)(nil), // 91: ateapi.WorkerStatus + (*WorkerCapacity)(nil), // 92: ateapi.WorkerCapacity + (*ActorAssignment)(nil), // 93: ateapi.ActorAssignment + (*KubeNamespacedObjectRef)(nil), // 94: ateapi.KubeNamespacedObjectRef + (*DebugClearRequest)(nil), // 95: ateapi.DebugClearRequest + (*DebugClearResponse)(nil), // 96: ateapi.DebugClearResponse + (*MintJWTRequest)(nil), // 97: ateapi.MintJWTRequest + (*MintJWTResponse)(nil), // 98: ateapi.MintJWTResponse + (*MintCertRequest)(nil), // 99: ateapi.MintCertRequest + (*MintCertResponse)(nil), // 100: ateapi.MintCertResponse + nil, // 101: ateapi.Selector.MatchLabelsEntry + nil, // 102: ateapi.ExternalVolume.VolumeContextEntry + nil, // 103: ateapi.SandboxAssets.AssetsEntry + nil, // 104: ateapi.ArchAssets.FilesEntry + nil, // 105: ateapi.Worker.LabelsEntry + (*timestamppb.Timestamp)(nil), // 106: google.protobuf.Timestamp + (*emptypb.Empty)(nil), // 107: google.protobuf.Empty + (*fieldmaskpb.FieldMask)(nil), // 108: google.protobuf.FieldMask } var file_ateapi_proto_depIdxs = []int32{ 0, // 0: ateapi.LocalSnapshotInfo.content_scope:type_name -> ateapi.SnapshotContentScope - 88, // 1: ateapi.Selector.match_labels:type_name -> ateapi.Selector.MatchLabelsEntry - 93, // 2: ateapi.ResourceMetadata.create_time:type_name -> google.protobuf.Timestamp - 93, // 3: ateapi.ResourceMetadata.update_time:type_name -> google.protobuf.Timestamp + 101, // 1: ateapi.Selector.match_labels:type_name -> ateapi.Selector.MatchLabelsEntry + 106, // 2: ateapi.ResourceMetadata.create_time:type_name -> google.protobuf.Timestamp + 106, // 3: ateapi.ResourceMetadata.update_time:type_name -> google.protobuf.Timestamp 8, // 4: ateapi.ExternalVolume.status:type_name -> ateapi.ExternalVolume.Status - 89, // 5: ateapi.ExternalVolume.volume_context:type_name -> ateapi.ExternalVolume.VolumeContextEntry + 102, // 5: ateapi.ExternalVolume.volume_context:type_name -> ateapi.ExternalVolume.VolumeContextEntry 11, // 6: ateapi.Actor.metadata:type_name -> ateapi.ResourceMetadata - 21, // 7: ateapi.Actor.actor_template:type_name -> ateapi.ObjectRef + 30, // 7: ateapi.Actor.actor_template:type_name -> ateapi.ObjectRef 10, // 8: ateapi.Actor.worker_selector:type_name -> ateapi.Selector - 21, // 9: ateapi.Actor.source_snapshot_tag:type_name -> ateapi.ObjectRef - 14, // 10: ateapi.Actor.status:type_name -> ateapi.ActorStatus - 2, // 11: ateapi.ActorStatus.state:type_name -> ateapi.ActorState - 16, // 12: ateapi.ActorStatus.worker_assignment:type_name -> ateapi.WorkerAssignment - 21, // 13: ateapi.ActorStatus.latest_snapshot:type_name -> ateapi.ObjectRef - 9, // 14: ateapi.ActorStatus.local_snapshot_info:type_name -> ateapi.LocalSnapshotInfo - 12, // 15: ateapi.ActorStatus.actor_volumes:type_name -> ateapi.ExternalVolume - 15, // 16: ateapi.ActorStatus.source_snapshot:type_name -> ateapi.ActorSourceSnapshotStatus - 21, // 17: ateapi.ActorSourceSnapshotStatus.snapshot:type_name -> ateapi.ObjectRef - 21, // 18: ateapi.WorkerAssignment.worker:type_name -> ateapi.ObjectRef - 11, // 19: ateapi.ActorSnapshot.metadata:type_name -> ateapi.ResourceMetadata - 18, // 20: ateapi.ActorSnapshot.status:type_name -> ateapi.ActorSnapshotStatus - 21, // 21: ateapi.ActorSnapshotStatus.source_actor:type_name -> ateapi.ObjectRef - 0, // 22: ateapi.ActorSnapshotStatus.content_scope:type_name -> ateapi.SnapshotContentScope - 21, // 23: ateapi.ActorSnapshotStatus.actor_template:type_name -> ateapi.ObjectRef - 11, // 24: ateapi.ActorSnapshotTag.metadata:type_name -> ateapi.ResourceMetadata - 21, // 25: ateapi.ActorSnapshotTag.snapshot:type_name -> ateapi.ObjectRef - 1, // 26: ateapi.ActorSnapshotTag.scope:type_name -> ateapi.ActorSnapshotTagScope - 11, // 27: ateapi.Atespace.metadata:type_name -> ateapi.ResourceMetadata - 11, // 28: ateapi.ActorTemplate.metadata:type_name -> ateapi.ResourceMetadata - 10, // 29: ateapi.ActorTemplate.worker_selector:type_name -> ateapi.Selector - 29, // 30: ateapi.ActorTemplate.containers:type_name -> ateapi.Container - 33, // 31: ateapi.ActorTemplate.volumes:type_name -> ateapi.Volume - 27, // 32: ateapi.ActorTemplate.snapshots_config:type_name -> ateapi.SnapshotsConfig - 26, // 33: ateapi.ActorTemplate.sandbox_config:type_name -> ateapi.SandboxConfig - 23, // 34: ateapi.ActorTemplate.resources:type_name -> ateapi.Resources - 25, // 35: ateapi.ActorTemplate.status:type_name -> ateapi.ActorTemplateStatus - 24, // 36: ateapi.Resources.limits:type_name -> ateapi.Limits - 4, // 37: ateapi.ActorTemplateStatus.phase:type_name -> ateapi.ActorTemplatePhase - 21, // 38: ateapi.ActorTemplateStatus.golden_snapshot:type_name -> ateapi.ObjectRef - 37, // 39: ateapi.ActorTemplateStatus.sandbox_assets:type_name -> ateapi.SandboxAssets - 3, // 40: ateapi.SandboxConfig.sandbox_class:type_name -> ateapi.SandboxClass - 0, // 41: ateapi.SnapshotsConfig.on_pause:type_name -> ateapi.SnapshotContentScope - 0, // 42: ateapi.SnapshotsConfig.on_commit:type_name -> ateapi.SnapshotContentScope - 28, // 43: ateapi.SnapshotsConfig.on_resume:type_name -> ateapi.OnResumeConfig - 5, // 44: ateapi.OnResumeConfig.from_data:type_name -> ateapi.ResumeSource - 30, // 45: ateapi.Container.env:type_name -> ateapi.EnvVar - 31, // 46: ateapi.Container.readyz:type_name -> ateapi.ContainerReadyz - 36, // 47: ateapi.Container.volume_mounts:type_name -> ateapi.VolumeMount - 32, // 48: ateapi.ContainerReadyz.http_get:type_name -> ateapi.HTTPGetAction - 34, // 49: ateapi.Volume.durable_dir:type_name -> ateapi.DurableDirVolumeSource - 35, // 50: ateapi.Volume.external_volume_template:type_name -> ateapi.ExternalVolumeTemplate - 3, // 51: ateapi.SandboxAssets.sandbox_class:type_name -> ateapi.SandboxClass - 90, // 52: ateapi.SandboxAssets.assets:type_name -> ateapi.SandboxAssets.AssetsEntry - 91, // 53: ateapi.ArchAssets.files:type_name -> ateapi.ArchAssets.FilesEntry - 20, // 54: ateapi.CreateAtespaceRequest.atespace:type_name -> ateapi.Atespace - 21, // 55: ateapi.GetAtespaceRequest.atespace:type_name -> ateapi.ObjectRef - 20, // 56: ateapi.ListAtespacesResponse.atespaces:type_name -> ateapi.Atespace - 21, // 57: ateapi.DeleteAtespaceRequest.atespace:type_name -> ateapi.ObjectRef - 22, // 58: ateapi.CreateActorTemplateRequest.actor_template:type_name -> ateapi.ActorTemplate - 21, // 59: ateapi.GetActorTemplateRequest.actor_template:type_name -> ateapi.ObjectRef - 22, // 60: ateapi.ListActorTemplatesResponse.actor_templates:type_name -> ateapi.ActorTemplate - 21, // 61: ateapi.DeleteActorTemplateRequest.actor_template:type_name -> ateapi.ObjectRef - 21, // 62: ateapi.GetActorRequest.actor:type_name -> ateapi.ObjectRef - 13, // 63: ateapi.CreateActorRequest.actor:type_name -> ateapi.Actor - 13, // 64: ateapi.UpdateActorRequest.actor:type_name -> ateapi.Actor - 94, // 65: ateapi.UpdateActorRequest.update_mask:type_name -> google.protobuf.FieldMask - 21, // 66: ateapi.SuspendActorRequest.actor:type_name -> ateapi.ObjectRef - 13, // 67: ateapi.SuspendActorResponse.actor:type_name -> ateapi.Actor - 21, // 68: ateapi.PauseActorRequest.actor:type_name -> ateapi.ObjectRef - 13, // 69: ateapi.PauseActorResponse.actor:type_name -> ateapi.Actor - 21, // 70: ateapi.ResumeActorRequest.actor:type_name -> ateapi.ObjectRef - 13, // 71: ateapi.ResumeActorResponse.actor:type_name -> ateapi.Actor - 21, // 72: ateapi.DeleteActorRequest.actor:type_name -> ateapi.ObjectRef - 21, // 73: ateapi.GetActorSnapshotRequest.snapshot:type_name -> ateapi.ObjectRef - 21, // 74: ateapi.GetActorSnapshotTagRequest.tag:type_name -> ateapi.ObjectRef - 17, // 75: ateapi.ListActorSnapshotsResponse.snapshots:type_name -> ateapi.ActorSnapshot - 19, // 76: ateapi.CreateActorSnapshotTagRequest.actor_snapshot_tag:type_name -> ateapi.ActorSnapshotTag - 19, // 77: ateapi.UpdateActorSnapshotTagRequest.tag:type_name -> ateapi.ActorSnapshotTag - 94, // 78: ateapi.UpdateActorSnapshotTagRequest.update_mask:type_name -> google.protobuf.FieldMask - 21, // 79: ateapi.DeleteActorSnapshotTagRequest.tag:type_name -> ateapi.ObjectRef - 77, // 80: ateapi.ListWorkersResponse.workers:type_name -> ateapi.Worker - 21, // 81: ateapi.GetWorkerRequest.worker:type_name -> ateapi.ObjectRef - 77, // 82: ateapi.CreateWorkerRequest.worker:type_name -> ateapi.Worker - 77, // 83: ateapi.UpdateWorkerRequest.worker:type_name -> ateapi.Worker - 94, // 84: ateapi.UpdateWorkerRequest.update_mask:type_name -> google.protobuf.FieldMask - 21, // 85: ateapi.DeleteWorkerRequest.worker:type_name -> ateapi.ObjectRef - 67, // 86: ateapi.DeleteWorkerRequest.options:type_name -> ateapi.DeleteOptions - 21, // 87: ateapi.DrainWorkerRequest.worker:type_name -> ateapi.ObjectRef - 13, // 88: ateapi.ListActorsResponse.actors:type_name -> ateapi.Actor - 11, // 89: ateapi.Worker.metadata:type_name -> ateapi.ResourceMetadata - 92, // 90: ateapi.Worker.labels:type_name -> ateapi.Worker.LabelsEntry - 79, // 91: ateapi.Worker.capacity:type_name -> ateapi.WorkerCapacity - 78, // 92: ateapi.Worker.status:type_name -> ateapi.WorkerStatus - 6, // 93: ateapi.WorkerStatus.state:type_name -> ateapi.WorkerState - 80, // 94: ateapi.WorkerStatus.assignment:type_name -> ateapi.ActorAssignment - 81, // 95: ateapi.ActorAssignment.actor_template:type_name -> ateapi.KubeNamespacedObjectRef - 21, // 96: ateapi.ActorAssignment.actor:type_name -> ateapi.ObjectRef - 21, // 97: ateapi.MintCertRequest.worker:type_name -> ateapi.ObjectRef - 7, // 98: ateapi.MintCertRequest.purpose:type_name -> ateapi.ActorCertificatePurpose - 38, // 99: ateapi.SandboxAssets.AssetsEntry.value:type_name -> ateapi.ArchAssets - 39, // 100: ateapi.ArchAssets.FilesEntry.value:type_name -> ateapi.AssetFile - 50, // 101: ateapi.Control.GetActor:input_type -> ateapi.GetActorRequest - 51, // 102: ateapi.Control.CreateActor:input_type -> ateapi.CreateActorRequest - 52, // 103: ateapi.Control.UpdateActor:input_type -> ateapi.UpdateActorRequest - 53, // 104: ateapi.Control.SuspendActor:input_type -> ateapi.SuspendActorRequest - 55, // 105: ateapi.Control.PauseActor:input_type -> ateapi.PauseActorRequest - 57, // 106: ateapi.Control.ResumeActor:input_type -> ateapi.ResumeActorRequest - 59, // 107: ateapi.Control.DeleteActor:input_type -> ateapi.DeleteActorRequest - 60, // 108: ateapi.Control.GetActorSnapshot:input_type -> ateapi.GetActorSnapshotRequest - 61, // 109: ateapi.Control.GetActorSnapshotTag:input_type -> ateapi.GetActorSnapshotTagRequest - 62, // 110: ateapi.Control.ListActorSnapshots:input_type -> ateapi.ListActorSnapshotsRequest - 64, // 111: ateapi.Control.CreateActorSnapshotTag:input_type -> ateapi.CreateActorSnapshotTagRequest - 65, // 112: ateapi.Control.UpdateActorSnapshotTag:input_type -> ateapi.UpdateActorSnapshotTagRequest - 66, // 113: ateapi.Control.DeleteActorSnapshotTag:input_type -> ateapi.DeleteActorSnapshotTagRequest - 68, // 114: ateapi.Control.ListWorkers:input_type -> ateapi.ListWorkersRequest - 70, // 115: ateapi.Control.GetWorker:input_type -> ateapi.GetWorkerRequest - 71, // 116: ateapi.Control.CreateWorker:input_type -> ateapi.CreateWorkerRequest - 72, // 117: ateapi.Control.UpdateWorker:input_type -> ateapi.UpdateWorkerRequest - 73, // 118: ateapi.Control.DeleteWorker:input_type -> ateapi.DeleteWorkerRequest - 74, // 119: ateapi.Control.DrainWorker:input_type -> ateapi.DrainWorkerRequest - 75, // 120: ateapi.Control.ListActors:input_type -> ateapi.ListActorsRequest - 40, // 121: ateapi.Control.CreateAtespace:input_type -> ateapi.CreateAtespaceRequest - 41, // 122: ateapi.Control.GetAtespace:input_type -> ateapi.GetAtespaceRequest - 42, // 123: ateapi.Control.ListAtespaces:input_type -> ateapi.ListAtespacesRequest - 44, // 124: ateapi.Control.DeleteAtespace:input_type -> ateapi.DeleteAtespaceRequest - 45, // 125: ateapi.Control.CreateActorTemplate:input_type -> ateapi.CreateActorTemplateRequest - 46, // 126: ateapi.Control.GetActorTemplate:input_type -> ateapi.GetActorTemplateRequest - 47, // 127: ateapi.Control.ListActorTemplates:input_type -> ateapi.ListActorTemplatesRequest - 49, // 128: ateapi.Control.DeleteActorTemplate:input_type -> ateapi.DeleteActorTemplateRequest - 82, // 129: ateapi.Debug.DebugClear:input_type -> ateapi.DebugClearRequest - 84, // 130: ateapi.ActorIdentity.MintJWT:input_type -> ateapi.MintJWTRequest - 86, // 131: ateapi.ActorIdentity.MintCert:input_type -> ateapi.MintCertRequest - 13, // 132: ateapi.Control.GetActor:output_type -> ateapi.Actor - 13, // 133: ateapi.Control.CreateActor:output_type -> ateapi.Actor - 13, // 134: ateapi.Control.UpdateActor:output_type -> ateapi.Actor - 54, // 135: ateapi.Control.SuspendActor:output_type -> ateapi.SuspendActorResponse - 56, // 136: ateapi.Control.PauseActor:output_type -> ateapi.PauseActorResponse - 58, // 137: ateapi.Control.ResumeActor:output_type -> ateapi.ResumeActorResponse - 13, // 138: ateapi.Control.DeleteActor:output_type -> ateapi.Actor - 17, // 139: ateapi.Control.GetActorSnapshot:output_type -> ateapi.ActorSnapshot - 19, // 140: ateapi.Control.GetActorSnapshotTag:output_type -> ateapi.ActorSnapshotTag - 63, // 141: ateapi.Control.ListActorSnapshots:output_type -> ateapi.ListActorSnapshotsResponse - 19, // 142: ateapi.Control.CreateActorSnapshotTag:output_type -> ateapi.ActorSnapshotTag - 19, // 143: ateapi.Control.UpdateActorSnapshotTag:output_type -> ateapi.ActorSnapshotTag - 19, // 144: ateapi.Control.DeleteActorSnapshotTag:output_type -> ateapi.ActorSnapshotTag - 69, // 145: ateapi.Control.ListWorkers:output_type -> ateapi.ListWorkersResponse - 77, // 146: ateapi.Control.GetWorker:output_type -> ateapi.Worker - 77, // 147: ateapi.Control.CreateWorker:output_type -> ateapi.Worker - 77, // 148: ateapi.Control.UpdateWorker:output_type -> ateapi.Worker - 77, // 149: ateapi.Control.DeleteWorker:output_type -> ateapi.Worker - 77, // 150: ateapi.Control.DrainWorker:output_type -> ateapi.Worker - 76, // 151: ateapi.Control.ListActors:output_type -> ateapi.ListActorsResponse - 20, // 152: ateapi.Control.CreateAtespace:output_type -> ateapi.Atespace - 20, // 153: ateapi.Control.GetAtespace:output_type -> ateapi.Atespace - 43, // 154: ateapi.Control.ListAtespaces:output_type -> ateapi.ListAtespacesResponse - 20, // 155: ateapi.Control.DeleteAtespace:output_type -> ateapi.Atespace - 22, // 156: ateapi.Control.CreateActorTemplate:output_type -> ateapi.ActorTemplate - 22, // 157: ateapi.Control.GetActorTemplate:output_type -> ateapi.ActorTemplate - 48, // 158: ateapi.Control.ListActorTemplates:output_type -> ateapi.ListActorTemplatesResponse - 22, // 159: ateapi.Control.DeleteActorTemplate:output_type -> ateapi.ActorTemplate - 83, // 160: ateapi.Debug.DebugClear:output_type -> ateapi.DebugClearResponse - 85, // 161: ateapi.ActorIdentity.MintJWT:output_type -> ateapi.MintJWTResponse - 87, // 162: ateapi.ActorIdentity.MintCert:output_type -> ateapi.MintCertResponse - 132, // [132:163] is the sub-list for method output_type - 101, // [101:132] is the sub-list for method input_type - 101, // [101:101] is the sub-list for extension type_name - 101, // [101:101] is the sub-list for extension extendee - 0, // [0:101] is the sub-list for field type_name + 30, // 9: ateapi.Actor.source_snapshot_tag:type_name -> ateapi.ObjectRef + 23, // 10: ateapi.Actor.status:type_name -> ateapi.ActorStatus + 15, // 11: ateapi.EgressPolicy.rules:type_name -> ateapi.EgressRule + 16, // 12: ateapi.EgressRule.allow:type_name -> ateapi.EgressMatch + 19, // 13: ateapi.EgressRule.effects:type_name -> ateapi.EgressRuleEffects + 107, // 14: ateapi.EgressMatch.all:type_name -> google.protobuf.Empty + 17, // 15: ateapi.EgressMatch.hostname:type_name -> ateapi.HostnameMatch + 18, // 16: ateapi.EgressMatch.ip_block:type_name -> ateapi.IPBlockMatch + 20, // 17: ateapi.EgressRuleEffects.inject_static_header:type_name -> ateapi.StaticHeaderInjection + 21, // 18: ateapi.EgressRuleEffects.inject_actor_jwt:type_name -> ateapi.ActorTokenInjection + 22, // 19: ateapi.ActorTokenInjection.rfc_8693_exchange:type_name -> ateapi.RFC8693ExchangeParameters + 2, // 20: ateapi.ActorStatus.state:type_name -> ateapi.ActorState + 25, // 21: ateapi.ActorStatus.worker_assignment:type_name -> ateapi.WorkerAssignment + 30, // 22: ateapi.ActorStatus.latest_snapshot:type_name -> ateapi.ObjectRef + 9, // 23: ateapi.ActorStatus.local_snapshot_info:type_name -> ateapi.LocalSnapshotInfo + 12, // 24: ateapi.ActorStatus.actor_volumes:type_name -> ateapi.ExternalVolume + 24, // 25: ateapi.ActorStatus.source_snapshot:type_name -> ateapi.ActorSourceSnapshotStatus + 30, // 26: ateapi.ActorSourceSnapshotStatus.snapshot:type_name -> ateapi.ObjectRef + 30, // 27: ateapi.WorkerAssignment.worker:type_name -> ateapi.ObjectRef + 11, // 28: ateapi.ActorSnapshot.metadata:type_name -> ateapi.ResourceMetadata + 27, // 29: ateapi.ActorSnapshot.status:type_name -> ateapi.ActorSnapshotStatus + 30, // 30: ateapi.ActorSnapshotStatus.source_actor:type_name -> ateapi.ObjectRef + 0, // 31: ateapi.ActorSnapshotStatus.content_scope:type_name -> ateapi.SnapshotContentScope + 30, // 32: ateapi.ActorSnapshotStatus.actor_template:type_name -> ateapi.ObjectRef + 11, // 33: ateapi.ActorSnapshotTag.metadata:type_name -> ateapi.ResourceMetadata + 30, // 34: ateapi.ActorSnapshotTag.snapshot:type_name -> ateapi.ObjectRef + 1, // 35: ateapi.ActorSnapshotTag.scope:type_name -> ateapi.ActorSnapshotTagScope + 11, // 36: ateapi.Atespace.metadata:type_name -> ateapi.ResourceMetadata + 11, // 37: ateapi.ActorTemplate.metadata:type_name -> ateapi.ResourceMetadata + 10, // 38: ateapi.ActorTemplate.worker_selector:type_name -> ateapi.Selector + 38, // 39: ateapi.ActorTemplate.containers:type_name -> ateapi.Container + 42, // 40: ateapi.ActorTemplate.volumes:type_name -> ateapi.Volume + 36, // 41: ateapi.ActorTemplate.snapshots_config:type_name -> ateapi.SnapshotsConfig + 35, // 42: ateapi.ActorTemplate.sandbox_config:type_name -> ateapi.SandboxConfig + 32, // 43: ateapi.ActorTemplate.resources:type_name -> ateapi.Resources + 34, // 44: ateapi.ActorTemplate.status:type_name -> ateapi.ActorTemplateStatus + 33, // 45: ateapi.Resources.limits:type_name -> ateapi.Limits + 4, // 46: ateapi.ActorTemplateStatus.phase:type_name -> ateapi.ActorTemplatePhase + 30, // 47: ateapi.ActorTemplateStatus.golden_snapshot:type_name -> ateapi.ObjectRef + 46, // 48: ateapi.ActorTemplateStatus.sandbox_assets:type_name -> ateapi.SandboxAssets + 3, // 49: ateapi.SandboxConfig.sandbox_class:type_name -> ateapi.SandboxClass + 0, // 50: ateapi.SnapshotsConfig.on_pause:type_name -> ateapi.SnapshotContentScope + 0, // 51: ateapi.SnapshotsConfig.on_commit:type_name -> ateapi.SnapshotContentScope + 37, // 52: ateapi.SnapshotsConfig.on_resume:type_name -> ateapi.OnResumeConfig + 5, // 53: ateapi.OnResumeConfig.from_data:type_name -> ateapi.ResumeSource + 39, // 54: ateapi.Container.env:type_name -> ateapi.EnvVar + 40, // 55: ateapi.Container.readyz:type_name -> ateapi.ContainerReadyz + 45, // 56: ateapi.Container.volume_mounts:type_name -> ateapi.VolumeMount + 41, // 57: ateapi.ContainerReadyz.http_get:type_name -> ateapi.HTTPGetAction + 43, // 58: ateapi.Volume.durable_dir:type_name -> ateapi.DurableDirVolumeSource + 44, // 59: ateapi.Volume.external_volume_template:type_name -> ateapi.ExternalVolumeTemplate + 3, // 60: ateapi.SandboxAssets.sandbox_class:type_name -> ateapi.SandboxClass + 103, // 61: ateapi.SandboxAssets.assets:type_name -> ateapi.SandboxAssets.AssetsEntry + 104, // 62: ateapi.ArchAssets.files:type_name -> ateapi.ArchAssets.FilesEntry + 29, // 63: ateapi.CreateAtespaceRequest.atespace:type_name -> ateapi.Atespace + 30, // 64: ateapi.GetAtespaceRequest.atespace:type_name -> ateapi.ObjectRef + 29, // 65: ateapi.ListAtespacesResponse.atespaces:type_name -> ateapi.Atespace + 30, // 66: ateapi.DeleteAtespaceRequest.atespace:type_name -> ateapi.ObjectRef + 31, // 67: ateapi.CreateActorTemplateRequest.actor_template:type_name -> ateapi.ActorTemplate + 30, // 68: ateapi.GetActorTemplateRequest.actor_template:type_name -> ateapi.ObjectRef + 31, // 69: ateapi.ListActorTemplatesResponse.actor_templates:type_name -> ateapi.ActorTemplate + 30, // 70: ateapi.DeleteActorTemplateRequest.actor_template:type_name -> ateapi.ObjectRef + 30, // 71: ateapi.GetActorRequest.actor:type_name -> ateapi.ObjectRef + 13, // 72: ateapi.CreateActorRequest.actor:type_name -> ateapi.Actor + 13, // 73: ateapi.UpdateActorRequest.actor:type_name -> ateapi.Actor + 108, // 74: ateapi.UpdateActorRequest.update_mask:type_name -> google.protobuf.FieldMask + 30, // 75: ateapi.SuspendActorRequest.actor:type_name -> ateapi.ObjectRef + 13, // 76: ateapi.SuspendActorResponse.actor:type_name -> ateapi.Actor + 30, // 77: ateapi.PauseActorRequest.actor:type_name -> ateapi.ObjectRef + 13, // 78: ateapi.PauseActorResponse.actor:type_name -> ateapi.Actor + 30, // 79: ateapi.ResumeActorRequest.actor:type_name -> ateapi.ObjectRef + 13, // 80: ateapi.ResumeActorResponse.actor:type_name -> ateapi.Actor + 30, // 81: ateapi.DeleteActorRequest.actor:type_name -> ateapi.ObjectRef + 30, // 82: ateapi.GetActorEgressPolicyRequest.actor:type_name -> ateapi.ObjectRef + 14, // 83: ateapi.GetActorEgressPolicyResponse.egress_policies:type_name -> ateapi.EgressPolicy + 30, // 84: ateapi.SetActorEgressPolicyRequest.actor:type_name -> ateapi.ObjectRef + 14, // 85: ateapi.SetActorEgressPolicyRequest.egress_policy:type_name -> ateapi.EgressPolicy + 30, // 86: ateapi.DeleteActorEgressPolicyRequest.actor:type_name -> ateapi.ObjectRef + 30, // 87: ateapi.GetActorSnapshotRequest.snapshot:type_name -> ateapi.ObjectRef + 30, // 88: ateapi.GetActorSnapshotTagRequest.tag:type_name -> ateapi.ObjectRef + 26, // 89: ateapi.ListActorSnapshotsResponse.snapshots:type_name -> ateapi.ActorSnapshot + 28, // 90: ateapi.CreateActorSnapshotTagRequest.actor_snapshot_tag:type_name -> ateapi.ActorSnapshotTag + 28, // 91: ateapi.UpdateActorSnapshotTagRequest.tag:type_name -> ateapi.ActorSnapshotTag + 108, // 92: ateapi.UpdateActorSnapshotTagRequest.update_mask:type_name -> google.protobuf.FieldMask + 30, // 93: ateapi.DeleteActorSnapshotTagRequest.tag:type_name -> ateapi.ObjectRef + 90, // 94: ateapi.ListWorkersResponse.workers:type_name -> ateapi.Worker + 30, // 95: ateapi.GetWorkerRequest.worker:type_name -> ateapi.ObjectRef + 90, // 96: ateapi.CreateWorkerRequest.worker:type_name -> ateapi.Worker + 90, // 97: ateapi.UpdateWorkerRequest.worker:type_name -> ateapi.Worker + 108, // 98: ateapi.UpdateWorkerRequest.update_mask:type_name -> google.protobuf.FieldMask + 30, // 99: ateapi.DeleteWorkerRequest.worker:type_name -> ateapi.ObjectRef + 80, // 100: ateapi.DeleteWorkerRequest.options:type_name -> ateapi.DeleteOptions + 30, // 101: ateapi.DrainWorkerRequest.worker:type_name -> ateapi.ObjectRef + 13, // 102: ateapi.ListActorsResponse.actors:type_name -> ateapi.Actor + 11, // 103: ateapi.Worker.metadata:type_name -> ateapi.ResourceMetadata + 105, // 104: ateapi.Worker.labels:type_name -> ateapi.Worker.LabelsEntry + 92, // 105: ateapi.Worker.capacity:type_name -> ateapi.WorkerCapacity + 91, // 106: ateapi.Worker.status:type_name -> ateapi.WorkerStatus + 6, // 107: ateapi.WorkerStatus.state:type_name -> ateapi.WorkerState + 93, // 108: ateapi.WorkerStatus.assignment:type_name -> ateapi.ActorAssignment + 94, // 109: ateapi.ActorAssignment.actor_template:type_name -> ateapi.KubeNamespacedObjectRef + 30, // 110: ateapi.ActorAssignment.actor:type_name -> ateapi.ObjectRef + 30, // 111: ateapi.MintCertRequest.worker:type_name -> ateapi.ObjectRef + 7, // 112: ateapi.MintCertRequest.purpose:type_name -> ateapi.ActorCertificatePurpose + 47, // 113: ateapi.SandboxAssets.AssetsEntry.value:type_name -> ateapi.ArchAssets + 48, // 114: ateapi.ArchAssets.FilesEntry.value:type_name -> ateapi.AssetFile + 59, // 115: ateapi.Control.GetActor:input_type -> ateapi.GetActorRequest + 60, // 116: ateapi.Control.CreateActor:input_type -> ateapi.CreateActorRequest + 61, // 117: ateapi.Control.UpdateActor:input_type -> ateapi.UpdateActorRequest + 62, // 118: ateapi.Control.SuspendActor:input_type -> ateapi.SuspendActorRequest + 64, // 119: ateapi.Control.PauseActor:input_type -> ateapi.PauseActorRequest + 66, // 120: ateapi.Control.ResumeActor:input_type -> ateapi.ResumeActorRequest + 68, // 121: ateapi.Control.DeleteActor:input_type -> ateapi.DeleteActorRequest + 69, // 122: ateapi.Control.GetActorEgressPolicy:input_type -> ateapi.GetActorEgressPolicyRequest + 71, // 123: ateapi.Control.SetActorEgressPolicy:input_type -> ateapi.SetActorEgressPolicyRequest + 72, // 124: ateapi.Control.DeleteActorEgressPolicy:input_type -> ateapi.DeleteActorEgressPolicyRequest + 73, // 125: ateapi.Control.GetActorSnapshot:input_type -> ateapi.GetActorSnapshotRequest + 74, // 126: ateapi.Control.GetActorSnapshotTag:input_type -> ateapi.GetActorSnapshotTagRequest + 75, // 127: ateapi.Control.ListActorSnapshots:input_type -> ateapi.ListActorSnapshotsRequest + 77, // 128: ateapi.Control.CreateActorSnapshotTag:input_type -> ateapi.CreateActorSnapshotTagRequest + 78, // 129: ateapi.Control.UpdateActorSnapshotTag:input_type -> ateapi.UpdateActorSnapshotTagRequest + 79, // 130: ateapi.Control.DeleteActorSnapshotTag:input_type -> ateapi.DeleteActorSnapshotTagRequest + 81, // 131: ateapi.Control.ListWorkers:input_type -> ateapi.ListWorkersRequest + 83, // 132: ateapi.Control.GetWorker:input_type -> ateapi.GetWorkerRequest + 84, // 133: ateapi.Control.CreateWorker:input_type -> ateapi.CreateWorkerRequest + 85, // 134: ateapi.Control.UpdateWorker:input_type -> ateapi.UpdateWorkerRequest + 86, // 135: ateapi.Control.DeleteWorker:input_type -> ateapi.DeleteWorkerRequest + 87, // 136: ateapi.Control.DrainWorker:input_type -> ateapi.DrainWorkerRequest + 88, // 137: ateapi.Control.ListActors:input_type -> ateapi.ListActorsRequest + 49, // 138: ateapi.Control.CreateAtespace:input_type -> ateapi.CreateAtespaceRequest + 50, // 139: ateapi.Control.GetAtespace:input_type -> ateapi.GetAtespaceRequest + 51, // 140: ateapi.Control.ListAtespaces:input_type -> ateapi.ListAtespacesRequest + 53, // 141: ateapi.Control.DeleteAtespace:input_type -> ateapi.DeleteAtespaceRequest + 54, // 142: ateapi.Control.CreateActorTemplate:input_type -> ateapi.CreateActorTemplateRequest + 55, // 143: ateapi.Control.GetActorTemplate:input_type -> ateapi.GetActorTemplateRequest + 56, // 144: ateapi.Control.ListActorTemplates:input_type -> ateapi.ListActorTemplatesRequest + 58, // 145: ateapi.Control.DeleteActorTemplate:input_type -> ateapi.DeleteActorTemplateRequest + 95, // 146: ateapi.Debug.DebugClear:input_type -> ateapi.DebugClearRequest + 97, // 147: ateapi.ActorIdentity.MintJWT:input_type -> ateapi.MintJWTRequest + 99, // 148: ateapi.ActorIdentity.MintCert:input_type -> ateapi.MintCertRequest + 13, // 149: ateapi.Control.GetActor:output_type -> ateapi.Actor + 13, // 150: ateapi.Control.CreateActor:output_type -> ateapi.Actor + 13, // 151: ateapi.Control.UpdateActor:output_type -> ateapi.Actor + 63, // 152: ateapi.Control.SuspendActor:output_type -> ateapi.SuspendActorResponse + 65, // 153: ateapi.Control.PauseActor:output_type -> ateapi.PauseActorResponse + 67, // 154: ateapi.Control.ResumeActor:output_type -> ateapi.ResumeActorResponse + 13, // 155: ateapi.Control.DeleteActor:output_type -> ateapi.Actor + 70, // 156: ateapi.Control.GetActorEgressPolicy:output_type -> ateapi.GetActorEgressPolicyResponse + 14, // 157: ateapi.Control.SetActorEgressPolicy:output_type -> ateapi.EgressPolicy + 14, // 158: ateapi.Control.DeleteActorEgressPolicy:output_type -> ateapi.EgressPolicy + 26, // 159: ateapi.Control.GetActorSnapshot:output_type -> ateapi.ActorSnapshot + 28, // 160: ateapi.Control.GetActorSnapshotTag:output_type -> ateapi.ActorSnapshotTag + 76, // 161: ateapi.Control.ListActorSnapshots:output_type -> ateapi.ListActorSnapshotsResponse + 28, // 162: ateapi.Control.CreateActorSnapshotTag:output_type -> ateapi.ActorSnapshotTag + 28, // 163: ateapi.Control.UpdateActorSnapshotTag:output_type -> ateapi.ActorSnapshotTag + 28, // 164: ateapi.Control.DeleteActorSnapshotTag:output_type -> ateapi.ActorSnapshotTag + 82, // 165: ateapi.Control.ListWorkers:output_type -> ateapi.ListWorkersResponse + 90, // 166: ateapi.Control.GetWorker:output_type -> ateapi.Worker + 90, // 167: ateapi.Control.CreateWorker:output_type -> ateapi.Worker + 90, // 168: ateapi.Control.UpdateWorker:output_type -> ateapi.Worker + 90, // 169: ateapi.Control.DeleteWorker:output_type -> ateapi.Worker + 90, // 170: ateapi.Control.DrainWorker:output_type -> ateapi.Worker + 89, // 171: ateapi.Control.ListActors:output_type -> ateapi.ListActorsResponse + 29, // 172: ateapi.Control.CreateAtespace:output_type -> ateapi.Atespace + 29, // 173: ateapi.Control.GetAtespace:output_type -> ateapi.Atespace + 52, // 174: ateapi.Control.ListAtespaces:output_type -> ateapi.ListAtespacesResponse + 29, // 175: ateapi.Control.DeleteAtespace:output_type -> ateapi.Atespace + 31, // 176: ateapi.Control.CreateActorTemplate:output_type -> ateapi.ActorTemplate + 31, // 177: ateapi.Control.GetActorTemplate:output_type -> ateapi.ActorTemplate + 57, // 178: ateapi.Control.ListActorTemplates:output_type -> ateapi.ListActorTemplatesResponse + 31, // 179: ateapi.Control.DeleteActorTemplate:output_type -> ateapi.ActorTemplate + 96, // 180: ateapi.Debug.DebugClear:output_type -> ateapi.DebugClearResponse + 98, // 181: ateapi.ActorIdentity.MintJWT:output_type -> ateapi.MintJWTResponse + 100, // 182: ateapi.ActorIdentity.MintCert:output_type -> ateapi.MintCertResponse + 149, // [149:183] is the sub-list for method output_type + 115, // [115:149] is the sub-list for method input_type + 115, // [115:115] is the sub-list for extension type_name + 115, // [115:115] is the sub-list for extension extendee + 0, // [0:115] is the sub-list for field type_name } func init() { file_ateapi_proto_init() } @@ -5905,13 +6748,18 @@ func file_ateapi_proto_init() { if File_ateapi_proto != nil { return } + file_ateapi_proto_msgTypes[7].OneofWrappers = []any{ + (*EgressMatch_All)(nil), + (*EgressMatch_Hostname)(nil), + (*EgressMatch_IpBlock)(nil), + } type x struct{} out := protoimpl.TypeBuilder{ File: protoimpl.DescBuilder{ GoPackagePath: reflect.TypeOf(x{}).PkgPath(), RawDescriptor: unsafe.Slice(unsafe.StringData(file_ateapi_proto_rawDesc), len(file_ateapi_proto_rawDesc)), NumEnums: 9, - NumMessages: 84, + NumMessages: 97, NumExtensions: 0, NumServices: 3, }, diff --git a/pkg/proto/ateapipb/ateapi.proto b/pkg/proto/ateapipb/ateapi.proto index fa2db521da..fa3dde513a 100644 --- a/pkg/proto/ateapipb/ateapi.proto +++ b/pkg/proto/ateapipb/ateapi.proto @@ -17,6 +17,7 @@ syntax = "proto3"; package ateapi; import "google/protobuf/field_mask.proto"; +import "google/protobuf/empty.proto"; import "google/protobuf/timestamp.proto"; option go_package = "github.com/agent-substrate/substrate/pkg/proto/ateapipb"; @@ -46,6 +47,16 @@ service Control { // Delete an actor. Only suspended actors can be deleted. rpc DeleteActor(DeleteActorRequest) returns (Actor) {} + // Get all egress policy documents nested under an Actor. V0 returns zero or + // one document. + rpc GetActorEgressPolicy(GetActorEgressPolicyRequest) returns (GetActorEgressPolicyResponse) {} + + // Create or replace the egress policy document nested under an Actor. + rpc SetActorEgressPolicy(SetActorEgressPolicyRequest) returns (EgressPolicy) {} + + // Delete all egress policy documents nested under an Actor. + rpc DeleteActorEgressPolicy(DeleteActorEgressPolicyRequest) returns (EgressPolicy) {} + // Get an ActorSnapshot. rpc GetActorSnapshot(GetActorSnapshotRequest) returns (ActorSnapshot) {} @@ -222,6 +233,103 @@ message Actor { ActorStatus status = 7; } +// EgressPolicy is a policy document nested under an Actor. All documents for +// an Actor comprise one logical policy and have the same evaluation semantics +// as one document containing their combined rules. V0 permits one implicitly +// named document per Actor. +message EgressPolicy { + // Server-assigned revision, increased on every mutation. + int64 version = 1; + + // A request is authorized when at least one rule matches. Effects from all + // matching rules are then applied once per rule. Rule order has no meaning. + // An empty rule list denies all traffic. + repeated EgressRule rules = 2; +} + +message EgressRule { + // Entries are ORed. The rule matches when any entry matches. + repeated EgressMatch allow = 1; + + // Effects do not authorize traffic. They are applied only after at least one + // rule authorizes the request. + EgressRuleEffects effects = 2; +} + +message EgressMatch { + oneof predicate { + google.protobuf.Empty all = 1; + HostnameMatch hostname = 2; + IPBlockMatch ip_block = 3; + } +} + +message HostnameMatch { + // An ASCII DNS name, or a wildcard in the complete leftmost label. + // + // The pattern and candidate hostname are normalized to lowercase. One + // trailing dot is permitted and removed. An optional port is removed from an + // HTTP authority before candidate normalization. All labels must be non-empty + // DNS labels of at most 63 characters, containing only ASCII letters, digits, + // and hyphens, and must start and end with a letter or digit. The normalized + // name must be at most 253 characters. + // + // A pattern without a wildcard matches only the complete normalized name. + // "*.example.com" matches exactly one non-empty label, such as + // "api.example.com". It does not match "example.com" or + // "nested.api.example.com". No other wildcard syntax is accepted. + // + // The pattern must not be a URL, IP literal, host:port authority, or Unicode + // U-label. An IP-literal candidate never matches. Internationalized names + // must use their ASCII IDNA A-label form; no Unicode conversion is done. + // Empty labels, malformed authorities, and more than one trailing dot are + // invalid and fail closed. + string pattern = 1; +} + +message IPBlockMatch { + // A canonical IPv4 or IPv6 CIDR prefix. The predicate matches when the + // original destination IP belongs to the prefix. + string cidr = 1; +} + +message EgressRuleEffects { + // These fields are not mutually exclusive. No two effects in a policy may + // target the same case-insensitive header. + repeated StaticHeaderInjection inject_static_header = 1; + ActorTokenInjection inject_actor_jwt = 2; +} + +message StaticHeaderInjection { + string header = 1; + + // For example, "Bearer " for the Authorization header. + string prefix = 2; + + // Source-agnostic reference interpreted by a registered credential provider: + // substrate-secret://// + string credential_uri = 3; +} + +message ActorTokenInjection { + string header = 1; + repeated string audiences = 2; + + // When present, exchanges the Actor JWT at an RFC 8693 endpoint and injects + // the result. A returned expires_in value controls caching of the token. + RFC8693ExchangeParameters rfc_8693_exchange = 3; +} + +message RFC8693ExchangeParameters { + string url = 1; + repeated string resources = 2; + repeated string audiences = 3; + string scope = 4; + string requested_token_type = 5; + // subject_token and subject_token_type are set automatically. actor_token + // and actor_token_type are not used for this flow. +} + enum ActorState { ACTOR_STATE_UNSPECIFIED = 0; ACTOR_STATE_RESUMING = 1; @@ -723,6 +831,28 @@ message DeleteActorRequest { bool any_state = 2; } +message GetActorEgressPolicyRequest { + ObjectRef actor = 1; +} + +message GetActorEgressPolicyResponse { + // Empty when the Actor has no policy. V0 returns at most one document. + repeated EgressPolicy egress_policies = 1; +} + +message SetActorEgressPolicyRequest { + // Parent Actor. V0 assigns the policy document's identity implicitly. + ObjectRef actor = 1; + + // Full replacement. A zero version creates the document and fails if one + // already exists. A non-zero version replaces only the observed revision. + EgressPolicy egress_policy = 2; +} + +message DeleteActorEgressPolicyRequest { + ObjectRef actor = 1; +} + message GetActorSnapshotRequest { ObjectRef snapshot = 1; } diff --git a/pkg/proto/ateapipb/ateapi_grpc.pb.go b/pkg/proto/ateapipb/ateapi_grpc.pb.go index 8ad10003a0..1f0687f99e 100644 --- a/pkg/proto/ateapipb/ateapi_grpc.pb.go +++ b/pkg/proto/ateapipb/ateapi_grpc.pb.go @@ -33,34 +33,37 @@ import ( const _ = grpc.SupportPackageIsVersion9 const ( - Control_GetActor_FullMethodName = "/ateapi.Control/GetActor" - Control_CreateActor_FullMethodName = "/ateapi.Control/CreateActor" - Control_UpdateActor_FullMethodName = "/ateapi.Control/UpdateActor" - Control_SuspendActor_FullMethodName = "/ateapi.Control/SuspendActor" - Control_PauseActor_FullMethodName = "/ateapi.Control/PauseActor" - Control_ResumeActor_FullMethodName = "/ateapi.Control/ResumeActor" - Control_DeleteActor_FullMethodName = "/ateapi.Control/DeleteActor" - Control_GetActorSnapshot_FullMethodName = "/ateapi.Control/GetActorSnapshot" - Control_GetActorSnapshotTag_FullMethodName = "/ateapi.Control/GetActorSnapshotTag" - Control_ListActorSnapshots_FullMethodName = "/ateapi.Control/ListActorSnapshots" - Control_CreateActorSnapshotTag_FullMethodName = "/ateapi.Control/CreateActorSnapshotTag" - Control_UpdateActorSnapshotTag_FullMethodName = "/ateapi.Control/UpdateActorSnapshotTag" - Control_DeleteActorSnapshotTag_FullMethodName = "/ateapi.Control/DeleteActorSnapshotTag" - Control_ListWorkers_FullMethodName = "/ateapi.Control/ListWorkers" - Control_GetWorker_FullMethodName = "/ateapi.Control/GetWorker" - Control_CreateWorker_FullMethodName = "/ateapi.Control/CreateWorker" - Control_UpdateWorker_FullMethodName = "/ateapi.Control/UpdateWorker" - Control_DeleteWorker_FullMethodName = "/ateapi.Control/DeleteWorker" - Control_DrainWorker_FullMethodName = "/ateapi.Control/DrainWorker" - Control_ListActors_FullMethodName = "/ateapi.Control/ListActors" - Control_CreateAtespace_FullMethodName = "/ateapi.Control/CreateAtespace" - Control_GetAtespace_FullMethodName = "/ateapi.Control/GetAtespace" - Control_ListAtespaces_FullMethodName = "/ateapi.Control/ListAtespaces" - Control_DeleteAtespace_FullMethodName = "/ateapi.Control/DeleteAtespace" - Control_CreateActorTemplate_FullMethodName = "/ateapi.Control/CreateActorTemplate" - Control_GetActorTemplate_FullMethodName = "/ateapi.Control/GetActorTemplate" - Control_ListActorTemplates_FullMethodName = "/ateapi.Control/ListActorTemplates" - Control_DeleteActorTemplate_FullMethodName = "/ateapi.Control/DeleteActorTemplate" + Control_GetActor_FullMethodName = "/ateapi.Control/GetActor" + Control_CreateActor_FullMethodName = "/ateapi.Control/CreateActor" + Control_UpdateActor_FullMethodName = "/ateapi.Control/UpdateActor" + Control_SuspendActor_FullMethodName = "/ateapi.Control/SuspendActor" + Control_PauseActor_FullMethodName = "/ateapi.Control/PauseActor" + Control_ResumeActor_FullMethodName = "/ateapi.Control/ResumeActor" + Control_DeleteActor_FullMethodName = "/ateapi.Control/DeleteActor" + Control_GetActorEgressPolicy_FullMethodName = "/ateapi.Control/GetActorEgressPolicy" + Control_SetActorEgressPolicy_FullMethodName = "/ateapi.Control/SetActorEgressPolicy" + Control_DeleteActorEgressPolicy_FullMethodName = "/ateapi.Control/DeleteActorEgressPolicy" + Control_GetActorSnapshot_FullMethodName = "/ateapi.Control/GetActorSnapshot" + Control_GetActorSnapshotTag_FullMethodName = "/ateapi.Control/GetActorSnapshotTag" + Control_ListActorSnapshots_FullMethodName = "/ateapi.Control/ListActorSnapshots" + Control_CreateActorSnapshotTag_FullMethodName = "/ateapi.Control/CreateActorSnapshotTag" + Control_UpdateActorSnapshotTag_FullMethodName = "/ateapi.Control/UpdateActorSnapshotTag" + Control_DeleteActorSnapshotTag_FullMethodName = "/ateapi.Control/DeleteActorSnapshotTag" + Control_ListWorkers_FullMethodName = "/ateapi.Control/ListWorkers" + Control_GetWorker_FullMethodName = "/ateapi.Control/GetWorker" + Control_CreateWorker_FullMethodName = "/ateapi.Control/CreateWorker" + Control_UpdateWorker_FullMethodName = "/ateapi.Control/UpdateWorker" + Control_DeleteWorker_FullMethodName = "/ateapi.Control/DeleteWorker" + Control_DrainWorker_FullMethodName = "/ateapi.Control/DrainWorker" + Control_ListActors_FullMethodName = "/ateapi.Control/ListActors" + Control_CreateAtespace_FullMethodName = "/ateapi.Control/CreateAtespace" + Control_GetAtespace_FullMethodName = "/ateapi.Control/GetAtespace" + Control_ListAtespaces_FullMethodName = "/ateapi.Control/ListAtespaces" + Control_DeleteAtespace_FullMethodName = "/ateapi.Control/DeleteAtespace" + Control_CreateActorTemplate_FullMethodName = "/ateapi.Control/CreateActorTemplate" + Control_GetActorTemplate_FullMethodName = "/ateapi.Control/GetActorTemplate" + Control_ListActorTemplates_FullMethodName = "/ateapi.Control/ListActorTemplates" + Control_DeleteActorTemplate_FullMethodName = "/ateapi.Control/DeleteActorTemplate" ) // ControlClient is the client API for Control service. @@ -85,6 +88,13 @@ type ControlClient interface { ResumeActor(ctx context.Context, in *ResumeActorRequest, opts ...grpc.CallOption) (*ResumeActorResponse, error) // Delete an actor. Only suspended actors can be deleted. DeleteActor(ctx context.Context, in *DeleteActorRequest, opts ...grpc.CallOption) (*Actor, error) + // Get all egress policy documents nested under an Actor. V0 returns zero or + // one document. + GetActorEgressPolicy(ctx context.Context, in *GetActorEgressPolicyRequest, opts ...grpc.CallOption) (*GetActorEgressPolicyResponse, error) + // Create or replace the egress policy document nested under an Actor. + SetActorEgressPolicy(ctx context.Context, in *SetActorEgressPolicyRequest, opts ...grpc.CallOption) (*EgressPolicy, error) + // Delete all egress policy documents nested under an Actor. + DeleteActorEgressPolicy(ctx context.Context, in *DeleteActorEgressPolicyRequest, opts ...grpc.CallOption) (*EgressPolicy, error) // Get an ActorSnapshot. GetActorSnapshot(ctx context.Context, in *GetActorSnapshotRequest, opts ...grpc.CallOption) (*ActorSnapshot, error) // Get an ActorSnapshot tag. @@ -209,6 +219,36 @@ func (c *controlClient) DeleteActor(ctx context.Context, in *DeleteActorRequest, return out, nil } +func (c *controlClient) GetActorEgressPolicy(ctx context.Context, in *GetActorEgressPolicyRequest, opts ...grpc.CallOption) (*GetActorEgressPolicyResponse, error) { + cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) + out := new(GetActorEgressPolicyResponse) + err := c.cc.Invoke(ctx, Control_GetActorEgressPolicy_FullMethodName, in, out, cOpts...) + if err != nil { + return nil, err + } + return out, nil +} + +func (c *controlClient) SetActorEgressPolicy(ctx context.Context, in *SetActorEgressPolicyRequest, opts ...grpc.CallOption) (*EgressPolicy, error) { + cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) + out := new(EgressPolicy) + err := c.cc.Invoke(ctx, Control_SetActorEgressPolicy_FullMethodName, in, out, cOpts...) + if err != nil { + return nil, err + } + return out, nil +} + +func (c *controlClient) DeleteActorEgressPolicy(ctx context.Context, in *DeleteActorEgressPolicyRequest, opts ...grpc.CallOption) (*EgressPolicy, error) { + cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) + out := new(EgressPolicy) + err := c.cc.Invoke(ctx, Control_DeleteActorEgressPolicy_FullMethodName, in, out, cOpts...) + if err != nil { + return nil, err + } + return out, nil +} + func (c *controlClient) GetActorSnapshot(ctx context.Context, in *GetActorSnapshotRequest, opts ...grpc.CallOption) (*ActorSnapshot, error) { cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) out := new(ActorSnapshot) @@ -441,6 +481,13 @@ type ControlServer interface { ResumeActor(context.Context, *ResumeActorRequest) (*ResumeActorResponse, error) // Delete an actor. Only suspended actors can be deleted. DeleteActor(context.Context, *DeleteActorRequest) (*Actor, error) + // Get all egress policy documents nested under an Actor. V0 returns zero or + // one document. + GetActorEgressPolicy(context.Context, *GetActorEgressPolicyRequest) (*GetActorEgressPolicyResponse, error) + // Create or replace the egress policy document nested under an Actor. + SetActorEgressPolicy(context.Context, *SetActorEgressPolicyRequest) (*EgressPolicy, error) + // Delete all egress policy documents nested under an Actor. + DeleteActorEgressPolicy(context.Context, *DeleteActorEgressPolicyRequest) (*EgressPolicy, error) // Get an ActorSnapshot. GetActorSnapshot(context.Context, *GetActorSnapshotRequest) (*ActorSnapshot, error) // Get an ActorSnapshot tag. @@ -516,6 +563,15 @@ func (UnimplementedControlServer) ResumeActor(context.Context, *ResumeActorReque func (UnimplementedControlServer) DeleteActor(context.Context, *DeleteActorRequest) (*Actor, error) { return nil, status.Error(codes.Unimplemented, "method DeleteActor not implemented") } +func (UnimplementedControlServer) GetActorEgressPolicy(context.Context, *GetActorEgressPolicyRequest) (*GetActorEgressPolicyResponse, error) { + return nil, status.Error(codes.Unimplemented, "method GetActorEgressPolicy not implemented") +} +func (UnimplementedControlServer) SetActorEgressPolicy(context.Context, *SetActorEgressPolicyRequest) (*EgressPolicy, error) { + return nil, status.Error(codes.Unimplemented, "method SetActorEgressPolicy not implemented") +} +func (UnimplementedControlServer) DeleteActorEgressPolicy(context.Context, *DeleteActorEgressPolicyRequest) (*EgressPolicy, error) { + return nil, status.Error(codes.Unimplemented, "method DeleteActorEgressPolicy not implemented") +} func (UnimplementedControlServer) GetActorSnapshot(context.Context, *GetActorSnapshotRequest) (*ActorSnapshot, error) { return nil, status.Error(codes.Unimplemented, "method GetActorSnapshot not implemented") } @@ -726,6 +782,60 @@ func _Control_DeleteActor_Handler(srv interface{}, ctx context.Context, dec func return interceptor(ctx, in, info, handler) } +func _Control_GetActorEgressPolicy_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { + in := new(GetActorEgressPolicyRequest) + if err := dec(in); err != nil { + return nil, err + } + if interceptor == nil { + return srv.(ControlServer).GetActorEgressPolicy(ctx, in) + } + info := &grpc.UnaryServerInfo{ + Server: srv, + FullMethod: Control_GetActorEgressPolicy_FullMethodName, + } + handler := func(ctx context.Context, req interface{}) (interface{}, error) { + return srv.(ControlServer).GetActorEgressPolicy(ctx, req.(*GetActorEgressPolicyRequest)) + } + return interceptor(ctx, in, info, handler) +} + +func _Control_SetActorEgressPolicy_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { + in := new(SetActorEgressPolicyRequest) + if err := dec(in); err != nil { + return nil, err + } + if interceptor == nil { + return srv.(ControlServer).SetActorEgressPolicy(ctx, in) + } + info := &grpc.UnaryServerInfo{ + Server: srv, + FullMethod: Control_SetActorEgressPolicy_FullMethodName, + } + handler := func(ctx context.Context, req interface{}) (interface{}, error) { + return srv.(ControlServer).SetActorEgressPolicy(ctx, req.(*SetActorEgressPolicyRequest)) + } + return interceptor(ctx, in, info, handler) +} + +func _Control_DeleteActorEgressPolicy_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { + in := new(DeleteActorEgressPolicyRequest) + if err := dec(in); err != nil { + return nil, err + } + if interceptor == nil { + return srv.(ControlServer).DeleteActorEgressPolicy(ctx, in) + } + info := &grpc.UnaryServerInfo{ + Server: srv, + FullMethod: Control_DeleteActorEgressPolicy_FullMethodName, + } + handler := func(ctx context.Context, req interface{}) (interface{}, error) { + return srv.(ControlServer).DeleteActorEgressPolicy(ctx, req.(*DeleteActorEgressPolicyRequest)) + } + return interceptor(ctx, in, info, handler) +} + func _Control_GetActorSnapshot_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { in := new(GetActorSnapshotRequest) if err := dec(in); err != nil { @@ -1139,6 +1249,18 @@ var Control_ServiceDesc = grpc.ServiceDesc{ MethodName: "DeleteActor", Handler: _Control_DeleteActor_Handler, }, + { + MethodName: "GetActorEgressPolicy", + Handler: _Control_GetActorEgressPolicy_Handler, + }, + { + MethodName: "SetActorEgressPolicy", + Handler: _Control_SetActorEgressPolicy_Handler, + }, + { + MethodName: "DeleteActorEgressPolicy", + Handler: _Control_DeleteActorEgressPolicy_Handler, + }, { MethodName: "GetActorSnapshot", Handler: _Control_GetActorSnapshot_Handler, From 7998ba4ec86080ed6a0586ef6338a4405bc0e67e Mon Sep 17 00:00:00 2001 From: Eitan Yarmush Date: Tue, 25 Aug 2026 11:43:34 +0000 Subject: [PATCH 2/9] chore: regenerate protobufs with CI toolchain Signed-off-by: Eitan Yarmush --- internal/proto/ateompb/ateom_grpc.pb.go | 8 ++++---- pkg/proto/ateapipb/ateapi.pb.go | 26 +++++++++++++------------ 2 files changed, 18 insertions(+), 16 deletions(-) diff --git a/internal/proto/ateompb/ateom_grpc.pb.go b/internal/proto/ateompb/ateom_grpc.pb.go index 4d230adf97..5001e15460 100644 --- a/internal/proto/ateompb/ateom_grpc.pb.go +++ b/internal/proto/ateompb/ateom_grpc.pb.go @@ -85,12 +85,12 @@ type AteomClient interface { // Two ways it declines to give a sample, and they ask different things of the // caller: // - // * NOT_FOUND -- this ateom is not executing the actor in the request. It + // - NOT_FOUND -- this ateom is not executing the actor in the request. It // may be "available", or a recycled worker may have moved on to a // different actor. Retrying on the same timer will not change the answer: // the caller's worker-to-actor mapping is stale and wants re-resolving. // - // * FAILED_PRECONDITION -- this ateom is executing the requested actor but + // - FAILED_PRECONDITION -- this ateom is executing the requested actor but // has no sample to give yet. It accepts an actor before the sandbox it // will measure exists, so a poll landing in the boot lands here. Read it // as "no numbers right now", not as "the actor is gone": it is transient, @@ -238,12 +238,12 @@ type AteomServer interface { // Two ways it declines to give a sample, and they ask different things of the // caller: // - // * NOT_FOUND -- this ateom is not executing the actor in the request. It + // - NOT_FOUND -- this ateom is not executing the actor in the request. It // may be "available", or a recycled worker may have moved on to a // different actor. Retrying on the same timer will not change the answer: // the caller's worker-to-actor mapping is stale and wants re-resolving. // - // * FAILED_PRECONDITION -- this ateom is executing the requested actor but + // - FAILED_PRECONDITION -- this ateom is executing the requested actor but // has no sample to give yet. It accepts an actor before the sandbox it // will measure exists, so a poll landing in the boot lands here. Read it // as "no numbers right now", not as "the actor is gone": it is transient, diff --git a/pkg/proto/ateapipb/ateapi.pb.go b/pkg/proto/ateapipb/ateapi.pb.go index 511734b505..40916d8d17 100644 --- a/pkg/proto/ateapipb/ateapi.pb.go +++ b/pkg/proto/ateapipb/ateapi.pb.go @@ -5757,19 +5757,21 @@ type MintJWTResponse struct { // // Claims: // - // * iss: Issuer - a valid URL where a relying party can fetch the OIDC - // discovery documents. - // * sub: Subject - a string expressing the identity carried in the + // - iss: Issuer - a valid URL where a relying party can fetch the OIDC + // discovery documents. + // - sub: Subject - a string expressing the identity carried in the + // // credential. Format - // `atespaces:${atespace}:actors:${actorname}`. - // * aud: Audience - a string identifying the service this token will be used - // to authenticate to. - // * nbf: Not Before - a numeric unix timestamp - // * exp: Expiration - a numeric unix timestamp - // * iat: Issued At - a numeric unix timestamp - // * `ate.dev`: Ate/Substrate Extension - JSON object - // * atespace: (string) The atespace the actor belongs to - // * actorName: (string) The actor's name, unique within its atespace + // + // `atespaces:${atespace}:actors:${actorname}`. + // - aud: Audience - a string identifying the service this token will be used + // to authenticate to. + // - nbf: Not Before - a numeric unix timestamp + // - exp: Expiration - a numeric unix timestamp + // - iat: Issued At - a numeric unix timestamp + // - `ate.dev`: Ate/Substrate Extension - JSON object + // - atespace: (string) The atespace the actor belongs to + // - actorName: (string) The actor's name, unique within its atespace ActorJwt string `protobuf:"bytes,1,opt,name=actor_jwt,json=actorJwt,proto3" json:"actor_jwt,omitempty"` unknownFields protoimpl.UnknownFields sizeCache protoimpl.SizeCache From 9401be1594c905a27c89b5114e8c8ca53ff5f4d3 Mon Sep 17 00:00:00 2001 From: Eitan Yarmush Date: Wed, 26 Aug 2026 00:27:56 +0000 Subject: [PATCH 3/9] Refine egress policy resource metadata Signed-off-by: Eitan Yarmush --- .../internal/controlapi/egress_policy.go | 85 ++-- .../internal/controlapi/egress_policy_test.go | 89 +---- cmd/ateapi/internal/controlapi/service.go | 5 +- .../internal/store/atepg/egress_policy.go | 48 +-- cmd/ateapi/internal/store/atepg/schema.go | 1 + cmd/ateapi/internal/store/store.go | 8 +- .../internal/store/storecontract/contract.go | 27 +- cmd/ateapi/main.go | 2 - .../proto/egresspolicypb/egress_policy.pb.go | 201 ---------- .../proto/egresspolicypb/egress_policy.proto | 35 -- .../egresspolicypb/egress_policy_grpc.pb.go | 139 ------- internal/proto/egresspolicypb/gen.go | 17 - pkg/proto/ateapipb/ateapi.pb.go | 370 +++++++++--------- pkg/proto/ateapipb/ateapi.proto | 9 +- 14 files changed, 282 insertions(+), 754 deletions(-) delete mode 100644 internal/proto/egresspolicypb/egress_policy.pb.go delete mode 100644 internal/proto/egresspolicypb/egress_policy.proto delete mode 100644 internal/proto/egresspolicypb/egress_policy_grpc.pb.go delete mode 100644 internal/proto/egresspolicypb/gen.go diff --git a/cmd/ateapi/internal/controlapi/egress_policy.go b/cmd/ateapi/internal/controlapi/egress_policy.go index 2e1543c196..245bda9921 100644 --- a/cmd/ateapi/internal/controlapi/egress_policy.go +++ b/cmd/ateapi/internal/controlapi/egress_policy.go @@ -23,8 +23,6 @@ import ( "strings" "github.com/agent-substrate/substrate/cmd/ateapi/internal/store" - "github.com/agent-substrate/substrate/internal/principal" - "github.com/agent-substrate/substrate/internal/proto/egresspolicypb" "github.com/agent-substrate/substrate/internal/resources" "github.com/agent-substrate/substrate/pkg/proto/ateapipb" "google.golang.org/grpc/codes" @@ -34,10 +32,6 @@ import ( "k8s.io/apimachinery/pkg/util/validation/field" ) -// TODO: Make the gateway namespace and service account configurable when the -// egress gateway deployment supports that configuration. -const egressGatewayPrincipal = "spiffe://cluster.local/ns/ate-system/sa/atenet-egress" - func (s *RPCService) GetActorEgressPolicy(ctx context.Context, req *ateapipb.GetActorEgressPolicyRequest) (*ateapipb.GetActorEgressPolicyResponse, error) { if errs := validateActorRef(req.GetActor(), field.NewPath("actor")); len(errs) > 0 { return nil, toGRPCStatusError(errs) @@ -61,17 +55,19 @@ func (s *RPCService) SetActorEgressPolicy(ctx context.Context, req *ateapipb.Set var errs field.ErrorList errs = append(errs, validateActorRef(req.GetActor(), field.NewPath("actor"))...) policy := req.GetEgressPolicy() - errs = append(errs, validateEgressPolicy(policy, policy.GetVersion() > 0)...) + metadata := policy.GetMetadata() + isUpdate := metadata.GetUid() != "" || metadata.GetVersion() != 0 + errs = append(errs, validateEgressPolicy(policy, isUpdate)...) if len(errs) > 0 { return nil, toGRPCStatusError(errs) } actorRef := resources.ActorRefFromObjectRef(req.GetActor()) in := normalizeEgressPolicy(policy) - if in.GetVersion() == 0 { + if !isUpdate { created, err := s.persistence.CreateEgressPolicy(ctx, actorRef, in) return mapEgressPolicyWrite(created, err) } - updated, err := s.persistence.UpdateEgressPolicy(ctx, actorRef, in.GetVersion(), func(toUpdate *ateapipb.EgressPolicy) error { + updated, err := s.persistence.UpdateEgressPolicy(ctx, actorRef, store.PreconditionFrom(in), func(toUpdate *ateapipb.EgressPolicy) error { toUpdate.Rules = in.GetRules() return nil }) @@ -86,40 +82,6 @@ func (s *RPCService) DeleteActorEgressPolicy(ctx context.Context, req *ateapipb. return mapEgressPolicyWrite(policy, err) } -func (s *RPCService) GetEffectiveEgressPolicy(ctx context.Context, req *egresspolicypb.GetEffectiveEgressPolicyRequest) (*egresspolicypb.EffectiveEgressPolicy, error) { - info, ok := principal.FromContext(ctx) - if !ok || info.Kind != principal.KindMTLS || info.ID != egressGatewayPrincipal { - return nil, status.Error(codes.PermissionDenied, "caller is not the egress gateway") - } - var errs field.ErrorList - errs = append(errs, validateActorRef(req.GetActor(), field.NewPath("actor"))...) - if req.GetActorUid() == "" { - errs = append(errs, field.Required(field.NewPath("actor_uid"), "")) - } - if len(errs) > 0 { - return nil, toGRPCStatusError(errs) - } - actorRef := resources.ActorRefFromObjectRef(req.GetActor()) - actor, err := s.persistence.GetActor(ctx, actorRef) - if errors.Is(err, store.ErrNotFound) { - return nil, status.Error(codes.PermissionDenied, "actor is not authorized for egress") - } - if err != nil { - return nil, status.Errorf(codes.Unavailable, "resolving actor: %v", err) - } - if actor.GetMetadata().GetUid() != req.GetActorUid() || actor.GetStatus().GetState() != ateapipb.ActorState_ACTOR_STATE_RUNNING { - return nil, status.Error(codes.PermissionDenied, "actor is not authorized for egress") - } - policy, err := s.persistence.ResolveEgressPolicy(ctx, actorRef, req.GetActorUid()) - if errors.Is(err, store.ErrNotFound) { - return &egresspolicypb.EffectiveEgressPolicy{Policy: &ateapipb.EgressPolicy{}}, nil - } - if err != nil { - return nil, status.Errorf(codes.Unavailable, "resolving egress policy: %v", err) - } - return &egresspolicypb.EffectiveEgressPolicy{Policy: policy}, nil -} - func validateActorRef(ref *ateapipb.ObjectRef, p *field.Path) field.ErrorList { if ref == nil { return field.ErrorList{field.Required(p, "")} @@ -133,12 +95,7 @@ func validateEgressPolicy(policy *ateapipb.EgressPolicy, requireVersion bool) fi return field.ErrorList{field.Required(root, "")} } var errs field.ErrorList - if requireVersion && policy.GetVersion() <= 0 { - errs = append(errs, field.Required(root.Child("version"), "must be greater than zero")) - } - if !requireVersion && policy.GetVersion() != 0 { - errs = append(errs, field.Invalid(root.Child("version"), policy.GetVersion(), "must be zero when creating")) - } + errs = append(errs, validateEgressPolicyMetadata(policy.GetMetadata(), requireVersion, root.Child("metadata"))...) seenHeaders := map[string]bool{} for i, rule := range policy.GetRules() { rulePath := root.Child("rules").Index(i) @@ -182,6 +139,34 @@ func validateEgressPolicy(policy *ateapipb.EgressPolicy, requireVersion bool) fi return errs } +func validateEgressPolicyMetadata(metadata *ateapipb.ResourceMetadata, update bool, p *field.Path) field.ErrorList { + var errs field.ErrorList + if metadata.GetAtespace() != "" { + errs = append(errs, field.Invalid(p.Child("atespace"), metadata.GetAtespace(), "must be empty")) + } + if metadata.GetName() != "" { + errs = append(errs, field.Invalid(p.Child("name"), metadata.GetName(), "must be empty")) + } + if !update { + if metadata.GetUid() != "" { + errs = append(errs, field.Invalid(p.Child("uid"), metadata.GetUid(), "must be empty when creating")) + } + if metadata.GetVersion() != 0 { + errs = append(errs, field.Invalid(p.Child("version"), metadata.GetVersion(), "must be zero when creating")) + } + return errs + } + if metadata.GetUid() == "" { + errs = append(errs, field.Required(p.Child("uid"), "")) + } else { + errs = append(errs, resources.ValidateUUID(metadata.GetUid(), p.Child("uid"))...) + } + if metadata.GetVersion() <= 0 { + errs = append(errs, field.Required(p.Child("version"), "must be greater than zero")) + } + return errs +} + func validateEgressMatch(match *ateapipb.EgressMatch, p *field.Path) (string, bool, field.ErrorList) { if match == nil || match.GetPredicate() == nil { return "", false, field.ErrorList{field.Required(p.Child("predicate"), "")} @@ -331,6 +316,8 @@ func mapEgressPolicyWrite(policy *ateapipb.EgressPolicy, err error) (*ateapipb.E return nil, status.Error(codes.AlreadyExists, "EgressPolicy already exists") case errors.Is(err, store.ErrVersionConflict): return nil, status.Error(codes.Aborted, "EgressPolicy version conflict") + case errors.Is(err, store.ErrUIDConflict): + return nil, status.Error(codes.Aborted, "EgressPolicy UID conflict") case errors.Is(err, store.ErrFailedPrecondition): return nil, status.Error(codes.FailedPrecondition, "parent Actor does not exist") default: diff --git a/cmd/ateapi/internal/controlapi/egress_policy_test.go b/cmd/ateapi/internal/controlapi/egress_policy_test.go index ac850bc4e3..3e28ee41b0 100644 --- a/cmd/ateapi/internal/controlapi/egress_policy_test.go +++ b/cmd/ateapi/internal/controlapi/egress_policy_test.go @@ -15,15 +15,9 @@ package controlapi import ( - "context" - "errors" "testing" - "github.com/agent-substrate/substrate/cmd/ateapi/internal/store" "github.com/agent-substrate/substrate/cmd/ateapi/internal/store/storetest" - "github.com/agent-substrate/substrate/internal/principal" - "github.com/agent-substrate/substrate/internal/proto/egresspolicypb" - "github.com/agent-substrate/substrate/internal/resources" "github.com/agent-substrate/substrate/pkg/proto/ateapipb" "google.golang.org/grpc/codes" "google.golang.org/grpc/status" @@ -53,7 +47,9 @@ func TestValidateEgressPolicy(t *testing.T) { {name: "invalid credential URI", mutate: func(p *ateapipb.EgressPolicy) { p.Rules[0].Effects.InjectStaticHeader[0].CredentialUri = "https://example.com/secret" }}, - {name: "create with version", mutate: func(p *ateapipb.EgressPolicy) { p.Version = 1 }}, + {name: "create with version", mutate: func(p *ateapipb.EgressPolicy) { p.Metadata = &ateapipb.ResourceMetadata{Version: 1} }}, + {name: "policy name", mutate: func(p *ateapipb.EgressPolicy) { p.Metadata = &ateapipb.ResourceMetadata{Name: "policy"} }}, + {name: "policy atespace", mutate: func(p *ateapipb.EgressPolicy) { p.Metadata = &ateapipb.ResourceMetadata{Atespace: "team"} }}, } for _, tc := range tests { t.Run(tc.name, func(t *testing.T) { @@ -71,26 +67,23 @@ func TestValidateEgressPolicy(t *testing.T) { } } -func TestGetEffectiveEgressPolicy(t *testing.T) { +func TestActorEgressPolicy(t *testing.T) { persistence, cleanup := storetest.SetupTestStore(t) defer cleanup() service := &RPCService{persistence: persistence} if _, err := persistence.CreateAtespace(t.Context(), &ateapipb.Atespace{Metadata: &ateapipb.ResourceMetadata{Name: testAtespace}}); err != nil { t.Fatal(err) } - actor, err := persistence.CreateActor(t.Context(), &ateapipb.Actor{ + _, err := persistence.CreateActor(t.Context(), &ateapipb.Actor{ Metadata: &ateapipb.ResourceMetadata{Atespace: testAtespace, Name: "egress-actor"}, Status: &ateapipb.ActorStatus{State: ateapipb.ActorState_ACTOR_STATE_RUNNING}, }) if err != nil { t.Fatal(err) } - request := &egresspolicypb.GetEffectiveEgressPolicyRequest{ - Actor: &ateapipb.ObjectRef{Atespace: testAtespace, Name: "egress-actor"}, ActorUid: actor.GetMetadata().GetUid(), - } - ctx := principal.InjectContext(context.Background(), principal.PrincipalInfo{Kind: principal.KindMTLS, ID: egressGatewayPrincipal}) + actorRef := &ateapipb.ObjectRef{Atespace: testAtespace, Name: "egress-actor"} - listed, err := service.GetActorEgressPolicy(t.Context(), &ateapipb.GetActorEgressPolicyRequest{Actor: request.GetActor()}) + listed, err := service.GetActorEgressPolicy(t.Context(), &ateapipb.GetActorEgressPolicyRequest{Actor: actorRef}) if err != nil || len(listed.GetEgressPolicies()) != 0 { t.Fatalf("policies before set = %v, %v; want empty", listed, err) } @@ -99,12 +92,8 @@ func TestGetEffectiveEgressPolicy(t *testing.T) { }); status.Code(err) != codes.NotFound { t.Fatalf("missing parent status = %v, want NotFound", status.Code(err)) } - empty, err := service.GetEffectiveEgressPolicy(ctx, request) - if err != nil || len(empty.GetPolicy().GetRules()) != 0 { - t.Fatalf("missing policy = %v, %v; want deny-all policy", empty, err) - } created, err := service.SetActorEgressPolicy(t.Context(), &ateapipb.SetActorEgressPolicyRequest{ - Actor: request.GetActor(), + Actor: actorRef, EgressPolicy: &ateapipb.EgressPolicy{Rules: []*ateapipb.EgressRule{{ Allow: []*ateapipb.EgressMatch{{Predicate: &ateapipb.EgressMatch_Hostname{Hostname: &ateapipb.HostnameMatch{Pattern: "API.EXAMPLE.COM."}}}}, Effects: &ateapipb.EgressRuleEffects{InjectStaticHeader: []*ateapipb.StaticHeaderInjection{{ @@ -116,77 +105,31 @@ func TestGetEffectiveEgressPolicy(t *testing.T) { t.Fatal(err) } if _, err := service.SetActorEgressPolicy(t.Context(), &ateapipb.SetActorEgressPolicyRequest{ - Actor: request.GetActor(), EgressPolicy: &ateapipb.EgressPolicy{}, + Actor: actorRef, EgressPolicy: &ateapipb.EgressPolicy{}, }); status.Code(err) != codes.AlreadyExists { t.Fatalf("create collision status = %v, want AlreadyExists", status.Code(err)) } if created.GetRules()[0].GetAllow()[0].GetHostname().GetPattern() != "api.example.com" || created.GetRules()[0].GetEffects().GetInjectStaticHeader()[0].GetHeader() != "authorization" { t.Fatalf("policy was not normalized: %v", created) } - listed, err = service.GetActorEgressPolicy(t.Context(), &ateapipb.GetActorEgressPolicyRequest{Actor: request.GetActor()}) + if md := created.GetMetadata(); md.GetName() != "" || md.GetAtespace() != "" || md.GetUid() == "" || md.GetVersion() != 1 || md.GetCreateTime() == nil || md.GetUpdateTime() == nil { + t.Fatalf("created metadata = %v", md) + } + listed, err = service.GetActorEgressPolicy(t.Context(), &ateapipb.GetActorEgressPolicyRequest{Actor: actorRef}) if err != nil || len(listed.GetEgressPolicies()) != 1 || !proto.Equal(listed.GetEgressPolicies()[0], created) { t.Fatalf("policies after set = %v, %v; want one document", listed, err) } replacement := proto.Clone(created).(*ateapipb.EgressPolicy) replacement.Rules = nil - updated, err := service.SetActorEgressPolicy(t.Context(), &ateapipb.SetActorEgressPolicyRequest{Actor: request.GetActor(), EgressPolicy: replacement}) - if err != nil || updated.GetVersion() != 2 || len(updated.GetRules()) != 0 { + updated, err := service.SetActorEgressPolicy(t.Context(), &ateapipb.SetActorEgressPolicyRequest{Actor: actorRef, EgressPolicy: replacement}) + if err != nil || updated.GetMetadata().GetVersion() != 2 || len(updated.GetRules()) != 0 { t.Fatalf("replacement = %v, %v; want empty version 2", updated, err) } if _, err := service.SetActorEgressPolicy(t.Context(), &ateapipb.SetActorEgressPolicyRequest{ - Actor: request.GetActor(), EgressPolicy: replacement, + Actor: actorRef, EgressPolicy: replacement, }); status.Code(err) != codes.Aborted { t.Fatalf("stale replacement status = %v, want Aborted", status.Code(err)) } - created = updated - got, err := service.GetEffectiveEgressPolicy(ctx, request) - if err != nil || !proto.Equal(got.GetPolicy(), created) { - t.Fatalf("effective policy = %v, %v; want %v", got, err, created) - } - if _, err := service.GetEffectiveEgressPolicy(context.Background(), request); status.Code(err) != codes.PermissionDenied { - t.Fatalf("unauthorized resolver status = %v, want PermissionDenied", status.Code(err)) - } - wrongUID := proto.Clone(request).(*egresspolicypb.GetEffectiveEgressPolicyRequest) - wrongUID.ActorUid = "replacement-uid" - if _, err := service.GetEffectiveEgressPolicy(ctx, wrongUID); status.Code(err) != codes.PermissionDenied { - t.Fatalf("wrong Actor UID status = %v, want PermissionDenied", status.Code(err)) - } -} - -type getActorErrorStore struct { - store.Interface - err error -} - -func (s *getActorErrorStore) GetActor(context.Context, resources.ActorRef) (*ateapipb.Actor, error) { - return nil, s.err -} - -func TestGetEffectiveEgressPolicyActorLookupErrors(t *testing.T) { - persistence, cleanup := storetest.SetupTestStore(t) - defer cleanup() - wrapped := &getActorErrorStore{Interface: persistence} - service := &RPCService{persistence: wrapped} - ctx := principal.InjectContext(context.Background(), principal.PrincipalInfo{Kind: principal.KindMTLS, ID: egressGatewayPrincipal}) - req := &egresspolicypb.GetEffectiveEgressPolicyRequest{ - Actor: &ateapipb.ObjectRef{Atespace: testAtespace, Name: "actor"}, ActorUid: "uid", - } - for _, tc := range []struct { - name string - err error - want codes.Code - }{ - {name: "missing actor", err: store.ErrNotFound, want: codes.PermissionDenied}, - {name: "persistence failure", err: errors.New("store unavailable"), want: codes.Unavailable}, - } { - t.Run(tc.name, func(t *testing.T) { - wrapped.err = tc.err - _, err := service.GetEffectiveEgressPolicy(ctx, req) - if status.Code(err) != tc.want { - t.Fatalf("status = %v, want %v", status.Code(err), tc.want) - } - }) - } } func TestCredentialURIValidation(t *testing.T) { diff --git a/cmd/ateapi/internal/controlapi/service.go b/cmd/ateapi/internal/controlapi/service.go index f8375274df..958796b5b9 100644 --- a/cmd/ateapi/internal/controlapi/service.go +++ b/cmd/ateapi/internal/controlapi/service.go @@ -20,7 +20,6 @@ import ( "github.com/agent-substrate/substrate/cmd/ateapi/internal/store" "github.com/agent-substrate/substrate/cmd/ateapi/internal/workercache" - "github.com/agent-substrate/substrate/internal/proto/egresspolicypb" "github.com/agent-substrate/substrate/internal/resources" "github.com/agent-substrate/substrate/internal/volume" "github.com/agent-substrate/substrate/internal/volume/csi" @@ -33,7 +32,6 @@ import ( // interface. type RPCService struct { ateapipb.UnimplementedControlServer - egresspolicypb.UnimplementedResolverServer persistence serviceStore workerCache *workercache.Cache dialer *AteletDialer @@ -92,8 +90,7 @@ type serviceStore interface { ListActors(ctx context.Context, atespace string, opts store.ListOptions) (store.ListResponse[*ateapipb.Actor], error) CreateEgressPolicy(ctx context.Context, actorRef resources.ActorRef, policy *ateapipb.EgressPolicy) (*ateapipb.EgressPolicy, error) GetEgressPolicy(ctx context.Context, actorRef resources.ActorRef) (*ateapipb.EgressPolicy, error) - ResolveEgressPolicy(ctx context.Context, actorRef resources.ActorRef, actorUID string) (*ateapipb.EgressPolicy, error) - UpdateEgressPolicy(ctx context.Context, actorRef resources.ActorRef, expectedVersion int64, mutate func(*ateapipb.EgressPolicy) error) (*ateapipb.EgressPolicy, error) + UpdateEgressPolicy(ctx context.Context, actorRef resources.ActorRef, precondition store.Precondition, mutate func(*ateapipb.EgressPolicy) error) (*ateapipb.EgressPolicy, error) DeleteEgressPolicy(ctx context.Context, actorRef resources.ActorRef) (*ateapipb.EgressPolicy, error) GetActorSnapshot(ctx context.Context, atespace, name string) (*ateapipb.ActorSnapshot, error) ListActorSnapshots(ctx context.Context, atespace string, opts store.ListOptions) (store.ListResponse[*ateapipb.ActorSnapshot], error) diff --git a/cmd/ateapi/internal/store/atepg/egress_policy.go b/cmd/ateapi/internal/store/atepg/egress_policy.go index 58ab500ee4..f835bb79ff 100644 --- a/cmd/ateapi/internal/store/atepg/egress_policy.go +++ b/cmd/ateapi/internal/store/atepg/egress_policy.go @@ -28,14 +28,14 @@ import ( func (p *Persistence) CreateEgressPolicy(ctx context.Context, actorRef resources.ActorRef, policy *ateapipb.EgressPolicy) (*ateapipb.EgressPolicy, error) { dbPolicy := proto.Clone(policy).(*ateapipb.EgressPolicy) - dbPolicy.Version = 1 + dbPolicy.Metadata = newCreateMetadata("", "") protoBytes, err := proto.Marshal(dbPolicy) if err != nil { return nil, fmt.Errorf("marshaling egress policy: %w", err) } _, err = p.pool.Exec(ctx, ` - INSERT INTO actor_egress_policies (atespace, actor_name, version, proto) - VALUES ($1, $2, $3, $4)`, actorRef.Atespace, actorRef.Name, dbPolicy.GetVersion(), protoBytes) + INSERT INTO actor_egress_policies (atespace, actor_name, uid, version, proto) + VALUES ($1, $2, $3, $4, $5)`, actorRef.Atespace, actorRef.Name, dbPolicy.GetMetadata().GetUid(), dbPolicy.GetMetadata().GetVersion(), protoBytes) if err != nil { if isUniqueViolation(err) { return nil, store.ErrAlreadyExists @@ -50,21 +50,13 @@ func (p *Persistence) CreateEgressPolicy(ctx context.Context, actorRef resources func (p *Persistence) GetEgressPolicy(ctx context.Context, actorRef resources.ActorRef) (*ateapipb.EgressPolicy, error) { return getEgressPolicyRow(ctx, p.pool, ` - SELECT version, proto FROM actor_egress_policies + SELECT uid, version, proto FROM actor_egress_policies WHERE atespace = $1 AND actor_name = $2`, actorRef.Atespace, actorRef.Name) } -func (p *Persistence) ResolveEgressPolicy(ctx context.Context, actorRef resources.ActorRef, actorUID string) (*ateapipb.EgressPolicy, error) { - return getEgressPolicyRow(ctx, p.pool, ` - SELECT p.version, p.proto - FROM actor_egress_policies AS p - JOIN actors AS a ON a.atespace = p.atespace AND a.name = p.actor_name - WHERE p.atespace = $1 AND p.actor_name = $2 AND a.uid = $3`, actorRef.Atespace, actorRef.Name, actorUID) -} - -func (p *Persistence) UpdateEgressPolicy(ctx context.Context, actorRef resources.ActorRef, expectedVersion int64, mutate func(*ateapipb.EgressPolicy) error) (*ateapipb.EgressPolicy, error) { - if expectedVersion <= 0 { - return nil, store.ErrPreconditionRequired +func (p *Persistence) UpdateEgressPolicy(ctx context.Context, actorRef resources.ActorRef, precondition store.Precondition, mutate func(*ateapipb.EgressPolicy) error) (*ateapipb.EgressPolicy, error) { + if err := precondition.Validate(); err != nil { + return nil, err } tx, err := p.pool.Begin(ctx) if err != nil { @@ -73,26 +65,26 @@ func (p *Persistence) UpdateEgressPolicy(ctx context.Context, actorRef resources defer tx.Rollback(ctx) //nolint:errcheck // no-op once committed current, err := getEgressPolicyRow(ctx, tx, ` - SELECT version, proto FROM actor_egress_policies + SELECT uid, version, proto FROM actor_egress_policies WHERE atespace = $1 AND actor_name = $2 FOR UPDATE`, actorRef.Atespace, actorRef.Name) if err != nil { return nil, err } - if current.GetVersion() != expectedVersion { - return nil, store.ErrVersionConflict + if err := precondition.Check(current.GetMetadata()); err != nil { + return nil, err } updated := proto.Clone(current).(*ateapipb.EgressPolicy) if err := mutate(updated); err != nil { return nil, err } - updated.Version = current.GetVersion() + 1 + updated.Metadata = newUpdateMetadata(current.GetMetadata()) protoBytes, err := proto.Marshal(updated) if err != nil { return nil, fmt.Errorf("marshaling updated egress policy: %w", err) } if _, err := tx.Exec(ctx, ` UPDATE actor_egress_policies SET version = $3, proto = $4 - WHERE atespace = $1 AND actor_name = $2`, actorRef.Atespace, actorRef.Name, updated.GetVersion(), protoBytes); err != nil { + WHERE atespace = $1 AND actor_name = $2`, actorRef.Atespace, actorRef.Name, updated.GetMetadata().GetVersion(), protoBytes); err != nil { return nil, fmt.Errorf("updating egress policy for %s: %w", actorRef, err) } if err := tx.Commit(ctx); err != nil { @@ -103,39 +95,41 @@ func (p *Persistence) UpdateEgressPolicy(ctx context.Context, actorRef resources func (p *Persistence) DeleteEgressPolicy(ctx context.Context, actorRef resources.ActorRef) (*ateapipb.EgressPolicy, error) { var version int64 + var uid string var protoBytes []byte err := p.pool.QueryRow(ctx, ` DELETE FROM actor_egress_policies WHERE atespace = $1 AND actor_name = $2 - RETURNING version, proto`, actorRef.Atespace, actorRef.Name).Scan(&version, &protoBytes) + RETURNING uid, version, proto`, actorRef.Atespace, actorRef.Name).Scan(&uid, &version, &protoBytes) if errors.Is(err, pgx.ErrNoRows) { return nil, store.ErrNotFound } if err != nil { return nil, fmt.Errorf("deleting egress policy for %s: %w", actorRef, err) } - return unmarshalEgressPolicy(version, protoBytes) + return unmarshalEgressPolicy(uid, version, protoBytes) } func getEgressPolicyRow(ctx context.Context, q querier, query string, args ...any) (*ateapipb.EgressPolicy, error) { + var uid string var version int64 var protoBytes []byte - if err := q.QueryRow(ctx, query, args...).Scan(&version, &protoBytes); err != nil { + if err := q.QueryRow(ctx, query, args...).Scan(&uid, &version, &protoBytes); err != nil { if errors.Is(err, pgx.ErrNoRows) { return nil, store.ErrNotFound } return nil, fmt.Errorf("getting egress policy: %w", err) } - return unmarshalEgressPolicy(version, protoBytes) + return unmarshalEgressPolicy(uid, version, protoBytes) } -func unmarshalEgressPolicy(version int64, protoBytes []byte) (*ateapipb.EgressPolicy, error) { +func unmarshalEgressPolicy(uid string, version int64, protoBytes []byte) (*ateapipb.EgressPolicy, error) { policy := &ateapipb.EgressPolicy{} if err := proto.Unmarshal(protoBytes, policy); err != nil { return nil, fmt.Errorf("unmarshaling egress policy: %w", err) } - if policy.GetVersion() != version { - return nil, fmt.Errorf("egress policy proto version %d does not match column version %d", policy.GetVersion(), version) + if err := validateProtoMetadataMatchesColumns("egress policy", policy.GetMetadata(), uid, version); err != nil { + return nil, err } return policy, nil } diff --git a/cmd/ateapi/internal/store/atepg/schema.go b/cmd/ateapi/internal/store/atepg/schema.go index c814f91b05..5c301b1cdf 100644 --- a/cmd/ateapi/internal/store/atepg/schema.go +++ b/cmd/ateapi/internal/store/atepg/schema.go @@ -47,6 +47,7 @@ CREATE TABLE IF NOT EXISTS actors ( CREATE TABLE IF NOT EXISTS actor_egress_policies ( atespace text NOT NULL, actor_name text NOT NULL, + uid text NOT NULL, version bigint NOT NULL, proto bytea NOT NULL, PRIMARY KEY (atespace, actor_name), diff --git a/cmd/ateapi/internal/store/store.go b/cmd/ateapi/internal/store/store.go index cd88195dfa..755d9cbdce 100644 --- a/cmd/ateapi/internal/store/store.go +++ b/cmd/ateapi/internal/store/store.go @@ -107,11 +107,9 @@ type Interface interface { CreateEgressPolicy(ctx context.Context, actorRef resources.ActorRef, policy *ateapipb.EgressPolicy) (*ateapipb.EgressPolicy, error) // Fetches an Actor's policy subresource. GetEgressPolicy(ctx context.Context, actorRef resources.ActorRef) (*ateapipb.EgressPolicy, error) - // Resolves a policy only when it belongs to the expected Actor incarnation. - ResolveEgressPolicy(ctx context.Context, actorRef resources.ActorRef, actorUID string) (*ateapipb.EgressPolicy, error) - // Transactionally updates an Actor's policy when its current version matches - // expectedVersion. - UpdateEgressPolicy(ctx context.Context, actorRef resources.ActorRef, expectedVersion int64, mutate func(*ateapipb.EgressPolicy) error) (*ateapipb.EgressPolicy, error) + // Transactionally updates an Actor's policy when its current UID and version + // match the precondition. + UpdateEgressPolicy(ctx context.Context, actorRef resources.ActorRef, precondition Precondition, mutate func(*ateapipb.EgressPolicy) error) (*ateapipb.EgressPolicy, error) // Deletes and returns an Actor's policy subresource. DeleteEgressPolicy(ctx context.Context, actorRef resources.ActorRef) (*ateapipb.EgressPolicy, error) diff --git a/cmd/ateapi/internal/store/storecontract/contract.go b/cmd/ateapi/internal/store/storecontract/contract.go index 5255da84e0..d91c5ee3c6 100644 --- a/cmd/ateapi/internal/store/storecontract/contract.go +++ b/cmd/ateapi/internal/store/storecontract/contract.go @@ -165,8 +165,11 @@ func runEgressPolicyContractTests(t *testing.T, setup func(t *testing.T) store.I if err != nil { t.Fatalf("CreateEgressPolicy failed: %v", err) } - if created.GetVersion() != 1 || policy.GetVersion() != 0 { - t.Fatalf("created version = %d, input version = %d; want 1, 0", created.GetVersion(), policy.GetVersion()) + if md := created.GetMetadata(); md.GetName() != "" || md.GetAtespace() != "" || md.GetUid() == "" || md.GetVersion() != 1 || md.GetCreateTime() == nil || md.GetUpdateTime() == nil { + t.Fatalf("created metadata = %v", md) + } + if policy.GetMetadata() != nil { + t.Fatalf("input metadata = %v; want nil", policy.GetMetadata()) } if _, err := s.CreateEgressPolicy(ctx, actorRef, policy); !errors.Is(err, store.ErrAlreadyExists) { t.Fatalf("duplicate create error = %v, want ErrAlreadyExists", err) @@ -175,24 +178,20 @@ func runEgressPolicyContractTests(t *testing.T, setup func(t *testing.T) store.I if err != nil || !proto.Equal(got, created) { t.Fatalf("GetEgressPolicy = %v, %v; want %v", got, err, created) } - resolved, err := s.ResolveEgressPolicy(ctx, actorRef, actor.GetMetadata().GetUid()) - if err != nil || !proto.Equal(resolved, created) { - t.Fatalf("ResolveEgressPolicy = %v, %v; want %v", resolved, err, created) - } - if _, err := s.ResolveEgressPolicy(ctx, actorRef, "replacement-uid"); !errors.Is(err, store.ErrNotFound) { - t.Fatalf("wrong Actor UID error = %v, want ErrNotFound", err) - } - if _, err := s.UpdateEgressPolicy(ctx, actorRef, 0, func(*ateapipb.EgressPolicy) error { return nil }); !errors.Is(err, store.ErrPreconditionRequired) { + if _, err := s.UpdateEgressPolicy(ctx, actorRef, store.Precondition{}, func(*ateapipb.EgressPolicy) error { return nil }); !errors.Is(err, store.ErrPreconditionRequired) { t.Fatalf("unguarded update error = %v, want ErrPreconditionRequired", err) } - if _, err := s.UpdateEgressPolicy(ctx, actorRef, 99, func(*ateapipb.EgressPolicy) error { return nil }); !errors.Is(err, store.ErrVersionConflict) { + if _, err := s.UpdateEgressPolicy(ctx, actorRef, store.Precondition{UID: created.GetMetadata().GetUid(), Version: 99}, func(*ateapipb.EgressPolicy) error { return nil }); !errors.Is(err, store.ErrVersionConflict) { t.Fatalf("stale update error = %v, want ErrVersionConflict", err) } - updated, err := s.UpdateEgressPolicy(ctx, actorRef, 1, func(policy *ateapipb.EgressPolicy) error { + if _, err := s.UpdateEgressPolicy(ctx, actorRef, store.Precondition{UID: "replacement-uid", Version: 1}, func(*ateapipb.EgressPolicy) error { return nil }); !errors.Is(err, store.ErrUIDConflict) { + t.Fatalf("wrong UID update error = %v, want ErrUIDConflict", err) + } + updated, err := s.UpdateEgressPolicy(ctx, actorRef, store.PreconditionFrom(created), func(policy *ateapipb.EgressPolicy) error { policy.Rules = []*ateapipb.EgressRule{{Allow: []*ateapipb.EgressMatch{{Predicate: &ateapipb.EgressMatch_All{All: &emptypb.Empty{}}}}}} return nil }) - if err != nil || updated.GetVersion() != 2 { + if err != nil || updated.GetMetadata().GetVersion() != 2 || updated.GetMetadata().GetUid() != created.GetMetadata().GetUid() { t.Fatalf("UpdateEgressPolicy = %v, %v; want version 2", updated, err) } deleted, err := s.DeleteEgressPolicy(ctx, actorRef) @@ -239,7 +238,7 @@ func runEgressPolicyContractTests(t *testing.T, setup func(t *testing.T) store.I if replacement.GetMetadata().GetUid() == actor.GetMetadata().GetUid() { t.Fatal("replacement Actor reused UID") } - if _, err := s.ResolveEgressPolicy(ctx, actorRef, replacement.GetMetadata().GetUid()); !errors.Is(err, store.ErrNotFound) { + if _, err := s.GetEgressPolicy(ctx, actorRef); !errors.Is(err, store.ErrNotFound) { t.Fatalf("replacement Actor inherited policy: %v", err) } }) diff --git a/cmd/ateapi/main.go b/cmd/ateapi/main.go index 75c2d8bda8..ae0d13b123 100644 --- a/cmd/ateapi/main.go +++ b/cmd/ateapi/main.go @@ -36,7 +36,6 @@ import ( "github.com/agent-substrate/substrate/internal/ateapiauth" "github.com/agent-substrate/substrate/internal/ateinterceptors" "github.com/agent-substrate/substrate/internal/credbundle" - "github.com/agent-substrate/substrate/internal/proto/egresspolicypb" "github.com/agent-substrate/substrate/internal/serverboot" "github.com/agent-substrate/substrate/internal/version" "github.com/agent-substrate/substrate/internal/volume" @@ -226,7 +225,6 @@ func main() { ) reflection.Register(mux) ateapipb.RegisterControlServer(mux, controlSrv) - egresspolicypb.RegisterResolverServer(mux, controlSrv) ateapipb.RegisterActorIdentityServer(mux, actorIdentitySrv) ateapipb.RegisterDebugServer(mux, debugSrv) diff --git a/internal/proto/egresspolicypb/egress_policy.pb.go b/internal/proto/egresspolicypb/egress_policy.pb.go deleted file mode 100644 index fb97b82173..0000000000 --- a/internal/proto/egresspolicypb/egress_policy.pb.go +++ /dev/null @@ -1,201 +0,0 @@ -// Copyright 2026 Google LLC -// -// Licensed under the Apache License, Version 2.0 (the "License"); -// you may not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, software -// distributed under the License is distributed on an "AS IS" BASIS, -// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -// See the License for the specific language governing permissions and -// limitations under the License. - -// Code generated by protoc-gen-go. DO NOT EDIT. -// versions: -// protoc-gen-go v1.36.11-devel -// protoc v4.25.3 -// source: egress_policy.proto - -package egresspolicypb - -import ( - ateapipb "github.com/agent-substrate/substrate/pkg/proto/ateapipb" - protoreflect "google.golang.org/protobuf/reflect/protoreflect" - protoimpl "google.golang.org/protobuf/runtime/protoimpl" - reflect "reflect" - sync "sync" - unsafe "unsafe" -) - -const ( - // Verify that this generated code is sufficiently up-to-date. - _ = protoimpl.EnforceVersion(20 - protoimpl.MinVersion) - // Verify that runtime/protoimpl is sufficiently up-to-date. - _ = protoimpl.EnforceVersion(protoimpl.MaxVersion - 20) -) - -type GetEffectiveEgressPolicyRequest struct { - state protoimpl.MessageState `protogen:"open.v1"` - Actor *ateapipb.ObjectRef `protobuf:"bytes,1,opt,name=actor,proto3" json:"actor,omitempty"` - ActorUid string `protobuf:"bytes,2,opt,name=actor_uid,json=actorUid,proto3" json:"actor_uid,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetEffectiveEgressPolicyRequest) Reset() { - *x = GetEffectiveEgressPolicyRequest{} - mi := &file_egress_policy_proto_msgTypes[0] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetEffectiveEgressPolicyRequest) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetEffectiveEgressPolicyRequest) ProtoMessage() {} - -func (x *GetEffectiveEgressPolicyRequest) ProtoReflect() protoreflect.Message { - mi := &file_egress_policy_proto_msgTypes[0] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetEffectiveEgressPolicyRequest.ProtoReflect.Descriptor instead. -func (*GetEffectiveEgressPolicyRequest) Descriptor() ([]byte, []int) { - return file_egress_policy_proto_rawDescGZIP(), []int{0} -} - -func (x *GetEffectiveEgressPolicyRequest) GetActor() *ateapipb.ObjectRef { - if x != nil { - return x.Actor - } - return nil -} - -func (x *GetEffectiveEgressPolicyRequest) GetActorUid() string { - if x != nil { - return x.ActorUid - } - return "" -} - -type EffectiveEgressPolicy struct { - state protoimpl.MessageState `protogen:"open.v1"` - Policy *ateapipb.EgressPolicy `protobuf:"bytes,1,opt,name=policy,proto3" json:"policy,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *EffectiveEgressPolicy) Reset() { - *x = EffectiveEgressPolicy{} - mi := &file_egress_policy_proto_msgTypes[1] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *EffectiveEgressPolicy) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*EffectiveEgressPolicy) ProtoMessage() {} - -func (x *EffectiveEgressPolicy) ProtoReflect() protoreflect.Message { - mi := &file_egress_policy_proto_msgTypes[1] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use EffectiveEgressPolicy.ProtoReflect.Descriptor instead. -func (*EffectiveEgressPolicy) Descriptor() ([]byte, []int) { - return file_egress_policy_proto_rawDescGZIP(), []int{1} -} - -func (x *EffectiveEgressPolicy) GetPolicy() *ateapipb.EgressPolicy { - if x != nil { - return x.Policy - } - return nil -} - -var File_egress_policy_proto protoreflect.FileDescriptor - -const file_egress_policy_proto_rawDesc = "" + - "\n" + - "\x13egress_policy.proto\x12\fegresspolicy\x1a\x1fpkg/proto/ateapipb/ateapi.proto\"g\n" + - "\x1fGetEffectiveEgressPolicyRequest\x12'\n" + - "\x05actor\x18\x01 \x01(\v2\x11.ateapi.ObjectRefR\x05actor\x12\x1b\n" + - "\tactor_uid\x18\x02 \x01(\tR\bactorUid\"E\n" + - "\x15EffectiveEgressPolicy\x12,\n" + - "\x06policy\x18\x01 \x01(\v2\x14.ateapi.EgressPolicyR\x06policy2|\n" + - "\bResolver\x12p\n" + - "\x18GetEffectiveEgressPolicy\x12-.egresspolicy.GetEffectiveEgressPolicyRequest\x1a#.egresspolicy.EffectiveEgressPolicy\"\x00BDZBgithub.com/agent-substrate/substrate/internal/proto/egresspolicypbb\x06proto3" - -var ( - file_egress_policy_proto_rawDescOnce sync.Once - file_egress_policy_proto_rawDescData []byte -) - -func file_egress_policy_proto_rawDescGZIP() []byte { - file_egress_policy_proto_rawDescOnce.Do(func() { - file_egress_policy_proto_rawDescData = protoimpl.X.CompressGZIP(unsafe.Slice(unsafe.StringData(file_egress_policy_proto_rawDesc), len(file_egress_policy_proto_rawDesc))) - }) - return file_egress_policy_proto_rawDescData -} - -var file_egress_policy_proto_msgTypes = make([]protoimpl.MessageInfo, 2) -var file_egress_policy_proto_goTypes = []any{ - (*GetEffectiveEgressPolicyRequest)(nil), // 0: egresspolicy.GetEffectiveEgressPolicyRequest - (*EffectiveEgressPolicy)(nil), // 1: egresspolicy.EffectiveEgressPolicy - (*ateapipb.ObjectRef)(nil), // 2: ateapi.ObjectRef - (*ateapipb.EgressPolicy)(nil), // 3: ateapi.EgressPolicy -} -var file_egress_policy_proto_depIdxs = []int32{ - 2, // 0: egresspolicy.GetEffectiveEgressPolicyRequest.actor:type_name -> ateapi.ObjectRef - 3, // 1: egresspolicy.EffectiveEgressPolicy.policy:type_name -> ateapi.EgressPolicy - 0, // 2: egresspolicy.Resolver.GetEffectiveEgressPolicy:input_type -> egresspolicy.GetEffectiveEgressPolicyRequest - 1, // 3: egresspolicy.Resolver.GetEffectiveEgressPolicy:output_type -> egresspolicy.EffectiveEgressPolicy - 3, // [3:4] is the sub-list for method output_type - 2, // [2:3] is the sub-list for method input_type - 2, // [2:2] is the sub-list for extension type_name - 2, // [2:2] is the sub-list for extension extendee - 0, // [0:2] is the sub-list for field type_name -} - -func init() { file_egress_policy_proto_init() } -func file_egress_policy_proto_init() { - if File_egress_policy_proto != nil { - return - } - type x struct{} - out := protoimpl.TypeBuilder{ - File: protoimpl.DescBuilder{ - GoPackagePath: reflect.TypeOf(x{}).PkgPath(), - RawDescriptor: unsafe.Slice(unsafe.StringData(file_egress_policy_proto_rawDesc), len(file_egress_policy_proto_rawDesc)), - NumEnums: 0, - NumMessages: 2, - NumExtensions: 0, - NumServices: 1, - }, - GoTypes: file_egress_policy_proto_goTypes, - DependencyIndexes: file_egress_policy_proto_depIdxs, - MessageInfos: file_egress_policy_proto_msgTypes, - }.Build() - File_egress_policy_proto = out.File - file_egress_policy_proto_goTypes = nil - file_egress_policy_proto_depIdxs = nil -} diff --git a/internal/proto/egresspolicypb/egress_policy.proto b/internal/proto/egresspolicypb/egress_policy.proto deleted file mode 100644 index e19d05f624..0000000000 --- a/internal/proto/egresspolicypb/egress_policy.proto +++ /dev/null @@ -1,35 +0,0 @@ -// Copyright 2026 Google LLC -// -// Licensed under the Apache License, Version 2.0 (the "License"); -// you may not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, software -// distributed under the License is distributed on an "AS IS" BASIS, -// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -// See the License for the specific language governing permissions and -// limitations under the License. - -syntax = "proto3"; - -package egresspolicy; - -import "pkg/proto/ateapipb/ateapi.proto"; - -option go_package = "github.com/agent-substrate/substrate/internal/proto/egresspolicypb"; - -// Resolver is an internal API used only by the egress gateway. -service Resolver { - rpc GetEffectiveEgressPolicy(GetEffectiveEgressPolicyRequest) returns (EffectiveEgressPolicy) {} -} - -message GetEffectiveEgressPolicyRequest { - ateapi.ObjectRef actor = 1; - string actor_uid = 2; -} - -message EffectiveEgressPolicy { - ateapi.EgressPolicy policy = 1; -} diff --git a/internal/proto/egresspolicypb/egress_policy_grpc.pb.go b/internal/proto/egresspolicypb/egress_policy_grpc.pb.go deleted file mode 100644 index e6d5eddb85..0000000000 --- a/internal/proto/egresspolicypb/egress_policy_grpc.pb.go +++ /dev/null @@ -1,139 +0,0 @@ -// Copyright 2026 Google LLC -// -// Licensed under the Apache License, Version 2.0 (the "License"); -// you may not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, software -// distributed under the License is distributed on an "AS IS" BASIS, -// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -// See the License for the specific language governing permissions and -// limitations under the License. - -// Code generated by protoc-gen-go-grpc. DO NOT EDIT. -// versions: -// - protoc-gen-go-grpc v1.6.1 -// - protoc v4.25.3 -// source: egress_policy.proto - -package egresspolicypb - -import ( - context "context" - grpc "google.golang.org/grpc" - codes "google.golang.org/grpc/codes" - status "google.golang.org/grpc/status" -) - -// This is a compile-time assertion to ensure that this generated file -// is compatible with the grpc package it is being compiled against. -// Requires gRPC-Go v1.64.0 or later. -const _ = grpc.SupportPackageIsVersion9 - -const ( - Resolver_GetEffectiveEgressPolicy_FullMethodName = "/egresspolicy.Resolver/GetEffectiveEgressPolicy" -) - -// ResolverClient is the client API for Resolver service. -// -// For semantics around ctx use and closing/ending streaming RPCs, please refer to https://pkg.go.dev/google.golang.org/grpc/?tab=doc#ClientConn.NewStream. -// -// Resolver is an internal API used only by the egress gateway. -type ResolverClient interface { - GetEffectiveEgressPolicy(ctx context.Context, in *GetEffectiveEgressPolicyRequest, opts ...grpc.CallOption) (*EffectiveEgressPolicy, error) -} - -type resolverClient struct { - cc grpc.ClientConnInterface -} - -func NewResolverClient(cc grpc.ClientConnInterface) ResolverClient { - return &resolverClient{cc} -} - -func (c *resolverClient) GetEffectiveEgressPolicy(ctx context.Context, in *GetEffectiveEgressPolicyRequest, opts ...grpc.CallOption) (*EffectiveEgressPolicy, error) { - cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(EffectiveEgressPolicy) - err := c.cc.Invoke(ctx, Resolver_GetEffectiveEgressPolicy_FullMethodName, in, out, cOpts...) - if err != nil { - return nil, err - } - return out, nil -} - -// ResolverServer is the server API for Resolver service. -// All implementations must embed UnimplementedResolverServer -// for forward compatibility. -// -// Resolver is an internal API used only by the egress gateway. -type ResolverServer interface { - GetEffectiveEgressPolicy(context.Context, *GetEffectiveEgressPolicyRequest) (*EffectiveEgressPolicy, error) - mustEmbedUnimplementedResolverServer() -} - -// UnimplementedResolverServer must be embedded to have -// forward compatible implementations. -// -// NOTE: this should be embedded by value instead of pointer to avoid a nil -// pointer dereference when methods are called. -type UnimplementedResolverServer struct{} - -func (UnimplementedResolverServer) GetEffectiveEgressPolicy(context.Context, *GetEffectiveEgressPolicyRequest) (*EffectiveEgressPolicy, error) { - return nil, status.Error(codes.Unimplemented, "method GetEffectiveEgressPolicy not implemented") -} -func (UnimplementedResolverServer) mustEmbedUnimplementedResolverServer() {} -func (UnimplementedResolverServer) testEmbeddedByValue() {} - -// UnsafeResolverServer may be embedded to opt out of forward compatibility for this service. -// Use of this interface is not recommended, as added methods to ResolverServer will -// result in compilation errors. -type UnsafeResolverServer interface { - mustEmbedUnimplementedResolverServer() -} - -func RegisterResolverServer(s grpc.ServiceRegistrar, srv ResolverServer) { - // If the following call panics, it indicates UnimplementedResolverServer was - // embedded by pointer and is nil. This will cause panics if an - // unimplemented method is ever invoked, so we test this at initialization - // time to prevent it from happening at runtime later due to I/O. - if t, ok := srv.(interface{ testEmbeddedByValue() }); ok { - t.testEmbeddedByValue() - } - s.RegisterService(&Resolver_ServiceDesc, srv) -} - -func _Resolver_GetEffectiveEgressPolicy_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(GetEffectiveEgressPolicyRequest) - if err := dec(in); err != nil { - return nil, err - } - if interceptor == nil { - return srv.(ResolverServer).GetEffectiveEgressPolicy(ctx, in) - } - info := &grpc.UnaryServerInfo{ - Server: srv, - FullMethod: Resolver_GetEffectiveEgressPolicy_FullMethodName, - } - handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(ResolverServer).GetEffectiveEgressPolicy(ctx, req.(*GetEffectiveEgressPolicyRequest)) - } - return interceptor(ctx, in, info, handler) -} - -// Resolver_ServiceDesc is the grpc.ServiceDesc for Resolver service. -// It's only intended for direct use with grpc.RegisterService, -// and not to be introspected or modified (even as a copy) -var Resolver_ServiceDesc = grpc.ServiceDesc{ - ServiceName: "egresspolicy.Resolver", - HandlerType: (*ResolverServer)(nil), - Methods: []grpc.MethodDesc{ - { - MethodName: "GetEffectiveEgressPolicy", - Handler: _Resolver_GetEffectiveEgressPolicy_Handler, - }, - }, - Streams: []grpc.StreamDesc{}, - Metadata: "egress_policy.proto", -} diff --git a/internal/proto/egresspolicypb/gen.go b/internal/proto/egresspolicypb/gen.go deleted file mode 100644 index e18feb0997..0000000000 --- a/internal/proto/egresspolicypb/gen.go +++ /dev/null @@ -1,17 +0,0 @@ -// Copyright 2026 Google LLC -// -// Licensed under the Apache License, Version 2.0 (the "License"); -// you may not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, software -// distributed under the License is distributed on an "AS IS" BASIS, -// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -// See the License for the specific language governing permissions and -// limitations under the License. - -package egresspolicypb - -//go:generate bash -c "../../../hack/protoc.sh -I . -I ../../.. --plugin=protoc-gen-go=$(bash ../../../hack/run-tool.sh --print-bin-path protoc-gen-go) --plugin=protoc-gen-go-grpc=$(bash ../../../hack/run-tool.sh --print-bin-path protoc-gen-go-grpc) --go_out=paths=source_relative:. --go-grpc_out=paths=source_relative:. egress_policy.proto" diff --git a/pkg/proto/ateapipb/ateapi.pb.go b/pkg/proto/ateapipb/ateapi.pb.go index 53e3482a04..6d0705e687 100644 --- a/pkg/proto/ateapipb/ateapi.pb.go +++ b/pkg/proto/ateapipb/ateapi.pb.go @@ -919,8 +919,9 @@ func (x *Actor) GetStatus() *ActorStatus { // named document per Actor. type EgressPolicy struct { state protoimpl.MessageState `protogen:"open.v1"` - // Server-assigned revision, increased on every mutation. - Version int64 `protobuf:"varint,1,opt,name=version,proto3" json:"version,omitempty"` + // Standard resource metadata. Atespace and name are always empty. UID, + // version, create_time, and update_time are server-managed. + Metadata *ResourceMetadata `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"` // A request is authorized when at least one rule matches. Effects from all // matching rules are then applied once per rule. Rule order has no meaning. // An empty rule list denies all traffic. @@ -959,11 +960,11 @@ func (*EgressPolicy) Descriptor() ([]byte, []int) { return file_ateapi_proto_rawDescGZIP(), []int{5} } -func (x *EgressPolicy) GetVersion() int64 { +func (x *EgressPolicy) GetMetadata() *ResourceMetadata { if x != nil { - return x.Version + return x.Metadata } - return 0 + return nil } func (x *EgressPolicy) GetRules() []*EgressRule { @@ -4283,8 +4284,8 @@ type SetActorEgressPolicyRequest struct { state protoimpl.MessageState `protogen:"open.v1"` // Parent Actor. V0 assigns the policy document's identity implicitly. Actor *ObjectRef `protobuf:"bytes,1,opt,name=actor,proto3" json:"actor,omitempty"` - // Full replacement. A zero version creates the document and fails if one - // already exists. A non-zero version replaces only the observed revision. + // Full replacement. Empty metadata creates the document and fails if one + // already exists. UID and version guard replacement of an observed document. EgressPolicy *EgressPolicy `protobuf:"bytes,2,opt,name=egress_policy,json=egressPolicy,proto3" json:"egress_policy,omitempty"` unknownFields protoimpl.UnknownFields sizeCache protoimpl.SizeCache @@ -5989,9 +5990,9 @@ const file_ateapi_proto_rawDesc = "" + "\x0eactor_template\x18\x04 \x01(\v2\x11.ateapi.ObjectRefR\ractorTemplate\x129\n" + "\x0fworker_selector\x18\x05 \x01(\v2\x10.ateapi.SelectorR\x0eworkerSelector\x12A\n" + "\x13source_snapshot_tag\x18\x06 \x01(\v2\x11.ateapi.ObjectRefR\x11sourceSnapshotTag\x12+\n" + - "\x06status\x18\a \x01(\v2\x13.ateapi.ActorStatusR\x06status\"R\n" + - "\fEgressPolicy\x12\x18\n" + - "\aversion\x18\x01 \x01(\x03R\aversion\x12(\n" + + "\x06status\x18\a \x01(\v2\x13.ateapi.ActorStatusR\x06status\"n\n" + + "\fEgressPolicy\x124\n" + + "\bmetadata\x18\x01 \x01(\v2\x18.ateapi.ResourceMetadataR\bmetadata\x12(\n" + "\x05rules\x18\x02 \x03(\v2\x12.ateapi.EgressRuleR\x05rules\"l\n" + "\n" + "EgressRule\x12)\n" + @@ -6522,180 +6523,181 @@ var file_ateapi_proto_depIdxs = []int32{ 10, // 8: ateapi.Actor.worker_selector:type_name -> ateapi.Selector 30, // 9: ateapi.Actor.source_snapshot_tag:type_name -> ateapi.ObjectRef 23, // 10: ateapi.Actor.status:type_name -> ateapi.ActorStatus - 15, // 11: ateapi.EgressPolicy.rules:type_name -> ateapi.EgressRule - 16, // 12: ateapi.EgressRule.allow:type_name -> ateapi.EgressMatch - 19, // 13: ateapi.EgressRule.effects:type_name -> ateapi.EgressRuleEffects - 107, // 14: ateapi.EgressMatch.all:type_name -> google.protobuf.Empty - 17, // 15: ateapi.EgressMatch.hostname:type_name -> ateapi.HostnameMatch - 18, // 16: ateapi.EgressMatch.ip_block:type_name -> ateapi.IPBlockMatch - 20, // 17: ateapi.EgressRuleEffects.inject_static_header:type_name -> ateapi.StaticHeaderInjection - 21, // 18: ateapi.EgressRuleEffects.inject_actor_jwt:type_name -> ateapi.ActorTokenInjection - 22, // 19: ateapi.ActorTokenInjection.rfc_8693_exchange:type_name -> ateapi.RFC8693ExchangeParameters - 2, // 20: ateapi.ActorStatus.state:type_name -> ateapi.ActorState - 25, // 21: ateapi.ActorStatus.worker_assignment:type_name -> ateapi.WorkerAssignment - 30, // 22: ateapi.ActorStatus.latest_snapshot:type_name -> ateapi.ObjectRef - 9, // 23: ateapi.ActorStatus.local_snapshot_info:type_name -> ateapi.LocalSnapshotInfo - 12, // 24: ateapi.ActorStatus.actor_volumes:type_name -> ateapi.ExternalVolume - 24, // 25: ateapi.ActorStatus.source_snapshot:type_name -> ateapi.ActorSourceSnapshotStatus - 30, // 26: ateapi.ActorSourceSnapshotStatus.snapshot:type_name -> ateapi.ObjectRef - 30, // 27: ateapi.WorkerAssignment.worker:type_name -> ateapi.ObjectRef - 11, // 28: ateapi.ActorSnapshot.metadata:type_name -> ateapi.ResourceMetadata - 27, // 29: ateapi.ActorSnapshot.status:type_name -> ateapi.ActorSnapshotStatus - 30, // 30: ateapi.ActorSnapshotStatus.source_actor:type_name -> ateapi.ObjectRef - 0, // 31: ateapi.ActorSnapshotStatus.content_scope:type_name -> ateapi.SnapshotContentScope - 30, // 32: ateapi.ActorSnapshotStatus.actor_template:type_name -> ateapi.ObjectRef - 11, // 33: ateapi.ActorSnapshotTag.metadata:type_name -> ateapi.ResourceMetadata - 30, // 34: ateapi.ActorSnapshotTag.snapshot:type_name -> ateapi.ObjectRef - 1, // 35: ateapi.ActorSnapshotTag.scope:type_name -> ateapi.ActorSnapshotTagScope - 11, // 36: ateapi.Atespace.metadata:type_name -> ateapi.ResourceMetadata - 11, // 37: ateapi.ActorTemplate.metadata:type_name -> ateapi.ResourceMetadata - 10, // 38: ateapi.ActorTemplate.worker_selector:type_name -> ateapi.Selector - 38, // 39: ateapi.ActorTemplate.containers:type_name -> ateapi.Container - 42, // 40: ateapi.ActorTemplate.volumes:type_name -> ateapi.Volume - 36, // 41: ateapi.ActorTemplate.snapshots_config:type_name -> ateapi.SnapshotsConfig - 35, // 42: ateapi.ActorTemplate.sandbox_config:type_name -> ateapi.SandboxConfig - 32, // 43: ateapi.ActorTemplate.resources:type_name -> ateapi.Resources - 34, // 44: ateapi.ActorTemplate.status:type_name -> ateapi.ActorTemplateStatus - 33, // 45: ateapi.Resources.limits:type_name -> ateapi.Limits - 4, // 46: ateapi.ActorTemplateStatus.phase:type_name -> ateapi.ActorTemplatePhase - 30, // 47: ateapi.ActorTemplateStatus.golden_snapshot:type_name -> ateapi.ObjectRef - 46, // 48: ateapi.ActorTemplateStatus.sandbox_assets:type_name -> ateapi.SandboxAssets - 3, // 49: ateapi.SandboxConfig.sandbox_class:type_name -> ateapi.SandboxClass - 0, // 50: ateapi.SnapshotsConfig.on_pause:type_name -> ateapi.SnapshotContentScope - 0, // 51: ateapi.SnapshotsConfig.on_commit:type_name -> ateapi.SnapshotContentScope - 37, // 52: ateapi.SnapshotsConfig.on_resume:type_name -> ateapi.OnResumeConfig - 5, // 53: ateapi.OnResumeConfig.from_data:type_name -> ateapi.ResumeSource - 39, // 54: ateapi.Container.env:type_name -> ateapi.EnvVar - 40, // 55: ateapi.Container.readyz:type_name -> ateapi.ContainerReadyz - 45, // 56: ateapi.Container.volume_mounts:type_name -> ateapi.VolumeMount - 41, // 57: ateapi.ContainerReadyz.http_get:type_name -> ateapi.HTTPGetAction - 43, // 58: ateapi.Volume.durable_dir:type_name -> ateapi.DurableDirVolumeSource - 44, // 59: ateapi.Volume.external_volume_template:type_name -> ateapi.ExternalVolumeTemplate - 3, // 60: ateapi.SandboxAssets.sandbox_class:type_name -> ateapi.SandboxClass - 103, // 61: ateapi.SandboxAssets.assets:type_name -> ateapi.SandboxAssets.AssetsEntry - 104, // 62: ateapi.ArchAssets.files:type_name -> ateapi.ArchAssets.FilesEntry - 29, // 63: ateapi.CreateAtespaceRequest.atespace:type_name -> ateapi.Atespace - 30, // 64: ateapi.GetAtespaceRequest.atespace:type_name -> ateapi.ObjectRef - 29, // 65: ateapi.ListAtespacesResponse.atespaces:type_name -> ateapi.Atespace - 30, // 66: ateapi.DeleteAtespaceRequest.atespace:type_name -> ateapi.ObjectRef - 31, // 67: ateapi.CreateActorTemplateRequest.actor_template:type_name -> ateapi.ActorTemplate - 30, // 68: ateapi.GetActorTemplateRequest.actor_template:type_name -> ateapi.ObjectRef - 31, // 69: ateapi.ListActorTemplatesResponse.actor_templates:type_name -> ateapi.ActorTemplate - 30, // 70: ateapi.DeleteActorTemplateRequest.actor_template:type_name -> ateapi.ObjectRef - 30, // 71: ateapi.GetActorRequest.actor:type_name -> ateapi.ObjectRef - 13, // 72: ateapi.CreateActorRequest.actor:type_name -> ateapi.Actor - 13, // 73: ateapi.UpdateActorRequest.actor:type_name -> ateapi.Actor - 30, // 74: ateapi.SuspendActorRequest.actor:type_name -> ateapi.ObjectRef - 13, // 75: ateapi.SuspendActorResponse.actor:type_name -> ateapi.Actor - 30, // 76: ateapi.PauseActorRequest.actor:type_name -> ateapi.ObjectRef - 13, // 77: ateapi.PauseActorResponse.actor:type_name -> ateapi.Actor - 30, // 78: ateapi.ResumeActorRequest.actor:type_name -> ateapi.ObjectRef - 13, // 79: ateapi.ResumeActorResponse.actor:type_name -> ateapi.Actor - 30, // 80: ateapi.DeleteActorRequest.actor:type_name -> ateapi.ObjectRef - 30, // 81: ateapi.GetActorEgressPolicyRequest.actor:type_name -> ateapi.ObjectRef - 14, // 82: ateapi.GetActorEgressPolicyResponse.egress_policies:type_name -> ateapi.EgressPolicy - 30, // 83: ateapi.SetActorEgressPolicyRequest.actor:type_name -> ateapi.ObjectRef - 14, // 84: ateapi.SetActorEgressPolicyRequest.egress_policy:type_name -> ateapi.EgressPolicy - 30, // 85: ateapi.DeleteActorEgressPolicyRequest.actor:type_name -> ateapi.ObjectRef - 30, // 86: ateapi.GetActorSnapshotRequest.actor_snapshot:type_name -> ateapi.ObjectRef - 30, // 87: ateapi.GetActorSnapshotTagRequest.actor_snapshot_tag:type_name -> ateapi.ObjectRef - 26, // 88: ateapi.ListActorSnapshotsResponse.actor_snapshots:type_name -> ateapi.ActorSnapshot - 28, // 89: ateapi.CreateActorSnapshotTagRequest.actor_snapshot_tag:type_name -> ateapi.ActorSnapshotTag - 28, // 90: ateapi.UpdateActorSnapshotTagRequest.actor_snapshot_tag:type_name -> ateapi.ActorSnapshotTag - 30, // 91: ateapi.DeleteActorSnapshotTagRequest.actor_snapshot_tag:type_name -> ateapi.ObjectRef - 90, // 92: ateapi.ListWorkersResponse.workers:type_name -> ateapi.Worker - 30, // 93: ateapi.GetWorkerRequest.worker:type_name -> ateapi.ObjectRef - 90, // 94: ateapi.CreateWorkerRequest.worker:type_name -> ateapi.Worker - 90, // 95: ateapi.UpdateWorkerRequest.worker:type_name -> ateapi.Worker - 30, // 96: ateapi.DeleteWorkerRequest.worker:type_name -> ateapi.ObjectRef - 80, // 97: ateapi.DeleteWorkerRequest.options:type_name -> ateapi.DeleteOptions - 30, // 98: ateapi.DrainWorkerRequest.worker:type_name -> ateapi.ObjectRef - 13, // 99: ateapi.ListActorsResponse.actors:type_name -> ateapi.Actor - 11, // 100: ateapi.Worker.metadata:type_name -> ateapi.ResourceMetadata - 105, // 101: ateapi.Worker.labels:type_name -> ateapi.Worker.LabelsEntry - 92, // 102: ateapi.Worker.capacity:type_name -> ateapi.WorkerCapacity - 91, // 103: ateapi.Worker.status:type_name -> ateapi.WorkerStatus - 6, // 104: ateapi.WorkerStatus.state:type_name -> ateapi.WorkerState - 93, // 105: ateapi.WorkerStatus.assignment:type_name -> ateapi.ActorAssignment - 94, // 106: ateapi.ActorAssignment.actor_template:type_name -> ateapi.KubeNamespacedObjectRef - 30, // 107: ateapi.ActorAssignment.actor:type_name -> ateapi.ObjectRef - 30, // 108: ateapi.MintCertRequest.worker:type_name -> ateapi.ObjectRef - 7, // 109: ateapi.MintCertRequest.purpose:type_name -> ateapi.ActorCertificatePurpose - 47, // 110: ateapi.SandboxAssets.AssetsEntry.value:type_name -> ateapi.ArchAssets - 48, // 111: ateapi.ArchAssets.FilesEntry.value:type_name -> ateapi.AssetFile - 59, // 112: ateapi.Control.GetActor:input_type -> ateapi.GetActorRequest - 60, // 113: ateapi.Control.CreateActor:input_type -> ateapi.CreateActorRequest - 61, // 114: ateapi.Control.UpdateActor:input_type -> ateapi.UpdateActorRequest - 62, // 115: ateapi.Control.SuspendActor:input_type -> ateapi.SuspendActorRequest - 64, // 116: ateapi.Control.PauseActor:input_type -> ateapi.PauseActorRequest - 66, // 117: ateapi.Control.ResumeActor:input_type -> ateapi.ResumeActorRequest - 68, // 118: ateapi.Control.DeleteActor:input_type -> ateapi.DeleteActorRequest - 69, // 119: ateapi.Control.GetActorEgressPolicy:input_type -> ateapi.GetActorEgressPolicyRequest - 71, // 120: ateapi.Control.SetActorEgressPolicy:input_type -> ateapi.SetActorEgressPolicyRequest - 72, // 121: ateapi.Control.DeleteActorEgressPolicy:input_type -> ateapi.DeleteActorEgressPolicyRequest - 73, // 122: ateapi.Control.GetActorSnapshot:input_type -> ateapi.GetActorSnapshotRequest - 74, // 123: ateapi.Control.GetActorSnapshotTag:input_type -> ateapi.GetActorSnapshotTagRequest - 75, // 124: ateapi.Control.ListActorSnapshots:input_type -> ateapi.ListActorSnapshotsRequest - 77, // 125: ateapi.Control.CreateActorSnapshotTag:input_type -> ateapi.CreateActorSnapshotTagRequest - 78, // 126: ateapi.Control.UpdateActorSnapshotTag:input_type -> ateapi.UpdateActorSnapshotTagRequest - 79, // 127: ateapi.Control.DeleteActorSnapshotTag:input_type -> ateapi.DeleteActorSnapshotTagRequest - 81, // 128: ateapi.Control.ListWorkers:input_type -> ateapi.ListWorkersRequest - 83, // 129: ateapi.Control.GetWorker:input_type -> ateapi.GetWorkerRequest - 84, // 130: ateapi.Control.CreateWorker:input_type -> ateapi.CreateWorkerRequest - 85, // 131: ateapi.Control.UpdateWorker:input_type -> ateapi.UpdateWorkerRequest - 86, // 132: ateapi.Control.DeleteWorker:input_type -> ateapi.DeleteWorkerRequest - 87, // 133: ateapi.Control.DrainWorker:input_type -> ateapi.DrainWorkerRequest - 88, // 134: ateapi.Control.ListActors:input_type -> ateapi.ListActorsRequest - 49, // 135: ateapi.Control.CreateAtespace:input_type -> ateapi.CreateAtespaceRequest - 50, // 136: ateapi.Control.GetAtespace:input_type -> ateapi.GetAtespaceRequest - 51, // 137: ateapi.Control.ListAtespaces:input_type -> ateapi.ListAtespacesRequest - 53, // 138: ateapi.Control.DeleteAtespace:input_type -> ateapi.DeleteAtespaceRequest - 54, // 139: ateapi.Control.CreateActorTemplate:input_type -> ateapi.CreateActorTemplateRequest - 55, // 140: ateapi.Control.GetActorTemplate:input_type -> ateapi.GetActorTemplateRequest - 56, // 141: ateapi.Control.ListActorTemplates:input_type -> ateapi.ListActorTemplatesRequest - 58, // 142: ateapi.Control.DeleteActorTemplate:input_type -> ateapi.DeleteActorTemplateRequest - 95, // 143: ateapi.Debug.DebugClear:input_type -> ateapi.DebugClearRequest - 97, // 144: ateapi.ActorIdentity.MintJWT:input_type -> ateapi.MintJWTRequest - 99, // 145: ateapi.ActorIdentity.MintCert:input_type -> ateapi.MintCertRequest - 13, // 146: ateapi.Control.GetActor:output_type -> ateapi.Actor - 13, // 147: ateapi.Control.CreateActor:output_type -> ateapi.Actor - 13, // 148: ateapi.Control.UpdateActor:output_type -> ateapi.Actor - 63, // 149: ateapi.Control.SuspendActor:output_type -> ateapi.SuspendActorResponse - 65, // 150: ateapi.Control.PauseActor:output_type -> ateapi.PauseActorResponse - 67, // 151: ateapi.Control.ResumeActor:output_type -> ateapi.ResumeActorResponse - 13, // 152: ateapi.Control.DeleteActor:output_type -> ateapi.Actor - 70, // 153: ateapi.Control.GetActorEgressPolicy:output_type -> ateapi.GetActorEgressPolicyResponse - 14, // 154: ateapi.Control.SetActorEgressPolicy:output_type -> ateapi.EgressPolicy - 14, // 155: ateapi.Control.DeleteActorEgressPolicy:output_type -> ateapi.EgressPolicy - 26, // 156: ateapi.Control.GetActorSnapshot:output_type -> ateapi.ActorSnapshot - 28, // 157: ateapi.Control.GetActorSnapshotTag:output_type -> ateapi.ActorSnapshotTag - 76, // 158: ateapi.Control.ListActorSnapshots:output_type -> ateapi.ListActorSnapshotsResponse - 28, // 159: ateapi.Control.CreateActorSnapshotTag:output_type -> ateapi.ActorSnapshotTag - 28, // 160: ateapi.Control.UpdateActorSnapshotTag:output_type -> ateapi.ActorSnapshotTag - 28, // 161: ateapi.Control.DeleteActorSnapshotTag:output_type -> ateapi.ActorSnapshotTag - 82, // 162: ateapi.Control.ListWorkers:output_type -> ateapi.ListWorkersResponse - 90, // 163: ateapi.Control.GetWorker:output_type -> ateapi.Worker - 90, // 164: ateapi.Control.CreateWorker:output_type -> ateapi.Worker - 90, // 165: ateapi.Control.UpdateWorker:output_type -> ateapi.Worker - 90, // 166: ateapi.Control.DeleteWorker:output_type -> ateapi.Worker - 90, // 167: ateapi.Control.DrainWorker:output_type -> ateapi.Worker - 89, // 168: ateapi.Control.ListActors:output_type -> ateapi.ListActorsResponse - 29, // 169: ateapi.Control.CreateAtespace:output_type -> ateapi.Atespace - 29, // 170: ateapi.Control.GetAtespace:output_type -> ateapi.Atespace - 52, // 171: ateapi.Control.ListAtespaces:output_type -> ateapi.ListAtespacesResponse - 29, // 172: ateapi.Control.DeleteAtespace:output_type -> ateapi.Atespace - 31, // 173: ateapi.Control.CreateActorTemplate:output_type -> ateapi.ActorTemplate - 31, // 174: ateapi.Control.GetActorTemplate:output_type -> ateapi.ActorTemplate - 57, // 175: ateapi.Control.ListActorTemplates:output_type -> ateapi.ListActorTemplatesResponse - 31, // 176: ateapi.Control.DeleteActorTemplate:output_type -> ateapi.ActorTemplate - 96, // 177: ateapi.Debug.DebugClear:output_type -> ateapi.DebugClearResponse - 98, // 178: ateapi.ActorIdentity.MintJWT:output_type -> ateapi.MintJWTResponse - 100, // 179: ateapi.ActorIdentity.MintCert:output_type -> ateapi.MintCertResponse - 146, // [146:180] is the sub-list for method output_type - 112, // [112:146] is the sub-list for method input_type - 112, // [112:112] is the sub-list for extension type_name - 112, // [112:112] is the sub-list for extension extendee - 0, // [0:112] is the sub-list for field type_name + 11, // 11: ateapi.EgressPolicy.metadata:type_name -> ateapi.ResourceMetadata + 15, // 12: ateapi.EgressPolicy.rules:type_name -> ateapi.EgressRule + 16, // 13: ateapi.EgressRule.allow:type_name -> ateapi.EgressMatch + 19, // 14: ateapi.EgressRule.effects:type_name -> ateapi.EgressRuleEffects + 107, // 15: ateapi.EgressMatch.all:type_name -> google.protobuf.Empty + 17, // 16: ateapi.EgressMatch.hostname:type_name -> ateapi.HostnameMatch + 18, // 17: ateapi.EgressMatch.ip_block:type_name -> ateapi.IPBlockMatch + 20, // 18: ateapi.EgressRuleEffects.inject_static_header:type_name -> ateapi.StaticHeaderInjection + 21, // 19: ateapi.EgressRuleEffects.inject_actor_jwt:type_name -> ateapi.ActorTokenInjection + 22, // 20: ateapi.ActorTokenInjection.rfc_8693_exchange:type_name -> ateapi.RFC8693ExchangeParameters + 2, // 21: ateapi.ActorStatus.state:type_name -> ateapi.ActorState + 25, // 22: ateapi.ActorStatus.worker_assignment:type_name -> ateapi.WorkerAssignment + 30, // 23: ateapi.ActorStatus.latest_snapshot:type_name -> ateapi.ObjectRef + 9, // 24: ateapi.ActorStatus.local_snapshot_info:type_name -> ateapi.LocalSnapshotInfo + 12, // 25: ateapi.ActorStatus.actor_volumes:type_name -> ateapi.ExternalVolume + 24, // 26: ateapi.ActorStatus.source_snapshot:type_name -> ateapi.ActorSourceSnapshotStatus + 30, // 27: ateapi.ActorSourceSnapshotStatus.snapshot:type_name -> ateapi.ObjectRef + 30, // 28: ateapi.WorkerAssignment.worker:type_name -> ateapi.ObjectRef + 11, // 29: ateapi.ActorSnapshot.metadata:type_name -> ateapi.ResourceMetadata + 27, // 30: ateapi.ActorSnapshot.status:type_name -> ateapi.ActorSnapshotStatus + 30, // 31: ateapi.ActorSnapshotStatus.source_actor:type_name -> ateapi.ObjectRef + 0, // 32: ateapi.ActorSnapshotStatus.content_scope:type_name -> ateapi.SnapshotContentScope + 30, // 33: ateapi.ActorSnapshotStatus.actor_template:type_name -> ateapi.ObjectRef + 11, // 34: ateapi.ActorSnapshotTag.metadata:type_name -> ateapi.ResourceMetadata + 30, // 35: ateapi.ActorSnapshotTag.snapshot:type_name -> ateapi.ObjectRef + 1, // 36: ateapi.ActorSnapshotTag.scope:type_name -> ateapi.ActorSnapshotTagScope + 11, // 37: ateapi.Atespace.metadata:type_name -> ateapi.ResourceMetadata + 11, // 38: ateapi.ActorTemplate.metadata:type_name -> ateapi.ResourceMetadata + 10, // 39: ateapi.ActorTemplate.worker_selector:type_name -> ateapi.Selector + 38, // 40: ateapi.ActorTemplate.containers:type_name -> ateapi.Container + 42, // 41: ateapi.ActorTemplate.volumes:type_name -> ateapi.Volume + 36, // 42: ateapi.ActorTemplate.snapshots_config:type_name -> ateapi.SnapshotsConfig + 35, // 43: ateapi.ActorTemplate.sandbox_config:type_name -> ateapi.SandboxConfig + 32, // 44: ateapi.ActorTemplate.resources:type_name -> ateapi.Resources + 34, // 45: ateapi.ActorTemplate.status:type_name -> ateapi.ActorTemplateStatus + 33, // 46: ateapi.Resources.limits:type_name -> ateapi.Limits + 4, // 47: ateapi.ActorTemplateStatus.phase:type_name -> ateapi.ActorTemplatePhase + 30, // 48: ateapi.ActorTemplateStatus.golden_snapshot:type_name -> ateapi.ObjectRef + 46, // 49: ateapi.ActorTemplateStatus.sandbox_assets:type_name -> ateapi.SandboxAssets + 3, // 50: ateapi.SandboxConfig.sandbox_class:type_name -> ateapi.SandboxClass + 0, // 51: ateapi.SnapshotsConfig.on_pause:type_name -> ateapi.SnapshotContentScope + 0, // 52: ateapi.SnapshotsConfig.on_commit:type_name -> ateapi.SnapshotContentScope + 37, // 53: ateapi.SnapshotsConfig.on_resume:type_name -> ateapi.OnResumeConfig + 5, // 54: ateapi.OnResumeConfig.from_data:type_name -> ateapi.ResumeSource + 39, // 55: ateapi.Container.env:type_name -> ateapi.EnvVar + 40, // 56: ateapi.Container.readyz:type_name -> ateapi.ContainerReadyz + 45, // 57: ateapi.Container.volume_mounts:type_name -> ateapi.VolumeMount + 41, // 58: ateapi.ContainerReadyz.http_get:type_name -> ateapi.HTTPGetAction + 43, // 59: ateapi.Volume.durable_dir:type_name -> ateapi.DurableDirVolumeSource + 44, // 60: ateapi.Volume.external_volume_template:type_name -> ateapi.ExternalVolumeTemplate + 3, // 61: ateapi.SandboxAssets.sandbox_class:type_name -> ateapi.SandboxClass + 103, // 62: ateapi.SandboxAssets.assets:type_name -> ateapi.SandboxAssets.AssetsEntry + 104, // 63: ateapi.ArchAssets.files:type_name -> ateapi.ArchAssets.FilesEntry + 29, // 64: ateapi.CreateAtespaceRequest.atespace:type_name -> ateapi.Atespace + 30, // 65: ateapi.GetAtespaceRequest.atespace:type_name -> ateapi.ObjectRef + 29, // 66: ateapi.ListAtespacesResponse.atespaces:type_name -> ateapi.Atespace + 30, // 67: ateapi.DeleteAtespaceRequest.atespace:type_name -> ateapi.ObjectRef + 31, // 68: ateapi.CreateActorTemplateRequest.actor_template:type_name -> ateapi.ActorTemplate + 30, // 69: ateapi.GetActorTemplateRequest.actor_template:type_name -> ateapi.ObjectRef + 31, // 70: ateapi.ListActorTemplatesResponse.actor_templates:type_name -> ateapi.ActorTemplate + 30, // 71: ateapi.DeleteActorTemplateRequest.actor_template:type_name -> ateapi.ObjectRef + 30, // 72: ateapi.GetActorRequest.actor:type_name -> ateapi.ObjectRef + 13, // 73: ateapi.CreateActorRequest.actor:type_name -> ateapi.Actor + 13, // 74: ateapi.UpdateActorRequest.actor:type_name -> ateapi.Actor + 30, // 75: ateapi.SuspendActorRequest.actor:type_name -> ateapi.ObjectRef + 13, // 76: ateapi.SuspendActorResponse.actor:type_name -> ateapi.Actor + 30, // 77: ateapi.PauseActorRequest.actor:type_name -> ateapi.ObjectRef + 13, // 78: ateapi.PauseActorResponse.actor:type_name -> ateapi.Actor + 30, // 79: ateapi.ResumeActorRequest.actor:type_name -> ateapi.ObjectRef + 13, // 80: ateapi.ResumeActorResponse.actor:type_name -> ateapi.Actor + 30, // 81: ateapi.DeleteActorRequest.actor:type_name -> ateapi.ObjectRef + 30, // 82: ateapi.GetActorEgressPolicyRequest.actor:type_name -> ateapi.ObjectRef + 14, // 83: ateapi.GetActorEgressPolicyResponse.egress_policies:type_name -> ateapi.EgressPolicy + 30, // 84: ateapi.SetActorEgressPolicyRequest.actor:type_name -> ateapi.ObjectRef + 14, // 85: ateapi.SetActorEgressPolicyRequest.egress_policy:type_name -> ateapi.EgressPolicy + 30, // 86: ateapi.DeleteActorEgressPolicyRequest.actor:type_name -> ateapi.ObjectRef + 30, // 87: ateapi.GetActorSnapshotRequest.actor_snapshot:type_name -> ateapi.ObjectRef + 30, // 88: ateapi.GetActorSnapshotTagRequest.actor_snapshot_tag:type_name -> ateapi.ObjectRef + 26, // 89: ateapi.ListActorSnapshotsResponse.actor_snapshots:type_name -> ateapi.ActorSnapshot + 28, // 90: ateapi.CreateActorSnapshotTagRequest.actor_snapshot_tag:type_name -> ateapi.ActorSnapshotTag + 28, // 91: ateapi.UpdateActorSnapshotTagRequest.actor_snapshot_tag:type_name -> ateapi.ActorSnapshotTag + 30, // 92: ateapi.DeleteActorSnapshotTagRequest.actor_snapshot_tag:type_name -> ateapi.ObjectRef + 90, // 93: ateapi.ListWorkersResponse.workers:type_name -> ateapi.Worker + 30, // 94: ateapi.GetWorkerRequest.worker:type_name -> ateapi.ObjectRef + 90, // 95: ateapi.CreateWorkerRequest.worker:type_name -> ateapi.Worker + 90, // 96: ateapi.UpdateWorkerRequest.worker:type_name -> ateapi.Worker + 30, // 97: ateapi.DeleteWorkerRequest.worker:type_name -> ateapi.ObjectRef + 80, // 98: ateapi.DeleteWorkerRequest.options:type_name -> ateapi.DeleteOptions + 30, // 99: ateapi.DrainWorkerRequest.worker:type_name -> ateapi.ObjectRef + 13, // 100: ateapi.ListActorsResponse.actors:type_name -> ateapi.Actor + 11, // 101: ateapi.Worker.metadata:type_name -> ateapi.ResourceMetadata + 105, // 102: ateapi.Worker.labels:type_name -> ateapi.Worker.LabelsEntry + 92, // 103: ateapi.Worker.capacity:type_name -> ateapi.WorkerCapacity + 91, // 104: ateapi.Worker.status:type_name -> ateapi.WorkerStatus + 6, // 105: ateapi.WorkerStatus.state:type_name -> ateapi.WorkerState + 93, // 106: ateapi.WorkerStatus.assignment:type_name -> ateapi.ActorAssignment + 94, // 107: ateapi.ActorAssignment.actor_template:type_name -> ateapi.KubeNamespacedObjectRef + 30, // 108: ateapi.ActorAssignment.actor:type_name -> ateapi.ObjectRef + 30, // 109: ateapi.MintCertRequest.worker:type_name -> ateapi.ObjectRef + 7, // 110: ateapi.MintCertRequest.purpose:type_name -> ateapi.ActorCertificatePurpose + 47, // 111: ateapi.SandboxAssets.AssetsEntry.value:type_name -> ateapi.ArchAssets + 48, // 112: ateapi.ArchAssets.FilesEntry.value:type_name -> ateapi.AssetFile + 59, // 113: ateapi.Control.GetActor:input_type -> ateapi.GetActorRequest + 60, // 114: ateapi.Control.CreateActor:input_type -> ateapi.CreateActorRequest + 61, // 115: ateapi.Control.UpdateActor:input_type -> ateapi.UpdateActorRequest + 62, // 116: ateapi.Control.SuspendActor:input_type -> ateapi.SuspendActorRequest + 64, // 117: ateapi.Control.PauseActor:input_type -> ateapi.PauseActorRequest + 66, // 118: ateapi.Control.ResumeActor:input_type -> ateapi.ResumeActorRequest + 68, // 119: ateapi.Control.DeleteActor:input_type -> ateapi.DeleteActorRequest + 69, // 120: ateapi.Control.GetActorEgressPolicy:input_type -> ateapi.GetActorEgressPolicyRequest + 71, // 121: ateapi.Control.SetActorEgressPolicy:input_type -> ateapi.SetActorEgressPolicyRequest + 72, // 122: ateapi.Control.DeleteActorEgressPolicy:input_type -> ateapi.DeleteActorEgressPolicyRequest + 73, // 123: ateapi.Control.GetActorSnapshot:input_type -> ateapi.GetActorSnapshotRequest + 74, // 124: ateapi.Control.GetActorSnapshotTag:input_type -> ateapi.GetActorSnapshotTagRequest + 75, // 125: ateapi.Control.ListActorSnapshots:input_type -> ateapi.ListActorSnapshotsRequest + 77, // 126: ateapi.Control.CreateActorSnapshotTag:input_type -> ateapi.CreateActorSnapshotTagRequest + 78, // 127: ateapi.Control.UpdateActorSnapshotTag:input_type -> ateapi.UpdateActorSnapshotTagRequest + 79, // 128: ateapi.Control.DeleteActorSnapshotTag:input_type -> ateapi.DeleteActorSnapshotTagRequest + 81, // 129: ateapi.Control.ListWorkers:input_type -> ateapi.ListWorkersRequest + 83, // 130: ateapi.Control.GetWorker:input_type -> ateapi.GetWorkerRequest + 84, // 131: ateapi.Control.CreateWorker:input_type -> ateapi.CreateWorkerRequest + 85, // 132: ateapi.Control.UpdateWorker:input_type -> ateapi.UpdateWorkerRequest + 86, // 133: ateapi.Control.DeleteWorker:input_type -> ateapi.DeleteWorkerRequest + 87, // 134: ateapi.Control.DrainWorker:input_type -> ateapi.DrainWorkerRequest + 88, // 135: ateapi.Control.ListActors:input_type -> ateapi.ListActorsRequest + 49, // 136: ateapi.Control.CreateAtespace:input_type -> ateapi.CreateAtespaceRequest + 50, // 137: ateapi.Control.GetAtespace:input_type -> ateapi.GetAtespaceRequest + 51, // 138: ateapi.Control.ListAtespaces:input_type -> ateapi.ListAtespacesRequest + 53, // 139: ateapi.Control.DeleteAtespace:input_type -> ateapi.DeleteAtespaceRequest + 54, // 140: ateapi.Control.CreateActorTemplate:input_type -> ateapi.CreateActorTemplateRequest + 55, // 141: ateapi.Control.GetActorTemplate:input_type -> ateapi.GetActorTemplateRequest + 56, // 142: ateapi.Control.ListActorTemplates:input_type -> ateapi.ListActorTemplatesRequest + 58, // 143: ateapi.Control.DeleteActorTemplate:input_type -> ateapi.DeleteActorTemplateRequest + 95, // 144: ateapi.Debug.DebugClear:input_type -> ateapi.DebugClearRequest + 97, // 145: ateapi.ActorIdentity.MintJWT:input_type -> ateapi.MintJWTRequest + 99, // 146: ateapi.ActorIdentity.MintCert:input_type -> ateapi.MintCertRequest + 13, // 147: ateapi.Control.GetActor:output_type -> ateapi.Actor + 13, // 148: ateapi.Control.CreateActor:output_type -> ateapi.Actor + 13, // 149: ateapi.Control.UpdateActor:output_type -> ateapi.Actor + 63, // 150: ateapi.Control.SuspendActor:output_type -> ateapi.SuspendActorResponse + 65, // 151: ateapi.Control.PauseActor:output_type -> ateapi.PauseActorResponse + 67, // 152: ateapi.Control.ResumeActor:output_type -> ateapi.ResumeActorResponse + 13, // 153: ateapi.Control.DeleteActor:output_type -> ateapi.Actor + 70, // 154: ateapi.Control.GetActorEgressPolicy:output_type -> ateapi.GetActorEgressPolicyResponse + 14, // 155: ateapi.Control.SetActorEgressPolicy:output_type -> ateapi.EgressPolicy + 14, // 156: ateapi.Control.DeleteActorEgressPolicy:output_type -> ateapi.EgressPolicy + 26, // 157: ateapi.Control.GetActorSnapshot:output_type -> ateapi.ActorSnapshot + 28, // 158: ateapi.Control.GetActorSnapshotTag:output_type -> ateapi.ActorSnapshotTag + 76, // 159: ateapi.Control.ListActorSnapshots:output_type -> ateapi.ListActorSnapshotsResponse + 28, // 160: ateapi.Control.CreateActorSnapshotTag:output_type -> ateapi.ActorSnapshotTag + 28, // 161: ateapi.Control.UpdateActorSnapshotTag:output_type -> ateapi.ActorSnapshotTag + 28, // 162: ateapi.Control.DeleteActorSnapshotTag:output_type -> ateapi.ActorSnapshotTag + 82, // 163: ateapi.Control.ListWorkers:output_type -> ateapi.ListWorkersResponse + 90, // 164: ateapi.Control.GetWorker:output_type -> ateapi.Worker + 90, // 165: ateapi.Control.CreateWorker:output_type -> ateapi.Worker + 90, // 166: ateapi.Control.UpdateWorker:output_type -> ateapi.Worker + 90, // 167: ateapi.Control.DeleteWorker:output_type -> ateapi.Worker + 90, // 168: ateapi.Control.DrainWorker:output_type -> ateapi.Worker + 89, // 169: ateapi.Control.ListActors:output_type -> ateapi.ListActorsResponse + 29, // 170: ateapi.Control.CreateAtespace:output_type -> ateapi.Atespace + 29, // 171: ateapi.Control.GetAtespace:output_type -> ateapi.Atespace + 52, // 172: ateapi.Control.ListAtespaces:output_type -> ateapi.ListAtespacesResponse + 29, // 173: ateapi.Control.DeleteAtespace:output_type -> ateapi.Atespace + 31, // 174: ateapi.Control.CreateActorTemplate:output_type -> ateapi.ActorTemplate + 31, // 175: ateapi.Control.GetActorTemplate:output_type -> ateapi.ActorTemplate + 57, // 176: ateapi.Control.ListActorTemplates:output_type -> ateapi.ListActorTemplatesResponse + 31, // 177: ateapi.Control.DeleteActorTemplate:output_type -> ateapi.ActorTemplate + 96, // 178: ateapi.Debug.DebugClear:output_type -> ateapi.DebugClearResponse + 98, // 179: ateapi.ActorIdentity.MintJWT:output_type -> ateapi.MintJWTResponse + 100, // 180: ateapi.ActorIdentity.MintCert:output_type -> ateapi.MintCertResponse + 147, // [147:181] is the sub-list for method output_type + 113, // [113:147] is the sub-list for method input_type + 113, // [113:113] is the sub-list for extension type_name + 113, // [113:113] is the sub-list for extension extendee + 0, // [0:113] is the sub-list for field type_name } func init() { file_ateapi_proto_init() } diff --git a/pkg/proto/ateapipb/ateapi.proto b/pkg/proto/ateapipb/ateapi.proto index 7857544d20..57f9198e64 100644 --- a/pkg/proto/ateapipb/ateapi.proto +++ b/pkg/proto/ateapipb/ateapi.proto @@ -237,8 +237,9 @@ message Actor { // as one document containing their combined rules. V0 permits one implicitly // named document per Actor. message EgressPolicy { - // Server-assigned revision, increased on every mutation. - int64 version = 1; + // Standard resource metadata. Atespace and name are always empty. UID, + // version, create_time, and update_time are server-managed. + ResourceMetadata metadata = 1; // A request is authorized when at least one rule matches. Effects from all // matching rules are then applied once per rule. Rule order has no meaning. @@ -837,8 +838,8 @@ message SetActorEgressPolicyRequest { // Parent Actor. V0 assigns the policy document's identity implicitly. ObjectRef actor = 1; - // Full replacement. A zero version creates the document and fails if one - // already exists. A non-zero version replaces only the observed revision. + // Full replacement. Empty metadata creates the document and fails if one + // already exists. UID and version guard replacement of an observed document. EgressPolicy egress_policy = 2; } From f8177456edb5e53e8bd78b398001ed45adde1d99 Mon Sep 17 00:00:00 2001 From: Eitan Yarmush Date: Wed, 26 Aug 2026 00:39:34 +0000 Subject: [PATCH 4/9] Split egress policy create and update APIs Signed-off-by: Eitan Yarmush --- .../internal/controlapi/egress_policy.go | 22 +- .../internal/controlapi/egress_policy_test.go | 8 +- pkg/proto/ateapipb/ateapi.pb.go | 566 ++++++++++-------- pkg/proto/ateapipb/ateapi.proto | 20 +- pkg/proto/ateapipb/ateapi_grpc.pb.go | 72 ++- 5 files changed, 404 insertions(+), 284 deletions(-) diff --git a/cmd/ateapi/internal/controlapi/egress_policy.go b/cmd/ateapi/internal/controlapi/egress_policy.go index 245bda9921..af95c001ec 100644 --- a/cmd/ateapi/internal/controlapi/egress_policy.go +++ b/cmd/ateapi/internal/controlapi/egress_policy.go @@ -51,22 +51,30 @@ func (s *RPCService) GetActorEgressPolicy(ctx context.Context, req *ateapipb.Get return &ateapipb.GetActorEgressPolicyResponse{EgressPolicies: []*ateapipb.EgressPolicy{policy}}, nil } -func (s *RPCService) SetActorEgressPolicy(ctx context.Context, req *ateapipb.SetActorEgressPolicyRequest) (*ateapipb.EgressPolicy, error) { +func (s *RPCService) CreateActorEgressPolicy(ctx context.Context, req *ateapipb.CreateActorEgressPolicyRequest) (*ateapipb.EgressPolicy, error) { var errs field.ErrorList errs = append(errs, validateActorRef(req.GetActor(), field.NewPath("actor"))...) policy := req.GetEgressPolicy() - metadata := policy.GetMetadata() - isUpdate := metadata.GetUid() != "" || metadata.GetVersion() != 0 - errs = append(errs, validateEgressPolicy(policy, isUpdate)...) + errs = append(errs, validateEgressPolicy(policy, false)...) if len(errs) > 0 { return nil, toGRPCStatusError(errs) } actorRef := resources.ActorRefFromObjectRef(req.GetActor()) in := normalizeEgressPolicy(policy) - if !isUpdate { - created, err := s.persistence.CreateEgressPolicy(ctx, actorRef, in) - return mapEgressPolicyWrite(created, err) + created, err := s.persistence.CreateEgressPolicy(ctx, actorRef, in) + return mapEgressPolicyWrite(created, err) +} + +func (s *RPCService) UpdateActorEgressPolicy(ctx context.Context, req *ateapipb.UpdateActorEgressPolicyRequest) (*ateapipb.EgressPolicy, error) { + var errs field.ErrorList + errs = append(errs, validateActorRef(req.GetActor(), field.NewPath("actor"))...) + policy := req.GetEgressPolicy() + errs = append(errs, validateEgressPolicy(policy, true)...) + if len(errs) > 0 { + return nil, toGRPCStatusError(errs) } + actorRef := resources.ActorRefFromObjectRef(req.GetActor()) + in := normalizeEgressPolicy(policy) updated, err := s.persistence.UpdateEgressPolicy(ctx, actorRef, store.PreconditionFrom(in), func(toUpdate *ateapipb.EgressPolicy) error { toUpdate.Rules = in.GetRules() return nil diff --git a/cmd/ateapi/internal/controlapi/egress_policy_test.go b/cmd/ateapi/internal/controlapi/egress_policy_test.go index 3e28ee41b0..aa9891e57a 100644 --- a/cmd/ateapi/internal/controlapi/egress_policy_test.go +++ b/cmd/ateapi/internal/controlapi/egress_policy_test.go @@ -92,7 +92,7 @@ func TestActorEgressPolicy(t *testing.T) { }); status.Code(err) != codes.NotFound { t.Fatalf("missing parent status = %v, want NotFound", status.Code(err)) } - created, err := service.SetActorEgressPolicy(t.Context(), &ateapipb.SetActorEgressPolicyRequest{ + created, err := service.CreateActorEgressPolicy(t.Context(), &ateapipb.CreateActorEgressPolicyRequest{ Actor: actorRef, EgressPolicy: &ateapipb.EgressPolicy{Rules: []*ateapipb.EgressRule{{ Allow: []*ateapipb.EgressMatch{{Predicate: &ateapipb.EgressMatch_Hostname{Hostname: &ateapipb.HostnameMatch{Pattern: "API.EXAMPLE.COM."}}}}, @@ -104,7 +104,7 @@ func TestActorEgressPolicy(t *testing.T) { if err != nil { t.Fatal(err) } - if _, err := service.SetActorEgressPolicy(t.Context(), &ateapipb.SetActorEgressPolicyRequest{ + if _, err := service.CreateActorEgressPolicy(t.Context(), &ateapipb.CreateActorEgressPolicyRequest{ Actor: actorRef, EgressPolicy: &ateapipb.EgressPolicy{}, }); status.Code(err) != codes.AlreadyExists { t.Fatalf("create collision status = %v, want AlreadyExists", status.Code(err)) @@ -121,11 +121,11 @@ func TestActorEgressPolicy(t *testing.T) { } replacement := proto.Clone(created).(*ateapipb.EgressPolicy) replacement.Rules = nil - updated, err := service.SetActorEgressPolicy(t.Context(), &ateapipb.SetActorEgressPolicyRequest{Actor: actorRef, EgressPolicy: replacement}) + updated, err := service.UpdateActorEgressPolicy(t.Context(), &ateapipb.UpdateActorEgressPolicyRequest{Actor: actorRef, EgressPolicy: replacement}) if err != nil || updated.GetMetadata().GetVersion() != 2 || len(updated.GetRules()) != 0 { t.Fatalf("replacement = %v, %v; want empty version 2", updated, err) } - if _, err := service.SetActorEgressPolicy(t.Context(), &ateapipb.SetActorEgressPolicyRequest{ + if _, err := service.UpdateActorEgressPolicy(t.Context(), &ateapipb.UpdateActorEgressPolicyRequest{ Actor: actorRef, EgressPolicy: replacement, }); status.Code(err) != codes.Aborted { t.Fatalf("stale replacement status = %v, want Aborted", status.Code(err)) diff --git a/pkg/proto/ateapipb/ateapi.pb.go b/pkg/proto/ateapipb/ateapi.pb.go index f9e022b772..fa595eda98 100644 --- a/pkg/proto/ateapipb/ateapi.pb.go +++ b/pkg/proto/ateapipb/ateapi.pb.go @@ -4280,31 +4280,30 @@ func (x *GetActorEgressPolicyResponse) GetEgressPolicies() []*EgressPolicy { return nil } -type SetActorEgressPolicyRequest struct { +type CreateActorEgressPolicyRequest struct { state protoimpl.MessageState `protogen:"open.v1"` // Parent Actor. V0 assigns the policy document's identity implicitly. Actor *ObjectRef `protobuf:"bytes,1,opt,name=actor,proto3" json:"actor,omitempty"` - // Full replacement. Empty metadata creates the document and fails if one - // already exists. UID and version guard replacement of an observed document. + // The policy to create. Metadata must be empty. EgressPolicy *EgressPolicy `protobuf:"bytes,2,opt,name=egress_policy,json=egressPolicy,proto3" json:"egress_policy,omitempty"` unknownFields protoimpl.UnknownFields sizeCache protoimpl.SizeCache } -func (x *SetActorEgressPolicyRequest) Reset() { - *x = SetActorEgressPolicyRequest{} +func (x *CreateActorEgressPolicyRequest) Reset() { + *x = CreateActorEgressPolicyRequest{} mi := &file_ateapi_proto_msgTypes[62] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } -func (x *SetActorEgressPolicyRequest) String() string { +func (x *CreateActorEgressPolicyRequest) String() string { return protoimpl.X.MessageStringOf(x) } -func (*SetActorEgressPolicyRequest) ProtoMessage() {} +func (*CreateActorEgressPolicyRequest) ProtoMessage() {} -func (x *SetActorEgressPolicyRequest) ProtoReflect() protoreflect.Message { +func (x *CreateActorEgressPolicyRequest) ProtoReflect() protoreflect.Message { mi := &file_ateapi_proto_msgTypes[62] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) @@ -4316,19 +4315,73 @@ func (x *SetActorEgressPolicyRequest) ProtoReflect() protoreflect.Message { return mi.MessageOf(x) } -// Deprecated: Use SetActorEgressPolicyRequest.ProtoReflect.Descriptor instead. -func (*SetActorEgressPolicyRequest) Descriptor() ([]byte, []int) { +// Deprecated: Use CreateActorEgressPolicyRequest.ProtoReflect.Descriptor instead. +func (*CreateActorEgressPolicyRequest) Descriptor() ([]byte, []int) { return file_ateapi_proto_rawDescGZIP(), []int{62} } -func (x *SetActorEgressPolicyRequest) GetActor() *ObjectRef { +func (x *CreateActorEgressPolicyRequest) GetActor() *ObjectRef { if x != nil { return x.Actor } return nil } -func (x *SetActorEgressPolicyRequest) GetEgressPolicy() *EgressPolicy { +func (x *CreateActorEgressPolicyRequest) GetEgressPolicy() *EgressPolicy { + if x != nil { + return x.EgressPolicy + } + return nil +} + +type UpdateActorEgressPolicyRequest struct { + state protoimpl.MessageState `protogen:"open.v1"` + // Parent Actor. V0 assigns the policy document's identity implicitly. + Actor *ObjectRef `protobuf:"bytes,1,opt,name=actor,proto3" json:"actor,omitempty"` + // Full replacement. Metadata UID and version are required preconditions. + EgressPolicy *EgressPolicy `protobuf:"bytes,2,opt,name=egress_policy,json=egressPolicy,proto3" json:"egress_policy,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *UpdateActorEgressPolicyRequest) Reset() { + *x = UpdateActorEgressPolicyRequest{} + mi := &file_ateapi_proto_msgTypes[63] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *UpdateActorEgressPolicyRequest) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*UpdateActorEgressPolicyRequest) ProtoMessage() {} + +func (x *UpdateActorEgressPolicyRequest) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[63] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use UpdateActorEgressPolicyRequest.ProtoReflect.Descriptor instead. +func (*UpdateActorEgressPolicyRequest) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{63} +} + +func (x *UpdateActorEgressPolicyRequest) GetActor() *ObjectRef { + if x != nil { + return x.Actor + } + return nil +} + +func (x *UpdateActorEgressPolicyRequest) GetEgressPolicy() *EgressPolicy { if x != nil { return x.EgressPolicy } @@ -4344,7 +4397,7 @@ type DeleteActorEgressPolicyRequest struct { func (x *DeleteActorEgressPolicyRequest) Reset() { *x = DeleteActorEgressPolicyRequest{} - mi := &file_ateapi_proto_msgTypes[63] + mi := &file_ateapi_proto_msgTypes[64] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4356,7 +4409,7 @@ func (x *DeleteActorEgressPolicyRequest) String() string { func (*DeleteActorEgressPolicyRequest) ProtoMessage() {} func (x *DeleteActorEgressPolicyRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[63] + mi := &file_ateapi_proto_msgTypes[64] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4369,7 +4422,7 @@ func (x *DeleteActorEgressPolicyRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteActorEgressPolicyRequest.ProtoReflect.Descriptor instead. func (*DeleteActorEgressPolicyRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{63} + return file_ateapi_proto_rawDescGZIP(), []int{64} } func (x *DeleteActorEgressPolicyRequest) GetActor() *ObjectRef { @@ -4388,7 +4441,7 @@ type GetActorSnapshotRequest struct { func (x *GetActorSnapshotRequest) Reset() { *x = GetActorSnapshotRequest{} - mi := &file_ateapi_proto_msgTypes[64] + mi := &file_ateapi_proto_msgTypes[65] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4400,7 +4453,7 @@ func (x *GetActorSnapshotRequest) String() string { func (*GetActorSnapshotRequest) ProtoMessage() {} func (x *GetActorSnapshotRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[64] + mi := &file_ateapi_proto_msgTypes[65] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4413,7 +4466,7 @@ func (x *GetActorSnapshotRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetActorSnapshotRequest.ProtoReflect.Descriptor instead. func (*GetActorSnapshotRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{64} + return file_ateapi_proto_rawDescGZIP(), []int{65} } func (x *GetActorSnapshotRequest) GetActorSnapshot() *ObjectRef { @@ -4432,7 +4485,7 @@ type GetActorSnapshotTagRequest struct { func (x *GetActorSnapshotTagRequest) Reset() { *x = GetActorSnapshotTagRequest{} - mi := &file_ateapi_proto_msgTypes[65] + mi := &file_ateapi_proto_msgTypes[66] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4444,7 +4497,7 @@ func (x *GetActorSnapshotTagRequest) String() string { func (*GetActorSnapshotTagRequest) ProtoMessage() {} func (x *GetActorSnapshotTagRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[65] + mi := &file_ateapi_proto_msgTypes[66] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4457,7 +4510,7 @@ func (x *GetActorSnapshotTagRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetActorSnapshotTagRequest.ProtoReflect.Descriptor instead. func (*GetActorSnapshotTagRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{65} + return file_ateapi_proto_rawDescGZIP(), []int{66} } func (x *GetActorSnapshotTagRequest) GetActorSnapshotTag() *ObjectRef { @@ -4478,7 +4531,7 @@ type ListActorSnapshotsRequest struct { func (x *ListActorSnapshotsRequest) Reset() { *x = ListActorSnapshotsRequest{} - mi := &file_ateapi_proto_msgTypes[66] + mi := &file_ateapi_proto_msgTypes[67] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4490,7 +4543,7 @@ func (x *ListActorSnapshotsRequest) String() string { func (*ListActorSnapshotsRequest) ProtoMessage() {} func (x *ListActorSnapshotsRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[66] + mi := &file_ateapi_proto_msgTypes[67] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4503,7 +4556,7 @@ func (x *ListActorSnapshotsRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ListActorSnapshotsRequest.ProtoReflect.Descriptor instead. func (*ListActorSnapshotsRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{66} + return file_ateapi_proto_rawDescGZIP(), []int{67} } func (x *ListActorSnapshotsRequest) GetAtespace() string { @@ -4537,7 +4590,7 @@ type ListActorSnapshotsResponse struct { func (x *ListActorSnapshotsResponse) Reset() { *x = ListActorSnapshotsResponse{} - mi := &file_ateapi_proto_msgTypes[67] + mi := &file_ateapi_proto_msgTypes[68] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4549,7 +4602,7 @@ func (x *ListActorSnapshotsResponse) String() string { func (*ListActorSnapshotsResponse) ProtoMessage() {} func (x *ListActorSnapshotsResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[67] + mi := &file_ateapi_proto_msgTypes[68] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4562,7 +4615,7 @@ func (x *ListActorSnapshotsResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ListActorSnapshotsResponse.ProtoReflect.Descriptor instead. func (*ListActorSnapshotsResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{67} + return file_ateapi_proto_rawDescGZIP(), []int{68} } func (x *ListActorSnapshotsResponse) GetActorSnapshots() []*ActorSnapshot { @@ -4589,7 +4642,7 @@ type CreateActorSnapshotTagRequest struct { func (x *CreateActorSnapshotTagRequest) Reset() { *x = CreateActorSnapshotTagRequest{} - mi := &file_ateapi_proto_msgTypes[68] + mi := &file_ateapi_proto_msgTypes[69] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4601,7 +4654,7 @@ func (x *CreateActorSnapshotTagRequest) String() string { func (*CreateActorSnapshotTagRequest) ProtoMessage() {} func (x *CreateActorSnapshotTagRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[68] + mi := &file_ateapi_proto_msgTypes[69] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4614,7 +4667,7 @@ func (x *CreateActorSnapshotTagRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use CreateActorSnapshotTagRequest.ProtoReflect.Descriptor instead. func (*CreateActorSnapshotTagRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{68} + return file_ateapi_proto_rawDescGZIP(), []int{69} } func (x *CreateActorSnapshotTagRequest) GetActorSnapshotTag() *ActorSnapshotTag { @@ -4640,7 +4693,7 @@ type UpdateActorSnapshotTagRequest struct { func (x *UpdateActorSnapshotTagRequest) Reset() { *x = UpdateActorSnapshotTagRequest{} - mi := &file_ateapi_proto_msgTypes[69] + mi := &file_ateapi_proto_msgTypes[70] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4652,7 +4705,7 @@ func (x *UpdateActorSnapshotTagRequest) String() string { func (*UpdateActorSnapshotTagRequest) ProtoMessage() {} func (x *UpdateActorSnapshotTagRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[69] + mi := &file_ateapi_proto_msgTypes[70] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4665,7 +4718,7 @@ func (x *UpdateActorSnapshotTagRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use UpdateActorSnapshotTagRequest.ProtoReflect.Descriptor instead. func (*UpdateActorSnapshotTagRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{69} + return file_ateapi_proto_rawDescGZIP(), []int{70} } func (x *UpdateActorSnapshotTagRequest) GetActorSnapshotTag() *ActorSnapshotTag { @@ -4684,7 +4737,7 @@ type DeleteActorSnapshotTagRequest struct { func (x *DeleteActorSnapshotTagRequest) Reset() { *x = DeleteActorSnapshotTagRequest{} - mi := &file_ateapi_proto_msgTypes[70] + mi := &file_ateapi_proto_msgTypes[71] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4696,7 +4749,7 @@ func (x *DeleteActorSnapshotTagRequest) String() string { func (*DeleteActorSnapshotTagRequest) ProtoMessage() {} func (x *DeleteActorSnapshotTagRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[70] + mi := &file_ateapi_proto_msgTypes[71] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4709,7 +4762,7 @@ func (x *DeleteActorSnapshotTagRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteActorSnapshotTagRequest.ProtoReflect.Descriptor instead. func (*DeleteActorSnapshotTagRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{70} + return file_ateapi_proto_rawDescGZIP(), []int{71} } func (x *DeleteActorSnapshotTagRequest) GetActorSnapshotTag() *ObjectRef { @@ -4739,7 +4792,7 @@ type DeleteOptions struct { func (x *DeleteOptions) Reset() { *x = DeleteOptions{} - mi := &file_ateapi_proto_msgTypes[71] + mi := &file_ateapi_proto_msgTypes[72] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4751,7 +4804,7 @@ func (x *DeleteOptions) String() string { func (*DeleteOptions) ProtoMessage() {} func (x *DeleteOptions) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[71] + mi := &file_ateapi_proto_msgTypes[72] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4764,7 +4817,7 @@ func (x *DeleteOptions) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteOptions.ProtoReflect.Descriptor instead. func (*DeleteOptions) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{71} + return file_ateapi_proto_rawDescGZIP(), []int{72} } func (x *DeleteOptions) GetVersion() int64 { @@ -4796,7 +4849,7 @@ type ListWorkersRequest struct { func (x *ListWorkersRequest) Reset() { *x = ListWorkersRequest{} - mi := &file_ateapi_proto_msgTypes[72] + mi := &file_ateapi_proto_msgTypes[73] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4808,7 +4861,7 @@ func (x *ListWorkersRequest) String() string { func (*ListWorkersRequest) ProtoMessage() {} func (x *ListWorkersRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[72] + mi := &file_ateapi_proto_msgTypes[73] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4821,7 +4874,7 @@ func (x *ListWorkersRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ListWorkersRequest.ProtoReflect.Descriptor instead. func (*ListWorkersRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{72} + return file_ateapi_proto_rawDescGZIP(), []int{73} } func (x *ListWorkersRequest) GetPageSize() int32 { @@ -4850,7 +4903,7 @@ type ListWorkersResponse struct { func (x *ListWorkersResponse) Reset() { *x = ListWorkersResponse{} - mi := &file_ateapi_proto_msgTypes[73] + mi := &file_ateapi_proto_msgTypes[74] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4862,7 +4915,7 @@ func (x *ListWorkersResponse) String() string { func (*ListWorkersResponse) ProtoMessage() {} func (x *ListWorkersResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[73] + mi := &file_ateapi_proto_msgTypes[74] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4875,7 +4928,7 @@ func (x *ListWorkersResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ListWorkersResponse.ProtoReflect.Descriptor instead. func (*ListWorkersResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{73} + return file_ateapi_proto_rawDescGZIP(), []int{74} } func (x *ListWorkersResponse) GetWorkers() []*Worker { @@ -4902,7 +4955,7 @@ type GetWorkerRequest struct { func (x *GetWorkerRequest) Reset() { *x = GetWorkerRequest{} - mi := &file_ateapi_proto_msgTypes[74] + mi := &file_ateapi_proto_msgTypes[75] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4914,7 +4967,7 @@ func (x *GetWorkerRequest) String() string { func (*GetWorkerRequest) ProtoMessage() {} func (x *GetWorkerRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[74] + mi := &file_ateapi_proto_msgTypes[75] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4927,7 +4980,7 @@ func (x *GetWorkerRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetWorkerRequest.ProtoReflect.Descriptor instead. func (*GetWorkerRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{74} + return file_ateapi_proto_rawDescGZIP(), []int{75} } func (x *GetWorkerRequest) GetWorker() *ObjectRef { @@ -4947,7 +5000,7 @@ type CreateWorkerRequest struct { func (x *CreateWorkerRequest) Reset() { *x = CreateWorkerRequest{} - mi := &file_ateapi_proto_msgTypes[75] + mi := &file_ateapi_proto_msgTypes[76] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4959,7 +5012,7 @@ func (x *CreateWorkerRequest) String() string { func (*CreateWorkerRequest) ProtoMessage() {} func (x *CreateWorkerRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[75] + mi := &file_ateapi_proto_msgTypes[76] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4972,7 +5025,7 @@ func (x *CreateWorkerRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use CreateWorkerRequest.ProtoReflect.Descriptor instead. func (*CreateWorkerRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{75} + return file_ateapi_proto_rawDescGZIP(), []int{76} } func (x *CreateWorkerRequest) GetWorker() *Worker { @@ -5002,7 +5055,7 @@ type UpdateWorkerRequest struct { func (x *UpdateWorkerRequest) Reset() { *x = UpdateWorkerRequest{} - mi := &file_ateapi_proto_msgTypes[76] + mi := &file_ateapi_proto_msgTypes[77] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5014,7 +5067,7 @@ func (x *UpdateWorkerRequest) String() string { func (*UpdateWorkerRequest) ProtoMessage() {} func (x *UpdateWorkerRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[76] + mi := &file_ateapi_proto_msgTypes[77] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5027,7 +5080,7 @@ func (x *UpdateWorkerRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use UpdateWorkerRequest.ProtoReflect.Descriptor instead. func (*UpdateWorkerRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{76} + return file_ateapi_proto_rawDescGZIP(), []int{77} } func (x *UpdateWorkerRequest) GetWorker() *Worker { @@ -5049,7 +5102,7 @@ type DeleteWorkerRequest struct { func (x *DeleteWorkerRequest) Reset() { *x = DeleteWorkerRequest{} - mi := &file_ateapi_proto_msgTypes[77] + mi := &file_ateapi_proto_msgTypes[78] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5061,7 +5114,7 @@ func (x *DeleteWorkerRequest) String() string { func (*DeleteWorkerRequest) ProtoMessage() {} func (x *DeleteWorkerRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[77] + mi := &file_ateapi_proto_msgTypes[78] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5074,7 +5127,7 @@ func (x *DeleteWorkerRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteWorkerRequest.ProtoReflect.Descriptor instead. func (*DeleteWorkerRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{77} + return file_ateapi_proto_rawDescGZIP(), []int{78} } func (x *DeleteWorkerRequest) GetWorker() *ObjectRef { @@ -5101,7 +5154,7 @@ type DrainWorkerRequest struct { func (x *DrainWorkerRequest) Reset() { *x = DrainWorkerRequest{} - mi := &file_ateapi_proto_msgTypes[78] + mi := &file_ateapi_proto_msgTypes[79] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5113,7 +5166,7 @@ func (x *DrainWorkerRequest) String() string { func (*DrainWorkerRequest) ProtoMessage() {} func (x *DrainWorkerRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[78] + mi := &file_ateapi_proto_msgTypes[79] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5126,7 +5179,7 @@ func (x *DrainWorkerRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DrainWorkerRequest.ProtoReflect.Descriptor instead. func (*DrainWorkerRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{78} + return file_ateapi_proto_rawDescGZIP(), []int{79} } func (x *DrainWorkerRequest) GetWorker() *ObjectRef { @@ -5155,7 +5208,7 @@ type ListActorsRequest struct { func (x *ListActorsRequest) Reset() { *x = ListActorsRequest{} - mi := &file_ateapi_proto_msgTypes[79] + mi := &file_ateapi_proto_msgTypes[80] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5167,7 +5220,7 @@ func (x *ListActorsRequest) String() string { func (*ListActorsRequest) ProtoMessage() {} func (x *ListActorsRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[79] + mi := &file_ateapi_proto_msgTypes[80] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5180,7 +5233,7 @@ func (x *ListActorsRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ListActorsRequest.ProtoReflect.Descriptor instead. func (*ListActorsRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{79} + return file_ateapi_proto_rawDescGZIP(), []int{80} } func (x *ListActorsRequest) GetAtespace() string { @@ -5216,7 +5269,7 @@ type ListActorsResponse struct { func (x *ListActorsResponse) Reset() { *x = ListActorsResponse{} - mi := &file_ateapi_proto_msgTypes[80] + mi := &file_ateapi_proto_msgTypes[81] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5228,7 +5281,7 @@ func (x *ListActorsResponse) String() string { func (*ListActorsResponse) ProtoMessage() {} func (x *ListActorsResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[80] + mi := &file_ateapi_proto_msgTypes[81] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5241,7 +5294,7 @@ func (x *ListActorsResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ListActorsResponse.ProtoReflect.Descriptor instead. func (*ListActorsResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{80} + return file_ateapi_proto_rawDescGZIP(), []int{81} } func (x *ListActorsResponse) GetActors() []*Actor { @@ -5296,7 +5349,7 @@ type Worker struct { func (x *Worker) Reset() { *x = Worker{} - mi := &file_ateapi_proto_msgTypes[81] + mi := &file_ateapi_proto_msgTypes[82] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5308,7 +5361,7 @@ func (x *Worker) String() string { func (*Worker) ProtoMessage() {} func (x *Worker) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[81] + mi := &file_ateapi_proto_msgTypes[82] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5321,7 +5374,7 @@ func (x *Worker) ProtoReflect() protoreflect.Message { // Deprecated: Use Worker.ProtoReflect.Descriptor instead. func (*Worker) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{81} + return file_ateapi_proto_rawDescGZIP(), []int{82} } func (x *Worker) GetMetadata() *ResourceMetadata { @@ -5412,7 +5465,7 @@ type WorkerStatus struct { func (x *WorkerStatus) Reset() { *x = WorkerStatus{} - mi := &file_ateapi_proto_msgTypes[82] + mi := &file_ateapi_proto_msgTypes[83] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5424,7 +5477,7 @@ func (x *WorkerStatus) String() string { func (*WorkerStatus) ProtoMessage() {} func (x *WorkerStatus) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[82] + mi := &file_ateapi_proto_msgTypes[83] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5437,7 +5490,7 @@ func (x *WorkerStatus) ProtoReflect() protoreflect.Message { // Deprecated: Use WorkerStatus.ProtoReflect.Descriptor instead. func (*WorkerStatus) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{82} + return file_ateapi_proto_rawDescGZIP(), []int{83} } func (x *WorkerStatus) GetState() WorkerState { @@ -5470,7 +5523,7 @@ type WorkerCapacity struct { func (x *WorkerCapacity) Reset() { *x = WorkerCapacity{} - mi := &file_ateapi_proto_msgTypes[83] + mi := &file_ateapi_proto_msgTypes[84] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5482,7 +5535,7 @@ func (x *WorkerCapacity) String() string { func (*WorkerCapacity) ProtoMessage() {} func (x *WorkerCapacity) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[83] + mi := &file_ateapi_proto_msgTypes[84] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5495,7 +5548,7 @@ func (x *WorkerCapacity) ProtoReflect() protoreflect.Message { // Deprecated: Use WorkerCapacity.ProtoReflect.Descriptor instead. func (*WorkerCapacity) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{83} + return file_ateapi_proto_rawDescGZIP(), []int{84} } func (x *WorkerCapacity) GetCpuMilli() int64 { @@ -5527,7 +5580,7 @@ type ActorAssignment struct { func (x *ActorAssignment) Reset() { *x = ActorAssignment{} - mi := &file_ateapi_proto_msgTypes[84] + mi := &file_ateapi_proto_msgTypes[85] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5539,7 +5592,7 @@ func (x *ActorAssignment) String() string { func (*ActorAssignment) ProtoMessage() {} func (x *ActorAssignment) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[84] + mi := &file_ateapi_proto_msgTypes[85] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5552,7 +5605,7 @@ func (x *ActorAssignment) ProtoReflect() protoreflect.Message { // Deprecated: Use ActorAssignment.ProtoReflect.Descriptor instead. func (*ActorAssignment) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{84} + return file_ateapi_proto_rawDescGZIP(), []int{85} } func (x *ActorAssignment) GetActorTemplate() *KubeNamespacedObjectRef { @@ -5586,7 +5639,7 @@ type KubeNamespacedObjectRef struct { func (x *KubeNamespacedObjectRef) Reset() { *x = KubeNamespacedObjectRef{} - mi := &file_ateapi_proto_msgTypes[85] + mi := &file_ateapi_proto_msgTypes[86] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5598,7 +5651,7 @@ func (x *KubeNamespacedObjectRef) String() string { func (*KubeNamespacedObjectRef) ProtoMessage() {} func (x *KubeNamespacedObjectRef) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[85] + mi := &file_ateapi_proto_msgTypes[86] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5611,7 +5664,7 @@ func (x *KubeNamespacedObjectRef) ProtoReflect() protoreflect.Message { // Deprecated: Use KubeNamespacedObjectRef.ProtoReflect.Descriptor instead. func (*KubeNamespacedObjectRef) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{85} + return file_ateapi_proto_rawDescGZIP(), []int{86} } func (x *KubeNamespacedObjectRef) GetNamespace() string { @@ -5636,7 +5689,7 @@ type DebugClearRequest struct { func (x *DebugClearRequest) Reset() { *x = DebugClearRequest{} - mi := &file_ateapi_proto_msgTypes[86] + mi := &file_ateapi_proto_msgTypes[87] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5648,7 +5701,7 @@ func (x *DebugClearRequest) String() string { func (*DebugClearRequest) ProtoMessage() {} func (x *DebugClearRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[86] + mi := &file_ateapi_proto_msgTypes[87] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5661,7 +5714,7 @@ func (x *DebugClearRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DebugClearRequest.ProtoReflect.Descriptor instead. func (*DebugClearRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{86} + return file_ateapi_proto_rawDescGZIP(), []int{87} } type DebugClearResponse struct { @@ -5672,7 +5725,7 @@ type DebugClearResponse struct { func (x *DebugClearResponse) Reset() { *x = DebugClearResponse{} - mi := &file_ateapi_proto_msgTypes[87] + mi := &file_ateapi_proto_msgTypes[88] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5684,7 +5737,7 @@ func (x *DebugClearResponse) String() string { func (*DebugClearResponse) ProtoMessage() {} func (x *DebugClearResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[87] + mi := &file_ateapi_proto_msgTypes[88] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5697,7 +5750,7 @@ func (x *DebugClearResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use DebugClearResponse.ProtoReflect.Descriptor instead. func (*DebugClearResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{87} + return file_ateapi_proto_rawDescGZIP(), []int{88} } type MintJWTRequest struct { @@ -5712,7 +5765,7 @@ type MintJWTRequest struct { func (x *MintJWTRequest) Reset() { *x = MintJWTRequest{} - mi := &file_ateapi_proto_msgTypes[88] + mi := &file_ateapi_proto_msgTypes[89] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5724,7 +5777,7 @@ func (x *MintJWTRequest) String() string { func (*MintJWTRequest) ProtoMessage() {} func (x *MintJWTRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[88] + mi := &file_ateapi_proto_msgTypes[89] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5737,7 +5790,7 @@ func (x *MintJWTRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use MintJWTRequest.ProtoReflect.Descriptor instead. func (*MintJWTRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{88} + return file_ateapi_proto_rawDescGZIP(), []int{89} } func (x *MintJWTRequest) GetAudience() []string { @@ -5798,7 +5851,7 @@ type MintJWTResponse struct { func (x *MintJWTResponse) Reset() { *x = MintJWTResponse{} - mi := &file_ateapi_proto_msgTypes[89] + mi := &file_ateapi_proto_msgTypes[90] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5810,7 +5863,7 @@ func (x *MintJWTResponse) String() string { func (*MintJWTResponse) ProtoMessage() {} func (x *MintJWTResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[89] + mi := &file_ateapi_proto_msgTypes[90] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5823,7 +5876,7 @@ func (x *MintJWTResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use MintJWTResponse.ProtoReflect.Descriptor instead. func (*MintJWTResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{89} + return file_ateapi_proto_rawDescGZIP(), []int{90} } func (x *MintJWTResponse) GetActorJwt() string { @@ -5858,7 +5911,7 @@ type MintCertRequest struct { func (x *MintCertRequest) Reset() { *x = MintCertRequest{} - mi := &file_ateapi_proto_msgTypes[90] + mi := &file_ateapi_proto_msgTypes[91] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5870,7 +5923,7 @@ func (x *MintCertRequest) String() string { func (*MintCertRequest) ProtoMessage() {} func (x *MintCertRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[90] + mi := &file_ateapi_proto_msgTypes[91] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5883,7 +5936,7 @@ func (x *MintCertRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use MintCertRequest.ProtoReflect.Descriptor instead. func (*MintCertRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{90} + return file_ateapi_proto_rawDescGZIP(), []int{91} } func (x *MintCertRequest) GetWorker() *ObjectRef { @@ -5926,7 +5979,7 @@ type MintCertResponse struct { func (x *MintCertResponse) Reset() { *x = MintCertResponse{} - mi := &file_ateapi_proto_msgTypes[91] + mi := &file_ateapi_proto_msgTypes[92] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5938,7 +5991,7 @@ func (x *MintCertResponse) String() string { func (*MintCertResponse) ProtoMessage() {} func (x *MintCertResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[91] + mi := &file_ateapi_proto_msgTypes[92] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5951,7 +6004,7 @@ func (x *MintCertResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use MintCertResponse.ProtoReflect.Descriptor instead. func (*MintCertResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{91} + return file_ateapi_proto_rawDescGZIP(), []int{92} } func (x *MintCertResponse) GetActorCertificates() [][]byte { @@ -6219,8 +6272,11 @@ const file_ateapi_proto_rawDesc = "" + "\x1bGetActorEgressPolicyRequest\x12'\n" + "\x05actor\x18\x01 \x01(\v2\x11.ateapi.ObjectRefR\x05actor\"]\n" + "\x1cGetActorEgressPolicyResponse\x12=\n" + - "\x0fegress_policies\x18\x01 \x03(\v2\x14.ateapi.EgressPolicyR\x0eegressPolicies\"\x81\x01\n" + - "\x1bSetActorEgressPolicyRequest\x12'\n" + + "\x0fegress_policies\x18\x01 \x03(\v2\x14.ateapi.EgressPolicyR\x0eegressPolicies\"\x84\x01\n" + + "\x1eCreateActorEgressPolicyRequest\x12'\n" + + "\x05actor\x18\x01 \x01(\v2\x11.ateapi.ObjectRefR\x05actor\x129\n" + + "\regress_policy\x18\x02 \x01(\v2\x14.ateapi.EgressPolicyR\fegressPolicy\"\x84\x01\n" + + "\x1eUpdateActorEgressPolicyRequest\x12'\n" + "\x05actor\x18\x01 \x01(\v2\x11.ateapi.ObjectRefR\x05actor\x129\n" + "\regress_policy\x18\x02 \x01(\v2\x14.ateapi.EgressPolicyR\fegressPolicy\"I\n" + "\x1eDeleteActorEgressPolicyRequest\x12'\n" + @@ -6362,7 +6418,7 @@ const file_ateapi_proto_rawDesc = "" + "\x15WORKER_STATE_DRAINING\x10\x02*k\n" + "\x17ActorCertificatePurpose\x12)\n" + "%ACTOR_CERTIFICATE_PURPOSE_UNSPECIFIED\x10\x00\x12%\n" + - "!ACTOR_CERTIFICATE_PURPOSE_ATUNNEL\x10\x012\xb3\x12\n" + + "!ACTOR_CERTIFICATE_PURPOSE_ATUNNEL\x10\x012\x94\x13\n" + "\aControl\x124\n" + "\bGetActor\x12\x17.ateapi.GetActorRequest\x1a\r.ateapi.Actor\"\x00\x12:\n" + "\vCreateActor\x12\x1a.ateapi.CreateActorRequest\x1a\r.ateapi.Actor\"\x00\x12:\n" + @@ -6372,8 +6428,9 @@ const file_ateapi_proto_rawDesc = "" + "PauseActor\x12\x19.ateapi.PauseActorRequest\x1a\x1a.ateapi.PauseActorResponse\"\x00\x12H\n" + "\vResumeActor\x12\x1a.ateapi.ResumeActorRequest\x1a\x1b.ateapi.ResumeActorResponse\"\x00\x12:\n" + "\vDeleteActor\x12\x1a.ateapi.DeleteActorRequest\x1a\r.ateapi.Actor\"\x00\x12c\n" + - "\x14GetActorEgressPolicy\x12#.ateapi.GetActorEgressPolicyRequest\x1a$.ateapi.GetActorEgressPolicyResponse\"\x00\x12S\n" + - "\x14SetActorEgressPolicy\x12#.ateapi.SetActorEgressPolicyRequest\x1a\x14.ateapi.EgressPolicy\"\x00\x12Y\n" + + "\x14GetActorEgressPolicy\x12#.ateapi.GetActorEgressPolicyRequest\x1a$.ateapi.GetActorEgressPolicyResponse\"\x00\x12Y\n" + + "\x17CreateActorEgressPolicy\x12&.ateapi.CreateActorEgressPolicyRequest\x1a\x14.ateapi.EgressPolicy\"\x00\x12Y\n" + + "\x17UpdateActorEgressPolicy\x12&.ateapi.UpdateActorEgressPolicyRequest\x1a\x14.ateapi.EgressPolicy\"\x00\x12Y\n" + "\x17DeleteActorEgressPolicy\x12&.ateapi.DeleteActorEgressPolicyRequest\x1a\x14.ateapi.EgressPolicy\"\x00\x12L\n" + "\x10GetActorSnapshot\x12\x1f.ateapi.GetActorSnapshotRequest\x1a\x15.ateapi.ActorSnapshot\"\x00\x12U\n" + "\x13GetActorSnapshotTag\x12\".ateapi.GetActorSnapshotTagRequest\x1a\x18.ateapi.ActorSnapshotTag\"\x00\x12]\n" + @@ -6417,7 +6474,7 @@ func file_ateapi_proto_rawDescGZIP() []byte { } var file_ateapi_proto_enumTypes = make([]protoimpl.EnumInfo, 9) -var file_ateapi_proto_msgTypes = make([]protoimpl.MessageInfo, 97) +var file_ateapi_proto_msgTypes = make([]protoimpl.MessageInfo, 98) var file_ateapi_proto_goTypes = []any{ (SnapshotContentScope)(0), // 0: ateapi.SnapshotContentScope (ActorSnapshotTagScope)(0), // 1: ateapi.ActorSnapshotTagScope @@ -6490,51 +6547,52 @@ var file_ateapi_proto_goTypes = []any{ (*DeleteActorRequest)(nil), // 68: ateapi.DeleteActorRequest (*GetActorEgressPolicyRequest)(nil), // 69: ateapi.GetActorEgressPolicyRequest (*GetActorEgressPolicyResponse)(nil), // 70: ateapi.GetActorEgressPolicyResponse - (*SetActorEgressPolicyRequest)(nil), // 71: ateapi.SetActorEgressPolicyRequest - (*DeleteActorEgressPolicyRequest)(nil), // 72: ateapi.DeleteActorEgressPolicyRequest - (*GetActorSnapshotRequest)(nil), // 73: ateapi.GetActorSnapshotRequest - (*GetActorSnapshotTagRequest)(nil), // 74: ateapi.GetActorSnapshotTagRequest - (*ListActorSnapshotsRequest)(nil), // 75: ateapi.ListActorSnapshotsRequest - (*ListActorSnapshotsResponse)(nil), // 76: ateapi.ListActorSnapshotsResponse - (*CreateActorSnapshotTagRequest)(nil), // 77: ateapi.CreateActorSnapshotTagRequest - (*UpdateActorSnapshotTagRequest)(nil), // 78: ateapi.UpdateActorSnapshotTagRequest - (*DeleteActorSnapshotTagRequest)(nil), // 79: ateapi.DeleteActorSnapshotTagRequest - (*DeleteOptions)(nil), // 80: ateapi.DeleteOptions - (*ListWorkersRequest)(nil), // 81: ateapi.ListWorkersRequest - (*ListWorkersResponse)(nil), // 82: ateapi.ListWorkersResponse - (*GetWorkerRequest)(nil), // 83: ateapi.GetWorkerRequest - (*CreateWorkerRequest)(nil), // 84: ateapi.CreateWorkerRequest - (*UpdateWorkerRequest)(nil), // 85: ateapi.UpdateWorkerRequest - (*DeleteWorkerRequest)(nil), // 86: ateapi.DeleteWorkerRequest - (*DrainWorkerRequest)(nil), // 87: ateapi.DrainWorkerRequest - (*ListActorsRequest)(nil), // 88: ateapi.ListActorsRequest - (*ListActorsResponse)(nil), // 89: ateapi.ListActorsResponse - (*Worker)(nil), // 90: ateapi.Worker - (*WorkerStatus)(nil), // 91: ateapi.WorkerStatus - (*WorkerCapacity)(nil), // 92: ateapi.WorkerCapacity - (*ActorAssignment)(nil), // 93: ateapi.ActorAssignment - (*KubeNamespacedObjectRef)(nil), // 94: ateapi.KubeNamespacedObjectRef - (*DebugClearRequest)(nil), // 95: ateapi.DebugClearRequest - (*DebugClearResponse)(nil), // 96: ateapi.DebugClearResponse - (*MintJWTRequest)(nil), // 97: ateapi.MintJWTRequest - (*MintJWTResponse)(nil), // 98: ateapi.MintJWTResponse - (*MintCertRequest)(nil), // 99: ateapi.MintCertRequest - (*MintCertResponse)(nil), // 100: ateapi.MintCertResponse - nil, // 101: ateapi.Selector.MatchLabelsEntry - nil, // 102: ateapi.ExternalVolume.VolumeContextEntry - nil, // 103: ateapi.SandboxAssets.AssetsEntry - nil, // 104: ateapi.ArchAssets.FilesEntry - nil, // 105: ateapi.Worker.LabelsEntry - (*timestamppb.Timestamp)(nil), // 106: google.protobuf.Timestamp - (*emptypb.Empty)(nil), // 107: google.protobuf.Empty + (*CreateActorEgressPolicyRequest)(nil), // 71: ateapi.CreateActorEgressPolicyRequest + (*UpdateActorEgressPolicyRequest)(nil), // 72: ateapi.UpdateActorEgressPolicyRequest + (*DeleteActorEgressPolicyRequest)(nil), // 73: ateapi.DeleteActorEgressPolicyRequest + (*GetActorSnapshotRequest)(nil), // 74: ateapi.GetActorSnapshotRequest + (*GetActorSnapshotTagRequest)(nil), // 75: ateapi.GetActorSnapshotTagRequest + (*ListActorSnapshotsRequest)(nil), // 76: ateapi.ListActorSnapshotsRequest + (*ListActorSnapshotsResponse)(nil), // 77: ateapi.ListActorSnapshotsResponse + (*CreateActorSnapshotTagRequest)(nil), // 78: ateapi.CreateActorSnapshotTagRequest + (*UpdateActorSnapshotTagRequest)(nil), // 79: ateapi.UpdateActorSnapshotTagRequest + (*DeleteActorSnapshotTagRequest)(nil), // 80: ateapi.DeleteActorSnapshotTagRequest + (*DeleteOptions)(nil), // 81: ateapi.DeleteOptions + (*ListWorkersRequest)(nil), // 82: ateapi.ListWorkersRequest + (*ListWorkersResponse)(nil), // 83: ateapi.ListWorkersResponse + (*GetWorkerRequest)(nil), // 84: ateapi.GetWorkerRequest + (*CreateWorkerRequest)(nil), // 85: ateapi.CreateWorkerRequest + (*UpdateWorkerRequest)(nil), // 86: ateapi.UpdateWorkerRequest + (*DeleteWorkerRequest)(nil), // 87: ateapi.DeleteWorkerRequest + (*DrainWorkerRequest)(nil), // 88: ateapi.DrainWorkerRequest + (*ListActorsRequest)(nil), // 89: ateapi.ListActorsRequest + (*ListActorsResponse)(nil), // 90: ateapi.ListActorsResponse + (*Worker)(nil), // 91: ateapi.Worker + (*WorkerStatus)(nil), // 92: ateapi.WorkerStatus + (*WorkerCapacity)(nil), // 93: ateapi.WorkerCapacity + (*ActorAssignment)(nil), // 94: ateapi.ActorAssignment + (*KubeNamespacedObjectRef)(nil), // 95: ateapi.KubeNamespacedObjectRef + (*DebugClearRequest)(nil), // 96: ateapi.DebugClearRequest + (*DebugClearResponse)(nil), // 97: ateapi.DebugClearResponse + (*MintJWTRequest)(nil), // 98: ateapi.MintJWTRequest + (*MintJWTResponse)(nil), // 99: ateapi.MintJWTResponse + (*MintCertRequest)(nil), // 100: ateapi.MintCertRequest + (*MintCertResponse)(nil), // 101: ateapi.MintCertResponse + nil, // 102: ateapi.Selector.MatchLabelsEntry + nil, // 103: ateapi.ExternalVolume.VolumeContextEntry + nil, // 104: ateapi.SandboxAssets.AssetsEntry + nil, // 105: ateapi.ArchAssets.FilesEntry + nil, // 106: ateapi.Worker.LabelsEntry + (*timestamppb.Timestamp)(nil), // 107: google.protobuf.Timestamp + (*emptypb.Empty)(nil), // 108: google.protobuf.Empty } var file_ateapi_proto_depIdxs = []int32{ 0, // 0: ateapi.LocalSnapshotInfo.content_scope:type_name -> ateapi.SnapshotContentScope - 101, // 1: ateapi.Selector.match_labels:type_name -> ateapi.Selector.MatchLabelsEntry - 106, // 2: ateapi.ResourceMetadata.create_time:type_name -> google.protobuf.Timestamp - 106, // 3: ateapi.ResourceMetadata.update_time:type_name -> google.protobuf.Timestamp + 102, // 1: ateapi.Selector.match_labels:type_name -> ateapi.Selector.MatchLabelsEntry + 107, // 2: ateapi.ResourceMetadata.create_time:type_name -> google.protobuf.Timestamp + 107, // 3: ateapi.ResourceMetadata.update_time:type_name -> google.protobuf.Timestamp 8, // 4: ateapi.ExternalVolume.status:type_name -> ateapi.ExternalVolume.Status - 102, // 5: ateapi.ExternalVolume.volume_context:type_name -> ateapi.ExternalVolume.VolumeContextEntry + 103, // 5: ateapi.ExternalVolume.volume_context:type_name -> ateapi.ExternalVolume.VolumeContextEntry 11, // 6: ateapi.Actor.metadata:type_name -> ateapi.ResourceMetadata 30, // 7: ateapi.Actor.actor_template:type_name -> ateapi.ObjectRef 10, // 8: ateapi.Actor.worker_selector:type_name -> ateapi.Selector @@ -6544,7 +6602,7 @@ var file_ateapi_proto_depIdxs = []int32{ 15, // 12: ateapi.EgressPolicy.rules:type_name -> ateapi.EgressRule 16, // 13: ateapi.EgressRule.allow:type_name -> ateapi.EgressMatch 19, // 14: ateapi.EgressRule.effects:type_name -> ateapi.EgressRuleEffects - 107, // 15: ateapi.EgressMatch.all:type_name -> google.protobuf.Empty + 108, // 15: ateapi.EgressMatch.all:type_name -> google.protobuf.Empty 17, // 16: ateapi.EgressMatch.hostname:type_name -> ateapi.HostnameMatch 18, // 17: ateapi.EgressMatch.ip_block:type_name -> ateapi.IPBlockMatch 20, // 18: ateapi.EgressRuleEffects.inject_static_header:type_name -> ateapi.StaticHeaderInjection @@ -6591,8 +6649,8 @@ var file_ateapi_proto_depIdxs = []int32{ 43, // 59: ateapi.Volume.durable_dir:type_name -> ateapi.DurableDirVolumeSource 44, // 60: ateapi.Volume.external_volume_template:type_name -> ateapi.ExternalVolumeTemplate 3, // 61: ateapi.SandboxAssets.sandbox_class:type_name -> ateapi.SandboxClass - 103, // 62: ateapi.SandboxAssets.assets:type_name -> ateapi.SandboxAssets.AssetsEntry - 104, // 63: ateapi.ArchAssets.files:type_name -> ateapi.ArchAssets.FilesEntry + 104, // 62: ateapi.SandboxAssets.assets:type_name -> ateapi.SandboxAssets.AssetsEntry + 105, // 63: ateapi.ArchAssets.files:type_name -> ateapi.ArchAssets.FilesEntry 29, // 64: ateapi.CreateAtespaceRequest.atespace:type_name -> ateapi.Atespace 30, // 65: ateapi.GetAtespaceRequest.atespace:type_name -> ateapi.ObjectRef 29, // 66: ateapi.ListAtespacesResponse.atespaces:type_name -> ateapi.Atespace @@ -6613,108 +6671,112 @@ var file_ateapi_proto_depIdxs = []int32{ 30, // 81: ateapi.DeleteActorRequest.actor:type_name -> ateapi.ObjectRef 30, // 82: ateapi.GetActorEgressPolicyRequest.actor:type_name -> ateapi.ObjectRef 14, // 83: ateapi.GetActorEgressPolicyResponse.egress_policies:type_name -> ateapi.EgressPolicy - 30, // 84: ateapi.SetActorEgressPolicyRequest.actor:type_name -> ateapi.ObjectRef - 14, // 85: ateapi.SetActorEgressPolicyRequest.egress_policy:type_name -> ateapi.EgressPolicy - 30, // 86: ateapi.DeleteActorEgressPolicyRequest.actor:type_name -> ateapi.ObjectRef - 30, // 87: ateapi.GetActorSnapshotRequest.actor_snapshot:type_name -> ateapi.ObjectRef - 30, // 88: ateapi.GetActorSnapshotTagRequest.actor_snapshot_tag:type_name -> ateapi.ObjectRef - 26, // 89: ateapi.ListActorSnapshotsResponse.actor_snapshots:type_name -> ateapi.ActorSnapshot - 28, // 90: ateapi.CreateActorSnapshotTagRequest.actor_snapshot_tag:type_name -> ateapi.ActorSnapshotTag - 28, // 91: ateapi.UpdateActorSnapshotTagRequest.actor_snapshot_tag:type_name -> ateapi.ActorSnapshotTag - 30, // 92: ateapi.DeleteActorSnapshotTagRequest.actor_snapshot_tag:type_name -> ateapi.ObjectRef - 90, // 93: ateapi.ListWorkersResponse.workers:type_name -> ateapi.Worker - 30, // 94: ateapi.GetWorkerRequest.worker:type_name -> ateapi.ObjectRef - 90, // 95: ateapi.CreateWorkerRequest.worker:type_name -> ateapi.Worker - 90, // 96: ateapi.UpdateWorkerRequest.worker:type_name -> ateapi.Worker - 30, // 97: ateapi.DeleteWorkerRequest.worker:type_name -> ateapi.ObjectRef - 80, // 98: ateapi.DeleteWorkerRequest.options:type_name -> ateapi.DeleteOptions - 30, // 99: ateapi.DrainWorkerRequest.worker:type_name -> ateapi.ObjectRef - 13, // 100: ateapi.ListActorsResponse.actors:type_name -> ateapi.Actor - 11, // 101: ateapi.Worker.metadata:type_name -> ateapi.ResourceMetadata - 105, // 102: ateapi.Worker.labels:type_name -> ateapi.Worker.LabelsEntry - 92, // 103: ateapi.Worker.capacity:type_name -> ateapi.WorkerCapacity - 91, // 104: ateapi.Worker.status:type_name -> ateapi.WorkerStatus - 6, // 105: ateapi.WorkerStatus.state:type_name -> ateapi.WorkerState - 93, // 106: ateapi.WorkerStatus.assignment:type_name -> ateapi.ActorAssignment - 94, // 107: ateapi.ActorAssignment.actor_template:type_name -> ateapi.KubeNamespacedObjectRef - 30, // 108: ateapi.ActorAssignment.actor:type_name -> ateapi.ObjectRef - 30, // 109: ateapi.MintCertRequest.worker:type_name -> ateapi.ObjectRef - 7, // 110: ateapi.MintCertRequest.purpose:type_name -> ateapi.ActorCertificatePurpose - 47, // 111: ateapi.SandboxAssets.AssetsEntry.value:type_name -> ateapi.ArchAssets - 48, // 112: ateapi.ArchAssets.FilesEntry.value:type_name -> ateapi.AssetFile - 59, // 113: ateapi.Control.GetActor:input_type -> ateapi.GetActorRequest - 60, // 114: ateapi.Control.CreateActor:input_type -> ateapi.CreateActorRequest - 61, // 115: ateapi.Control.UpdateActor:input_type -> ateapi.UpdateActorRequest - 62, // 116: ateapi.Control.SuspendActor:input_type -> ateapi.SuspendActorRequest - 64, // 117: ateapi.Control.PauseActor:input_type -> ateapi.PauseActorRequest - 66, // 118: ateapi.Control.ResumeActor:input_type -> ateapi.ResumeActorRequest - 68, // 119: ateapi.Control.DeleteActor:input_type -> ateapi.DeleteActorRequest - 69, // 120: ateapi.Control.GetActorEgressPolicy:input_type -> ateapi.GetActorEgressPolicyRequest - 71, // 121: ateapi.Control.SetActorEgressPolicy:input_type -> ateapi.SetActorEgressPolicyRequest - 72, // 122: ateapi.Control.DeleteActorEgressPolicy:input_type -> ateapi.DeleteActorEgressPolicyRequest - 73, // 123: ateapi.Control.GetActorSnapshot:input_type -> ateapi.GetActorSnapshotRequest - 74, // 124: ateapi.Control.GetActorSnapshotTag:input_type -> ateapi.GetActorSnapshotTagRequest - 75, // 125: ateapi.Control.ListActorSnapshots:input_type -> ateapi.ListActorSnapshotsRequest - 77, // 126: ateapi.Control.CreateActorSnapshotTag:input_type -> ateapi.CreateActorSnapshotTagRequest - 78, // 127: ateapi.Control.UpdateActorSnapshotTag:input_type -> ateapi.UpdateActorSnapshotTagRequest - 79, // 128: ateapi.Control.DeleteActorSnapshotTag:input_type -> ateapi.DeleteActorSnapshotTagRequest - 81, // 129: ateapi.Control.ListWorkers:input_type -> ateapi.ListWorkersRequest - 83, // 130: ateapi.Control.GetWorker:input_type -> ateapi.GetWorkerRequest - 84, // 131: ateapi.Control.CreateWorker:input_type -> ateapi.CreateWorkerRequest - 85, // 132: ateapi.Control.UpdateWorker:input_type -> ateapi.UpdateWorkerRequest - 86, // 133: ateapi.Control.DeleteWorker:input_type -> ateapi.DeleteWorkerRequest - 87, // 134: ateapi.Control.DrainWorker:input_type -> ateapi.DrainWorkerRequest - 88, // 135: ateapi.Control.ListActors:input_type -> ateapi.ListActorsRequest - 49, // 136: ateapi.Control.CreateAtespace:input_type -> ateapi.CreateAtespaceRequest - 50, // 137: ateapi.Control.GetAtespace:input_type -> ateapi.GetAtespaceRequest - 51, // 138: ateapi.Control.ListAtespaces:input_type -> ateapi.ListAtespacesRequest - 53, // 139: ateapi.Control.DeleteAtespace:input_type -> ateapi.DeleteAtespaceRequest - 54, // 140: ateapi.Control.CreateActorTemplate:input_type -> ateapi.CreateActorTemplateRequest - 55, // 141: ateapi.Control.GetActorTemplate:input_type -> ateapi.GetActorTemplateRequest - 56, // 142: ateapi.Control.ListActorTemplates:input_type -> ateapi.ListActorTemplatesRequest - 58, // 143: ateapi.Control.DeleteActorTemplate:input_type -> ateapi.DeleteActorTemplateRequest - 95, // 144: ateapi.Debug.DebugClear:input_type -> ateapi.DebugClearRequest - 97, // 145: ateapi.ActorIdentity.MintJWT:input_type -> ateapi.MintJWTRequest - 99, // 146: ateapi.ActorIdentity.MintCert:input_type -> ateapi.MintCertRequest - 13, // 147: ateapi.Control.GetActor:output_type -> ateapi.Actor - 13, // 148: ateapi.Control.CreateActor:output_type -> ateapi.Actor - 13, // 149: ateapi.Control.UpdateActor:output_type -> ateapi.Actor - 63, // 150: ateapi.Control.SuspendActor:output_type -> ateapi.SuspendActorResponse - 65, // 151: ateapi.Control.PauseActor:output_type -> ateapi.PauseActorResponse - 67, // 152: ateapi.Control.ResumeActor:output_type -> ateapi.ResumeActorResponse - 13, // 153: ateapi.Control.DeleteActor:output_type -> ateapi.Actor - 70, // 154: ateapi.Control.GetActorEgressPolicy:output_type -> ateapi.GetActorEgressPolicyResponse - 14, // 155: ateapi.Control.SetActorEgressPolicy:output_type -> ateapi.EgressPolicy - 14, // 156: ateapi.Control.DeleteActorEgressPolicy:output_type -> ateapi.EgressPolicy - 26, // 157: ateapi.Control.GetActorSnapshot:output_type -> ateapi.ActorSnapshot - 28, // 158: ateapi.Control.GetActorSnapshotTag:output_type -> ateapi.ActorSnapshotTag - 76, // 159: ateapi.Control.ListActorSnapshots:output_type -> ateapi.ListActorSnapshotsResponse - 28, // 160: ateapi.Control.CreateActorSnapshotTag:output_type -> ateapi.ActorSnapshotTag - 28, // 161: ateapi.Control.UpdateActorSnapshotTag:output_type -> ateapi.ActorSnapshotTag - 28, // 162: ateapi.Control.DeleteActorSnapshotTag:output_type -> ateapi.ActorSnapshotTag - 82, // 163: ateapi.Control.ListWorkers:output_type -> ateapi.ListWorkersResponse - 90, // 164: ateapi.Control.GetWorker:output_type -> ateapi.Worker - 90, // 165: ateapi.Control.CreateWorker:output_type -> ateapi.Worker - 90, // 166: ateapi.Control.UpdateWorker:output_type -> ateapi.Worker - 90, // 167: ateapi.Control.DeleteWorker:output_type -> ateapi.Worker - 90, // 168: ateapi.Control.DrainWorker:output_type -> ateapi.Worker - 89, // 169: ateapi.Control.ListActors:output_type -> ateapi.ListActorsResponse - 29, // 170: ateapi.Control.CreateAtespace:output_type -> ateapi.Atespace - 29, // 171: ateapi.Control.GetAtespace:output_type -> ateapi.Atespace - 52, // 172: ateapi.Control.ListAtespaces:output_type -> ateapi.ListAtespacesResponse - 29, // 173: ateapi.Control.DeleteAtespace:output_type -> ateapi.Atespace - 31, // 174: ateapi.Control.CreateActorTemplate:output_type -> ateapi.ActorTemplate - 31, // 175: ateapi.Control.GetActorTemplate:output_type -> ateapi.ActorTemplate - 57, // 176: ateapi.Control.ListActorTemplates:output_type -> ateapi.ListActorTemplatesResponse - 31, // 177: ateapi.Control.DeleteActorTemplate:output_type -> ateapi.ActorTemplate - 96, // 178: ateapi.Debug.DebugClear:output_type -> ateapi.DebugClearResponse - 98, // 179: ateapi.ActorIdentity.MintJWT:output_type -> ateapi.MintJWTResponse - 100, // 180: ateapi.ActorIdentity.MintCert:output_type -> ateapi.MintCertResponse - 147, // [147:181] is the sub-list for method output_type - 113, // [113:147] is the sub-list for method input_type - 113, // [113:113] is the sub-list for extension type_name - 113, // [113:113] is the sub-list for extension extendee - 0, // [0:113] is the sub-list for field type_name + 30, // 84: ateapi.CreateActorEgressPolicyRequest.actor:type_name -> ateapi.ObjectRef + 14, // 85: ateapi.CreateActorEgressPolicyRequest.egress_policy:type_name -> ateapi.EgressPolicy + 30, // 86: ateapi.UpdateActorEgressPolicyRequest.actor:type_name -> ateapi.ObjectRef + 14, // 87: ateapi.UpdateActorEgressPolicyRequest.egress_policy:type_name -> ateapi.EgressPolicy + 30, // 88: ateapi.DeleteActorEgressPolicyRequest.actor:type_name -> ateapi.ObjectRef + 30, // 89: ateapi.GetActorSnapshotRequest.actor_snapshot:type_name -> ateapi.ObjectRef + 30, // 90: ateapi.GetActorSnapshotTagRequest.actor_snapshot_tag:type_name -> ateapi.ObjectRef + 26, // 91: ateapi.ListActorSnapshotsResponse.actor_snapshots:type_name -> ateapi.ActorSnapshot + 28, // 92: ateapi.CreateActorSnapshotTagRequest.actor_snapshot_tag:type_name -> ateapi.ActorSnapshotTag + 28, // 93: ateapi.UpdateActorSnapshotTagRequest.actor_snapshot_tag:type_name -> ateapi.ActorSnapshotTag + 30, // 94: ateapi.DeleteActorSnapshotTagRequest.actor_snapshot_tag:type_name -> ateapi.ObjectRef + 91, // 95: ateapi.ListWorkersResponse.workers:type_name -> ateapi.Worker + 30, // 96: ateapi.GetWorkerRequest.worker:type_name -> ateapi.ObjectRef + 91, // 97: ateapi.CreateWorkerRequest.worker:type_name -> ateapi.Worker + 91, // 98: ateapi.UpdateWorkerRequest.worker:type_name -> ateapi.Worker + 30, // 99: ateapi.DeleteWorkerRequest.worker:type_name -> ateapi.ObjectRef + 81, // 100: ateapi.DeleteWorkerRequest.options:type_name -> ateapi.DeleteOptions + 30, // 101: ateapi.DrainWorkerRequest.worker:type_name -> ateapi.ObjectRef + 13, // 102: ateapi.ListActorsResponse.actors:type_name -> ateapi.Actor + 11, // 103: ateapi.Worker.metadata:type_name -> ateapi.ResourceMetadata + 106, // 104: ateapi.Worker.labels:type_name -> ateapi.Worker.LabelsEntry + 93, // 105: ateapi.Worker.capacity:type_name -> ateapi.WorkerCapacity + 92, // 106: ateapi.Worker.status:type_name -> ateapi.WorkerStatus + 6, // 107: ateapi.WorkerStatus.state:type_name -> ateapi.WorkerState + 94, // 108: ateapi.WorkerStatus.assignment:type_name -> ateapi.ActorAssignment + 95, // 109: ateapi.ActorAssignment.actor_template:type_name -> ateapi.KubeNamespacedObjectRef + 30, // 110: ateapi.ActorAssignment.actor:type_name -> ateapi.ObjectRef + 30, // 111: ateapi.MintCertRequest.worker:type_name -> ateapi.ObjectRef + 7, // 112: ateapi.MintCertRequest.purpose:type_name -> ateapi.ActorCertificatePurpose + 47, // 113: ateapi.SandboxAssets.AssetsEntry.value:type_name -> ateapi.ArchAssets + 48, // 114: ateapi.ArchAssets.FilesEntry.value:type_name -> ateapi.AssetFile + 59, // 115: ateapi.Control.GetActor:input_type -> ateapi.GetActorRequest + 60, // 116: ateapi.Control.CreateActor:input_type -> ateapi.CreateActorRequest + 61, // 117: ateapi.Control.UpdateActor:input_type -> ateapi.UpdateActorRequest + 62, // 118: ateapi.Control.SuspendActor:input_type -> ateapi.SuspendActorRequest + 64, // 119: ateapi.Control.PauseActor:input_type -> ateapi.PauseActorRequest + 66, // 120: ateapi.Control.ResumeActor:input_type -> ateapi.ResumeActorRequest + 68, // 121: ateapi.Control.DeleteActor:input_type -> ateapi.DeleteActorRequest + 69, // 122: ateapi.Control.GetActorEgressPolicy:input_type -> ateapi.GetActorEgressPolicyRequest + 71, // 123: ateapi.Control.CreateActorEgressPolicy:input_type -> ateapi.CreateActorEgressPolicyRequest + 72, // 124: ateapi.Control.UpdateActorEgressPolicy:input_type -> ateapi.UpdateActorEgressPolicyRequest + 73, // 125: ateapi.Control.DeleteActorEgressPolicy:input_type -> ateapi.DeleteActorEgressPolicyRequest + 74, // 126: ateapi.Control.GetActorSnapshot:input_type -> ateapi.GetActorSnapshotRequest + 75, // 127: ateapi.Control.GetActorSnapshotTag:input_type -> ateapi.GetActorSnapshotTagRequest + 76, // 128: ateapi.Control.ListActorSnapshots:input_type -> ateapi.ListActorSnapshotsRequest + 78, // 129: ateapi.Control.CreateActorSnapshotTag:input_type -> ateapi.CreateActorSnapshotTagRequest + 79, // 130: ateapi.Control.UpdateActorSnapshotTag:input_type -> ateapi.UpdateActorSnapshotTagRequest + 80, // 131: ateapi.Control.DeleteActorSnapshotTag:input_type -> ateapi.DeleteActorSnapshotTagRequest + 82, // 132: ateapi.Control.ListWorkers:input_type -> ateapi.ListWorkersRequest + 84, // 133: ateapi.Control.GetWorker:input_type -> ateapi.GetWorkerRequest + 85, // 134: ateapi.Control.CreateWorker:input_type -> ateapi.CreateWorkerRequest + 86, // 135: ateapi.Control.UpdateWorker:input_type -> ateapi.UpdateWorkerRequest + 87, // 136: ateapi.Control.DeleteWorker:input_type -> ateapi.DeleteWorkerRequest + 88, // 137: ateapi.Control.DrainWorker:input_type -> ateapi.DrainWorkerRequest + 89, // 138: ateapi.Control.ListActors:input_type -> ateapi.ListActorsRequest + 49, // 139: ateapi.Control.CreateAtespace:input_type -> ateapi.CreateAtespaceRequest + 50, // 140: ateapi.Control.GetAtespace:input_type -> ateapi.GetAtespaceRequest + 51, // 141: ateapi.Control.ListAtespaces:input_type -> ateapi.ListAtespacesRequest + 53, // 142: ateapi.Control.DeleteAtespace:input_type -> ateapi.DeleteAtespaceRequest + 54, // 143: ateapi.Control.CreateActorTemplate:input_type -> ateapi.CreateActorTemplateRequest + 55, // 144: ateapi.Control.GetActorTemplate:input_type -> ateapi.GetActorTemplateRequest + 56, // 145: ateapi.Control.ListActorTemplates:input_type -> ateapi.ListActorTemplatesRequest + 58, // 146: ateapi.Control.DeleteActorTemplate:input_type -> ateapi.DeleteActorTemplateRequest + 96, // 147: ateapi.Debug.DebugClear:input_type -> ateapi.DebugClearRequest + 98, // 148: ateapi.ActorIdentity.MintJWT:input_type -> ateapi.MintJWTRequest + 100, // 149: ateapi.ActorIdentity.MintCert:input_type -> ateapi.MintCertRequest + 13, // 150: ateapi.Control.GetActor:output_type -> ateapi.Actor + 13, // 151: ateapi.Control.CreateActor:output_type -> ateapi.Actor + 13, // 152: ateapi.Control.UpdateActor:output_type -> ateapi.Actor + 63, // 153: ateapi.Control.SuspendActor:output_type -> ateapi.SuspendActorResponse + 65, // 154: ateapi.Control.PauseActor:output_type -> ateapi.PauseActorResponse + 67, // 155: ateapi.Control.ResumeActor:output_type -> ateapi.ResumeActorResponse + 13, // 156: ateapi.Control.DeleteActor:output_type -> ateapi.Actor + 70, // 157: ateapi.Control.GetActorEgressPolicy:output_type -> ateapi.GetActorEgressPolicyResponse + 14, // 158: ateapi.Control.CreateActorEgressPolicy:output_type -> ateapi.EgressPolicy + 14, // 159: ateapi.Control.UpdateActorEgressPolicy:output_type -> ateapi.EgressPolicy + 14, // 160: ateapi.Control.DeleteActorEgressPolicy:output_type -> ateapi.EgressPolicy + 26, // 161: ateapi.Control.GetActorSnapshot:output_type -> ateapi.ActorSnapshot + 28, // 162: ateapi.Control.GetActorSnapshotTag:output_type -> ateapi.ActorSnapshotTag + 77, // 163: ateapi.Control.ListActorSnapshots:output_type -> ateapi.ListActorSnapshotsResponse + 28, // 164: ateapi.Control.CreateActorSnapshotTag:output_type -> ateapi.ActorSnapshotTag + 28, // 165: ateapi.Control.UpdateActorSnapshotTag:output_type -> ateapi.ActorSnapshotTag + 28, // 166: ateapi.Control.DeleteActorSnapshotTag:output_type -> ateapi.ActorSnapshotTag + 83, // 167: ateapi.Control.ListWorkers:output_type -> ateapi.ListWorkersResponse + 91, // 168: ateapi.Control.GetWorker:output_type -> ateapi.Worker + 91, // 169: ateapi.Control.CreateWorker:output_type -> ateapi.Worker + 91, // 170: ateapi.Control.UpdateWorker:output_type -> ateapi.Worker + 91, // 171: ateapi.Control.DeleteWorker:output_type -> ateapi.Worker + 91, // 172: ateapi.Control.DrainWorker:output_type -> ateapi.Worker + 90, // 173: ateapi.Control.ListActors:output_type -> ateapi.ListActorsResponse + 29, // 174: ateapi.Control.CreateAtespace:output_type -> ateapi.Atespace + 29, // 175: ateapi.Control.GetAtespace:output_type -> ateapi.Atespace + 52, // 176: ateapi.Control.ListAtespaces:output_type -> ateapi.ListAtespacesResponse + 29, // 177: ateapi.Control.DeleteAtespace:output_type -> ateapi.Atespace + 31, // 178: ateapi.Control.CreateActorTemplate:output_type -> ateapi.ActorTemplate + 31, // 179: ateapi.Control.GetActorTemplate:output_type -> ateapi.ActorTemplate + 57, // 180: ateapi.Control.ListActorTemplates:output_type -> ateapi.ListActorTemplatesResponse + 31, // 181: ateapi.Control.DeleteActorTemplate:output_type -> ateapi.ActorTemplate + 97, // 182: ateapi.Debug.DebugClear:output_type -> ateapi.DebugClearResponse + 99, // 183: ateapi.ActorIdentity.MintJWT:output_type -> ateapi.MintJWTResponse + 101, // 184: ateapi.ActorIdentity.MintCert:output_type -> ateapi.MintCertResponse + 150, // [150:185] is the sub-list for method output_type + 115, // [115:150] is the sub-list for method input_type + 115, // [115:115] is the sub-list for extension type_name + 115, // [115:115] is the sub-list for extension extendee + 0, // [0:115] is the sub-list for field type_name } func init() { file_ateapi_proto_init() } @@ -6733,7 +6795,7 @@ func file_ateapi_proto_init() { GoPackagePath: reflect.TypeOf(x{}).PkgPath(), RawDescriptor: unsafe.Slice(unsafe.StringData(file_ateapi_proto_rawDesc), len(file_ateapi_proto_rawDesc)), NumEnums: 9, - NumMessages: 97, + NumMessages: 98, NumExtensions: 0, NumServices: 3, }, diff --git a/pkg/proto/ateapipb/ateapi.proto b/pkg/proto/ateapipb/ateapi.proto index 728fbb9dcd..2359603edd 100644 --- a/pkg/proto/ateapipb/ateapi.proto +++ b/pkg/proto/ateapipb/ateapi.proto @@ -50,8 +50,11 @@ service Control { // one document. rpc GetActorEgressPolicy(GetActorEgressPolicyRequest) returns (GetActorEgressPolicyResponse) {} - // Create or replace the egress policy document nested under an Actor. - rpc SetActorEgressPolicy(SetActorEgressPolicyRequest) returns (EgressPolicy) {} + // Create the egress policy document nested under an Actor. + rpc CreateActorEgressPolicy(CreateActorEgressPolicyRequest) returns (EgressPolicy) {} + + // Replace the egress policy document nested under an Actor. + rpc UpdateActorEgressPolicy(UpdateActorEgressPolicyRequest) returns (EgressPolicy) {} // Delete all egress policy documents nested under an Actor. rpc DeleteActorEgressPolicy(DeleteActorEgressPolicyRequest) returns (EgressPolicy) {} @@ -835,12 +838,19 @@ message GetActorEgressPolicyResponse { repeated EgressPolicy egress_policies = 1; } -message SetActorEgressPolicyRequest { +message CreateActorEgressPolicyRequest { + // Parent Actor. V0 assigns the policy document's identity implicitly. + ObjectRef actor = 1; + + // The policy to create. Metadata must be empty. + EgressPolicy egress_policy = 2; +} + +message UpdateActorEgressPolicyRequest { // Parent Actor. V0 assigns the policy document's identity implicitly. ObjectRef actor = 1; - // Full replacement. Empty metadata creates the document and fails if one - // already exists. UID and version guard replacement of an observed document. + // Full replacement. Metadata UID and version are required preconditions. EgressPolicy egress_policy = 2; } diff --git a/pkg/proto/ateapipb/ateapi_grpc.pb.go b/pkg/proto/ateapipb/ateapi_grpc.pb.go index eefe587ebd..19357ed3a1 100644 --- a/pkg/proto/ateapipb/ateapi_grpc.pb.go +++ b/pkg/proto/ateapipb/ateapi_grpc.pb.go @@ -41,7 +41,8 @@ const ( Control_ResumeActor_FullMethodName = "/ateapi.Control/ResumeActor" Control_DeleteActor_FullMethodName = "/ateapi.Control/DeleteActor" Control_GetActorEgressPolicy_FullMethodName = "/ateapi.Control/GetActorEgressPolicy" - Control_SetActorEgressPolicy_FullMethodName = "/ateapi.Control/SetActorEgressPolicy" + Control_CreateActorEgressPolicy_FullMethodName = "/ateapi.Control/CreateActorEgressPolicy" + Control_UpdateActorEgressPolicy_FullMethodName = "/ateapi.Control/UpdateActorEgressPolicy" Control_DeleteActorEgressPolicy_FullMethodName = "/ateapi.Control/DeleteActorEgressPolicy" Control_GetActorSnapshot_FullMethodName = "/ateapi.Control/GetActorSnapshot" Control_GetActorSnapshotTag_FullMethodName = "/ateapi.Control/GetActorSnapshotTag" @@ -91,8 +92,10 @@ type ControlClient interface { // Get all egress policy documents nested under an Actor. V0 returns zero or // one document. GetActorEgressPolicy(ctx context.Context, in *GetActorEgressPolicyRequest, opts ...grpc.CallOption) (*GetActorEgressPolicyResponse, error) - // Create or replace the egress policy document nested under an Actor. - SetActorEgressPolicy(ctx context.Context, in *SetActorEgressPolicyRequest, opts ...grpc.CallOption) (*EgressPolicy, error) + // Create the egress policy document nested under an Actor. + CreateActorEgressPolicy(ctx context.Context, in *CreateActorEgressPolicyRequest, opts ...grpc.CallOption) (*EgressPolicy, error) + // Replace the egress policy document nested under an Actor. + UpdateActorEgressPolicy(ctx context.Context, in *UpdateActorEgressPolicyRequest, opts ...grpc.CallOption) (*EgressPolicy, error) // Delete all egress policy documents nested under an Actor. DeleteActorEgressPolicy(ctx context.Context, in *DeleteActorEgressPolicyRequest, opts ...grpc.CallOption) (*EgressPolicy, error) // Get an ActorSnapshot. @@ -230,10 +233,20 @@ func (c *controlClient) GetActorEgressPolicy(ctx context.Context, in *GetActorEg return out, nil } -func (c *controlClient) SetActorEgressPolicy(ctx context.Context, in *SetActorEgressPolicyRequest, opts ...grpc.CallOption) (*EgressPolicy, error) { +func (c *controlClient) CreateActorEgressPolicy(ctx context.Context, in *CreateActorEgressPolicyRequest, opts ...grpc.CallOption) (*EgressPolicy, error) { cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) out := new(EgressPolicy) - err := c.cc.Invoke(ctx, Control_SetActorEgressPolicy_FullMethodName, in, out, cOpts...) + err := c.cc.Invoke(ctx, Control_CreateActorEgressPolicy_FullMethodName, in, out, cOpts...) + if err != nil { + return nil, err + } + return out, nil +} + +func (c *controlClient) UpdateActorEgressPolicy(ctx context.Context, in *UpdateActorEgressPolicyRequest, opts ...grpc.CallOption) (*EgressPolicy, error) { + cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) + out := new(EgressPolicy) + err := c.cc.Invoke(ctx, Control_UpdateActorEgressPolicy_FullMethodName, in, out, cOpts...) if err != nil { return nil, err } @@ -485,8 +498,10 @@ type ControlServer interface { // Get all egress policy documents nested under an Actor. V0 returns zero or // one document. GetActorEgressPolicy(context.Context, *GetActorEgressPolicyRequest) (*GetActorEgressPolicyResponse, error) - // Create or replace the egress policy document nested under an Actor. - SetActorEgressPolicy(context.Context, *SetActorEgressPolicyRequest) (*EgressPolicy, error) + // Create the egress policy document nested under an Actor. + CreateActorEgressPolicy(context.Context, *CreateActorEgressPolicyRequest) (*EgressPolicy, error) + // Replace the egress policy document nested under an Actor. + UpdateActorEgressPolicy(context.Context, *UpdateActorEgressPolicyRequest) (*EgressPolicy, error) // Delete all egress policy documents nested under an Actor. DeleteActorEgressPolicy(context.Context, *DeleteActorEgressPolicyRequest) (*EgressPolicy, error) // Get an ActorSnapshot. @@ -568,8 +583,11 @@ func (UnimplementedControlServer) DeleteActor(context.Context, *DeleteActorReque func (UnimplementedControlServer) GetActorEgressPolicy(context.Context, *GetActorEgressPolicyRequest) (*GetActorEgressPolicyResponse, error) { return nil, status.Error(codes.Unimplemented, "method GetActorEgressPolicy not implemented") } -func (UnimplementedControlServer) SetActorEgressPolicy(context.Context, *SetActorEgressPolicyRequest) (*EgressPolicy, error) { - return nil, status.Error(codes.Unimplemented, "method SetActorEgressPolicy not implemented") +func (UnimplementedControlServer) CreateActorEgressPolicy(context.Context, *CreateActorEgressPolicyRequest) (*EgressPolicy, error) { + return nil, status.Error(codes.Unimplemented, "method CreateActorEgressPolicy not implemented") +} +func (UnimplementedControlServer) UpdateActorEgressPolicy(context.Context, *UpdateActorEgressPolicyRequest) (*EgressPolicy, error) { + return nil, status.Error(codes.Unimplemented, "method UpdateActorEgressPolicy not implemented") } func (UnimplementedControlServer) DeleteActorEgressPolicy(context.Context, *DeleteActorEgressPolicyRequest) (*EgressPolicy, error) { return nil, status.Error(codes.Unimplemented, "method DeleteActorEgressPolicy not implemented") @@ -802,20 +820,38 @@ func _Control_GetActorEgressPolicy_Handler(srv interface{}, ctx context.Context, return interceptor(ctx, in, info, handler) } -func _Control_SetActorEgressPolicy_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { - in := new(SetActorEgressPolicyRequest) +func _Control_CreateActorEgressPolicy_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { + in := new(CreateActorEgressPolicyRequest) + if err := dec(in); err != nil { + return nil, err + } + if interceptor == nil { + return srv.(ControlServer).CreateActorEgressPolicy(ctx, in) + } + info := &grpc.UnaryServerInfo{ + Server: srv, + FullMethod: Control_CreateActorEgressPolicy_FullMethodName, + } + handler := func(ctx context.Context, req interface{}) (interface{}, error) { + return srv.(ControlServer).CreateActorEgressPolicy(ctx, req.(*CreateActorEgressPolicyRequest)) + } + return interceptor(ctx, in, info, handler) +} + +func _Control_UpdateActorEgressPolicy_Handler(srv interface{}, ctx context.Context, dec func(interface{}) error, interceptor grpc.UnaryServerInterceptor) (interface{}, error) { + in := new(UpdateActorEgressPolicyRequest) if err := dec(in); err != nil { return nil, err } if interceptor == nil { - return srv.(ControlServer).SetActorEgressPolicy(ctx, in) + return srv.(ControlServer).UpdateActorEgressPolicy(ctx, in) } info := &grpc.UnaryServerInfo{ Server: srv, - FullMethod: Control_SetActorEgressPolicy_FullMethodName, + FullMethod: Control_UpdateActorEgressPolicy_FullMethodName, } handler := func(ctx context.Context, req interface{}) (interface{}, error) { - return srv.(ControlServer).SetActorEgressPolicy(ctx, req.(*SetActorEgressPolicyRequest)) + return srv.(ControlServer).UpdateActorEgressPolicy(ctx, req.(*UpdateActorEgressPolicyRequest)) } return interceptor(ctx, in, info, handler) } @@ -1256,8 +1292,12 @@ var Control_ServiceDesc = grpc.ServiceDesc{ Handler: _Control_GetActorEgressPolicy_Handler, }, { - MethodName: "SetActorEgressPolicy", - Handler: _Control_SetActorEgressPolicy_Handler, + MethodName: "CreateActorEgressPolicy", + Handler: _Control_CreateActorEgressPolicy_Handler, + }, + { + MethodName: "UpdateActorEgressPolicy", + Handler: _Control_UpdateActorEgressPolicy_Handler, }, { MethodName: "DeleteActorEgressPolicy", From a82a96c8d234ca94c4e44e5d99bc3b4e5931ef7d Mon Sep 17 00:00:00 2001 From: Eitan Yarmush Date: Wed, 26 Aug 2026 14:24:53 +0000 Subject: [PATCH 5/9] Move egress policy storage into atepg Signed-off-by: Eitan Yarmush --- cmd/ateapi/internal/store/atepg/atepg.go | 110 ++++++++++++++ .../internal/store/atepg/egress_policy.go | 135 ------------------ 2 files changed, 110 insertions(+), 135 deletions(-) delete mode 100644 cmd/ateapi/internal/store/atepg/egress_policy.go diff --git a/cmd/ateapi/internal/store/atepg/atepg.go b/cmd/ateapi/internal/store/atepg/atepg.go index 1f16e18cb1..2db07c42de 100644 --- a/cmd/ateapi/internal/store/atepg/atepg.go +++ b/cmd/ateapi/internal/store/atepg/atepg.go @@ -836,6 +836,116 @@ func (p *Persistence) listActorsGlobal(ctx context.Context, pageSize int32, page return result, nextToken, nil } +// --- Actor egress policies --- + +func (p *Persistence) CreateEgressPolicy(ctx context.Context, actorRef resources.ActorRef, policy *ateapipb.EgressPolicy) (*ateapipb.EgressPolicy, error) { + dbPolicy := proto.Clone(policy).(*ateapipb.EgressPolicy) + dbPolicy.Metadata = newCreateMetadata("", "") + protoBytes, err := proto.Marshal(dbPolicy) + if err != nil { + return nil, fmt.Errorf("marshaling egress policy: %w", err) + } + _, err = p.pool.Exec(ctx, ` + INSERT INTO actor_egress_policies (atespace, actor_name, uid, version, proto) + VALUES ($1, $2, $3, $4, $5)`, actorRef.Atespace, actorRef.Name, dbPolicy.GetMetadata().GetUid(), dbPolicy.GetMetadata().GetVersion(), protoBytes) + if err != nil { + if isUniqueViolation(err) { + return nil, store.ErrAlreadyExists + } + if isForeignKeyViolation(err) { + return nil, store.ErrFailedPrecondition + } + return nil, fmt.Errorf("inserting egress policy for %s: %w", actorRef, err) + } + return dbPolicy, nil +} + +func (p *Persistence) GetEgressPolicy(ctx context.Context, actorRef resources.ActorRef) (*ateapipb.EgressPolicy, error) { + return getEgressPolicyRow(ctx, p.pool, ` + SELECT uid, version, proto FROM actor_egress_policies + WHERE atespace = $1 AND actor_name = $2`, actorRef.Atespace, actorRef.Name) +} + +func (p *Persistence) UpdateEgressPolicy(ctx context.Context, actorRef resources.ActorRef, precondition store.Precondition, mutate func(*ateapipb.EgressPolicy) error) (*ateapipb.EgressPolicy, error) { + if err := precondition.Validate(); err != nil { + return nil, err + } + tx, err := p.pool.Begin(ctx) + if err != nil { + return nil, fmt.Errorf("beginning egress policy update: %w", err) + } + defer tx.Rollback(ctx) //nolint:errcheck // no-op once committed + + current, err := getEgressPolicyRow(ctx, tx, ` + SELECT uid, version, proto FROM actor_egress_policies + WHERE atespace = $1 AND actor_name = $2 FOR UPDATE`, actorRef.Atespace, actorRef.Name) + if err != nil { + return nil, err + } + if err := precondition.Check(current.GetMetadata()); err != nil { + return nil, err + } + updated := proto.Clone(current).(*ateapipb.EgressPolicy) + if err := mutate(updated); err != nil { + return nil, err + } + updated.Metadata = newUpdateMetadata(current.GetMetadata()) + protoBytes, err := proto.Marshal(updated) + if err != nil { + return nil, fmt.Errorf("marshaling updated egress policy: %w", err) + } + if _, err := tx.Exec(ctx, ` + UPDATE actor_egress_policies SET version = $3, proto = $4 + WHERE atespace = $1 AND actor_name = $2`, actorRef.Atespace, actorRef.Name, updated.GetMetadata().GetVersion(), protoBytes); err != nil { + return nil, fmt.Errorf("updating egress policy for %s: %w", actorRef, err) + } + if err := tx.Commit(ctx); err != nil { + return nil, fmt.Errorf("committing egress policy update: %w", err) + } + return updated, nil +} + +func (p *Persistence) DeleteEgressPolicy(ctx context.Context, actorRef resources.ActorRef) (*ateapipb.EgressPolicy, error) { + var version int64 + var uid string + var protoBytes []byte + err := p.pool.QueryRow(ctx, ` + DELETE FROM actor_egress_policies + WHERE atespace = $1 AND actor_name = $2 + RETURNING uid, version, proto`, actorRef.Atespace, actorRef.Name).Scan(&uid, &version, &protoBytes) + if errors.Is(err, pgx.ErrNoRows) { + return nil, store.ErrNotFound + } + if err != nil { + return nil, fmt.Errorf("deleting egress policy for %s: %w", actorRef, err) + } + return unmarshalEgressPolicy(uid, version, protoBytes) +} + +func getEgressPolicyRow(ctx context.Context, q querier, query string, args ...any) (*ateapipb.EgressPolicy, error) { + var uid string + var version int64 + var protoBytes []byte + if err := q.QueryRow(ctx, query, args...).Scan(&uid, &version, &protoBytes); err != nil { + if errors.Is(err, pgx.ErrNoRows) { + return nil, store.ErrNotFound + } + return nil, fmt.Errorf("getting egress policy: %w", err) + } + return unmarshalEgressPolicy(uid, version, protoBytes) +} + +func unmarshalEgressPolicy(uid string, version int64, protoBytes []byte) (*ateapipb.EgressPolicy, error) { + policy := &ateapipb.EgressPolicy{} + if err := proto.Unmarshal(protoBytes, policy); err != nil { + return nil, fmt.Errorf("unmarshaling egress policy: %w", err) + } + if err := validateProtoMetadataMatchesColumns("egress policy", policy.GetMetadata(), uid, version); err != nil { + return nil, err + } + return policy, nil +} + // --- Actor snapshots --- func (p *Persistence) CreateActorSnapshot(ctx context.Context, snapshot *ateapipb.ActorSnapshot) (*ateapipb.ActorSnapshot, error) { diff --git a/cmd/ateapi/internal/store/atepg/egress_policy.go b/cmd/ateapi/internal/store/atepg/egress_policy.go deleted file mode 100644 index f835bb79ff..0000000000 --- a/cmd/ateapi/internal/store/atepg/egress_policy.go +++ /dev/null @@ -1,135 +0,0 @@ -// Copyright 2026 Google LLC -// -// Licensed under the Apache License, Version 2.0 (the "License"); -// you may not use this file except in compliance with the License. -// You may obtain a copy of the License at -// -// http://www.apache.org/licenses/LICENSE-2.0 -// -// Unless required by applicable law or agreed to in writing, software -// distributed under the License is distributed on an "AS IS" BASIS, -// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. -// See the License for the specific language governing permissions and -// limitations under the License. - -package atepg - -import ( - "context" - "errors" - "fmt" - - "github.com/agent-substrate/substrate/cmd/ateapi/internal/store" - "github.com/agent-substrate/substrate/internal/resources" - "github.com/agent-substrate/substrate/pkg/proto/ateapipb" - "github.com/jackc/pgx/v5" - "google.golang.org/protobuf/proto" -) - -func (p *Persistence) CreateEgressPolicy(ctx context.Context, actorRef resources.ActorRef, policy *ateapipb.EgressPolicy) (*ateapipb.EgressPolicy, error) { - dbPolicy := proto.Clone(policy).(*ateapipb.EgressPolicy) - dbPolicy.Metadata = newCreateMetadata("", "") - protoBytes, err := proto.Marshal(dbPolicy) - if err != nil { - return nil, fmt.Errorf("marshaling egress policy: %w", err) - } - _, err = p.pool.Exec(ctx, ` - INSERT INTO actor_egress_policies (atespace, actor_name, uid, version, proto) - VALUES ($1, $2, $3, $4, $5)`, actorRef.Atespace, actorRef.Name, dbPolicy.GetMetadata().GetUid(), dbPolicy.GetMetadata().GetVersion(), protoBytes) - if err != nil { - if isUniqueViolation(err) { - return nil, store.ErrAlreadyExists - } - if isForeignKeyViolation(err) { - return nil, store.ErrFailedPrecondition - } - return nil, fmt.Errorf("inserting egress policy for %s: %w", actorRef, err) - } - return dbPolicy, nil -} - -func (p *Persistence) GetEgressPolicy(ctx context.Context, actorRef resources.ActorRef) (*ateapipb.EgressPolicy, error) { - return getEgressPolicyRow(ctx, p.pool, ` - SELECT uid, version, proto FROM actor_egress_policies - WHERE atespace = $1 AND actor_name = $2`, actorRef.Atespace, actorRef.Name) -} - -func (p *Persistence) UpdateEgressPolicy(ctx context.Context, actorRef resources.ActorRef, precondition store.Precondition, mutate func(*ateapipb.EgressPolicy) error) (*ateapipb.EgressPolicy, error) { - if err := precondition.Validate(); err != nil { - return nil, err - } - tx, err := p.pool.Begin(ctx) - if err != nil { - return nil, fmt.Errorf("beginning egress policy update: %w", err) - } - defer tx.Rollback(ctx) //nolint:errcheck // no-op once committed - - current, err := getEgressPolicyRow(ctx, tx, ` - SELECT uid, version, proto FROM actor_egress_policies - WHERE atespace = $1 AND actor_name = $2 FOR UPDATE`, actorRef.Atespace, actorRef.Name) - if err != nil { - return nil, err - } - if err := precondition.Check(current.GetMetadata()); err != nil { - return nil, err - } - updated := proto.Clone(current).(*ateapipb.EgressPolicy) - if err := mutate(updated); err != nil { - return nil, err - } - updated.Metadata = newUpdateMetadata(current.GetMetadata()) - protoBytes, err := proto.Marshal(updated) - if err != nil { - return nil, fmt.Errorf("marshaling updated egress policy: %w", err) - } - if _, err := tx.Exec(ctx, ` - UPDATE actor_egress_policies SET version = $3, proto = $4 - WHERE atespace = $1 AND actor_name = $2`, actorRef.Atespace, actorRef.Name, updated.GetMetadata().GetVersion(), protoBytes); err != nil { - return nil, fmt.Errorf("updating egress policy for %s: %w", actorRef, err) - } - if err := tx.Commit(ctx); err != nil { - return nil, fmt.Errorf("committing egress policy update: %w", err) - } - return updated, nil -} - -func (p *Persistence) DeleteEgressPolicy(ctx context.Context, actorRef resources.ActorRef) (*ateapipb.EgressPolicy, error) { - var version int64 - var uid string - var protoBytes []byte - err := p.pool.QueryRow(ctx, ` - DELETE FROM actor_egress_policies - WHERE atespace = $1 AND actor_name = $2 - RETURNING uid, version, proto`, actorRef.Atespace, actorRef.Name).Scan(&uid, &version, &protoBytes) - if errors.Is(err, pgx.ErrNoRows) { - return nil, store.ErrNotFound - } - if err != nil { - return nil, fmt.Errorf("deleting egress policy for %s: %w", actorRef, err) - } - return unmarshalEgressPolicy(uid, version, protoBytes) -} - -func getEgressPolicyRow(ctx context.Context, q querier, query string, args ...any) (*ateapipb.EgressPolicy, error) { - var uid string - var version int64 - var protoBytes []byte - if err := q.QueryRow(ctx, query, args...).Scan(&uid, &version, &protoBytes); err != nil { - if errors.Is(err, pgx.ErrNoRows) { - return nil, store.ErrNotFound - } - return nil, fmt.Errorf("getting egress policy: %w", err) - } - return unmarshalEgressPolicy(uid, version, protoBytes) -} - -func unmarshalEgressPolicy(uid string, version int64, protoBytes []byte) (*ateapipb.EgressPolicy, error) { - policy := &ateapipb.EgressPolicy{} - if err := proto.Unmarshal(protoBytes, policy); err != nil { - return nil, fmt.Errorf("unmarshaling egress policy: %w", err) - } - if err := validateProtoMetadataMatchesColumns("egress policy", policy.GetMetadata(), uid, version); err != nil { - return nil, err - } - return policy, nil -} From 5a95201b7c3df8d0fef9a2d6c11fb3765922dbcb Mon Sep 17 00:00:00 2001 From: Eitan Yarmush Date: Wed, 26 Aug 2026 18:49:36 +0000 Subject: [PATCH 6/9] Address egress policy API review Signed-off-by: Eitan Yarmush --- .../internal/controlapi/egress_policy.go | 52 ++--- .../internal/controlapi/egress_policy_test.go | 16 +- .../controlapi/zz_generated.validation.go | 202 +++++++++++++++++- cmd/ateapi/internal/store/atepg/atepg.go | 2 +- .../internal/store/storecontract/contract.go | 6 +- pkg/proto/ateapipb/ateapi.pb.go | 92 +++----- pkg/proto/ateapipb/ateapi.proto | 38 +++- 7 files changed, 301 insertions(+), 107 deletions(-) diff --git a/cmd/ateapi/internal/controlapi/egress_policy.go b/cmd/ateapi/internal/controlapi/egress_policy.go index 1a4c5e29b4..478220476d 100644 --- a/cmd/ateapi/internal/controlapi/egress_policy.go +++ b/cmd/ateapi/internal/controlapi/egress_policy.go @@ -28,6 +28,7 @@ import ( "google.golang.org/grpc/codes" "google.golang.org/grpc/status" "google.golang.org/protobuf/proto" + "k8s.io/apimachinery/pkg/api/operation" "k8s.io/apimachinery/pkg/util/validation" "k8s.io/apimachinery/pkg/util/validation/field" ) @@ -55,7 +56,7 @@ func (s *RPCService) CreateActorEgressPolicy(ctx context.Context, req *ateapipb. var errs field.ErrorList errs = append(errs, validateActorRef(req.GetActor(), field.NewPath("actor"))...) policy := req.GetEgressPolicy() - errs = append(errs, validateEgressPolicy(policy, false)...) + errs = append(errs, validateEgressPolicy(ctx, policy, false)...) if len(errs) > 0 { return nil, toGRPCStatusError(errs) } @@ -69,7 +70,7 @@ func (s *RPCService) UpdateActorEgressPolicy(ctx context.Context, req *ateapipb. var errs field.ErrorList errs = append(errs, validateActorRef(req.GetActor(), field.NewPath("actor"))...) policy := req.GetEgressPolicy() - errs = append(errs, validateEgressPolicy(policy, true)...) + errs = append(errs, validateEgressPolicy(ctx, policy, true)...) if len(errs) > 0 { return nil, toGRPCStatusError(errs) } @@ -113,7 +114,7 @@ func validateActorRef(ref *ateapipb.ObjectRef, p *field.Path) field.ErrorList { return resources.ValidateObjectRef(ref, p) } -func validateEgressPolicy(policy *ateapipb.EgressPolicy, requireVersion bool) field.ErrorList { +func validateEgressPolicy(ctx context.Context, policy *ateapipb.EgressPolicy, requireVersion bool) field.ErrorList { root := field.NewPath("egress_policy") if policy == nil { return field.ErrorList{field.Required(root, "")} @@ -134,7 +135,7 @@ func validateEgressPolicy(policy *ateapipb.EgressPolicy, requireVersion bool) fi onlyExactHostnames := len(rule.GetAllow()) > 0 for j, match := range rule.GetAllow() { matchPath := rulePath.Child("allow").Index(j) - key, exactHostname, matchErrs := validateEgressMatch(match, matchPath) + key, exactHostname, matchErrs := validateEgressMatch(ctx, match, matchPath) errs = append(errs, matchErrs...) onlyExactHostnames = onlyExactHostnames && exactHostname if key != "" && seenMatches[key] { @@ -168,10 +169,10 @@ func validateEgressPolicyMetadata(metadata *ateapipb.ResourceMetadata, update bo if metadata.GetAtespace() != "" { errs = append(errs, field.Invalid(p.Child("atespace"), metadata.GetAtespace(), "must be empty")) } - if metadata.GetName() != "" { - errs = append(errs, field.Invalid(p.Child("name"), metadata.GetName(), "must be empty")) - } if !update { + if metadata.GetName() != "" { + errs = append(errs, field.Invalid(p.Child("name"), metadata.GetName(), "must be empty when creating")) + } if metadata.GetUid() != "" { errs = append(errs, field.Invalid(p.Child("uid"), metadata.GetUid(), "must be empty when creating")) } @@ -180,6 +181,9 @@ func validateEgressPolicyMetadata(metadata *ateapipb.ResourceMetadata, update bo } return errs } + if metadata.GetName() != "default" { + errs = append(errs, field.Invalid(p.Child("name"), metadata.GetName(), `must be "default"`)) + } if metadata.GetUid() == "" { errs = append(errs, field.Required(p.Child("uid"), "")) } else { @@ -191,27 +195,27 @@ func validateEgressPolicyMetadata(metadata *ateapipb.ResourceMetadata, update bo return errs } -func validateEgressMatch(match *ateapipb.EgressMatch, p *field.Path) (string, bool, field.ErrorList) { - if match == nil || match.GetPredicate() == nil { - return "", false, field.ErrorList{field.Required(p.Child("predicate"), "")} +func validateEgressMatch(ctx context.Context, match *ateapipb.EgressMatch, p *field.Path) (string, bool, field.ErrorList) { + if match == nil { + return "", false, field.ErrorList{field.Required(p, "")} } - switch predicate := match.GetPredicate().(type) { - case *ateapipb.EgressMatch_All: + if errs := Validate_EgressMatch(ctx, operation.Operation{Type: operation.Create}, p, match, nil); len(errs) != 0 { + return "", false, errs + } + if match.GetAll() != nil { return "all", false, nil - case *ateapipb.EgressMatch_Hostname: - normalized, wildcard, errs := validateHostnameMatch(predicate.Hostname, p.Child("hostname")) + } + if match.GetHostname() != nil { + normalized, wildcard, errs := validateHostnameMatch(match.GetHostname(), p.Child("hostname")) return "hostname:" + normalized, normalized != "" && !wildcard, errs - case *ateapipb.EgressMatch_IpBlock: - cidrPath := p.Child("ip_block", "cidr") - cidr := predicate.IpBlock.GetCidr() - prefix, err := netip.ParsePrefix(cidr) - if err != nil || prefix.Masked().String() != cidr { - return "", false, field.ErrorList{field.Invalid(cidrPath, cidr, "must be a canonical IPv4 or IPv6 prefix")} - } - return "ip:" + cidr, false, nil - default: - return "", false, field.ErrorList{field.NotSupported(p.Child("predicate"), fmt.Sprintf("%T", predicate), []string{"all", "hostname", "ip_block"})} } + cidrPath := p.Child("ip_block", "cidr") + cidr := match.GetIpBlock().GetCidr() + prefix, err := netip.ParsePrefix(cidr) + if err != nil || prefix.Masked().String() != cidr { + return "", false, field.ErrorList{field.Invalid(cidrPath, cidr, "must be a canonical IPv4 or IPv6 prefix")} + } + return "ip:" + cidr, false, nil } func validateHostnameMatch(match *ateapipb.HostnameMatch, p *field.Path) (string, bool, field.ErrorList) { diff --git a/cmd/ateapi/internal/controlapi/egress_policy_test.go b/cmd/ateapi/internal/controlapi/egress_policy_test.go index 5939d293a8..15c85e9d26 100644 --- a/cmd/ateapi/internal/controlapi/egress_policy_test.go +++ b/cmd/ateapi/internal/controlapi/egress_policy_test.go @@ -22,16 +22,17 @@ import ( "google.golang.org/grpc/codes" "google.golang.org/grpc/status" "google.golang.org/protobuf/proto" + "google.golang.org/protobuf/types/known/emptypb" ) func TestValidateEgressPolicy(t *testing.T) { valid := &ateapipb.EgressPolicy{Rules: []*ateapipb.EgressRule{{ - Allow: []*ateapipb.EgressMatch{{Predicate: &ateapipb.EgressMatch_Hostname{Hostname: &ateapipb.HostnameMatch{Pattern: "api.example.com"}}}}, + Allow: []*ateapipb.EgressMatch{{Hostname: &ateapipb.HostnameMatch{Pattern: "api.example.com"}}}, Effects: &ateapipb.EgressRuleEffects{InjectStaticHeader: []*ateapipb.StaticHeaderInjection{{ Header: "Authorization", Prefix: "Bearer ", CredentialUri: "substrate-secret://kubernetes.io/provider/ns/name", }}}, }}} - if errs := validateEgressPolicy(valid, false); len(errs) != 0 { + if errs := validateEgressPolicy(t.Context(), valid, false); len(errs) != 0 { t.Fatalf("valid policy rejected: %v", errs) } @@ -40,9 +41,10 @@ func TestValidateEgressPolicy(t *testing.T) { mutate func(*ateapipb.EgressPolicy) }{ {name: "empty allow", mutate: func(p *ateapipb.EgressPolicy) { p.Rules[0].Allow = nil }}, + {name: "multiple predicates", mutate: func(p *ateapipb.EgressPolicy) { p.Rules[0].Allow[0].All = &emptypb.Empty{} }}, {name: "wildcard credential effect", mutate: func(p *ateapipb.EgressPolicy) { p.Rules[0].Allow[0].GetHostname().Pattern = "*.example.com" }}, {name: "noncanonical CIDR", mutate: func(p *ateapipb.EgressPolicy) { - p.Rules[0].Allow[0].Predicate = &ateapipb.EgressMatch_IpBlock{IpBlock: &ateapipb.IPBlockMatch{Cidr: "192.0.2.1/24"}} + p.Rules[0].Allow[0] = &ateapipb.EgressMatch{IpBlock: &ateapipb.IPBlockMatch{Cidr: "192.0.2.1/24"}} }}, {name: "invalid credential URI", mutate: func(p *ateapipb.EgressPolicy) { p.Rules[0].Effects.InjectStaticHeader[0].CredentialUri = "https://example.com/secret" @@ -55,14 +57,14 @@ func TestValidateEgressPolicy(t *testing.T) { t.Run(tc.name, func(t *testing.T) { policy := proto.Clone(valid).(*ateapipb.EgressPolicy) tc.mutate(policy) - if errs := validateEgressPolicy(policy, false); len(errs) == 0 { + if errs := validateEgressPolicy(t.Context(), policy, false); len(errs) == 0 { t.Fatal("invalid policy accepted") } }) } update := proto.Clone(valid).(*ateapipb.EgressPolicy) - if errs := validateEgressPolicy(update, true); len(errs) == 0 { + if errs := validateEgressPolicy(t.Context(), update, true); len(errs) == 0 { t.Fatal("update without version accepted") } } @@ -95,7 +97,7 @@ func TestActorEgressPolicy(t *testing.T) { created, err := service.CreateActorEgressPolicy(t.Context(), &ateapipb.CreateActorEgressPolicyRequest{ Actor: actorRef, EgressPolicy: &ateapipb.EgressPolicy{Rules: []*ateapipb.EgressRule{{ - Allow: []*ateapipb.EgressMatch{{Predicate: &ateapipb.EgressMatch_Hostname{Hostname: &ateapipb.HostnameMatch{Pattern: "API.EXAMPLE.COM."}}}}, + Allow: []*ateapipb.EgressMatch{{Hostname: &ateapipb.HostnameMatch{Pattern: "API.EXAMPLE.COM."}}}, Effects: &ateapipb.EgressRuleEffects{InjectStaticHeader: []*ateapipb.StaticHeaderInjection{{ Header: "Authorization", Prefix: "Bearer ", CredentialUri: "substrate-secret://kubernetes.io/provider/ns/name", }}}, @@ -112,7 +114,7 @@ func TestActorEgressPolicy(t *testing.T) { if created.GetRules()[0].GetAllow()[0].GetHostname().GetPattern() != "api.example.com" || created.GetRules()[0].GetEffects().GetInjectStaticHeader()[0].GetHeader() != "authorization" { t.Fatalf("policy was not normalized: %v", created) } - if md := created.GetMetadata(); md.GetName() != "" || md.GetAtespace() != "" || md.GetUid() == "" || md.GetVersion() != 1 || md.GetCreateTime() == nil || md.GetUpdateTime() == nil { + if md := created.GetMetadata(); md.GetName() != "default" || md.GetAtespace() != "" || md.GetUid() == "" || md.GetVersion() != 1 || md.GetCreateTime() == nil || md.GetUpdateTime() == nil { t.Fatalf("created metadata = %v", md) } listed, err = service.GetActorEgressPolicy(t.Context(), &ateapipb.GetActorEgressPolicyRequest{Actor: actorRef}) diff --git a/cmd/ateapi/internal/controlapi/zz_generated.validation.go b/cmd/ateapi/internal/controlapi/zz_generated.validation.go index 0709edac33..5621ab0bdd 100644 --- a/cmd/ateapi/internal/controlapi/zz_generated.validation.go +++ b/cmd/ateapi/internal/controlapi/zz_generated.validation.go @@ -23,6 +23,7 @@ import ( context "context" ateapipb "github.com/agent-substrate/substrate/pkg/proto/ateapipb" + emptypb "google.golang.org/protobuf/types/known/emptypb" timestamppb "google.golang.org/protobuf/types/known/timestamppb" operation "k8s.io/apimachinery/pkg/api/operation" safe "k8s.io/apimachinery/pkg/api/safe" @@ -711,6 +712,123 @@ func Validate_DeleteAtespaceRequest( return errs } +var unionMembershipFor_github_com_agent_substrate_substrate_pkg_proto_ateapipb_EgressMatch_ = validate.NewUnionMembership(validate.NewUnionMember("all"), validate.NewUnionMember("hostname"), validate.NewUnionMember("ip_block")) + +// Validate_EgressMatch validates an instance of EgressMatch according +// to declarative validation rules in the API schema. +func Validate_EgressMatch( + ctx context.Context, op operation.Operation, fldPath *field.Path, + obj, oldObj *ateapipb.EgressMatch) (errs field.ErrorList) { + + if e := validate.Union(ctx, op, fldPath, obj, oldObj, unionMembershipFor_github_com_agent_substrate_substrate_pkg_proto_ateapipb_EgressMatch_, + func(obj *ateapipb.EgressMatch) bool { + if obj == nil { + return false + } + return obj.All != nil + }, + func(obj *ateapipb.EgressMatch) bool { + if obj == nil { + return false + } + return obj.Hostname != nil + }, + func(obj *ateapipb.EgressMatch) bool { + if obj == nil { + return false + } + return obj.IpBlock != nil + }); len(e) != 0 { + errs = append(errs, e...) + } + + { // field ateapipb.EgressMatch.All + fn := func( + fldPath *field.Path, + obj, oldObj *emptypb.Empty, + oldValueCorrelated bool) (errs field.ErrorList) { + // don't revalidate unchanged data + if oldValueCorrelated && op.Type == operation.Update { + if ateDeepEqual(obj, oldObj) { + return nil + } + } + // call field-attached validations + earlyReturn := false + if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 { + earlyReturn = true + } + if earlyReturn { + return // do not proceed + } + return + } + oldVal := safe.Field(oldObj, + func(oldObj *ateapipb.EgressMatch) *emptypb.Empty { + return oldObj.All + }) + errs = append(errs, fn(fldPath.Child("all"), obj.All, oldVal, oldObj != nil)...) + } + + { // field ateapipb.EgressMatch.Hostname + fn := func( + fldPath *field.Path, + obj, oldObj *ateapipb.HostnameMatch, + oldValueCorrelated bool) (errs field.ErrorList) { + // don't revalidate unchanged data + if oldValueCorrelated && op.Type == operation.Update { + if ateDeepEqual(obj, oldObj) { + return nil + } + } + // call field-attached validations + earlyReturn := false + if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 { + earlyReturn = true + } + if earlyReturn { + return // do not proceed + } + return + } + oldVal := safe.Field(oldObj, + func(oldObj *ateapipb.EgressMatch) *ateapipb.HostnameMatch { + return oldObj.Hostname + }) + errs = append(errs, fn(fldPath.Child("hostname"), obj.Hostname, oldVal, oldObj != nil)...) + } + + { // field ateapipb.EgressMatch.IpBlock + fn := func( + fldPath *field.Path, + obj, oldObj *ateapipb.IPBlockMatch, + oldValueCorrelated bool) (errs field.ErrorList) { + // don't revalidate unchanged data + if oldValueCorrelated && op.Type == operation.Update { + if ateDeepEqual(obj, oldObj) { + return nil + } + } + // call field-attached validations + earlyReturn := false + if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 { + earlyReturn = true + } + if earlyReturn { + return // do not proceed + } + return + } + oldVal := safe.Field(oldObj, + func(oldObj *ateapipb.EgressMatch) *ateapipb.IPBlockMatch { + return oldObj.IpBlock + }) + errs = append(errs, fn(fldPath.Child("ip_block"), obj.IpBlock, oldVal, oldObj != nil)...) + } + + return errs +} + // Validate_EgressPolicy validates an instance of EgressPolicy according // to declarative validation rules in the API schema. func Validate_EgressPolicy( @@ -746,7 +864,89 @@ func Validate_EgressPolicy( errs = append(errs, fn(fldPath.Child("metadata"), obj.Metadata, oldVal, oldObj != nil)...) } - // field ateapipb.EgressPolicy.Rules has no validation + { // field ateapipb.EgressPolicy.Rules + fn := func( + fldPath *field.Path, + obj, oldObj []*ateapipb.EgressRule, + oldValueCorrelated bool) (errs field.ErrorList) { + // don't revalidate unchanged data + if oldValueCorrelated && op.Type == operation.Update { + if ateDeepEqual(obj, oldObj) { + return nil + } + } + // call field-attached validations + earlyReturn := false + if e := validate.PtrSliceNoNils[ateapipb.EgressRule](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 { + errs = append(errs, e...) + earlyReturn = true + } + if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 { + earlyReturn = true + } + if earlyReturn { + return // do not proceed + } + // iterate the list and call the type's validation function + if e := validate.EachPtrSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_EgressRule); len(e) != 0 { + errs = append(errs, e...) + } + return + } + oldVal := safe.Field(oldObj, + func(oldObj *ateapipb.EgressPolicy) []*ateapipb.EgressRule { + return oldObj.Rules + }) + errs = append(errs, fn(fldPath.Child("rules"), obj.Rules, oldVal, oldObj != nil)...) + } + + return errs +} + +// Validate_EgressRule validates an instance of EgressRule according +// to declarative validation rules in the API schema. +func Validate_EgressRule( + ctx context.Context, op operation.Operation, fldPath *field.Path, + obj, oldObj *ateapipb.EgressRule) (errs field.ErrorList) { + + { // field ateapipb.EgressRule.Allow + fn := func( + fldPath *field.Path, + obj, oldObj []*ateapipb.EgressMatch, + oldValueCorrelated bool) (errs field.ErrorList) { + // don't revalidate unchanged data + if oldValueCorrelated && op.Type == operation.Update { + if ateDeepEqual(obj, oldObj) { + return nil + } + } + // call field-attached validations + earlyReturn := false + if e := validate.PtrSliceNoNils[ateapipb.EgressMatch](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 { + errs = append(errs, e...) + earlyReturn = true + } + if e := validate.RequiredSlice(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 { + errs = append(errs, e...) + earlyReturn = true + } + if earlyReturn { + return // do not proceed + } + // iterate the list and call the type's validation function + if e := validate.EachPtrSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_EgressMatch); len(e) != 0 { + errs = append(errs, e...) + } + return + } + oldVal := safe.Field(oldObj, + func(oldObj *ateapipb.EgressRule) []*ateapipb.EgressMatch { + return oldObj.Allow + }) + errs = append(errs, fn(fldPath.Child("allow"), obj.Allow, oldVal, oldObj != nil)...) + } + + // field ateapipb.EgressRule.Effects has no validation return errs } diff --git a/cmd/ateapi/internal/store/atepg/atepg.go b/cmd/ateapi/internal/store/atepg/atepg.go index 2db07c42de..3e737d77e4 100644 --- a/cmd/ateapi/internal/store/atepg/atepg.go +++ b/cmd/ateapi/internal/store/atepg/atepg.go @@ -840,7 +840,7 @@ func (p *Persistence) listActorsGlobal(ctx context.Context, pageSize int32, page func (p *Persistence) CreateEgressPolicy(ctx context.Context, actorRef resources.ActorRef, policy *ateapipb.EgressPolicy) (*ateapipb.EgressPolicy, error) { dbPolicy := proto.Clone(policy).(*ateapipb.EgressPolicy) - dbPolicy.Metadata = newCreateMetadata("", "") + dbPolicy.Metadata = newCreateMetadata("", "default") protoBytes, err := proto.Marshal(dbPolicy) if err != nil { return nil, fmt.Errorf("marshaling egress policy: %w", err) diff --git a/cmd/ateapi/internal/store/storecontract/contract.go b/cmd/ateapi/internal/store/storecontract/contract.go index 81fdfcdecf..4ae9f17cbb 100644 --- a/cmd/ateapi/internal/store/storecontract/contract.go +++ b/cmd/ateapi/internal/store/storecontract/contract.go @@ -161,14 +161,14 @@ func runEgressPolicyContractTests(t *testing.T, setup func(t *testing.T) store.I } actorRef := resources.ActorRefFromActor(actor) policy := &ateapipb.EgressPolicy{Rules: []*ateapipb.EgressRule{{Allow: []*ateapipb.EgressMatch{{ - Predicate: &ateapipb.EgressMatch_Hostname{Hostname: &ateapipb.HostnameMatch{Pattern: "api.example.com"}}, + Hostname: &ateapipb.HostnameMatch{Pattern: "api.example.com"}, }}}}} created, err := s.CreateEgressPolicy(ctx, actorRef, policy) if err != nil { t.Fatalf("CreateEgressPolicy failed: %v", err) } - if md := created.GetMetadata(); md.GetName() != "" || md.GetAtespace() != "" || md.GetUid() == "" || md.GetVersion() != 1 || md.GetCreateTime() == nil || md.GetUpdateTime() == nil { + if md := created.GetMetadata(); md.GetName() != "default" || md.GetAtespace() != "" || md.GetUid() == "" || md.GetVersion() != 1 || md.GetCreateTime() == nil || md.GetUpdateTime() == nil { t.Fatalf("created metadata = %v", md) } if policy.GetMetadata() != nil { @@ -191,7 +191,7 @@ func runEgressPolicyContractTests(t *testing.T, setup func(t *testing.T) store.I t.Fatalf("wrong UID update error = %v, want ErrUIDConflict", err) } updated, err := s.UpdateEgressPolicy(ctx, actorRef, store.PreconditionFrom(created), func(policy *ateapipb.EgressPolicy) error { - policy.Rules = []*ateapipb.EgressRule{{Allow: []*ateapipb.EgressMatch{{Predicate: &ateapipb.EgressMatch_All{All: &emptypb.Empty{}}}}}} + policy.Rules = []*ateapipb.EgressRule{{Allow: []*ateapipb.EgressMatch{{All: &emptypb.Empty{}}}}} return nil }) if err != nil || updated.GetMetadata().GetVersion() != 2 || updated.GetMetadata().GetUid() != created.GetMetadata().GetUid() { diff --git a/pkg/proto/ateapipb/ateapi.pb.go b/pkg/proto/ateapipb/ateapi.pb.go index 5e5261d645..910767b031 100644 --- a/pkg/proto/ateapipb/ateapi.pb.go +++ b/pkg/proto/ateapipb/ateapi.pb.go @@ -983,12 +983,13 @@ func (x *Actor) GetStatus() *ActorStatus { // EgressPolicy is a policy document nested under an Actor. All documents for // an Actor comprise one logical policy and have the same evaluation semantics -// as one document containing their combined rules. V0 permits one implicitly -// named document per Actor. +// as one document containing their combined rules. V0 permits one document +// named "default" per Actor. type EgressPolicy struct { state protoimpl.MessageState `protogen:"open.v1"` - // Standard resource metadata. Atespace and name are always empty. UID, - // version, create_time, and update_time are server-managed. + // Standard resource metadata. Atespace is always empty. In v0, name is + // always "default". UID, version, create_time, and update_time are + // server-managed. // // +k8s:required // +k8s:opaqueType @@ -996,6 +997,8 @@ type EgressPolicy struct { // A request is authorized when at least one rule matches. Effects from all // matching rules are then applied once per rule. Rule order has no meaning. // An empty rule list denies all traffic. + // + // +k8s:optional Rules []*EgressRule `protobuf:"bytes,2,rep,name=rules,proto3" json:"rules,omitempty"` unknownFields protoimpl.UnknownFields sizeCache protoimpl.SizeCache @@ -1048,6 +1051,8 @@ func (x *EgressPolicy) GetRules() []*EgressRule { type EgressRule struct { state protoimpl.MessageState `protogen:"open.v1"` // Entries are ORed. The rule matches when any entry matches. + // + // +k8s:required Allow []*EgressMatch `protobuf:"bytes,1,rep,name=allow,proto3" json:"allow,omitempty"` // Effects do not authorize traffic. They are applied only after at least one // rule authorizes the request. @@ -1102,12 +1107,18 @@ func (x *EgressRule) GetEffects() *EgressRuleEffects { type EgressMatch struct { state protoimpl.MessageState `protogen:"open.v1"` - // Types that are valid to be assigned to Predicate: + // Exactly one predicate must be set. // - // *EgressMatch_All - // *EgressMatch_Hostname - // *EgressMatch_IpBlock - Predicate isEgressMatch_Predicate `protobuf_oneof:"predicate"` + // +k8s:optional + // +k8s:unionMember + // +k8s:opaqueType + All *emptypb.Empty `protobuf:"bytes,1,opt,name=all,proto3" json:"all,omitempty"` + // +k8s:optional + // +k8s:unionMember + Hostname *HostnameMatch `protobuf:"bytes,2,opt,name=hostname,proto3" json:"hostname,omitempty"` + // +k8s:optional + // +k8s:unionMember + IpBlock *IPBlockMatch `protobuf:"bytes,3,opt,name=ip_block,json=ipBlock,proto3" json:"ip_block,omitempty"` unknownFields protoimpl.UnknownFields sizeCache protoimpl.SizeCache } @@ -1142,62 +1153,27 @@ func (*EgressMatch) Descriptor() ([]byte, []int) { return file_ateapi_proto_rawDescGZIP(), []int{7} } -func (x *EgressMatch) GetPredicate() isEgressMatch_Predicate { - if x != nil { - return x.Predicate - } - return nil -} - func (x *EgressMatch) GetAll() *emptypb.Empty { if x != nil { - if x, ok := x.Predicate.(*EgressMatch_All); ok { - return x.All - } + return x.All } return nil } func (x *EgressMatch) GetHostname() *HostnameMatch { if x != nil { - if x, ok := x.Predicate.(*EgressMatch_Hostname); ok { - return x.Hostname - } + return x.Hostname } return nil } func (x *EgressMatch) GetIpBlock() *IPBlockMatch { if x != nil { - if x, ok := x.Predicate.(*EgressMatch_IpBlock); ok { - return x.IpBlock - } + return x.IpBlock } return nil } -type isEgressMatch_Predicate interface { - isEgressMatch_Predicate() -} - -type EgressMatch_All struct { - All *emptypb.Empty `protobuf:"bytes,1,opt,name=all,proto3,oneof"` -} - -type EgressMatch_Hostname struct { - Hostname *HostnameMatch `protobuf:"bytes,2,opt,name=hostname,proto3,oneof"` -} - -type EgressMatch_IpBlock struct { - IpBlock *IPBlockMatch `protobuf:"bytes,3,opt,name=ip_block,json=ipBlock,proto3,oneof"` -} - -func (*EgressMatch_All) isEgressMatch_Predicate() {} - -func (*EgressMatch_Hostname) isEgressMatch_Predicate() {} - -func (*EgressMatch_IpBlock) isEgressMatch_Predicate() {} - type HostnameMatch struct { state protoimpl.MessageState `protogen:"open.v1"` // An ASCII DNS name, or a wildcard in the complete leftmost label. @@ -4437,7 +4413,8 @@ func (x *GetActorEgressPolicyResponse) GetEgressPolicies() []*EgressPolicy { type CreateActorEgressPolicyRequest struct { state protoimpl.MessageState `protogen:"open.v1"` - // Parent Actor. V0 assigns the policy document's identity implicitly. + // Parent Actor. V0 creates the policy document named "default" under this + // Actor, so no policy name is supplied. // // +k8s:required // +k8s:opaqueType @@ -4497,7 +4474,8 @@ func (x *CreateActorEgressPolicyRequest) GetEgressPolicy() *EgressPolicy { type UpdateActorEgressPolicyRequest struct { state protoimpl.MessageState `protogen:"open.v1"` - // Parent Actor. V0 assigns the policy document's identity implicitly. + // Parent Actor. V0 updates the policy document named "default" under this + // Actor, so no policy name is supplied. // // +k8s:required // +k8s:opaqueType @@ -6245,12 +6223,11 @@ const file_ateapi_proto_rawDesc = "" + "\n" + "EgressRule\x12)\n" + "\x05allow\x18\x01 \x03(\v2\x13.ateapi.EgressMatchR\x05allow\x123\n" + - "\aeffects\x18\x02 \x01(\v2\x19.ateapi.EgressRuleEffectsR\aeffects\"\xae\x01\n" + - "\vEgressMatch\x12*\n" + - "\x03all\x18\x01 \x01(\v2\x16.google.protobuf.EmptyH\x00R\x03all\x123\n" + - "\bhostname\x18\x02 \x01(\v2\x15.ateapi.HostnameMatchH\x00R\bhostname\x121\n" + - "\bip_block\x18\x03 \x01(\v2\x14.ateapi.IPBlockMatchH\x00R\aipBlockB\v\n" + - "\tpredicate\")\n" + + "\aeffects\x18\x02 \x01(\v2\x19.ateapi.EgressRuleEffectsR\aeffects\"\x9b\x01\n" + + "\vEgressMatch\x12(\n" + + "\x03all\x18\x01 \x01(\v2\x16.google.protobuf.EmptyR\x03all\x121\n" + + "\bhostname\x18\x02 \x01(\v2\x15.ateapi.HostnameMatchR\bhostname\x12/\n" + + "\bip_block\x18\x03 \x01(\v2\x14.ateapi.IPBlockMatchR\aipBlock\")\n" + "\rHostnameMatch\x12\x18\n" + "\apattern\x18\x01 \x01(\tR\apattern\"\"\n" + "\fIPBlockMatch\x12\x12\n" + @@ -6962,11 +6939,6 @@ func file_ateapi_proto_init() { if File_ateapi_proto != nil { return } - file_ateapi_proto_msgTypes[7].OneofWrappers = []any{ - (*EgressMatch_All)(nil), - (*EgressMatch_Hostname)(nil), - (*EgressMatch_IpBlock)(nil), - } type x struct{} out := protoimpl.TypeBuilder{ File: protoimpl.DescBuilder{ diff --git a/pkg/proto/ateapipb/ateapi.proto b/pkg/proto/ateapipb/ateapi.proto index f3addfe242..9857c11ddf 100644 --- a/pkg/proto/ateapipb/ateapi.proto +++ b/pkg/proto/ateapipb/ateapi.proto @@ -306,11 +306,12 @@ message Actor { // EgressPolicy is a policy document nested under an Actor. All documents for // an Actor comprise one logical policy and have the same evaluation semantics -// as one document containing their combined rules. V0 permits one implicitly -// named document per Actor. +// as one document containing their combined rules. V0 permits one document +// named "default" per Actor. message EgressPolicy { - // Standard resource metadata. Atespace and name are always empty. UID, - // version, create_time, and update_time are server-managed. + // Standard resource metadata. Atespace is always empty. In v0, name is + // always "default". UID, version, create_time, and update_time are + // server-managed. // // +k8s:required // +k8s:opaqueType @@ -319,11 +320,15 @@ message EgressPolicy { // A request is authorized when at least one rule matches. Effects from all // matching rules are then applied once per rule. Rule order has no meaning. // An empty rule list denies all traffic. + // + // +k8s:optional repeated EgressRule rules = 2; } message EgressRule { // Entries are ORed. The rule matches when any entry matches. + // + // +k8s:required repeated EgressMatch allow = 1; // Effects do not authorize traffic. They are applied only after at least one @@ -332,11 +337,20 @@ message EgressRule { } message EgressMatch { - oneof predicate { - google.protobuf.Empty all = 1; - HostnameMatch hostname = 2; - IPBlockMatch ip_block = 3; - } + // Exactly one predicate must be set. + // + // +k8s:optional + // +k8s:unionMember + // +k8s:opaqueType + google.protobuf.Empty all = 1; + + // +k8s:optional + // +k8s:unionMember + HostnameMatch hostname = 2; + + // +k8s:optional + // +k8s:unionMember + IPBlockMatch ip_block = 3; } message HostnameMatch { @@ -996,7 +1010,8 @@ message GetActorEgressPolicyResponse { } message CreateActorEgressPolicyRequest { - // Parent Actor. V0 assigns the policy document's identity implicitly. + // Parent Actor. V0 creates the policy document named "default" under this + // Actor, so no policy name is supplied. // // +k8s:required // +k8s:opaqueType @@ -1010,7 +1025,8 @@ message CreateActorEgressPolicyRequest { } message UpdateActorEgressPolicyRequest { - // Parent Actor. V0 assigns the policy document's identity implicitly. + // Parent Actor. V0 updates the policy document named "default" under this + // Actor, so no policy name is supplied. // // +k8s:required // +k8s:opaqueType From 78ebac2de2847d686bf625f91eab17763256e5b1 Mon Sep 17 00:00:00 2001 From: Eitan Yarmush Date: Wed, 26 Aug 2026 18:53:50 +0000 Subject: [PATCH 7/9] Inherit egress policy atespace from actor Signed-off-by: Eitan Yarmush --- .../internal/controlapi/egress_policy.go | 19 +++++++++++-------- .../internal/controlapi/egress_policy_test.go | 14 ++++++++++---- cmd/ateapi/internal/store/atepg/atepg.go | 2 +- .../internal/store/storecontract/contract.go | 6 ++++-- pkg/proto/ateapipb/ateapi.pb.go | 9 +++++---- pkg/proto/ateapipb/ateapi.proto | 9 +++++---- 6 files changed, 36 insertions(+), 23 deletions(-) diff --git a/cmd/ateapi/internal/controlapi/egress_policy.go b/cmd/ateapi/internal/controlapi/egress_policy.go index 478220476d..cff670e7ff 100644 --- a/cmd/ateapi/internal/controlapi/egress_policy.go +++ b/cmd/ateapi/internal/controlapi/egress_policy.go @@ -56,7 +56,7 @@ func (s *RPCService) CreateActorEgressPolicy(ctx context.Context, req *ateapipb. var errs field.ErrorList errs = append(errs, validateActorRef(req.GetActor(), field.NewPath("actor"))...) policy := req.GetEgressPolicy() - errs = append(errs, validateEgressPolicy(ctx, policy, false)...) + errs = append(errs, validateEgressPolicy(ctx, policy, "", false)...) if len(errs) > 0 { return nil, toGRPCStatusError(errs) } @@ -70,7 +70,7 @@ func (s *RPCService) UpdateActorEgressPolicy(ctx context.Context, req *ateapipb. var errs field.ErrorList errs = append(errs, validateActorRef(req.GetActor(), field.NewPath("actor"))...) policy := req.GetEgressPolicy() - errs = append(errs, validateEgressPolicy(ctx, policy, true)...) + errs = append(errs, validateEgressPolicy(ctx, policy, req.GetActor().GetAtespace(), true)...) if len(errs) > 0 { return nil, toGRPCStatusError(errs) } @@ -114,13 +114,13 @@ func validateActorRef(ref *ateapipb.ObjectRef, p *field.Path) field.ErrorList { return resources.ValidateObjectRef(ref, p) } -func validateEgressPolicy(ctx context.Context, policy *ateapipb.EgressPolicy, requireVersion bool) field.ErrorList { +func validateEgressPolicy(ctx context.Context, policy *ateapipb.EgressPolicy, actorAtespace string, requireVersion bool) field.ErrorList { root := field.NewPath("egress_policy") if policy == nil { return field.ErrorList{field.Required(root, "")} } var errs field.ErrorList - errs = append(errs, validateEgressPolicyMetadata(policy.GetMetadata(), requireVersion, root.Child("metadata"))...) + errs = append(errs, validateEgressPolicyMetadata(policy.GetMetadata(), actorAtespace, requireVersion, root.Child("metadata"))...) seenHeaders := map[string]bool{} for i, rule := range policy.GetRules() { rulePath := root.Child("rules").Index(i) @@ -164,12 +164,12 @@ func validateEgressPolicy(ctx context.Context, policy *ateapipb.EgressPolicy, re return errs } -func validateEgressPolicyMetadata(metadata *ateapipb.ResourceMetadata, update bool, p *field.Path) field.ErrorList { +func validateEgressPolicyMetadata(metadata *ateapipb.ResourceMetadata, actorAtespace string, update bool, p *field.Path) field.ErrorList { var errs field.ErrorList - if metadata.GetAtespace() != "" { - errs = append(errs, field.Invalid(p.Child("atespace"), metadata.GetAtespace(), "must be empty")) - } if !update { + if metadata.GetAtespace() != "" { + errs = append(errs, field.Invalid(p.Child("atespace"), metadata.GetAtespace(), "must be empty when creating")) + } if metadata.GetName() != "" { errs = append(errs, field.Invalid(p.Child("name"), metadata.GetName(), "must be empty when creating")) } @@ -181,6 +181,9 @@ func validateEgressPolicyMetadata(metadata *ateapipb.ResourceMetadata, update bo } return errs } + if metadata.GetAtespace() != actorAtespace { + errs = append(errs, field.Invalid(p.Child("atespace"), metadata.GetAtespace(), "must match the parent Actor")) + } if metadata.GetName() != "default" { errs = append(errs, field.Invalid(p.Child("name"), metadata.GetName(), `must be "default"`)) } diff --git a/cmd/ateapi/internal/controlapi/egress_policy_test.go b/cmd/ateapi/internal/controlapi/egress_policy_test.go index 15c85e9d26..474502d2e6 100644 --- a/cmd/ateapi/internal/controlapi/egress_policy_test.go +++ b/cmd/ateapi/internal/controlapi/egress_policy_test.go @@ -32,7 +32,7 @@ func TestValidateEgressPolicy(t *testing.T) { Header: "Authorization", Prefix: "Bearer ", CredentialUri: "substrate-secret://kubernetes.io/provider/ns/name", }}}, }}} - if errs := validateEgressPolicy(t.Context(), valid, false); len(errs) != 0 { + if errs := validateEgressPolicy(t.Context(), valid, "", false); len(errs) != 0 { t.Fatalf("valid policy rejected: %v", errs) } @@ -57,14 +57,14 @@ func TestValidateEgressPolicy(t *testing.T) { t.Run(tc.name, func(t *testing.T) { policy := proto.Clone(valid).(*ateapipb.EgressPolicy) tc.mutate(policy) - if errs := validateEgressPolicy(t.Context(), policy, false); len(errs) == 0 { + if errs := validateEgressPolicy(t.Context(), policy, "", false); len(errs) == 0 { t.Fatal("invalid policy accepted") } }) } update := proto.Clone(valid).(*ateapipb.EgressPolicy) - if errs := validateEgressPolicy(t.Context(), update, true); len(errs) == 0 { + if errs := validateEgressPolicy(t.Context(), update, testAtespace, true); len(errs) == 0 { t.Fatal("update without version accepted") } } @@ -114,7 +114,7 @@ func TestActorEgressPolicy(t *testing.T) { if created.GetRules()[0].GetAllow()[0].GetHostname().GetPattern() != "api.example.com" || created.GetRules()[0].GetEffects().GetInjectStaticHeader()[0].GetHeader() != "authorization" { t.Fatalf("policy was not normalized: %v", created) } - if md := created.GetMetadata(); md.GetName() != "default" || md.GetAtespace() != "" || md.GetUid() == "" || md.GetVersion() != 1 || md.GetCreateTime() == nil || md.GetUpdateTime() == nil { + if md := created.GetMetadata(); md.GetName() != "default" || md.GetAtespace() != testAtespace || md.GetUid() == "" || md.GetVersion() != 1 || md.GetCreateTime() == nil || md.GetUpdateTime() == nil { t.Fatalf("created metadata = %v", md) } listed, err = service.GetActorEgressPolicy(t.Context(), &ateapipb.GetActorEgressPolicyRequest{Actor: actorRef}) @@ -123,6 +123,12 @@ func TestActorEgressPolicy(t *testing.T) { } replacement := proto.Clone(created).(*ateapipb.EgressPolicy) replacement.Rules = nil + changedIdentity := proto.Clone(replacement).(*ateapipb.EgressPolicy) + changedIdentity.Metadata.Atespace = "other" + changedIdentity.Metadata.Name = "other" + if _, err := service.UpdateActorEgressPolicy(t.Context(), &ateapipb.UpdateActorEgressPolicyRequest{Actor: actorRef, EgressPolicy: changedIdentity}); status.Code(err) != codes.InvalidArgument { + t.Fatalf("changed identity status = %v, want InvalidArgument", status.Code(err)) + } updated, err := service.UpdateActorEgressPolicy(t.Context(), &ateapipb.UpdateActorEgressPolicyRequest{Actor: actorRef, EgressPolicy: replacement}) if err != nil || updated.GetMetadata().GetVersion() != 2 || len(updated.GetRules()) != 0 { t.Fatalf("replacement = %v, %v; want empty version 2", updated, err) diff --git a/cmd/ateapi/internal/store/atepg/atepg.go b/cmd/ateapi/internal/store/atepg/atepg.go index 3e737d77e4..35b6904bb2 100644 --- a/cmd/ateapi/internal/store/atepg/atepg.go +++ b/cmd/ateapi/internal/store/atepg/atepg.go @@ -840,7 +840,7 @@ func (p *Persistence) listActorsGlobal(ctx context.Context, pageSize int32, page func (p *Persistence) CreateEgressPolicy(ctx context.Context, actorRef resources.ActorRef, policy *ateapipb.EgressPolicy) (*ateapipb.EgressPolicy, error) { dbPolicy := proto.Clone(policy).(*ateapipb.EgressPolicy) - dbPolicy.Metadata = newCreateMetadata("", "default") + dbPolicy.Metadata = newCreateMetadata(actorRef.Atespace, "default") protoBytes, err := proto.Marshal(dbPolicy) if err != nil { return nil, fmt.Errorf("marshaling egress policy: %w", err) diff --git a/cmd/ateapi/internal/store/storecontract/contract.go b/cmd/ateapi/internal/store/storecontract/contract.go index 4ae9f17cbb..31e8e26ed8 100644 --- a/cmd/ateapi/internal/store/storecontract/contract.go +++ b/cmd/ateapi/internal/store/storecontract/contract.go @@ -168,7 +168,7 @@ func runEgressPolicyContractTests(t *testing.T, setup func(t *testing.T) store.I if err != nil { t.Fatalf("CreateEgressPolicy failed: %v", err) } - if md := created.GetMetadata(); md.GetName() != "default" || md.GetAtespace() != "" || md.GetUid() == "" || md.GetVersion() != 1 || md.GetCreateTime() == nil || md.GetUpdateTime() == nil { + if md := created.GetMetadata(); md.GetName() != "default" || md.GetAtespace() != testAtespace || md.GetUid() == "" || md.GetVersion() != 1 || md.GetCreateTime() == nil || md.GetUpdateTime() == nil { t.Fatalf("created metadata = %v", md) } if policy.GetMetadata() != nil { @@ -191,10 +191,12 @@ func runEgressPolicyContractTests(t *testing.T, setup func(t *testing.T) store.I t.Fatalf("wrong UID update error = %v, want ErrUIDConflict", err) } updated, err := s.UpdateEgressPolicy(ctx, actorRef, store.PreconditionFrom(created), func(policy *ateapipb.EgressPolicy) error { + policy.Metadata.Atespace = "other" + policy.Metadata.Name = "other" policy.Rules = []*ateapipb.EgressRule{{Allow: []*ateapipb.EgressMatch{{All: &emptypb.Empty{}}}}} return nil }) - if err != nil || updated.GetMetadata().GetVersion() != 2 || updated.GetMetadata().GetUid() != created.GetMetadata().GetUid() { + if err != nil || updated.GetMetadata().GetAtespace() != testAtespace || updated.GetMetadata().GetName() != "default" || updated.GetMetadata().GetVersion() != 2 || updated.GetMetadata().GetUid() != created.GetMetadata().GetUid() { t.Fatalf("UpdateEgressPolicy = %v, %v; want version 2", updated, err) } deleted, err := s.DeleteEgressPolicy(ctx, actorRef) diff --git a/pkg/proto/ateapipb/ateapi.pb.go b/pkg/proto/ateapipb/ateapi.pb.go index 910767b031..9de086342f 100644 --- a/pkg/proto/ateapipb/ateapi.pb.go +++ b/pkg/proto/ateapipb/ateapi.pb.go @@ -987,9 +987,9 @@ func (x *Actor) GetStatus() *ActorStatus { // named "default" per Actor. type EgressPolicy struct { state protoimpl.MessageState `protogen:"open.v1"` - // Standard resource metadata. Atespace is always empty. In v0, name is - // always "default". UID, version, create_time, and update_time are - // server-managed. + // Standard resource metadata. Atespace is inherited from the parent Actor + // and, in v0, name is always "default". These identity fields, UID, version, + // create_time, and update_time are server-managed. // // +k8s:required // +k8s:opaqueType @@ -4480,7 +4480,8 @@ type UpdateActorEgressPolicyRequest struct { // +k8s:required // +k8s:opaqueType Actor *ObjectRef `protobuf:"bytes,1,opt,name=actor,proto3" json:"actor,omitempty"` - // Full replacement. Metadata UID and version are required preconditions. + // Full replacement. Metadata UID and version are required preconditions; + // atespace and name are immutable and must match the existing policy. // // +k8s:required // +k8s:opaqueType diff --git a/pkg/proto/ateapipb/ateapi.proto b/pkg/proto/ateapipb/ateapi.proto index 9857c11ddf..cbaeafdc64 100644 --- a/pkg/proto/ateapipb/ateapi.proto +++ b/pkg/proto/ateapipb/ateapi.proto @@ -309,9 +309,9 @@ message Actor { // as one document containing their combined rules. V0 permits one document // named "default" per Actor. message EgressPolicy { - // Standard resource metadata. Atespace is always empty. In v0, name is - // always "default". UID, version, create_time, and update_time are - // server-managed. + // Standard resource metadata. Atespace is inherited from the parent Actor + // and, in v0, name is always "default". These identity fields, UID, version, + // create_time, and update_time are server-managed. // // +k8s:required // +k8s:opaqueType @@ -1032,7 +1032,8 @@ message UpdateActorEgressPolicyRequest { // +k8s:opaqueType ObjectRef actor = 1; - // Full replacement. Metadata UID and version are required preconditions. + // Full replacement. Metadata UID and version are required preconditions; + // atespace and name are immutable and must match the existing policy. // // +k8s:required // +k8s:opaqueType From 53a295065849d381c4fe0e30faa6fe7a7e663d52 Mon Sep 17 00:00:00 2001 From: Eitan Yarmush Date: Wed, 26 Aug 2026 20:18:49 +0000 Subject: [PATCH 8/9] Address egress policy API feedback Signed-off-by: Eitan Yarmush --- .../internal/controlapi/egress_policy.go | 11 +- .../internal/controlapi/egress_policy_test.go | 11 +- pkg/proto/ateapipb/ateapi.pb.go | 619 +++++++++--------- pkg/proto/ateapipb/ateapi.proto | 65 +- pkg/proto/ateapipb/ateapi_grpc.pb.go | 28 +- 5 files changed, 355 insertions(+), 379 deletions(-) diff --git a/cmd/ateapi/internal/controlapi/egress_policy.go b/cmd/ateapi/internal/controlapi/egress_policy.go index cff670e7ff..9c25b5faed 100644 --- a/cmd/ateapi/internal/controlapi/egress_policy.go +++ b/cmd/ateapi/internal/controlapi/egress_policy.go @@ -33,23 +33,18 @@ import ( "k8s.io/apimachinery/pkg/util/validation/field" ) -func (s *RPCService) GetActorEgressPolicy(ctx context.Context, req *ateapipb.GetActorEgressPolicyRequest) (*ateapipb.GetActorEgressPolicyResponse, error) { +func (s *RPCService) GetActorEgressPolicy(ctx context.Context, req *ateapipb.GetActorEgressPolicyRequest) (*ateapipb.EgressPolicy, error) { if errs := validateActorRef(req.GetActor(), field.NewPath("actor")); len(errs) > 0 { return nil, toGRPCStatusError(errs) } policy, err := s.impl.GetEgressPolicy(ctx, resources.ActorRefFromObjectRef(req.GetActor())) if errors.Is(err, store.ErrNotFound) { - if _, actorErr := s.impl.GetActor(ctx, resources.ActorRefFromObjectRef(req.GetActor())); errors.Is(actorErr, store.ErrNotFound) { - return nil, status.Error(codes.NotFound, "Actor not found") - } else if actorErr != nil { - return nil, fmt.Errorf("while getting parent Actor: %w", actorErr) - } - return &ateapipb.GetActorEgressPolicyResponse{}, nil + return nil, status.Error(codes.NotFound, "EgressPolicy not found") } if err != nil { return nil, fmt.Errorf("while getting Actor egress policy: %w", err) } - return &ateapipb.GetActorEgressPolicyResponse{EgressPolicies: []*ateapipb.EgressPolicy{policy}}, nil + return policy, nil } func (s *RPCService) CreateActorEgressPolicy(ctx context.Context, req *ateapipb.CreateActorEgressPolicyRequest) (*ateapipb.EgressPolicy, error) { diff --git a/cmd/ateapi/internal/controlapi/egress_policy_test.go b/cmd/ateapi/internal/controlapi/egress_policy_test.go index 474502d2e6..fc0224d65b 100644 --- a/cmd/ateapi/internal/controlapi/egress_policy_test.go +++ b/cmd/ateapi/internal/controlapi/egress_policy_test.go @@ -85,9 +85,8 @@ func TestActorEgressPolicy(t *testing.T) { } actorRef := &ateapipb.ObjectRef{Atespace: testAtespace, Name: "egress-actor"} - listed, err := service.GetActorEgressPolicy(t.Context(), &ateapipb.GetActorEgressPolicyRequest{Actor: actorRef}) - if err != nil || len(listed.GetEgressPolicies()) != 0 { - t.Fatalf("policies before set = %v, %v; want empty", listed, err) + if _, err := service.GetActorEgressPolicy(t.Context(), &ateapipb.GetActorEgressPolicyRequest{Actor: actorRef}); status.Code(err) != codes.NotFound { + t.Fatalf("policy before create status = %v, want NotFound", status.Code(err)) } if _, err := service.GetActorEgressPolicy(t.Context(), &ateapipb.GetActorEgressPolicyRequest{ Actor: &ateapipb.ObjectRef{Atespace: testAtespace, Name: "missing-actor"}, @@ -117,9 +116,9 @@ func TestActorEgressPolicy(t *testing.T) { if md := created.GetMetadata(); md.GetName() != "default" || md.GetAtespace() != testAtespace || md.GetUid() == "" || md.GetVersion() != 1 || md.GetCreateTime() == nil || md.GetUpdateTime() == nil { t.Fatalf("created metadata = %v", md) } - listed, err = service.GetActorEgressPolicy(t.Context(), &ateapipb.GetActorEgressPolicyRequest{Actor: actorRef}) - if err != nil || len(listed.GetEgressPolicies()) != 1 || !proto.Equal(listed.GetEgressPolicies()[0], created) { - t.Fatalf("policies after set = %v, %v; want one document", listed, err) + got, err := service.GetActorEgressPolicy(t.Context(), &ateapipb.GetActorEgressPolicyRequest{Actor: actorRef}) + if err != nil || !proto.Equal(got, created) { + t.Fatalf("policy after create = %v, %v; want %v", got, err, created) } replacement := proto.Clone(created).(*ateapipb.EgressPolicy) replacement.Rules = nil diff --git a/pkg/proto/ateapipb/ateapi.pb.go b/pkg/proto/ateapipb/ateapi.pb.go index 9de086342f..513cbe1aef 100644 --- a/pkg/proto/ateapipb/ateapi.pb.go +++ b/pkg/proto/ateapipb/ateapi.pb.go @@ -981,15 +981,13 @@ func (x *Actor) GetStatus() *ActorStatus { return nil } -// EgressPolicy is a policy document nested under an Actor. All documents for -// an Actor comprise one logical policy and have the same evaluation semantics -// as one document containing their combined rules. V0 permits one document -// named "default" per Actor. +// EgressPolicy is an egress policy resource nested under an Actor. An Actor has +// at most one egress policy resource, named "default" by the server. type EgressPolicy struct { state protoimpl.MessageState `protogen:"open.v1"` // Standard resource metadata. Atespace is inherited from the parent Actor - // and, in v0, name is always "default". These identity fields, UID, version, - // create_time, and update_time are server-managed. + // and name is "default". These identity fields, UID, version, create_time, + // and update_time are server-managed. // // +k8s:required // +k8s:opaqueType @@ -1107,15 +1105,19 @@ func (x *EgressRule) GetEffects() *EgressRuleEffects { type EgressMatch struct { state protoimpl.MessageState `protogen:"open.v1"` - // Exactly one predicate must be set. + // Matches every destination. Exactly one predicate must be set. // // +k8s:optional // +k8s:unionMember // +k8s:opaqueType All *emptypb.Empty `protobuf:"bytes,1,opt,name=all,proto3" json:"all,omitempty"` + // Matches when the request hostname satisfies the configured pattern. + // // +k8s:optional // +k8s:unionMember Hostname *HostnameMatch `protobuf:"bytes,2,opt,name=hostname,proto3" json:"hostname,omitempty"` + // Matches when the original destination IP belongs to the configured block. + // // +k8s:optional // +k8s:unionMember IpBlock *IPBlockMatch `protobuf:"bytes,3,opt,name=ip_block,json=ipBlock,proto3" json:"ip_block,omitempty"` @@ -1283,14 +1285,16 @@ func (x *IPBlockMatch) GetCidr() string { return "" } +// EgressRuleEffects contains non-mutually-exclusive effects. No two effects in +// a policy may target the same case-insensitive header. type EgressRuleEffects struct { state protoimpl.MessageState `protogen:"open.v1"` - // These fields are not mutually exclusive. No two effects in a policy may - // target the same case-insensitive header. + // Injects values retrieved from credential providers into request headers. InjectStaticHeader []*StaticHeaderInjection `protobuf:"bytes,1,rep,name=inject_static_header,json=injectStaticHeader,proto3" json:"inject_static_header,omitempty"` - InjectActorJwt *ActorTokenInjection `protobuf:"bytes,2,opt,name=inject_actor_jwt,json=injectActorJwt,proto3" json:"inject_actor_jwt,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache + // Injects an Actor JWT, or its exchanged token, into a request header. + InjectActorJwt *ActorTokenInjection `protobuf:"bytes,2,opt,name=inject_actor_jwt,json=injectActorJwt,proto3" json:"inject_actor_jwt,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache } func (x *EgressRuleEffects) Reset() { @@ -1338,8 +1342,9 @@ func (x *EgressRuleEffects) GetInjectActorJwt() *ActorTokenInjection { } type StaticHeaderInjection struct { - state protoimpl.MessageState `protogen:"open.v1"` - Header string `protobuf:"bytes,1,opt,name=header,proto3" json:"header,omitempty"` + state protoimpl.MessageState `protogen:"open.v1"` + // The case-insensitive HTTP request header to inject. + Header string `protobuf:"bytes,1,opt,name=header,proto3" json:"header,omitempty"` // For example, "Bearer " for the Authorization header. Prefix string `protobuf:"bytes,2,opt,name=prefix,proto3" json:"prefix,omitempty"` // Source-agnostic reference interpreted by a registered credential provider: @@ -1401,9 +1406,11 @@ func (x *StaticHeaderInjection) GetCredentialUri() string { } type ActorTokenInjection struct { - state protoimpl.MessageState `protogen:"open.v1"` - Header string `protobuf:"bytes,1,opt,name=header,proto3" json:"header,omitempty"` - Audiences []string `protobuf:"bytes,2,rep,name=audiences,proto3" json:"audiences,omitempty"` + state protoimpl.MessageState `protogen:"open.v1"` + // The case-insensitive HTTP request header to inject. + Header string `protobuf:"bytes,1,opt,name=header,proto3" json:"header,omitempty"` + // Audiences included in the minted Actor JWT. + Audiences []string `protobuf:"bytes,2,rep,name=audiences,proto3" json:"audiences,omitempty"` // When present, exchanges the Actor JWT at an RFC 8693 endpoint and injects // the result. A returned expires_in value controls caching of the token. Rfc_8693Exchange *RFC8693ExchangeParameters `protobuf:"bytes,3,opt,name=rfc_8693_exchange,json=rfc8693Exchange,proto3" json:"rfc_8693_exchange,omitempty"` @@ -1463,12 +1470,17 @@ func (x *ActorTokenInjection) GetRfc_8693Exchange() *RFC8693ExchangeParameters { } type RFC8693ExchangeParameters struct { - state protoimpl.MessageState `protogen:"open.v1"` - Url string `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"` - Resources []string `protobuf:"bytes,2,rep,name=resources,proto3" json:"resources,omitempty"` - Audiences []string `protobuf:"bytes,3,rep,name=audiences,proto3" json:"audiences,omitempty"` - Scope string `protobuf:"bytes,4,opt,name=scope,proto3" json:"scope,omitempty"` - RequestedTokenType string `protobuf:"bytes,5,opt,name=requested_token_type,json=requestedTokenType,proto3" json:"requested_token_type,omitempty"` + state protoimpl.MessageState `protogen:"open.v1"` + // The HTTPS URL of the RFC 8693 token exchange endpoint. + Url string `protobuf:"bytes,1,opt,name=url,proto3" json:"url,omitempty"` + // Resource indicators sent in the token exchange request. + Resources []string `protobuf:"bytes,2,rep,name=resources,proto3" json:"resources,omitempty"` + // Audience values sent in the token exchange request. + Audiences []string `protobuf:"bytes,3,rep,name=audiences,proto3" json:"audiences,omitempty"` + // The requested access scope sent in the token exchange request. + Scope string `protobuf:"bytes,4,opt,name=scope,proto3" json:"scope,omitempty"` + // The requested token type sent in the token exchange request. + RequestedTokenType string `protobuf:"bytes,5,opt,name=requested_token_type,json=requestedTokenType,proto3" json:"requested_token_type,omitempty"` unknownFields protoimpl.UnknownFields sizeCache protoimpl.SizeCache } @@ -4322,6 +4334,8 @@ func (x *DeleteActorRequest) GetAnyState() bool { type GetActorEgressPolicyRequest struct { state protoimpl.MessageState `protogen:"open.v1"` + // The parent Actor of the egress policy resource to retrieve. + // // +k8s:required // +k8s:opaqueType Actor *ObjectRef `protobuf:"bytes,1,opt,name=actor,proto3" json:"actor,omitempty"` @@ -4366,55 +4380,10 @@ func (x *GetActorEgressPolicyRequest) GetActor() *ObjectRef { return nil } -type GetActorEgressPolicyResponse struct { - state protoimpl.MessageState `protogen:"open.v1"` - // Empty when the Actor has no policy. V0 returns at most one document. - EgressPolicies []*EgressPolicy `protobuf:"bytes,1,rep,name=egress_policies,json=egressPolicies,proto3" json:"egress_policies,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache -} - -func (x *GetActorEgressPolicyResponse) Reset() { - *x = GetActorEgressPolicyResponse{} - mi := &file_ateapi_proto_msgTypes[61] - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - ms.StoreMessageInfo(mi) -} - -func (x *GetActorEgressPolicyResponse) String() string { - return protoimpl.X.MessageStringOf(x) -} - -func (*GetActorEgressPolicyResponse) ProtoMessage() {} - -func (x *GetActorEgressPolicyResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[61] - if x != nil { - ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) - if ms.LoadMessageInfo() == nil { - ms.StoreMessageInfo(mi) - } - return ms - } - return mi.MessageOf(x) -} - -// Deprecated: Use GetActorEgressPolicyResponse.ProtoReflect.Descriptor instead. -func (*GetActorEgressPolicyResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{61} -} - -func (x *GetActorEgressPolicyResponse) GetEgressPolicies() []*EgressPolicy { - if x != nil { - return x.EgressPolicies - } - return nil -} - type CreateActorEgressPolicyRequest struct { state protoimpl.MessageState `protogen:"open.v1"` - // Parent Actor. V0 creates the policy document named "default" under this - // Actor, so no policy name is supplied. + // Parent Actor. The server creates the policy resource named "default" + // under this Actor, so no policy name is supplied. // // +k8s:required // +k8s:opaqueType @@ -4430,7 +4399,7 @@ type CreateActorEgressPolicyRequest struct { func (x *CreateActorEgressPolicyRequest) Reset() { *x = CreateActorEgressPolicyRequest{} - mi := &file_ateapi_proto_msgTypes[62] + mi := &file_ateapi_proto_msgTypes[61] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4442,7 +4411,7 @@ func (x *CreateActorEgressPolicyRequest) String() string { func (*CreateActorEgressPolicyRequest) ProtoMessage() {} func (x *CreateActorEgressPolicyRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[62] + mi := &file_ateapi_proto_msgTypes[61] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4455,7 +4424,7 @@ func (x *CreateActorEgressPolicyRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use CreateActorEgressPolicyRequest.ProtoReflect.Descriptor instead. func (*CreateActorEgressPolicyRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{62} + return file_ateapi_proto_rawDescGZIP(), []int{61} } func (x *CreateActorEgressPolicyRequest) GetActor() *ObjectRef { @@ -4474,8 +4443,8 @@ func (x *CreateActorEgressPolicyRequest) GetEgressPolicy() *EgressPolicy { type UpdateActorEgressPolicyRequest struct { state protoimpl.MessageState `protogen:"open.v1"` - // Parent Actor. V0 updates the policy document named "default" under this - // Actor, so no policy name is supplied. + // Parent Actor. The server updates the policy resource named "default" + // under this Actor, so no policy name is supplied. // // +k8s:required // +k8s:opaqueType @@ -4492,7 +4461,7 @@ type UpdateActorEgressPolicyRequest struct { func (x *UpdateActorEgressPolicyRequest) Reset() { *x = UpdateActorEgressPolicyRequest{} - mi := &file_ateapi_proto_msgTypes[63] + mi := &file_ateapi_proto_msgTypes[62] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4504,7 +4473,7 @@ func (x *UpdateActorEgressPolicyRequest) String() string { func (*UpdateActorEgressPolicyRequest) ProtoMessage() {} func (x *UpdateActorEgressPolicyRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[63] + mi := &file_ateapi_proto_msgTypes[62] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4517,7 +4486,7 @@ func (x *UpdateActorEgressPolicyRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use UpdateActorEgressPolicyRequest.ProtoReflect.Descriptor instead. func (*UpdateActorEgressPolicyRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{63} + return file_ateapi_proto_rawDescGZIP(), []int{62} } func (x *UpdateActorEgressPolicyRequest) GetActor() *ObjectRef { @@ -4536,6 +4505,8 @@ func (x *UpdateActorEgressPolicyRequest) GetEgressPolicy() *EgressPolicy { type DeleteActorEgressPolicyRequest struct { state protoimpl.MessageState `protogen:"open.v1"` + // The parent Actor of the egress policy resource to delete. + // // +k8s:required // +k8s:opaqueType Actor *ObjectRef `protobuf:"bytes,1,opt,name=actor,proto3" json:"actor,omitempty"` @@ -4545,7 +4516,7 @@ type DeleteActorEgressPolicyRequest struct { func (x *DeleteActorEgressPolicyRequest) Reset() { *x = DeleteActorEgressPolicyRequest{} - mi := &file_ateapi_proto_msgTypes[64] + mi := &file_ateapi_proto_msgTypes[63] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4557,7 +4528,7 @@ func (x *DeleteActorEgressPolicyRequest) String() string { func (*DeleteActorEgressPolicyRequest) ProtoMessage() {} func (x *DeleteActorEgressPolicyRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[64] + mi := &file_ateapi_proto_msgTypes[63] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4570,7 +4541,7 @@ func (x *DeleteActorEgressPolicyRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteActorEgressPolicyRequest.ProtoReflect.Descriptor instead. func (*DeleteActorEgressPolicyRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{64} + return file_ateapi_proto_rawDescGZIP(), []int{63} } func (x *DeleteActorEgressPolicyRequest) GetActor() *ObjectRef { @@ -4590,7 +4561,7 @@ type GetActorSnapshotRequest struct { func (x *GetActorSnapshotRequest) Reset() { *x = GetActorSnapshotRequest{} - mi := &file_ateapi_proto_msgTypes[65] + mi := &file_ateapi_proto_msgTypes[64] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4602,7 +4573,7 @@ func (x *GetActorSnapshotRequest) String() string { func (*GetActorSnapshotRequest) ProtoMessage() {} func (x *GetActorSnapshotRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[65] + mi := &file_ateapi_proto_msgTypes[64] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4615,7 +4586,7 @@ func (x *GetActorSnapshotRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetActorSnapshotRequest.ProtoReflect.Descriptor instead. func (*GetActorSnapshotRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{65} + return file_ateapi_proto_rawDescGZIP(), []int{64} } func (x *GetActorSnapshotRequest) GetActorSnapshot() *ObjectRef { @@ -4635,7 +4606,7 @@ type GetActorSnapshotTagRequest struct { func (x *GetActorSnapshotTagRequest) Reset() { *x = GetActorSnapshotTagRequest{} - mi := &file_ateapi_proto_msgTypes[66] + mi := &file_ateapi_proto_msgTypes[65] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4647,7 +4618,7 @@ func (x *GetActorSnapshotTagRequest) String() string { func (*GetActorSnapshotTagRequest) ProtoMessage() {} func (x *GetActorSnapshotTagRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[66] + mi := &file_ateapi_proto_msgTypes[65] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4660,7 +4631,7 @@ func (x *GetActorSnapshotTagRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetActorSnapshotTagRequest.ProtoReflect.Descriptor instead. func (*GetActorSnapshotTagRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{66} + return file_ateapi_proto_rawDescGZIP(), []int{65} } func (x *GetActorSnapshotTagRequest) GetActorSnapshotTag() *ObjectRef { @@ -4681,7 +4652,7 @@ type ListActorSnapshotsRequest struct { func (x *ListActorSnapshotsRequest) Reset() { *x = ListActorSnapshotsRequest{} - mi := &file_ateapi_proto_msgTypes[67] + mi := &file_ateapi_proto_msgTypes[66] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4693,7 +4664,7 @@ func (x *ListActorSnapshotsRequest) String() string { func (*ListActorSnapshotsRequest) ProtoMessage() {} func (x *ListActorSnapshotsRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[67] + mi := &file_ateapi_proto_msgTypes[66] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4706,7 +4677,7 @@ func (x *ListActorSnapshotsRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ListActorSnapshotsRequest.ProtoReflect.Descriptor instead. func (*ListActorSnapshotsRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{67} + return file_ateapi_proto_rawDescGZIP(), []int{66} } func (x *ListActorSnapshotsRequest) GetAtespace() string { @@ -4740,7 +4711,7 @@ type ListActorSnapshotsResponse struct { func (x *ListActorSnapshotsResponse) Reset() { *x = ListActorSnapshotsResponse{} - mi := &file_ateapi_proto_msgTypes[68] + mi := &file_ateapi_proto_msgTypes[67] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4752,7 +4723,7 @@ func (x *ListActorSnapshotsResponse) String() string { func (*ListActorSnapshotsResponse) ProtoMessage() {} func (x *ListActorSnapshotsResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[68] + mi := &file_ateapi_proto_msgTypes[67] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4765,7 +4736,7 @@ func (x *ListActorSnapshotsResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ListActorSnapshotsResponse.ProtoReflect.Descriptor instead. func (*ListActorSnapshotsResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{68} + return file_ateapi_proto_rawDescGZIP(), []int{67} } func (x *ListActorSnapshotsResponse) GetActorSnapshots() []*ActorSnapshot { @@ -4792,7 +4763,7 @@ type CreateActorSnapshotTagRequest struct { func (x *CreateActorSnapshotTagRequest) Reset() { *x = CreateActorSnapshotTagRequest{} - mi := &file_ateapi_proto_msgTypes[69] + mi := &file_ateapi_proto_msgTypes[68] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4804,7 +4775,7 @@ func (x *CreateActorSnapshotTagRequest) String() string { func (*CreateActorSnapshotTagRequest) ProtoMessage() {} func (x *CreateActorSnapshotTagRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[69] + mi := &file_ateapi_proto_msgTypes[68] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4817,7 +4788,7 @@ func (x *CreateActorSnapshotTagRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use CreateActorSnapshotTagRequest.ProtoReflect.Descriptor instead. func (*CreateActorSnapshotTagRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{69} + return file_ateapi_proto_rawDescGZIP(), []int{68} } func (x *CreateActorSnapshotTagRequest) GetActorSnapshotTag() *ActorSnapshotTag { @@ -4843,7 +4814,7 @@ type UpdateActorSnapshotTagRequest struct { func (x *UpdateActorSnapshotTagRequest) Reset() { *x = UpdateActorSnapshotTagRequest{} - mi := &file_ateapi_proto_msgTypes[70] + mi := &file_ateapi_proto_msgTypes[69] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4855,7 +4826,7 @@ func (x *UpdateActorSnapshotTagRequest) String() string { func (*UpdateActorSnapshotTagRequest) ProtoMessage() {} func (x *UpdateActorSnapshotTagRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[70] + mi := &file_ateapi_proto_msgTypes[69] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4868,7 +4839,7 @@ func (x *UpdateActorSnapshotTagRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use UpdateActorSnapshotTagRequest.ProtoReflect.Descriptor instead. func (*UpdateActorSnapshotTagRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{70} + return file_ateapi_proto_rawDescGZIP(), []int{69} } func (x *UpdateActorSnapshotTagRequest) GetActorSnapshotTag() *ActorSnapshotTag { @@ -4888,7 +4859,7 @@ type DeleteActorSnapshotTagRequest struct { func (x *DeleteActorSnapshotTagRequest) Reset() { *x = DeleteActorSnapshotTagRequest{} - mi := &file_ateapi_proto_msgTypes[71] + mi := &file_ateapi_proto_msgTypes[70] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4900,7 +4871,7 @@ func (x *DeleteActorSnapshotTagRequest) String() string { func (*DeleteActorSnapshotTagRequest) ProtoMessage() {} func (x *DeleteActorSnapshotTagRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[71] + mi := &file_ateapi_proto_msgTypes[70] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4913,7 +4884,7 @@ func (x *DeleteActorSnapshotTagRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteActorSnapshotTagRequest.ProtoReflect.Descriptor instead. func (*DeleteActorSnapshotTagRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{71} + return file_ateapi_proto_rawDescGZIP(), []int{70} } func (x *DeleteActorSnapshotTagRequest) GetActorSnapshotTag() *ObjectRef { @@ -4943,7 +4914,7 @@ type DeleteOptions struct { func (x *DeleteOptions) Reset() { *x = DeleteOptions{} - mi := &file_ateapi_proto_msgTypes[72] + mi := &file_ateapi_proto_msgTypes[71] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4955,7 +4926,7 @@ func (x *DeleteOptions) String() string { func (*DeleteOptions) ProtoMessage() {} func (x *DeleteOptions) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[72] + mi := &file_ateapi_proto_msgTypes[71] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4968,7 +4939,7 @@ func (x *DeleteOptions) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteOptions.ProtoReflect.Descriptor instead. func (*DeleteOptions) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{72} + return file_ateapi_proto_rawDescGZIP(), []int{71} } func (x *DeleteOptions) GetVersion() int64 { @@ -5000,7 +4971,7 @@ type ListWorkersRequest struct { func (x *ListWorkersRequest) Reset() { *x = ListWorkersRequest{} - mi := &file_ateapi_proto_msgTypes[73] + mi := &file_ateapi_proto_msgTypes[72] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5012,7 +4983,7 @@ func (x *ListWorkersRequest) String() string { func (*ListWorkersRequest) ProtoMessage() {} func (x *ListWorkersRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[73] + mi := &file_ateapi_proto_msgTypes[72] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5025,7 +4996,7 @@ func (x *ListWorkersRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ListWorkersRequest.ProtoReflect.Descriptor instead. func (*ListWorkersRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{73} + return file_ateapi_proto_rawDescGZIP(), []int{72} } func (x *ListWorkersRequest) GetPageSize() int32 { @@ -5054,7 +5025,7 @@ type ListWorkersResponse struct { func (x *ListWorkersResponse) Reset() { *x = ListWorkersResponse{} - mi := &file_ateapi_proto_msgTypes[74] + mi := &file_ateapi_proto_msgTypes[73] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5066,7 +5037,7 @@ func (x *ListWorkersResponse) String() string { func (*ListWorkersResponse) ProtoMessage() {} func (x *ListWorkersResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[74] + mi := &file_ateapi_proto_msgTypes[73] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5079,7 +5050,7 @@ func (x *ListWorkersResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ListWorkersResponse.ProtoReflect.Descriptor instead. func (*ListWorkersResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{74} + return file_ateapi_proto_rawDescGZIP(), []int{73} } func (x *ListWorkersResponse) GetWorkers() []*Worker { @@ -5107,7 +5078,7 @@ type GetWorkerRequest struct { func (x *GetWorkerRequest) Reset() { *x = GetWorkerRequest{} - mi := &file_ateapi_proto_msgTypes[75] + mi := &file_ateapi_proto_msgTypes[74] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5119,7 +5090,7 @@ func (x *GetWorkerRequest) String() string { func (*GetWorkerRequest) ProtoMessage() {} func (x *GetWorkerRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[75] + mi := &file_ateapi_proto_msgTypes[74] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5132,7 +5103,7 @@ func (x *GetWorkerRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetWorkerRequest.ProtoReflect.Descriptor instead. func (*GetWorkerRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{75} + return file_ateapi_proto_rawDescGZIP(), []int{74} } func (x *GetWorkerRequest) GetWorker() *ObjectRef { @@ -5152,7 +5123,7 @@ type CreateWorkerRequest struct { func (x *CreateWorkerRequest) Reset() { *x = CreateWorkerRequest{} - mi := &file_ateapi_proto_msgTypes[76] + mi := &file_ateapi_proto_msgTypes[75] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5164,7 +5135,7 @@ func (x *CreateWorkerRequest) String() string { func (*CreateWorkerRequest) ProtoMessage() {} func (x *CreateWorkerRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[76] + mi := &file_ateapi_proto_msgTypes[75] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5177,7 +5148,7 @@ func (x *CreateWorkerRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use CreateWorkerRequest.ProtoReflect.Descriptor instead. func (*CreateWorkerRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{76} + return file_ateapi_proto_rawDescGZIP(), []int{75} } func (x *CreateWorkerRequest) GetWorker() *Worker { @@ -5207,7 +5178,7 @@ type UpdateWorkerRequest struct { func (x *UpdateWorkerRequest) Reset() { *x = UpdateWorkerRequest{} - mi := &file_ateapi_proto_msgTypes[77] + mi := &file_ateapi_proto_msgTypes[76] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5219,7 +5190,7 @@ func (x *UpdateWorkerRequest) String() string { func (*UpdateWorkerRequest) ProtoMessage() {} func (x *UpdateWorkerRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[77] + mi := &file_ateapi_proto_msgTypes[76] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5232,7 +5203,7 @@ func (x *UpdateWorkerRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use UpdateWorkerRequest.ProtoReflect.Descriptor instead. func (*UpdateWorkerRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{77} + return file_ateapi_proto_rawDescGZIP(), []int{76} } func (x *UpdateWorkerRequest) GetWorker() *Worker { @@ -5255,7 +5226,7 @@ type DeleteWorkerRequest struct { func (x *DeleteWorkerRequest) Reset() { *x = DeleteWorkerRequest{} - mi := &file_ateapi_proto_msgTypes[78] + mi := &file_ateapi_proto_msgTypes[77] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5267,7 +5238,7 @@ func (x *DeleteWorkerRequest) String() string { func (*DeleteWorkerRequest) ProtoMessage() {} func (x *DeleteWorkerRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[78] + mi := &file_ateapi_proto_msgTypes[77] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5280,7 +5251,7 @@ func (x *DeleteWorkerRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteWorkerRequest.ProtoReflect.Descriptor instead. func (*DeleteWorkerRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{78} + return file_ateapi_proto_rawDescGZIP(), []int{77} } func (x *DeleteWorkerRequest) GetWorker() *ObjectRef { @@ -5308,7 +5279,7 @@ type DrainWorkerRequest struct { func (x *DrainWorkerRequest) Reset() { *x = DrainWorkerRequest{} - mi := &file_ateapi_proto_msgTypes[79] + mi := &file_ateapi_proto_msgTypes[78] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5320,7 +5291,7 @@ func (x *DrainWorkerRequest) String() string { func (*DrainWorkerRequest) ProtoMessage() {} func (x *DrainWorkerRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[79] + mi := &file_ateapi_proto_msgTypes[78] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5333,7 +5304,7 @@ func (x *DrainWorkerRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DrainWorkerRequest.ProtoReflect.Descriptor instead. func (*DrainWorkerRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{79} + return file_ateapi_proto_rawDescGZIP(), []int{78} } func (x *DrainWorkerRequest) GetWorker() *ObjectRef { @@ -5362,7 +5333,7 @@ type ListActorsRequest struct { func (x *ListActorsRequest) Reset() { *x = ListActorsRequest{} - mi := &file_ateapi_proto_msgTypes[80] + mi := &file_ateapi_proto_msgTypes[79] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5374,7 +5345,7 @@ func (x *ListActorsRequest) String() string { func (*ListActorsRequest) ProtoMessage() {} func (x *ListActorsRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[80] + mi := &file_ateapi_proto_msgTypes[79] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5387,7 +5358,7 @@ func (x *ListActorsRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ListActorsRequest.ProtoReflect.Descriptor instead. func (*ListActorsRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{80} + return file_ateapi_proto_rawDescGZIP(), []int{79} } func (x *ListActorsRequest) GetAtespace() string { @@ -5423,7 +5394,7 @@ type ListActorsResponse struct { func (x *ListActorsResponse) Reset() { *x = ListActorsResponse{} - mi := &file_ateapi_proto_msgTypes[81] + mi := &file_ateapi_proto_msgTypes[80] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5435,7 +5406,7 @@ func (x *ListActorsResponse) String() string { func (*ListActorsResponse) ProtoMessage() {} func (x *ListActorsResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[81] + mi := &file_ateapi_proto_msgTypes[80] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5448,7 +5419,7 @@ func (x *ListActorsResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ListActorsResponse.ProtoReflect.Descriptor instead. func (*ListActorsResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{81} + return file_ateapi_proto_rawDescGZIP(), []int{80} } func (x *ListActorsResponse) GetActors() []*Actor { @@ -5504,7 +5475,7 @@ type Worker struct { func (x *Worker) Reset() { *x = Worker{} - mi := &file_ateapi_proto_msgTypes[82] + mi := &file_ateapi_proto_msgTypes[81] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5516,7 +5487,7 @@ func (x *Worker) String() string { func (*Worker) ProtoMessage() {} func (x *Worker) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[82] + mi := &file_ateapi_proto_msgTypes[81] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5529,7 +5500,7 @@ func (x *Worker) ProtoReflect() protoreflect.Message { // Deprecated: Use Worker.ProtoReflect.Descriptor instead. func (*Worker) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{82} + return file_ateapi_proto_rawDescGZIP(), []int{81} } func (x *Worker) GetMetadata() *ResourceMetadata { @@ -5620,7 +5591,7 @@ type WorkerStatus struct { func (x *WorkerStatus) Reset() { *x = WorkerStatus{} - mi := &file_ateapi_proto_msgTypes[83] + mi := &file_ateapi_proto_msgTypes[82] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5632,7 +5603,7 @@ func (x *WorkerStatus) String() string { func (*WorkerStatus) ProtoMessage() {} func (x *WorkerStatus) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[83] + mi := &file_ateapi_proto_msgTypes[82] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5645,7 +5616,7 @@ func (x *WorkerStatus) ProtoReflect() protoreflect.Message { // Deprecated: Use WorkerStatus.ProtoReflect.Descriptor instead. func (*WorkerStatus) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{83} + return file_ateapi_proto_rawDescGZIP(), []int{82} } func (x *WorkerStatus) GetState() WorkerState { @@ -5678,7 +5649,7 @@ type WorkerCapacity struct { func (x *WorkerCapacity) Reset() { *x = WorkerCapacity{} - mi := &file_ateapi_proto_msgTypes[84] + mi := &file_ateapi_proto_msgTypes[83] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5690,7 +5661,7 @@ func (x *WorkerCapacity) String() string { func (*WorkerCapacity) ProtoMessage() {} func (x *WorkerCapacity) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[84] + mi := &file_ateapi_proto_msgTypes[83] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5703,7 +5674,7 @@ func (x *WorkerCapacity) ProtoReflect() protoreflect.Message { // Deprecated: Use WorkerCapacity.ProtoReflect.Descriptor instead. func (*WorkerCapacity) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{84} + return file_ateapi_proto_rawDescGZIP(), []int{83} } func (x *WorkerCapacity) GetCpuMilli() int64 { @@ -5736,7 +5707,7 @@ type ActorAssignment struct { func (x *ActorAssignment) Reset() { *x = ActorAssignment{} - mi := &file_ateapi_proto_msgTypes[85] + mi := &file_ateapi_proto_msgTypes[84] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5748,7 +5719,7 @@ func (x *ActorAssignment) String() string { func (*ActorAssignment) ProtoMessage() {} func (x *ActorAssignment) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[85] + mi := &file_ateapi_proto_msgTypes[84] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5761,7 +5732,7 @@ func (x *ActorAssignment) ProtoReflect() protoreflect.Message { // Deprecated: Use ActorAssignment.ProtoReflect.Descriptor instead. func (*ActorAssignment) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{85} + return file_ateapi_proto_rawDescGZIP(), []int{84} } func (x *ActorAssignment) GetActorTemplate() *KubeNamespacedObjectRef { @@ -5795,7 +5766,7 @@ type KubeNamespacedObjectRef struct { func (x *KubeNamespacedObjectRef) Reset() { *x = KubeNamespacedObjectRef{} - mi := &file_ateapi_proto_msgTypes[86] + mi := &file_ateapi_proto_msgTypes[85] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5807,7 +5778,7 @@ func (x *KubeNamespacedObjectRef) String() string { func (*KubeNamespacedObjectRef) ProtoMessage() {} func (x *KubeNamespacedObjectRef) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[86] + mi := &file_ateapi_proto_msgTypes[85] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5820,7 +5791,7 @@ func (x *KubeNamespacedObjectRef) ProtoReflect() protoreflect.Message { // Deprecated: Use KubeNamespacedObjectRef.ProtoReflect.Descriptor instead. func (*KubeNamespacedObjectRef) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{86} + return file_ateapi_proto_rawDescGZIP(), []int{85} } func (x *KubeNamespacedObjectRef) GetNamespace() string { @@ -5845,7 +5816,7 @@ type DebugClearRequest struct { func (x *DebugClearRequest) Reset() { *x = DebugClearRequest{} - mi := &file_ateapi_proto_msgTypes[87] + mi := &file_ateapi_proto_msgTypes[86] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5857,7 +5828,7 @@ func (x *DebugClearRequest) String() string { func (*DebugClearRequest) ProtoMessage() {} func (x *DebugClearRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[87] + mi := &file_ateapi_proto_msgTypes[86] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5870,7 +5841,7 @@ func (x *DebugClearRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DebugClearRequest.ProtoReflect.Descriptor instead. func (*DebugClearRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{87} + return file_ateapi_proto_rawDescGZIP(), []int{86} } type DebugClearResponse struct { @@ -5881,7 +5852,7 @@ type DebugClearResponse struct { func (x *DebugClearResponse) Reset() { *x = DebugClearResponse{} - mi := &file_ateapi_proto_msgTypes[88] + mi := &file_ateapi_proto_msgTypes[87] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5893,7 +5864,7 @@ func (x *DebugClearResponse) String() string { func (*DebugClearResponse) ProtoMessage() {} func (x *DebugClearResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[88] + mi := &file_ateapi_proto_msgTypes[87] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5906,7 +5877,7 @@ func (x *DebugClearResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use DebugClearResponse.ProtoReflect.Descriptor instead. func (*DebugClearResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{88} + return file_ateapi_proto_rawDescGZIP(), []int{87} } type MintJWTRequest struct { @@ -5921,7 +5892,7 @@ type MintJWTRequest struct { func (x *MintJWTRequest) Reset() { *x = MintJWTRequest{} - mi := &file_ateapi_proto_msgTypes[89] + mi := &file_ateapi_proto_msgTypes[88] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5933,7 +5904,7 @@ func (x *MintJWTRequest) String() string { func (*MintJWTRequest) ProtoMessage() {} func (x *MintJWTRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[89] + mi := &file_ateapi_proto_msgTypes[88] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5946,7 +5917,7 @@ func (x *MintJWTRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use MintJWTRequest.ProtoReflect.Descriptor instead. func (*MintJWTRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{89} + return file_ateapi_proto_rawDescGZIP(), []int{88} } func (x *MintJWTRequest) GetAudience() []string { @@ -6007,7 +5978,7 @@ type MintJWTResponse struct { func (x *MintJWTResponse) Reset() { *x = MintJWTResponse{} - mi := &file_ateapi_proto_msgTypes[90] + mi := &file_ateapi_proto_msgTypes[89] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -6019,7 +5990,7 @@ func (x *MintJWTResponse) String() string { func (*MintJWTResponse) ProtoMessage() {} func (x *MintJWTResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[90] + mi := &file_ateapi_proto_msgTypes[89] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -6032,7 +6003,7 @@ func (x *MintJWTResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use MintJWTResponse.ProtoReflect.Descriptor instead. func (*MintJWTResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{90} + return file_ateapi_proto_rawDescGZIP(), []int{89} } func (x *MintJWTResponse) GetActorJwt() string { @@ -6068,7 +6039,7 @@ type MintCertRequest struct { func (x *MintCertRequest) Reset() { *x = MintCertRequest{} - mi := &file_ateapi_proto_msgTypes[91] + mi := &file_ateapi_proto_msgTypes[90] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -6080,7 +6051,7 @@ func (x *MintCertRequest) String() string { func (*MintCertRequest) ProtoMessage() {} func (x *MintCertRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[91] + mi := &file_ateapi_proto_msgTypes[90] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -6093,7 +6064,7 @@ func (x *MintCertRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use MintCertRequest.ProtoReflect.Descriptor instead. func (*MintCertRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{91} + return file_ateapi_proto_rawDescGZIP(), []int{90} } func (x *MintCertRequest) GetWorker() *ObjectRef { @@ -6136,7 +6107,7 @@ type MintCertResponse struct { func (x *MintCertResponse) Reset() { *x = MintCertResponse{} - mi := &file_ateapi_proto_msgTypes[92] + mi := &file_ateapi_proto_msgTypes[91] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -6148,7 +6119,7 @@ func (x *MintCertResponse) String() string { func (*MintCertResponse) ProtoMessage() {} func (x *MintCertResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[92] + mi := &file_ateapi_proto_msgTypes[91] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -6161,7 +6132,7 @@ func (x *MintCertResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use MintCertResponse.ProtoReflect.Descriptor instead. func (*MintCertResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{92} + return file_ateapi_proto_rawDescGZIP(), []int{91} } func (x *MintCertResponse) GetActorCertificates() [][]byte { @@ -6426,9 +6397,7 @@ const file_ateapi_proto_rawDesc = "" + "\x05actor\x18\x01 \x01(\v2\x11.ateapi.ObjectRefR\x05actor\x12\x1b\n" + "\tany_state\x18\x02 \x01(\bR\banyState\"F\n" + "\x1bGetActorEgressPolicyRequest\x12'\n" + - "\x05actor\x18\x01 \x01(\v2\x11.ateapi.ObjectRefR\x05actor\"]\n" + - "\x1cGetActorEgressPolicyResponse\x12=\n" + - "\x0fegress_policies\x18\x01 \x03(\v2\x14.ateapi.EgressPolicyR\x0eegressPolicies\"\x84\x01\n" + + "\x05actor\x18\x01 \x01(\v2\x11.ateapi.ObjectRefR\x05actor\"\x84\x01\n" + "\x1eCreateActorEgressPolicyRequest\x12'\n" + "\x05actor\x18\x01 \x01(\v2\x11.ateapi.ObjectRefR\x05actor\x129\n" + "\regress_policy\x18\x02 \x01(\v2\x14.ateapi.EgressPolicyR\fegressPolicy\"\x84\x01\n" + @@ -6574,7 +6543,7 @@ const file_ateapi_proto_rawDesc = "" + "\x15WORKER_STATE_DRAINING\x10\x02*k\n" + "\x17ActorCertificatePurpose\x12)\n" + "%ACTOR_CERTIFICATE_PURPOSE_UNSPECIFIED\x10\x00\x12%\n" + - "!ACTOR_CERTIFICATE_PURPOSE_ATUNNEL\x10\x012\x94\x13\n" + + "!ACTOR_CERTIFICATE_PURPOSE_ATUNNEL\x10\x012\x84\x13\n" + "\aControl\x124\n" + "\bGetActor\x12\x17.ateapi.GetActorRequest\x1a\r.ateapi.Actor\"\x00\x12:\n" + "\vCreateActor\x12\x1a.ateapi.CreateActorRequest\x1a\r.ateapi.Actor\"\x00\x12:\n" + @@ -6583,8 +6552,8 @@ const file_ateapi_proto_rawDesc = "" + "\n" + "PauseActor\x12\x19.ateapi.PauseActorRequest\x1a\x1a.ateapi.PauseActorResponse\"\x00\x12H\n" + "\vResumeActor\x12\x1a.ateapi.ResumeActorRequest\x1a\x1b.ateapi.ResumeActorResponse\"\x00\x12:\n" + - "\vDeleteActor\x12\x1a.ateapi.DeleteActorRequest\x1a\r.ateapi.Actor\"\x00\x12c\n" + - "\x14GetActorEgressPolicy\x12#.ateapi.GetActorEgressPolicyRequest\x1a$.ateapi.GetActorEgressPolicyResponse\"\x00\x12Y\n" + + "\vDeleteActor\x12\x1a.ateapi.DeleteActorRequest\x1a\r.ateapi.Actor\"\x00\x12S\n" + + "\x14GetActorEgressPolicy\x12#.ateapi.GetActorEgressPolicyRequest\x1a\x14.ateapi.EgressPolicy\"\x00\x12Y\n" + "\x17CreateActorEgressPolicy\x12&.ateapi.CreateActorEgressPolicyRequest\x1a\x14.ateapi.EgressPolicy\"\x00\x12Y\n" + "\x17UpdateActorEgressPolicy\x12&.ateapi.UpdateActorEgressPolicyRequest\x1a\x14.ateapi.EgressPolicy\"\x00\x12Y\n" + "\x17DeleteActorEgressPolicy\x12&.ateapi.DeleteActorEgressPolicyRequest\x1a\x14.ateapi.EgressPolicy\"\x00\x12L\n" + @@ -6630,7 +6599,7 @@ func file_ateapi_proto_rawDescGZIP() []byte { } var file_ateapi_proto_enumTypes = make([]protoimpl.EnumInfo, 9) -var file_ateapi_proto_msgTypes = make([]protoimpl.MessageInfo, 98) +var file_ateapi_proto_msgTypes = make([]protoimpl.MessageInfo, 97) var file_ateapi_proto_goTypes = []any{ (SnapshotContentScope)(0), // 0: ateapi.SnapshotContentScope (ActorSnapshotTagScope)(0), // 1: ateapi.ActorSnapshotTagScope @@ -6702,53 +6671,52 @@ var file_ateapi_proto_goTypes = []any{ (*ResumeActorResponse)(nil), // 67: ateapi.ResumeActorResponse (*DeleteActorRequest)(nil), // 68: ateapi.DeleteActorRequest (*GetActorEgressPolicyRequest)(nil), // 69: ateapi.GetActorEgressPolicyRequest - (*GetActorEgressPolicyResponse)(nil), // 70: ateapi.GetActorEgressPolicyResponse - (*CreateActorEgressPolicyRequest)(nil), // 71: ateapi.CreateActorEgressPolicyRequest - (*UpdateActorEgressPolicyRequest)(nil), // 72: ateapi.UpdateActorEgressPolicyRequest - (*DeleteActorEgressPolicyRequest)(nil), // 73: ateapi.DeleteActorEgressPolicyRequest - (*GetActorSnapshotRequest)(nil), // 74: ateapi.GetActorSnapshotRequest - (*GetActorSnapshotTagRequest)(nil), // 75: ateapi.GetActorSnapshotTagRequest - (*ListActorSnapshotsRequest)(nil), // 76: ateapi.ListActorSnapshotsRequest - (*ListActorSnapshotsResponse)(nil), // 77: ateapi.ListActorSnapshotsResponse - (*CreateActorSnapshotTagRequest)(nil), // 78: ateapi.CreateActorSnapshotTagRequest - (*UpdateActorSnapshotTagRequest)(nil), // 79: ateapi.UpdateActorSnapshotTagRequest - (*DeleteActorSnapshotTagRequest)(nil), // 80: ateapi.DeleteActorSnapshotTagRequest - (*DeleteOptions)(nil), // 81: ateapi.DeleteOptions - (*ListWorkersRequest)(nil), // 82: ateapi.ListWorkersRequest - (*ListWorkersResponse)(nil), // 83: ateapi.ListWorkersResponse - (*GetWorkerRequest)(nil), // 84: ateapi.GetWorkerRequest - (*CreateWorkerRequest)(nil), // 85: ateapi.CreateWorkerRequest - (*UpdateWorkerRequest)(nil), // 86: ateapi.UpdateWorkerRequest - (*DeleteWorkerRequest)(nil), // 87: ateapi.DeleteWorkerRequest - (*DrainWorkerRequest)(nil), // 88: ateapi.DrainWorkerRequest - (*ListActorsRequest)(nil), // 89: ateapi.ListActorsRequest - (*ListActorsResponse)(nil), // 90: ateapi.ListActorsResponse - (*Worker)(nil), // 91: ateapi.Worker - (*WorkerStatus)(nil), // 92: ateapi.WorkerStatus - (*WorkerCapacity)(nil), // 93: ateapi.WorkerCapacity - (*ActorAssignment)(nil), // 94: ateapi.ActorAssignment - (*KubeNamespacedObjectRef)(nil), // 95: ateapi.KubeNamespacedObjectRef - (*DebugClearRequest)(nil), // 96: ateapi.DebugClearRequest - (*DebugClearResponse)(nil), // 97: ateapi.DebugClearResponse - (*MintJWTRequest)(nil), // 98: ateapi.MintJWTRequest - (*MintJWTResponse)(nil), // 99: ateapi.MintJWTResponse - (*MintCertRequest)(nil), // 100: ateapi.MintCertRequest - (*MintCertResponse)(nil), // 101: ateapi.MintCertResponse - nil, // 102: ateapi.Selector.MatchLabelsEntry - nil, // 103: ateapi.ExternalVolume.VolumeContextEntry - nil, // 104: ateapi.SandboxAssets.AssetsEntry - nil, // 105: ateapi.ArchAssets.FilesEntry - nil, // 106: ateapi.Worker.LabelsEntry - (*timestamppb.Timestamp)(nil), // 107: google.protobuf.Timestamp - (*emptypb.Empty)(nil), // 108: google.protobuf.Empty + (*CreateActorEgressPolicyRequest)(nil), // 70: ateapi.CreateActorEgressPolicyRequest + (*UpdateActorEgressPolicyRequest)(nil), // 71: ateapi.UpdateActorEgressPolicyRequest + (*DeleteActorEgressPolicyRequest)(nil), // 72: ateapi.DeleteActorEgressPolicyRequest + (*GetActorSnapshotRequest)(nil), // 73: ateapi.GetActorSnapshotRequest + (*GetActorSnapshotTagRequest)(nil), // 74: ateapi.GetActorSnapshotTagRequest + (*ListActorSnapshotsRequest)(nil), // 75: ateapi.ListActorSnapshotsRequest + (*ListActorSnapshotsResponse)(nil), // 76: ateapi.ListActorSnapshotsResponse + (*CreateActorSnapshotTagRequest)(nil), // 77: ateapi.CreateActorSnapshotTagRequest + (*UpdateActorSnapshotTagRequest)(nil), // 78: ateapi.UpdateActorSnapshotTagRequest + (*DeleteActorSnapshotTagRequest)(nil), // 79: ateapi.DeleteActorSnapshotTagRequest + (*DeleteOptions)(nil), // 80: ateapi.DeleteOptions + (*ListWorkersRequest)(nil), // 81: ateapi.ListWorkersRequest + (*ListWorkersResponse)(nil), // 82: ateapi.ListWorkersResponse + (*GetWorkerRequest)(nil), // 83: ateapi.GetWorkerRequest + (*CreateWorkerRequest)(nil), // 84: ateapi.CreateWorkerRequest + (*UpdateWorkerRequest)(nil), // 85: ateapi.UpdateWorkerRequest + (*DeleteWorkerRequest)(nil), // 86: ateapi.DeleteWorkerRequest + (*DrainWorkerRequest)(nil), // 87: ateapi.DrainWorkerRequest + (*ListActorsRequest)(nil), // 88: ateapi.ListActorsRequest + (*ListActorsResponse)(nil), // 89: ateapi.ListActorsResponse + (*Worker)(nil), // 90: ateapi.Worker + (*WorkerStatus)(nil), // 91: ateapi.WorkerStatus + (*WorkerCapacity)(nil), // 92: ateapi.WorkerCapacity + (*ActorAssignment)(nil), // 93: ateapi.ActorAssignment + (*KubeNamespacedObjectRef)(nil), // 94: ateapi.KubeNamespacedObjectRef + (*DebugClearRequest)(nil), // 95: ateapi.DebugClearRequest + (*DebugClearResponse)(nil), // 96: ateapi.DebugClearResponse + (*MintJWTRequest)(nil), // 97: ateapi.MintJWTRequest + (*MintJWTResponse)(nil), // 98: ateapi.MintJWTResponse + (*MintCertRequest)(nil), // 99: ateapi.MintCertRequest + (*MintCertResponse)(nil), // 100: ateapi.MintCertResponse + nil, // 101: ateapi.Selector.MatchLabelsEntry + nil, // 102: ateapi.ExternalVolume.VolumeContextEntry + nil, // 103: ateapi.SandboxAssets.AssetsEntry + nil, // 104: ateapi.ArchAssets.FilesEntry + nil, // 105: ateapi.Worker.LabelsEntry + (*timestamppb.Timestamp)(nil), // 106: google.protobuf.Timestamp + (*emptypb.Empty)(nil), // 107: google.protobuf.Empty } var file_ateapi_proto_depIdxs = []int32{ 0, // 0: ateapi.LocalSnapshotInfo.content_scope:type_name -> ateapi.SnapshotContentScope - 102, // 1: ateapi.Selector.match_labels:type_name -> ateapi.Selector.MatchLabelsEntry - 107, // 2: ateapi.ResourceMetadata.create_time:type_name -> google.protobuf.Timestamp - 107, // 3: ateapi.ResourceMetadata.update_time:type_name -> google.protobuf.Timestamp + 101, // 1: ateapi.Selector.match_labels:type_name -> ateapi.Selector.MatchLabelsEntry + 106, // 2: ateapi.ResourceMetadata.create_time:type_name -> google.protobuf.Timestamp + 106, // 3: ateapi.ResourceMetadata.update_time:type_name -> google.protobuf.Timestamp 8, // 4: ateapi.ExternalVolume.status:type_name -> ateapi.ExternalVolume.Status - 103, // 5: ateapi.ExternalVolume.volume_context:type_name -> ateapi.ExternalVolume.VolumeContextEntry + 102, // 5: ateapi.ExternalVolume.volume_context:type_name -> ateapi.ExternalVolume.VolumeContextEntry 11, // 6: ateapi.Actor.metadata:type_name -> ateapi.ResourceMetadata 30, // 7: ateapi.Actor.actor_template:type_name -> ateapi.ObjectRef 10, // 8: ateapi.Actor.worker_selector:type_name -> ateapi.Selector @@ -6758,7 +6726,7 @@ var file_ateapi_proto_depIdxs = []int32{ 15, // 12: ateapi.EgressPolicy.rules:type_name -> ateapi.EgressRule 16, // 13: ateapi.EgressRule.allow:type_name -> ateapi.EgressMatch 19, // 14: ateapi.EgressRule.effects:type_name -> ateapi.EgressRuleEffects - 108, // 15: ateapi.EgressMatch.all:type_name -> google.protobuf.Empty + 107, // 15: ateapi.EgressMatch.all:type_name -> google.protobuf.Empty 17, // 16: ateapi.EgressMatch.hostname:type_name -> ateapi.HostnameMatch 18, // 17: ateapi.EgressMatch.ip_block:type_name -> ateapi.IPBlockMatch 20, // 18: ateapi.EgressRuleEffects.inject_static_header:type_name -> ateapi.StaticHeaderInjection @@ -6805,8 +6773,8 @@ var file_ateapi_proto_depIdxs = []int32{ 43, // 59: ateapi.Volume.durable_dir:type_name -> ateapi.DurableDirVolumeSource 44, // 60: ateapi.Volume.external_volume_template:type_name -> ateapi.ExternalVolumeTemplate 3, // 61: ateapi.SandboxAssets.sandbox_class:type_name -> ateapi.SandboxClass - 104, // 62: ateapi.SandboxAssets.assets:type_name -> ateapi.SandboxAssets.AssetsEntry - 105, // 63: ateapi.ArchAssets.files:type_name -> ateapi.ArchAssets.FilesEntry + 103, // 62: ateapi.SandboxAssets.assets:type_name -> ateapi.SandboxAssets.AssetsEntry + 104, // 63: ateapi.ArchAssets.files:type_name -> ateapi.ArchAssets.FilesEntry 29, // 64: ateapi.CreateAtespaceRequest.atespace:type_name -> ateapi.Atespace 30, // 65: ateapi.GetAtespaceRequest.atespace:type_name -> ateapi.ObjectRef 29, // 66: ateapi.ListAtespacesResponse.atespaces:type_name -> ateapi.Atespace @@ -6826,113 +6794,112 @@ var file_ateapi_proto_depIdxs = []int32{ 13, // 80: ateapi.ResumeActorResponse.actor:type_name -> ateapi.Actor 30, // 81: ateapi.DeleteActorRequest.actor:type_name -> ateapi.ObjectRef 30, // 82: ateapi.GetActorEgressPolicyRequest.actor:type_name -> ateapi.ObjectRef - 14, // 83: ateapi.GetActorEgressPolicyResponse.egress_policies:type_name -> ateapi.EgressPolicy - 30, // 84: ateapi.CreateActorEgressPolicyRequest.actor:type_name -> ateapi.ObjectRef - 14, // 85: ateapi.CreateActorEgressPolicyRequest.egress_policy:type_name -> ateapi.EgressPolicy - 30, // 86: ateapi.UpdateActorEgressPolicyRequest.actor:type_name -> ateapi.ObjectRef - 14, // 87: ateapi.UpdateActorEgressPolicyRequest.egress_policy:type_name -> ateapi.EgressPolicy - 30, // 88: ateapi.DeleteActorEgressPolicyRequest.actor:type_name -> ateapi.ObjectRef - 30, // 89: ateapi.GetActorSnapshotRequest.actor_snapshot:type_name -> ateapi.ObjectRef - 30, // 90: ateapi.GetActorSnapshotTagRequest.actor_snapshot_tag:type_name -> ateapi.ObjectRef - 26, // 91: ateapi.ListActorSnapshotsResponse.actor_snapshots:type_name -> ateapi.ActorSnapshot - 28, // 92: ateapi.CreateActorSnapshotTagRequest.actor_snapshot_tag:type_name -> ateapi.ActorSnapshotTag - 28, // 93: ateapi.UpdateActorSnapshotTagRequest.actor_snapshot_tag:type_name -> ateapi.ActorSnapshotTag - 30, // 94: ateapi.DeleteActorSnapshotTagRequest.actor_snapshot_tag:type_name -> ateapi.ObjectRef - 91, // 95: ateapi.ListWorkersResponse.workers:type_name -> ateapi.Worker - 30, // 96: ateapi.GetWorkerRequest.worker:type_name -> ateapi.ObjectRef - 91, // 97: ateapi.CreateWorkerRequest.worker:type_name -> ateapi.Worker - 91, // 98: ateapi.UpdateWorkerRequest.worker:type_name -> ateapi.Worker - 30, // 99: ateapi.DeleteWorkerRequest.worker:type_name -> ateapi.ObjectRef - 81, // 100: ateapi.DeleteWorkerRequest.options:type_name -> ateapi.DeleteOptions - 30, // 101: ateapi.DrainWorkerRequest.worker:type_name -> ateapi.ObjectRef - 13, // 102: ateapi.ListActorsResponse.actors:type_name -> ateapi.Actor - 11, // 103: ateapi.Worker.metadata:type_name -> ateapi.ResourceMetadata - 106, // 104: ateapi.Worker.labels:type_name -> ateapi.Worker.LabelsEntry - 93, // 105: ateapi.Worker.capacity:type_name -> ateapi.WorkerCapacity - 92, // 106: ateapi.Worker.status:type_name -> ateapi.WorkerStatus - 6, // 107: ateapi.WorkerStatus.state:type_name -> ateapi.WorkerState - 94, // 108: ateapi.WorkerStatus.assignment:type_name -> ateapi.ActorAssignment - 95, // 109: ateapi.ActorAssignment.actor_template:type_name -> ateapi.KubeNamespacedObjectRef - 30, // 110: ateapi.ActorAssignment.actor:type_name -> ateapi.ObjectRef - 30, // 111: ateapi.MintCertRequest.worker:type_name -> ateapi.ObjectRef - 7, // 112: ateapi.MintCertRequest.purpose:type_name -> ateapi.ActorCertificatePurpose - 47, // 113: ateapi.SandboxAssets.AssetsEntry.value:type_name -> ateapi.ArchAssets - 48, // 114: ateapi.ArchAssets.FilesEntry.value:type_name -> ateapi.AssetFile - 59, // 115: ateapi.Control.GetActor:input_type -> ateapi.GetActorRequest - 60, // 116: ateapi.Control.CreateActor:input_type -> ateapi.CreateActorRequest - 61, // 117: ateapi.Control.UpdateActor:input_type -> ateapi.UpdateActorRequest - 62, // 118: ateapi.Control.SuspendActor:input_type -> ateapi.SuspendActorRequest - 64, // 119: ateapi.Control.PauseActor:input_type -> ateapi.PauseActorRequest - 66, // 120: ateapi.Control.ResumeActor:input_type -> ateapi.ResumeActorRequest - 68, // 121: ateapi.Control.DeleteActor:input_type -> ateapi.DeleteActorRequest - 69, // 122: ateapi.Control.GetActorEgressPolicy:input_type -> ateapi.GetActorEgressPolicyRequest - 71, // 123: ateapi.Control.CreateActorEgressPolicy:input_type -> ateapi.CreateActorEgressPolicyRequest - 72, // 124: ateapi.Control.UpdateActorEgressPolicy:input_type -> ateapi.UpdateActorEgressPolicyRequest - 73, // 125: ateapi.Control.DeleteActorEgressPolicy:input_type -> ateapi.DeleteActorEgressPolicyRequest - 74, // 126: ateapi.Control.GetActorSnapshot:input_type -> ateapi.GetActorSnapshotRequest - 75, // 127: ateapi.Control.GetActorSnapshotTag:input_type -> ateapi.GetActorSnapshotTagRequest - 76, // 128: ateapi.Control.ListActorSnapshots:input_type -> ateapi.ListActorSnapshotsRequest - 78, // 129: ateapi.Control.CreateActorSnapshotTag:input_type -> ateapi.CreateActorSnapshotTagRequest - 79, // 130: ateapi.Control.UpdateActorSnapshotTag:input_type -> ateapi.UpdateActorSnapshotTagRequest - 80, // 131: ateapi.Control.DeleteActorSnapshotTag:input_type -> ateapi.DeleteActorSnapshotTagRequest - 82, // 132: ateapi.Control.ListWorkers:input_type -> ateapi.ListWorkersRequest - 84, // 133: ateapi.Control.GetWorker:input_type -> ateapi.GetWorkerRequest - 85, // 134: ateapi.Control.CreateWorker:input_type -> ateapi.CreateWorkerRequest - 86, // 135: ateapi.Control.UpdateWorker:input_type -> ateapi.UpdateWorkerRequest - 87, // 136: ateapi.Control.DeleteWorker:input_type -> ateapi.DeleteWorkerRequest - 88, // 137: ateapi.Control.DrainWorker:input_type -> ateapi.DrainWorkerRequest - 89, // 138: ateapi.Control.ListActors:input_type -> ateapi.ListActorsRequest - 49, // 139: ateapi.Control.CreateAtespace:input_type -> ateapi.CreateAtespaceRequest - 50, // 140: ateapi.Control.GetAtespace:input_type -> ateapi.GetAtespaceRequest - 51, // 141: ateapi.Control.ListAtespaces:input_type -> ateapi.ListAtespacesRequest - 53, // 142: ateapi.Control.DeleteAtespace:input_type -> ateapi.DeleteAtespaceRequest - 54, // 143: ateapi.Control.CreateActorTemplate:input_type -> ateapi.CreateActorTemplateRequest - 55, // 144: ateapi.Control.GetActorTemplate:input_type -> ateapi.GetActorTemplateRequest - 56, // 145: ateapi.Control.ListActorTemplates:input_type -> ateapi.ListActorTemplatesRequest - 58, // 146: ateapi.Control.DeleteActorTemplate:input_type -> ateapi.DeleteActorTemplateRequest - 96, // 147: ateapi.Debug.DebugClear:input_type -> ateapi.DebugClearRequest - 98, // 148: ateapi.ActorIdentity.MintJWT:input_type -> ateapi.MintJWTRequest - 100, // 149: ateapi.ActorIdentity.MintCert:input_type -> ateapi.MintCertRequest - 13, // 150: ateapi.Control.GetActor:output_type -> ateapi.Actor - 13, // 151: ateapi.Control.CreateActor:output_type -> ateapi.Actor - 13, // 152: ateapi.Control.UpdateActor:output_type -> ateapi.Actor - 63, // 153: ateapi.Control.SuspendActor:output_type -> ateapi.SuspendActorResponse - 65, // 154: ateapi.Control.PauseActor:output_type -> ateapi.PauseActorResponse - 67, // 155: ateapi.Control.ResumeActor:output_type -> ateapi.ResumeActorResponse - 13, // 156: ateapi.Control.DeleteActor:output_type -> ateapi.Actor - 70, // 157: ateapi.Control.GetActorEgressPolicy:output_type -> ateapi.GetActorEgressPolicyResponse - 14, // 158: ateapi.Control.CreateActorEgressPolicy:output_type -> ateapi.EgressPolicy - 14, // 159: ateapi.Control.UpdateActorEgressPolicy:output_type -> ateapi.EgressPolicy - 14, // 160: ateapi.Control.DeleteActorEgressPolicy:output_type -> ateapi.EgressPolicy - 26, // 161: ateapi.Control.GetActorSnapshot:output_type -> ateapi.ActorSnapshot - 28, // 162: ateapi.Control.GetActorSnapshotTag:output_type -> ateapi.ActorSnapshotTag - 77, // 163: ateapi.Control.ListActorSnapshots:output_type -> ateapi.ListActorSnapshotsResponse - 28, // 164: ateapi.Control.CreateActorSnapshotTag:output_type -> ateapi.ActorSnapshotTag - 28, // 165: ateapi.Control.UpdateActorSnapshotTag:output_type -> ateapi.ActorSnapshotTag - 28, // 166: ateapi.Control.DeleteActorSnapshotTag:output_type -> ateapi.ActorSnapshotTag - 83, // 167: ateapi.Control.ListWorkers:output_type -> ateapi.ListWorkersResponse - 91, // 168: ateapi.Control.GetWorker:output_type -> ateapi.Worker - 91, // 169: ateapi.Control.CreateWorker:output_type -> ateapi.Worker - 91, // 170: ateapi.Control.UpdateWorker:output_type -> ateapi.Worker - 91, // 171: ateapi.Control.DeleteWorker:output_type -> ateapi.Worker - 91, // 172: ateapi.Control.DrainWorker:output_type -> ateapi.Worker - 90, // 173: ateapi.Control.ListActors:output_type -> ateapi.ListActorsResponse - 29, // 174: ateapi.Control.CreateAtespace:output_type -> ateapi.Atespace - 29, // 175: ateapi.Control.GetAtespace:output_type -> ateapi.Atespace - 52, // 176: ateapi.Control.ListAtespaces:output_type -> ateapi.ListAtespacesResponse - 29, // 177: ateapi.Control.DeleteAtespace:output_type -> ateapi.Atespace - 31, // 178: ateapi.Control.CreateActorTemplate:output_type -> ateapi.ActorTemplate - 31, // 179: ateapi.Control.GetActorTemplate:output_type -> ateapi.ActorTemplate - 57, // 180: ateapi.Control.ListActorTemplates:output_type -> ateapi.ListActorTemplatesResponse - 31, // 181: ateapi.Control.DeleteActorTemplate:output_type -> ateapi.ActorTemplate - 97, // 182: ateapi.Debug.DebugClear:output_type -> ateapi.DebugClearResponse - 99, // 183: ateapi.ActorIdentity.MintJWT:output_type -> ateapi.MintJWTResponse - 101, // 184: ateapi.ActorIdentity.MintCert:output_type -> ateapi.MintCertResponse - 150, // [150:185] is the sub-list for method output_type - 115, // [115:150] is the sub-list for method input_type - 115, // [115:115] is the sub-list for extension type_name - 115, // [115:115] is the sub-list for extension extendee - 0, // [0:115] is the sub-list for field type_name + 30, // 83: ateapi.CreateActorEgressPolicyRequest.actor:type_name -> ateapi.ObjectRef + 14, // 84: ateapi.CreateActorEgressPolicyRequest.egress_policy:type_name -> ateapi.EgressPolicy + 30, // 85: ateapi.UpdateActorEgressPolicyRequest.actor:type_name -> ateapi.ObjectRef + 14, // 86: ateapi.UpdateActorEgressPolicyRequest.egress_policy:type_name -> ateapi.EgressPolicy + 30, // 87: ateapi.DeleteActorEgressPolicyRequest.actor:type_name -> ateapi.ObjectRef + 30, // 88: ateapi.GetActorSnapshotRequest.actor_snapshot:type_name -> ateapi.ObjectRef + 30, // 89: ateapi.GetActorSnapshotTagRequest.actor_snapshot_tag:type_name -> ateapi.ObjectRef + 26, // 90: ateapi.ListActorSnapshotsResponse.actor_snapshots:type_name -> ateapi.ActorSnapshot + 28, // 91: ateapi.CreateActorSnapshotTagRequest.actor_snapshot_tag:type_name -> ateapi.ActorSnapshotTag + 28, // 92: ateapi.UpdateActorSnapshotTagRequest.actor_snapshot_tag:type_name -> ateapi.ActorSnapshotTag + 30, // 93: ateapi.DeleteActorSnapshotTagRequest.actor_snapshot_tag:type_name -> ateapi.ObjectRef + 90, // 94: ateapi.ListWorkersResponse.workers:type_name -> ateapi.Worker + 30, // 95: ateapi.GetWorkerRequest.worker:type_name -> ateapi.ObjectRef + 90, // 96: ateapi.CreateWorkerRequest.worker:type_name -> ateapi.Worker + 90, // 97: ateapi.UpdateWorkerRequest.worker:type_name -> ateapi.Worker + 30, // 98: ateapi.DeleteWorkerRequest.worker:type_name -> ateapi.ObjectRef + 80, // 99: ateapi.DeleteWorkerRequest.options:type_name -> ateapi.DeleteOptions + 30, // 100: ateapi.DrainWorkerRequest.worker:type_name -> ateapi.ObjectRef + 13, // 101: ateapi.ListActorsResponse.actors:type_name -> ateapi.Actor + 11, // 102: ateapi.Worker.metadata:type_name -> ateapi.ResourceMetadata + 105, // 103: ateapi.Worker.labels:type_name -> ateapi.Worker.LabelsEntry + 92, // 104: ateapi.Worker.capacity:type_name -> ateapi.WorkerCapacity + 91, // 105: ateapi.Worker.status:type_name -> ateapi.WorkerStatus + 6, // 106: ateapi.WorkerStatus.state:type_name -> ateapi.WorkerState + 93, // 107: ateapi.WorkerStatus.assignment:type_name -> ateapi.ActorAssignment + 94, // 108: ateapi.ActorAssignment.actor_template:type_name -> ateapi.KubeNamespacedObjectRef + 30, // 109: ateapi.ActorAssignment.actor:type_name -> ateapi.ObjectRef + 30, // 110: ateapi.MintCertRequest.worker:type_name -> ateapi.ObjectRef + 7, // 111: ateapi.MintCertRequest.purpose:type_name -> ateapi.ActorCertificatePurpose + 47, // 112: ateapi.SandboxAssets.AssetsEntry.value:type_name -> ateapi.ArchAssets + 48, // 113: ateapi.ArchAssets.FilesEntry.value:type_name -> ateapi.AssetFile + 59, // 114: ateapi.Control.GetActor:input_type -> ateapi.GetActorRequest + 60, // 115: ateapi.Control.CreateActor:input_type -> ateapi.CreateActorRequest + 61, // 116: ateapi.Control.UpdateActor:input_type -> ateapi.UpdateActorRequest + 62, // 117: ateapi.Control.SuspendActor:input_type -> ateapi.SuspendActorRequest + 64, // 118: ateapi.Control.PauseActor:input_type -> ateapi.PauseActorRequest + 66, // 119: ateapi.Control.ResumeActor:input_type -> ateapi.ResumeActorRequest + 68, // 120: ateapi.Control.DeleteActor:input_type -> ateapi.DeleteActorRequest + 69, // 121: ateapi.Control.GetActorEgressPolicy:input_type -> ateapi.GetActorEgressPolicyRequest + 70, // 122: ateapi.Control.CreateActorEgressPolicy:input_type -> ateapi.CreateActorEgressPolicyRequest + 71, // 123: ateapi.Control.UpdateActorEgressPolicy:input_type -> ateapi.UpdateActorEgressPolicyRequest + 72, // 124: ateapi.Control.DeleteActorEgressPolicy:input_type -> ateapi.DeleteActorEgressPolicyRequest + 73, // 125: ateapi.Control.GetActorSnapshot:input_type -> ateapi.GetActorSnapshotRequest + 74, // 126: ateapi.Control.GetActorSnapshotTag:input_type -> ateapi.GetActorSnapshotTagRequest + 75, // 127: ateapi.Control.ListActorSnapshots:input_type -> ateapi.ListActorSnapshotsRequest + 77, // 128: ateapi.Control.CreateActorSnapshotTag:input_type -> ateapi.CreateActorSnapshotTagRequest + 78, // 129: ateapi.Control.UpdateActorSnapshotTag:input_type -> ateapi.UpdateActorSnapshotTagRequest + 79, // 130: ateapi.Control.DeleteActorSnapshotTag:input_type -> ateapi.DeleteActorSnapshotTagRequest + 81, // 131: ateapi.Control.ListWorkers:input_type -> ateapi.ListWorkersRequest + 83, // 132: ateapi.Control.GetWorker:input_type -> ateapi.GetWorkerRequest + 84, // 133: ateapi.Control.CreateWorker:input_type -> ateapi.CreateWorkerRequest + 85, // 134: ateapi.Control.UpdateWorker:input_type -> ateapi.UpdateWorkerRequest + 86, // 135: ateapi.Control.DeleteWorker:input_type -> ateapi.DeleteWorkerRequest + 87, // 136: ateapi.Control.DrainWorker:input_type -> ateapi.DrainWorkerRequest + 88, // 137: ateapi.Control.ListActors:input_type -> ateapi.ListActorsRequest + 49, // 138: ateapi.Control.CreateAtespace:input_type -> ateapi.CreateAtespaceRequest + 50, // 139: ateapi.Control.GetAtespace:input_type -> ateapi.GetAtespaceRequest + 51, // 140: ateapi.Control.ListAtespaces:input_type -> ateapi.ListAtespacesRequest + 53, // 141: ateapi.Control.DeleteAtespace:input_type -> ateapi.DeleteAtespaceRequest + 54, // 142: ateapi.Control.CreateActorTemplate:input_type -> ateapi.CreateActorTemplateRequest + 55, // 143: ateapi.Control.GetActorTemplate:input_type -> ateapi.GetActorTemplateRequest + 56, // 144: ateapi.Control.ListActorTemplates:input_type -> ateapi.ListActorTemplatesRequest + 58, // 145: ateapi.Control.DeleteActorTemplate:input_type -> ateapi.DeleteActorTemplateRequest + 95, // 146: ateapi.Debug.DebugClear:input_type -> ateapi.DebugClearRequest + 97, // 147: ateapi.ActorIdentity.MintJWT:input_type -> ateapi.MintJWTRequest + 99, // 148: ateapi.ActorIdentity.MintCert:input_type -> ateapi.MintCertRequest + 13, // 149: ateapi.Control.GetActor:output_type -> ateapi.Actor + 13, // 150: ateapi.Control.CreateActor:output_type -> ateapi.Actor + 13, // 151: ateapi.Control.UpdateActor:output_type -> ateapi.Actor + 63, // 152: ateapi.Control.SuspendActor:output_type -> ateapi.SuspendActorResponse + 65, // 153: ateapi.Control.PauseActor:output_type -> ateapi.PauseActorResponse + 67, // 154: ateapi.Control.ResumeActor:output_type -> ateapi.ResumeActorResponse + 13, // 155: ateapi.Control.DeleteActor:output_type -> ateapi.Actor + 14, // 156: ateapi.Control.GetActorEgressPolicy:output_type -> ateapi.EgressPolicy + 14, // 157: ateapi.Control.CreateActorEgressPolicy:output_type -> ateapi.EgressPolicy + 14, // 158: ateapi.Control.UpdateActorEgressPolicy:output_type -> ateapi.EgressPolicy + 14, // 159: ateapi.Control.DeleteActorEgressPolicy:output_type -> ateapi.EgressPolicy + 26, // 160: ateapi.Control.GetActorSnapshot:output_type -> ateapi.ActorSnapshot + 28, // 161: ateapi.Control.GetActorSnapshotTag:output_type -> ateapi.ActorSnapshotTag + 76, // 162: ateapi.Control.ListActorSnapshots:output_type -> ateapi.ListActorSnapshotsResponse + 28, // 163: ateapi.Control.CreateActorSnapshotTag:output_type -> ateapi.ActorSnapshotTag + 28, // 164: ateapi.Control.UpdateActorSnapshotTag:output_type -> ateapi.ActorSnapshotTag + 28, // 165: ateapi.Control.DeleteActorSnapshotTag:output_type -> ateapi.ActorSnapshotTag + 82, // 166: ateapi.Control.ListWorkers:output_type -> ateapi.ListWorkersResponse + 90, // 167: ateapi.Control.GetWorker:output_type -> ateapi.Worker + 90, // 168: ateapi.Control.CreateWorker:output_type -> ateapi.Worker + 90, // 169: ateapi.Control.UpdateWorker:output_type -> ateapi.Worker + 90, // 170: ateapi.Control.DeleteWorker:output_type -> ateapi.Worker + 90, // 171: ateapi.Control.DrainWorker:output_type -> ateapi.Worker + 89, // 172: ateapi.Control.ListActors:output_type -> ateapi.ListActorsResponse + 29, // 173: ateapi.Control.CreateAtespace:output_type -> ateapi.Atespace + 29, // 174: ateapi.Control.GetAtespace:output_type -> ateapi.Atespace + 52, // 175: ateapi.Control.ListAtespaces:output_type -> ateapi.ListAtespacesResponse + 29, // 176: ateapi.Control.DeleteAtespace:output_type -> ateapi.Atespace + 31, // 177: ateapi.Control.CreateActorTemplate:output_type -> ateapi.ActorTemplate + 31, // 178: ateapi.Control.GetActorTemplate:output_type -> ateapi.ActorTemplate + 57, // 179: ateapi.Control.ListActorTemplates:output_type -> ateapi.ListActorTemplatesResponse + 31, // 180: ateapi.Control.DeleteActorTemplate:output_type -> ateapi.ActorTemplate + 96, // 181: ateapi.Debug.DebugClear:output_type -> ateapi.DebugClearResponse + 98, // 182: ateapi.ActorIdentity.MintJWT:output_type -> ateapi.MintJWTResponse + 100, // 183: ateapi.ActorIdentity.MintCert:output_type -> ateapi.MintCertResponse + 149, // [149:184] is the sub-list for method output_type + 114, // [114:149] is the sub-list for method input_type + 114, // [114:114] is the sub-list for extension type_name + 114, // [114:114] is the sub-list for extension extendee + 0, // [0:114] is the sub-list for field type_name } func init() { file_ateapi_proto_init() } @@ -6946,7 +6913,7 @@ func file_ateapi_proto_init() { GoPackagePath: reflect.TypeOf(x{}).PkgPath(), RawDescriptor: unsafe.Slice(unsafe.StringData(file_ateapi_proto_rawDesc), len(file_ateapi_proto_rawDesc)), NumEnums: 9, - NumMessages: 98, + NumMessages: 97, NumExtensions: 0, NumServices: 3, }, diff --git a/pkg/proto/ateapipb/ateapi.proto b/pkg/proto/ateapipb/ateapi.proto index cbaeafdc64..ac4508a56d 100644 --- a/pkg/proto/ateapipb/ateapi.proto +++ b/pkg/proto/ateapipb/ateapi.proto @@ -46,17 +46,16 @@ service Control { // Delete an actor. Only suspended actors can be deleted. rpc DeleteActor(DeleteActorRequest) returns (Actor) {} - // Get all egress policy documents nested under an Actor. V0 returns zero or - // one document. - rpc GetActorEgressPolicy(GetActorEgressPolicyRequest) returns (GetActorEgressPolicyResponse) {} + // Get the egress policy resource nested under an Actor. + rpc GetActorEgressPolicy(GetActorEgressPolicyRequest) returns (EgressPolicy) {} - // Create the egress policy document nested under an Actor. + // Create the egress policy resource nested under an Actor. rpc CreateActorEgressPolicy(CreateActorEgressPolicyRequest) returns (EgressPolicy) {} - // Replace the egress policy document nested under an Actor. + // Replace the egress policy resource nested under an Actor. rpc UpdateActorEgressPolicy(UpdateActorEgressPolicyRequest) returns (EgressPolicy) {} - // Delete all egress policy documents nested under an Actor. + // Delete the egress policy resource nested under an Actor. rpc DeleteActorEgressPolicy(DeleteActorEgressPolicyRequest) returns (EgressPolicy) {} // Get an ActorSnapshot. @@ -304,14 +303,12 @@ message Actor { ActorStatus status = 7; } -// EgressPolicy is a policy document nested under an Actor. All documents for -// an Actor comprise one logical policy and have the same evaluation semantics -// as one document containing their combined rules. V0 permits one document -// named "default" per Actor. +// EgressPolicy is an egress policy resource nested under an Actor. An Actor has +// at most one egress policy resource, named "default" by the server. message EgressPolicy { // Standard resource metadata. Atespace is inherited from the parent Actor - // and, in v0, name is always "default". These identity fields, UID, version, - // create_time, and update_time are server-managed. + // and name is "default". These identity fields, UID, version, create_time, + // and update_time are server-managed. // // +k8s:required // +k8s:opaqueType @@ -337,17 +334,21 @@ message EgressRule { } message EgressMatch { - // Exactly one predicate must be set. + // Matches every destination. Exactly one predicate must be set. // // +k8s:optional // +k8s:unionMember // +k8s:opaqueType google.protobuf.Empty all = 1; + // Matches when the request hostname satisfies the configured pattern. + // // +k8s:optional // +k8s:unionMember HostnameMatch hostname = 2; + // Matches when the original destination IP belongs to the configured block. + // // +k8s:optional // +k8s:unionMember IPBlockMatch ip_block = 3; @@ -382,14 +383,18 @@ message IPBlockMatch { string cidr = 1; } +// EgressRuleEffects contains non-mutually-exclusive effects. No two effects in +// a policy may target the same case-insensitive header. message EgressRuleEffects { - // These fields are not mutually exclusive. No two effects in a policy may - // target the same case-insensitive header. + // Injects values retrieved from credential providers into request headers. repeated StaticHeaderInjection inject_static_header = 1; + + // Injects an Actor JWT, or its exchanged token, into a request header. ActorTokenInjection inject_actor_jwt = 2; } message StaticHeaderInjection { + // The case-insensitive HTTP request header to inject. string header = 1; // For example, "Bearer " for the Authorization header. @@ -401,7 +406,10 @@ message StaticHeaderInjection { } message ActorTokenInjection { + // The case-insensitive HTTP request header to inject. string header = 1; + + // Audiences included in the minted Actor JWT. repeated string audiences = 2; // When present, exchanges the Actor JWT at an RFC 8693 endpoint and injects @@ -410,11 +418,21 @@ message ActorTokenInjection { } message RFC8693ExchangeParameters { + // The HTTPS URL of the RFC 8693 token exchange endpoint. string url = 1; + + // Resource indicators sent in the token exchange request. repeated string resources = 2; + + // Audience values sent in the token exchange request. repeated string audiences = 3; + + // The requested access scope sent in the token exchange request. string scope = 4; + + // The requested token type sent in the token exchange request. string requested_token_type = 5; + // subject_token and subject_token_type are set automatically. actor_token // and actor_token_type are not used for this flow. } @@ -999,19 +1017,16 @@ message DeleteActorRequest { } message GetActorEgressPolicyRequest { + // The parent Actor of the egress policy resource to retrieve. + // // +k8s:required // +k8s:opaqueType ObjectRef actor = 1; } -message GetActorEgressPolicyResponse { - // Empty when the Actor has no policy. V0 returns at most one document. - repeated EgressPolicy egress_policies = 1; -} - message CreateActorEgressPolicyRequest { - // Parent Actor. V0 creates the policy document named "default" under this - // Actor, so no policy name is supplied. + // Parent Actor. The server creates the policy resource named "default" + // under this Actor, so no policy name is supplied. // // +k8s:required // +k8s:opaqueType @@ -1025,8 +1040,8 @@ message CreateActorEgressPolicyRequest { } message UpdateActorEgressPolicyRequest { - // Parent Actor. V0 updates the policy document named "default" under this - // Actor, so no policy name is supplied. + // Parent Actor. The server updates the policy resource named "default" + // under this Actor, so no policy name is supplied. // // +k8s:required // +k8s:opaqueType @@ -1041,6 +1056,8 @@ message UpdateActorEgressPolicyRequest { } message DeleteActorEgressPolicyRequest { + // The parent Actor of the egress policy resource to delete. + // // +k8s:required // +k8s:opaqueType ObjectRef actor = 1; diff --git a/pkg/proto/ateapipb/ateapi_grpc.pb.go b/pkg/proto/ateapipb/ateapi_grpc.pb.go index 19357ed3a1..0bb9f4b383 100644 --- a/pkg/proto/ateapipb/ateapi_grpc.pb.go +++ b/pkg/proto/ateapipb/ateapi_grpc.pb.go @@ -89,14 +89,13 @@ type ControlClient interface { ResumeActor(ctx context.Context, in *ResumeActorRequest, opts ...grpc.CallOption) (*ResumeActorResponse, error) // Delete an actor. Only suspended actors can be deleted. DeleteActor(ctx context.Context, in *DeleteActorRequest, opts ...grpc.CallOption) (*Actor, error) - // Get all egress policy documents nested under an Actor. V0 returns zero or - // one document. - GetActorEgressPolicy(ctx context.Context, in *GetActorEgressPolicyRequest, opts ...grpc.CallOption) (*GetActorEgressPolicyResponse, error) - // Create the egress policy document nested under an Actor. + // Get the egress policy resource nested under an Actor. + GetActorEgressPolicy(ctx context.Context, in *GetActorEgressPolicyRequest, opts ...grpc.CallOption) (*EgressPolicy, error) + // Create the egress policy resource nested under an Actor. CreateActorEgressPolicy(ctx context.Context, in *CreateActorEgressPolicyRequest, opts ...grpc.CallOption) (*EgressPolicy, error) - // Replace the egress policy document nested under an Actor. + // Replace the egress policy resource nested under an Actor. UpdateActorEgressPolicy(ctx context.Context, in *UpdateActorEgressPolicyRequest, opts ...grpc.CallOption) (*EgressPolicy, error) - // Delete all egress policy documents nested under an Actor. + // Delete the egress policy resource nested under an Actor. DeleteActorEgressPolicy(ctx context.Context, in *DeleteActorEgressPolicyRequest, opts ...grpc.CallOption) (*EgressPolicy, error) // Get an ActorSnapshot. GetActorSnapshot(ctx context.Context, in *GetActorSnapshotRequest, opts ...grpc.CallOption) (*ActorSnapshot, error) @@ -223,9 +222,9 @@ func (c *controlClient) DeleteActor(ctx context.Context, in *DeleteActorRequest, return out, nil } -func (c *controlClient) GetActorEgressPolicy(ctx context.Context, in *GetActorEgressPolicyRequest, opts ...grpc.CallOption) (*GetActorEgressPolicyResponse, error) { +func (c *controlClient) GetActorEgressPolicy(ctx context.Context, in *GetActorEgressPolicyRequest, opts ...grpc.CallOption) (*EgressPolicy, error) { cOpts := append([]grpc.CallOption{grpc.StaticMethod()}, opts...) - out := new(GetActorEgressPolicyResponse) + out := new(EgressPolicy) err := c.cc.Invoke(ctx, Control_GetActorEgressPolicy_FullMethodName, in, out, cOpts...) if err != nil { return nil, err @@ -495,14 +494,13 @@ type ControlServer interface { ResumeActor(context.Context, *ResumeActorRequest) (*ResumeActorResponse, error) // Delete an actor. Only suspended actors can be deleted. DeleteActor(context.Context, *DeleteActorRequest) (*Actor, error) - // Get all egress policy documents nested under an Actor. V0 returns zero or - // one document. - GetActorEgressPolicy(context.Context, *GetActorEgressPolicyRequest) (*GetActorEgressPolicyResponse, error) - // Create the egress policy document nested under an Actor. + // Get the egress policy resource nested under an Actor. + GetActorEgressPolicy(context.Context, *GetActorEgressPolicyRequest) (*EgressPolicy, error) + // Create the egress policy resource nested under an Actor. CreateActorEgressPolicy(context.Context, *CreateActorEgressPolicyRequest) (*EgressPolicy, error) - // Replace the egress policy document nested under an Actor. + // Replace the egress policy resource nested under an Actor. UpdateActorEgressPolicy(context.Context, *UpdateActorEgressPolicyRequest) (*EgressPolicy, error) - // Delete all egress policy documents nested under an Actor. + // Delete the egress policy resource nested under an Actor. DeleteActorEgressPolicy(context.Context, *DeleteActorEgressPolicyRequest) (*EgressPolicy, error) // Get an ActorSnapshot. GetActorSnapshot(context.Context, *GetActorSnapshotRequest) (*ActorSnapshot, error) @@ -580,7 +578,7 @@ func (UnimplementedControlServer) ResumeActor(context.Context, *ResumeActorReque func (UnimplementedControlServer) DeleteActor(context.Context, *DeleteActorRequest) (*Actor, error) { return nil, status.Error(codes.Unimplemented, "method DeleteActor not implemented") } -func (UnimplementedControlServer) GetActorEgressPolicy(context.Context, *GetActorEgressPolicyRequest) (*GetActorEgressPolicyResponse, error) { +func (UnimplementedControlServer) GetActorEgressPolicy(context.Context, *GetActorEgressPolicyRequest) (*EgressPolicy, error) { return nil, status.Error(codes.Unimplemented, "method GetActorEgressPolicy not implemented") } func (UnimplementedControlServer) CreateActorEgressPolicy(context.Context, *CreateActorEgressPolicyRequest) (*EgressPolicy, error) { From f1248a0a0ce90d3b71d0900ce71b1ab6d3d1b5de Mon Sep 17 00:00:00 2001 From: Eitan Yarmush Date: Wed, 26 Aug 2026 22:06:47 +0000 Subject: [PATCH 9/9] Align egress policy validation with Actor API Signed-off-by: Eitan Yarmush --- .../internal/controlapi/egress_policy.go | 144 +++--- .../internal/controlapi/egress_policy_test.go | 107 ++++- .../controlapi/zz_generated.validation.go | 423 +++++++++++++++++- pkg/proto/ateapipb/ateapi.pb.go | 53 ++- pkg/proto/ateapipb/ateapi.proto | 53 ++- 5 files changed, 652 insertions(+), 128 deletions(-) diff --git a/cmd/ateapi/internal/controlapi/egress_policy.go b/cmd/ateapi/internal/controlapi/egress_policy.go index 9c25b5faed..ac78f7f8b7 100644 --- a/cmd/ateapi/internal/controlapi/egress_policy.go +++ b/cmd/ateapi/internal/controlapi/egress_policy.go @@ -34,7 +34,7 @@ import ( ) func (s *RPCService) GetActorEgressPolicy(ctx context.Context, req *ateapipb.GetActorEgressPolicyRequest) (*ateapipb.EgressPolicy, error) { - if errs := validateActorRef(req.GetActor(), field.NewPath("actor")); len(errs) > 0 { + if errs := Validate_GetActorEgressPolicyRequest(ctx, operation.Operation{Type: operation.Create}, nil, req, nil); len(errs) > 0 { return nil, toGRPCStatusError(errs) } policy, err := s.impl.GetEgressPolicy(ctx, resources.ActorRefFromObjectRef(req.GetActor())) @@ -48,11 +48,11 @@ func (s *RPCService) GetActorEgressPolicy(ctx context.Context, req *ateapipb.Get } func (s *RPCService) CreateActorEgressPolicy(ctx context.Context, req *ateapipb.CreateActorEgressPolicyRequest) (*ateapipb.EgressPolicy, error) { - var errs field.ErrorList - errs = append(errs, validateActorRef(req.GetActor(), field.NewPath("actor"))...) policy := req.GetEgressPolicy() - errs = append(errs, validateEgressPolicy(ctx, policy, "", false)...) - if len(errs) > 0 { + if policy != nil { + scrubResourceMetadataForCreate(policy.Metadata) + } + if errs := validateCreateActorEgressPolicyRequest(ctx, req); len(errs) > 0 { return nil, toGRPCStatusError(errs) } actorRef := resources.ActorRefFromObjectRef(req.GetActor()) @@ -62,11 +62,11 @@ func (s *RPCService) CreateActorEgressPolicy(ctx context.Context, req *ateapipb. } func (s *RPCService) UpdateActorEgressPolicy(ctx context.Context, req *ateapipb.UpdateActorEgressPolicyRequest) (*ateapipb.EgressPolicy, error) { - var errs field.ErrorList - errs = append(errs, validateActorRef(req.GetActor(), field.NewPath("actor"))...) policy := req.GetEgressPolicy() - errs = append(errs, validateEgressPolicy(ctx, policy, req.GetActor().GetAtespace(), true)...) - if len(errs) > 0 { + if policy != nil { + scrubResourceMetadataForUpdate(policy.Metadata) + } + if errs := validateUpdateActorEgressPolicyRequest(ctx, req); len(errs) > 0 { return nil, toGRPCStatusError(errs) } actorRef := resources.ActorRefFromObjectRef(req.GetActor()) @@ -79,7 +79,7 @@ func (s *RPCService) UpdateActorEgressPolicy(ctx context.Context, req *ateapipb. } func (s *RPCService) DeleteActorEgressPolicy(ctx context.Context, req *ateapipb.DeleteActorEgressPolicyRequest) (*ateapipb.EgressPolicy, error) { - if errs := validateActorRef(req.GetActor(), field.NewPath("actor")); len(errs) > 0 { + if errs := Validate_DeleteActorEgressPolicyRequest(ctx, operation.Operation{Type: operation.Create}, nil, req, nil); len(errs) > 0 { return nil, toGRPCStatusError(errs) } policy, err := s.impl.DeleteEgressPolicy(ctx, resources.ActorRefFromObjectRef(req.GetActor())) @@ -102,36 +102,49 @@ func (s *ServiceImpl) DeleteEgressPolicy(ctx context.Context, actorRef resources return s.store.DeleteEgressPolicy(ctx, actorRef) } -func validateActorRef(ref *ateapipb.ObjectRef, p *field.Path) field.ErrorList { - if ref == nil { - return field.ErrorList{field.Required(p, "")} - } - return resources.ValidateObjectRef(ref, p) +func validateCreateActorEgressPolicyRequest(ctx context.Context, req *ateapipb.CreateActorEgressPolicyRequest) field.ErrorList { + errs := Validate_CreateActorEgressPolicyRequest(ctx, operation.Operation{Type: operation.Create}, nil, req, nil) + errs = append(errs, validateNoUnknownFields(req.GetEgressPolicy(), field.NewPath("egress_policy"))...) + return errs +} + +func validateUpdateActorEgressPolicyRequest(ctx context.Context, req *ateapipb.UpdateActorEgressPolicyRequest) field.ErrorList { + errs := Validate_UpdateActorEgressPolicyRequest(ctx, operation.Operation{Type: operation.Create}, nil, req, nil) + errs = append(errs, validateNoUnknownFields(req.GetEgressPolicy(), field.NewPath("egress_policy"))...) + return errs +} + +func ValidateCustom_CreateActorEgressPolicyRequest(_ context.Context, _ operation.Operation, p *field.Path, req, _ *ateapipb.CreateActorEgressPolicyRequest) field.ErrorList { + return validateEgressPolicyParentAtespace(req.GetActor(), req.GetEgressPolicy(), p) +} + +func ValidateCustom_UpdateActorEgressPolicyRequest(_ context.Context, _ operation.Operation, p *field.Path, req, _ *ateapipb.UpdateActorEgressPolicyRequest) field.ErrorList { + return validateEgressPolicyParentAtespace(req.GetActor(), req.GetEgressPolicy(), p) } -func validateEgressPolicy(ctx context.Context, policy *ateapipb.EgressPolicy, actorAtespace string, requireVersion bool) field.ErrorList { - root := field.NewPath("egress_policy") - if policy == nil { - return field.ErrorList{field.Required(root, "")} +func validateEgressPolicyParentAtespace(actor *ateapipb.ObjectRef, policy *ateapipb.EgressPolicy, p *field.Path) field.ErrorList { + if actor == nil || policy.GetMetadata() == nil || actor.GetAtespace() == "" || policy.GetMetadata().GetAtespace() == "" || actor.GetAtespace() == policy.GetMetadata().GetAtespace() { + return nil } + return field.ErrorList{field.Invalid(p.Child("egress_policy", "metadata", "atespace"), policy.GetMetadata().GetAtespace(), "must match actor.atespace")} +} + +func ValidateCustom_EgressPolicy(_ context.Context, _ operation.Operation, root *field.Path, policy, _ *ateapipb.EgressPolicy) field.ErrorList { var errs field.ErrorList - errs = append(errs, validateEgressPolicyMetadata(policy.GetMetadata(), actorAtespace, requireVersion, root.Child("metadata"))...) + if name := policy.GetMetadata().GetName(); name != "" && name != "default" { + errs = append(errs, field.Invalid(root.Child("metadata", "name"), name, `must be "default"`)) + } seenHeaders := map[string]bool{} for i, rule := range policy.GetRules() { rulePath := root.Child("rules").Index(i) if rule == nil { - errs = append(errs, field.Required(rulePath, "")) continue } - if len(rule.GetAllow()) == 0 { - errs = append(errs, field.Required(rulePath.Child("allow"), "")) - } seenMatches := map[string]bool{} onlyExactHostnames := len(rule.GetAllow()) > 0 for j, match := range rule.GetAllow() { matchPath := rulePath.Child("allow").Index(j) - key, exactHostname, matchErrs := validateEgressMatch(ctx, match, matchPath) - errs = append(errs, matchErrs...) + key, exactHostname := egressMatchKey(match) onlyExactHostnames = onlyExactHostnames && exactHostname if key != "" && seenMatches[key] { errs = append(errs, field.Duplicate(matchPath, key)) @@ -147,73 +160,48 @@ func validateEgressPolicy(ctx context.Context, policy *ateapipb.EgressPolicy, ac } for j, injection := range effects.GetInjectStaticHeader() { p := rulePath.Child("effects", "inject_static_header").Index(j) - errs = append(errs, validateStaticHeaderInjection(injection, p)...) + if injection == nil { + continue + } errs = append(errs, recordInjectionHeader(injection.GetHeader(), p.Child("header"), seenHeaders)...) } if injection := effects.GetInjectActorJwt(); injection != nil { p := rulePath.Child("effects", "inject_actor_jwt") - errs = append(errs, validateActorTokenInjection(injection, p)...) errs = append(errs, recordInjectionHeader(injection.GetHeader(), p.Child("header"), seenHeaders)...) } } return errs } -func validateEgressPolicyMetadata(metadata *ateapipb.ResourceMetadata, actorAtespace string, update bool, p *field.Path) field.ErrorList { - var errs field.ErrorList - if !update { - if metadata.GetAtespace() != "" { - errs = append(errs, field.Invalid(p.Child("atespace"), metadata.GetAtespace(), "must be empty when creating")) - } - if metadata.GetName() != "" { - errs = append(errs, field.Invalid(p.Child("name"), metadata.GetName(), "must be empty when creating")) - } - if metadata.GetUid() != "" { - errs = append(errs, field.Invalid(p.Child("uid"), metadata.GetUid(), "must be empty when creating")) - } - if metadata.GetVersion() != 0 { - errs = append(errs, field.Invalid(p.Child("version"), metadata.GetVersion(), "must be zero when creating")) - } - return errs - } - if metadata.GetAtespace() != actorAtespace { - errs = append(errs, field.Invalid(p.Child("atespace"), metadata.GetAtespace(), "must match the parent Actor")) +func egressMatchKey(match *ateapipb.EgressMatch) (string, bool) { + if match == nil { + return "", false } - if metadata.GetName() != "default" { - errs = append(errs, field.Invalid(p.Child("name"), metadata.GetName(), `must be "default"`)) + if match.GetAll() != nil { + return "all", false } - if metadata.GetUid() == "" { - errs = append(errs, field.Required(p.Child("uid"), "")) - } else { - errs = append(errs, resources.ValidateUUID(metadata.GetUid(), p.Child("uid"))...) + if match.GetHostname() != nil { + normalized := strings.ToLower(strings.TrimSuffix(match.GetHostname().GetPattern(), ".")) + return "hostname:" + normalized, normalized != "" && !strings.HasPrefix(normalized, "*.") } - if metadata.GetVersion() <= 0 { - errs = append(errs, field.Required(p.Child("version"), "must be greater than zero")) + if match.GetIpBlock() != nil { + return "ip:" + match.GetIpBlock().GetCidr(), false } + return "", false +} + +func ValidateCustom_HostnameMatch(_ context.Context, _ operation.Operation, p *field.Path, match, _ *ateapipb.HostnameMatch) field.ErrorList { + _, _, errs := validateHostnameMatch(match, p) return errs } -func validateEgressMatch(ctx context.Context, match *ateapipb.EgressMatch, p *field.Path) (string, bool, field.ErrorList) { - if match == nil { - return "", false, field.ErrorList{field.Required(p, "")} - } - if errs := Validate_EgressMatch(ctx, operation.Operation{Type: operation.Create}, p, match, nil); len(errs) != 0 { - return "", false, errs - } - if match.GetAll() != nil { - return "all", false, nil - } - if match.GetHostname() != nil { - normalized, wildcard, errs := validateHostnameMatch(match.GetHostname(), p.Child("hostname")) - return "hostname:" + normalized, normalized != "" && !wildcard, errs - } - cidrPath := p.Child("ip_block", "cidr") - cidr := match.GetIpBlock().GetCidr() +func ValidateCustom_IPBlockMatch(_ context.Context, _ operation.Operation, p *field.Path, match, _ *ateapipb.IPBlockMatch) field.ErrorList { + cidr := match.GetCidr() prefix, err := netip.ParsePrefix(cidr) if err != nil || prefix.Masked().String() != cidr { - return "", false, field.ErrorList{field.Invalid(cidrPath, cidr, "must be a canonical IPv4 or IPv6 prefix")} + return field.ErrorList{field.Invalid(p.Child("cidr"), cidr, "must be a canonical IPv4 or IPv6 prefix")} } - return "ip:" + cidr, false, nil + return nil } func validateHostnameMatch(match *ateapipb.HostnameMatch, p *field.Path) (string, bool, field.ErrorList) { @@ -251,6 +239,10 @@ func validateStaticHeaderInjection(injection *ateapipb.StaticHeaderInjection, p return errs } +func ValidateCustom_StaticHeaderInjection(_ context.Context, _ operation.Operation, p *field.Path, injection, _ *ateapipb.StaticHeaderInjection) field.ErrorList { + return validateStaticHeaderInjection(injection, p) +} + func validateActorTokenInjection(injection *ateapipb.ActorTokenInjection, p *field.Path) field.ErrorList { var errs field.ErrorList if !validHeaderName(injection.GetHeader()) { @@ -265,6 +257,10 @@ func validateActorTokenInjection(injection *ateapipb.ActorTokenInjection, p *fie return errs } +func ValidateCustom_ActorTokenInjection(_ context.Context, _ operation.Operation, p *field.Path, injection, _ *ateapipb.ActorTokenInjection) field.ErrorList { + return validateActorTokenInjection(injection, p) +} + func recordInjectionHeader(header string, p *field.Path, seen map[string]bool) field.ErrorList { normalized := strings.ToLower(header) if normalized == "" || !validHeaderName(normalized) { @@ -344,6 +340,8 @@ func mapEgressPolicyWrite(policy *ateapipb.EgressPolicy, err error) (*ateapipb.E return nil, status.Error(codes.Aborted, "EgressPolicy version conflict") case errors.Is(err, store.ErrUIDConflict): return nil, status.Error(codes.Aborted, "EgressPolicy UID conflict") + case errors.Is(err, store.ErrPreconditionRequired): + return nil, status.Error(codes.InvalidArgument, "EgressPolicy UID and version are required") case errors.Is(err, store.ErrFailedPrecondition): return nil, status.Error(codes.FailedPrecondition, "parent Actor does not exist") default: diff --git a/cmd/ateapi/internal/controlapi/egress_policy_test.go b/cmd/ateapi/internal/controlapi/egress_policy_test.go index fc0224d65b..9233e60847 100644 --- a/cmd/ateapi/internal/controlapi/egress_policy_test.go +++ b/cmd/ateapi/internal/controlapi/egress_policy_test.go @@ -15,6 +15,7 @@ package controlapi import ( + "context" "testing" "github.com/agent-substrate/substrate/cmd/ateapi/internal/store/storetest" @@ -23,19 +24,71 @@ import ( "google.golang.org/grpc/status" "google.golang.org/protobuf/proto" "google.golang.org/protobuf/types/known/emptypb" + "k8s.io/apimachinery/pkg/util/validation/field" ) -func TestValidateEgressPolicy(t *testing.T) { - valid := &ateapipb.EgressPolicy{Rules: []*ateapipb.EgressRule{{ - Allow: []*ateapipb.EgressMatch{{Hostname: &ateapipb.HostnameMatch{Pattern: "api.example.com"}}}, - Effects: &ateapipb.EgressRuleEffects{InjectStaticHeader: []*ateapipb.StaticHeaderInjection{{ - Header: "Authorization", Prefix: "Bearer ", CredentialUri: "substrate-secret://kubernetes.io/provider/ns/name", - }}}, - }}} - if errs := validateEgressPolicy(t.Context(), valid, "", false); len(errs) != 0 { - t.Fatalf("valid policy rejected: %v", errs) +func validEgressPolicy() *ateapipb.EgressPolicy { + return &ateapipb.EgressPolicy{ + Metadata: &ateapipb.ResourceMetadata{Atespace: testAtespace, Name: "default"}, + Rules: []*ateapipb.EgressRule{{ + Allow: []*ateapipb.EgressMatch{{Hostname: &ateapipb.HostnameMatch{Pattern: "api.example.com"}}}, + Effects: &ateapipb.EgressRuleEffects{InjectStaticHeader: []*ateapipb.StaticHeaderInjection{{ + Header: "Authorization", Prefix: "Bearer ", CredentialUri: "substrate-secret://kubernetes.io/provider/ns/name", + }}}, + }}} +} + +func TestValidateCreateActorEgressPolicyRequest(t *testing.T) { + validReq := func() *ateapipb.CreateActorEgressPolicyRequest { + return &ateapipb.CreateActorEgressPolicyRequest{ + Actor: &ateapipb.ObjectRef{Atespace: testAtespace, Name: "actor"}, + EgressPolicy: validEgressPolicy(), + } } + tests := []struct { + name string + req *ateapipb.CreateActorEgressPolicyRequest + want field.ErrorList + }{ + {name: "valid", req: validReq()}, + {name: "missing actor", req: func() *ateapipb.CreateActorEgressPolicyRequest { r := validReq(); r.Actor = nil; return r }(), want: field.ErrorList{field.Required(field.NewPath("actor"), "")}}, + {name: "missing actor atespace", req: func() *ateapipb.CreateActorEgressPolicyRequest { r := validReq(); r.Actor.Atespace = ""; return r }(), want: field.ErrorList{field.Required(field.NewPath("actor", "atespace"), "")}}, + {name: "missing policy", req: func() *ateapipb.CreateActorEgressPolicyRequest { r := validReq(); r.EgressPolicy = nil; return r }(), want: field.ErrorList{field.Required(field.NewPath("egress_policy"), "")}}, + {name: "missing metadata", req: func() *ateapipb.CreateActorEgressPolicyRequest { + r := validReq() + r.EgressPolicy.Metadata = nil + return r + }(), want: field.ErrorList{field.Required(field.NewPath("egress_policy", "metadata"), "")}}, + {name: "missing policy atespace", req: func() *ateapipb.CreateActorEgressPolicyRequest { + r := validReq() + r.EgressPolicy.Metadata.Atespace = "" + return r + }(), want: field.ErrorList{field.Required(field.NewPath("egress_policy", "metadata", "atespace"), "")}}, + {name: "missing default name", req: func() *ateapipb.CreateActorEgressPolicyRequest { + r := validReq() + r.EgressPolicy.Metadata.Name = "" + return r + }(), want: field.ErrorList{field.Required(field.NewPath("egress_policy", "metadata", "name"), "")}}, + {name: "wrong policy name", req: func() *ateapipb.CreateActorEgressPolicyRequest { + r := validReq() + r.EgressPolicy.Metadata.Name = "other" + return r + }(), want: field.ErrorList{field.Invalid(field.NewPath("egress_policy", "metadata", "name"), "other", `must be "default"`)}}, + {name: "mismatched policy atespace", req: func() *ateapipb.CreateActorEgressPolicyRequest { + r := validReq() + r.EgressPolicy.Metadata.Atespace = "other" + return r + }(), want: field.ErrorList{field.Invalid(field.NewPath("egress_policy", "metadata", "atespace"), "other", "must match actor.atespace")}}, + } + for _, tc := range tests { + t.Run(tc.name, func(t *testing.T) { + assertValidateErr(t, validateCreateActorEgressPolicyRequest(context.Background(), tc.req), tc.want) + }) + } +} + +func TestValidateEgressPolicyRules(t *testing.T) { tests := []struct { name string mutate func(*ateapipb.EgressPolicy) @@ -49,24 +102,16 @@ func TestValidateEgressPolicy(t *testing.T) { {name: "invalid credential URI", mutate: func(p *ateapipb.EgressPolicy) { p.Rules[0].Effects.InjectStaticHeader[0].CredentialUri = "https://example.com/secret" }}, - {name: "create with version", mutate: func(p *ateapipb.EgressPolicy) { p.Metadata = &ateapipb.ResourceMetadata{Version: 1} }}, - {name: "policy name", mutate: func(p *ateapipb.EgressPolicy) { p.Metadata = &ateapipb.ResourceMetadata{Name: "policy"} }}, - {name: "policy atespace", mutate: func(p *ateapipb.EgressPolicy) { p.Metadata = &ateapipb.ResourceMetadata{Atespace: "team"} }}, } for _, tc := range tests { t.Run(tc.name, func(t *testing.T) { - policy := proto.Clone(valid).(*ateapipb.EgressPolicy) - tc.mutate(policy) - if errs := validateEgressPolicy(t.Context(), policy, "", false); len(errs) == 0 { + req := &ateapipb.CreateActorEgressPolicyRequest{Actor: &ateapipb.ObjectRef{Atespace: testAtespace, Name: "actor"}, EgressPolicy: validEgressPolicy()} + tc.mutate(req.EgressPolicy) + if errs := validateCreateActorEgressPolicyRequest(context.Background(), req); len(errs) == 0 { t.Fatal("invalid policy accepted") } }) } - - update := proto.Clone(valid).(*ateapipb.EgressPolicy) - if errs := validateEgressPolicy(t.Context(), update, testAtespace, true); len(errs) == 0 { - t.Fatal("update without version accepted") - } } func TestActorEgressPolicy(t *testing.T) { @@ -95,7 +140,7 @@ func TestActorEgressPolicy(t *testing.T) { } created, err := service.CreateActorEgressPolicy(t.Context(), &ateapipb.CreateActorEgressPolicyRequest{ Actor: actorRef, - EgressPolicy: &ateapipb.EgressPolicy{Rules: []*ateapipb.EgressRule{{ + EgressPolicy: &ateapipb.EgressPolicy{Metadata: &ateapipb.ResourceMetadata{Atespace: testAtespace, Name: "default", Uid: "ignored", Version: 99}, Rules: []*ateapipb.EgressRule{{ Allow: []*ateapipb.EgressMatch{{Hostname: &ateapipb.HostnameMatch{Pattern: "API.EXAMPLE.COM."}}}, Effects: &ateapipb.EgressRuleEffects{InjectStaticHeader: []*ateapipb.StaticHeaderInjection{{ Header: "Authorization", Prefix: "Bearer ", CredentialUri: "substrate-secret://kubernetes.io/provider/ns/name", @@ -106,7 +151,7 @@ func TestActorEgressPolicy(t *testing.T) { t.Fatal(err) } if _, err := service.CreateActorEgressPolicy(t.Context(), &ateapipb.CreateActorEgressPolicyRequest{ - Actor: actorRef, EgressPolicy: &ateapipb.EgressPolicy{}, + Actor: actorRef, EgressPolicy: &ateapipb.EgressPolicy{Metadata: &ateapipb.ResourceMetadata{Atespace: testAtespace, Name: "default"}}, }); status.Code(err) != codes.AlreadyExists { t.Fatalf("create collision status = %v, want AlreadyExists", status.Code(err)) } @@ -122,12 +167,23 @@ func TestActorEgressPolicy(t *testing.T) { } replacement := proto.Clone(created).(*ateapipb.EgressPolicy) replacement.Rules = nil + missingPreconditions := proto.Clone(replacement).(*ateapipb.EgressPolicy) + missingPreconditions.Metadata.Uid = "" + missingPreconditions.Metadata.Version = 0 + if _, err := service.UpdateActorEgressPolicy(t.Context(), &ateapipb.UpdateActorEgressPolicyRequest{Actor: actorRef, EgressPolicy: missingPreconditions}); status.Code(err) != codes.InvalidArgument { + t.Fatalf("missing preconditions status = %v, want InvalidArgument", status.Code(err)) + } changedIdentity := proto.Clone(replacement).(*ateapipb.EgressPolicy) changedIdentity.Metadata.Atespace = "other" changedIdentity.Metadata.Name = "other" if _, err := service.UpdateActorEgressPolicy(t.Context(), &ateapipb.UpdateActorEgressPolicyRequest{Actor: actorRef, EgressPolicy: changedIdentity}); status.Code(err) != codes.InvalidArgument { t.Fatalf("changed identity status = %v, want InvalidArgument", status.Code(err)) } + unknown := proto.Clone(replacement).(*ateapipb.EgressPolicy) + unknown.ProtoReflect().SetUnknown(unknownField(9999)) + if _, err := service.UpdateActorEgressPolicy(t.Context(), &ateapipb.UpdateActorEgressPolicyRequest{Actor: actorRef, EgressPolicy: unknown}); status.Code(err) != codes.InvalidArgument { + t.Fatalf("unknown field status = %v, want InvalidArgument", status.Code(err)) + } updated, err := service.UpdateActorEgressPolicy(t.Context(), &ateapipb.UpdateActorEgressPolicyRequest{Actor: actorRef, EgressPolicy: replacement}) if err != nil || updated.GetMetadata().GetVersion() != 2 || len(updated.GetRules()) != 0 { t.Fatalf("replacement = %v, %v; want empty version 2", updated, err) @@ -137,6 +193,13 @@ func TestActorEgressPolicy(t *testing.T) { }); status.Code(err) != codes.Aborted { t.Fatalf("stale replacement status = %v, want Aborted", status.Code(err)) } + deleted, err := service.DeleteActorEgressPolicy(t.Context(), &ateapipb.DeleteActorEgressPolicyRequest{Actor: actorRef}) + if err != nil || !proto.Equal(deleted, updated) { + t.Fatalf("deleted policy = %v, %v; want %v", deleted, err, updated) + } + if _, err := service.GetActorEgressPolicy(t.Context(), &ateapipb.GetActorEgressPolicyRequest{Actor: actorRef}); status.Code(err) != codes.NotFound { + t.Fatalf("policy after delete status = %v, want NotFound", status.Code(err)) + } } func TestCredentialURIValidation(t *testing.T) { diff --git a/cmd/ateapi/internal/controlapi/zz_generated.validation.go b/cmd/ateapi/internal/controlapi/zz_generated.validation.go index 5621ab0bdd..5b8640c1c0 100644 --- a/cmd/ateapi/internal/controlapi/zz_generated.validation.go +++ b/cmd/ateapi/internal/controlapi/zz_generated.validation.go @@ -405,6 +405,51 @@ func Validate_ActorStatus( return errs } +// Validate_ActorTokenInjection validates an instance of ActorTokenInjection according +// to declarative validation rules in the API schema. +func Validate_ActorTokenInjection( + ctx context.Context, op operation.Operation, fldPath *field.Path, + obj, oldObj *ateapipb.ActorTokenInjection) (errs field.ErrorList) { + + // custom validation + if e := ValidateCustom_ActorTokenInjection(ctx, op, fldPath, obj, oldObj); len(e) != 0 { + errs = append(errs, e...) + } + + { // field ateapipb.ActorTokenInjection.Header + fn := func( + fldPath *field.Path, + obj, oldObj *string, + oldValueCorrelated bool) (errs field.ErrorList) { + // don't revalidate unchanged data + if oldValueCorrelated && op.Type == operation.Update { + if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) { + return nil + } + } + // call field-attached validations + earlyReturn := false + if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 { + errs = append(errs, e...) + earlyReturn = true + } + if earlyReturn { + return // do not proceed + } + return + } + oldVal := safe.Field(oldObj, + func(oldObj *ateapipb.ActorTokenInjection) *string { + return &oldObj.Header + }) + errs = append(errs, fn(fldPath.Child("header"), &obj.Header, oldVal, oldObj != nil)...) + } + + // field ateapipb.ActorTokenInjection.Audiences has no validation + // field ateapipb.ActorTokenInjection.Rfc_8693Exchange has no validation + return errs +} + // Validate_Atespace validates an instance of Atespace according // to declarative validation rules in the API schema. func Validate_Atespace( @@ -474,6 +519,11 @@ func Validate_CreateActorEgressPolicyRequest( ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *ateapipb.CreateActorEgressPolicyRequest) (errs field.ErrorList) { + // custom validation + if e := ValidateCustom_CreateActorEgressPolicyRequest(ctx, op, fldPath, obj, oldObj); len(e) != 0 { + errs = append(errs, e...) + } + { // field ateapipb.CreateActorEgressPolicyRequest.Actor fn := func( fldPath *field.Path, @@ -494,6 +544,23 @@ func Validate_CreateActorEgressPolicyRequest( if earlyReturn { return // do not proceed } + func() { // cohort = "atespace" + earlyReturn := false + if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "atespace", + func(o *ateapipb.ObjectRef) *string { return &o.Atespace }, validate.DirectEqual, validate.RequiredValue).MarkShortCircuit(); len(e) != 0 { + errs = append(errs, e...) + earlyReturn = true + } + if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "atespace", + func(o *ateapipb.ObjectRef) *string { return &o.Atespace }, validate.DirectEqual, validate.OptionalValue).MarkShortCircuit(); len(e) != 0 { + earlyReturn = true + } + if earlyReturn { + return // do not proceed + } + }() + // call the type's validation function + errs = append(errs, Validate_ObjectRef(ctx, op, fldPath, obj, oldObj)...) return } oldVal := safe.Field(oldObj, @@ -523,6 +590,8 @@ func Validate_CreateActorEgressPolicyRequest( if earlyReturn { return // do not proceed } + // call the type's validation function + errs = append(errs, Validate_EgressPolicy(ctx, op, fldPath, obj, oldObj)...) return } oldVal := safe.Field(oldObj, @@ -641,6 +710,23 @@ func Validate_DeleteActorEgressPolicyRequest( if earlyReturn { return // do not proceed } + func() { // cohort = "atespace" + earlyReturn := false + if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "atespace", + func(o *ateapipb.ObjectRef) *string { return &o.Atespace }, validate.DirectEqual, validate.RequiredValue).MarkShortCircuit(); len(e) != 0 { + errs = append(errs, e...) + earlyReturn = true + } + if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "atespace", + func(o *ateapipb.ObjectRef) *string { return &o.Atespace }, validate.DirectEqual, validate.OptionalValue).MarkShortCircuit(); len(e) != 0 { + earlyReturn = true + } + if earlyReturn { + return // do not proceed + } + }() + // call the type's validation function + errs = append(errs, Validate_ObjectRef(ctx, op, fldPath, obj, oldObj)...) return } oldVal := safe.Field(oldObj, @@ -789,6 +875,8 @@ func Validate_EgressMatch( if earlyReturn { return // do not proceed } + // call the type's validation function + errs = append(errs, Validate_HostnameMatch(ctx, op, fldPath, obj, oldObj)...) return } oldVal := safe.Field(oldObj, @@ -817,6 +905,8 @@ func Validate_EgressMatch( if earlyReturn { return // do not proceed } + // call the type's validation function + errs = append(errs, Validate_IPBlockMatch(ctx, op, fldPath, obj, oldObj)...) return } oldVal := safe.Field(oldObj, @@ -835,6 +925,11 @@ func Validate_EgressPolicy( ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *ateapipb.EgressPolicy) (errs field.ErrorList) { + // custom validation + if e := ValidateCustom_EgressPolicy(ctx, op, fldPath, obj, oldObj); len(e) != 0 { + errs = append(errs, e...) + } + { // field ateapipb.EgressPolicy.Metadata fn := func( fldPath *field.Path, @@ -855,6 +950,27 @@ func Validate_EgressPolicy( if earlyReturn { return // do not proceed } + func() { // cohort = "atespace" + earlyReturn := false + if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "atespace", + func(o *ateapipb.ResourceMetadata) *string { return &o.Atespace }, validate.DirectEqual, validate.RequiredValue).MarkShortCircuit(); len(e) != 0 { + errs = append(errs, e...) + earlyReturn = true + } + if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "atespace", + func(o *ateapipb.ResourceMetadata) *string { return &o.Atespace }, validate.DirectEqual, validate.Immutable).MarkShortCircuit(); len(e) != 0 { + earlyReturn = true + } + if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "atespace", + func(o *ateapipb.ResourceMetadata) *string { return &o.Atespace }, validate.DirectEqual, validate.OptionalValue).MarkShortCircuit(); len(e) != 0 { + earlyReturn = true + } + if earlyReturn { + return // do not proceed + } + }() + // call the type's validation function + errs = append(errs, Validate_ResourceMetadata(ctx, op, fldPath, obj, oldObj)...) return } oldVal := safe.Field(oldObj, @@ -946,7 +1062,111 @@ func Validate_EgressRule( errs = append(errs, fn(fldPath.Child("allow"), obj.Allow, oldVal, oldObj != nil)...) } - // field ateapipb.EgressRule.Effects has no validation + { // field ateapipb.EgressRule.Effects + fn := func( + fldPath *field.Path, + obj, oldObj *ateapipb.EgressRuleEffects, + oldValueCorrelated bool) (errs field.ErrorList) { + // don't revalidate unchanged data + if oldValueCorrelated && op.Type == operation.Update { + if ateDeepEqual(obj, oldObj) { + return nil + } + } + // call field-attached validations + earlyReturn := false + if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 { + earlyReturn = true + } + if earlyReturn { + return // do not proceed + } + // call the type's validation function + errs = append(errs, Validate_EgressRuleEffects(ctx, op, fldPath, obj, oldObj)...) + return + } + oldVal := safe.Field(oldObj, + func(oldObj *ateapipb.EgressRule) *ateapipb.EgressRuleEffects { + return oldObj.Effects + }) + errs = append(errs, fn(fldPath.Child("effects"), obj.Effects, oldVal, oldObj != nil)...) + } + + return errs +} + +// Validate_EgressRuleEffects validates an instance of EgressRuleEffects according +// to declarative validation rules in the API schema. +func Validate_EgressRuleEffects( + ctx context.Context, op operation.Operation, fldPath *field.Path, + obj, oldObj *ateapipb.EgressRuleEffects) (errs field.ErrorList) { + + { // field ateapipb.EgressRuleEffects.InjectStaticHeader + fn := func( + fldPath *field.Path, + obj, oldObj []*ateapipb.StaticHeaderInjection, + oldValueCorrelated bool) (errs field.ErrorList) { + // don't revalidate unchanged data + if oldValueCorrelated && op.Type == operation.Update { + if ateDeepEqual(obj, oldObj) { + return nil + } + } + // call field-attached validations + earlyReturn := false + if e := validate.PtrSliceNoNils[ateapipb.StaticHeaderInjection](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 { + errs = append(errs, e...) + earlyReturn = true + } + if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 { + earlyReturn = true + } + if earlyReturn { + return // do not proceed + } + // iterate the list and call the type's validation function + if e := validate.EachPtrSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_StaticHeaderInjection); len(e) != 0 { + errs = append(errs, e...) + } + return + } + oldVal := safe.Field(oldObj, + func(oldObj *ateapipb.EgressRuleEffects) []*ateapipb.StaticHeaderInjection { + return oldObj.InjectStaticHeader + }) + errs = append(errs, fn(fldPath.Child("inject_static_header"), obj.InjectStaticHeader, oldVal, oldObj != nil)...) + } + + { // field ateapipb.EgressRuleEffects.InjectActorJwt + fn := func( + fldPath *field.Path, + obj, oldObj *ateapipb.ActorTokenInjection, + oldValueCorrelated bool) (errs field.ErrorList) { + // don't revalidate unchanged data + if oldValueCorrelated && op.Type == operation.Update { + if ateDeepEqual(obj, oldObj) { + return nil + } + } + // call field-attached validations + earlyReturn := false + if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 { + earlyReturn = true + } + if earlyReturn { + return // do not proceed + } + // call the type's validation function + errs = append(errs, Validate_ActorTokenInjection(ctx, op, fldPath, obj, oldObj)...) + return + } + oldVal := safe.Field(oldObj, + func(oldObj *ateapipb.EgressRuleEffects) *ateapipb.ActorTokenInjection { + return oldObj.InjectActorJwt + }) + errs = append(errs, fn(fldPath.Child("inject_actor_jwt"), obj.InjectActorJwt, oldVal, oldObj != nil)...) + } + return errs } @@ -976,6 +1196,23 @@ func Validate_GetActorEgressPolicyRequest( if earlyReturn { return // do not proceed } + func() { // cohort = "atespace" + earlyReturn := false + if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "atespace", + func(o *ateapipb.ObjectRef) *string { return &o.Atespace }, validate.DirectEqual, validate.RequiredValue).MarkShortCircuit(); len(e) != 0 { + errs = append(errs, e...) + earlyReturn = true + } + if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "atespace", + func(o *ateapipb.ObjectRef) *string { return &o.Atespace }, validate.DirectEqual, validate.OptionalValue).MarkShortCircuit(); len(e) != 0 { + earlyReturn = true + } + if earlyReturn { + return // do not proceed + } + }() + // call the type's validation function + errs = append(errs, Validate_ObjectRef(ctx, op, fldPath, obj, oldObj)...) return } oldVal := safe.Field(oldObj, @@ -1047,6 +1284,92 @@ func Validate_GetAtespaceRequest( return errs } +// Validate_HostnameMatch validates an instance of HostnameMatch according +// to declarative validation rules in the API schema. +func Validate_HostnameMatch( + ctx context.Context, op operation.Operation, fldPath *field.Path, + obj, oldObj *ateapipb.HostnameMatch) (errs field.ErrorList) { + + // custom validation + if e := ValidateCustom_HostnameMatch(ctx, op, fldPath, obj, oldObj); len(e) != 0 { + errs = append(errs, e...) + } + + { // field ateapipb.HostnameMatch.Pattern + fn := func( + fldPath *field.Path, + obj, oldObj *string, + oldValueCorrelated bool) (errs field.ErrorList) { + // don't revalidate unchanged data + if oldValueCorrelated && op.Type == operation.Update { + if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) { + return nil + } + } + // call field-attached validations + earlyReturn := false + if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 { + errs = append(errs, e...) + earlyReturn = true + } + if earlyReturn { + return // do not proceed + } + return + } + oldVal := safe.Field(oldObj, + func(oldObj *ateapipb.HostnameMatch) *string { + return &oldObj.Pattern + }) + errs = append(errs, fn(fldPath.Child("pattern"), &obj.Pattern, oldVal, oldObj != nil)...) + } + + return errs +} + +// Validate_IPBlockMatch validates an instance of IPBlockMatch according +// to declarative validation rules in the API schema. +func Validate_IPBlockMatch( + ctx context.Context, op operation.Operation, fldPath *field.Path, + obj, oldObj *ateapipb.IPBlockMatch) (errs field.ErrorList) { + + // custom validation + if e := ValidateCustom_IPBlockMatch(ctx, op, fldPath, obj, oldObj); len(e) != 0 { + errs = append(errs, e...) + } + + { // field ateapipb.IPBlockMatch.Cidr + fn := func( + fldPath *field.Path, + obj, oldObj *string, + oldValueCorrelated bool) (errs field.ErrorList) { + // don't revalidate unchanged data + if oldValueCorrelated && op.Type == operation.Update { + if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) { + return nil + } + } + // call field-attached validations + earlyReturn := false + if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 { + errs = append(errs, e...) + earlyReturn = true + } + if earlyReturn { + return // do not proceed + } + return + } + oldVal := safe.Field(oldObj, + func(oldObj *ateapipb.IPBlockMatch) *string { + return &oldObj.Cidr + }) + errs = append(errs, fn(fldPath.Child("cidr"), &obj.Cidr, oldVal, oldObj != nil)...) + } + + return errs +} + // Validate_ListAtespacesRequest validates an instance of ListAtespacesRequest according // to declarative validation rules in the API schema. func Validate_ListAtespacesRequest( @@ -1470,12 +1793,91 @@ func Validate_Selector( return errs } +// Validate_StaticHeaderInjection validates an instance of StaticHeaderInjection according +// to declarative validation rules in the API schema. +func Validate_StaticHeaderInjection( + ctx context.Context, op operation.Operation, fldPath *field.Path, + obj, oldObj *ateapipb.StaticHeaderInjection) (errs field.ErrorList) { + + // custom validation + if e := ValidateCustom_StaticHeaderInjection(ctx, op, fldPath, obj, oldObj); len(e) != 0 { + errs = append(errs, e...) + } + + { // field ateapipb.StaticHeaderInjection.Header + fn := func( + fldPath *field.Path, + obj, oldObj *string, + oldValueCorrelated bool) (errs field.ErrorList) { + // don't revalidate unchanged data + if oldValueCorrelated && op.Type == operation.Update { + if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) { + return nil + } + } + // call field-attached validations + earlyReturn := false + if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 { + errs = append(errs, e...) + earlyReturn = true + } + if earlyReturn { + return // do not proceed + } + return + } + oldVal := safe.Field(oldObj, + func(oldObj *ateapipb.StaticHeaderInjection) *string { + return &oldObj.Header + }) + errs = append(errs, fn(fldPath.Child("header"), &obj.Header, oldVal, oldObj != nil)...) + } + + // field ateapipb.StaticHeaderInjection.Prefix has no validation + + { // field ateapipb.StaticHeaderInjection.CredentialUri + fn := func( + fldPath *field.Path, + obj, oldObj *string, + oldValueCorrelated bool) (errs field.ErrorList) { + // don't revalidate unchanged data + if oldValueCorrelated && op.Type == operation.Update { + if obj == oldObj || (obj != nil && oldObj != nil && *obj == *oldObj) { + return nil + } + } + // call field-attached validations + earlyReturn := false + if e := validate.RequiredValue(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 { + errs = append(errs, e...) + earlyReturn = true + } + if earlyReturn { + return // do not proceed + } + return + } + oldVal := safe.Field(oldObj, + func(oldObj *ateapipb.StaticHeaderInjection) *string { + return &oldObj.CredentialUri + }) + errs = append(errs, fn(fldPath.Child("credential_uri"), &obj.CredentialUri, oldVal, oldObj != nil)...) + } + + return errs +} + // Validate_UpdateActorEgressPolicyRequest validates an instance of UpdateActorEgressPolicyRequest according // to declarative validation rules in the API schema. func Validate_UpdateActorEgressPolicyRequest( ctx context.Context, op operation.Operation, fldPath *field.Path, obj, oldObj *ateapipb.UpdateActorEgressPolicyRequest) (errs field.ErrorList) { + // custom validation + if e := ValidateCustom_UpdateActorEgressPolicyRequest(ctx, op, fldPath, obj, oldObj); len(e) != 0 { + errs = append(errs, e...) + } + { // field ateapipb.UpdateActorEgressPolicyRequest.Actor fn := func( fldPath *field.Path, @@ -1496,6 +1898,23 @@ func Validate_UpdateActorEgressPolicyRequest( if earlyReturn { return // do not proceed } + func() { // cohort = "atespace" + earlyReturn := false + if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "atespace", + func(o *ateapipb.ObjectRef) *string { return &o.Atespace }, validate.DirectEqual, validate.RequiredValue).MarkShortCircuit(); len(e) != 0 { + errs = append(errs, e...) + earlyReturn = true + } + if e := validate.Subfield(ctx, op, fldPath, obj, oldObj, "atespace", + func(o *ateapipb.ObjectRef) *string { return &o.Atespace }, validate.DirectEqual, validate.OptionalValue).MarkShortCircuit(); len(e) != 0 { + earlyReturn = true + } + if earlyReturn { + return // do not proceed + } + }() + // call the type's validation function + errs = append(errs, Validate_ObjectRef(ctx, op, fldPath, obj, oldObj)...) return } oldVal := safe.Field(oldObj, @@ -1525,6 +1944,8 @@ func Validate_UpdateActorEgressPolicyRequest( if earlyReturn { return // do not proceed } + // call the type's validation function + errs = append(errs, Validate_EgressPolicy(ctx, op, fldPath, obj, oldObj)...) return } oldVal := safe.Field(oldObj, diff --git a/pkg/proto/ateapipb/ateapi.pb.go b/pkg/proto/ateapipb/ateapi.pb.go index 513cbe1aef..d1025805dc 100644 --- a/pkg/proto/ateapipb/ateapi.pb.go +++ b/pkg/proto/ateapipb/ateapi.pb.go @@ -982,15 +982,17 @@ func (x *Actor) GetStatus() *ActorStatus { } // EgressPolicy is an egress policy resource nested under an Actor. An Actor has -// at most one egress policy resource, named "default" by the server. +// at most one egress policy resource, named "default". +// +// +k8s:customValidation type EgressPolicy struct { state protoimpl.MessageState `protogen:"open.v1"` - // Standard resource metadata. Atespace is inherited from the parent Actor - // and name is "default". These identity fields, UID, version, create_time, - // and update_time are server-managed. + // Standard resource metadata. Atespace must match the parent Actor and name + // must be "default". Both are caller-specified on create and immutable. + // UID, version, create_time, and update_time are server-managed. // // +k8s:required - // +k8s:opaqueType + // +k8s:subfield(atespace)=+k8s:required Metadata *ResourceMetadata `protobuf:"bytes,1,opt,name=metadata,proto3" json:"metadata,omitempty"` // A request is authorized when at least one rule matches. Effects from all // matching rules are then applied once per rule. Rule order has no meaning. @@ -1054,6 +1056,8 @@ type EgressRule struct { Allow []*EgressMatch `protobuf:"bytes,1,rep,name=allow,proto3" json:"allow,omitempty"` // Effects do not authorize traffic. They are applied only after at least one // rule authorizes the request. + // + // +k8s:optional Effects *EgressRuleEffects `protobuf:"bytes,2,opt,name=effects,proto3" json:"effects,omitempty"` unknownFields protoimpl.UnknownFields sizeCache protoimpl.SizeCache @@ -1176,6 +1180,7 @@ func (x *EgressMatch) GetIpBlock() *IPBlockMatch { return nil } +// +k8s:customValidation type HostnameMatch struct { state protoimpl.MessageState `protogen:"open.v1"` // An ASCII DNS name, or a wildcard in the complete leftmost label. @@ -1197,6 +1202,8 @@ type HostnameMatch struct { // must use their ASCII IDNA A-label form; no Unicode conversion is done. // Empty labels, malformed authorities, and more than one trailing dot are // invalid and fail closed. + // + // +k8s:required Pattern string `protobuf:"bytes,1,opt,name=pattern,proto3" json:"pattern,omitempty"` unknownFields protoimpl.UnknownFields sizeCache protoimpl.SizeCache @@ -1239,10 +1246,13 @@ func (x *HostnameMatch) GetPattern() string { return "" } +// +k8s:customValidation type IPBlockMatch struct { state protoimpl.MessageState `protogen:"open.v1"` // A canonical IPv4 or IPv6 CIDR prefix. The predicate matches when the // original destination IP belongs to the prefix. + // + // +k8s:required Cidr string `protobuf:"bytes,1,opt,name=cidr,proto3" json:"cidr,omitempty"` unknownFields protoimpl.UnknownFields sizeCache protoimpl.SizeCache @@ -1290,8 +1300,12 @@ func (x *IPBlockMatch) GetCidr() string { type EgressRuleEffects struct { state protoimpl.MessageState `protogen:"open.v1"` // Injects values retrieved from credential providers into request headers. + // + // +k8s:optional InjectStaticHeader []*StaticHeaderInjection `protobuf:"bytes,1,rep,name=inject_static_header,json=injectStaticHeader,proto3" json:"inject_static_header,omitempty"` // Injects an Actor JWT, or its exchanged token, into a request header. + // + // +k8s:optional InjectActorJwt *ActorTokenInjection `protobuf:"bytes,2,opt,name=inject_actor_jwt,json=injectActorJwt,proto3" json:"inject_actor_jwt,omitempty"` unknownFields protoimpl.UnknownFields sizeCache protoimpl.SizeCache @@ -1341,14 +1355,19 @@ func (x *EgressRuleEffects) GetInjectActorJwt() *ActorTokenInjection { return nil } +// +k8s:customValidation type StaticHeaderInjection struct { state protoimpl.MessageState `protogen:"open.v1"` // The case-insensitive HTTP request header to inject. + // + // +k8s:required Header string `protobuf:"bytes,1,opt,name=header,proto3" json:"header,omitempty"` // For example, "Bearer " for the Authorization header. Prefix string `protobuf:"bytes,2,opt,name=prefix,proto3" json:"prefix,omitempty"` // Source-agnostic reference interpreted by a registered credential provider: // substrate-secret://// + // + // +k8s:required CredentialUri string `protobuf:"bytes,3,opt,name=credential_uri,json=credentialUri,proto3" json:"credential_uri,omitempty"` unknownFields protoimpl.UnknownFields sizeCache protoimpl.SizeCache @@ -1405,9 +1424,12 @@ func (x *StaticHeaderInjection) GetCredentialUri() string { return "" } +// +k8s:customValidation type ActorTokenInjection struct { state protoimpl.MessageState `protogen:"open.v1"` // The case-insensitive HTTP request header to inject. + // + // +k8s:required Header string `protobuf:"bytes,1,opt,name=header,proto3" json:"header,omitempty"` // Audiences included in the minted Actor JWT. Audiences []string `protobuf:"bytes,2,rep,name=audiences,proto3" json:"audiences,omitempty"` @@ -4337,7 +4359,7 @@ type GetActorEgressPolicyRequest struct { // The parent Actor of the egress policy resource to retrieve. // // +k8s:required - // +k8s:opaqueType + // +k8s:subfield(atespace)=+k8s:required Actor *ObjectRef `protobuf:"bytes,1,opt,name=actor,proto3" json:"actor,omitempty"` unknownFields protoimpl.UnknownFields sizeCache protoimpl.SizeCache @@ -4380,18 +4402,18 @@ func (x *GetActorEgressPolicyRequest) GetActor() *ObjectRef { return nil } +// +k8s:customValidation type CreateActorEgressPolicyRequest struct { state protoimpl.MessageState `protogen:"open.v1"` - // Parent Actor. The server creates the policy resource named "default" - // under this Actor, so no policy name is supplied. + // Parent Actor under which to create the policy resource. // // +k8s:required - // +k8s:opaqueType + // +k8s:subfield(atespace)=+k8s:required Actor *ObjectRef `protobuf:"bytes,1,opt,name=actor,proto3" json:"actor,omitempty"` - // The policy to create. Metadata must be empty. + // The policy to create. metadata.name must be "default" and + // metadata.atespace must match actor.atespace. // // +k8s:required - // +k8s:opaqueType EgressPolicy *EgressPolicy `protobuf:"bytes,2,opt,name=egress_policy,json=egressPolicy,proto3" json:"egress_policy,omitempty"` unknownFields protoimpl.UnknownFields sizeCache protoimpl.SizeCache @@ -4441,19 +4463,18 @@ func (x *CreateActorEgressPolicyRequest) GetEgressPolicy() *EgressPolicy { return nil } +// +k8s:customValidation type UpdateActorEgressPolicyRequest struct { state protoimpl.MessageState `protogen:"open.v1"` - // Parent Actor. The server updates the policy resource named "default" - // under this Actor, so no policy name is supplied. + // Parent Actor under which to update the policy resource. // // +k8s:required - // +k8s:opaqueType + // +k8s:subfield(atespace)=+k8s:required Actor *ObjectRef `protobuf:"bytes,1,opt,name=actor,proto3" json:"actor,omitempty"` // Full replacement. Metadata UID and version are required preconditions; // atespace and name are immutable and must match the existing policy. // // +k8s:required - // +k8s:opaqueType EgressPolicy *EgressPolicy `protobuf:"bytes,2,opt,name=egress_policy,json=egressPolicy,proto3" json:"egress_policy,omitempty"` unknownFields protoimpl.UnknownFields sizeCache protoimpl.SizeCache @@ -4508,7 +4529,7 @@ type DeleteActorEgressPolicyRequest struct { // The parent Actor of the egress policy resource to delete. // // +k8s:required - // +k8s:opaqueType + // +k8s:subfield(atespace)=+k8s:required Actor *ObjectRef `protobuf:"bytes,1,opt,name=actor,proto3" json:"actor,omitempty"` unknownFields protoimpl.UnknownFields sizeCache protoimpl.SizeCache diff --git a/pkg/proto/ateapipb/ateapi.proto b/pkg/proto/ateapipb/ateapi.proto index ac4508a56d..721b30a1e8 100644 --- a/pkg/proto/ateapipb/ateapi.proto +++ b/pkg/proto/ateapipb/ateapi.proto @@ -304,14 +304,16 @@ message Actor { } // EgressPolicy is an egress policy resource nested under an Actor. An Actor has -// at most one egress policy resource, named "default" by the server. +// at most one egress policy resource, named "default". +// +// +k8s:customValidation message EgressPolicy { - // Standard resource metadata. Atespace is inherited from the parent Actor - // and name is "default". These identity fields, UID, version, create_time, - // and update_time are server-managed. + // Standard resource metadata. Atespace must match the parent Actor and name + // must be "default". Both are caller-specified on create and immutable. + // UID, version, create_time, and update_time are server-managed. // // +k8s:required - // +k8s:opaqueType + // +k8s:subfield(atespace)=+k8s:required ResourceMetadata metadata = 1; // A request is authorized when at least one rule matches. Effects from all @@ -330,6 +332,8 @@ message EgressRule { // Effects do not authorize traffic. They are applied only after at least one // rule authorizes the request. + // + // +k8s:optional EgressRuleEffects effects = 2; } @@ -354,6 +358,7 @@ message EgressMatch { IPBlockMatch ip_block = 3; } +// +k8s:customValidation message HostnameMatch { // An ASCII DNS name, or a wildcard in the complete leftmost label. // @@ -374,12 +379,17 @@ message HostnameMatch { // must use their ASCII IDNA A-label form; no Unicode conversion is done. // Empty labels, malformed authorities, and more than one trailing dot are // invalid and fail closed. + // + // +k8s:required string pattern = 1; } +// +k8s:customValidation message IPBlockMatch { // A canonical IPv4 or IPv6 CIDR prefix. The predicate matches when the // original destination IP belongs to the prefix. + // + // +k8s:required string cidr = 1; } @@ -387,14 +397,21 @@ message IPBlockMatch { // a policy may target the same case-insensitive header. message EgressRuleEffects { // Injects values retrieved from credential providers into request headers. + // + // +k8s:optional repeated StaticHeaderInjection inject_static_header = 1; // Injects an Actor JWT, or its exchanged token, into a request header. + // + // +k8s:optional ActorTokenInjection inject_actor_jwt = 2; } +// +k8s:customValidation message StaticHeaderInjection { // The case-insensitive HTTP request header to inject. + // + // +k8s:required string header = 1; // For example, "Bearer " for the Authorization header. @@ -402,11 +419,16 @@ message StaticHeaderInjection { // Source-agnostic reference interpreted by a registered credential provider: // substrate-secret://// + // + // +k8s:required string credential_uri = 3; } +// +k8s:customValidation message ActorTokenInjection { // The case-insensitive HTTP request header to inject. + // + // +k8s:required string header = 1; // Audiences included in the minted Actor JWT. @@ -1020,38 +1042,37 @@ message GetActorEgressPolicyRequest { // The parent Actor of the egress policy resource to retrieve. // // +k8s:required - // +k8s:opaqueType + // +k8s:subfield(atespace)=+k8s:required ObjectRef actor = 1; } +// +k8s:customValidation message CreateActorEgressPolicyRequest { - // Parent Actor. The server creates the policy resource named "default" - // under this Actor, so no policy name is supplied. + // Parent Actor under which to create the policy resource. // // +k8s:required - // +k8s:opaqueType + // +k8s:subfield(atespace)=+k8s:required ObjectRef actor = 1; - // The policy to create. Metadata must be empty. + // The policy to create. metadata.name must be "default" and + // metadata.atespace must match actor.atespace. // // +k8s:required - // +k8s:opaqueType EgressPolicy egress_policy = 2; } +// +k8s:customValidation message UpdateActorEgressPolicyRequest { - // Parent Actor. The server updates the policy resource named "default" - // under this Actor, so no policy name is supplied. + // Parent Actor under which to update the policy resource. // // +k8s:required - // +k8s:opaqueType + // +k8s:subfield(atespace)=+k8s:required ObjectRef actor = 1; // Full replacement. Metadata UID and version are required preconditions; // atespace and name are immutable and must match the existing policy. // // +k8s:required - // +k8s:opaqueType EgressPolicy egress_policy = 2; } @@ -1059,7 +1080,7 @@ message DeleteActorEgressPolicyRequest { // The parent Actor of the egress policy resource to delete. // // +k8s:required - // +k8s:opaqueType + // +k8s:subfield(atespace)=+k8s:required ObjectRef actor = 1; }