Skip to content

Commit c0e21bb

Browse files
tongryan-googletongryan-google
authored
Add toolset resource for CES (#15526)
1 parent 29ad9b6 commit c0e21bb

File tree

6 files changed

+1120
-0
lines changed

6 files changed

+1120
-0
lines changed

‎mmv1/products/ces/Toolset.yaml‎

Lines changed: 286 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,286 @@
1+
# Copyright 2025 Google Inc.
2+
# Licensed under the Apache License, Version 2.0 (the "License");
3+
# you may not use this file except in compliance with the License.
4+
# You may obtain a copy of the License at
5+
#
6+
# http://www.apache.org/licenses/LICENSE-2.0
7+
#
8+
# Unless required by applicable law or agreed to in writing, software
9+
# distributed under the License is distributed on an "AS IS" BASIS,
10+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
# See the License for the specific language governing permissions and
12+
# limitations under the License.
13+
14+
---
15+
name: Toolset
16+
description: Description
17+
base_url: projects/{{project}}/locations/{{location}}/apps/{{app}}/toolsets
18+
update_mask: true
19+
self_link:
20+
projects/{{project}}/locations/{{location}}/apps/{{app}}/toolsets/{{toolset_id}}
21+
create_url:
22+
projects/{{project}}/locations/{{location}}/apps/{{app}}/toolsets?toolsetId={{toolset_id}}
23+
update_verb: PATCH
24+
id_format:
25+
projects/{{project}}/locations/{{location}}/apps/{{app}}/toolsets/{{toolset_id}}
26+
import_format:
27+
- projects/{{project}}/locations/{{location}}/apps/{{app}}/toolsets/{{toolset_id}}
28+
examples:
29+
- name: "ces_toolset_openapi_service_account_auth_config"
30+
primary_resource_id: "ces_toolset_openapi_service_account_auth_config" # yamllint disable rule:line-length
31+
vars:
32+
app_display_name: 'my-app'
33+
app_id: 'app-id'
34+
toolset_id: 'toolset1'
35+
location: 'us'
36+
- name: "ces_toolset_openapi_oauth_config"
37+
primary_resource_id: "ces_toolset_openapi_oauth_config"
38+
vars:
39+
app_display_name: 'my-app'
40+
app_id: 'app-id'
41+
toolset_id: 'toolset1'
42+
location: 'us'
43+
- name: "ces_toolset_openapi_service_agent_id_token_auth_config"
44+
primary_resource_id: "ces_toolset_openapi_service_agent_id_token_auth_config"
45+
vars:
46+
app_display_name: 'my-app'
47+
app_id: 'app-id'
48+
toolset_id: 'toolset1'
49+
location: 'us'
50+
- name: "ces_toolset_openapi_api_key_config"
51+
primary_resource_id: "ces_toolset_openapi_api_key_config"
52+
vars:
53+
app_display_name: 'my-app'
54+
app_id: 'app-id'
55+
toolset_id: 'toolset1'
56+
location: 'us'
57+
autogen_async: true
58+
autogen_status: VG9vbHNldA==
59+
parameters:
60+
- name: location
61+
type: String
62+
description: Resource ID segment making up resource `name`. It identifies the
63+
resource within its parent collection as described in
64+
https://google.aip.dev/122.
65+
immutable: true
66+
url_param_only: true
67+
required: true
68+
- name: app
69+
type: String
70+
description: Resource ID segment making up resource `name`. It identifies the
71+
resource within its parent collection as described in
72+
https://google.aip.dev/122.
73+
immutable: true
74+
url_param_only: true
75+
required: true
76+
- name: toolsetId
77+
type: String
78+
description: |-
79+
The ID to use for the toolset, which will become the final component of
80+
the toolset's resource name. If not provided, a unique ID will be
81+
automatically assigned for the toolset.
82+
immutable: true
83+
url_param_only: true
84+
required: true
85+
properties:
86+
- name: createTime
87+
type: String
88+
description: Timestamp when the toolset was created.
89+
output: true
90+
- name: description
91+
type: String
92+
description: The description of the toolset.
93+
- name: displayName
94+
type: String
95+
description: The display name of the toolset. Must be unique within the same
96+
app.
97+
- name: etag
98+
type: String
99+
output: true
100+
description: |-
101+
ETag used to ensure the object hasn't changed during a read-modify-write
102+
operation. If the etag is empty, the update will overwrite any concurrent
103+
changes.
104+
- name: executionType
105+
type: String
106+
description: |2-
107+
108+
Possible values:
109+
SYNCHRONOUS
110+
ASYNCHRONOUS
111+
- name: name
112+
type: String
113+
description: |-
114+
Identifier. The unique identifier of the toolset.
115+
Format:
116+
`projects/{project}/locations/{location}/apps/{app}/toolsets/{toolset}`
117+
output: true
118+
- name: openApiToolset
119+
type: NestedObject
120+
description: |-
121+
A toolset that contains a list of tools that are defined by an OpenAPI
122+
schema.
123+
properties:
124+
- name: apiAuthentication
125+
type: NestedObject
126+
description: Authentication information required for API calls.
127+
properties:
128+
- name: apiKeyConfig
129+
type: NestedObject
130+
description: Configurations for authentication with API key.
131+
properties:
132+
- name: apiKeySecretVersion
133+
type: String
134+
description: |-
135+
The name of the SecretManager secret version resource storing the API key.
136+
Format: `projects/{project}/secrets/{secret}/versions/{version}`
137+
Note: You should grant `roles/secretmanager.secretAccessor` role to the CES
138+
service agent
139+
`[email protected]`.
140+
required: true
141+
- name: keyName
142+
type: String
143+
description: |-
144+
The parameter name or the header name of the API key.
145+
E.g., If the API request is "https://example.com/act?X-Api-Key=", "X-Api-Key" would be the parameter name.
146+
required: true
147+
- name: requestLocation
148+
type: String
149+
description: |-
150+
Key location in the request.
151+
Possible values:
152+
HEADER
153+
QUERY_STRING
154+
required: true
155+
- name: oauthConfig
156+
type: NestedObject
157+
description: Configurations for authentication with OAuth.
158+
properties:
159+
- name: clientId
160+
type: String
161+
description: The client ID from the OAuth provider.
162+
required: true
163+
- name: clientSecretVersion
164+
type: String
165+
description: |-
166+
The name of the SecretManager secret version resource storing the
167+
client secret.
168+
Format: `projects/{project}/secrets/{secret}/versions/{version}`
169+
170+
Note: You should grant `roles/secretmanager.secretAccessor` role to the CES
171+
service agent
172+
`[email protected]`.
173+
required: true
174+
- name: oauthGrantType
175+
type: String
176+
description: |-
177+
OAuth grant types.
178+
Possible values:
179+
CLIENT_CREDENTIAL
180+
required: true
181+
- name: scopes
182+
type: Array
183+
description: The OAuth scopes to grant.
184+
item_type:
185+
type: String
186+
- name: tokenEndpoint
187+
type: String
188+
description: The token endpoint in the OAuth provider to exchange for an
189+
access token.
190+
required: true
191+
- name: serviceAccountAuthConfig
192+
type: NestedObject
193+
description: Configurations for authentication using a custom service
194+
account.
195+
properties:
196+
- name: serviceAccount
197+
type: String
198+
description: |-
199+
The email address of the service account used for authenticatation. CES
200+
uses this service account to exchange an access token and the access token
201+
is then sent in the `Authorization` header of the request.
202+
203+
The service account must have the
204+
`roles/iam.serviceAccountTokenCreator` role granted to the
205+
CES service agent
206+
`[email protected]`.
207+
required: true
208+
- name: serviceAgentIdTokenAuthConfig
209+
type: NestedObject
210+
description: |-
211+
Configurations for authentication with [ID
212+
token](https://cloud.google.com/docs/authentication/token-types#id) generated
213+
from service agent.
214+
allow_empty_object: true
215+
send_empty_value: true
216+
properties: []
217+
- name: ignoreUnknownFields
218+
type: Boolean
219+
description: |-
220+
If true, the agent will ignore unknown fields in the API response for all
221+
operations defined in the OpenAPI schema.
222+
- name: openApiSchema
223+
type: String
224+
description: The OpenAPI schema of the toolset.
225+
required: true
226+
- name: serviceDirectoryConfig
227+
type: NestedObject
228+
description: Configuration for tools using Service Directory.
229+
properties:
230+
- name: service
231+
type: String
232+
description: |-
233+
The name of [Service
234+
Directory](https://cloud.google.com/service-directory) service.
235+
Format:
236+
`projects/{project}/locations/{location}/namespaces/{namespace}/services/{service}`.
237+
Location of the service directory must be the same as the location of the
238+
app.
239+
required: true
240+
- name: tlsConfig
241+
type: NestedObject
242+
description: The TLS configuration.
243+
properties:
244+
- name: caCerts
245+
type: Array
246+
description: |-
247+
Specifies a list of allowed custom CA certificates for HTTPS
248+
verification.
249+
required: true
250+
item_type:
251+
type: NestedObject
252+
properties:
253+
- name: cert
254+
type: String
255+
description: |-
256+
The allowed custom CA certificates (in DER format) for
257+
HTTPS verification. This overrides the default SSL trust store. If this
258+
is empty or unspecified, CES will use Google's default trust
259+
store to verify certificates. N.B. Make sure the HTTPS server
260+
certificates are signed with "subject alt name". For instance a
261+
certificate can be self-signed using the following command,
262+
openssl x509 -req -days 200 -in example.com.csr \
263+
-signkey example.com.key \
264+
-out example.com.crt \
265+
-extfile <(printf "\nsubjectAltName='DNS:www.example.com'")
266+
required: true
267+
- name: displayName
268+
type: String
269+
description: |-
270+
The name of the allowed custom CA certificates. This
271+
can be used to disambiguate the custom CA certificates.
272+
required: true
273+
- name: url
274+
type: String
275+
description: |-
276+
The server URL of the Open API schema.
277+
This field is only set in toolsets in the environment dependencies
278+
during the export process if the schema contains a server url.
279+
During the import process, if this url is present in the environment dependencies
280+
and the schema has the $env_var placeholder,
281+
it will replace the placeholder in the schema.
282+
output: true
283+
- name: updateTime
284+
type: String
285+
description: Timestamp when the toolset was last updated.
286+
output: true

‎mmv1/templates/terraform/examples/ces_toolset_openapi_api_key_config.tf.tmpl‎

Lines changed: 55 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,55 @@
1+
resource "google_ces_app" "ces_app_for_toolset" {
2+
app_id = "{{index $.Vars "app_id"}}"
3+
location = "us"
4+
description = "App used as parent for CES Toolset example"
5+
display_name = "{{index $.Vars "app_display_name"}}"
6+
7+
language_settings {
8+
default_language_code = "en-US"
9+
supported_language_codes = ["es-ES", "fr-FR"]
10+
enable_multilingual_support = true
11+
fallback_action = "escalate"
12+
}
13+
time_zone_settings {
14+
time_zone = "America/Los_Angeles"
15+
}
16+
}
17+
18+
resource "google_ces_toolset" "ces_toolset_openapi_api_key_config" {
19+
toolset_id = "{{index $.Vars "toolset_id"}}"
20+
location = "us"
21+
app = google_ces_app.ces_app_for_toolset.app_id
22+
display_name = "Basic toolset display name"
23+
description = "Test description"
24+
execution_type = "SYNCHRONOUS"
25+
26+
open_api_toolset {
27+
open_api_schema = <<-EOT
28+
openapi: 3.0.0
29+
info:
30+
title: My Sample API
31+
version: 1.0.0
32+
description: A simple API example
33+
servers:
34+
- url: https://api.example.com/v1
35+
paths: {}
36+
EOT
37+
ignore_unknown_fields = false
38+
tls_config {
39+
ca_certs {
40+
display_name="example"
41+
cert="ZXhhbXBsZQ=="
42+
}
43+
}
44+
service_directory_config {
45+
service = "projects/example/locations/us/namespaces/namespace/services/service"
46+
}
47+
api_authentication {
48+
api_key_config {
49+
key_name = "ExampleKey"
50+
api_key_secret_version = "projects/fake-project/secrets/fake-secret/versions/version-1"
51+
request_location = "HEADER"
52+
}
53+
}
54+
}
55+
}

0 commit comments

Comments
 (0)