data.proto

// Copyright 2022 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package google.events.cloud.certificatemanager.v1;

import "google/protobuf/duration.proto";
import "google/protobuf/timestamp.proto";

option csharp_namespace = "Google.Events.Protobuf.Cloud.CertificateManager.V1";
option php_namespace = "Google\\Events\\Cloud\\CertificateManager\\V1";
option ruby_package = "Google::Events::Cloud::CertificateManager::V1";

// CertificateIssuanceConfig specifies how to issue and manage a certificate.
message CertificateIssuanceConfig {
  // The CA that issues the workload certificate. It includes CA address, type,
  // authentication to CA service, etc.
  message CertificateAuthorityConfig {
    // Contains information required to contact CA service.
    message CertificateAuthorityServiceConfig {
      // Required. A CA pool resource used to issue a certificate.
      // The CA pool string has a relative resource path following the form
      // "projects/{project}/locations/{location}/caPools/{ca_pool}".
      string ca_pool = 1;
    }

    oneof kind {
      // Defines a CertificateAuthorityServiceConfig.
      CertificateAuthorityServiceConfig certificate_authority_service_config =
          1;
    }
  }

  // The type of keypair to generate.
  enum KeyAlgorithm {
    // Unspecified key algorithm.
    KEY_ALGORITHM_UNSPECIFIED = 0;

    // Specifies RSA with a 2048-bit modulus.
    RSA_2048 = 1;

    // Specifies ECDSA with curve P256.
    ECDSA_P256 = 4;
  }

  // A user-defined name of the certificate issuance config.
  // CertificateIssuanceConfig names must be unique globally and match pattern
  // `projects/*/locations/*/certificateIssuanceConfigs/*`.
  string name = 1;

  // Output only. The creation timestamp of a CertificateIssuanceConfig.
  google.protobuf.Timestamp create_time = 2;

  // Output only. The last update timestamp of a CertificateIssuanceConfig.
  google.protobuf.Timestamp update_time = 3;

  // Set of labels associated with a CertificateIssuanceConfig.
  map<string, string> labels = 4;

  // One or more paragraphs of text description of a CertificateIssuanceConfig.
  string description = 5;

  // Required. The CA that issues the workload certificate. It includes the CA
  // address, type, authentication to CA service, etc.
  CertificateAuthorityConfig certificate_authority_config = 6;

  // Required. Workload certificate lifetime requested.
  google.protobuf.Duration lifetime = 7;

  // Required. Specifies the percentage of elapsed time of the certificate
  // lifetime to wait before renewing the certificate. Must be a number between
  // 1-99, inclusive.
  int32 rotation_window_percentage = 8;

  // Required. The key algorithm to use when generating the private key.
  KeyAlgorithm key_algorithm = 9;
}

// Defines TLS certificate.
message Certificate {
  // Certificate data for a SelfManaged Certificate.
  // SelfManaged Certificates are uploaded by the user. Updating such
  // certificates before they expire remains the user's responsibility.
  message SelfManagedCertificate {}

  // Configuration and state of a Managed Certificate.
  // Certificate Manager provisions and renews Managed Certificates
  // automatically, for as long as it's authorized to do so.
  message ManagedCertificate {
    // Information about issues with provisioning a Managed Certificate.
    message ProvisioningIssue {
      enum Reason {
        REASON_UNSPECIFIED = 0;

        // Certificate provisioning failed due to an issue with one or more of
        // the domains on the certificate.
        // For details of which domains failed, consult the
        // `authorization_attempt_info` field.
        AUTHORIZATION_ISSUE = 1;

        // Exceeded Certificate Authority quotas or internal rate limits of the
        // system. Provisioning may take longer to complete.
        RATE_LIMITED = 2;
      }

      // Output only. Reason for provisioning failures.
      Reason reason = 1;

      // Output only. Human readable explanation about the issue. Provided to
      // help address the configuration issues. Not guaranteed to be stable. For
      // programmatic access use Reason enum.
      string details = 2;
    }

    // State of the latest attempt to authorize a domain for certificate
    // issuance.
    message AuthorizationAttemptInfo {
      enum State {
        STATE_UNSPECIFIED = 0;

        // Certificate provisioning for this domain is under way. GCP will
        // attempt to authorize the domain.
        AUTHORIZING = 1;

        // A managed certificate can be provisioned, no issues for this domain.
        AUTHORIZED = 6;

        // Attempt to authorize the domain failed. This prevents the Managed
        // Certificate from being issued.
        // See `failure_reason` and `details` fields for more information.
        FAILED = 7;
      }

      enum FailureReason {
        FAILURE_REASON_UNSPECIFIED = 0;

        // There was a problem with the user's DNS or load balancer
        // configuration for this domain.
        CONFIG = 1;

        // Certificate issuance forbidden by an explicit CAA record for the
        // domain or a failure to check CAA records for the domain.
        CAA = 2;

        // Reached a CA or internal rate-limit for the domain,
        // e.g. for certificates per top-level private domain.
        RATE_LIMITED = 3;
      }

      // Domain name of the authorization attempt.
      string domain = 1;

      // Output only. State of the domain for managed certificate issuance.
      State state = 2;

      // Output only. Reason for failure of the authorization attempt for the
      // domain.
      FailureReason failure_reason = 3;

      // Output only. Human readable explanation for reaching the state.
      // Provided to help address the configuration issues. Not guaranteed to be
      // stable. For programmatic access use FailureReason enum.
      string details = 4;
    }

    enum State {
      STATE_UNSPECIFIED = 0;

      // Certificate Manager attempts to provision or renew the certificate.
      // If the process takes longer than expected, consult the
      // `provisioning_issue` field.
      PROVISIONING = 1;

      // Multiple certificate provisioning attempts failed and Certificate
      // Manager gave up. To try again, delete and create a new managed
      // Certificate resource.
      // For details see the `provisioning_issue` field.
      FAILED = 2;

      // The certificate management is working, and a certificate has been
      // provisioned.
      ACTIVE = 3;
    }

    // Immutable. The domains for which a managed SSL certificate will be
    // generated. Wildcard domains are only supported with DNS challenge
    // resolution.
    repeated string domains = 1;

    // Immutable. Authorizations that will be used for performing domain
    // authorization.
    repeated string dns_authorizations = 2;

    // Immutable. The resource name for a
    // [CertificateIssuanceConfig][google.cloud.certificatemanager.v1.CertificateIssuanceConfig]
    // used to configure private PKI certificates in the format
    // `projects/*/locations/*/certificateIssuanceConfigs/*`.
    // If this field is not set, the certificates will instead be publicly
    // signed as documented at
    // https://cloud.google.com/load-balancing/docs/ssl-certificates/google-managed-certs#caa.
    string issuance_config = 6;

    // Output only. State of the managed certificate resource.
    State state = 4;

    // Output only. Information about issues with provisioning a Managed
    // Certificate.
    ProvisioningIssue provisioning_issue = 3;

    // Output only. Detailed state of the latest authorization attempt for each
    // domain specified for managed certificate resource.
    repeated AuthorizationAttemptInfo authorization_attempt_info = 5;
  }

  // Certificate scope.
  enum Scope {
    // Certificates with default scope are served from core Google data centers.
    // If unsure, choose this option.
    DEFAULT = 0;

    // Certificates with scope EDGE_CACHE are special-purposed certificates,
    // served from non-core Google data centers.
    EDGE_CACHE = 1;
  }

  // A user-defined name of the certificate. Certificate names must be unique
  // globally and match pattern `projects/*/locations/*/certificates/*`.
  string name = 1;

  // One or more paragraphs of text description of a certificate.
  string description = 8;

  // Output only. The creation timestamp of a Certificate.
  google.protobuf.Timestamp create_time = 2;

  // Output only. The last update timestamp of a Certificate.
  google.protobuf.Timestamp update_time = 3;

  // Set of labels associated with a Certificate.
  map<string, string> labels = 4;

  oneof type {
    // If set, defines data of a self-managed certificate.
    SelfManagedCertificate self_managed = 5;

    // If set, contains configuration and state of a managed certificate.
    ManagedCertificate managed = 11;
  }

  // Output only. The list of Subject Alternative Names of dnsName type defined
  // in the certificate (see RFC 5280 4.2.1.6). Managed certificates that
  // haven't been provisioned yet have this field populated with a value of the
  // managed.domains field.
  repeated string san_dnsnames = 6;

  // Output only. The PEM-encoded certificate chain.
  string pem_certificate = 9;

  // Output only. The expiry timestamp of a Certificate.
  google.protobuf.Timestamp expire_time = 7;

  // Immutable. The scope of the certificate.
  Scope scope = 12;
}

// Defines a collection of certificate configurations.
message CertificateMap {
  // Describes a Target Proxy that uses this Certificate Map.
  message GclbTarget {
    // Defines IP configuration where this Certificate Map is serving.
    message IpConfig {
      // Output only. An external IP address.
      string ip_address = 1;

      // Output only. Ports.
      repeated uint32 ports = 3;
    }

    // A Target Proxy to which this map is attached to.
    oneof target_proxy {
      // Output only. This field returns the resource name in the following
      // format:
      // `//compute.googleapis.com/projects/*/global/targetHttpsProxies/*`.
      string target_https_proxy = 1;

      // Output only. This field returns the resource name in the following
      // format:
      // `//compute.googleapis.com/projects/*/global/targetSslProxies/*`.
      string target_ssl_proxy = 3;
    }

    // Output only. IP configurations for this Target Proxy where the
    // Certificate Map is serving.
    repeated IpConfig ip_configs = 2;
  }

  // A user-defined name of the Certificate Map. Certificate Map names must be
  // unique globally and match pattern
  // `projects/*/locations/*/certificateMaps/*`.
  string name = 1;

  // One or more paragraphs of text description of a certificate map.
  string description = 5;

  // Output only. The creation timestamp of a Certificate Map.
  google.protobuf.Timestamp create_time = 2;

  // Output only. The update timestamp of a Certificate Map.
  google.protobuf.Timestamp update_time = 6;

  // Set of labels associated with a Certificate Map.
  map<string, string> labels = 3;

  // Output only. A list of GCLB targets that use this Certificate Map.
  // A Target Proxy is only present on this list if it's attached to a
  // Forwarding Rule.
  repeated GclbTarget gclb_targets = 4;
}

// Defines a certificate map entry.
message CertificateMapEntry {
  // Defines predefined cases other than SNI-hostname match when this
  // configuration should be applied.
  enum Matcher {
    // A matcher has't been recognized.
    MATCHER_UNSPECIFIED = 0;

    // A primary certificate that is served when SNI wasn't specified in the
    // request or SNI couldn't be found in the map.
    PRIMARY = 1;
  }

  // A user-defined name of the Certificate Map Entry. Certificate Map Entry
  // names must be unique globally and match pattern
  // `projects/*/locations/*/certificateMaps/*/certificateMapEntries/*`.
  string name = 1;

  // One or more paragraphs of text description of a certificate map entry.
  string description = 9;

  // Output only. The creation timestamp of a Certificate Map Entry.
  google.protobuf.Timestamp create_time = 2;

  // Output only. The update timestamp of a Certificate Map Entry.
  google.protobuf.Timestamp update_time = 3;

  // Set of labels associated with a Certificate Map Entry.
  map<string, string> labels = 4;

  oneof match {
    // A Hostname (FQDN, e.g. `example.com`) or a wildcard hostname expression
    // (`*.example.com`) for a set of hostnames with common suffix. Used as
    // Server Name Indication (SNI) for selecting a proper certificate.
    string hostname = 5;

    // A predefined matcher for particular cases, other than SNI selection.
    Matcher matcher = 10;
  }

  // A set of Certificates defines for the given `hostname`. There can be
  // defined up to fifteen certificates in each Certificate Map Entry. Each
  // certificate must match pattern `projects/*/locations/*/certificates/*`.
  repeated string certificates = 7;

  // Output only. A serving state of this Certificate Map Entry.
  ServingState state = 8;
}

// A DnsAuthorization resource describes a way to perform domain authorization
// for certificate issuance.
message DnsAuthorization {
  // The structure describing the DNS Resource Record that needs to be added
  // to DNS configuration for the authorization to be usable by
  // certificate.
  message DnsResourceRecord {
    // Output only. Fully qualified name of the DNS Resource Record.
    // e.g. `_acme-challenge.example.com`
    string name = 1;

    // Output only. Type of the DNS Resource Record.
    // Currently always set to "CNAME".
    string type = 2;

    // Output only. Data of the DNS Resource Record.
    string data = 3;
  }

  // A user-defined name of the dns authorization. DnsAuthorization names must
  // be unique globally and match pattern
  // `projects/*/locations/*/dnsAuthorizations/*`.
  string name = 1;

  // Output only. The creation timestamp of a DnsAuthorization.
  google.protobuf.Timestamp create_time = 2;

  // Output only. The last update timestamp of a DnsAuthorization.
  google.protobuf.Timestamp update_time = 3;

  // Set of labels associated with a DnsAuthorization.
  map<string, string> labels = 4;

  // One or more paragraphs of text description of a DnsAuthorization.
  string description = 5;

  // Required. Immutable. A domain that is being authorized. A DnsAuthorization
  // resource covers a single domain and its wildcard, e.g. authorization for
  // `example.com` can be used to issue certificates for `example.com` and
  // `*.example.com`.
  string domain = 6;

  // Output only. DNS Resource Record that needs to be added to DNS
  // configuration.
  DnsResourceRecord dns_resource_record = 10;
}

// Defines set of serving states associated with a resource.
enum ServingState {
  // The status is undefined.
  SERVING_STATE_UNSPECIFIED = 0;

  // The configuration is serving.
  ACTIVE = 1;

  // Update is in progress. Some frontends may serve this configuration.
  PENDING = 2;
}

// The data within all DnsAuthorization events.
message DnsAuthorizationEventData {
  // Optional. The DnsAuthorization event payload. Unset for deletion events.
  optional DnsAuthorization payload = 1;
}

// The data within all CertificateIssuanceConfig events.
message CertificateIssuanceConfigEventData {
  // Optional. The CertificateIssuanceConfig event payload. Unset for deletion
  // events.
  optional CertificateIssuanceConfig payload = 1;
}

// The data within all CertificateMapEntry events.
message CertificateMapEntryEventData {
  // Optional. The CertificateMapEntry event payload. Unset for deletion events.
  optional CertificateMapEntry payload = 1;
}

// The data within all CertificateMap events.
message CertificateMapEventData {
  // Optional. The CertificateMap event payload. Unset for deletion events.
  optional CertificateMap payload = 1;
}

// The data within all Certificate events.
message CertificateEventData {
  // Optional. The Certificate event payload. Unset for deletion events.
  optional Certificate payload = 1;
}