// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package google.cloud.gkehub.v1;

import "google/api/field_behavior.proto";
import "google/api/resource.proto";
import "google/protobuf/timestamp.proto";

option csharp_namespace = "Google.Cloud.GkeHub.V1";
option go_package = "cloud.google.com/go/gkehub/apiv1/gkehubpb;gkehubpb";
option java_multiple_files = true;
option java_outer_classname = "FleetProto";
option java_package = "com.google.cloud.gkehub.v1";
option php_namespace = "Google\\Cloud\\GkeHub\\V1";
option ruby_package = "Google::Cloud::GkeHub::V1";

// Fleet contains the Fleet-wide metadata and configuration.
message Fleet {
  option (google.api.resource) = {
    type: "gkehub.googleapis.com/Fleet"
    pattern: "projects/{project}/locations/{location}/fleets/{fleet}"
    pattern: "organizations/{organization}/locations/{location}/fleets/{fleet}"
  };

  // Output only. The full, unique resource name of this fleet in the format of
  // `projects/{project}/locations/{location}/fleets/{fleet}`.
  //
  // Each Google Cloud project can have at most one fleet resource, named
  // "default".
  string name = 1 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. A user-assigned display name of the Fleet.
  // When present, it must be between 4 to 30 characters.
  // Allowed characters are: lowercase and uppercase letters, numbers,
  // hyphen, single-quote, double-quote, space, and exclamation point.
  //
  // Example: `Production Fleet`
  string display_name = 2 [(google.api.field_behavior) = OPTIONAL];

  // Output only. When the Fleet was created.
  google.protobuf.Timestamp create_time = 3
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. When the Fleet was last updated.
  google.protobuf.Timestamp update_time = 4
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. When the Fleet was deleted.
  google.protobuf.Timestamp delete_time = 5
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Google-generated UUID for this resource. This is unique across
  // all Fleet resources. If a Fleet resource is deleted and another resource
  // with the same name is created, it gets a different uid.
  string uid = 6 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. State of the namespace resource.
  FleetLifecycleState state = 9 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. The default cluster configurations to apply across the fleet.
  DefaultClusterConfig default_cluster_config = 10
      [(google.api.field_behavior) = OPTIONAL];

  // Optional. Labels for this Fleet.
  map<string, string> labels = 11 [(google.api.field_behavior) = OPTIONAL];
}

// DefaultClusterConfig describes the default cluster configurations to be
// applied to all clusters born-in-fleet.
message DefaultClusterConfig {
  // Enable/Disable Security Posture features for the cluster.
  SecurityPostureConfig security_posture_config = 1;

  // Optional. Enable/Disable binary authorization features for the cluster.
  BinaryAuthorizationConfig binary_authorization_config = 2
      [(google.api.field_behavior) = OPTIONAL];

  // Optional. Enable/Disable Compliance Posture features for the cluster.
  // Note that on UpdateFleet, only full replacement of this field is allowed.
  // Users are not allowed for partial updates through field mask.
  CompliancePostureConfig compliance_posture_config = 3
      [(google.api.field_behavior) = OPTIONAL];
}

// SecurityPostureConfig defines the flags needed to enable/disable features for
// the Security Posture API.
message SecurityPostureConfig {
  // Mode defines enablement mode for GKE Security posture features.
  enum Mode {
    // Default value not specified.
    MODE_UNSPECIFIED = 0;

    // Disables Security Posture features on the cluster.
    DISABLED = 1;

    // Applies Security Posture features on the cluster.
    BASIC = 2;

    // Applies the Security Posture off cluster Enterprise level features.
    ENTERPRISE = 3;
  }

  // VulnerabilityMode defines enablement mode for vulnerability scanning.
  enum VulnerabilityMode {
    // Default value not specified.
    VULNERABILITY_MODE_UNSPECIFIED = 0;

    // Disables vulnerability scanning on the cluster.
    VULNERABILITY_DISABLED = 1;

    // Applies basic vulnerability scanning on the cluster.
    VULNERABILITY_BASIC = 2;

    // Applies the Security Posture's vulnerability on cluster Enterprise level
    // features.
    VULNERABILITY_ENTERPRISE = 3;
  }

  // Sets which mode to use for Security Posture features.
  Mode mode = 1;

  // Sets which mode to use for vulnerability scanning.
  VulnerabilityMode vulnerability_mode = 2;
}

// BinaryAuthorizationConfig defines the fleet level configuration of binary
// authorization feature.
message BinaryAuthorizationConfig {
  // Binauthz policy that applies to this cluster.
  message PolicyBinding {
    // The relative resource name of the binauthz platform policy to audit. GKE
    // platform policies have the following format:
    // `projects/{project_number}/platforms/gke/policies/{policy_id}`.
    string name = 1;
  }

  // Binary Authorization mode of operation.
  enum EvaluationMode {
    // Default value
    EVALUATION_MODE_UNSPECIFIED = 0;

    // Disable BinaryAuthorization
    DISABLED = 1;

    // Use Binary Authorization with the policies specified in policy_bindings.
    POLICY_BINDINGS = 2;
  }

  // Optional. Mode of operation for binauthz policy evaluation.
  EvaluationMode evaluation_mode = 1 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Binauthz policies that apply to this cluster.
  repeated PolicyBinding policy_bindings = 2
      [(google.api.field_behavior) = OPTIONAL];
}

// CompliancePostureConfig defines the settings needed to enable/disable
// features for the Compliance Posture.
message CompliancePostureConfig {
  message ComplianceStandard {
    // Name of the compliance standard.
    string standard = 1;
  }

  enum Mode {
    // Default value not specified.
    MODE_UNSPECIFIED = 0;

    // Disables Compliance Posture features on the cluster.
    DISABLED = 1;

    // Enables Compliance Posture features on the cluster.
    ENABLED = 2;
  }

  // Defines the enablement mode for Compliance Posture.
  Mode mode = 1;

  // List of enabled compliance standards.
  repeated ComplianceStandard compliance_standards = 2;
}

// FleetLifecycleState describes the state of a Fleet resource.
message FleetLifecycleState {
  // Code describes the state of a Fleet resource.
  enum Code {
    // The code is not set.
    CODE_UNSPECIFIED = 0;

    // The fleet is being created.
    CREATING = 1;

    // The fleet active.
    READY = 2;

    // The fleet is being deleted.
    DELETING = 3;

    // The fleet is being updated.
    UPDATING = 4;
  }

  // Output only. The current state of the Fleet resource.
  Code code = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
}

// Namespace represents a namespace across the Fleet
message Namespace {
  option (google.api.resource) = {
    type: "gkehub.googleapis.com/Namespace"
    pattern: "projects/{project}/locations/{location}/scopes/{scope}/namespaces/{namespace}"
  };

  // The resource name for the namespace
  // `projects/{project}/locations/{location}/namespaces/{namespace}`
  string name = 1;

  // Output only. Google-generated UUID for this resource. This is unique across
  // all namespace resources. If a namespace resource is deleted and another
  // resource with the same name is created, it gets a different uid.
  string uid = 2 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. When the namespace was created.
  google.protobuf.Timestamp create_time = 3
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. When the namespace was last updated.
  google.protobuf.Timestamp update_time = 4
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. When the namespace was deleted.
  google.protobuf.Timestamp delete_time = 5
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. State of the namespace resource.
  NamespaceLifecycleState state = 6 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Required. Scope associated with the namespace
  string scope = 8 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = { type: "gkehub.googleapis.com/Scope" }
  ];

  // Optional. Namespace-level cluster namespace labels. These labels are
  // applied to the related namespace of the member clusters bound to the parent
  // Scope. Scope-level labels (`namespace_labels` in the Fleet Scope
  // resource) take precedence over Namespace-level labels if they share
  // a key. Keys and values must be Kubernetes-conformant.
  map<string, string> namespace_labels = 9
      [(google.api.field_behavior) = OPTIONAL];

  // Optional. Labels for this Namespace.
  map<string, string> labels = 10 [(google.api.field_behavior) = OPTIONAL];
}

// NamespaceLifecycleState describes the state of a Namespace resource.
message NamespaceLifecycleState {
  // Code describes the state of a Namespace resource.
  enum Code {
    // The code is not set.
    CODE_UNSPECIFIED = 0;

    // The namespace is being created.
    CREATING = 1;

    // The namespace active.
    READY = 2;

    // The namespace is being deleted.
    DELETING = 3;

    // The namespace is being updated.
    UPDATING = 4;
  }

  // Output only. The current state of the Namespace resource.
  Code code = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
}

// RBACRoleBinding represents a rbacrolebinding across the Fleet
message RBACRoleBinding {
  option (google.api.resource) = {
    type: "gkehub.googleapis.com/RBACRoleBinding"
    pattern: "projects/{project}/locations/{location}/scopes/{scope}/rbacrolebindings/{rbacrolebinding}"
    pattern: "projects/{project}/locations/{location}/memberships/{membership}/rbacrolebindings/{rbacrolebinding}"
  };

  // Role is the type for Kubernetes roles
  message Role {
    // PredefinedRoles is an ENUM representation of the default Kubernetes Roles
    enum PredefinedRoles {
      // UNKNOWN
      UNKNOWN = 0;

      // ADMIN has EDIT and RBAC permissions
      ADMIN = 1;

      // EDIT can edit all resources except RBAC
      EDIT = 2;

      // VIEW can only read resources
      VIEW = 3;

      // ANTHOS_SUPPORT gives Google Support read-only access to a number of
      // cluster resources.
      ANTHOS_SUPPORT = 4;
    }

    // predefined_role is the Kubernetes default role to use
    PredefinedRoles predefined_role = 1;

    // Optional. custom_role is the name of a custom KubernetesClusterRole to
    // use.
    string custom_role = 2 [(google.api.field_behavior) = OPTIONAL];
  }

  // Principal that is be authorized in the cluster (at least of one the oneof
  // is required). Updating one will unset the other automatically.
  oneof principal {
    // user is the name of the user as seen by the kubernetes cluster, example
    // "alice" or "alice@domain.tld"
    string user = 7;

    // group is the group, as seen by the kubernetes cluster.
    string group = 8;
  }

  // The resource name for the rbacrolebinding
  // `projects/{project}/locations/{location}/scopes/{scope}/rbacrolebindings/{rbacrolebinding}`
  // or
  // `projects/{project}/locations/{location}/memberships/{membership}/rbacrolebindings/{rbacrolebinding}`
  string name = 1;

  // Output only. Google-generated UUID for this resource. This is unique across
  // all rbacrolebinding resources. If a rbacrolebinding resource is deleted and
  // another resource with the same name is created, it gets a different uid.
  string uid = 2 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. When the rbacrolebinding was created.
  google.protobuf.Timestamp create_time = 3
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. When the rbacrolebinding was last updated.
  google.protobuf.Timestamp update_time = 4
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. When the rbacrolebinding was deleted.
  google.protobuf.Timestamp delete_time = 5
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. State of the rbacrolebinding resource.
  RBACRoleBindingLifecycleState state = 6
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Required. Role to bind to the principal
  Role role = 9 [(google.api.field_behavior) = REQUIRED];

  // Optional. Labels for this RBACRolebinding.
  map<string, string> labels = 10 [(google.api.field_behavior) = OPTIONAL];
}

// RBACRoleBindingLifecycleState describes the state of a RbacRoleBinding
// resource.
message RBACRoleBindingLifecycleState {
  // Code describes the state of a rbacrolebinding resource.
  enum Code {
    // The code is not set.
    CODE_UNSPECIFIED = 0;

    // The rbacrolebinding is being created.
    CREATING = 1;

    // The rbacrolebinding active.
    READY = 2;

    // The rbacrolebinding is being deleted.
    DELETING = 3;

    // The rbacrolebinding is being updated.
    UPDATING = 4;
  }

  // Output only. The current state of the rbacrolebinding resource.
  Code code = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
}

// Scope represents a Scope in a Fleet.
message Scope {
  option (google.api.resource) = {
    type: "gkehub.googleapis.com/Scope"
    pattern: "projects/{project}/locations/{location}/scopes/{scope}"
  };

  // The resource name for the scope
  // `projects/{project}/locations/{location}/scopes/{scope}`
  string name = 1;

  // Output only. Google-generated UUID for this resource. This is unique across
  // all scope resources. If a scope resource is deleted and another resource
  // with the same name is created, it gets a different uid.
  string uid = 2 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. When the scope was created.
  google.protobuf.Timestamp create_time = 3
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. When the scope was last updated.
  google.protobuf.Timestamp update_time = 4
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. When the scope was deleted.
  google.protobuf.Timestamp delete_time = 5
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. State of the scope resource.
  ScopeLifecycleState state = 6 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. Scope-level cluster namespace labels. For the member clusters
  // bound to the Scope, these labels are applied to each namespace under the
  // Scope. Scope-level labels take precedence over Namespace-level
  // labels (`namespace_labels` in the Fleet Namespace resource) if they
  // share a key. Keys and values must be Kubernetes-conformant.
  map<string, string> namespace_labels = 8
      [(google.api.field_behavior) = OPTIONAL];

  // Optional. Labels for this Scope.
  map<string, string> labels = 9 [(google.api.field_behavior) = OPTIONAL];
}

// ScopeLifecycleState describes the state of a Scope resource.
message ScopeLifecycleState {
  // Code describes the state of a Scope resource.
  enum Code {
    // The code is not set.
    CODE_UNSPECIFIED = 0;

    // The scope is being created.
    CREATING = 1;

    // The scope active.
    READY = 2;

    // The scope is being deleted.
    DELETING = 3;

    // The scope is being updated.
    UPDATING = 4;
  }

  // Output only. The current state of the scope resource.
  Code code = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
}

// MembershipBinding is a subresource of a Membership, representing
// what Fleet Scopes (or other, future Fleet resources) a Membership is bound
// to.
message MembershipBinding {
  option (google.api.resource) = {
    type: "gkehub.googleapis.com/MembershipBinding"
    pattern: "projects/{project}/locations/{location}/memberships/{membership}/bindings/{membershipbinding}"
  };

  // What type of membershipbinding this is.
  oneof target {
    // A Scope resource name in the format
    // `projects/*/locations/*/scopes/*`.
    string scope = 3 [
      (google.api.resource_reference) = { type: "gkehub.googleapis.com/Scope" }
    ];
  }

  // The resource name for the membershipbinding itself
  // `projects/{project}/locations/{location}/memberships/{membership}/bindings/{membershipbinding}`
  string name = 1;

  // Output only. Google-generated UUID for this resource. This is unique across
  // all membershipbinding resources. If a membershipbinding resource is deleted
  // and another resource with the same name is created, it gets a different
  // uid.
  string uid = 2 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. When the membership binding was created.
  google.protobuf.Timestamp create_time = 5
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. When the membership binding was last updated.
  google.protobuf.Timestamp update_time = 6
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. When the membership binding was deleted.
  google.protobuf.Timestamp delete_time = 7
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. State of the membership binding resource.
  MembershipBindingLifecycleState state = 8
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Optional. Labels for this MembershipBinding.
  map<string, string> labels = 9 [(google.api.field_behavior) = OPTIONAL];
}

// MembershipBindingLifecycleState describes the state of a Binding resource.
message MembershipBindingLifecycleState {
  // Code describes the state of a MembershipBinding resource.
  enum Code {
    // The code is not set.
    CODE_UNSPECIFIED = 0;

    // The membershipbinding is being created.
    CREATING = 1;

    // The membershipbinding active.
    READY = 2;

    // The membershipbinding is being deleted.
    DELETING = 3;

    // The membershipbinding is being updated.
    UPDATING = 4;
  }

  // Output only. The current state of the MembershipBinding resource.
  Code code = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
}