// Copyright 2026 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package google.cloud.gkehub.v1;

import "google/api/annotations.proto";
import "google/api/client.proto";
import "google/api/field_behavior.proto";
import "google/api/resource.proto";
import "google/cloud/gkehub/v1/feature.proto";
import "google/cloud/gkehub/v1/fleet.proto";
import "google/cloud/gkehub/v1/membership.proto";
import "google/longrunning/operations.proto";
import "google/protobuf/field_mask.proto";
import "google/protobuf/timestamp.proto";

option csharp_namespace = "Google.Cloud.GkeHub.V1";
option go_package = "cloud.google.com/go/gkehub/apiv1/gkehubpb;gkehubpb";
option java_multiple_files = true;
option java_outer_classname = "ServiceProto";
option java_package = "com.google.cloud.gkehub.v1";
option php_namespace = "Google\\Cloud\\GkeHub\\V1";
option ruby_package = "Google::Cloud::GkeHub::V1";

// The GKE Hub service handles the registration of many Kubernetes clusters to
// Google Cloud, and the management of multi-cluster features over those
// clusters.
//
// The GKE Hub service operates on the following resources:
//
// * [Membership][google.cloud.gkehub.v1.Membership]
// * [Feature][google.cloud.gkehub.v1.Feature]
//
// GKE Hub is currently available in the global region and all regions in
// https://cloud.google.com/compute/docs/regions-zones. Feature is only
// available in global region while membership is global region and all the
// regions.
//
// **Membership management may be non-trivial:** it is recommended to use one
// of the Google-provided client libraries or tools where possible when working
// with Membership resources.
service GkeHub {
  option (google.api.default_host) = "gkehub.googleapis.com";
  option (google.api.oauth_scopes) =
      "https://www.googleapis.com/auth/cloud-platform";

  // Lists Memberships in a given project and location.
  rpc ListMemberships(ListMembershipsRequest)
      returns (ListMembershipsResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=projects/*/locations/*}/memberships"
    };
    option (google.api.method_signature) = "parent";
  }

  // Lists Memberships bound to a Scope. The response includes relevant
  // Memberships from all regions.
  rpc ListBoundMemberships(ListBoundMembershipsRequest)
      returns (ListBoundMembershipsResponse) {
    option (google.api.http) = {
      get: "/v1/{scope_name=projects/*/locations/*/scopes/*}:listMemberships"
    };
    option (google.api.method_signature) = "scope_name";
  }

  // Lists Features in a given project and location.
  rpc ListFeatures(ListFeaturesRequest) returns (ListFeaturesResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=projects/*/locations/*}/features"
    };
    option (google.api.method_signature) = "parent";
  }

  // Gets the details of a Membership.
  rpc GetMembership(GetMembershipRequest) returns (Membership) {
    option (google.api.http) = {
      get: "/v1/{name=projects/*/locations/*/memberships/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Gets details of a single Feature.
  rpc GetFeature(GetFeatureRequest) returns (Feature) {
    option (google.api.http) = {
      get: "/v1/{name=projects/*/locations/*/features/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Creates a new Membership.
  //
  // **This is currently only supported for GKE clusters on Google Cloud**.
  // To register other clusters, follow the instructions at
  // https://cloud.google.com/anthos/multicluster-management/connect/registering-a-cluster.
  rpc CreateMembership(CreateMembershipRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1/{parent=projects/*/locations/*}/memberships"
      body: "resource"
    };
    option (google.api.method_signature) = "parent,resource,membership_id";
    option (google.longrunning.operation_info) = {
      response_type: "Membership"
      metadata_type: "OperationMetadata"
    };
  }

  // Adds a new Feature.
  rpc CreateFeature(CreateFeatureRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1/{parent=projects/*/locations/*}/features"
      body: "resource"
    };
    option (google.api.method_signature) = "parent,resource,feature_id";
    option (google.longrunning.operation_info) = {
      response_type: "Feature"
      metadata_type: "OperationMetadata"
    };
  }

  // Removes a Membership.
  //
  // **This is currently only supported for GKE clusters on Google Cloud**.
  // To unregister other clusters, follow the instructions at
  // https://cloud.google.com/anthos/multicluster-management/connect/unregistering-a-cluster.
  rpc DeleteMembership(DeleteMembershipRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      delete: "/v1/{name=projects/*/locations/*/memberships/*}"
    };
    option (google.api.method_signature) = "name";
    option (google.longrunning.operation_info) = {
      response_type: "google.protobuf.Empty"
      metadata_type: "OperationMetadata"
    };
  }

  // Removes a Feature.
  rpc DeleteFeature(DeleteFeatureRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      delete: "/v1/{name=projects/*/locations/*/features/*}"
    };
    option (google.api.method_signature) = "name";
    option (google.longrunning.operation_info) = {
      response_type: "google.protobuf.Empty"
      metadata_type: "OperationMetadata"
    };
  }

  // Updates an existing Membership.
  rpc UpdateMembership(UpdateMembershipRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      patch: "/v1/{name=projects/*/locations/*/memberships/*}"
      body: "resource"
    };
    option (google.api.method_signature) = "name,resource,update_mask";
    option (google.longrunning.operation_info) = {
      response_type: "Membership"
      metadata_type: "OperationMetadata"
    };
  }

  // Updates an existing Feature.
  rpc UpdateFeature(UpdateFeatureRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      patch: "/v1/{name=projects/*/locations/*/features/*}"
      body: "resource"
    };
    option (google.api.method_signature) = "name,resource,update_mask";
    option (google.longrunning.operation_info) = {
      response_type: "Feature"
      metadata_type: "OperationMetadata"
    };
  }

  // Generates the manifest for deployment of the GKE connect agent.
  //
  // **This method is used internally by Google-provided libraries.**
  // Most clients should not need to call this method directly.
  rpc GenerateConnectManifest(GenerateConnectManifestRequest)
      returns (GenerateConnectManifestResponse) {
    option (google.api.http) = {
      get: "/v1/{name=projects/*/locations/*/memberships/*}:generateConnectManifest"
    };
  }

  // Creates a fleet.
  rpc CreateFleet(CreateFleetRequest) returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1/{parent=projects/*/locations/*}/fleets"
      body: "fleet"
    };
    option (google.api.method_signature) = "parent,fleet";
    option (google.longrunning.operation_info) = {
      response_type: "Fleet"
      metadata_type: "OperationMetadata"
    };
  }

  // Returns the details of a fleet.
  rpc GetFleet(GetFleetRequest) returns (Fleet) {
    option (google.api.http) = {
      get: "/v1/{name=projects/*/locations/*/fleets/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Updates a fleet.
  rpc UpdateFleet(UpdateFleetRequest) returns (google.longrunning.Operation) {
    option (google.api.http) = {
      patch: "/v1/{fleet.name=projects/*/locations/*/fleets/*}"
      body: "fleet"
    };
    option (google.api.method_signature) = "fleet,update_mask";
    option (google.longrunning.operation_info) = {
      response_type: "Fleet"
      metadata_type: "OperationMetadata"
    };
  }

  // Removes a Fleet. There must be no memberships remaining in the Fleet.
  rpc DeleteFleet(DeleteFleetRequest) returns (google.longrunning.Operation) {
    option (google.api.http) = {
      delete: "/v1/{name=projects/*/locations/*/fleets/*}"
    };
    option (google.api.method_signature) = "name";
    option (google.longrunning.operation_info) = {
      response_type: "google.protobuf.Empty"
      metadata_type: "OperationMetadata"
    };
  }

  // Returns all fleets within an organization or a project that the caller has
  // access to.
  rpc ListFleets(ListFleetsRequest) returns (ListFleetsResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=projects/*/locations/*}/fleets"
      additional_bindings {
        get: "/v1/{parent=organizations/*/locations/*}/fleets"
      }
    };
    option (google.api.method_signature) = "parent";
  }

  // Returns the details of a fleet namespace.
  rpc GetScopeNamespace(GetScopeNamespaceRequest) returns (Namespace) {
    option (google.api.http) = {
      get: "/v1/{name=projects/*/locations/*/scopes/*/namespaces/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Creates a fleet namespace.
  rpc CreateScopeNamespace(CreateScopeNamespaceRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1/{parent=projects/*/locations/*/scopes/*}/namespaces"
      body: "scope_namespace"
    };
    option (google.api.method_signature) =
        "parent,scope_namespace,scope_namespace_id";
    option (google.longrunning.operation_info) = {
      response_type: "Namespace"
      metadata_type: "OperationMetadata"
    };
  }

  // Updates a fleet namespace.
  rpc UpdateScopeNamespace(UpdateScopeNamespaceRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      patch: "/v1/{scope_namespace.name=projects/*/locations/*/scopes/*/namespaces/*}"
      body: "scope_namespace"
    };
    option (google.api.method_signature) = "scope_namespace,update_mask";
    option (google.longrunning.operation_info) = {
      response_type: "Namespace"
      metadata_type: "OperationMetadata"
    };
  }

  // Deletes a fleet namespace.
  rpc DeleteScopeNamespace(DeleteScopeNamespaceRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      delete: "/v1/{name=projects/*/locations/*/scopes/*/namespaces/*}"
    };
    option (google.api.method_signature) = "name";
    option (google.longrunning.operation_info) = {
      response_type: "google.protobuf.Empty"
      metadata_type: "OperationMetadata"
    };
  }

  // Lists fleet namespaces.
  rpc ListScopeNamespaces(ListScopeNamespacesRequest)
      returns (ListScopeNamespacesResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=projects/*/locations/*/scopes/*}/namespaces"
    };
    option (google.api.method_signature) = "parent";
  }

  // Returns the details of a Scope RBACRoleBinding.
  rpc GetScopeRBACRoleBinding(GetScopeRBACRoleBindingRequest)
      returns (RBACRoleBinding) {
    option (google.api.http) = {
      get: "/v1/{name=projects/*/locations/*/scopes/*/rbacrolebindings/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Creates a Scope RBACRoleBinding.
  rpc CreateScopeRBACRoleBinding(CreateScopeRBACRoleBindingRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1/{parent=projects/*/locations/*/scopes/*}/rbacrolebindings"
      body: "rbacrolebinding"
    };
    option (google.api.method_signature) =
        "parent,rbacrolebinding,rbacrolebinding_id";
    option (google.longrunning.operation_info) = {
      response_type: "RBACRoleBinding"
      metadata_type: "OperationMetadata"
    };
  }

  // Updates a Scope RBACRoleBinding.
  rpc UpdateScopeRBACRoleBinding(UpdateScopeRBACRoleBindingRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      patch: "/v1/{rbacrolebinding.name=projects/*/locations/*/scopes/*/rbacrolebindings/*}"
      body: "rbacrolebinding"
    };
    option (google.api.method_signature) = "rbacrolebinding,update_mask";
    option (google.longrunning.operation_info) = {
      response_type: "RBACRoleBinding"
      metadata_type: "OperationMetadata"
    };
  }

  // Deletes a Scope RBACRoleBinding.
  rpc DeleteScopeRBACRoleBinding(DeleteScopeRBACRoleBindingRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      delete: "/v1/{name=projects/*/locations/*/scopes/*/rbacrolebindings/*}"
    };
    option (google.api.method_signature) = "name";
    option (google.longrunning.operation_info) = {
      response_type: "google.protobuf.Empty"
      metadata_type: "OperationMetadata"
    };
  }

  // Lists all Scope RBACRoleBindings.
  rpc ListScopeRBACRoleBindings(ListScopeRBACRoleBindingsRequest)
      returns (ListScopeRBACRoleBindingsResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=projects/*/locations/*/scopes/*}/rbacrolebindings"
    };
    option (google.api.method_signature) = "parent";
  }

  // Returns the details of a Scope.
  rpc GetScope(GetScopeRequest) returns (Scope) {
    option (google.api.http) = {
      get: "/v1/{name=projects/*/locations/*/scopes/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Creates a Scope.
  rpc CreateScope(CreateScopeRequest) returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1/{parent=projects/*/locations/*}/scopes"
      body: "scope"
    };
    option (google.api.method_signature) = "parent,scope,scope_id";
    option (google.longrunning.operation_info) = {
      response_type: "Scope"
      metadata_type: "OperationMetadata"
    };
  }

  // Updates a scopes.
  rpc UpdateScope(UpdateScopeRequest) returns (google.longrunning.Operation) {
    option (google.api.http) = {
      patch: "/v1/{scope.name=projects/*/locations/*/scopes/*}"
      body: "scope"
    };
    option (google.api.method_signature) = "scope,update_mask";
    option (google.longrunning.operation_info) = {
      response_type: "Scope"
      metadata_type: "OperationMetadata"
    };
  }

  // Deletes a Scope.
  rpc DeleteScope(DeleteScopeRequest) returns (google.longrunning.Operation) {
    option (google.api.http) = {
      delete: "/v1/{name=projects/*/locations/*/scopes/*}"
    };
    option (google.api.method_signature) = "name";
    option (google.longrunning.operation_info) = {
      response_type: "google.protobuf.Empty"
      metadata_type: "OperationMetadata"
    };
  }

  // Lists Scopes.
  rpc ListScopes(ListScopesRequest) returns (ListScopesResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=projects/*/locations/*}/scopes"
    };
    option (google.api.method_signature) = "parent";
  }

  // Lists permitted Scopes.
  rpc ListPermittedScopes(ListPermittedScopesRequest)
      returns (ListPermittedScopesResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=projects/*/locations/*}/scopes:listPermitted"
    };
    option (google.api.method_signature) = "parent";
  }

  // Returns the details of a MembershipBinding.
  rpc GetMembershipBinding(GetMembershipBindingRequest)
      returns (MembershipBinding) {
    option (google.api.http) = {
      get: "/v1/{name=projects/*/locations/*/memberships/*/bindings/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Creates a MembershipBinding.
  rpc CreateMembershipBinding(CreateMembershipBindingRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1/{parent=projects/*/locations/*/memberships/*}/bindings"
      body: "membership_binding"
    };
    option (google.api.method_signature) =
        "parent,membership_binding,membership_binding_id";
    option (google.longrunning.operation_info) = {
      response_type: "MembershipBinding"
      metadata_type: "OperationMetadata"
    };
  }

  // Updates a MembershipBinding.
  rpc UpdateMembershipBinding(UpdateMembershipBindingRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      patch: "/v1/{membership_binding.name=projects/*/locations/*/memberships/*/bindings/*}"
      body: "membership_binding"
    };
    option (google.api.method_signature) = "membership_binding,update_mask";
    option (google.longrunning.operation_info) = {
      response_type: "MembershipBinding"
      metadata_type: "OperationMetadata"
    };
  }

  // Deletes a MembershipBinding.
  rpc DeleteMembershipBinding(DeleteMembershipBindingRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      delete: "/v1/{name=projects/*/locations/*/memberships/*/bindings/*}"
    };
    option (google.api.method_signature) = "name";
    option (google.longrunning.operation_info) = {
      response_type: "google.protobuf.Empty"
      metadata_type: "OperationMetadata"
    };
  }

  // Lists MembershipBindings.
  rpc ListMembershipBindings(ListMembershipBindingsRequest)
      returns (ListMembershipBindingsResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=projects/*/locations/*/memberships/*}/bindings"
    };
    option (google.api.method_signature) = "parent";
  }

  // Returns the details of a Membership RBACRoleBinding.
  rpc GetMembershipRBACRoleBinding(GetMembershipRBACRoleBindingRequest)
      returns (RBACRoleBinding) {
    option (google.api.http) = {
      get: "/v1/{name=projects/*/locations/*/memberships/*/rbacrolebindings/*}"
    };
    option (google.api.method_signature) = "name";
  }

  // Creates a Membership RBACRoleBinding.
  rpc CreateMembershipRBACRoleBinding(CreateMembershipRBACRoleBindingRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      post: "/v1/{parent=projects/*/locations/*/memberships/*}/rbacrolebindings"
      body: "rbacrolebinding"
    };
    option (google.api.method_signature) =
        "parent,rbacrolebinding,rbacrolebinding_id";
    option (google.longrunning.operation_info) = {
      response_type: "RBACRoleBinding"
      metadata_type: "OperationMetadata"
    };
  }

  // Updates a Membership RBACRoleBinding.
  rpc UpdateMembershipRBACRoleBinding(UpdateMembershipRBACRoleBindingRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      patch: "/v1/{rbacrolebinding.name=projects/*/locations/*/memberships/*/rbacrolebindings/*}"
      body: "rbacrolebinding"
    };
    option (google.api.method_signature) = "rbacrolebinding,update_mask";
    option (google.longrunning.operation_info) = {
      response_type: "RBACRoleBinding"
      metadata_type: "OperationMetadata"
    };
  }

  // Deletes a Membership RBACRoleBinding.
  rpc DeleteMembershipRBACRoleBinding(DeleteMembershipRBACRoleBindingRequest)
      returns (google.longrunning.Operation) {
    option (google.api.http) = {
      delete: "/v1/{name=projects/*/locations/*/memberships/*/rbacrolebindings/*}"
    };
    option (google.api.method_signature) = "name";
    option (google.longrunning.operation_info) = {
      response_type: "google.protobuf.Empty"
      metadata_type: "OperationMetadata"
    };
  }

  // Lists all Membership RBACRoleBindings.
  rpc ListMembershipRBACRoleBindings(ListMembershipRBACRoleBindingsRequest)
      returns (ListMembershipRBACRoleBindingsResponse) {
    option (google.api.http) = {
      get: "/v1/{parent=projects/*/locations/*/memberships/*}/rbacrolebindings"
    };
    option (google.api.method_signature) = "parent";
  }

  // Generates a YAML of the  RBAC policies for the specified
  // RoleBinding and its associated impersonation resources.
  rpc GenerateMembershipRBACRoleBindingYAML(
      GenerateMembershipRBACRoleBindingYAMLRequest)
      returns (GenerateMembershipRBACRoleBindingYAMLResponse) {
    option (google.api.http) = {
      post: "/v1/{parent=projects/*/locations/*/memberships/*}/rbacrolebindings:generateMembershipRBACRoleBindingYAML"
      body: "rbacrolebinding"
    };
  }
}

// Request message for the `GkeHub.GetNamespace` method.
message GetScopeNamespaceRequest {
  // Required. The Namespace resource name in the format
  // `projects/*/locations/*/scopes/*/namespaces/*`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "gkehub.googleapis.com/Namespace"
    }
  ];
}

// Request to create a fleet namespace.
message CreateScopeNamespaceRequest {
  // Required. The parent (project and location) where the Namespace will be
  // created. Specified in the format `projects/*/locations/*/scopes/*`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "gkehub.googleapis.com/Namespace"
    }
  ];

  // Required. Client chosen ID for the Namespace. `namespace_id` must be a
  // valid RFC 1123 compliant DNS label:
  //
  //   1. At most 63 characters in length
  //   2. It must consist of lower case alphanumeric characters or `-`
  //   3. It must start and end with an alphanumeric character
  //
  // Which can be expressed as the regex: `[a-z0-9]([-a-z0-9]*[a-z0-9])?`,
  // with a maximum length of 63 characters.
  string scope_namespace_id = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. The fleet namespace to create.
  Namespace scope_namespace = 3 [(google.api.field_behavior) = REQUIRED];
}

// Request to update a fleet namespace.
message UpdateScopeNamespaceRequest {
  // Required. A namespace with fields updated. The 'name' field in this
  // namespace is used to identify the resource to update. Given 'updated'
  // prefix to follow go/proto-best-practices-checkers#keyword_conflict
  Namespace scope_namespace = 1 [(google.api.field_behavior) = REQUIRED];

  // Required. The fields to be updated.
  google.protobuf.FieldMask update_mask = 2
      [(google.api.field_behavior) = REQUIRED];
}

// Request to delete a fleet namespace.
message DeleteScopeNamespaceRequest {
  // Required. The Namespace resource name in the format
  // `projects/*/locations/*/scopes/*/namespaces/*`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "gkehub.googleapis.com/Namespace"
    }
  ];
}

// Request to list fleet namespaces.
message ListScopeNamespacesRequest {
  // Required. The parent (project and location) where the Features will be
  // listed. Specified in the format `projects/*/locations/*/scopes/*`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "gkehub.googleapis.com/Namespace"
    }
  ];

  // Optional. When requesting a 'page' of resources, `page_size` specifies
  // number of resources to return. If unspecified or set to 0, all resources
  // will be returned.
  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Token returned by previous call to `ListFeatures` which
  // specifies the position in the list from where to continue listing the
  // resources.
  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];
}

// List of fleet namespaces.
message ListScopeNamespacesResponse {
  // The list of fleet namespaces
  repeated Namespace scope_namespaces = 1;

  // A token to request the next page of resources from the
  // `ListNamespaces` method. The value of an empty string means
  // that there are no more resources to return.
  string next_page_token = 2;
}

// Request message for the `GkeHub.GetScopeRBACRoleBinding` method.
message GetScopeRBACRoleBindingRequest {
  // Required. The RBACRoleBinding resource name in the format
  // `projects/*/locations/*/scopes/*/rbacrolebindings/*`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "gkehub.googleapis.com/RBACRoleBinding"
    }
  ];
}

// Request to create a rbacrolebindings.
message CreateScopeRBACRoleBindingRequest {
  // Required. The parent (project and location) where the RBACRoleBinding will
  // be created. Specified in the format `projects/*/locations/*/scopes/*`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "gkehub.googleapis.com/RBACRoleBinding"
    }
  ];

  // Required. Client chosen ID for the RBACRoleBinding. `rbacrolebinding_id`
  // must be a valid RFC 1123 compliant DNS label:
  //
  //   1. At most 63 characters in length
  //   2. It must consist of lower case alphanumeric characters or `-`
  //   3. It must start and end with an alphanumeric character
  //
  // Which can be expressed as the regex: `[a-z0-9]([-a-z0-9]*[a-z0-9])?`,
  // with a maximum length of 63 characters.
  string rbacrolebinding_id = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. The rbacrolebindings to create.
  RBACRoleBinding rbacrolebinding = 3 [(google.api.field_behavior) = REQUIRED];
}

// Request to update a scope rbacrolebinding.
message UpdateScopeRBACRoleBindingRequest {
  // Required. A rbacrolebinding with fields updated. The 'name' field in this
  // rbacrolebinding is used to identify the resource to update.
  RBACRoleBinding rbacrolebinding = 1 [(google.api.field_behavior) = REQUIRED];

  // Required. The fields to be updated.
  google.protobuf.FieldMask update_mask = 2
      [(google.api.field_behavior) = REQUIRED];
}

// Request to delete a Scope RBACRoleBinding.
message DeleteScopeRBACRoleBindingRequest {
  // Required. The RBACRoleBinding resource name in the format
  // `projects/*/locations/*/scopes/*/rbacrolebindings/*`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "gkehub.googleapis.com/RBACRoleBinding"
    }
  ];
}

// Request to list Scope RBACRoleBindings.
message ListScopeRBACRoleBindingsRequest {
  // Required. The parent (project and location) where the Features will be
  // listed. Specified in the format `projects/*/locations/*/scopes/*`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "gkehub.googleapis.com/RBACRoleBinding"
    }
  ];

  // Optional. When requesting a 'page' of resources, `page_size` specifies
  // number of resources to return. If unspecified or set to 0, all resources
  // will be returned.
  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Token returned by previous call to `ListScopeRBACRoleBindings`
  // which specifies the position in the list from where to continue listing the
  // resources.
  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];
}

// List of Scope RBACRoleBindings.
message ListScopeRBACRoleBindingsResponse {
  // The list of Scope RBACRoleBindings.
  repeated RBACRoleBinding rbacrolebindings = 1;

  // A token to request the next page of resources from the
  // `ListScopeRBACRoleBindings` method. The value of an empty string means
  // that there are no more resources to return.
  string next_page_token = 2;
}

// Request message for the `GkeHub.GetScope` method.
message GetScopeRequest {
  // Required. The Scope resource name in the format
  // `projects/*/locations/*/scopes/*`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = { type: "gkehub.googleapis.com/Scope" }
  ];
}

// Request to create a Scope.
message CreateScopeRequest {
  // Required. The parent (project and location) where the Scope will be
  // created. Specified in the format `projects/*/locations/*`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "gkehub.googleapis.com/Scope"
    }
  ];

  // Required. Client chosen ID for the Scope. `scope_id` must be a
  // ????
  string scope_id = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. The Scope to create.
  Scope scope = 3 [(google.api.field_behavior) = REQUIRED];
}

// Request to update a Scope.
message UpdateScopeRequest {
  // Required. A Scope with fields updated. The 'name' field in this
  // namespace is used to identify the resource to update.
  Scope scope = 1 [(google.api.field_behavior) = REQUIRED];

  // Required. The fields to be updated.
  google.protobuf.FieldMask update_mask = 2
      [(google.api.field_behavior) = REQUIRED];
}

// Request to delete a Scope.
message DeleteScopeRequest {
  // Required. The Scope resource name in the format
  // `projects/*/locations/*/scopes/*`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = { type: "gkehub.googleapis.com/Scope" }
  ];
}

// Request to list Scopes.
message ListScopesRequest {
  // Required. The parent (project and location) where the Scope will be listed.
  // Specified in the format `projects/*/locations/*`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "gkehub.googleapis.com/Scope"
    }
  ];

  // Optional. When requesting a 'page' of resources, `page_size` specifies
  // number of resources to return. If unspecified or set to 0, all resources
  // will be returned.
  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Token returned by previous call to `ListScopes` which
  // specifies the position in the list from where to continue listing the
  // resources.
  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];
}

// List of Scopes.
message ListScopesResponse {
  // The list of Scopes
  repeated Scope scopes = 1;

  // A token to request the next page of resources from the
  // `ListScopes` method. The value of an empty string means
  // that there are no more resources to return.
  string next_page_token = 2;
}

// Request to list permitted Scopes.
message ListPermittedScopesRequest {
  // Required. The parent (project and location) where the Scope will be listed.
  // Specified in the format `projects/*/locations/*`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "gkehub.googleapis.com/Scope"
    }
  ];

  // Optional. When requesting a 'page' of resources, `page_size` specifies
  // number of resources to return. If unspecified or set to 0, all resources
  // will be returned.
  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Token returned by previous call to `ListPermittedScopes` which
  // specifies the position in the list from where to continue listing the
  // resources.
  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];
}

// List of permitted Scopes.
message ListPermittedScopesResponse {
  // The list of permitted Scopes
  repeated Scope scopes = 1;

  // A token to request the next page of resources from the
  // `ListPermittedScopes` method. The value of an empty string means
  // that there are no more resources to return.
  string next_page_token = 2;
}

// Request message for the `GkeHub.GetMembershipBinding` method.
message GetMembershipBindingRequest {
  // Required. The MembershipBinding resource name in the format
  // `projects/*/locations/*/memberships/*/bindings/*`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "gkehub.googleapis.com/MembershipBinding"
    }
  ];
}

// Request to create a MembershipBinding.
message CreateMembershipBindingRequest {
  // Required. The parent (project and location) where the MembershipBinding
  // will be created. Specified in the format
  // `projects/*/locations/*/memberships/*`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "gkehub.googleapis.com/MembershipBinding"
    }
  ];

  // Required. The MembershipBinding to create.
  MembershipBinding membership_binding = 2
      [(google.api.field_behavior) = REQUIRED];

  // Required. The ID to use for the MembershipBinding.
  string membership_binding_id = 3 [(google.api.field_behavior) = REQUIRED];
}

// Request to update a MembershipBinding.
message UpdateMembershipBindingRequest {
  // Required. The MembershipBinding object with fields updated.
  MembershipBinding membership_binding = 1
      [(google.api.field_behavior) = REQUIRED];

  // Required. The fields to be updated.
  google.protobuf.FieldMask update_mask = 2
      [(google.api.field_behavior) = REQUIRED];
}

// Request to delete a Binding.
message DeleteMembershipBindingRequest {
  // Required. The MembershipBinding resource name in the format
  // `projects/*/locations/*/memberships/*/bindings/*`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "gkehub.googleapis.com/MembershipBinding"
    }
  ];
}

// Request to list MembershipBinding.
message ListMembershipBindingsRequest {
  // Required. The parent Membership for which the MembershipBindings will be
  // listed. Specified in the format `projects/*/locations/*/memberships/*`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "gkehub.googleapis.com/MembershipBinding"
    }
  ];

  // Optional. When requesting a 'page' of resources, `page_size` specifies
  // number of resources to return. If unspecified or set to 0, all resources
  // will be returned.
  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Token returned by previous call to `ListMembershipBindings` which
  // specifies the position in the list from where to continue listing the
  // resources.
  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Lists MembershipBindings that match the filter expression,
  // following the syntax outlined in https://google.aip.dev/160.
  string filter = 4 [(google.api.field_behavior) = OPTIONAL];
}

// List of MembershipBindings.
message ListMembershipBindingsResponse {
  // The list of membership_bindings
  repeated MembershipBinding membership_bindings = 1;

  // A token to request the next page of resources from the
  // `ListMembershipBindings` method. The value of an empty string means
  // that there are no more resources to return.
  string next_page_token = 2;

  // List of locations that could not be reached while fetching this list.
  repeated string unreachable = 3;
}

// Request message for `GkeHub.ListMemberships` method.
message ListMembershipsRequest {
  // Required. The parent (project and location) where the Memberships will be
  // listed. Specified in the format `projects/*/locations/*`.
  // `projects/*/locations/-` list memberships in all the regions.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "gkehub.googleapis.com/Membership"
    }
  ];

  // Optional. When requesting a 'page' of resources, `page_size` specifies
  // number of resources to return. If unspecified or set to 0, all resources
  // will be returned.
  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Token returned by previous call to `ListMemberships` which
  // specifies the position in the list from where to continue listing the
  // resources.
  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Lists Memberships that match the filter expression, following the
  // syntax outlined in https://google.aip.dev/160.
  //
  // Examples:
  //
  //   - Name is `bar` in project `foo-proj` and location `global`:
  //
  //       name = "projects/foo-proj/locations/global/membership/bar"
  //
  //   - Memberships that have a label called `foo`:
  //
  //       labels.foo:*
  //
  //   - Memberships that have a label called `foo` whose value is `bar`:
  //
  //       labels.foo = bar
  //
  //   - Memberships in the CREATING state:
  //
  //       state = CREATING
  string filter = 4 [(google.api.field_behavior) = OPTIONAL];

  // Optional. One or more fields to compare and use to sort the output.
  // See https://google.aip.dev/132#ordering.
  string order_by = 5 [(google.api.field_behavior) = OPTIONAL];
}

// Request message for the `GkeHub.GetMembershipRBACRoleBinding` method.
message GetMembershipRBACRoleBindingRequest {
  // Required. The RBACRoleBinding resource name in the format
  // `projects/*/locations/*/memberships/*/rbacrolebindings/*`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "gkehub.googleapis.com/RBACRoleBinding"
    }
  ];
}

// Request to create a rbacrolebindings.
message CreateMembershipRBACRoleBindingRequest {
  // Required. The parent (project and location) where the RBACRoleBinding will
  // be created. Specified in the format `projects/*/locations/*/memberships/*`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "gkehub.googleapis.com/RBACRoleBinding"
    }
  ];

  // Required. Client chosen ID for the RBACRoleBinding. `rbacrolebinding_id`
  // must be a valid RFC 1123 compliant DNS label:
  //
  //   1. At most 63 characters in length
  //   2. It must consist of lower case alphanumeric characters or `-`
  //   3. It must start and end with an alphanumeric character
  //
  // Which can be expressed as the regex: `[a-z0-9]([-a-z0-9]*[a-z0-9])?`,
  // with a maximum length of 63 characters.
  string rbacrolebinding_id = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. The rbacrolebindings to create.
  RBACRoleBinding rbacrolebinding = 3 [(google.api.field_behavior) = REQUIRED];
}

// Request to update a membership rbacrolebinding.
message UpdateMembershipRBACRoleBindingRequest {
  // Required. A rbacrolebinding with fields updated. The 'name' field in this
  // rbacrolebinding is used to identify the resource to update.
  RBACRoleBinding rbacrolebinding = 1 [(google.api.field_behavior) = REQUIRED];

  // Required. The fields to be updated.
  google.protobuf.FieldMask update_mask = 2
      [(google.api.field_behavior) = REQUIRED];
}

// Request to delete a Membership RBACRoleBinding.
message DeleteMembershipRBACRoleBindingRequest {
  // Required. The RBACRoleBinding resource name in the format
  // `projects/*/locations/*/memberships/*/rbacrolebindings/*`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "gkehub.googleapis.com/RBACRoleBinding"
    }
  ];
}

// Request to list Membership RBACRoleBindings.
message ListMembershipRBACRoleBindingsRequest {
  // Required. The parent (project and location) where the Features will be
  // listed. Specified in the format `projects/*/locations/*/memberships/*`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "gkehub.googleapis.com/RBACRoleBinding"
    }
  ];

  // Optional. When requesting a 'page' of resources, `page_size` specifies
  // number of resources to return. If unspecified or set to 0, all resources
  // will be returned.
  int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Token returned by previous call to
  // `ListMembershipRBACRoleBindings` which specifies the position in the list
  // from where to continue listing the resources.
  string page_token = 3 [(google.api.field_behavior) = OPTIONAL];
}

// List of Membership RBACRoleBindings.
message ListMembershipRBACRoleBindingsResponse {
  // The list of Membership RBACRoleBindings.
  repeated RBACRoleBinding rbacrolebindings = 1;

  // A token to request the next page of resources from the
  // `ListMembershipRBACRoleBindings` method. The value of an empty string means
  // that there are no more resources to return.
  string next_page_token = 2;

  // List of locations that could not be reached while fetching this list.
  repeated string unreachable = 3;
}

// Request to generate a YAML of the RBAC policies for the specified
// RoleBinding and its associated impersonation resources.
message GenerateMembershipRBACRoleBindingYAMLRequest {
  // Required. The parent (project and location) where the RBACRoleBinding will
  // be created. Specified in the format `projects/*/locations/*/memberships/*`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      // Manually set the type to be the Membership resource type because the
      // RBACRoleBinding is a child of the Membership resource and
      // GenerateMembershipRBACRoleBindingYAM RPC should
      // only be called with the membership resource parent.
      type: "gkehub.googleapis.com/Membership"
    }
  ];

  // Required. Client chosen ID for the RBACRoleBinding. `rbacrolebinding_id`
  // must be a valid RFC 1123 compliant DNS label:
  //
  //   1. At most 63 characters in length
  //   2. It must consist of lower case alphanumeric characters or `-`
  //   3. It must start and end with an alphanumeric character
  //
  // Which can be expressed as the regex: `[a-z0-9]([-a-z0-9]*[a-z0-9])?`,
  // with a maximum length of 63 characters.
  string rbacrolebinding_id = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. The rbacrolebindings to generate the YAML for.
  RBACRoleBinding rbacrolebinding = 3 [(google.api.field_behavior) = REQUIRED];
}

// Response for GenerateRBACRoleBindingYAML.
message GenerateMembershipRBACRoleBindingYAMLResponse {
  // a yaml text blob including the RBAC policies.
  string role_bindings_yaml = 1;
}

// Response message for the `GkeHub.ListMemberships` method.
message ListMembershipsResponse {
  // The list of matching Memberships.
  repeated Membership resources = 1;

  // A token to request the next page of resources from the
  // `ListMemberships` method. The value of an empty string means that
  // there are no more resources to return.
  string next_page_token = 2;

  // List of locations that could not be reached while fetching this list.
  repeated string unreachable = 3;
}

// Request message for `GkeHub.GetMembership` method.
message GetMembershipRequest {
  // Required. The Membership resource name in the format
  // `projects/*/locations/*/memberships/*`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "gkehub.googleapis.com/Membership"
    }
  ];
}

// Request to list Memberships bound to a Scope.
message ListBoundMembershipsRequest {
  // Required. Name of the Scope, in the format
  // `projects/*/locations/global/scopes/*`, to which the Memberships are bound.
  string scope_name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = { type: "gkehub.googleapis.com/Scope" }
  ];

  // Optional. Lists Memberships that match the filter expression, following the
  // syntax outlined in https://google.aip.dev/160. Currently, filtering
  // can be done only based on Memberships's `name`, `labels`, `create_time`,
  // `update_time`, and `unique_id`.
  string filter = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. When requesting a 'page' of resources, `page_size` specifies
  // number of resources to return. If unspecified or set to 0, all resources
  // will be returned. Pagination is currently not supported; therefore, setting
  // this field does not have any impact for now.
  int32 page_size = 3 [(google.api.field_behavior) = OPTIONAL];

  // Optional. Token returned by previous call to `ListBoundMemberships` which
  // specifies the position in the list from where to continue listing the
  // resources.
  string page_token = 4 [(google.api.field_behavior) = OPTIONAL];
}

// List of Memberships bound to a Scope.
message ListBoundMembershipsResponse {
  // The list of Memberships bound to the given Scope.
  repeated Membership memberships = 1;

  // List of locations that could not be reached while fetching this list.
  repeated string unreachable = 2;

  // A token to request the next page of resources from the
  // `ListBoundMemberships` method. The value of an empty string means that
  // there are no more resources to return.
  string next_page_token = 3;
}

// Request message for the `GkeHub.CreateMembership` method.
message CreateMembershipRequest {
  // Required. The parent (project and location) where the Memberships will be
  // created. Specified in the format `projects/*/locations/*`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      child_type: "gkehub.googleapis.com/Membership"
    }
  ];

  // Required. Client chosen ID for the membership. `membership_id` must be a
  // valid RFC 1123 compliant DNS label:
  //
  //   1. At most 63 characters in length
  //   2. It must consist of lower case alphanumeric characters or `-`
  //   3. It must start and end with an alphanumeric character
  //
  // Which can be expressed as the regex: `[a-z0-9]([-a-z0-9]*[a-z0-9])?`,
  // with a maximum length of 63 characters.
  string membership_id = 2 [(google.api.field_behavior) = REQUIRED];

  // Required. The membership to create.
  Membership resource = 3 [(google.api.field_behavior) = REQUIRED];

  // Optional. A request ID to identify requests. Specify a unique request ID
  // so that if you must retry your request, the server will know to ignore
  // the request if it has already been completed. The server will guarantee
  // that for at least 60 minutes after the first request.
  //
  // For example, consider a situation where you make an initial request and
  // the request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 4 [(google.api.field_behavior) = OPTIONAL];
}

// Request message for `GkeHub.DeleteMembership` method.
message DeleteMembershipRequest {
  // Required. The Membership resource name in the format
  // `projects/*/locations/*/memberships/*`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "gkehub.googleapis.com/Membership"
    }
  ];

  // Optional. A request ID to identify requests. Specify a unique request ID
  // so that if you must retry your request, the server will know to ignore
  // the request if it has already been completed. The server will guarantee
  // that for at least 60 minutes after the first request.
  //
  // For example, consider a situation where you make an initial request and
  // the request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. If set to true, any subresource from this Membership will also be
  // deleted. Otherwise, the request will only work if the Membership has no
  // subresource.
  bool force = 3 [(google.api.field_behavior) = OPTIONAL];
}

// Request message for `GkeHub.UpdateMembership` method.
message UpdateMembershipRequest {
  // Required. The Membership resource name in the format
  // `projects/*/locations/*/memberships/*`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "gkehub.googleapis.com/Membership"
    }
  ];

  // Required. Mask of fields to update.
  google.protobuf.FieldMask update_mask = 2
      [(google.api.field_behavior) = REQUIRED];

  // Required. Only fields specified in update_mask are updated.
  // If you specify a field in the update_mask but don't specify its value here
  // that field will be deleted.
  // If you are updating a map field, set the value of a key to null or empty
  // string to delete the key from the map. It's not possible to update a key's
  // value to the empty string.
  // If you specify the update_mask to be a special path "*", fully replaces all
  // user-modifiable fields to match `resource`.
  Membership resource = 3 [(google.api.field_behavior) = REQUIRED];

  // Optional. A request ID to identify requests. Specify a unique request ID
  // so that if you must retry your request, the server will know to ignore
  // the request if it has already been completed. The server will guarantee
  // that for at least 60 minutes after the first request.
  //
  // For example, consider a situation where you make an initial request and
  // the request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 4 [(google.api.field_behavior) = OPTIONAL];
}

// Request message for `GkeHub.GenerateConnectManifest`
// method.
// .
message GenerateConnectManifestRequest {
  // Required. The Membership resource name the Agent will associate with, in
  // the format `projects/*/locations/*/memberships/*`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      type: "gkehub.googleapis.com/Membership"
    }
  ];

  // Optional. Namespace for GKE Connect agent resources. Defaults to
  // `gke-connect`.
  //
  // The Connect Agent is authorized automatically when run in the default
  // namespace. Otherwise, explicit authorization must be granted with an
  // additional IAM binding.
  string namespace = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. URI of a proxy if connectivity from the agent to
  // gkeconnect.googleapis.com requires the use of a proxy. Format must be in
  // the form `http(s)://{proxy_address}`, depending on the HTTP/HTTPS protocol
  // supported by the proxy. This will direct the connect agent's outbound
  // traffic through a HTTP(S) proxy.
  bytes proxy = 3 [(google.api.field_behavior) = OPTIONAL];

  // Optional. The Connect agent version to use. Defaults to the most current
  // version.
  string version = 4 [(google.api.field_behavior) = OPTIONAL];

  // Optional. If true, generate the resources for upgrade only. Some resources
  // generated only for installation (e.g. secrets) will be excluded.
  bool is_upgrade = 5 [(google.api.field_behavior) = OPTIONAL];

  // Optional. The registry to fetch the connect agent image from. Defaults to
  // gcr.io/gkeconnect.
  string registry = 6 [(google.api.field_behavior) = OPTIONAL];

  // Optional. The image pull secret content for the registry, if not public.
  bytes image_pull_secret_content = 7 [(google.api.field_behavior) = OPTIONAL];
}

// GenerateConnectManifestResponse contains manifest information for
// installing/upgrading a Connect agent.
message GenerateConnectManifestResponse {
  // The ordered list of Kubernetes resources that need to be applied to the
  // cluster for GKE Connect agent installation/upgrade.
  repeated ConnectAgentResource manifest = 1;
}

// ConnectAgentResource represents a Kubernetes resource manifest for Connect
// Agent deployment.
message ConnectAgentResource {
  // Kubernetes type of the resource.
  TypeMeta type = 1;

  // YAML manifest of the resource.
  string manifest = 2;
}

// TypeMeta is the type information needed for content unmarshalling of
// Kubernetes resources in the manifest.
message TypeMeta {
  // Kind of the resource (e.g. Deployment).
  string kind = 1;

  // APIVersion of the resource (e.g. v1).
  string api_version = 2;
}

// Request message for `GkeHub.ListFeatures` method.
message ListFeaturesRequest {
  // Required. The parent (project and location) where the Features will be
  // listed. Specified in the format `projects/*/locations/*`.
  string parent = 1 [(google.api.resource_reference) = {
    child_type: "gkehub.googleapis.com/Feature"
  }];

  // When requesting a 'page' of resources, `page_size` specifies number of
  // resources to return. If unspecified or set to 0, all resources will
  // be returned.
  int32 page_size = 2;

  // Token returned by previous call to `ListFeatures` which
  // specifies the position in the list from where to continue listing the
  // resources.
  string page_token = 3;

  // Lists Features that match the filter expression, following the syntax
  // outlined in https://google.aip.dev/160.
  //
  // Examples:
  //
  //   - Feature with the name "servicemesh" in project "foo-proj":
  //
  //       name = "projects/foo-proj/locations/global/features/servicemesh"
  //
  //   - Features that have a label called `foo`:
  //
  //       labels.foo:*
  //
  //   - Features that have a label called `foo` whose value is `bar`:
  //
  //       labels.foo = bar
  string filter = 4;

  // One or more fields to compare and use to sort the output.
  // See https://google.aip.dev/132#ordering.
  string order_by = 5;

  // Optional. If set to true, the response will return partial results when
  // some regions are unreachable and the unreachable field in Feature proto
  // will be populated. If set to false, the request will fail when some regions
  // are unreachable.
  bool return_partial_success = 6 [(google.api.field_behavior) = OPTIONAL];
}

// Response message for the `GkeHub.ListFeatures` method.
message ListFeaturesResponse {
  // The list of matching Features
  repeated Feature resources = 1;

  // A token to request the next page of resources from the
  // `ListFeatures` method. The value of an empty string means
  // that there are no more resources to return.
  string next_page_token = 2;
}

// Request message for `GkeHub.GetFeature` method.
message GetFeatureRequest {
  // Required. The Feature resource name in the format
  // `projects/*/locations/*/features/*`
  string name = 1 [
    (google.api.resource_reference) = { type: "gkehub.googleapis.com/Feature" }
  ];

  // Optional. If set to true, the response will return partial results when
  // some regions are unreachable and the unreachable field in Feature proto
  // will be populated. If set to false, the request will fail when some regions
  // are unreachable.
  bool return_partial_success = 2 [(google.api.field_behavior) = OPTIONAL];
}

// Request message for the `GkeHub.CreateFeature` method.
message CreateFeatureRequest {
  // Required. The parent (project and location) where the Feature will be
  // created. Specified in the format `projects/*/locations/*`.
  string parent = 1 [(google.api.resource_reference) = {
    child_type: "gkehub.googleapis.com/Feature"
  }];

  // The ID of the feature to create.
  string feature_id = 2;

  // The Feature resource to create.
  Feature resource = 3;

  // A request ID to identify requests. Specify a unique request ID
  // so that if you must retry your request, the server will know to ignore
  // the request if it has already been completed. The server will guarantee
  // that for at least 60 minutes after the first request.
  //
  // For example, consider a situation where you make an initial request and
  // the request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 4;
}

// Request message for `GkeHub.DeleteFeature` method.
message DeleteFeatureRequest {
  // Required. The Feature resource name in the format
  // `projects/*/locations/*/features/*`.
  string name = 1 [
    (google.api.resource_reference) = { type: "gkehub.googleapis.com/Feature" }
  ];

  // If set to true, the delete will ignore any outstanding resources for
  // this Feature (that is, `FeatureState.has_resources` is set to true). These
  // resources will NOT be cleaned up or modified in any way.
  bool force = 2;

  // Optional. A request ID to identify requests. Specify a unique request ID
  // so that if you must retry your request, the server will know to ignore
  // the request if it has already been completed. The server will guarantee
  // that for at least 60 minutes after the first request.
  //
  // For example, consider a situation where you make an initial request and
  // the request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 3 [(google.api.field_behavior) = OPTIONAL];
}

// Request message for `GkeHub.UpdateFeature` method.
message UpdateFeatureRequest {
  // Required. The Feature resource name in the format
  // `projects/*/locations/*/features/*`.
  string name = 1 [
    (google.api.resource_reference) = { type: "gkehub.googleapis.com/Feature" }
  ];

  // Mask of fields to update.
  google.protobuf.FieldMask update_mask = 2;

  // Only fields specified in update_mask are updated.
  // If you specify a field in the update_mask but don't specify its value here
  // that field will be deleted.
  // If you are updating a map field, set the value of a key to null or empty
  // string to delete the key from the map. It's not possible to update a key's
  // value to the empty string.
  // If you specify the update_mask to be a special path "*", fully replaces all
  // user-modifiable fields to match `resource`.
  Feature resource = 3;

  // A request ID to identify requests. Specify a unique request ID
  // so that if you must retry your request, the server will know to ignore
  // the request if it has already been completed. The server will guarantee
  // that for at least 60 minutes after the first request.
  //
  // For example, consider a situation where you make an initial request and
  // the request times out. If you make the request again with the same request
  // ID, the server can check if original operation with the same request ID
  // was received, and if so, will ignore the second request. This prevents
  // clients from accidentally creating duplicate commitments.
  //
  // The request ID must be a valid UUID with the exception that zero UUID is
  // not supported (00000000-0000-0000-0000-000000000000).
  string request_id = 4;
}

// Request message for the `GkeHub.CreateFleet` method.
message CreateFleetRequest {
  // Required. The parent (project and location) where the Fleet will be
  // created. Specified in the format `projects/*/locations/*`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      // Manually set the type to "locations.googleapis.com/Location" because
      // the generated child_type - `gkehub.googleapis.com/Fleet` creates a
      // conflict between Organization and Project Level locations with client
      // library generation.
      type: "locations.googleapis.com/Location",
    }
  ];

  // Required. The fleet to create.
  Fleet fleet = 2 [(google.api.field_behavior) = REQUIRED];
}

// Request message for the `GkeHub.GetFleet` method.
message GetFleetRequest {
  // Required. The Fleet resource name in the format
  // `projects/*/locations/*/fleets/*`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = { type: "gkehub.googleapis.com/Fleet" }
  ];
}

// Request message for the `GkeHub.UpdateFleet` method.
message UpdateFleetRequest {
  // Required. The Fleet to update.
  //
  // The `name` field of the Fleet object identifies which fleet will be
  // updated.
  Fleet fleet = 1 [(google.api.field_behavior) = REQUIRED];

  // Required. The fields to be updated;
  google.protobuf.FieldMask update_mask = 2
      [(google.api.field_behavior) = REQUIRED];
}

// Request message for `GkeHub.DeleteFleet` method.
message DeleteFleetRequest {
  // Required. The Fleet resource name in the format
  // `projects/*/locations/*/fleets/*`.
  string name = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = { type: "gkehub.googleapis.com/Fleet" }
  ];
}

// Request message for the `GkeHub.ListFleets` method.
message ListFleetsRequest {
  // Required. The organization or project to list for Fleets under, in the
  // format `organizations/*/locations/*` or `projects/*/locations/*`.
  string parent = 1 [
    (google.api.field_behavior) = REQUIRED,
    (google.api.resource_reference) = {
      // Manually set the type to "locations.googleapis.com/Location" because
      // the generated child_type - `gkehub.googleapis.com/Fleet` creates a
      // conflict between Organization and Project Level locations with client
      // library generation.
      type: "locations.googleapis.com/Location",
    }
  ];

  // Optional. A page token, received from a previous `ListFleets` call.
  // Provide this to retrieve the subsequent page.
  //
  // When paginating, all other parameters provided to `ListFleets` must match
  // the call that provided the page token.
  string page_token = 2 [(google.api.field_behavior) = OPTIONAL];

  // Optional. The maximum number of fleets to return. The service may return
  // fewer than this value. If unspecified, at most 200 fleets will be returned.
  // The maximum value is 1000; values above 1000 will be coerced to 1000.
  int32 page_size = 3 [(google.api.field_behavior) = OPTIONAL];
}

// Response message for the `GkeHub.ListFleetsResponse` method.
message ListFleetsResponse {
  // The list of matching fleets.
  repeated Fleet fleets = 1;

  // A token, which can be sent as `page_token` to retrieve the next page.
  // If this field is omitted, there are no subsequent pages.
  // The token is only valid for 1h.
  string next_page_token = 2;
}

// Represents the metadata of the long-running operation.
message OperationMetadata {
  // Output only. The time the operation was created.
  google.protobuf.Timestamp create_time = 1
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. The time the operation finished running.
  google.protobuf.Timestamp end_time = 2
      [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Server-defined resource path for the target of the operation.
  string target = 3 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Name of the verb executed by the operation.
  string verb = 4 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Human-readable status of the operation, if any.
  string status_detail = 5 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. Identifies whether the user has requested cancellation
  // of the operation. Operations that have successfully been cancelled
  // have
  // [google.longrunning.Operation.error][google.longrunning.Operation.error]
  // value with a [google.rpc.Status.code][google.rpc.Status.code] of 1,
  // corresponding to `Code.CANCELLED`.
  bool cancel_requested = 6 [(google.api.field_behavior) = OUTPUT_ONLY];

  // Output only. API version used to start the operation.
  string api_version = 7 [(google.api.field_behavior) = OUTPUT_ONLY];
}