feat: Automated regeneration of BinaryAuthorization client

clients/binary_authorization/README.md

@@ -11,7 +11,7 @@ Install this package from [Hex](https://hex.pm) by adding
 
 ```elixir
 def deps do
-  [{:google_api_binary_authorization, "~> 0.14"}]
+  [{:google_api_binary_authorization, "~> 0.15"}]
 end
 ```
 

clients/binary_authorization/lib/google_api/binary_authorization/v1/metadata.ex

@@ -20,7 +20,7 @@ defmodule GoogleApi.BinaryAuthorization.V1 do
   API client metadata for GoogleApi.BinaryAuthorization.V1.
   """
 
-  @discovery_revision "20220826"
+  @discovery_revision "20240301"
 
   def discovery_revision(), do: @discovery_revision
 end

clients/binary_authorization/lib/google_api/binary_authorization/v1/model/admission_rule.ex

@@ -23,7 +23,7 @@ defmodule GoogleApi.BinaryAuthorization.V1.Model.AdmissionRule do
 
   *   `enforcementMode` (*type:* `String.t`, *default:* `nil`) - Required. The action when a pod creation is denied by the admission rule.
   *   `evaluationMode` (*type:* `String.t`, *default:* `nil`) - Required. How this admission rule will be evaluated.
-  *   `requireAttestationsBy` (*type:* `list(String.t)`, *default:* `nil`) - Optional. The resource names of the attestors that must attest to a container image, in the format `projects/*/attestors/*`. Each attestor must exist before a policy can reference it. To add an attestor to a policy the principal issuing the policy change request must be able to read the attestor resource. Note: this field must be non-empty when the evaluation_mode field specifies REQUIRE_ATTESTATION, otherwise it must be empty.
+  *   `requireAttestationsBy` (*type:* `list(String.t)`, *default:* `nil`) - Optional. The resource names of the attestors that must attest to a container image, in the format `projects/*/attestors/*`. Each attestor must exist before a policy can reference it. To add an attestor to a policy the principal issuing the policy change request must be able to read the attestor resource. Note: this field must be non-empty when the `evaluation_mode` field specifies `REQUIRE_ATTESTATION`, otherwise it must be empty.
   """
 
   use GoogleApi.Gax.ModelBase

clients/binary_authorization/lib/google_api/binary_authorization/v1/model/allowlist_result.ex

@@ -0,0 +1,46 @@
+# Copyright 2019 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# NOTE: This file is auto generated by the elixir code generator program.
+# Do not edit this file manually.
+
+defmodule GoogleApi.BinaryAuthorization.V1.Model.AllowlistResult do
+  @moduledoc """
+  Result of evaluating an image name allowlist.
+
+  ## Attributes
+
+  *   `matchedPattern` (*type:* `String.t`, *default:* `nil`) - The allowlist pattern that the image matched.
+  """
+
+  use GoogleApi.Gax.ModelBase
+
+  @type t :: %__MODULE__{
+          :matchedPattern => String.t() | nil
+        }
+
+  field(:matchedPattern)
+end
+
+defimpl Poison.Decoder, for: GoogleApi.BinaryAuthorization.V1.Model.AllowlistResult do
+  def decode(value, options) do
+    GoogleApi.BinaryAuthorization.V1.Model.AllowlistResult.decode(value, options)
+  end
+end
+
+defimpl Poison.Encoder, for: GoogleApi.BinaryAuthorization.V1.Model.AllowlistResult do
+  def encode(value, options) do
+    GoogleApi.Gax.ModelBase.encode(value, options)
+  end
+end

clients/binary_authorization/lib/google_api/binary_authorization/v1/model/attestation_authenticator.ex

@@ -0,0 +1,49 @@
+# Copyright 2019 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# NOTE: This file is auto generated by the elixir code generator program.
+# Do not edit this file manually.
+
+defmodule GoogleApi.BinaryAuthorization.V1.Model.AttestationAuthenticator do
+  @moduledoc """
+  An attestation authenticator that will be used to verify attestations. Typically this is just a set of public keys. Conceptually, an authenticator can be treated as always returning either "authenticated" or "not authenticated" when presented with a signed attestation (almost always assumed to be a [DSSE](https://github.com/secure-systems-lab/dsse) attestation). The details of how an authenticator makes this decision are specific to the type of 'authenticator' that this message wraps.
+
+  ## Attributes
+
+  *   `displayName` (*type:* `String.t`, *default:* `nil`) - Optional. A user-provided name for this `AttestationAuthenticator`. This field has no effect on the policy evaluation behavior except to improve readability of messages in evaluation results.
+  *   `pkixPublicKeySet` (*type:* `GoogleApi.BinaryAuthorization.V1.Model.PkixPublicKeySet.t`, *default:* `nil`) - Optional. A set of raw PKIX SubjectPublicKeyInfo format public keys. If any public key in the set validates the attestation signature, then the signature is considered authenticated (i.e. any one key is sufficient to authenticate).
+  """
+
+  use GoogleApi.Gax.ModelBase
+
+  @type t :: %__MODULE__{
+          :displayName => String.t() | nil,
+          :pkixPublicKeySet => GoogleApi.BinaryAuthorization.V1.Model.PkixPublicKeySet.t() | nil
+        }
+
+  field(:displayName)
+  field(:pkixPublicKeySet, as: GoogleApi.BinaryAuthorization.V1.Model.PkixPublicKeySet)
+end
+
+defimpl Poison.Decoder, for: GoogleApi.BinaryAuthorization.V1.Model.AttestationAuthenticator do
+  def decode(value, options) do
+    GoogleApi.BinaryAuthorization.V1.Model.AttestationAuthenticator.decode(value, options)
+  end
+end
+
+defimpl Poison.Encoder, for: GoogleApi.BinaryAuthorization.V1.Model.AttestationAuthenticator do
+  def encode(value, options) do
+    GoogleApi.Gax.ModelBase.encode(value, options)
+  end
+end

clients/binary_authorization/lib/google_api/binary_authorization/v1/model/attestation_source.ex

@@ -0,0 +1,46 @@
+# Copyright 2019 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+# NOTE: This file is auto generated by the elixir code generator program.
+# Do not edit this file manually.
+
+defmodule GoogleApi.BinaryAuthorization.V1.Model.AttestationSource do
+  @moduledoc """
+  Specifies the locations for fetching the provenance attestations.
+
+  ## Attributes
+
+  *   `containerAnalysisAttestationProjects` (*type:* `list(String.t)`, *default:* `nil`) - The IDs of the Google Cloud projects that store the SLSA attestations as Container Analysis Occurrences, in the format `projects/[PROJECT_ID]`. Maximum number of `container_analysis_attestation_projects` allowed in each `AttestationSource` is 10.
+  """
+
+  use GoogleApi.Gax.ModelBase
+
+  @type t :: %__MODULE__{
+          :containerAnalysisAttestationProjects => list(String.t()) | nil
+        }
+
+  field(:containerAnalysisAttestationProjects, type: :list)
+end
+
+defimpl Poison.Decoder, for: GoogleApi.BinaryAuthorization.V1.Model.AttestationSource do
+  def decode(value, options) do
+    GoogleApi.BinaryAuthorization.V1.Model.AttestationSource.decode(value, options)
+  end
+end
+
+defimpl Poison.Encoder, for: GoogleApi.BinaryAuthorization.V1.Model.AttestationSource do
+  def encode(value, options) do
+    GoogleApi.Gax.ModelBase.encode(value, options)
+  end
+end

clients/binary_authorization/lib/google_api/binary_authorization/v1/model/attestor_public_key.ex

@@ -21,9 +21,9 @@ defmodule GoogleApi.BinaryAuthorization.V1.Model.AttestorPublicKey do
 
   ## Attributes
 
-  *   `asciiArmoredPgpPublicKey` (*type:* `String.t`, *default:* `nil`) - ASCII-armored representation of a PGP public key, as the entire output by the command `gpg --export --armor [email protected]` (either LF or CRLF line endings). When using this field, `id` should be left blank. The BinAuthz API handlers will calculate the ID and fill it in automatically. BinAuthz computes this ID as the OpenPGP RFC4880 V4 fingerprint, represented as upper-case hex. If `id` is provided by the caller, it will be overwritten by the API-calculated ID.
+  *   `asciiArmoredPgpPublicKey` (*type:* `String.t`, *default:* `nil`) - ASCII-armored representation of a PGP public key, as the entire output by the command `gpg --export --armor [email protected]` (either LF or CRLF line endings). When using this field, `id` should be left blank. The Binary Authorization API handlers will calculate the ID and fill it in automatically. Binary Authorization computes this ID as the OpenPGP RFC4880 V4 fingerprint, represented as upper-case hex. If `id` is provided by the caller, it will be overwritten by the API-calculated ID.
   *   `comment` (*type:* `String.t`, *default:* `nil`) - Optional. A descriptive comment. This field may be updated.
-  *   `id` (*type:* `String.t`, *default:* `nil`) - The ID of this public key. Signatures verified by BinAuthz must include the ID of the public key that can be used to verify them, and that ID must match the contents of this field exactly. Additional restrictions on this field can be imposed based on which public key type is encapsulated. See the documentation on `public_key` cases below for details.
+  *   `id` (*type:* `String.t`, *default:* `nil`) - The ID of this public key. Signatures verified by Binary Authorization must include the ID of the public key that can be used to verify them, and that ID must match the contents of this field exactly. Additional restrictions on this field can be imposed based on which public key type is encapsulated. See the documentation on `public_key` cases below for details.
   *   `pkixPublicKey` (*type:* `GoogleApi.BinaryAuthorization.V1.Model.PkixPublicKey.t`, *default:* `nil`) - A raw PKIX SubjectPublicKeyInfo format public key. NOTE: `id` may be explicitly provided by the caller when using this type of public key, but it MUST be a valid RFC3986 URI. If `id` is left blank, a default one will be computed based on the digest of the DER encoding of the public key.
   """
 

clients/binary_authorization/lib/google_api/binary_authorization/v1/model/binding.ex

@@ -22,8 +22,8 @@ defmodule GoogleApi.BinaryAuthorization.V1.Model.Binding do
   ## Attributes
 
   *   `condition` (*type:* `GoogleApi.BinaryAuthorization.V1.Model.Expr.t`, *default:* `nil`) - The condition that is associated with this binding. If the condition evaluates to `true`, then this binding applies to the current request. If the condition evaluates to `false`, then this binding does not apply to the current request. However, a different role binding might grant the same role to one or more of the principals in this binding. To learn which resources support conditions in their IAM policies, see the [IAM documentation](https://cloud.google.com/iam/help/conditions/resource-policies).
-  *   `members` (*type:* `list(String.t)`, *default:* `nil`) - Specifies the principals requesting access for a Google Cloud resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. Does not include identities that come from external identity providers (IdPs) through identity federation. * `user:{emailid}`: An email address that represents a specific Google account. For example, `[email protected]` . * `serviceAccount:{emailid}`: An email address that represents a Google service account. For example, `[email protected]`. * `serviceAccount:{projectid}.svc.id.goog[{namespace}/{kubernetes-sa}]`: An identifier for a [Kubernetes service account](https://cloud.google.com/kubernetes-engine/docs/how-to/kubernetes-service-accounts). For example, `my-project.svc.id.goog[my-namespace/my-kubernetes-sa]`. * `group:{emailid}`: An email address that represents a Google group. For example, `[email protected]`. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `[email protected]?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `[email protected]?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `[email protected]?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`. 
-  *   `role` (*type:* `String.t`, *default:* `nil`) - Role that is assigned to the list of `members`, or principals. For example, `roles/viewer`, `roles/editor`, or `roles/owner`.
+  *   `members` (*type:* `list(String.t)`, *default:* `nil`) - Specifies the principals requesting access for a Google Cloud resource. `members` can have the following values: * `allUsers`: A special identifier that represents anyone who is on the internet; with or without a Google account. * `allAuthenticatedUsers`: A special identifier that represents anyone who is authenticated with a Google account or a service account. Does not include identities that come from external identity providers (IdPs) through identity federation. * `user:{emailid}`: An email address that represents a specific Google account. For example, `[email protected]` . * `serviceAccount:{emailid}`: An email address that represents a Google service account. For example, `[email protected]`. * `serviceAccount:{projectid}.svc.id.goog[{namespace}/{kubernetes-sa}]`: An identifier for a [Kubernetes service account](https://cloud.google.com/kubernetes-engine/docs/how-to/kubernetes-service-accounts). For example, `my-project.svc.id.goog[my-namespace/my-kubernetes-sa]`. * `group:{emailid}`: An email address that represents a Google group. For example, `[email protected]`. * `domain:{domain}`: The G Suite domain (primary) that represents all the users of that domain. For example, `google.com` or `example.com`. * `principal://iam.googleapis.com/locations/global/workforcePools/{pool_id}/subject/{subject_attribute_value}`: A single identity in a workforce identity pool. * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/group/{group_id}`: All workforce identities in a group. * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/attribute.{attribute_name}/{attribute_value}`: All workforce identities with a specific attribute value. * `principalSet://iam.googleapis.com/locations/global/workforcePools/{pool_id}/*`: All identities in a workforce identity pool. * `principal://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/subject/{subject_attribute_value}`: A single identity in a workload identity pool. * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/group/{group_id}`: A workload identity pool group. * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/attribute.{attribute_name}/{attribute_value}`: All identities in a workload identity pool with a certain attribute. * `principalSet://iam.googleapis.com/projects/{project_number}/locations/global/workloadIdentityPools/{pool_id}/*`: All identities in a workload identity pool. * `deleted:user:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a user that has been recently deleted. For example, `[email protected]?uid=123456789012345678901`. If the user is recovered, this value reverts to `user:{emailid}` and the recovered user retains the role in the binding. * `deleted:serviceAccount:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a service account that has been recently deleted. For example, `[email protected]?uid=123456789012345678901`. If the service account is undeleted, this value reverts to `serviceAccount:{emailid}` and the undeleted service account retains the role in the binding. * `deleted:group:{emailid}?uid={uniqueid}`: An email address (plus unique identifier) representing a Google group that has been recently deleted. For example, `[email protected]?uid=123456789012345678901`. If the group is recovered, this value reverts to `group:{emailid}` and the recovered group retains the role in the binding. * `deleted:principal://iam.googleapis.com/locations/global/workforcePools/{pool_id}/subject/{subject_attribute_value}`: Deleted single identity in a workforce identity pool. For example, `deleted:principal://iam.googleapis.com/locations/global/workforcePools/my-pool-id/subject/my-subject-attribute-value`.
+  *   `role` (*type:* `String.t`, *default:* `nil`) - Role that is assigned to the list of `members`, or principals. For example, `roles/viewer`, `roles/editor`, or `roles/owner`. For an overview of the IAM roles and permissions, see the [IAM documentation](https://cloud.google.com/iam/docs/roles-overview). For a list of the available pre-defined roles, see [here](https://cloud.google.com/iam/docs/understanding-roles).
   """
 
   use GoogleApi.Gax.ModelBase