data.proto

// Copyright 2022 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     https://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

package google.events.cloud.functions.v2;

import "google/protobuf/timestamp.proto";

option csharp_namespace = "Google.Events.Protobuf.Cloud.Functions.V2";
option php_namespace = "Google\\Events\\Cloud\\Functions\\V2";
option ruby_package = "Google::Events::Cloud::Functions::V2";

// Describes a Cloud Function that contains user computation executed in
// response to an event. It encapsulates function and trigger configurations.
message Function {
  // Describes the current state of the function.
  enum State {
    // Not specified. Invalid state.
    STATE_UNSPECIFIED = 0;

    // Function has been successfully deployed and is serving.
    ACTIVE = 1;

    // Function deployment failed and the function is not serving.
    FAILED = 2;

    // Function is being created or updated.
    DEPLOYING = 3;

    // Function is being deleted.
    DELETING = 4;

    // Function deployment failed and the function serving state is undefined.
    // The function should be updated or deleted to move it out of this state.
    UNKNOWN = 5;
  }

  // A user-defined name of the function. Function names must be unique
  // globally and match pattern `projects/*/locations/*/functions/*`
  string name = 1;

  // Describe whether the function is gen1 or gen2.
  Environment environment = 10;

  // User-provided description of a function.
  string description = 2;

  // Describes the Build step of the function that builds a container from the
  // given source.
  BuildConfig build_config = 3;

  // Describes the Service being deployed. Currently deploys services to Cloud
  // Run (fully managed).
  ServiceConfig service_config = 4;

  // An Eventarc trigger managed by Google Cloud Functions that fires events in
  // response to a condition in another service.
  EventTrigger event_trigger = 5;

  // Output only. State of the function.
  State state = 6;

  // Output only. The last update timestamp of a Cloud Function.
  google.protobuf.Timestamp update_time = 7;

  // Labels associated with this Cloud Function.
  map<string, string> labels = 8;

  // Output only. State Messages for this Cloud Function.
  repeated StateMessage state_messages = 9;
}

// Informational messages about the state of the Cloud Function or Operation.
message StateMessage {
  // Severity of the state message.
  enum Severity {
    // Not specified. Invalid severity.
    SEVERITY_UNSPECIFIED = 0;

    // ERROR-level severity.
    ERROR = 1;

    // WARNING-level severity.
    WARNING = 2;

    // INFO-level severity.
    INFO = 3;
  }

  // Severity of the state message.
  Severity severity = 1;

  // One-word CamelCase type of the state message.
  string type = 2;

  // The message.
  string message = 3;
}

// Location of the source in an archive file in Google Cloud Storage.
message StorageSource {
  // Google Cloud Storage bucket containing the source (see
  // [Bucket Name
  // Requirements](https://cloud.google.com/storage/docs/bucket-naming#requirements)).
  string bucket = 1;

  // Google Cloud Storage object containing the source.
  //
  // This object must be a gzipped archive file (`.tar.gz`) containing source to
  // build.
  string object = 2;

  // Google Cloud Storage generation for the object. If the generation is
  // omitted, the latest generation will be used.
  int64 generation = 3;
}

// Location of the source in a Google Cloud Source Repository.
message RepoSource {
  // A revision within the Cloud Source Repository must be specified in
  // one of these ways.
  oneof revision {
    // Regex matching branches to build.
    //
    // The syntax of the regular expressions accepted is the syntax accepted by
    // RE2 and described at https://github.com/google/re2/wiki/Syntax
    string branch_name = 3;

    // Regex matching tags to build.
    //
    // The syntax of the regular expressions accepted is the syntax accepted by
    // RE2 and described at https://github.com/google/re2/wiki/Syntax
    string tag_name = 4;

    // Explicit commit SHA to build.
    string commit_sha = 5;
  }

  // ID of the project that owns the Cloud Source Repository. If omitted, the
  // project ID requesting the build is assumed.
  string project_id = 1;

  // Name of the Cloud Source Repository.
  string repo_name = 2;

  // Directory, relative to the source root, in which to run the build.
  //
  // This must be a relative path. If a step's `dir` is specified and is an
  // absolute path, this value is ignored for that step's execution.
  // eg. helloworld (no leading slash allowed)
  string dir = 6;

  // Only trigger a build if the revision regex does NOT match the revision
  // regex.
  bool invert_regex = 7;
}

// The location of the function source code.
message Source {
  // Location of the source.
  // At least one source needs to be provided for the deployment to succeed.
  oneof source {
    // If provided, get the source from this location in Google Cloud Storage.
    StorageSource storage_source = 1;

    // If provided, get the source from this location in a Cloud Source
    // Repository.
    RepoSource repo_source = 2;
  }
}

// Provenance of the source. Ways to find the original source, or verify that
// some source was used for this build.
message SourceProvenance {
  // A copy of the build's `source.storage_source`, if exists, with any
  // generations resolved.
  StorageSource resolved_storage_source = 1;

  // A copy of the build's `source.repo_source`, if exists, with any
  // revisions resolved.
  RepoSource resolved_repo_source = 2;
}

// Describes the Build step of the function that builds a container from the
// given source.
message BuildConfig {
  // Docker Registry to use for storing function Docker images.
  enum DockerRegistry {
    // Unspecified.
    DOCKER_REGISTRY_UNSPECIFIED = 0;

    // Docker images will be stored in multi-regional Container Registry
    // repositories named `gcf`.
    CONTAINER_REGISTRY = 1;

    // Docker images will be stored in regional Artifact Registry repositories.
    // By default, GCF will create and use repositories named `gcf-artifacts`
    // in every region in which a function is deployed. But the repository to
    // use can also be specified by the user using the `docker_repository`
    // field.
    ARTIFACT_REGISTRY = 2;
  }

  // Output only. The Cloud Build name of the latest successful deployment of
  // the function.
  string build = 1;

  // The runtime in which to run the function. Required when deploying a new
  // function, optional when updating an existing function. For a complete
  // list of possible choices, see the
  // [`gcloud` command
  // reference](https://cloud.google.com/sdk/gcloud/reference/functions/deploy#--runtime).
  string runtime = 2;

  // The name of the function (as defined in source code) that will be
  // executed. Defaults to the resource name suffix, if not specified. For
  // backward compatibility, if function with given name is not found, then the
  // system will try to use function named "function".
  // For Node.js this is name of a function exported by the module specified
  // in `source_location`.
  string entry_point = 3;

  // The location of the function source code.
  Source source = 4;

  // Output only. A permanent fixed identifier for source.
  SourceProvenance source_provenance = 8;

  // Name of the Cloud Build Custom Worker Pool that should be used to build the
  // function. The format of this field is
  // `projects/{project}/locations/{region}/workerPools/{workerPool}` where
  // {project} and {region} are the project id and region respectively where the
  // worker pool is defined and {workerPool} is the short name of the worker
  // pool.
  //
  // If the project id is not the same as the function, then the Cloud
  // Functions Service Agent
  // (service-<project_number>@gcf-admin-robot.iam.gserviceaccount.com) must be
  // granted the role Cloud Build Custom Workers Builder
  // (roles/cloudbuild.customworkers.builder) in the project.
  string worker_pool = 5;

  // User-provided build-time environment variables for the function
  map<string, string> environment_variables = 6;

  // Optional. Docker Registry to use for this deployment. This configuration is
  // only applicable to 1st Gen functions, 2nd Gen functions can only use
  // Artifact Registry.
  //
  // If `docker_repository` field is specified, this field will be automatically
  // set as `ARTIFACT_REGISTRY`.
  // If unspecified, it currently defaults to `CONTAINER_REGISTRY`.
  // This field may be overridden by the backend for eligible deployments.
  DockerRegistry docker_registry = 10;

  // User managed repository created in Artifact Registry optionally with a
  // customer managed encryption key. This is the repository to which the
  // function docker image will be pushed after it is built by Cloud Build.
  // If unspecified, GCF will create and use a repository named 'gcf-artifacts'
  // for every deployed region.
  //
  // It must match the pattern
  // `projects/{project}/locations/{location}/repositories/{repository}`.
  //
  // Cross-project repositories are not supported.
  // Cross-location repositories are not supported.
  // Repository format must be 'DOCKER'.
  string docker_repository = 7;

  // Specifies one of the Google provided buildpack stacks.
  string buildpack_stack = 9;
}

// Describes the Service being deployed.
// Currently Supported : Cloud Run (fully managed).
// Next tag: 23
message ServiceConfig {
  // Available egress settings.
  //
  // This controls what traffic is diverted through the VPC Access Connector
  // resource. By default PRIVATE_RANGES_ONLY will be used.
  enum VpcConnectorEgressSettings {
    // Unspecified.
    VPC_CONNECTOR_EGRESS_SETTINGS_UNSPECIFIED = 0;

    // Use the VPC Access Connector only for private IP space from RFC1918.
    PRIVATE_RANGES_ONLY = 1;

    // Force the use of VPC Access Connector for all egress traffic from the
    // function.
    ALL_TRAFFIC = 2;
  }

  // Available ingress settings.
  //
  // This controls what traffic can reach the function.
  //
  // If unspecified, ALLOW_ALL will be used.
  enum IngressSettings {
    // Unspecified.
    INGRESS_SETTINGS_UNSPECIFIED = 0;

    // Allow HTTP traffic from public and private sources.
    ALLOW_ALL = 1;

    // Allow HTTP traffic from only private VPC sources.
    ALLOW_INTERNAL_ONLY = 2;

    // Allow HTTP traffic from private VPC sources and through GCLB.
    ALLOW_INTERNAL_AND_GCLB = 3;
  }

  // Available security level settings.
  //
  // This enforces security protocol on function URL.
  //
  // Security level is only ocnfigurable for 1st Gen functions, If unspecified,
  // SECURE_OPTIONAL will be used. 2nd Gen functions are SECURE_ALWAYS ONLY.
  enum SecurityLevel {
    // Unspecified.
    SECURITY_LEVEL_UNSPECIFIED = 0;

    // Requests for a URL that match this handler that do not use HTTPS are
    // automatically redirected to the HTTPS URL with the same path. Query
    // parameters are reserved for the redirect.
    SECURE_ALWAYS = 1;

    // Both HTTP and HTTPS requests with URLs that match the handler succeed
    // without redirects. The application can examine the request to determine
    // which protocol was used and respond accordingly.
    SECURE_OPTIONAL = 2;
  }

  // Output only. Name of the service associated with a Function.
  // The format of this field is
  // `projects/{project}/locations/{region}/services/{service}`
  string service = 1;

  // The function execution timeout. Execution is considered failed and
  // can be terminated if the function is not completed at the end of the
  // timeout period. Defaults to 60 seconds.
  int32 timeout_seconds = 2;

  // The amount of memory available for a function.
  // Defaults to 256M. Supported units are k, M, G, Mi, Gi. If no unit is
  // supplied the value is interpreted as bytes.
  // See
  // https://github.com/kubernetes/kubernetes/blob/master/staging/src/k8s.io/apimachinery/pkg/api/resource/quantity.go
  // a full description.
  string available_memory = 13;

  // The number of CPUs used in a single container instance.
  // Default value is calculated from available memory.
  // Supports the same values as Cloud Run, see
  // https://cloud.google.com/run/docs/reference/rest/v1/Container#resourcerequirements
  // Example: "1" indicates 1 vCPU
  string available_cpu = 22;

  // Environment variables that shall be available during function execution.
  map<string, string> environment_variables = 4;

  // The limit on the maximum number of function instances that may coexist at a
  // given time.
  //
  // In some cases, such as rapid traffic surges, Cloud Functions may, for a
  // short period of time, create more instances than the specified max
  // instances limit. If your function cannot tolerate this temporary behavior,
  // you may want to factor in a safety margin and set a lower max instances
  // value than your function can tolerate.
  //
  // See the [Max
  // Instances](https://cloud.google.com/functions/docs/max-instances) Guide for
  // more details.
  int32 max_instance_count = 5;

  // The limit on the minimum number of function instances that may coexist at a
  // given time.
  //
  // Function instances are kept in idle state for a short period after they
  // finished executing the request to reduce cold start time for subsequent
  // requests. Setting a minimum instance count will ensure that the given
  // number of instances are kept running in idle state always. This can help
  // with cold start times when jump in incoming request count occurs after the
  // idle instance would have been stopped in the default case.
  int32 min_instance_count = 12;

  // The Serverless VPC Access connector that this cloud function can connect
  // to. The format of this field is `projects/*/locations/*/connectors/*`.
  string vpc_connector = 6;

  // The egress settings for the connector, controlling what traffic is diverted
  // through it.
  VpcConnectorEgressSettings vpc_connector_egress_settings = 7;

  // The ingress settings for the function, controlling what traffic can reach
  // it.
  IngressSettings ingress_settings = 8;

  // Output only. URI of the Service deployed.
  string uri = 9;

  // The email of the service's service account. If empty, defaults to
  // `{project_number}-compute@developer.gserviceaccount.com`.
  string service_account_email = 10;

  // Whether 100% of traffic is routed to the latest revision.
  // On CreateFunction and UpdateFunction, when set to true, the revision being
  // deployed will serve 100% of traffic, ignoring any traffic split settings,
  // if any. On GetFunction, true will be returned if the latest revision is
  // serving 100% of traffic.
  bool all_traffic_on_latest_revision = 16;

  // Secret environment variables configuration.
  repeated SecretEnvVar secret_environment_variables = 17;

  // Secret volumes configuration.
  repeated SecretVolume secret_volumes = 19;

  // Output only. The name of service revision.
  string revision = 18;

  // Sets the maximum number of concurrent requests that each instance can
  // receive. Defaults to 1.
  int32 max_instance_request_concurrency = 20;

  // Security level configure whether the function only accepts https.
  // This configuration is only applicable to 1st Gen functions with Http
  // trigger. By default https is optional for 1st Gen functions; 2nd Gen
  // functions are https ONLY.
  SecurityLevel security_level = 21;
}

// Configuration for a secret environment variable. It has the information
// necessary to fetch the secret value from secret manager and expose it as an
// environment variable.
message SecretEnvVar {
  // Name of the environment variable.
  string key = 1;

  // Project identifier (preferably project number but can also be the
  // project ID) of the project that contains the secret. If not set, it is
  // assumed that the secret is in the same project as the function.
  string project_id = 2;

  // Name of the secret in secret manager (not the full resource name).
  string secret = 3;

  // Version of the secret (version number or the string 'latest'). It is
  // recommended to use a numeric version for secret environment variables as
  // any updates to the secret value is not reflected until new instances
  // start.
  string version = 4;
}

// Configuration for a secret volume. It has the information necessary to fetch
// the secret value from secret manager and make it available as files mounted
// at the requested paths within the application container.
message SecretVolume {
  // Configuration for a single version.
  message SecretVersion {
    // Version of the secret (version number or the string 'latest'). It is
    // preferable to use `latest` version with secret volumes as secret value
    // changes are reflected immediately.
    string version = 1;

    // Relative path of the file under the mount path where the secret value for
    // this version will be fetched and made available. For example, setting the
    // mount_path as '/etc/secrets' and path as `secret_foo` would mount the
    // secret value file at `/etc/secrets/secret_foo`.
    string path = 2;
  }

  // The path within the container to mount the secret volume. For example,
  // setting the mount_path as `/etc/secrets` would mount the secret value files
  // under the `/etc/secrets` directory. This directory will also be completely
  // shadowed and unavailable to mount any other secrets.
  // Recommended mount path: /etc/secrets
  string mount_path = 1;

  // Project identifier (preferably project number but can also be the project
  // ID) of the project that contains the secret. If not set, it is
  // assumed that the secret is in the same project as the function.
  string project_id = 2;

  // Name of the secret in secret manager (not the full resource name).
  string secret = 3;

  // List of secret versions to mount for this secret. If empty, the `latest`
  // version of the secret will be made available in a file named after the
  // secret under the mount point.
  repeated SecretVersion versions = 4;
}

// Describes EventTrigger, used to request events to be sent from another
// service.
message EventTrigger {
  // Describes the retry policy in case of function's execution failure.
  // Retried execution is charged as any other execution.
  enum RetryPolicy {
    // Not specified.
    RETRY_POLICY_UNSPECIFIED = 0;

    // Do not retry.
    RETRY_POLICY_DO_NOT_RETRY = 1;

    // Retry on any failure, retry up to 7 days with an exponential backoff
    // (capped at 10 seconds).
    RETRY_POLICY_RETRY = 2;
  }

  // Output only. The resource name of the Eventarc trigger. The format of this
  // field is `projects/{project}/locations/{region}/triggers/{trigger}`.
  string trigger = 1;

  // The region that the trigger will be in. The trigger will only receive
  // events originating in this region. It can be the same
  // region as the function, a different region or multi-region, or the global
  // region. If not provided, defaults to the same region as the function.
  string trigger_region = 2;

  // Required. The type of event to observe. For example:
  // `google.cloud.audit.log.v1.written` or
  // `google.cloud.pubsub.topic.v1.messagePublished`.
  string event_type = 3;

  // Criteria used to filter events.
  repeated EventFilter event_filters = 4;

  // Optional. The name of a Pub/Sub topic in the same project that will be used
  // as the transport topic for the event delivery. Format:
  // `projects/{project}/topics/{topic}`.
  //
  // This is only valid for events of type
  // `google.cloud.pubsub.topic.v1.messagePublished`. The topic provided here
  // will not be deleted at function deletion.
  string pubsub_topic = 5;

  // Optional. The email of the trigger's service account. The service account
  // must have permission to invoke Cloud Run services, the permission is
  // `run.routes.invoke`.
  // If empty, defaults to the Compute Engine default service account:
  // `{project_number}-compute@developer.gserviceaccount.com`.
  string service_account_email = 6;

  // Optional. If unset, then defaults to ignoring failures (i.e. not retrying
  // them).
  RetryPolicy retry_policy = 7;

  // Optional. The name of the channel associated with the trigger in
  // `projects/{project}/locations/{location}/channels/{channel}` format.
  // You must provide a channel to receive events from Eventarc SaaS partners.
  string channel = 8;
}

// Filters events based on exact matches on the CloudEvents attributes.
message EventFilter {
  // Required. The name of a CloudEvents attribute.
  string attribute = 1;

  // Required. The value for the attribute.
  string value = 2;

  // Optional. The operator used for matching the events with the value of the
  // filter. If not specified, only events that have an exact key-value pair
  // specified in the filter are matched. The only allowed value is
  // `match-path-pattern`.
  string operator = 3;
}

// The environment the function is hosted on.
enum Environment {
  // Unspecified
  ENVIRONMENT_UNSPECIFIED = 0;

  // Gen 1
  GEN_1 = 1;

  // Gen 2
  GEN_2 = 2;
}

// The data within all Function events.
message FunctionEventData {
  // Optional. The Function event payload. Unset for deletion events.
  optional Function payload = 1;
}