spiffe 0.17.0

// This file is @generated by prost-build.
/// The WorkloadReference message represents a single reference to a workload.
/// The reference field contains one of the standard reference types or
/// a vendor-specific extension type.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct WorkloadReference {
    /// Required. The reference to the workload.
    #[prost(message, optional, tag = "1")]
    pub reference: ::core::option::Option<::prost_types::Any>,
}
impl ::prost::Name for WorkloadReference {
    const NAME: &'static str = "WorkloadReference";
    const PACKAGE: &'static str = "spiffe.broker";
    fn full_name() -> ::prost::alloc::string::String {
        "spiffe.broker.WorkloadReference".into()
    }
    fn type_url() -> ::prost::alloc::string::String {
        "type.googleapis.com/spiffe.broker.WorkloadReference".into()
    }
}
/// The WorkloadPIDReference message conveys a process id reference of a workload
/// running in the same environment.
#[derive(Clone, Copy, PartialEq, Eq, Hash, ::prost::Message)]
pub struct WorkloadPidReference {
    /// Required. The process id of the workload. MUST be a positive integer.
    /// For workloads running inside container runtimes that maintain a separate
    /// sandbox (e.g. the `pause` container in containerd or CRI-O), this MUST
    /// be the PID of the workload's own process, not the sandbox PID.
    #[prost(int32, tag = "1")]
    pub pid: i32,
}
impl ::prost::Name for WorkloadPidReference {
    const NAME: &'static str = "WorkloadPIDReference";
    const PACKAGE: &'static str = "spiffe.broker";
    fn full_name() -> ::prost::alloc::string::String {
        "spiffe.broker.WorkloadPIDReference".into()
    }
    fn type_url() -> ::prost::alloc::string::String {
        "type.googleapis.com/spiffe.broker.WorkloadPIDReference".into()
    }
}
/// The KubernetesObjectType message identifies the type of a Kubernetes object
/// by its plural name and API group. This avoids ambiguity between plurals that
/// happen to contain dots (e.g., the plural `myresource.example` in the `com`
/// group vs. `myresource` in the `example.com` group) that arises when the
/// `<plural>.<group>` shorthand is parsed as a single string.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct KubernetesObjectType {
    /// Required. The plural name of the Kubernetes resource, as registered with
    /// the Kubernetes API server. For example, `pods`, `deployments`, or the
    /// plural form declared by a `CustomResourceDefinition`.
    #[prost(string, tag = "1")]
    pub plural: ::prost::alloc::string::String,
    /// Required. The API group of the Kubernetes resource. For non-core
    /// resources this is the API group name (e.g., `apps`, `example.com`).
    /// For core resources this field MUST be set to the literal string `core`.
    #[prost(string, tag = "2")]
    pub group: ::prost::alloc::string::String,
}
impl ::prost::Name for KubernetesObjectType {
    const NAME: &'static str = "KubernetesObjectType";
    const PACKAGE: &'static str = "spiffe.broker";
    fn full_name() -> ::prost::alloc::string::String {
        "spiffe.broker.KubernetesObjectType".into()
    }
    fn type_url() -> ::prost::alloc::string::String {
        "type.googleapis.com/spiffe.broker.KubernetesObjectType".into()
    }
}
/// The KubernetesObjectKey message identifies a specific Kubernetes object
/// within its type by `namespace` and `name`.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct KubernetesObjectKey {
    /// Optional. The namespace of the referenced Kubernetes object. MUST be set
    /// for namespaced resources. MUST be empty when the resource is
    /// cluster-scoped.
    #[prost(string, tag = "1")]
    pub namespace: ::prost::alloc::string::String,
    /// Required. The name of the referenced Kubernetes object.
    #[prost(string, tag = "2")]
    pub name: ::prost::alloc::string::String,
}
impl ::prost::Name for KubernetesObjectKey {
    const NAME: &'static str = "KubernetesObjectKey";
    const PACKAGE: &'static str = "spiffe.broker";
    fn full_name() -> ::prost::alloc::string::String {
        "spiffe.broker.KubernetesObjectKey".into()
    }
    fn type_url() -> ::prost::alloc::string::String {
        "type.googleapis.com/spiffe.broker.KubernetesObjectKey".into()
    }
}
/// The KubernetesObjectReference message conveys a reference to an arbitrary
/// Kubernetes object (built-in or custom) by which a workload is identified for
/// the purpose of SVID issuance. The referenced object MUST exist and be accessible
/// at the time of the request.
///
/// The mapping from a Kubernetes object to a SPIFFE ID is implementation-defined;
/// this specification does not mandate a particular SPIFFE ID format.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct KubernetesObjectReference {
    /// Required. The type of the referenced Kubernetes object.
    #[prost(message, optional, tag = "1")]
    pub r#type: ::core::option::Option<KubernetesObjectType>,
    /// Optional. The namespaced name of the referenced Kubernetes object.
    /// At least one of `key` or `uid` MUST be specified.
    #[prost(message, optional, tag = "2")]
    pub key: ::core::option::Option<KubernetesObjectKey>,
    /// Optional. The UID of the referenced Kubernetes object. MUST be a valid
    /// UUID string as assigned by Kubernetes. At least one of `key` or `uid`
    /// MUST be specified. When both `key` and `uid` are specified, the server
    /// MUST verify that the object resolved by `key` has the specified UID at
    /// the time of issuing the SVIDs and MUST return an error otherwise.
    #[prost(string, tag = "3")]
    pub uid: ::prost::alloc::string::String,
}
impl ::prost::Name for KubernetesObjectReference {
    const NAME: &'static str = "KubernetesObjectReference";
    const PACKAGE: &'static str = "spiffe.broker";
    fn full_name() -> ::prost::alloc::string::String {
        "spiffe.broker.KubernetesObjectReference".into()
    }
    fn type_url() -> ::prost::alloc::string::String {
        "type.googleapis.com/spiffe.broker.KubernetesObjectReference".into()
    }
}
/// The SubscribeToX509SVIDRequest message conveys parameters for requesting an X.509-SVID.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct SubscribeToX509svidRequest {
    /// Required. The reference identifying the workload.
    #[prost(message, optional, tag = "1")]
    pub reference: ::core::option::Option<WorkloadReference>,
}
impl ::prost::Name for SubscribeToX509svidRequest {
    const NAME: &'static str = "SubscribeToX509SVIDRequest";
    const PACKAGE: &'static str = "spiffe.broker";
    fn full_name() -> ::prost::alloc::string::String {
        "spiffe.broker.SubscribeToX509SVIDRequest".into()
    }
    fn type_url() -> ::prost::alloc::string::String {
        "type.googleapis.com/spiffe.broker.SubscribeToX509SVIDRequest".into()
    }
}
/// The SubscribeToX509SVIDResponse message carries X.509-SVIDs and related information,
/// including a list of bundles the workload may use for federating with foreign
/// trust domains.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct SubscribeToX509svidResponse {
    /// Required. A list of X509SVID messages, each of which includes a single
    /// X.509-SVID, its private key, and the bundle for the trust domain.
    #[prost(message, repeated, tag = "1")]
    pub svids: ::prost::alloc::vec::Vec<X509svid>,
    /// Optional. ASN.1 DER encoded (not PEM) certificate revocation lists.
    #[prost(bytes = "bytes", repeated, tag = "2")]
    pub crl: ::prost::alloc::vec::Vec<::prost::bytes::Bytes>,
    /// Optional. CA certificate bundles belonging to foreign trust domains that
    /// the workload should trust, keyed by the SPIFFE ID of the foreign trust
    /// domain. Bundles are ASN.1 DER encoded (not PEM).
    #[prost(map = "string, bytes", tag = "3")]
    pub federated_bundles:
        ::std::collections::HashMap<::prost::alloc::string::String, ::prost::bytes::Bytes>,
}
impl ::prost::Name for SubscribeToX509svidResponse {
    const NAME: &'static str = "SubscribeToX509SVIDResponse";
    const PACKAGE: &'static str = "spiffe.broker";
    fn full_name() -> ::prost::alloc::string::String {
        "spiffe.broker.SubscribeToX509SVIDResponse".into()
    }
    fn type_url() -> ::prost::alloc::string::String {
        "type.googleapis.com/spiffe.broker.SubscribeToX509SVIDResponse".into()
    }
}
/// The X509SVID message carries a single SVID and all associated information,
/// including the X.509 bundle for the trust domain.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
#[prost(skip_debug)]
pub struct X509svid {
    /// Required. The SPIFFE ID of the SVID in this entry
    #[prost(string, tag = "1")]
    pub spiffe_id: ::prost::alloc::string::String,
    /// Required. ASN.1 DER encoded (not PEM) certificate chain. MAY include
    /// intermediates, the leaf certificate (or SVID itself) MUST come first.
    #[prost(bytes = "bytes", tag = "2")]
    pub x509_svid: ::prost::bytes::Bytes,
    /// Required. ASN.1 DER encoded (not PEM) PKCS#8 private key. MUST be unencrypted.
    #[prost(bytes = "bytes", tag = "3")]
    pub x509_svid_key: ::prost::bytes::Bytes,
    /// Required. ASN.1 DER encoded (not PEM) X.509 bundle for the trust domain.
    #[prost(bytes = "bytes", tag = "4")]
    pub bundle: ::prost::bytes::Bytes,
    /// Optional. An operator-specified string used to provide guidance on how this
    /// identity should be used by a broker or workload when more than one SVID is
    /// returned. For example, `internal` and `external` to indicate an SVID for
    /// internal or external use, respectively.
    #[prost(string, tag = "5")]
    pub hint: ::prost::alloc::string::String,
}
impl ::prost::Name for X509svid {
    const NAME: &'static str = "X509SVID";
    const PACKAGE: &'static str = "spiffe.broker";
    fn full_name() -> ::prost::alloc::string::String {
        "spiffe.broker.X509SVID".into()
    }
    fn type_url() -> ::prost::alloc::string::String {
        "type.googleapis.com/spiffe.broker.X509SVID".into()
    }
}
/// The SubscribeToX509BundlesRequest message conveys parameters for requesting X.509
/// bundles.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct SubscribeToX509BundlesRequest {
    /// Required. The reference identifying the workload.
    #[prost(message, optional, tag = "1")]
    pub reference: ::core::option::Option<WorkloadReference>,
}
impl ::prost::Name for SubscribeToX509BundlesRequest {
    const NAME: &'static str = "SubscribeToX509BundlesRequest";
    const PACKAGE: &'static str = "spiffe.broker";
    fn full_name() -> ::prost::alloc::string::String {
        "spiffe.broker.SubscribeToX509BundlesRequest".into()
    }
    fn type_url() -> ::prost::alloc::string::String {
        "type.googleapis.com/spiffe.broker.SubscribeToX509BundlesRequest".into()
    }
}
/// The SubscribeToX509BundlesResponse message carries a map of trust bundles the workload
/// should trust.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct SubscribeToX509BundlesResponse {
    /// Optional. ASN.1 DER encoded (not PEM) certificate revocation lists.
    #[prost(bytes = "bytes", repeated, tag = "1")]
    pub crl: ::prost::alloc::vec::Vec<::prost::bytes::Bytes>,
    /// Required. CA certificate bundles belonging to trust domains that the
    /// workload should trust, keyed by the SPIFFE ID of the trust domain.
    /// Bundles are ASN.1 DER encoded (not PEM).
    #[prost(map = "string, bytes", tag = "2")]
    pub bundles: ::std::collections::HashMap<::prost::alloc::string::String, ::prost::bytes::Bytes>,
}
impl ::prost::Name for SubscribeToX509BundlesResponse {
    const NAME: &'static str = "SubscribeToX509BundlesResponse";
    const PACKAGE: &'static str = "spiffe.broker";
    fn full_name() -> ::prost::alloc::string::String {
        "spiffe.broker.SubscribeToX509BundlesResponse".into()
    }
    fn type_url() -> ::prost::alloc::string::String {
        "type.googleapis.com/spiffe.broker.SubscribeToX509BundlesResponse".into()
    }
}
/// The FetchJWTSVIDRequest message conveys parameters for requesting JWT-SVIDs.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct FetchJwtsvidRequest {
    /// Required. The reference identifying the workload.
    #[prost(message, optional, tag = "1")]
    pub reference: ::core::option::Option<WorkloadReference>,
    /// Required. The audience(s) the workload intends to authenticate against.
    #[prost(string, repeated, tag = "2")]
    pub audience: ::prost::alloc::vec::Vec<::prost::alloc::string::String>,
    /// Optional. The requested SPIFFE ID for the JWT-SVID. If unset, all
    /// JWT-SVIDs to which the workload is entitled are requested.
    #[prost(string, tag = "3")]
    pub spiffe_id: ::prost::alloc::string::String,
}
impl ::prost::Name for FetchJwtsvidRequest {
    const NAME: &'static str = "FetchJWTSVIDRequest";
    const PACKAGE: &'static str = "spiffe.broker";
    fn full_name() -> ::prost::alloc::string::String {
        "spiffe.broker.FetchJWTSVIDRequest".into()
    }
    fn type_url() -> ::prost::alloc::string::String {
        "type.googleapis.com/spiffe.broker.FetchJWTSVIDRequest".into()
    }
}
/// The FetchJWTSVIDResponse message conveys JWT-SVIDs.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct FetchJwtsvidResponse {
    /// Required. The list of returned JWT-SVIDs.
    #[prost(message, repeated, tag = "1")]
    pub svids: ::prost::alloc::vec::Vec<Jwtsvid>,
}
impl ::prost::Name for FetchJwtsvidResponse {
    const NAME: &'static str = "FetchJWTSVIDResponse";
    const PACKAGE: &'static str = "spiffe.broker";
    fn full_name() -> ::prost::alloc::string::String {
        "spiffe.broker.FetchJWTSVIDResponse".into()
    }
    fn type_url() -> ::prost::alloc::string::String {
        "type.googleapis.com/spiffe.broker.FetchJWTSVIDResponse".into()
    }
}
/// The JWTSVID message carries the JWT-SVID token and associated metadata.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
#[prost(skip_debug)]
pub struct Jwtsvid {
    /// Required. The SPIFFE ID of the JWT-SVID.
    #[prost(string, tag = "1")]
    pub spiffe_id: ::prost::alloc::string::String,
    /// Required. Encoded JWT using JWS Compact Serialization.
    #[prost(string, tag = "2")]
    pub svid: ::prost::alloc::string::String,
    /// Optional. An operator-specified string used to provide guidance on how this
    /// identity should be used by a workload when more than one SVID is returned.
    /// For example, `internal` and `external` to indicate an SVID for internal or
    /// external use, respectively.
    #[prost(string, tag = "3")]
    pub hint: ::prost::alloc::string::String,
}
impl ::prost::Name for Jwtsvid {
    const NAME: &'static str = "JWTSVID";
    const PACKAGE: &'static str = "spiffe.broker";
    fn full_name() -> ::prost::alloc::string::String {
        "spiffe.broker.JWTSVID".into()
    }
    fn type_url() -> ::prost::alloc::string::String {
        "type.googleapis.com/spiffe.broker.JWTSVID".into()
    }
}
/// The SubscribeToJWTBundlesRequest message conveys parameters for requesting JWT bundles.
#[derive(Clone, PartialEq, Eq, Hash, ::prost::Message)]
pub struct SubscribeToJwtBundlesRequest {
    /// Required. The reference identifying the workload.
    #[prost(message, optional, tag = "1")]
    pub reference: ::core::option::Option<WorkloadReference>,
}
impl ::prost::Name for SubscribeToJwtBundlesRequest {
    const NAME: &'static str = "SubscribeToJWTBundlesRequest";
    const PACKAGE: &'static str = "spiffe.broker";
    fn full_name() -> ::prost::alloc::string::String {
        "spiffe.broker.SubscribeToJWTBundlesRequest".into()
    }
    fn type_url() -> ::prost::alloc::string::String {
        "type.googleapis.com/spiffe.broker.SubscribeToJWTBundlesRequest".into()
    }
}
/// The SubscribeToJWTBundlesResponse message conveys JWT bundles.
#[derive(Clone, PartialEq, ::prost::Message)]
pub struct SubscribeToJwtBundlesResponse {
    /// Required. JWK encoded JWT bundles, keyed by the SPIFFE ID of the trust
    /// domain.
    #[prost(map = "string, bytes", tag = "1")]
    pub bundles: ::std::collections::HashMap<::prost::alloc::string::String, ::prost::bytes::Bytes>,
}
impl ::prost::Name for SubscribeToJwtBundlesResponse {
    const NAME: &'static str = "SubscribeToJWTBundlesResponse";
    const PACKAGE: &'static str = "spiffe.broker";
    fn full_name() -> ::prost::alloc::string::String {
        "spiffe.broker.SubscribeToJWTBundlesResponse".into()
    }
    fn type_url() -> ::prost::alloc::string::String {
        "type.googleapis.com/spiffe.broker.SubscribeToJWTBundlesResponse".into()
    }
}
/// Generated client implementations.
pub mod api_client {
    #![allow(
        unused_variables,
        dead_code,
        missing_docs,
        clippy::wildcard_imports,
        clippy::let_unit_value
    )]
    use tonic::codegen::http::Uri;
    use tonic::codegen::*;
    #[derive(Debug, Clone)]
    pub struct ApiClient<T> {
        inner: tonic::client::Grpc<T>,
    }
    impl<T> ApiClient<T>
    where
        T: tonic::client::GrpcService<tonic::body::Body>,
        T::Error: Into<StdError>,
        T::ResponseBody: Body<Data = Bytes> + std::marker::Send + 'static,
        <T::ResponseBody as Body>::Error: Into<StdError> + std::marker::Send,
    {
        pub fn new(inner: T) -> Self {
            let inner = tonic::client::Grpc::new(inner);
            Self { inner }
        }
        pub fn with_origin(inner: T, origin: Uri) -> Self {
            let inner = tonic::client::Grpc::with_origin(inner, origin);
            Self { inner }
        }
        pub fn with_interceptor<F>(inner: T, interceptor: F) -> ApiClient<InterceptedService<T, F>>
        where
            F: tonic::service::Interceptor,
            T::ResponseBody: Default,
            T: tonic::codegen::Service<
                http::Request<tonic::body::Body>,
                Response = http::Response<
                    <T as tonic::client::GrpcService<tonic::body::Body>>::ResponseBody,
                >,
            >,
            <T as tonic::codegen::Service<http::Request<tonic::body::Body>>>::Error:
                Into<StdError> + std::marker::Send + std::marker::Sync,
        {
            ApiClient::new(InterceptedService::new(inner, interceptor))
        }
        /// Compress requests with the given encoding.
        ///
        /// This requires the server to support it otherwise it might respond with an
        /// error.
        #[must_use]
        pub fn send_compressed(mut self, encoding: CompressionEncoding) -> Self {
            self.inner = self.inner.send_compressed(encoding);
            self
        }
        /// Enable decompressing responses.
        #[must_use]
        pub fn accept_compressed(mut self, encoding: CompressionEncoding) -> Self {
            self.inner = self.inner.accept_compressed(encoding);
            self
        }
        /// Limits the maximum size of a decoded message.
        ///
        /// Default: `4MB`
        #[must_use]
        pub fn max_decoding_message_size(mut self, limit: usize) -> Self {
            self.inner = self.inner.max_decoding_message_size(limit);
            self
        }
        /// Limits the maximum size of an encoded message.
        ///
        /// Default: `usize::MAX`
        #[must_use]
        pub fn max_encoding_message_size(mut self, limit: usize) -> Self {
            self.inner = self.inner.max_encoding_message_size(limit);
            self
        }
        /// Fetch X.509-SVIDs for all SPIFFE identities the referenced workload is
        /// entitled to, as well as related information like trust bundles. As this
        /// information changes, subsequent messages will be streamed from the server.
        pub async fn subscribe_to_x509svid(
            &mut self,
            request: impl tonic::IntoRequest<super::SubscribeToX509svidRequest>,
        ) -> std::result::Result<
            tonic::Response<tonic::codec::Streaming<super::SubscribeToX509svidResponse>>,
            tonic::Status,
        > {
            self.inner.ready().await.map_err(|e| {
                tonic::Status::unknown(format!("Service was not ready: {}", e.into()))
            })?;
            let codec = tonic_prost::ProstCodec::default();
            let path =
                http::uri::PathAndQuery::from_static("/spiffe.broker.API/SubscribeToX509SVID");
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(GrpcMethod::new("spiffe.broker.API", "SubscribeToX509SVID"));
            self.inner.server_streaming(req, path, codec).await
        }
        /// Fetch trust bundles of the referenced workload. Useful in situations that
        /// only need to validate SVIDs without obtaining an SVID for themself. As this
        /// information changes, subsequent messages will be streamed from the server.
        pub async fn subscribe_to_x509_bundles(
            &mut self,
            request: impl tonic::IntoRequest<super::SubscribeToX509BundlesRequest>,
        ) -> std::result::Result<
            tonic::Response<tonic::codec::Streaming<super::SubscribeToX509BundlesResponse>>,
            tonic::Status,
        > {
            self.inner.ready().await.map_err(|e| {
                tonic::Status::unknown(format!("Service was not ready: {}", e.into()))
            })?;
            let codec = tonic_prost::ProstCodec::default();
            let path =
                http::uri::PathAndQuery::from_static("/spiffe.broker.API/SubscribeToX509Bundles");
            let mut req = request.into_request();
            req.extensions_mut().insert(GrpcMethod::new(
                "spiffe.broker.API",
                "SubscribeToX509Bundles",
            ));
            self.inner.server_streaming(req, path, codec).await
        }
        /// Fetch JWT-SVIDs for all SPIFFE identities the referenced workload is
        /// entitled to, for the requested audience. If an optional SPIFFE ID is
        /// requested, only the JWT-SVID for that SPIFFE ID is returned.
        pub async fn fetch_jwtsvid(
            &mut self,
            request: impl tonic::IntoRequest<super::FetchJwtsvidRequest>,
        ) -> std::result::Result<tonic::Response<super::FetchJwtsvidResponse>, tonic::Status>
        {
            self.inner.ready().await.map_err(|e| {
                tonic::Status::unknown(format!("Service was not ready: {}", e.into()))
            })?;
            let codec = tonic_prost::ProstCodec::default();
            let path = http::uri::PathAndQuery::from_static("/spiffe.broker.API/FetchJWTSVID");
            let mut req = request.into_request();
            req.extensions_mut()
                .insert(GrpcMethod::new("spiffe.broker.API", "FetchJWTSVID"));
            self.inner.unary(req, path, codec).await
        }
        /// Fetches the JWT bundles, formatted as JWKS documents, keyed by the
        /// SPIFFE ID of the trust domain. As this information changes, subsequent
        /// messages will be streamed from the server.
        pub async fn subscribe_to_jwt_bundles(
            &mut self,
            request: impl tonic::IntoRequest<super::SubscribeToJwtBundlesRequest>,
        ) -> std::result::Result<
            tonic::Response<tonic::codec::Streaming<super::SubscribeToJwtBundlesResponse>>,
            tonic::Status,
        > {
            self.inner.ready().await.map_err(|e| {
                tonic::Status::unknown(format!("Service was not ready: {}", e.into()))
            })?;
            let codec = tonic_prost::ProstCodec::default();
            let path =
                http::uri::PathAndQuery::from_static("/spiffe.broker.API/SubscribeToJWTBundles");
            let mut req = request.into_request();
            req.extensions_mut().insert(GrpcMethod::new(
                "spiffe.broker.API",
                "SubscribeToJWTBundles",
            ));
            self.inner.server_streaming(req, path, codec).await
        }
    }
}