Class: Google::Cloud::Container::V1::ContainerdConfig

Inherits:
Object
  • Object
show all
Extended by:
Protobuf::MessageExts::ClassMethods
Includes:
Protobuf::MessageExts
Defined in:
proto_docs/google/container/v1/cluster_service.rb

Overview

ContainerdConfig contains configuration to customize containerd.

Defined Under Namespace

Classes: PrivateRegistryAccessConfig, RegistryHostConfig, WritableCgroups

Instance Attribute Summary collapse

Instance Attribute Details

#private_registry_access_config ⇒ ::Google::Cloud::Container::V1::ContainerdConfig::PrivateRegistryAccessConfig

Returns PrivateRegistryAccessConfig is used to configure access configuration for private container registries.

Returns:



1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669
1670
1671
1672
1673
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
 
# File 'proto_docs/google/container/v1/cluster_service.rb', line 1507

class ContainerdConfig
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # PrivateRegistryAccessConfig contains access configuration for
  # private container registries.
  # @!attribute [rw] enabled
  #   @return [::Boolean]
  #     Private registry access is enabled.
  # @!attribute [rw] certificate_authority_domain_config
  #   @return [::Array<::Google::Cloud::Container::V1::ContainerdConfig::PrivateRegistryAccessConfig::CertificateAuthorityDomainConfig>]
  #     Private registry access configuration.
  class PrivateRegistryAccessConfig
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods

    # CertificateAuthorityDomainConfig configures one or more fully qualified
    # domain names (FQDN) to a specific certificate.
    # @!attribute [rw] fqdns
    #   @return [::Array<::String>]
    #     List of fully qualified domain names (FQDN).
    #     Specifying port is supported.
    #     Wildcards are NOT supported.
    #     Examples:
    #     - `my.customdomain.com`
    #     - `10.0.1.2:5000`
    # @!attribute [rw] gcp_secret_manager_certificate_config
    #   @return [::Google::Cloud::Container::V1::ContainerdConfig::PrivateRegistryAccessConfig::CertificateAuthorityDomainConfig::GCPSecretManagerCertificateConfig]
    #     Secret Manager certificate configuration.
    class CertificateAuthorityDomainConfig
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods

      # GCPSecretManagerCertificateConfig configures a secret from
      # [Secret Manager](https://cloud.google.com/secret-manager).
      # @!attribute [rw] secret_uri
      #   @return [::String]
      #     Secret URI, in the form
      #     "projects/$PROJECT_ID/secrets/$SECRET_NAME/versions/$VERSION".
      #     Version can be fixed (e.g. "2") or "latest"
      class GCPSecretManagerCertificateConfig
        include ::Google::Protobuf::MessageExts
        extend ::Google::Protobuf::MessageExts::ClassMethods
      end
    end
  end

  # Defines writable cgroups configuration.
  # @!attribute [rw] enabled
  #   @return [::Boolean]
  #     Optional. Whether writable cgroups is enabled.
  class WritableCgroups
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # RegistryHostConfig configures the top-level structure for a single
  # containerd registry server's configuration, which represents one hosts.toml
  # file on the node. It will override the same fqdns in
  # PrivateRegistryAccessConfig.
  # @!attribute [rw] server
  #   @return [::String]
  #     Defines the host name of the registry server, which will be used to
  #     create configuration file as /etc/containerd/hosts.d/<server>/hosts.toml.
  #     It supports fully qualified domain names (FQDN) and IP addresses:
  #     Specifying port is supported, while scheme and path are NOT supported.
  #     Wildcards are NOT supported.
  #     Examples:
  #     - `my.customdomain.com`
  #     - `10.0.1.2:5000`
  # @!attribute [rw] hosts
  #   @return [::Array<::Google::Cloud::Container::V1::ContainerdConfig::RegistryHostConfig::HostConfig>]
  #     HostConfig configures a list of host-specific configurations for the
  #     server.
  #     Each server can have at most 10 host configurations.
  class RegistryHostConfig
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods

    # CertificateConfig configures certificate for the registry.
    # @!attribute [rw] gcp_secret_manager_secret_uri
    #   @return [::String]
    #     The URI configures a secret from
    #     [Secret Manager](https://cloud.google.com/secret-manager)
    #     in the format
    #     "projects/$PROJECT_ID/secrets/$SECRET_NAME/versions/$VERSION" for
    #     global secret or
    #     "projects/$PROJECT_ID/locations/$REGION/secrets/$SECRET_NAME/versions/$VERSION"
    #     for regional secret. Version can be fixed (e.g. "2") or "latest"
    class CertificateConfig
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end

    # CertificateConfigPair configures pairs of certificates, which is used for
    # client certificate and key pairs under a registry.
    # @!attribute [rw] cert
    #   @return [::Google::Cloud::Container::V1::ContainerdConfig::RegistryHostConfig::CertificateConfig]
    #     Cert configures the client certificate.
    # @!attribute [rw] key
    #   @return [::Google::Cloud::Container::V1::ContainerdConfig::RegistryHostConfig::CertificateConfig]
    #     Key configures the client private key. Optional.
    class CertificateConfigPair
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end

    # RegistryHeader configures headers for the registry.
    # @!attribute [rw] key
    #   @return [::String]
    #     Key configures the header key.
    # @!attribute [rw] value
    #   @return [::Array<::String>]
    #     Value configures the header value.
    class RegistryHeader
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end

    # HostConfig configures the registry host under a given Server.
    # @!attribute [rw] host
    #   @return [::String]
    #     Host configures the registry host/mirror.
    #     It supports fully qualified domain names (FQDNs) and IP addresses.
    #     Specifying scheme, port or path is supported. Scheme can only be http
    #     or https.
    #     Wildcards are NOT supported.
    #     Examples:
    #     - `my.customdomain.com`
    #     - `https://my.customdomain.com/path`
    #     - `10.0.1.2:5000`
    # @!attribute [rw] capabilities
    #   @return [::Array<::Google::Cloud::Container::V1::ContainerdConfig::RegistryHostConfig::HostCapability>]
    #     Capabilities represent the capabilities of the registry host,
    #     specifying what operations a host is capable of performing.
    #     If not set, containerd enables all capabilities by default.
    # @!attribute [rw] override_path
    #   @return [::Boolean]
    #     OverridePath is used to indicate the host's API root endpoint is
    #     defined in the URL path rather than by the API specification. This may
    #     be used with non-compliant OCI registries which are missing the /v2
    #     prefix.
    #     If not set, containerd sets default false.
    # @!attribute [rw] header
    #   @return [::Array<::Google::Cloud::Container::V1::ContainerdConfig::RegistryHostConfig::RegistryHeader>]
    #     Header configures the registry host headers.
    # @!attribute [rw] ca
    #   @return [::Array<::Google::Cloud::Container::V1::ContainerdConfig::RegistryHostConfig::CertificateConfig>]
    #     CA configures the registry host certificate.
    # @!attribute [rw] client
    #   @return [::Array<::Google::Cloud::Container::V1::ContainerdConfig::RegistryHostConfig::CertificateConfigPair>]
    #     Client configures the registry host client certificate and key.
    # @!attribute [rw] dial_timeout
    #   @return [::Google::Protobuf::Duration]
    #     Specifies the maximum duration allowed for a connection attempt to
    #     complete. A shorter timeout helps reduce delays when falling back to
    #     the original registry if the mirror is unreachable.
    #     Maximum allowed value is 180s. If not set, containerd sets default 30s.
    #     The value should be a decimal number of seconds with an `s` suffix.
    class HostConfig
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end

    # HostCapability configures capabilities for the registry host.
    module HostCapability
      # UNKNOWN should never be set.
      HOST_CAPABILITY_UNSPECIFIED = 0

      # Pull represents the capability to fetch manifests and blobs by digest.
      HOST_CAPABILITY_PULL = 1

      # Resolve represents the capability to fetch manifests by name.
      HOST_CAPABILITY_RESOLVE = 2

      # Push represents the capability to push blobs and manifests.
      HOST_CAPABILITY_PUSH = 3
    end
  end
end

#registry_hosts ⇒ ::Array<::Google::Cloud::Container::V1::ContainerdConfig::RegistryHostConfig>

Returns RegistryHostConfig configures containerd registry host configuration. Each registry_hosts represents a hosts.toml file. At most 25 registry_hosts are allowed.

Returns:



1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669
1670
1671
1672
1673
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
 
# File 'proto_docs/google/container/v1/cluster_service.rb', line 1507

class ContainerdConfig
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # PrivateRegistryAccessConfig contains access configuration for
  # private container registries.
  # @!attribute [rw] enabled
  #   @return [::Boolean]
  #     Private registry access is enabled.
  # @!attribute [rw] certificate_authority_domain_config
  #   @return [::Array<::Google::Cloud::Container::V1::ContainerdConfig::PrivateRegistryAccessConfig::CertificateAuthorityDomainConfig>]
  #     Private registry access configuration.
  class PrivateRegistryAccessConfig
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods

    # CertificateAuthorityDomainConfig configures one or more fully qualified
    # domain names (FQDN) to a specific certificate.
    # @!attribute [rw] fqdns
    #   @return [::Array<::String>]
    #     List of fully qualified domain names (FQDN).
    #     Specifying port is supported.
    #     Wildcards are NOT supported.
    #     Examples:
    #     - `my.customdomain.com`
    #     - `10.0.1.2:5000`
    # @!attribute [rw] gcp_secret_manager_certificate_config
    #   @return [::Google::Cloud::Container::V1::ContainerdConfig::PrivateRegistryAccessConfig::CertificateAuthorityDomainConfig::GCPSecretManagerCertificateConfig]
    #     Secret Manager certificate configuration.
    class CertificateAuthorityDomainConfig
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods

      # GCPSecretManagerCertificateConfig configures a secret from
      # [Secret Manager](https://cloud.google.com/secret-manager).
      # @!attribute [rw] secret_uri
      #   @return [::String]
      #     Secret URI, in the form
      #     "projects/$PROJECT_ID/secrets/$SECRET_NAME/versions/$VERSION".
      #     Version can be fixed (e.g. "2") or "latest"
      class GCPSecretManagerCertificateConfig
        include ::Google::Protobuf::MessageExts
        extend ::Google::Protobuf::MessageExts::ClassMethods
      end
    end
  end

  # Defines writable cgroups configuration.
  # @!attribute [rw] enabled
  #   @return [::Boolean]
  #     Optional. Whether writable cgroups is enabled.
  class WritableCgroups
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # RegistryHostConfig configures the top-level structure for a single
  # containerd registry server's configuration, which represents one hosts.toml
  # file on the node. It will override the same fqdns in
  # PrivateRegistryAccessConfig.
  # @!attribute [rw] server
  #   @return [::String]
  #     Defines the host name of the registry server, which will be used to
  #     create configuration file as /etc/containerd/hosts.d/<server>/hosts.toml.
  #     It supports fully qualified domain names (FQDN) and IP addresses:
  #     Specifying port is supported, while scheme and path are NOT supported.
  #     Wildcards are NOT supported.
  #     Examples:
  #     - `my.customdomain.com`
  #     - `10.0.1.2:5000`
  # @!attribute [rw] hosts
  #   @return [::Array<::Google::Cloud::Container::V1::ContainerdConfig::RegistryHostConfig::HostConfig>]
  #     HostConfig configures a list of host-specific configurations for the
  #     server.
  #     Each server can have at most 10 host configurations.
  class RegistryHostConfig
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods

    # CertificateConfig configures certificate for the registry.
    # @!attribute [rw] gcp_secret_manager_secret_uri
    #   @return [::String]
    #     The URI configures a secret from
    #     [Secret Manager](https://cloud.google.com/secret-manager)
    #     in the format
    #     "projects/$PROJECT_ID/secrets/$SECRET_NAME/versions/$VERSION" for
    #     global secret or
    #     "projects/$PROJECT_ID/locations/$REGION/secrets/$SECRET_NAME/versions/$VERSION"
    #     for regional secret. Version can be fixed (e.g. "2") or "latest"
    class CertificateConfig
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end

    # CertificateConfigPair configures pairs of certificates, which is used for
    # client certificate and key pairs under a registry.
    # @!attribute [rw] cert
    #   @return [::Google::Cloud::Container::V1::ContainerdConfig::RegistryHostConfig::CertificateConfig]
    #     Cert configures the client certificate.
    # @!attribute [rw] key
    #   @return [::Google::Cloud::Container::V1::ContainerdConfig::RegistryHostConfig::CertificateConfig]
    #     Key configures the client private key. Optional.
    class CertificateConfigPair
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end

    # RegistryHeader configures headers for the registry.
    # @!attribute [rw] key
    #   @return [::String]
    #     Key configures the header key.
    # @!attribute [rw] value
    #   @return [::Array<::String>]
    #     Value configures the header value.
    class RegistryHeader
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end

    # HostConfig configures the registry host under a given Server.
    # @!attribute [rw] host
    #   @return [::String]
    #     Host configures the registry host/mirror.
    #     It supports fully qualified domain names (FQDNs) and IP addresses.
    #     Specifying scheme, port or path is supported. Scheme can only be http
    #     or https.
    #     Wildcards are NOT supported.
    #     Examples:
    #     - `my.customdomain.com`
    #     - `https://my.customdomain.com/path`
    #     - `10.0.1.2:5000`
    # @!attribute [rw] capabilities
    #   @return [::Array<::Google::Cloud::Container::V1::ContainerdConfig::RegistryHostConfig::HostCapability>]
    #     Capabilities represent the capabilities of the registry host,
    #     specifying what operations a host is capable of performing.
    #     If not set, containerd enables all capabilities by default.
    # @!attribute [rw] override_path
    #   @return [::Boolean]
    #     OverridePath is used to indicate the host's API root endpoint is
    #     defined in the URL path rather than by the API specification. This may
    #     be used with non-compliant OCI registries which are missing the /v2
    #     prefix.
    #     If not set, containerd sets default false.
    # @!attribute [rw] header
    #   @return [::Array<::Google::Cloud::Container::V1::ContainerdConfig::RegistryHostConfig::RegistryHeader>]
    #     Header configures the registry host headers.
    # @!attribute [rw] ca
    #   @return [::Array<::Google::Cloud::Container::V1::ContainerdConfig::RegistryHostConfig::CertificateConfig>]
    #     CA configures the registry host certificate.
    # @!attribute [rw] client
    #   @return [::Array<::Google::Cloud::Container::V1::ContainerdConfig::RegistryHostConfig::CertificateConfigPair>]
    #     Client configures the registry host client certificate and key.
    # @!attribute [rw] dial_timeout
    #   @return [::Google::Protobuf::Duration]
    #     Specifies the maximum duration allowed for a connection attempt to
    #     complete. A shorter timeout helps reduce delays when falling back to
    #     the original registry if the mirror is unreachable.
    #     Maximum allowed value is 180s. If not set, containerd sets default 30s.
    #     The value should be a decimal number of seconds with an `s` suffix.
    class HostConfig
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end

    # HostCapability configures capabilities for the registry host.
    module HostCapability
      # UNKNOWN should never be set.
      HOST_CAPABILITY_UNSPECIFIED = 0

      # Pull represents the capability to fetch manifests and blobs by digest.
      HOST_CAPABILITY_PULL = 1

      # Resolve represents the capability to fetch manifests by name.
      HOST_CAPABILITY_RESOLVE = 2

      # Push represents the capability to push blobs and manifests.
      HOST_CAPABILITY_PUSH = 3
    end
  end
end

#writable_cgroups ⇒ ::Google::Cloud::Container::V1::ContainerdConfig::WritableCgroups

Returns Optional. WritableCgroups defines writable cgroups configuration for the node pool.

Returns:



1507
1508
1509
1510
1511
1512
1513
1514
1515
1516
1517
1518
1519
1520
1521
1522
1523
1524
1525
1526
1527
1528
1529
1530
1531
1532
1533
1534
1535
1536
1537
1538
1539
1540
1541
1542
1543
1544
1545
1546
1547
1548
1549
1550
1551
1552
1553
1554
1555
1556
1557
1558
1559
1560
1561
1562
1563
1564
1565
1566
1567
1568
1569
1570
1571
1572
1573
1574
1575
1576
1577
1578
1579
1580
1581
1582
1583
1584
1585
1586
1587
1588
1589
1590
1591
1592
1593
1594
1595
1596
1597
1598
1599
1600
1601
1602
1603
1604
1605
1606
1607
1608
1609
1610
1611
1612
1613
1614
1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669
1670
1671
1672
1673
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
 
# File 'proto_docs/google/container/v1/cluster_service.rb', line 1507

class ContainerdConfig
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # PrivateRegistryAccessConfig contains access configuration for
  # private container registries.
  # @!attribute [rw] enabled
  #   @return [::Boolean]
  #     Private registry access is enabled.
  # @!attribute [rw] certificate_authority_domain_config
  #   @return [::Array<::Google::Cloud::Container::V1::ContainerdConfig::PrivateRegistryAccessConfig::CertificateAuthorityDomainConfig>]
  #     Private registry access configuration.
  class PrivateRegistryAccessConfig
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods

    # CertificateAuthorityDomainConfig configures one or more fully qualified
    # domain names (FQDN) to a specific certificate.
    # @!attribute [rw] fqdns
    #   @return [::Array<::String>]
    #     List of fully qualified domain names (FQDN).
    #     Specifying port is supported.
    #     Wildcards are NOT supported.
    #     Examples:
    #     - `my.customdomain.com`
    #     - `10.0.1.2:5000`
    # @!attribute [rw] gcp_secret_manager_certificate_config
    #   @return [::Google::Cloud::Container::V1::ContainerdConfig::PrivateRegistryAccessConfig::CertificateAuthorityDomainConfig::GCPSecretManagerCertificateConfig]
    #     Secret Manager certificate configuration.
    class CertificateAuthorityDomainConfig
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods

      # GCPSecretManagerCertificateConfig configures a secret from
      # [Secret Manager](https://cloud.google.com/secret-manager).
      # @!attribute [rw] secret_uri
      #   @return [::String]
      #     Secret URI, in the form
      #     "projects/$PROJECT_ID/secrets/$SECRET_NAME/versions/$VERSION".
      #     Version can be fixed (e.g. "2") or "latest"
      class GCPSecretManagerCertificateConfig
        include ::Google::Protobuf::MessageExts
        extend ::Google::Protobuf::MessageExts::ClassMethods
      end
    end
  end

  # Defines writable cgroups configuration.
  # @!attribute [rw] enabled
  #   @return [::Boolean]
  #     Optional. Whether writable cgroups is enabled.
  class WritableCgroups
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # RegistryHostConfig configures the top-level structure for a single
  # containerd registry server's configuration, which represents one hosts.toml
  # file on the node. It will override the same fqdns in
  # PrivateRegistryAccessConfig.
  # @!attribute [rw] server
  #   @return [::String]
  #     Defines the host name of the registry server, which will be used to
  #     create configuration file as /etc/containerd/hosts.d/<server>/hosts.toml.
  #     It supports fully qualified domain names (FQDN) and IP addresses:
  #     Specifying port is supported, while scheme and path are NOT supported.
  #     Wildcards are NOT supported.
  #     Examples:
  #     - `my.customdomain.com`
  #     - `10.0.1.2:5000`
  # @!attribute [rw] hosts
  #   @return [::Array<::Google::Cloud::Container::V1::ContainerdConfig::RegistryHostConfig::HostConfig>]
  #     HostConfig configures a list of host-specific configurations for the
  #     server.
  #     Each server can have at most 10 host configurations.
  class RegistryHostConfig
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods

    # CertificateConfig configures certificate for the registry.
    # @!attribute [rw] gcp_secret_manager_secret_uri
    #   @return [::String]
    #     The URI configures a secret from
    #     [Secret Manager](https://cloud.google.com/secret-manager)
    #     in the format
    #     "projects/$PROJECT_ID/secrets/$SECRET_NAME/versions/$VERSION" for
    #     global secret or
    #     "projects/$PROJECT_ID/locations/$REGION/secrets/$SECRET_NAME/versions/$VERSION"
    #     for regional secret. Version can be fixed (e.g. "2") or "latest"
    class CertificateConfig
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end

    # CertificateConfigPair configures pairs of certificates, which is used for
    # client certificate and key pairs under a registry.
    # @!attribute [rw] cert
    #   @return [::Google::Cloud::Container::V1::ContainerdConfig::RegistryHostConfig::CertificateConfig]
    #     Cert configures the client certificate.
    # @!attribute [rw] key
    #   @return [::Google::Cloud::Container::V1::ContainerdConfig::RegistryHostConfig::CertificateConfig]
    #     Key configures the client private key. Optional.
    class CertificateConfigPair
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end

    # RegistryHeader configures headers for the registry.
    # @!attribute [rw] key
    #   @return [::String]
    #     Key configures the header key.
    # @!attribute [rw] value
    #   @return [::Array<::String>]
    #     Value configures the header value.
    class RegistryHeader
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end

    # HostConfig configures the registry host under a given Server.
    # @!attribute [rw] host
    #   @return [::String]
    #     Host configures the registry host/mirror.
    #     It supports fully qualified domain names (FQDNs) and IP addresses.
    #     Specifying scheme, port or path is supported. Scheme can only be http
    #     or https.
    #     Wildcards are NOT supported.
    #     Examples:
    #     - `my.customdomain.com`
    #     - `https://my.customdomain.com/path`
    #     - `10.0.1.2:5000`
    # @!attribute [rw] capabilities
    #   @return [::Array<::Google::Cloud::Container::V1::ContainerdConfig::RegistryHostConfig::HostCapability>]
    #     Capabilities represent the capabilities of the registry host,
    #     specifying what operations a host is capable of performing.
    #     If not set, containerd enables all capabilities by default.
    # @!attribute [rw] override_path
    #   @return [::Boolean]
    #     OverridePath is used to indicate the host's API root endpoint is
    #     defined in the URL path rather than by the API specification. This may
    #     be used with non-compliant OCI registries which are missing the /v2
    #     prefix.
    #     If not set, containerd sets default false.
    # @!attribute [rw] header
    #   @return [::Array<::Google::Cloud::Container::V1::ContainerdConfig::RegistryHostConfig::RegistryHeader>]
    #     Header configures the registry host headers.
    # @!attribute [rw] ca
    #   @return [::Array<::Google::Cloud::Container::V1::ContainerdConfig::RegistryHostConfig::CertificateConfig>]
    #     CA configures the registry host certificate.
    # @!attribute [rw] client
    #   @return [::Array<::Google::Cloud::Container::V1::ContainerdConfig::RegistryHostConfig::CertificateConfigPair>]
    #     Client configures the registry host client certificate and key.
    # @!attribute [rw] dial_timeout
    #   @return [::Google::Protobuf::Duration]
    #     Specifies the maximum duration allowed for a connection attempt to
    #     complete. A shorter timeout helps reduce delays when falling back to
    #     the original registry if the mirror is unreachable.
    #     Maximum allowed value is 180s. If not set, containerd sets default 30s.
    #     The value should be a decimal number of seconds with an `s` suffix.
    class HostConfig
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end

    # HostCapability configures capabilities for the registry host.
    module HostCapability
      # UNKNOWN should never be set.
      HOST_CAPABILITY_UNSPECIFIED = 0

      # Pull represents the capability to fetch manifests and blobs by digest.
      HOST_CAPABILITY_PULL = 1

      # Resolve represents the capability to fetch manifests by name.
      HOST_CAPABILITY_RESOLVE = 2

      # Push represents the capability to push blobs and manifests.
      HOST_CAPABILITY_PUSH = 3
    end
  end
end