Class: Google::Cloud::Container::V1beta1::ContainerdConfig

Inherits:
Object
  • Object
show all
Extended by:
Protobuf::MessageExts::ClassMethods
Includes:
Protobuf::MessageExts
Defined in:
proto_docs/google/container/v1beta1/cluster_service.rb

Overview

ContainerdConfig contains configuration to customize containerd.

Defined Under Namespace

Classes: PrivateRegistryAccessConfig, RegistryHostConfig, WritableCgroups

Instance Attribute Summary collapse

Instance Attribute Details

#private_registry_access_config ⇒ ::Google::Cloud::Container::V1beta1::ContainerdConfig::PrivateRegistryAccessConfig

Returns PrivateRegistryAccessConfig is used to configure access configuration for private container registries.

Returns:



1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669
1670
1671
1672
1673
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
1693
1694
1695
1696
1697
1698
1699
1700
1701
1702
1703
1704
1705
1706
1707
1708
1709
1710
1711
1712
1713
1714
1715
1716
1717
1718
1719
1720
1721
1722
1723
1724
1725
1726
1727
1728
1729
1730
1731
1732
1733
1734
1735
1736
1737
1738
1739
1740
1741
1742
1743
1744
1745
1746
1747
1748
1749
1750
1751
1752
1753
1754
1755
1756
1757
1758
1759
1760
1761
1762
1763
1764
1765
1766
1767
1768
1769
1770
1771
1772
1773
1774
1775
1776
1777
1778
1779
1780
1781
1782
1783
1784
1785
1786
1787
1788
1789
1790
1791
1792
1793
1794
 
# File 'proto_docs/google/container/v1beta1/cluster_service.rb', line 1615

class ContainerdConfig
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # PrivateRegistryAccessConfig contains access configuration for
  # private container registries.
  # @!attribute [rw] enabled
  #   @return [::Boolean]
  #     Private registry access is enabled.
  # @!attribute [rw] certificate_authority_domain_config
  #   @return [::Array<::Google::Cloud::Container::V1beta1::ContainerdConfig::PrivateRegistryAccessConfig::CertificateAuthorityDomainConfig>]
  #     Private registry access configuration.
  class PrivateRegistryAccessConfig
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods

    # CertificateAuthorityDomainConfig configures one or more fully qualified
    # domain names (FQDN) to a specific certificate.
    # @!attribute [rw] fqdns
    #   @return [::Array<::String>]
    #     List of fully qualified domain names (FQDN).
    #     Specifying port is supported.
    #     Wildcards are NOT supported.
    #     Examples:
    #     - `my.customdomain.com`
    #     - `10.0.1.2:5000`
    # @!attribute [rw] gcp_secret_manager_certificate_config
    #   @return [::Google::Cloud::Container::V1beta1::ContainerdConfig::PrivateRegistryAccessConfig::CertificateAuthorityDomainConfig::GCPSecretManagerCertificateConfig]
    #     Secret Manager certificate configuration.
    class CertificateAuthorityDomainConfig
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods

      # GCPSecretManagerCertificateConfig configures a secret from
      # [Secret Manager](https://cloud.google.com/secret-manager).
      # @!attribute [rw] secret_uri
      #   @return [::String]
      #     Secret URI, in the form
      #     "projects/$PROJECT_ID/secrets/$SECRET_NAME/versions/$VERSION".
      #     Version can be fixed (e.g. "2") or "latest"
      class GCPSecretManagerCertificateConfig
        include ::Google::Protobuf::MessageExts
        extend ::Google::Protobuf::MessageExts::ClassMethods
      end
    end
  end

  # Defines writable cgroups configuration.
  # @!attribute [rw] enabled
  #   @return [::Boolean]
  #     Optional. Whether writable cgroups is enabled.
  class WritableCgroups
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # RegistryHostConfig configures the top-level structure for a single
  # containerd registry server's configuration, which represents one hosts.toml
  # file on the node. It will override the same fqdns in
  # PrivateRegistryAccessConfig.
  # @!attribute [rw] server
  #   @return [::String]
  #     Defines the host name of the registry server, which will be used to
  #     create configuration file as /etc/containerd/hosts.d/<server>/hosts.toml.
  #     It supports fully qualified domain names (FQDN) and IP addresses:
  #     Specifying port is supported, while scheme and path are NOT supported.
  #     Wildcards are NOT supported.
  #     Examples:
  #     - `my.customdomain.com`
  #     - `10.0.1.2:5000`
  # @!attribute [rw] hosts
  #   @return [::Array<::Google::Cloud::Container::V1beta1::ContainerdConfig::RegistryHostConfig::HostConfig>]
  #     HostConfig configures a list of host-specific configurations for the
  #     server.
  #     Each server can have at most 10 host configurations.
  class RegistryHostConfig
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods

    # CertificateConfig configures certificate for the registry.
    # @!attribute [rw] gcp_secret_manager_secret_uri
    #   @return [::String]
    #     The URI configures a secret from
    #     [Secret Manager](https://cloud.google.com/secret-manager)
    #     in the format
    #     "projects/$PROJECT_ID/secrets/$SECRET_NAME/versions/$VERSION" for
    #     global secret or
    #     "projects/$PROJECT_ID/locations/$REGION/secrets/$SECRET_NAME/versions/$VERSION"
    #     for regional secret. Version can be fixed (e.g. "2") or "latest"
    class CertificateConfig
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end

    # CertificateConfigPair configures pairs of certificates, which is used for
    # client certificate and key pairs under a registry.
    # @!attribute [rw] cert
    #   @return [::Google::Cloud::Container::V1beta1::ContainerdConfig::RegistryHostConfig::CertificateConfig]
    #     Cert configures the client certificate.
    # @!attribute [rw] key
    #   @return [::Google::Cloud::Container::V1beta1::ContainerdConfig::RegistryHostConfig::CertificateConfig]
    #     Key configures the client private key. Optional.
    class CertificateConfigPair
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end

    # RegistryHeader configures headers for the registry.
    # @!attribute [rw] key
    #   @return [::String]
    #     Key configures the header key.
    # @!attribute [rw] value
    #   @return [::Array<::String>]
    #     Value configures the header value.
    class RegistryHeader
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end

    # HostConfig configures the registry host under a given Server.
    # @!attribute [rw] host
    #   @return [::String]
    #     Host configures the registry host/mirror.
    #     It supports fully qualified domain names (FQDNs) and IP addresses.
    #     Specifying scheme, port or path is supported. Scheme can only be http
    #     or https.
    #     Wildcards are NOT supported.
    #     Examples:
    #     - `my.customdomain.com`
    #     - `https://my.customdomain.com/path`
    #     - `10.0.1.2:5000`
    # @!attribute [rw] capabilities
    #   @return [::Array<::Google::Cloud::Container::V1beta1::ContainerdConfig::RegistryHostConfig::HostCapability>]
    #     Capabilities represent the capabilities of the registry host,
    #     specifying what operations a host is capable of performing.
    #     If not set, containerd enables all capabilities by default.
    # @!attribute [rw] override_path
    #   @return [::Boolean]
    #     OverridePath is used to indicate the host's API root endpoint is
    #     defined in the URL path rather than by the API specification. This may
    #     be used with non-compliant OCI registries which are missing the /v2
    #     prefix.
    #     If not set, containerd sets default false.
    # @!attribute [rw] header
    #   @return [::Array<::Google::Cloud::Container::V1beta1::ContainerdConfig::RegistryHostConfig::RegistryHeader>]
    #     Header configures the registry host headers.
    # @!attribute [rw] ca
    #   @return [::Array<::Google::Cloud::Container::V1beta1::ContainerdConfig::RegistryHostConfig::CertificateConfig>]
    #     CA configures the registry host certificate.
    # @!attribute [rw] client
    #   @return [::Array<::Google::Cloud::Container::V1beta1::ContainerdConfig::RegistryHostConfig::CertificateConfigPair>]
    #     Client configures the registry host client certificate and key.
    # @!attribute [rw] dial_timeout
    #   @return [::Google::Protobuf::Duration]
    #     Specifies the maximum duration allowed for a connection attempt to
    #     complete. A shorter timeout helps reduce delays when falling back to
    #     the original registry if the mirror is unreachable.
    #     Maximum allowed value is 180s. If not set, containerd sets default 30s.
    #     The value should be a decimal number of seconds with an `s` suffix.
    class HostConfig
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end

    # HostCapability configures capabilities for the registry host.
    module HostCapability
      # UNKNOWN should never be set.
      HOST_CAPABILITY_UNSPECIFIED = 0

      # Pull represents the capability to fetch manifests and blobs by digest.
      HOST_CAPABILITY_PULL = 1

      # Resolve represents the capability to fetch manifests by name.
      HOST_CAPABILITY_RESOLVE = 2

      # Push represents the capability to push blobs and manifests.
      HOST_CAPABILITY_PUSH = 3
    end
  end
end

#registry_hosts ⇒ ::Array<::Google::Cloud::Container::V1beta1::ContainerdConfig::RegistryHostConfig>

Returns RegistryHostConfig configures containerd registry host configuration. Each registry_hosts represents a hosts.toml file. At most 25 registry_hosts are allowed.

Returns:



1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669
1670
1671
1672
1673
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
1693
1694
1695
1696
1697
1698
1699
1700
1701
1702
1703
1704
1705
1706
1707
1708
1709
1710
1711
1712
1713
1714
1715
1716
1717
1718
1719
1720
1721
1722
1723
1724
1725
1726
1727
1728
1729
1730
1731
1732
1733
1734
1735
1736
1737
1738
1739
1740
1741
1742
1743
1744
1745
1746
1747
1748
1749
1750
1751
1752
1753
1754
1755
1756
1757
1758
1759
1760
1761
1762
1763
1764
1765
1766
1767
1768
1769
1770
1771
1772
1773
1774
1775
1776
1777
1778
1779
1780
1781
1782
1783
1784
1785
1786
1787
1788
1789
1790
1791
1792
1793
1794
 
# File 'proto_docs/google/container/v1beta1/cluster_service.rb', line 1615

class ContainerdConfig
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # PrivateRegistryAccessConfig contains access configuration for
  # private container registries.
  # @!attribute [rw] enabled
  #   @return [::Boolean]
  #     Private registry access is enabled.
  # @!attribute [rw] certificate_authority_domain_config
  #   @return [::Array<::Google::Cloud::Container::V1beta1::ContainerdConfig::PrivateRegistryAccessConfig::CertificateAuthorityDomainConfig>]
  #     Private registry access configuration.
  class PrivateRegistryAccessConfig
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods

    # CertificateAuthorityDomainConfig configures one or more fully qualified
    # domain names (FQDN) to a specific certificate.
    # @!attribute [rw] fqdns
    #   @return [::Array<::String>]
    #     List of fully qualified domain names (FQDN).
    #     Specifying port is supported.
    #     Wildcards are NOT supported.
    #     Examples:
    #     - `my.customdomain.com`
    #     - `10.0.1.2:5000`
    # @!attribute [rw] gcp_secret_manager_certificate_config
    #   @return [::Google::Cloud::Container::V1beta1::ContainerdConfig::PrivateRegistryAccessConfig::CertificateAuthorityDomainConfig::GCPSecretManagerCertificateConfig]
    #     Secret Manager certificate configuration.
    class CertificateAuthorityDomainConfig
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods

      # GCPSecretManagerCertificateConfig configures a secret from
      # [Secret Manager](https://cloud.google.com/secret-manager).
      # @!attribute [rw] secret_uri
      #   @return [::String]
      #     Secret URI, in the form
      #     "projects/$PROJECT_ID/secrets/$SECRET_NAME/versions/$VERSION".
      #     Version can be fixed (e.g. "2") or "latest"
      class GCPSecretManagerCertificateConfig
        include ::Google::Protobuf::MessageExts
        extend ::Google::Protobuf::MessageExts::ClassMethods
      end
    end
  end

  # Defines writable cgroups configuration.
  # @!attribute [rw] enabled
  #   @return [::Boolean]
  #     Optional. Whether writable cgroups is enabled.
  class WritableCgroups
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # RegistryHostConfig configures the top-level structure for a single
  # containerd registry server's configuration, which represents one hosts.toml
  # file on the node. It will override the same fqdns in
  # PrivateRegistryAccessConfig.
  # @!attribute [rw] server
  #   @return [::String]
  #     Defines the host name of the registry server, which will be used to
  #     create configuration file as /etc/containerd/hosts.d/<server>/hosts.toml.
  #     It supports fully qualified domain names (FQDN) and IP addresses:
  #     Specifying port is supported, while scheme and path are NOT supported.
  #     Wildcards are NOT supported.
  #     Examples:
  #     - `my.customdomain.com`
  #     - `10.0.1.2:5000`
  # @!attribute [rw] hosts
  #   @return [::Array<::Google::Cloud::Container::V1beta1::ContainerdConfig::RegistryHostConfig::HostConfig>]
  #     HostConfig configures a list of host-specific configurations for the
  #     server.
  #     Each server can have at most 10 host configurations.
  class RegistryHostConfig
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods

    # CertificateConfig configures certificate for the registry.
    # @!attribute [rw] gcp_secret_manager_secret_uri
    #   @return [::String]
    #     The URI configures a secret from
    #     [Secret Manager](https://cloud.google.com/secret-manager)
    #     in the format
    #     "projects/$PROJECT_ID/secrets/$SECRET_NAME/versions/$VERSION" for
    #     global secret or
    #     "projects/$PROJECT_ID/locations/$REGION/secrets/$SECRET_NAME/versions/$VERSION"
    #     for regional secret. Version can be fixed (e.g. "2") or "latest"
    class CertificateConfig
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end

    # CertificateConfigPair configures pairs of certificates, which is used for
    # client certificate and key pairs under a registry.
    # @!attribute [rw] cert
    #   @return [::Google::Cloud::Container::V1beta1::ContainerdConfig::RegistryHostConfig::CertificateConfig]
    #     Cert configures the client certificate.
    # @!attribute [rw] key
    #   @return [::Google::Cloud::Container::V1beta1::ContainerdConfig::RegistryHostConfig::CertificateConfig]
    #     Key configures the client private key. Optional.
    class CertificateConfigPair
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end

    # RegistryHeader configures headers for the registry.
    # @!attribute [rw] key
    #   @return [::String]
    #     Key configures the header key.
    # @!attribute [rw] value
    #   @return [::Array<::String>]
    #     Value configures the header value.
    class RegistryHeader
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end

    # HostConfig configures the registry host under a given Server.
    # @!attribute [rw] host
    #   @return [::String]
    #     Host configures the registry host/mirror.
    #     It supports fully qualified domain names (FQDNs) and IP addresses.
    #     Specifying scheme, port or path is supported. Scheme can only be http
    #     or https.
    #     Wildcards are NOT supported.
    #     Examples:
    #     - `my.customdomain.com`
    #     - `https://my.customdomain.com/path`
    #     - `10.0.1.2:5000`
    # @!attribute [rw] capabilities
    #   @return [::Array<::Google::Cloud::Container::V1beta1::ContainerdConfig::RegistryHostConfig::HostCapability>]
    #     Capabilities represent the capabilities of the registry host,
    #     specifying what operations a host is capable of performing.
    #     If not set, containerd enables all capabilities by default.
    # @!attribute [rw] override_path
    #   @return [::Boolean]
    #     OverridePath is used to indicate the host's API root endpoint is
    #     defined in the URL path rather than by the API specification. This may
    #     be used with non-compliant OCI registries which are missing the /v2
    #     prefix.
    #     If not set, containerd sets default false.
    # @!attribute [rw] header
    #   @return [::Array<::Google::Cloud::Container::V1beta1::ContainerdConfig::RegistryHostConfig::RegistryHeader>]
    #     Header configures the registry host headers.
    # @!attribute [rw] ca
    #   @return [::Array<::Google::Cloud::Container::V1beta1::ContainerdConfig::RegistryHostConfig::CertificateConfig>]
    #     CA configures the registry host certificate.
    # @!attribute [rw] client
    #   @return [::Array<::Google::Cloud::Container::V1beta1::ContainerdConfig::RegistryHostConfig::CertificateConfigPair>]
    #     Client configures the registry host client certificate and key.
    # @!attribute [rw] dial_timeout
    #   @return [::Google::Protobuf::Duration]
    #     Specifies the maximum duration allowed for a connection attempt to
    #     complete. A shorter timeout helps reduce delays when falling back to
    #     the original registry if the mirror is unreachable.
    #     Maximum allowed value is 180s. If not set, containerd sets default 30s.
    #     The value should be a decimal number of seconds with an `s` suffix.
    class HostConfig
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end

    # HostCapability configures capabilities for the registry host.
    module HostCapability
      # UNKNOWN should never be set.
      HOST_CAPABILITY_UNSPECIFIED = 0

      # Pull represents the capability to fetch manifests and blobs by digest.
      HOST_CAPABILITY_PULL = 1

      # Resolve represents the capability to fetch manifests by name.
      HOST_CAPABILITY_RESOLVE = 2

      # Push represents the capability to push blobs and manifests.
      HOST_CAPABILITY_PUSH = 3
    end
  end
end

#writable_cgroups ⇒ ::Google::Cloud::Container::V1beta1::ContainerdConfig::WritableCgroups

Returns Optional. WritableCgroups defines writable cgroups configuration for the node pool.

Returns:



1615
1616
1617
1618
1619
1620
1621
1622
1623
1624
1625
1626
1627
1628
1629
1630
1631
1632
1633
1634
1635
1636
1637
1638
1639
1640
1641
1642
1643
1644
1645
1646
1647
1648
1649
1650
1651
1652
1653
1654
1655
1656
1657
1658
1659
1660
1661
1662
1663
1664
1665
1666
1667
1668
1669
1670
1671
1672
1673
1674
1675
1676
1677
1678
1679
1680
1681
1682
1683
1684
1685
1686
1687
1688
1689
1690
1691
1692
1693
1694
1695
1696
1697
1698
1699
1700
1701
1702
1703
1704
1705
1706
1707
1708
1709
1710
1711
1712
1713
1714
1715
1716
1717
1718
1719
1720
1721
1722
1723
1724
1725
1726
1727
1728
1729
1730
1731
1732
1733
1734
1735
1736
1737
1738
1739
1740
1741
1742
1743
1744
1745
1746
1747
1748
1749
1750
1751
1752
1753
1754
1755
1756
1757
1758
1759
1760
1761
1762
1763
1764
1765
1766
1767
1768
1769
1770
1771
1772
1773
1774
1775
1776
1777
1778
1779
1780
1781
1782
1783
1784
1785
1786
1787
1788
1789
1790
1791
1792
1793
1794
 
# File 'proto_docs/google/container/v1beta1/cluster_service.rb', line 1615

class ContainerdConfig
  include ::Google::Protobuf::MessageExts
  extend ::Google::Protobuf::MessageExts::ClassMethods

  # PrivateRegistryAccessConfig contains access configuration for
  # private container registries.
  # @!attribute [rw] enabled
  #   @return [::Boolean]
  #     Private registry access is enabled.
  # @!attribute [rw] certificate_authority_domain_config
  #   @return [::Array<::Google::Cloud::Container::V1beta1::ContainerdConfig::PrivateRegistryAccessConfig::CertificateAuthorityDomainConfig>]
  #     Private registry access configuration.
  class PrivateRegistryAccessConfig
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods

    # CertificateAuthorityDomainConfig configures one or more fully qualified
    # domain names (FQDN) to a specific certificate.
    # @!attribute [rw] fqdns
    #   @return [::Array<::String>]
    #     List of fully qualified domain names (FQDN).
    #     Specifying port is supported.
    #     Wildcards are NOT supported.
    #     Examples:
    #     - `my.customdomain.com`
    #     - `10.0.1.2:5000`
    # @!attribute [rw] gcp_secret_manager_certificate_config
    #   @return [::Google::Cloud::Container::V1beta1::ContainerdConfig::PrivateRegistryAccessConfig::CertificateAuthorityDomainConfig::GCPSecretManagerCertificateConfig]
    #     Secret Manager certificate configuration.
    class CertificateAuthorityDomainConfig
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods

      # GCPSecretManagerCertificateConfig configures a secret from
      # [Secret Manager](https://cloud.google.com/secret-manager).
      # @!attribute [rw] secret_uri
      #   @return [::String]
      #     Secret URI, in the form
      #     "projects/$PROJECT_ID/secrets/$SECRET_NAME/versions/$VERSION".
      #     Version can be fixed (e.g. "2") or "latest"
      class GCPSecretManagerCertificateConfig
        include ::Google::Protobuf::MessageExts
        extend ::Google::Protobuf::MessageExts::ClassMethods
      end
    end
  end

  # Defines writable cgroups configuration.
  # @!attribute [rw] enabled
  #   @return [::Boolean]
  #     Optional. Whether writable cgroups is enabled.
  class WritableCgroups
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods
  end

  # RegistryHostConfig configures the top-level structure for a single
  # containerd registry server's configuration, which represents one hosts.toml
  # file on the node. It will override the same fqdns in
  # PrivateRegistryAccessConfig.
  # @!attribute [rw] server
  #   @return [::String]
  #     Defines the host name of the registry server, which will be used to
  #     create configuration file as /etc/containerd/hosts.d/<server>/hosts.toml.
  #     It supports fully qualified domain names (FQDN) and IP addresses:
  #     Specifying port is supported, while scheme and path are NOT supported.
  #     Wildcards are NOT supported.
  #     Examples:
  #     - `my.customdomain.com`
  #     - `10.0.1.2:5000`
  # @!attribute [rw] hosts
  #   @return [::Array<::Google::Cloud::Container::V1beta1::ContainerdConfig::RegistryHostConfig::HostConfig>]
  #     HostConfig configures a list of host-specific configurations for the
  #     server.
  #     Each server can have at most 10 host configurations.
  class RegistryHostConfig
    include ::Google::Protobuf::MessageExts
    extend ::Google::Protobuf::MessageExts::ClassMethods

    # CertificateConfig configures certificate for the registry.
    # @!attribute [rw] gcp_secret_manager_secret_uri
    #   @return [::String]
    #     The URI configures a secret from
    #     [Secret Manager](https://cloud.google.com/secret-manager)
    #     in the format
    #     "projects/$PROJECT_ID/secrets/$SECRET_NAME/versions/$VERSION" for
    #     global secret or
    #     "projects/$PROJECT_ID/locations/$REGION/secrets/$SECRET_NAME/versions/$VERSION"
    #     for regional secret. Version can be fixed (e.g. "2") or "latest"
    class CertificateConfig
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end

    # CertificateConfigPair configures pairs of certificates, which is used for
    # client certificate and key pairs under a registry.
    # @!attribute [rw] cert
    #   @return [::Google::Cloud::Container::V1beta1::ContainerdConfig::RegistryHostConfig::CertificateConfig]
    #     Cert configures the client certificate.
    # @!attribute [rw] key
    #   @return [::Google::Cloud::Container::V1beta1::ContainerdConfig::RegistryHostConfig::CertificateConfig]
    #     Key configures the client private key. Optional.
    class CertificateConfigPair
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end

    # RegistryHeader configures headers for the registry.
    # @!attribute [rw] key
    #   @return [::String]
    #     Key configures the header key.
    # @!attribute [rw] value
    #   @return [::Array<::String>]
    #     Value configures the header value.
    class RegistryHeader
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end

    # HostConfig configures the registry host under a given Server.
    # @!attribute [rw] host
    #   @return [::String]
    #     Host configures the registry host/mirror.
    #     It supports fully qualified domain names (FQDNs) and IP addresses.
    #     Specifying scheme, port or path is supported. Scheme can only be http
    #     or https.
    #     Wildcards are NOT supported.
    #     Examples:
    #     - `my.customdomain.com`
    #     - `https://my.customdomain.com/path`
    #     - `10.0.1.2:5000`
    # @!attribute [rw] capabilities
    #   @return [::Array<::Google::Cloud::Container::V1beta1::ContainerdConfig::RegistryHostConfig::HostCapability>]
    #     Capabilities represent the capabilities of the registry host,
    #     specifying what operations a host is capable of performing.
    #     If not set, containerd enables all capabilities by default.
    # @!attribute [rw] override_path
    #   @return [::Boolean]
    #     OverridePath is used to indicate the host's API root endpoint is
    #     defined in the URL path rather than by the API specification. This may
    #     be used with non-compliant OCI registries which are missing the /v2
    #     prefix.
    #     If not set, containerd sets default false.
    # @!attribute [rw] header
    #   @return [::Array<::Google::Cloud::Container::V1beta1::ContainerdConfig::RegistryHostConfig::RegistryHeader>]
    #     Header configures the registry host headers.
    # @!attribute [rw] ca
    #   @return [::Array<::Google::Cloud::Container::V1beta1::ContainerdConfig::RegistryHostConfig::CertificateConfig>]
    #     CA configures the registry host certificate.
    # @!attribute [rw] client
    #   @return [::Array<::Google::Cloud::Container::V1beta1::ContainerdConfig::RegistryHostConfig::CertificateConfigPair>]
    #     Client configures the registry host client certificate and key.
    # @!attribute [rw] dial_timeout
    #   @return [::Google::Protobuf::Duration]
    #     Specifies the maximum duration allowed for a connection attempt to
    #     complete. A shorter timeout helps reduce delays when falling back to
    #     the original registry if the mirror is unreachable.
    #     Maximum allowed value is 180s. If not set, containerd sets default 30s.
    #     The value should be a decimal number of seconds with an `s` suffix.
    class HostConfig
      include ::Google::Protobuf::MessageExts
      extend ::Google::Protobuf::MessageExts::ClassMethods
    end

    # HostCapability configures capabilities for the registry host.
    module HostCapability
      # UNKNOWN should never be set.
      HOST_CAPABILITY_UNSPECIFIED = 0

      # Pull represents the capability to fetch manifests and blobs by digest.
      HOST_CAPABILITY_PULL = 1

      # Resolve represents the capability to fetch manifests by name.
      HOST_CAPABILITY_RESOLVE = 2

      # Push represents the capability to push blobs and manifests.
      HOST_CAPABILITY_PUSH = 3
    end
  end
end