From 7ef1bec7534fe23b4a7453ce1b86085b1048ca77 Mon Sep 17 00:00:00 2001 From: Eitan Yarmush Date: Sat, 3 Oct 2026 12:02:07 +0000 Subject: [PATCH 1/3] Initialize actor egress policies from template defaults Copy an optional template policy when creating an actor, including the golden actor, and write the actor and policy in one transaction. Preserve the distinction between an absent default and an explicitly empty policy, and let each actor policy evolve independently. Signed-off-by: Eitan Yarmush --- .../apivalidation/actor_template_test.go | 36 + .../internal/apivalidation/egress_policy.go | 4 + .../apivalidation/zz_generated.validation.go | 83 + cmd/ateapi/internal/controlapi/actor.go | 9 +- cmd/ateapi/internal/controlapi/actor_test.go | 2 +- .../internal/controlapi/egress_policy_test.go | 2 +- .../controlapi/functionaltest/actor_test.go | 8 +- cmd/ateapi/internal/controlapi/service.go | 6 +- .../controlapi/template_egress_test.go | 173 ++ cmd/ateapi/internal/defaults/defaults.go | 14 +- cmd/ateapi/internal/defaults/defaults_test.go | 14 + cmd/ateapi/internal/store/atepg/actor.go | 27 +- cmd/ateapi/internal/store/atepg/actor_test.go | 76 +- cmd/ateapi/internal/store/atepg/atepg_test.go | 2 +- .../internal/store/atepg/egress_policy.go | 6 +- cmd/ateapi/internal/store/store.go | 5 +- .../internal/store/storecontract/contract.go | 56 +- .../internal/store/storetest/storetest.go | 2 +- docs/api-guide.md | 25 + pkg/proto/ateapipb/ateapi.pb.go | 1464 +++++++++-------- pkg/proto/ateapipb/ateapi.proto | 24 + 21 files changed, 1290 insertions(+), 748 deletions(-) create mode 100644 cmd/ateapi/internal/controlapi/template_egress_test.go diff --git a/cmd/ateapi/internal/apivalidation/actor_template_test.go b/cmd/ateapi/internal/apivalidation/actor_template_test.go index 12d979784d..b75cae337f 100644 --- a/cmd/ateapi/internal/apivalidation/actor_template_test.go +++ b/cmd/ateapi/internal/apivalidation/actor_template_test.go @@ -34,6 +34,42 @@ func TestValidateCreateActorTemplateRequest(t *testing.T) { "valid", &ateapipb.CreateActorTemplateRequest{ActorTemplate: validActorTemplate()}, nil, + }, { + "valid default egress rules", + &ateapipb.CreateActorTemplateRequest{ActorTemplate: validActorTemplate(func(tmpl *ateapipb.ActorTemplate) { + tmpl.DefaultEgressPolicy = &ateapipb.EgressPolicyTemplate{Rules: []*ateapipb.EgressRule{{Http: &ateapipb.HTTPRule{Hostnames: []string{"api.example.com"}, Ports: &ateapipb.Ports{Numbers: []int32{80}}}}}} + })}, + nil, + }, { + "empty default egress rules", + &ateapipb.CreateActorTemplateRequest{ActorTemplate: validActorTemplate(func(tmpl *ateapipb.ActorTemplate) { + tmpl.DefaultEgressPolicy = &ateapipb.EgressPolicyTemplate{} + })}, + nil, + }, { + "invalid default egress hostname", + &ateapipb.CreateActorTemplateRequest{ActorTemplate: validActorTemplate(func(tmpl *ateapipb.ActorTemplate) { + tmpl.DefaultEgressPolicy = &ateapipb.EgressPolicyTemplate{Rules: []*ateapipb.EgressRule{{Http: &ateapipb.HTTPRule{Hostnames: []string{"bad/host"}, Ports: &ateapipb.Ports{Numbers: []int32{80}}}}}} + })}, + field.ErrorList{field.Invalid(field.NewPath("actor_template", "default_egress_policy", "rules").Index(0).Child("http", "hostnames").Index(0), nil, "")}, + }, { + "default egress rules tie across protocols", + &ateapipb.CreateActorTemplateRequest{ActorTemplate: validActorTemplate(func(tmpl *ateapipb.ActorTemplate) { + tmpl.DefaultEgressPolicy = &ateapipb.EgressPolicyTemplate{Rules: []*ateapipb.EgressRule{ + {Https: &ateapipb.HTTPSRule{Hostnames: []string{"api.example.com"}, Ports: &ateapipb.Ports{Numbers: []int32{443}}}}, + {TlsPassthrough: &ateapipb.TLSPassthroughRule{Hostnames: []string{"api.example.com"}, Ports: &ateapipb.Ports{Numbers: []int32{443}}}}, + }} + })}, + field.ErrorList{field.Invalid(field.NewPath("actor_template", "default_egress_policy", "rules").Index(1).Child("tls_passthrough", "hostnames").Index(0), nil, "")}, + }, { + "too many default egress rules", + &ateapipb.CreateActorTemplateRequest{ActorTemplate: validActorTemplate(func(tmpl *ateapipb.ActorTemplate) { + tmpl.DefaultEgressPolicy = &ateapipb.EgressPolicyTemplate{} + for i := range 257 { + tmpl.DefaultEgressPolicy.Rules = append(tmpl.DefaultEgressPolicy.Rules, &ateapipb.EgressRule{Http: &ateapipb.HTTPRule{Hostnames: []string{fmt.Sprintf("host-%d.example.com", i)}, Ports: &ateapipb.Ports{Numbers: []int32{80}}}}) + } + })}, + field.ErrorList{field.TooMany(field.NewPath("actor_template", "default_egress_policy", "rules"), 257, 256).WithOrigin("maxItems")}, }, { "missing actor_template", &ateapipb.CreateActorTemplateRequest{}, diff --git a/cmd/ateapi/internal/apivalidation/egress_policy.go b/cmd/ateapi/internal/apivalidation/egress_policy.go index df9961ee43..59ad3badc4 100644 --- a/cmd/ateapi/internal/apivalidation/egress_policy.go +++ b/cmd/ateapi/internal/apivalidation/egress_policy.go @@ -119,6 +119,10 @@ func ValidateCustom_EgressPolicy_Rules(_ context.Context, _ operation.Operation, return errs } +func ValidateCustom_EgressPolicyTemplate_Rules(ctx context.Context, op operation.Operation, p *field.Path, rules, oldRules []*ateapipb.EgressRule) field.ErrorList { + return ValidateCustom_EgressPolicy_Rules(ctx, op, p, rules, oldRules) +} + // ruleMatchFields is what a rule matches on: the union member, its hostnames, // and its ports. Everything is empty for a rule that sets no member. func ruleMatchFields(rule *ateapipb.EgressRule) (member string, hostnames []string, ports *ateapipb.Ports) { diff --git a/cmd/ateapi/internal/apivalidation/zz_generated.validation.go b/cmd/ateapi/internal/apivalidation/zz_generated.validation.go index 25b7bee5f0..294c61fddb 100644 --- a/cmd/ateapi/internal/apivalidation/zz_generated.validation.go +++ b/cmd/ateapi/internal/apivalidation/zz_generated.validation.go @@ -1202,6 +1202,36 @@ func Validate_ActorTemplate( errs = append(errs, fn(fldPath.Child("status"), obj.Status, oldVal, oldObj != nil)...) } + { // field ateapipb.ActorTemplate.DefaultEgressPolicy + fn := func( + fldPath *field.Path, + obj, oldObj *ateapipb.EgressPolicyTemplate, + oldValueCorrelated bool) (errs field.ErrorList) { + // don't revalidate unchanged data + if oldValueCorrelated && op.Type == operation.Update { + if ateDeepEqual(obj, oldObj) { + return nil + } + } + // call field-attached validations + earlyReturn := false + if e := validate.OptionalPointer(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 { + earlyReturn = true + } + if earlyReturn { + return // do not proceed + } + // call the type's validation function + errs = append(errs, Validate_EgressPolicyTemplate(ctx, op, fldPath, obj, oldObj)...) + return + } + oldVal := safe.Field(oldObj, + func(oldObj *ateapipb.ActorTemplate) *ateapipb.EgressPolicyTemplate { + return oldObj.DefaultEgressPolicy + }) + errs = append(errs, fn(fldPath.Child("default_egress_policy"), obj.DefaultEgressPolicy, oldVal, oldObj != nil)...) + } + return errs } @@ -3424,6 +3454,59 @@ func Validate_EgressPolicy( return errs } +// Validate_EgressPolicyTemplate validates an instance of EgressPolicyTemplate according +// to declarative validation rules in the API schema. +func Validate_EgressPolicyTemplate( + ctx context.Context, op operation.Operation, fldPath *field.Path, + obj, oldObj *ateapipb.EgressPolicyTemplate) (errs field.ErrorList) { + + { // field ateapipb.EgressPolicyTemplate.Rules + fn := func( + fldPath *field.Path, + obj, oldObj []*ateapipb.EgressRule, + oldValueCorrelated bool) (errs field.ErrorList) { + // don't revalidate unchanged data + if oldValueCorrelated && op.Type == operation.Update { + if ateDeepEqual(obj, oldObj) { + return nil + } + } + // call field-attached validations + earlyReturn := false + if e := validate.PtrSliceNoNils[ateapipb.EgressRule](ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 { + errs = append(errs, e...) + earlyReturn = true + } + if e := validate.MaxItems(ctx, op, fldPath, obj, oldObj, 256).MarkShortCircuit(); len(e) != 0 { + errs = append(errs, e...) + earlyReturn = true + } + if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 { + earlyReturn = true + } + if earlyReturn { + return // do not proceed + } + // custom validation + if e := ValidateCustom_EgressPolicyTemplate_Rules(ctx, op, fldPath, obj, oldObj); len(e) != 0 { + errs = append(errs, e...) + } + // iterate the list and call the type's validation function + if e := validate.EachPtrSliceVal(ctx, op, fldPath, obj, oldObj, nil, nil, Validate_EgressRule); len(e) != 0 { + errs = append(errs, e...) + } + return + } + oldVal := safe.Field(oldObj, + func(oldObj *ateapipb.EgressPolicyTemplate) []*ateapipb.EgressRule { + return oldObj.Rules + }) + errs = append(errs, fn(fldPath.Child("rules"), obj.Rules, oldVal, oldObj != nil)...) + } + + return errs +} + var unionMembershipFor_github_com_agent_substrate_substrate_pkg_proto_ateapipb_EgressRule_ = validate.NewUnionMembership(validate.NewUnionMember("http"), validate.NewUnionMember("https"), validate.NewUnionMember("tls_passthrough")) // Validate_EgressRule validates an instance of EgressRule according diff --git a/cmd/ateapi/internal/controlapi/actor.go b/cmd/ateapi/internal/controlapi/actor.go index 19740224df..564d5bbe45 100644 --- a/cmd/ateapi/internal/controlapi/actor.go +++ b/cmd/ateapi/internal/controlapi/actor.go @@ -147,7 +147,14 @@ func (s *ServiceImpl) CreateActor(ctx context.Context, inActor *ateapipb.Actor) } // Save the data in the storage layer. - stored, err := s.store.CreateActor(ctx, outActor) + var policy *ateapipb.EgressPolicy + if initial := template.GetDefaultEgressPolicy(); initial != nil { + policy = &ateapipb.EgressPolicy{ + Metadata: &ateapipb.ResourceMetadata{Atespace: atespace, Name: "default"}, + Rules: initial.GetRules(), + } + } + stored, err := s.store.CreateActor(ctx, outActor, policy) if err != nil { if errors.Is(err, store.ErrAlreadyExists) { return nil, apierror.AlreadyExists("Actor %s already exists", name) diff --git a/cmd/ateapi/internal/controlapi/actor_test.go b/cmd/ateapi/internal/controlapi/actor_test.go index f5377c4169..e0310e0e91 100644 --- a/cmd/ateapi/internal/controlapi/actor_test.go +++ b/cmd/ateapi/internal/controlapi/actor_test.go @@ -676,7 +676,7 @@ func TestUpdateActor_DeleteRecreateRace(t *testing.T) { Metadata: &ateapipb.ResourceMetadata{Atespace: testAtespace, Name: testActorID}, ActorTemplate: &ateapipb.ObjectRef{Atespace: "ns1", Name: "tmpl1"}, Status: &ateapipb.ActorStatus{State: ateapipb.ActorState_ACTOR_STATE_SUSPENDED}, - }) + }, nil) if err != nil { t.Fatalf("racing writer: recreate CreateActor: %v", err) } diff --git a/cmd/ateapi/internal/controlapi/egress_policy_test.go b/cmd/ateapi/internal/controlapi/egress_policy_test.go index e454e04395..e928f5b8b7 100644 --- a/cmd/ateapi/internal/controlapi/egress_policy_test.go +++ b/cmd/ateapi/internal/controlapi/egress_policy_test.go @@ -38,7 +38,7 @@ func TestActorEgressPolicy(t *testing.T) { _, err := persistence.CreateActor(t.Context(), &ateapipb.Actor{ Metadata: &ateapipb.ResourceMetadata{Atespace: testAtespace, Name: "egress-actor"}, Status: &ateapipb.ActorStatus{State: ateapipb.ActorState_ACTOR_STATE_RUNNING}, - }) + }, nil) if err != nil { t.Fatal(err) } diff --git a/cmd/ateapi/internal/controlapi/functionaltest/actor_test.go b/cmd/ateapi/internal/controlapi/functionaltest/actor_test.go index 49f4f64b4d..67a3833d01 100644 --- a/cmd/ateapi/internal/controlapi/functionaltest/actor_test.go +++ b/cmd/ateapi/internal/controlapi/functionaltest/actor_test.go @@ -1304,7 +1304,7 @@ func TestDeleteActor_StateDeleting(t *testing.T) { Status: &ateapipb.ActorStatus{State: ateapipb.ActorState_ACTOR_STATE_DELETING}, ActorTemplate: &ateapipb.ObjectRef{Atespace: testAtespace, Name: "tmpl1"}, } - if _, err := tc.persistence.CreateActor(context.Background(), deletingActor); err != nil { + if _, err := tc.persistence.CreateActor(context.Background(), deletingActor, nil); err != nil { t.Fatalf("CreateActor: %v", err) } @@ -1333,7 +1333,7 @@ func TestDeleteActor_WrongState(t *testing.T) { Status: &ateapipb.ActorStatus{State: ateapipb.ActorState_ACTOR_STATE_RUNNING}, ActorTemplate: &ateapipb.ObjectRef{Atespace: testAtespace, Name: "tmpl1"}, } - if _, err := tc.persistence.CreateActor(context.Background(), runningActor); err != nil { + if _, err := tc.persistence.CreateActor(context.Background(), runningActor, nil); err != nil { t.Fatalf("CreateActor: %v", err) } @@ -1378,7 +1378,7 @@ func TestDeleteActor_MultipleVolumeDeletionFailures(t *testing.T) { }, }, } - if _, err := tc.persistence.CreateActor(context.Background(), actor); err != nil { + if _, err := tc.persistence.CreateActor(context.Background(), actor, nil); err != nil { t.Fatalf("CreateActor: %v", err) } @@ -1453,7 +1453,7 @@ func TestDeleteActor_VolumeDeletionFailure_RetrySuccess(t *testing.T) { }, }, } - if _, err := tc.persistence.CreateActor(context.Background(), actor); err != nil { + if _, err := tc.persistence.CreateActor(context.Background(), actor, nil); err != nil { t.Fatalf("CreateActor: %v", err) } diff --git a/cmd/ateapi/internal/controlapi/service.go b/cmd/ateapi/internal/controlapi/service.go index 4e5db34875..b024957331 100644 --- a/cmd/ateapi/internal/controlapi/service.go +++ b/cmd/ateapi/internal/controlapi/service.go @@ -39,7 +39,6 @@ import ( type RPCService struct { ateapipb.UnimplementedControlServer impl serviceStore - persistence serviceStore workerCache *workercache.Cache dialer *AteletDialer sandboxConfigLister listersv1alpha1.SandboxConfigLister @@ -91,7 +90,6 @@ func NewRPCService( impl := newServiceImpl(persistence, storageClassLister) s := &RPCService{ impl: impl, - persistence: persistence, workerCache: workerCache, sandboxConfigLister: sandboxConfigLister, csiDriverConfigLister: csiDriverConfigLister, @@ -166,7 +164,7 @@ func (s *RPCService) GetPlugin(ctx context.Context, driverName string) (volume.V return csiPlugin, nil } -// ServiceImpl implements store.Interface and provides the "middleware" layer +// ServiceImpl implements serviceStore and provides the "middleware" layer // between the RPC and storage layers. It enforces invariants and validation // rules, and may implement additional logic beyond the storage layer. // @@ -179,7 +177,7 @@ type ServiceImpl struct { storageClassLister storagev1listers.StorageClassLister } -var _ store.Interface = (*ServiceImpl)(nil) +var _ serviceStore = (*ServiceImpl)(nil) // newServiceImpl creates an instance of the service's middleware // implementation layer. diff --git a/cmd/ateapi/internal/controlapi/template_egress_test.go b/cmd/ateapi/internal/controlapi/template_egress_test.go new file mode 100644 index 0000000000..6b9de6da70 --- /dev/null +++ b/cmd/ateapi/internal/controlapi/template_egress_test.go @@ -0,0 +1,173 @@ +// Copyright 2026 Google LLC +// +// Licensed under the Apache License, Version 2.0 (the "License"); +// you may not use this file except in compliance with the License. +// You may obtain a copy of the License at +// +// http://www.apache.org/licenses/LICENSE-2.0 +// +// Unless required by applicable law or agreed to in writing, software +// distributed under the License is distributed on an "AS IS" BASIS, +// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. +// See the License for the specific language governing permissions and +// limitations under the License. + +package controlapi + +import ( + "context" + "errors" + "testing" + + "github.com/agent-substrate/substrate/cmd/ateapi/internal/store/storetest" + "github.com/agent-substrate/substrate/internal/resources" + "github.com/agent-substrate/substrate/pkg/proto/ateapipb" + "google.golang.org/grpc/codes" + "google.golang.org/grpc/status" + "google.golang.org/protobuf/proto" +) + +func TestCreateActor_DefaultEgressPolicy(t *testing.T) { + for _, tt := range []struct { + name string + policy *ateapipb.EgressPolicyTemplate + }{ + {name: "absent"}, + {name: "empty", policy: &ateapipb.EgressPolicyTemplate{}}, + {name: "configured", policy: &ateapipb.EgressPolicyTemplate{Rules: []*ateapipb.EgressRule{ + {Http: &ateapipb.HTTPRule{Hostnames: []string{"api.example.com"}}}, + {Https: &ateapipb.HTTPSRule{Hostnames: []string{"api.example.com"}}}, + }}}, + } { + t.Run(tt.name, func(t *testing.T) { + ctx := t.Context() + persistence := newTestPersistence(t) + svc := &RPCService{impl: newServiceImpl(persistence, nil), sandboxConfigLister: gvisorDefaultLister(t)} + storetest.MustCreateAtespace(t, ctx, persistence, "templates") + storetest.MustCreateAtespace(t, ctx, persistence, "actors") + tmpl, err := svc.CreateActorTemplate(ctx, &ateapipb.CreateActorTemplateRequest{ActorTemplate: validActorTemplate(func(tmpl *ateapipb.ActorTemplate) { + tmpl.Metadata = &ateapipb.ResourceMetadata{Atespace: "templates", Name: "tmpl"} + tmpl.DefaultEgressPolicy = tt.policy + })}) + if err != nil { + t.Fatal(err) + } + tmplRef := resources.ActorTemplateRefFromActorTemplate(tmpl).ToObjectRef() + var policies []*ateapipb.EgressPolicy + for _, name := range []string{"alpha", "beta"} { + actor, err := svc.CreateActor(ctx, &ateapipb.CreateActorRequest{Actor: &ateapipb.Actor{ + Metadata: &ateapipb.ResourceMetadata{Atespace: "actors", Name: name}, ActorTemplate: tmplRef, + }}) + if err != nil { + t.Fatal(err) + } + policy, err := svc.GetActorEgressPolicy(ctx, &ateapipb.GetActorEgressPolicyRequest{Actor: resources.ActorRefFromActor(actor).ToObjectRef()}) + if tt.policy == nil { + if status.Code(err) != codes.NotFound { + t.Fatalf("policy without default rules: %v, want NotFound", err) + } + continue + } + if err != nil { + t.Fatal(err) + } + md := policy.GetMetadata() + if md.GetAtespace() != "actors" || md.GetName() != "default" || md.GetUid() == "" || md.GetUid() == actor.GetMetadata().GetUid() || md.GetVersion() != 1 || md.GetCreateTime() == nil || md.GetUpdateTime() == nil { + t.Errorf("unexpected policy metadata: %v", md) + } + want := &ateapipb.EgressPolicy{Metadata: md, Rules: tmpl.GetDefaultEgressPolicy().GetRules()} + if !proto.Equal(policy, want) { + t.Errorf("policy = %v, want %v", policy, want) + } + policies = append(policies, policy) + } + if len(policies) == 0 { + return + } + if policies[0].GetMetadata().GetUid() == policies[1].GetMetadata().GetUid() { + t.Fatal("actors share a policy UID") + } + + alpha := &ateapipb.ObjectRef{Atespace: "actors", Name: "alpha"} + policies[0].Rules = nil + if _, err := svc.UpdateActorEgressPolicy(ctx, &ateapipb.UpdateActorEgressPolicyRequest{Actor: alpha, EgressPolicy: policies[0]}); err != nil { + t.Fatal(err) + } + if _, err := svc.DeleteActorEgressPolicy(ctx, &ateapipb.DeleteActorEgressPolicyRequest{Actor: alpha}); err != nil { + t.Fatal(err) + } + if _, err := svc.GetActorEgressPolicy(ctx, &ateapipb.GetActorEgressPolicyRequest{Actor: alpha}); status.Code(err) != codes.NotFound { + t.Fatalf("deleted policy: %v, want NotFound", err) + } + betaPolicy, err := svc.GetActorEgressPolicy(ctx, &ateapipb.GetActorEgressPolicyRequest{Actor: &ateapipb.ObjectRef{Atespace: "actors", Name: "beta"}}) + if err != nil || !proto.Equal(betaPolicy, policies[1]) { + t.Fatalf("editing alpha changed beta's policy: %v, %v", betaPolicy, err) + } + gotTemplate, err := svc.GetActorTemplate(ctx, &ateapipb.GetActorTemplateRequest{ActorTemplate: tmplRef}) + if err != nil || !proto.Equal(gotTemplate, tmpl) { + t.Fatalf("editing alpha changed the template: %v, %v", gotTemplate, err) + } + }) + } +} + +type goldenEgressControl struct { + *RPCService + resume func(context.Context, *ateapipb.ResumeActorRequest) (*ateapipb.ResumeActorResponse, error) +} + +func (c *goldenEgressControl) ResumeActor(ctx context.Context, req *ateapipb.ResumeActorRequest) (*ateapipb.ResumeActorResponse, error) { + return c.resume(ctx, req) +} + +func TestReconcileOne_DefaultEgressPolicyBeforeResume(t *testing.T) { + for _, tt := range []struct { + name string + policy *ateapipb.EgressPolicyTemplate + }{ + {name: "absent"}, + {name: "empty", policy: &ateapipb.EgressPolicyTemplate{}}, + {name: "configured", policy: &ateapipb.EgressPolicyTemplate{Rules: []*ateapipb.EgressRule{{Https: &ateapipb.HTTPSRule{Hostnames: []string{"api.example.com"}}}}}}, + } { + t.Run(tt.name, func(t *testing.T) { + ctx := t.Context() + persistence := newTestPersistence(t) + svc := &RPCService{impl: newServiceImpl(persistence, nil), sandboxConfigLister: gvisorDefaultLister(t)} + storetest.MustCreateAtespace(t, ctx, persistence, "templates") + tmpl, err := svc.CreateActorTemplate(ctx, &ateapipb.CreateActorTemplateRequest{ActorTemplate: validActorTemplate(func(tmpl *ateapipb.ActorTemplate) { + tmpl.Metadata = &ateapipb.ResourceMetadata{Atespace: "templates", Name: "tmpl"} + tmpl.DefaultEgressPolicy = tt.policy + })}) + if err != nil { + t.Fatal(err) + } + stop := errors.New("stop before running workload") + control := &goldenEgressControl{RPCService: svc, resume: func(ctx context.Context, req *ateapipb.ResumeActorRequest) (*ateapipb.ResumeActorResponse, error) { + ref := req.GetActor() + if ref.GetAtespace() != resources.GoldenActorAtespace || ref.GetName() != tmpl.GetMetadata().GetUid() { + t.Fatalf("unexpected golden actor: %v", ref) + } + policy, err := svc.GetActorEgressPolicy(ctx, &ateapipb.GetActorEgressPolicyRequest{Actor: ref}) + if tt.policy == nil { + if status.Code(err) != codes.NotFound { + t.Fatalf("golden without default policy: %v, want NotFound", err) + } + return nil, stop + } + if err != nil { + t.Fatalf("golden policy must exist before resume: %v", err) + } + want := &ateapipb.EgressPolicy{Metadata: policy.Metadata, Rules: tmpl.GetDefaultEgressPolicy().GetRules()} + if policy.GetMetadata().GetAtespace() != resources.GoldenActorAtespace || policy.GetMetadata().GetName() != "default" || !proto.Equal(policy, want) { + t.Fatalf("golden policy = %v, want rules %v in ate-golden", policy, want.Rules) + } + return nil, stop + }} + r := newTestTemplateReconciler(persistence, control) + defer r.queue.ShutDown() + if _, err := r.reconcileOne(ctx, resources.ActorTemplateRefFromActorTemplate(tmpl)); !errors.Is(err, stop) { + t.Fatalf("reconcile = %v, want to reach resume with the policy present", err) + } + }) + } +} diff --git a/cmd/ateapi/internal/defaults/defaults.go b/cmd/ateapi/internal/defaults/defaults.go index ff31f792d4..a628507c61 100644 --- a/cmd/ateapi/internal/defaults/defaults.go +++ b/cmd/ateapi/internal/defaults/defaults.go @@ -52,6 +52,7 @@ func applyActorTemplateDefaults(t *ateapipb.ActorTemplate) { return } applySnapshotConfigDefaults(t.SnapshotConfig) + applyEgressRuleDefaults(t.GetDefaultEgressPolicy().GetRules()) for _, c := range t.Containers { applyContainerDefaults(c) } @@ -94,14 +95,15 @@ func applyActorDefaults(*ateapipb.Actor) {} func applyAtespaceDefaults(*ateapipb.Atespace) {} -// applyEgressPolicyDefaults fills the port of an http or https rule that +func applyEgressPolicyDefaults(p *ateapipb.EgressPolicy) { + applyEgressRuleDefaults(p.GetRules()) +} + +// applyEgressRuleDefaults fills the port of an http or https rule that // names none: the protocol's well-known port. A tls_passthrough rule has no // default; validation requires its ports. -func applyEgressPolicyDefaults(p *ateapipb.EgressPolicy) { - if p == nil { - return - } - for _, r := range p.Rules { +func applyEgressRuleDefaults(rules []*ateapipb.EgressRule) { + for _, r := range rules { switch { case r.GetHttp() != nil && r.Http.Ports == nil: r.Http.Ports = &ateapipb.Ports{Numbers: []int32{80}} diff --git a/cmd/ateapi/internal/defaults/defaults_test.go b/cmd/ateapi/internal/defaults/defaults_test.go index 5a4c90042c..c31c3f7708 100644 --- a/cmd/ateapi/internal/defaults/defaults_test.go +++ b/cmd/ateapi/internal/defaults/defaults_test.go @@ -130,6 +130,20 @@ func TestApply(t *testing.T) { {TlsPassthrough: &ateapipb.TLSPassthroughRule{Hostnames: []string{"d.example.com"}}}, {}, }}, + }, { + name: "template defaults egress ports", + in: &ateapipb.ActorTemplate{DefaultEgressPolicy: &ateapipb.EgressPolicyTemplate{Rules: []*ateapipb.EgressRule{ + {Http: &ateapipb.HTTPRule{Hostnames: []string{"api.example.com"}}}, + {Https: &ateapipb.HTTPSRule{Hostnames: []string{"api.example.com"}}}, + {Https: &ateapipb.HTTPSRule{Hostnames: []string{"custom.example.com"}, Ports: &ateapipb.Ports{Numbers: []int32{8443}}}}, + {TlsPassthrough: &ateapipb.TLSPassthroughRule{Hostnames: []string{"tcp.example.com"}}}, + }}}, + want: &ateapipb.ActorTemplate{DefaultEgressPolicy: &ateapipb.EgressPolicyTemplate{Rules: []*ateapipb.EgressRule{ + {Http: &ateapipb.HTTPRule{Hostnames: []string{"api.example.com"}, Ports: &ateapipb.Ports{Numbers: []int32{80}}}}, + {Https: &ateapipb.HTTPSRule{Hostnames: []string{"api.example.com"}, Ports: &ateapipb.Ports{Numbers: []int32{443}}}}, + {Https: &ateapipb.HTTPSRule{Hostnames: []string{"custom.example.com"}, Ports: &ateapipb.Ports{Numbers: []int32{8443}}}}, + {TlsPassthrough: &ateapipb.TLSPassthroughRule{Hostnames: []string{"tcp.example.com"}}}, + }}}, }, { name: "tag has no defaults", in: &ateapipb.Tag{Scope: ateapipb.TagScope_TAG_SCOPE_PUBLISHED}, diff --git a/cmd/ateapi/internal/store/atepg/actor.go b/cmd/ateapi/internal/store/atepg/actor.go index 538d263511..c1b27ceb31 100644 --- a/cmd/ateapi/internal/store/atepg/actor.go +++ b/cmd/ateapi/internal/store/atepg/actor.go @@ -26,7 +26,30 @@ import ( "google.golang.org/protobuf/proto" ) -func (p *Persistence) CreateActor(ctx context.Context, actor *ateapipb.Actor) (*ateapipb.Actor, error) { +func (p *Persistence) CreateActor(ctx context.Context, actor *ateapipb.Actor, policy *ateapipb.EgressPolicy) (*ateapipb.Actor, error) { + if policy == nil { + return createActor(ctx, p.pool, actor) + } + tx, err := p.pool.Begin(ctx) + if err != nil { + return nil, err + } + defer func() { _ = tx.Rollback(ctx) }() + + dbActor, err := createActor(ctx, tx, actor) + if err != nil { + return nil, err + } + if _, err := createEgressPolicy(ctx, tx, resources.ActorRefFromActor(dbActor), policy); err != nil { + return nil, err + } + if err := tx.Commit(ctx); err != nil { + return nil, err + } + return dbActor, nil +} + +func createActor(ctx context.Context, q querier, actor *ateapipb.Actor) (*ateapipb.Actor, error) { atespace := actor.GetMetadata().GetAtespace() name := actor.GetMetadata().GetName() @@ -42,7 +65,7 @@ func (p *Persistence) CreateActor(ctx context.Context, actor *ateapipb.Actor) (* return nil, fmt.Errorf("marshaling actor: %w", err) } - _, err = p.pool.Exec(ctx, ` + _, err = q.Exec(ctx, ` INSERT INTO actors (atespace, name, uid, version, proto) VALUES ($1, $2, $3, $4, $5)`, atespace, name, dbActor.GetMetadata().GetUid(), dbActor.GetMetadata().GetVersion(), protoBytes) diff --git a/cmd/ateapi/internal/store/atepg/actor_test.go b/cmd/ateapi/internal/store/atepg/actor_test.go index 337a758663..b9c5f5257a 100644 --- a/cmd/ateapi/internal/store/atepg/actor_test.go +++ b/cmd/ateapi/internal/store/atepg/actor_test.go @@ -23,6 +23,7 @@ import ( "github.com/agent-substrate/substrate/cmd/ateapi/internal/store" "github.com/agent-substrate/substrate/internal/resources" "github.com/agent-substrate/substrate/pkg/proto/ateapipb" + "google.golang.org/protobuf/proto" ) func TestUpdateActor_ConcurrentWriteReturnsConflict(t *testing.T) { @@ -33,7 +34,7 @@ func TestUpdateActor_ConcurrentWriteReturnsConflict(t *testing.T) { Metadata: &ateapipb.ResourceMetadata{Atespace: "team-a", Name: "actor-a"}, ActorTemplate: &ateapipb.ObjectRef{Atespace: "default", Name: "template-a"}, Status: &ateapipb.ActorStatus{State: ateapipb.ActorState_ACTOR_STATE_SUSPENDED}, - }) + }, nil) if err != nil { t.Fatalf("CreateActor failed: %v", err) } @@ -85,11 +86,80 @@ func TestCreateActor_MissingAtespace_FailedPrecondition(t *testing.T) { ActorTemplate: &ateapipb.ObjectRef{Atespace: "ns1", Name: "tmpl1"}, Status: &ateapipb.ActorStatus{State: ateapipb.ActorState_ACTOR_STATE_SUSPENDED}, } - if _, err := s.CreateActor(ctx, actor); !errors.Is(err, store.ErrFailedPrecondition) { + if _, err := s.CreateActor(ctx, actor, nil); !errors.Is(err, store.ErrFailedPrecondition) { t.Errorf("CreateActor with missing atespace = %v, want ErrFailedPrecondition", err) } } +func TestCreateActor_EgressPolicyRollback(t *testing.T) { + p := setupPostgresPersistence(t) + ctx := t.Context() + createTestAtespace(t, p, "team-a") + actor := &ateapipb.Actor{ + Metadata: &ateapipb.ResourceMetadata{Atespace: "team-a", Name: "fail-policy"}, + Status: &ateapipb.ActorStatus{State: ateapipb.ActorState_ACTOR_STATE_SUSPENDED}, + } + policy := &ateapipb.EgressPolicy{ + Metadata: &ateapipb.ResourceMetadata{Atespace: "team-a", Name: "default"}, + Rules: []*ateapipb.EgressRule{{ + Http: &ateapipb.HTTPRule{Hostnames: []string{"api.example.com"}, Ports: &ateapipb.Ports{Numbers: []int32{80}}}, + }}, + } + wantActor, wantPolicy := proto.CloneOf(actor), proto.CloneOf(policy) + ref := resources.ActorRefFromActor(actor) + + // Fail the policy INSERT after the actor INSERT has succeeded. + if _, err := p.pool.Exec(ctx, `ALTER TABLE actor_egress_policies ADD CONSTRAINT fail_policy CHECK (actor_name <> 'fail-policy')`); err != nil { + t.Fatal(err) + } + t.Cleanup(func() { + if _, err := p.pool.Exec(context.Background(), `ALTER TABLE actor_egress_policies DROP CONSTRAINT IF EXISTS fail_policy`); err != nil { + t.Error(err) + } + }) + if _, err := p.CreateActor(ctx, actor, policy); err == nil { + t.Fatal("expected policy insert failure") + } + if _, err := p.GetActor(ctx, ref); !errors.Is(err, store.ErrNotFound) { + t.Fatalf("actor after rollback: %v, want ErrNotFound", err) + } + if _, err := p.GetEgressPolicy(ctx, ref); !errors.Is(err, store.ErrNotFound) { + t.Fatalf("policy after rollback: %v, want ErrNotFound", err) + } + if _, err := p.pool.Exec(ctx, `ALTER TABLE actor_egress_policies DROP CONSTRAINT fail_policy`); err != nil { + t.Fatal(err) + } + created, err := p.CreateActor(ctx, actor, policy) + if err != nil { + t.Fatalf("retry: %v", err) + } + got, err := p.GetActor(ctx, ref) + if err != nil { + t.Fatal(err) + } + if !proto.Equal(created, got) { + t.Errorf("stored actor = %v, want %v", got, created) + } + if !proto.Equal(wantActor, actor) || !proto.Equal(wantPolicy, policy) { + t.Error("CreateActor mutated its inputs") + } + if _, err := p.CreateActor(ctx, actor, &ateapipb.EgressPolicy{}); !errors.Is(err, store.ErrAlreadyExists) { + t.Fatalf("duplicate create: %v, want ErrAlreadyExists", err) + } + storedPolicy, err := p.GetEgressPolicy(ctx, ref) + if err != nil { + t.Fatal(err) + } + wantPolicy.Metadata = storedPolicy.Metadata + if !proto.Equal(wantPolicy, storedPolicy) { + t.Errorf("stored policy = %v, want %v", storedPolicy, wantPolicy) + } + md := storedPolicy.GetMetadata() + if md.GetAtespace() != ref.Atespace || md.GetName() != "default" || md.GetUid() == "" || md.GetUid() == created.GetMetadata().GetUid() || md.GetVersion() != 1 || md.GetCreateTime() == nil || md.GetUpdateTime() == nil { + t.Errorf("unexpected policy metadata: %v", md) + } +} + func TestListActors_InvalidPageToken(t *testing.T) { s := setupPostgresPersistence(t) ctx := context.Background() @@ -110,7 +180,7 @@ func TestListActors_CrossScopePageToken(t *testing.T) { t.Fatalf("CreateAtespace(team-b) failed: %v", err) } for _, name := range []string{"a1", "a2"} { - if _, err := s.CreateActor(ctx, &ateapipb.Actor{Metadata: &ateapipb.ResourceMetadata{Name: name, Atespace: "team-a"}, Status: &ateapipb.ActorStatus{State: ateapipb.ActorState_ACTOR_STATE_SUSPENDED}}); err != nil { + if _, err := s.CreateActor(ctx, &ateapipb.Actor{Metadata: &ateapipb.ResourceMetadata{Name: name, Atespace: "team-a"}, Status: &ateapipb.ActorStatus{State: ateapipb.ActorState_ACTOR_STATE_SUSPENDED}}, nil); err != nil { t.Fatalf("CreateActor failed: %v", err) } } diff --git a/cmd/ateapi/internal/store/atepg/atepg_test.go b/cmd/ateapi/internal/store/atepg/atepg_test.go index 6c0e6c0bb0..a456265b07 100644 --- a/cmd/ateapi/internal/store/atepg/atepg_test.go +++ b/cmd/ateapi/internal/store/atepg/atepg_test.go @@ -34,7 +34,7 @@ func TestList_NamesAnUndecodableRow(t *testing.T) { if _, err := s.CreateActor(ctx, &ateapipb.Actor{ Metadata: &ateapipb.ResourceMetadata{Name: "a1", Atespace: "team-a"}, Status: &ateapipb.ActorStatus{State: ateapipb.ActorState_ACTOR_STATE_SUSPENDED}, - }); err != nil { + }, nil); err != nil { t.Fatalf("CreateActor failed: %v", err) } if _, err := s.CreateWorker(ctx, &ateapipb.Worker{ diff --git a/cmd/ateapi/internal/store/atepg/egress_policy.go b/cmd/ateapi/internal/store/atepg/egress_policy.go index 70c679656b..d5ec2e431d 100644 --- a/cmd/ateapi/internal/store/atepg/egress_policy.go +++ b/cmd/ateapi/internal/store/atepg/egress_policy.go @@ -27,13 +27,17 @@ import ( ) func (p *Persistence) CreateEgressPolicy(ctx context.Context, actorRef resources.ActorRef, policy *ateapipb.EgressPolicy) (*ateapipb.EgressPolicy, error) { + return createEgressPolicy(ctx, p.pool, actorRef, policy) +} + +func createEgressPolicy(ctx context.Context, q querier, actorRef resources.ActorRef, policy *ateapipb.EgressPolicy) (*ateapipb.EgressPolicy, error) { dbPolicy := proto.Clone(policy).(*ateapipb.EgressPolicy) setCreateMetadata(dbPolicy.Metadata) protoBytes, err := proto.Marshal(dbPolicy) if err != nil { return nil, fmt.Errorf("marshaling egress policy: %w", err) } - _, err = p.pool.Exec(ctx, ` + _, err = q.Exec(ctx, ` INSERT INTO actor_egress_policies (atespace, actor_name, uid, version, proto) VALUES ($1, $2, $3, $4, $5)`, actorRef.Atespace, actorRef.Name, dbPolicy.GetMetadata().GetUid(), dbPolicy.GetMetadata().GetVersion(), protoBytes) if err != nil { diff --git a/cmd/ateapi/internal/store/store.go b/cmd/ateapi/internal/store/store.go index cc494082c1..52c956cc23 100644 --- a/cmd/ateapi/internal/store/store.go +++ b/cmd/ateapi/internal/store/store.go @@ -70,7 +70,10 @@ type Interface interface { // server-assigned metadata (uid, version, timestamps). The input is not // mutated. Returns ErrAlreadyExists if key is taken, or // ErrFailedPrecondition if the actor's atespace does not exist. - CreateActor(ctx context.Context, actor *ateapipb.Actor) (*ateapipb.Actor, error) + // If policy is non-nil, atomically creates it with the actor, assigning fresh + // server metadata without mutating either input. Its metadata must specify + // the actor's atespace and the name "default". A nil policy creates no policy. + CreateActor(ctx context.Context, actor *ateapipb.Actor, policy *ateapipb.EgressPolicy) (*ateapipb.Actor, error) // Fetches an actor by reference. Returns ErrNotFound if missing. GetActor(ctx context.Context, actorRef resources.ActorRef) (*ateapipb.Actor, error) diff --git a/cmd/ateapi/internal/store/storecontract/contract.go b/cmd/ateapi/internal/store/storecontract/contract.go index f356967998..e88816e864 100644 --- a/cmd/ateapi/internal/store/storecontract/contract.go +++ b/cmd/ateapi/internal/store/storecontract/contract.go @@ -224,7 +224,7 @@ func runEgressPolicyContractTests(t *testing.T, setup func(t *testing.T) store.I actor, err := s.CreateActor(ctx, &ateapipb.Actor{ Metadata: &ateapipb.ResourceMetadata{Atespace: testAtespace, Name: "session-1"}, Status: &ateapipb.ActorStatus{State: ateapipb.ActorState_ACTOR_STATE_RUNNING}, - }) + }, nil) if err != nil { t.Fatal(err) } @@ -282,7 +282,7 @@ func runEgressPolicyContractTests(t *testing.T, setup func(t *testing.T) store.I ctx := context.Background() mustCreateAtespace(t, s, testAtespace) actorRef := resources.ActorRef{Atespace: testAtespace, Name: "session-1"} - if _, err := s.CreateActor(ctx, newTestSuspendedActor(testAtespace, actorRef.Name)); err != nil { + if _, err := s.CreateActor(ctx, newTestSuspendedActor(testAtespace, actorRef.Name), nil); err != nil { t.Fatalf("CreateActor failed: %v", err) } create := func() *ateapipb.EgressPolicy { @@ -351,7 +351,7 @@ func runEgressPolicyContractTests(t *testing.T, setup func(t *testing.T) store.I actor, err := s.CreateActor(ctx, &ateapipb.Actor{ Metadata: &ateapipb.ResourceMetadata{Atespace: testAtespace, Name: actorRef.Name}, Status: &ateapipb.ActorStatus{State: ateapipb.ActorState_ACTOR_STATE_DELETING}, - }) + }, nil) if err != nil { t.Fatal(err) } @@ -367,7 +367,7 @@ func runEgressPolicyContractTests(t *testing.T, setup func(t *testing.T) store.I replacement, err := s.CreateActor(ctx, &ateapipb.Actor{ Metadata: &ateapipb.ResourceMetadata{Atespace: testAtespace, Name: actorRef.Name}, Status: &ateapipb.ActorStatus{State: ateapipb.ActorState_ACTOR_STATE_RUNNING}, - }) + }, nil) if err != nil { t.Fatal(err) } @@ -455,7 +455,7 @@ func runActorContractTests(t *testing.T, setup func(t *testing.T) store.Interfac Status: &ateapipb.ActorStatus{State: ateapipb.ActorState_ACTOR_STATE_SUSPENDED}, } - created, err := s.CreateActor(ctx, actor) + created, err := s.CreateActor(ctx, actor, nil) if err != nil { t.Fatalf("CreateActor failed: %v", err) } @@ -500,10 +500,10 @@ func runActorContractTests(t *testing.T, setup func(t *testing.T) store.Interfac Status: &ateapipb.ActorStatus{State: ateapipb.ActorState_ACTOR_STATE_SUSPENDED}, } - if _, err := s.CreateActor(ctx, actor); err != nil { + if _, err := s.CreateActor(ctx, actor, nil); err != nil { t.Fatalf("CreateActor failed: %v", err) } - if _, err := s.CreateActor(ctx, actor); !errors.Is(err, store.ErrAlreadyExists) { + if _, err := s.CreateActor(ctx, actor, nil); !errors.Is(err, store.ErrAlreadyExists) { t.Errorf("expected ErrAlreadyExists, got %v", err) } }) @@ -519,7 +519,7 @@ func runActorContractTests(t *testing.T, setup func(t *testing.T) store.Interfac Status: &ateapipb.ActorStatus{State: ateapipb.ActorState_ACTOR_STATE_SUSPENDED}, } - created, err := s.CreateActor(ctx, actor) + created, err := s.CreateActor(ctx, actor, nil) if err != nil { t.Fatalf("CreateActor failed: %v", err) } @@ -575,7 +575,7 @@ func runActorContractTests(t *testing.T, setup func(t *testing.T) store.Interfac Status: &ateapipb.ActorStatus{State: ateapipb.ActorState_ACTOR_STATE_SUSPENDED}, } - if _, err := s.CreateActor(ctx, actor); err != nil { + if _, err := s.CreateActor(ctx, actor, nil); err != nil { t.Fatalf("CreateActor failed: %v", err) } @@ -618,7 +618,7 @@ func runActorContractTests(t *testing.T, setup func(t *testing.T) store.Interfac } } - original, err := s.CreateActor(ctx, newActor()) + original, err := s.CreateActor(ctx, newActor(), nil) if err != nil { t.Fatalf("CreateActor failed: %v", err) } @@ -633,7 +633,7 @@ func runActorContractTests(t *testing.T, setup func(t *testing.T) store.Interfac if _, err := s.DeleteActor(ctx, actorRef, store.DeletePreconditions{}); err != nil { t.Fatalf("DeleteActor failed: %v", err) } - recreated, err := s.CreateActor(ctx, newActor()) + recreated, err := s.CreateActor(ctx, newActor(), nil) if err != nil { t.Fatalf("recreate CreateActor failed: %v", err) } @@ -669,7 +669,7 @@ func runActorContractTests(t *testing.T, setup func(t *testing.T) store.Interfac Metadata: &ateapipb.ResourceMetadata{Name: "session-1", Atespace: testAtespace}, ActorTemplate: &ateapipb.ObjectRef{Atespace: "default", Name: "test-template"}, Status: &ateapipb.ActorStatus{State: ateapipb.ActorState_ACTOR_STATE_SUSPENDED}, - }) + }, nil) if err != nil { t.Fatalf("CreateActor failed: %v", err) } @@ -700,7 +700,7 @@ func runActorContractTests(t *testing.T, setup func(t *testing.T) store.Interfac Metadata: &ateapipb.ResourceMetadata{Name: "session-1", Atespace: testAtespace}, ActorTemplate: &ateapipb.ObjectRef{Atespace: "default", Name: "test-template"}, Status: &ateapipb.ActorStatus{State: ateapipb.ActorState_ACTOR_STATE_SUSPENDED}, - }) + }, nil) if err != nil { t.Fatalf("CreateActor failed: %v", err) } @@ -761,7 +761,7 @@ func runActorContractTests(t *testing.T, setup func(t *testing.T) store.Interfac Metadata: &ateapipb.ResourceMetadata{Name: actorRef.Name, Atespace: testAtespace}, ActorTemplate: &ateapipb.ObjectRef{Atespace: "default", Name: "test-template"}, Status: &ateapipb.ActorStatus{State: state}, - }); err != nil { + }, nil); err != nil { t.Fatalf("CreateActor failed: %v", err) } @@ -794,7 +794,7 @@ func runActorContractTests(t *testing.T, setup func(t *testing.T) store.Interfac mustCreateAtespace(t, s, testAtespace) actorRef := resources.ActorRef{Atespace: testAtespace, Name: "session-1"} create := func() *ateapipb.Actor { - created, err := s.CreateActor(ctx, newTestSuspendedActor(testAtespace, actorRef.Name)) + created, err := s.CreateActor(ctx, newTestSuspendedActor(testAtespace, actorRef.Name), nil) if err != nil { t.Fatalf("CreateActor failed: %v", err) } @@ -895,10 +895,10 @@ func runActorContractTests(t *testing.T, setup func(t *testing.T) store.Interfac }}, }, } - if _, err := s.CreateActor(ctx, actor1); err != nil { + if _, err := s.CreateActor(ctx, actor1, nil); err != nil { t.Fatalf("failed to create actor1: %v", err) } - if _, err := s.CreateActor(ctx, actor2); err != nil { + if _, err := s.CreateActor(ctx, actor2, nil); err != nil { t.Fatalf("failed to create actor2: %v", err) } @@ -926,7 +926,7 @@ func runActorContractTests(t *testing.T, setup func(t *testing.T) store.Interfac ActorTemplate: &ateapipb.ObjectRef{Atespace: "ns1", Name: "tmpl1"}, Status: &ateapipb.ActorStatus{State: ateapipb.ActorState_ACTOR_STATE_SUSPENDED}, } - if _, err := s.CreateActor(ctx, actor); err != nil { + if _, err := s.CreateActor(ctx, actor, nil); err != nil { t.Fatalf("failed to create actor %d: %v", i, err) } } @@ -971,7 +971,7 @@ func runActorContractTests(t *testing.T, setup func(t *testing.T) store.Interfac } } for _, a := range []*ateapipb.Actor{mkActor("team-a", "a1"), mkActor("team-a", "a2"), mkActor("team-b", "b1")} { - if _, err := s.CreateActor(ctx, a); err != nil { + if _, err := s.CreateActor(ctx, a, nil); err != nil { t.Fatalf("CreateActor(%s/%s) failed: %v", a.GetMetadata().GetAtespace(), a.GetMetadata().GetName(), err) } } @@ -1210,7 +1210,7 @@ func runTagContractTests(t *testing.T, setup func(t *testing.T) store.Interface) seedSuspendedActor := func(t *testing.T, s store.Interface, atespace, name string) *ateapipb.Actor { t.Helper() mustCreateAtespace(t, s, atespace) - actor, err := s.CreateActor(context.Background(), newTestSuspendedActor(atespace, name)) + actor, err := s.CreateActor(context.Background(), newTestSuspendedActor(atespace, name), nil) if err != nil { t.Fatalf("CreateActor(%s/%s) failed: %v", atespace, name, err) } @@ -1299,7 +1299,7 @@ func runTagContractTests(t *testing.T, setup func(t *testing.T) store.Interface) s := setup(t) ctx := context.Background() mustCreateAtespace(t, s, testAtespace) - actor, err := s.CreateActor(ctx, newTestSuspendedActor(testAtespace, "actor-1")) + actor, err := s.CreateActor(ctx, newTestSuspendedActor(testAtespace, "actor-1"), nil) if err != nil { t.Fatalf("CreateActor failed: %v", err) } @@ -2988,7 +2988,7 @@ func runAtespaceContractTests(t *testing.T, setup func(t *testing.T) store.Inter // Matching guards do not override the emptiness rule. actorRef := resources.ActorRef{Atespace: "team-a", Name: "id1"} - if _, err := s.CreateActor(ctx, newTestSuspendedActor(actorRef.Atespace, actorRef.Name)); err != nil { + if _, err := s.CreateActor(ctx, newTestSuspendedActor(actorRef.Atespace, actorRef.Name), nil); err != nil { t.Fatalf("CreateActor failed: %v", err) } if err := del(store.DeletePreconditions{UID: uid, Version: version}); !errors.Is(err, store.ErrFailedPrecondition) { @@ -3024,7 +3024,7 @@ func runAtespaceContractTests(t *testing.T, setup func(t *testing.T) store.Inter if _, err := s.CreateAtespace(ctx, newTestAtespace("team-a")); err != nil { t.Fatalf("CreateAtespace failed: %v", err) } - if _, err := s.CreateActor(ctx, &ateapipb.Actor{Metadata: &ateapipb.ResourceMetadata{Name: "id1", Atespace: "team-a"}, Status: &ateapipb.ActorStatus{State: ateapipb.ActorState_ACTOR_STATE_DELETING}}); err != nil { + if _, err := s.CreateActor(ctx, &ateapipb.Actor{Metadata: &ateapipb.ResourceMetadata{Name: "id1", Atespace: "team-a"}, Status: &ateapipb.ActorStatus{State: ateapipb.ActorState_ACTOR_STATE_DELETING}}, nil); err != nil { t.Fatalf("CreateActor failed: %v", err) } if _, err := s.DeleteAtespace(ctx, "team-a", store.DeletePreconditions{}); !errors.Is(err, store.ErrFailedPrecondition) { @@ -3042,7 +3042,7 @@ func runAtespaceContractTests(t *testing.T, setup func(t *testing.T) store.Inter if _, err := s.CreateAtespace(ctx, newTestAtespace("team-a")); err != nil { t.Fatalf("CreateAtespace failed: %v", err) } - if _, err := s.CreateActor(ctx, &ateapipb.Actor{Metadata: &ateapipb.ResourceMetadata{Name: "id1", Atespace: "team-a"}, Status: &ateapipb.ActorStatus{State: ateapipb.ActorState_ACTOR_STATE_DELETING}}); err != nil { + if _, err := s.CreateActor(ctx, &ateapipb.Actor{Metadata: &ateapipb.ResourceMetadata{Name: "id1", Atespace: "team-a"}, Status: &ateapipb.ActorStatus{State: ateapipb.ActorState_ACTOR_STATE_DELETING}}, nil); err != nil { t.Fatalf("CreateActor failed: %v", err) } if _, err := s.DeleteAtespace(ctx, "team-a", store.DeletePreconditions{}); !errors.Is(err, store.ErrFailedPrecondition) { @@ -3066,7 +3066,7 @@ func runAtespaceContractTests(t *testing.T, setup func(t *testing.T) store.Inter if _, err := s.CreateAtespace(ctx, newTestAtespace("team-b")); err != nil { t.Fatalf("CreateAtespace(team-b) failed: %v", err) } - if _, err := s.CreateActor(ctx, &ateapipb.Actor{Metadata: &ateapipb.ResourceMetadata{Name: "id1", Atespace: "team-b"}, Status: &ateapipb.ActorStatus{State: ateapipb.ActorState_ACTOR_STATE_SUSPENDED}}); err != nil { + if _, err := s.CreateActor(ctx, &ateapipb.Actor{Metadata: &ateapipb.ResourceMetadata{Name: "id1", Atespace: "team-b"}, Status: &ateapipb.ActorStatus{State: ateapipb.ActorState_ACTOR_STATE_SUSPENDED}}, nil); err != nil { t.Fatalf("CreateActor failed: %v", err) } @@ -3176,7 +3176,7 @@ func runUnknownFieldContractTests(t *testing.T, setup func(t *testing.T) store.I Metadata: withUnknownField(&ateapipb.ResourceMetadata{Atespace: testAtespace, Name: "actor-1"}), ActorTemplate: withUnknownField(&ateapipb.ObjectRef{Atespace: testAtespace, Name: "tmpl-1"}), Status: withUnknownField(&ateapipb.ActorStatus{State: ateapipb.ActorState_ACTOR_STATE_DELETING}), - })) + }), nil) if err != nil { t.Fatalf("CreateActor failed: %v", err) } @@ -3217,7 +3217,7 @@ func runUnknownFieldContractTests(t *testing.T, setup func(t *testing.T) store.I actor, err := s.CreateActor(ctx, &ateapipb.Actor{ Metadata: &ateapipb.ResourceMetadata{Atespace: testAtespace, Name: "actor-1"}, Status: &ateapipb.ActorStatus{State: ateapipb.ActorState_ACTOR_STATE_RUNNING}, - }) + }, nil) if err != nil { t.Fatalf("CreateActor failed: %v", err) } @@ -3258,7 +3258,7 @@ func runUnknownFieldContractTests(t *testing.T, setup func(t *testing.T) store.I s := setup(t) ctx := context.Background() mustCreateAtespace(t, s, testAtespace) - actor, err := s.CreateActor(ctx, newTestSuspendedActor(testAtespace, "actor-1")) + actor, err := s.CreateActor(ctx, newTestSuspendedActor(testAtespace, "actor-1"), nil) if err != nil { t.Fatalf("CreateActor failed: %v", err) } diff --git a/cmd/ateapi/internal/store/storetest/storetest.go b/cmd/ateapi/internal/store/storetest/storetest.go index ed8e457d7b..4884438b08 100644 --- a/cmd/ateapi/internal/store/storetest/storetest.go +++ b/cmd/ateapi/internal/store/storetest/storetest.go @@ -113,7 +113,7 @@ func MustCreateActor(t *testing.T, ctx context.Context, s store.Interface, actor t.Helper() atespace := actor.GetMetadata().GetAtespace() MustCreateAtespace(t, ctx, s, atespace) - created, err := s.CreateActor(ctx, actor) + created, err := s.CreateActor(ctx, actor, nil) if err != nil { t.Fatalf("creating test actor %q/%q: %v", atespace, actor.GetMetadata().GetName(), err) } diff --git a/docs/api-guide.md b/docs/api-guide.md index cdf0766025..ccc486e1ab 100644 --- a/docs/api-guide.md +++ b/docs/api-guide.md @@ -127,11 +127,36 @@ The `ActorTemplate` defines the code, environment, and state-management policies | `snapshotConfig` | `SnapshotConfig` | **Required.** The base object-storage location snapshots are written under, the snapshot fidelity (`preferredFidelity`) every Pause and Suspend captures (`SNAPSHOT_FIDELITY_ROOTFS` requires `sandboxClass: SANDBOX_CLASS_MICROVM`), and automated golden snapshot creation (`goldenSnapshotConfig.mode`). See [Snapshot Storage Layout](#snapshot-storage-layout). | | `volumes` | `[]Volume` | Optional. Volumes the containers may mount, each a `durableDir`, an `externalVolumeTemplate` (see [CSI Volumes Guide](csi-volumes.md)), or a `systemInfo` volume (see [SystemInfo Volumes](#systeminfo-volumes)). Every declared volume must be mounted by at least one container. A `microvm` template may declare several `durableDir` volumes; a `gvisor` template is limited to one. | | `resources` | `*ResourceRequirements` | Optional. Declares each actor's compute size via `limits` — see [Sandbox Right-Sizing](#sandbox-right-sizing-resources). Immutable, like the rest of the template. | +| `defaultEgressPolicy` | `EgressPolicyTemplate` | Optional. Initial egress policy copied when each actor is created, including the golden actor. Contains only `rules`, with the same defaults and validation as `EgressPolicy.rules`. See [Default Egress Policy](#default-egress-policy-defaultegresspolicy). | The sandbox itself — the binaries (e.g. the gVisor `runsc` binary) and the `pauseImage` holding the sandbox's namespaces — comes from the cluster-scoped [`SandboxConfig`](#3-sandboxconfig-the-sandbox-itself) object the template names via `sandboxConfig.configName`. An actor always resolves the config from its current template — repointing the actor at another template requires the same config. Because a snapshot is not restorable across sandbox runtimes, `sandboxClass` is a **hard scheduling gate**: an actor is only ever placed on a `WorkerPool` whose `sandboxClasses` entry matches. It is AND'd with `workerSelector` (and the actor's `worker_selector`), which can only narrow the eligible pools further. It has no default — `sandboxConfig` is required and its `sandboxClass` must be set — and, like the rest of the template, is immutable, so each template's class is fixed at creation. +### Default Egress Policy (`defaultEgressPolicy`) + +Set `defaultEgressPolicy` on an ActorTemplate to give its golden actor and each +new actor the same initial network access. For example, this template field +allows HTTPS to `api.example.com` on the default port, 443: + +```yaml +defaultEgressPolicy: + rules: + - https: + hostnames: [api.example.com] +``` + +Actor creation atomically creates the actor and its `default` egress policy, +so the policy exists before golden initialization can start. Each policy uses +its actor's atespace (`ate-golden` for the golden actor) and receives its own +UID, version, and timestamps. The template field contains only rules. + +The rules are copied once at creation. Updating or deleting an actor's policy +does not affect the template or other actors. Changing an actor's template +does not replace its existing policy. Omitting `defaultEgressPolicy` creates +no policy. Setting it to `{}` creates an explicitly empty policy that allows +no destinations. + ### Sandbox Right-Sizing (`resources`) Unlike a Pod, an actor is sized by its **`limits`** (CPU and Memory): the size is a property of the template, baked into snapshots, so it lives on the immutable `ActorTemplate`. Declared limits do three things: diff --git a/pkg/proto/ateapipb/ateapi.pb.go b/pkg/proto/ateapipb/ateapi.pb.go index 597cbfaef2..b12094c634 100644 --- a/pkg/proto/ateapipb/ateapi.pb.go +++ b/pkg/proto/ateapipb/ateapi.pb.go @@ -1309,6 +1309,60 @@ func (x *EgressPolicy) GetRules() []*EgressRule { return nil } +// EgressPolicyTemplate defines an initial Actor egress policy without resource +// metadata. Rules have the same defaults, validation, and semantics as +// EgressPolicy.rules. +type EgressPolicyTemplate struct { + state protoimpl.MessageState `protogen:"open.v1"` + // Rules are an unordered set of allows, with the same precedence and effects + // as EgressPolicy.rules. Traffic is denied when no rule matches. + // + // +k8s:optional + // +k8s:maxItems=256 + // +k8s:listType=atomic + // +k8s:customValidation # no two rules tie on a name and port + Rules []*EgressRule `protobuf:"bytes,1,rep,name=rules,proto3" json:"rules,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache +} + +func (x *EgressPolicyTemplate) Reset() { + *x = EgressPolicyTemplate{} + mi := &file_ateapi_proto_msgTypes[8] + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + ms.StoreMessageInfo(mi) +} + +func (x *EgressPolicyTemplate) String() string { + return protoimpl.X.MessageStringOf(x) +} + +func (*EgressPolicyTemplate) ProtoMessage() {} + +func (x *EgressPolicyTemplate) ProtoReflect() protoreflect.Message { + mi := &file_ateapi_proto_msgTypes[8] + if x != nil { + ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) + if ms.LoadMessageInfo() == nil { + ms.StoreMessageInfo(mi) + } + return ms + } + return mi.MessageOf(x) +} + +// Deprecated: Use EgressPolicyTemplate.ProtoReflect.Descriptor instead. +func (*EgressPolicyTemplate) Descriptor() ([]byte, []int) { + return file_ateapi_proto_rawDescGZIP(), []int{8} +} + +func (x *EgressPolicyTemplate) GetRules() []*EgressRule { + if x != nil { + return x.Rules + } + return nil +} + // EgressRule allows traffic for a given protocol and destination (host name // or IP, and port). The protocol fixes what the gateway matches on and when: // a request, or a TLS connection at its ClientHello. Traffic that matches no @@ -1342,7 +1396,7 @@ type EgressRule struct { func (x *EgressRule) Reset() { *x = EgressRule{} - mi := &file_ateapi_proto_msgTypes[8] + mi := &file_ateapi_proto_msgTypes[9] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1354,7 +1408,7 @@ func (x *EgressRule) String() string { func (*EgressRule) ProtoMessage() {} func (x *EgressRule) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[8] + mi := &file_ateapi_proto_msgTypes[9] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1367,7 +1421,7 @@ func (x *EgressRule) ProtoReflect() protoreflect.Message { // Deprecated: Use EgressRule.ProtoReflect.Descriptor instead. func (*EgressRule) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{8} + return file_ateapi_proto_rawDescGZIP(), []int{9} } func (x *EgressRule) GetHttp() *HTTPRule { @@ -1435,7 +1489,7 @@ type HTTPRule struct { func (x *HTTPRule) Reset() { *x = HTTPRule{} - mi := &file_ateapi_proto_msgTypes[9] + mi := &file_ateapi_proto_msgTypes[10] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1447,7 +1501,7 @@ func (x *HTTPRule) String() string { func (*HTTPRule) ProtoMessage() {} func (x *HTTPRule) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[9] + mi := &file_ateapi_proto_msgTypes[10] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1460,7 +1514,7 @@ func (x *HTTPRule) ProtoReflect() protoreflect.Message { // Deprecated: Use HTTPRule.ProtoReflect.Descriptor instead. func (*HTTPRule) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{9} + return file_ateapi_proto_rawDescGZIP(), []int{10} } func (x *HTTPRule) GetHostnames() []string { @@ -1520,7 +1574,7 @@ type HTTPSRule struct { func (x *HTTPSRule) Reset() { *x = HTTPSRule{} - mi := &file_ateapi_proto_msgTypes[10] + mi := &file_ateapi_proto_msgTypes[11] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1532,7 +1586,7 @@ func (x *HTTPSRule) String() string { func (*HTTPSRule) ProtoMessage() {} func (x *HTTPSRule) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[10] + mi := &file_ateapi_proto_msgTypes[11] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1545,7 +1599,7 @@ func (x *HTTPSRule) ProtoReflect() protoreflect.Message { // Deprecated: Use HTTPSRule.ProtoReflect.Descriptor instead. func (*HTTPSRule) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{10} + return file_ateapi_proto_rawDescGZIP(), []int{11} } func (x *HTTPSRule) GetHostnames() []string { @@ -1596,7 +1650,7 @@ type TLSPassthroughRule struct { func (x *TLSPassthroughRule) Reset() { *x = TLSPassthroughRule{} - mi := &file_ateapi_proto_msgTypes[11] + mi := &file_ateapi_proto_msgTypes[12] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1608,7 +1662,7 @@ func (x *TLSPassthroughRule) String() string { func (*TLSPassthroughRule) ProtoMessage() {} func (x *TLSPassthroughRule) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[11] + mi := &file_ateapi_proto_msgTypes[12] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1621,7 +1675,7 @@ func (x *TLSPassthroughRule) ProtoReflect() protoreflect.Message { // Deprecated: Use TLSPassthroughRule.ProtoReflect.Descriptor instead. func (*TLSPassthroughRule) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{11} + return file_ateapi_proto_rawDescGZIP(), []int{12} } func (x *TLSPassthroughRule) GetHostnames() []string { @@ -1662,7 +1716,7 @@ type Ports struct { func (x *Ports) Reset() { *x = Ports{} - mi := &file_ateapi_proto_msgTypes[12] + mi := &file_ateapi_proto_msgTypes[13] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1674,7 +1728,7 @@ func (x *Ports) String() string { func (*Ports) ProtoMessage() {} func (x *Ports) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[12] + mi := &file_ateapi_proto_msgTypes[13] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1687,7 +1741,7 @@ func (x *Ports) ProtoReflect() protoreflect.Message { // Deprecated: Use Ports.ProtoReflect.Descriptor instead. func (*Ports) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{12} + return file_ateapi_proto_rawDescGZIP(), []int{13} } func (x *Ports) GetAll() *AllPorts { @@ -1713,7 +1767,7 @@ type AllPorts struct { func (x *AllPorts) Reset() { *x = AllPorts{} - mi := &file_ateapi_proto_msgTypes[13] + mi := &file_ateapi_proto_msgTypes[14] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1725,7 +1779,7 @@ func (x *AllPorts) String() string { func (*AllPorts) ProtoMessage() {} func (x *AllPorts) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[13] + mi := &file_ateapi_proto_msgTypes[14] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1738,7 +1792,7 @@ func (x *AllPorts) ProtoReflect() protoreflect.Message { // Deprecated: Use AllPorts.ProtoReflect.Descriptor instead. func (*AllPorts) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{13} + return file_ateapi_proto_rawDescGZIP(), []int{14} } // HttpRuleEffects contains effects applied by a matching HTTP or HTTPS rule. @@ -1772,7 +1826,7 @@ type HttpRuleEffects struct { func (x *HttpRuleEffects) Reset() { *x = HttpRuleEffects{} - mi := &file_ateapi_proto_msgTypes[14] + mi := &file_ateapi_proto_msgTypes[15] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1784,7 +1838,7 @@ func (x *HttpRuleEffects) String() string { func (*HttpRuleEffects) ProtoMessage() {} func (x *HttpRuleEffects) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[14] + mi := &file_ateapi_proto_msgTypes[15] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1797,7 +1851,7 @@ func (x *HttpRuleEffects) ProtoReflect() protoreflect.Message { // Deprecated: Use HttpRuleEffects.ProtoReflect.Descriptor instead. func (*HttpRuleEffects) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{14} + return file_ateapi_proto_rawDescGZIP(), []int{15} } func (x *HttpRuleEffects) GetReplaceHeaders() []*CredentialHeader { @@ -1847,7 +1901,7 @@ type CredentialHeader struct { func (x *CredentialHeader) Reset() { *x = CredentialHeader{} - mi := &file_ateapi_proto_msgTypes[15] + mi := &file_ateapi_proto_msgTypes[16] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1859,7 +1913,7 @@ func (x *CredentialHeader) String() string { func (*CredentialHeader) ProtoMessage() {} func (x *CredentialHeader) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[15] + mi := &file_ateapi_proto_msgTypes[16] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1872,7 +1926,7 @@ func (x *CredentialHeader) ProtoReflect() protoreflect.Message { // Deprecated: Use CredentialHeader.ProtoReflect.Descriptor instead. func (*CredentialHeader) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{15} + return file_ateapi_proto_rawDescGZIP(), []int{16} } func (x *CredentialHeader) GetHeader() string { @@ -1929,7 +1983,7 @@ type ActorJWTSource struct { func (x *ActorJWTSource) Reset() { *x = ActorJWTSource{} - mi := &file_ateapi_proto_msgTypes[16] + mi := &file_ateapi_proto_msgTypes[17] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -1941,7 +1995,7 @@ func (x *ActorJWTSource) String() string { func (*ActorJWTSource) ProtoMessage() {} func (x *ActorJWTSource) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[16] + mi := &file_ateapi_proto_msgTypes[17] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -1954,7 +2008,7 @@ func (x *ActorJWTSource) ProtoReflect() protoreflect.Message { // Deprecated: Use ActorJWTSource.ProtoReflect.Descriptor instead. func (*ActorJWTSource) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{16} + return file_ateapi_proto_rawDescGZIP(), []int{17} } func (x *ActorJWTSource) GetAudiences() []string { @@ -2030,7 +2084,7 @@ type ActorStatus struct { func (x *ActorStatus) Reset() { *x = ActorStatus{} - mi := &file_ateapi_proto_msgTypes[17] + mi := &file_ateapi_proto_msgTypes[18] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2042,7 +2096,7 @@ func (x *ActorStatus) String() string { func (*ActorStatus) ProtoMessage() {} func (x *ActorStatus) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[17] + mi := &file_ateapi_proto_msgTypes[18] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2055,7 +2109,7 @@ func (x *ActorStatus) ProtoReflect() protoreflect.Message { // Deprecated: Use ActorStatus.ProtoReflect.Descriptor instead. func (*ActorStatus) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{17} + return file_ateapi_proto_rawDescGZIP(), []int{18} } func (x *ActorStatus) GetState() ActorState { @@ -2125,7 +2179,7 @@ type ActorCrash struct { func (x *ActorCrash) Reset() { *x = ActorCrash{} - mi := &file_ateapi_proto_msgTypes[18] + mi := &file_ateapi_proto_msgTypes[19] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2137,7 +2191,7 @@ func (x *ActorCrash) String() string { func (*ActorCrash) ProtoMessage() {} func (x *ActorCrash) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[18] + mi := &file_ateapi_proto_msgTypes[19] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2150,7 +2204,7 @@ func (x *ActorCrash) ProtoReflect() protoreflect.Message { // Deprecated: Use ActorCrash.ProtoReflect.Descriptor instead. func (*ActorCrash) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{18} + return file_ateapi_proto_rawDescGZIP(), []int{19} } func (x *ActorCrash) GetMessage() string { @@ -2231,7 +2285,7 @@ type WorkerAssignment struct { func (x *WorkerAssignment) Reset() { *x = WorkerAssignment{} - mi := &file_ateapi_proto_msgTypes[19] + mi := &file_ateapi_proto_msgTypes[20] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2243,7 +2297,7 @@ func (x *WorkerAssignment) String() string { func (*WorkerAssignment) ProtoMessage() {} func (x *WorkerAssignment) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[19] + mi := &file_ateapi_proto_msgTypes[20] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2256,7 +2310,7 @@ func (x *WorkerAssignment) ProtoReflect() protoreflect.Message { // Deprecated: Use WorkerAssignment.ProtoReflect.Descriptor instead. func (*WorkerAssignment) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{19} + return file_ateapi_proto_rawDescGZIP(), []int{20} } func (x *WorkerAssignment) GetWorker() *ObjectRef { @@ -2342,7 +2396,7 @@ type TagStatus struct { func (x *TagStatus) Reset() { *x = TagStatus{} - mi := &file_ateapi_proto_msgTypes[20] + mi := &file_ateapi_proto_msgTypes[21] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2354,7 +2408,7 @@ func (x *TagStatus) String() string { func (*TagStatus) ProtoMessage() {} func (x *TagStatus) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[20] + mi := &file_ateapi_proto_msgTypes[21] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2367,7 +2421,7 @@ func (x *TagStatus) ProtoReflect() protoreflect.Message { // Deprecated: Use TagStatus.ProtoReflect.Descriptor instead. func (*TagStatus) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{20} + return file_ateapi_proto_rawDescGZIP(), []int{21} } func (x *TagStatus) GetSnapshot() *Snapshot { @@ -2419,7 +2473,7 @@ type Tag struct { func (x *Tag) Reset() { *x = Tag{} - mi := &file_ateapi_proto_msgTypes[21] + mi := &file_ateapi_proto_msgTypes[22] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2431,7 +2485,7 @@ func (x *Tag) String() string { func (*Tag) ProtoMessage() {} func (x *Tag) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[21] + mi := &file_ateapi_proto_msgTypes[22] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2444,7 +2498,7 @@ func (x *Tag) ProtoReflect() protoreflect.Message { // Deprecated: Use Tag.ProtoReflect.Descriptor instead. func (*Tag) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{21} + return file_ateapi_proto_rawDescGZIP(), []int{22} } func (x *Tag) GetMetadata() *ResourceMetadata { @@ -2490,7 +2544,7 @@ type Atespace struct { func (x *Atespace) Reset() { *x = Atespace{} - mi := &file_ateapi_proto_msgTypes[22] + mi := &file_ateapi_proto_msgTypes[23] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2502,7 +2556,7 @@ func (x *Atespace) String() string { func (*Atespace) ProtoMessage() {} func (x *Atespace) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[22] + mi := &file_ateapi_proto_msgTypes[23] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2515,7 +2569,7 @@ func (x *Atespace) ProtoReflect() protoreflect.Message { // Deprecated: Use Atespace.ProtoReflect.Descriptor instead. func (*Atespace) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{22} + return file_ateapi_proto_rawDescGZIP(), []int{23} } func (x *Atespace) GetMetadata() *ResourceMetadata { @@ -2548,7 +2602,7 @@ type ObjectRef struct { func (x *ObjectRef) Reset() { *x = ObjectRef{} - mi := &file_ateapi_proto_msgTypes[23] + mi := &file_ateapi_proto_msgTypes[24] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2560,7 +2614,7 @@ func (x *ObjectRef) String() string { func (*ObjectRef) ProtoMessage() {} func (x *ObjectRef) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[23] + mi := &file_ateapi_proto_msgTypes[24] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2573,7 +2627,7 @@ func (x *ObjectRef) ProtoReflect() protoreflect.Message { // Deprecated: Use ObjectRef.ProtoReflect.Descriptor instead. func (*ObjectRef) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{23} + return file_ateapi_proto_rawDescGZIP(), []int{24} } func (x *ObjectRef) GetAtespace() string { @@ -2623,14 +2677,23 @@ type ActorTemplate struct { // +k8s:optional Resources *Resources `protobuf:"bytes,7,opt,name=resources,proto3" json:"resources,omitempty"` // +k8s:optional - Status *ActorTemplateStatus `protobuf:"bytes,8,opt,name=status,proto3" json:"status,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache + Status *ActorTemplateStatus `protobuf:"bytes,8,opt,name=status,proto3" json:"status,omitempty"` + // Initial egress policy, copied atomically when an Actor is created from + // this template, including the golden Actor used for initialization. The + // policy is named "default" in the Actor's atespace, with its own metadata. + // Callers may update or delete the copy independently; changing the Actor's + // template does not update its policy. If absent, no policy is created; + // an empty block creates a policy with no rules. + // + // +k8s:optional + DefaultEgressPolicy *EgressPolicyTemplate `protobuf:"bytes,9,opt,name=default_egress_policy,json=defaultEgressPolicy,proto3" json:"default_egress_policy,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache } func (x *ActorTemplate) Reset() { *x = ActorTemplate{} - mi := &file_ateapi_proto_msgTypes[24] + mi := &file_ateapi_proto_msgTypes[25] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2642,7 +2705,7 @@ func (x *ActorTemplate) String() string { func (*ActorTemplate) ProtoMessage() {} func (x *ActorTemplate) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[24] + mi := &file_ateapi_proto_msgTypes[25] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2655,7 +2718,7 @@ func (x *ActorTemplate) ProtoReflect() protoreflect.Message { // Deprecated: Use ActorTemplate.ProtoReflect.Descriptor instead. func (*ActorTemplate) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{24} + return file_ateapi_proto_rawDescGZIP(), []int{25} } func (x *ActorTemplate) GetMetadata() *ResourceMetadata { @@ -2714,6 +2777,13 @@ func (x *ActorTemplate) GetStatus() *ActorTemplateStatus { return nil } +func (x *ActorTemplate) GetDefaultEgressPolicy() *EgressPolicyTemplate { + if x != nil { + return x.DefaultEgressPolicy + } + return nil +} + type Resources struct { state protoimpl.MessageState `protogen:"open.v1"` // limits is the maximum amount of compute resources allowed. Only "cpu" @@ -2731,7 +2801,7 @@ type Resources struct { func (x *Resources) Reset() { *x = Resources{} - mi := &file_ateapi_proto_msgTypes[25] + mi := &file_ateapi_proto_msgTypes[26] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2743,7 +2813,7 @@ func (x *Resources) String() string { func (*Resources) ProtoMessage() {} func (x *Resources) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[25] + mi := &file_ateapi_proto_msgTypes[26] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2756,7 +2826,7 @@ func (x *Resources) ProtoReflect() protoreflect.Message { // Deprecated: Use Resources.ProtoReflect.Descriptor instead. func (*Resources) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{25} + return file_ateapi_proto_rawDescGZIP(), []int{26} } func (x *Resources) GetLimits() []*Limits { @@ -2784,7 +2854,7 @@ type Limits struct { func (x *Limits) Reset() { *x = Limits{} - mi := &file_ateapi_proto_msgTypes[26] + mi := &file_ateapi_proto_msgTypes[27] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2796,7 +2866,7 @@ func (x *Limits) String() string { func (*Limits) ProtoMessage() {} func (x *Limits) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[26] + mi := &file_ateapi_proto_msgTypes[27] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2809,7 +2879,7 @@ func (x *Limits) ProtoReflect() protoreflect.Message { // Deprecated: Use Limits.ProtoReflect.Descriptor instead. func (*Limits) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{26} + return file_ateapi_proto_rawDescGZIP(), []int{27} } func (x *Limits) GetName() string { @@ -2850,7 +2920,7 @@ type GoldenSnapshotStatus struct { func (x *GoldenSnapshotStatus) Reset() { *x = GoldenSnapshotStatus{} - mi := &file_ateapi_proto_msgTypes[27] + mi := &file_ateapi_proto_msgTypes[28] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2862,7 +2932,7 @@ func (x *GoldenSnapshotStatus) String() string { func (*GoldenSnapshotStatus) ProtoMessage() {} func (x *GoldenSnapshotStatus) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[27] + mi := &file_ateapi_proto_msgTypes[28] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2875,7 +2945,7 @@ func (x *GoldenSnapshotStatus) ProtoReflect() protoreflect.Message { // Deprecated: Use GoldenSnapshotStatus.ProtoReflect.Descriptor instead. func (*GoldenSnapshotStatus) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{27} + return file_ateapi_proto_rawDescGZIP(), []int{28} } func (x *GoldenSnapshotStatus) GetGoldenTag() *ObjectRef { @@ -2909,7 +2979,7 @@ type ActorTemplateStatus struct { func (x *ActorTemplateStatus) Reset() { *x = ActorTemplateStatus{} - mi := &file_ateapi_proto_msgTypes[28] + mi := &file_ateapi_proto_msgTypes[29] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2921,7 +2991,7 @@ func (x *ActorTemplateStatus) String() string { func (*ActorTemplateStatus) ProtoMessage() {} func (x *ActorTemplateStatus) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[28] + mi := &file_ateapi_proto_msgTypes[29] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2934,7 +3004,7 @@ func (x *ActorTemplateStatus) ProtoReflect() protoreflect.Message { // Deprecated: Use ActorTemplateStatus.ProtoReflect.Descriptor instead. func (*ActorTemplateStatus) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{28} + return file_ateapi_proto_rawDescGZIP(), []int{29} } func (x *ActorTemplateStatus) GetGoldenSnapshotStatus() *GoldenSnapshotStatus { @@ -2965,7 +3035,7 @@ type SandboxConfig struct { func (x *SandboxConfig) Reset() { *x = SandboxConfig{} - mi := &file_ateapi_proto_msgTypes[29] + mi := &file_ateapi_proto_msgTypes[30] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -2977,7 +3047,7 @@ func (x *SandboxConfig) String() string { func (*SandboxConfig) ProtoMessage() {} func (x *SandboxConfig) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[29] + mi := &file_ateapi_proto_msgTypes[30] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -2990,7 +3060,7 @@ func (x *SandboxConfig) ProtoReflect() protoreflect.Message { // Deprecated: Use SandboxConfig.ProtoReflect.Descriptor instead. func (*SandboxConfig) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{29} + return file_ateapi_proto_rawDescGZIP(), []int{30} } func (x *SandboxConfig) GetSandboxClass() SandboxClass { @@ -3043,7 +3113,7 @@ type SnapshotConfig struct { func (x *SnapshotConfig) Reset() { *x = SnapshotConfig{} - mi := &file_ateapi_proto_msgTypes[30] + mi := &file_ateapi_proto_msgTypes[31] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -3055,7 +3125,7 @@ func (x *SnapshotConfig) String() string { func (*SnapshotConfig) ProtoMessage() {} func (x *SnapshotConfig) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[30] + mi := &file_ateapi_proto_msgTypes[31] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -3068,7 +3138,7 @@ func (x *SnapshotConfig) ProtoReflect() protoreflect.Message { // Deprecated: Use SnapshotConfig.ProtoReflect.Descriptor instead. func (*SnapshotConfig) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{30} + return file_ateapi_proto_rawDescGZIP(), []int{31} } func (x *SnapshotConfig) GetStorageLocation() string { @@ -3108,7 +3178,7 @@ type GoldenSnapshotConfig struct { func (x *GoldenSnapshotConfig) Reset() { *x = GoldenSnapshotConfig{} - mi := &file_ateapi_proto_msgTypes[31] + mi := &file_ateapi_proto_msgTypes[32] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -3120,7 +3190,7 @@ func (x *GoldenSnapshotConfig) String() string { func (*GoldenSnapshotConfig) ProtoMessage() {} func (x *GoldenSnapshotConfig) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[31] + mi := &file_ateapi_proto_msgTypes[32] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -3133,7 +3203,7 @@ func (x *GoldenSnapshotConfig) ProtoReflect() protoreflect.Message { // Deprecated: Use GoldenSnapshotConfig.ProtoReflect.Descriptor instead. func (*GoldenSnapshotConfig) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{31} + return file_ateapi_proto_rawDescGZIP(), []int{32} } func (x *GoldenSnapshotConfig) GetMode() GoldenSnapshotMode { @@ -3213,7 +3283,7 @@ type Container struct { func (x *Container) Reset() { *x = Container{} - mi := &file_ateapi_proto_msgTypes[32] + mi := &file_ateapi_proto_msgTypes[33] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -3225,7 +3295,7 @@ func (x *Container) String() string { func (*Container) ProtoMessage() {} func (x *Container) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[32] + mi := &file_ateapi_proto_msgTypes[33] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -3238,7 +3308,7 @@ func (x *Container) ProtoReflect() protoreflect.Message { // Deprecated: Use Container.ProtoReflect.Descriptor instead. func (*Container) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{32} + return file_ateapi_proto_rawDescGZIP(), []int{33} } func (x *Container) GetName() string { @@ -3318,7 +3388,7 @@ type SecurityContext struct { func (x *SecurityContext) Reset() { *x = SecurityContext{} - mi := &file_ateapi_proto_msgTypes[33] + mi := &file_ateapi_proto_msgTypes[34] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -3330,7 +3400,7 @@ func (x *SecurityContext) String() string { func (*SecurityContext) ProtoMessage() {} func (x *SecurityContext) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[33] + mi := &file_ateapi_proto_msgTypes[34] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -3343,7 +3413,7 @@ func (x *SecurityContext) ProtoReflect() protoreflect.Message { // Deprecated: Use SecurityContext.ProtoReflect.Descriptor instead. func (*SecurityContext) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{33} + return file_ateapi_proto_rawDescGZIP(), []int{34} } func (x *SecurityContext) GetCapabilities() *Capabilities { @@ -3381,7 +3451,7 @@ type Capabilities struct { func (x *Capabilities) Reset() { *x = Capabilities{} - mi := &file_ateapi_proto_msgTypes[34] + mi := &file_ateapi_proto_msgTypes[35] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -3393,7 +3463,7 @@ func (x *Capabilities) String() string { func (*Capabilities) ProtoMessage() {} func (x *Capabilities) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[34] + mi := &file_ateapi_proto_msgTypes[35] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -3406,7 +3476,7 @@ func (x *Capabilities) ProtoReflect() protoreflect.Message { // Deprecated: Use Capabilities.ProtoReflect.Descriptor instead. func (*Capabilities) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{34} + return file_ateapi_proto_rawDescGZIP(), []int{35} } func (x *Capabilities) GetAdd() []string { @@ -3444,7 +3514,7 @@ type EnvVar struct { func (x *EnvVar) Reset() { *x = EnvVar{} - mi := &file_ateapi_proto_msgTypes[35] + mi := &file_ateapi_proto_msgTypes[36] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -3456,7 +3526,7 @@ func (x *EnvVar) String() string { func (*EnvVar) ProtoMessage() {} func (x *EnvVar) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[35] + mi := &file_ateapi_proto_msgTypes[36] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -3469,7 +3539,7 @@ func (x *EnvVar) ProtoReflect() protoreflect.Message { // Deprecated: Use EnvVar.ProtoReflect.Descriptor instead. func (*EnvVar) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{35} + return file_ateapi_proto_rawDescGZIP(), []int{36} } func (x *EnvVar) GetName() string { @@ -3509,7 +3579,7 @@ type ContainerWakeupProbe struct { func (x *ContainerWakeupProbe) Reset() { *x = ContainerWakeupProbe{} - mi := &file_ateapi_proto_msgTypes[36] + mi := &file_ateapi_proto_msgTypes[37] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -3521,7 +3591,7 @@ func (x *ContainerWakeupProbe) String() string { func (*ContainerWakeupProbe) ProtoMessage() {} func (x *ContainerWakeupProbe) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[36] + mi := &file_ateapi_proto_msgTypes[37] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -3534,7 +3604,7 @@ func (x *ContainerWakeupProbe) ProtoReflect() protoreflect.Message { // Deprecated: Use ContainerWakeupProbe.ProtoReflect.Descriptor instead. func (*ContainerWakeupProbe) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{36} + return file_ateapi_proto_rawDescGZIP(), []int{37} } func (x *ContainerWakeupProbe) GetHttpGet() *HTTPGetAction { @@ -3574,7 +3644,7 @@ type HTTPGetAction struct { func (x *HTTPGetAction) Reset() { *x = HTTPGetAction{} - mi := &file_ateapi_proto_msgTypes[37] + mi := &file_ateapi_proto_msgTypes[38] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -3586,7 +3656,7 @@ func (x *HTTPGetAction) String() string { func (*HTTPGetAction) ProtoMessage() {} func (x *HTTPGetAction) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[37] + mi := &file_ateapi_proto_msgTypes[38] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -3599,7 +3669,7 @@ func (x *HTTPGetAction) ProtoReflect() protoreflect.Message { // Deprecated: Use HTTPGetAction.ProtoReflect.Descriptor instead. func (*HTTPGetAction) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{37} + return file_ateapi_proto_rawDescGZIP(), []int{38} } func (x *HTTPGetAction) GetPath() string { @@ -3646,7 +3716,7 @@ type Volume struct { func (x *Volume) Reset() { *x = Volume{} - mi := &file_ateapi_proto_msgTypes[38] + mi := &file_ateapi_proto_msgTypes[39] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -3658,7 +3728,7 @@ func (x *Volume) String() string { func (*Volume) ProtoMessage() {} func (x *Volume) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[38] + mi := &file_ateapi_proto_msgTypes[39] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -3671,7 +3741,7 @@ func (x *Volume) ProtoReflect() protoreflect.Message { // Deprecated: Use Volume.ProtoReflect.Descriptor instead. func (*Volume) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{38} + return file_ateapi_proto_rawDescGZIP(), []int{39} } func (x *Volume) GetName() string { @@ -3727,7 +3797,7 @@ type ImageVolumeSource struct { func (x *ImageVolumeSource) Reset() { *x = ImageVolumeSource{} - mi := &file_ateapi_proto_msgTypes[39] + mi := &file_ateapi_proto_msgTypes[40] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -3739,7 +3809,7 @@ func (x *ImageVolumeSource) String() string { func (*ImageVolumeSource) ProtoMessage() {} func (x *ImageVolumeSource) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[39] + mi := &file_ateapi_proto_msgTypes[40] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -3752,7 +3822,7 @@ func (x *ImageVolumeSource) ProtoReflect() protoreflect.Message { // Deprecated: Use ImageVolumeSource.ProtoReflect.Descriptor instead. func (*ImageVolumeSource) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{39} + return file_ateapi_proto_rawDescGZIP(), []int{40} } func (x *ImageVolumeSource) GetReference() string { @@ -3772,7 +3842,7 @@ type DurableDirVolumeSource struct { func (x *DurableDirVolumeSource) Reset() { *x = DurableDirVolumeSource{} - mi := &file_ateapi_proto_msgTypes[40] + mi := &file_ateapi_proto_msgTypes[41] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -3784,7 +3854,7 @@ func (x *DurableDirVolumeSource) String() string { func (*DurableDirVolumeSource) ProtoMessage() {} func (x *DurableDirVolumeSource) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[40] + mi := &file_ateapi_proto_msgTypes[41] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -3797,7 +3867,7 @@ func (x *DurableDirVolumeSource) ProtoReflect() protoreflect.Message { // Deprecated: Use DurableDirVolumeSource.ProtoReflect.Descriptor instead. func (*DurableDirVolumeSource) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{40} + return file_ateapi_proto_rawDescGZIP(), []int{41} } // ExternalVolumeTemplate provisions an external volume per actor; the volume @@ -3823,7 +3893,7 @@ type ExternalVolumeTemplate struct { func (x *ExternalVolumeTemplate) Reset() { *x = ExternalVolumeTemplate{} - mi := &file_ateapi_proto_msgTypes[41] + mi := &file_ateapi_proto_msgTypes[42] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -3835,7 +3905,7 @@ func (x *ExternalVolumeTemplate) String() string { func (*ExternalVolumeTemplate) ProtoMessage() {} func (x *ExternalVolumeTemplate) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[41] + mi := &file_ateapi_proto_msgTypes[42] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -3848,7 +3918,7 @@ func (x *ExternalVolumeTemplate) ProtoReflect() protoreflect.Message { // Deprecated: Use ExternalVolumeTemplate.ProtoReflect.Descriptor instead. func (*ExternalVolumeTemplate) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{41} + return file_ateapi_proto_rawDescGZIP(), []int{42} } func (x *ExternalVolumeTemplate) GetCapacity() string { @@ -3885,7 +3955,7 @@ type SystemInfoVolumeSource struct { func (x *SystemInfoVolumeSource) Reset() { *x = SystemInfoVolumeSource{} - mi := &file_ateapi_proto_msgTypes[42] + mi := &file_ateapi_proto_msgTypes[43] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -3897,7 +3967,7 @@ func (x *SystemInfoVolumeSource) String() string { func (*SystemInfoVolumeSource) ProtoMessage() {} func (x *SystemInfoVolumeSource) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[42] + mi := &file_ateapi_proto_msgTypes[43] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -3910,7 +3980,7 @@ func (x *SystemInfoVolumeSource) ProtoReflect() protoreflect.Message { // Deprecated: Use SystemInfoVolumeSource.ProtoReflect.Descriptor instead. func (*SystemInfoVolumeSource) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{42} + return file_ateapi_proto_rawDescGZIP(), []int{43} } func (x *SystemInfoVolumeSource) GetDataSources() []*SystemInfoDataSource { @@ -3936,7 +4006,7 @@ type SystemInfoDataSource struct { func (x *SystemInfoDataSource) Reset() { *x = SystemInfoDataSource{} - mi := &file_ateapi_proto_msgTypes[43] + mi := &file_ateapi_proto_msgTypes[44] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -3948,7 +4018,7 @@ func (x *SystemInfoDataSource) String() string { func (*SystemInfoDataSource) ProtoMessage() {} func (x *SystemInfoDataSource) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[43] + mi := &file_ateapi_proto_msgTypes[44] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -3961,7 +4031,7 @@ func (x *SystemInfoDataSource) ProtoReflect() protoreflect.Message { // Deprecated: Use SystemInfoDataSource.ProtoReflect.Descriptor instead. func (*SystemInfoDataSource) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{43} + return file_ateapi_proto_rawDescGZIP(), []int{44} } func (x *SystemInfoDataSource) GetActorMetadata() *ActorMetadataDataSource { @@ -3998,7 +4068,7 @@ type ActorMetadataDataSource struct { func (x *ActorMetadataDataSource) Reset() { *x = ActorMetadataDataSource{} - mi := &file_ateapi_proto_msgTypes[44] + mi := &file_ateapi_proto_msgTypes[45] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4010,7 +4080,7 @@ func (x *ActorMetadataDataSource) String() string { func (*ActorMetadataDataSource) ProtoMessage() {} func (x *ActorMetadataDataSource) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[44] + mi := &file_ateapi_proto_msgTypes[45] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4023,7 +4093,7 @@ func (x *ActorMetadataDataSource) ProtoReflect() protoreflect.Message { // Deprecated: Use ActorMetadataDataSource.ProtoReflect.Descriptor instead. func (*ActorMetadataDataSource) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{44} + return file_ateapi_proto_rawDescGZIP(), []int{45} } func (x *ActorMetadataDataSource) GetItems() []*ActorMetadataItem { @@ -4055,7 +4125,7 @@ type ActorMetadataItem struct { func (x *ActorMetadataItem) Reset() { *x = ActorMetadataItem{} - mi := &file_ateapi_proto_msgTypes[45] + mi := &file_ateapi_proto_msgTypes[46] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4067,7 +4137,7 @@ func (x *ActorMetadataItem) String() string { func (*ActorMetadataItem) ProtoMessage() {} func (x *ActorMetadataItem) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[45] + mi := &file_ateapi_proto_msgTypes[46] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4080,7 +4150,7 @@ func (x *ActorMetadataItem) ProtoReflect() protoreflect.Message { // Deprecated: Use ActorMetadataItem.ProtoReflect.Descriptor instead. func (*ActorMetadataItem) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{45} + return file_ateapi_proto_rawDescGZIP(), []int{46} } func (x *ActorMetadataItem) GetField() ActorMetadataField { @@ -4132,7 +4202,7 @@ type TrustBundleDataSource struct { func (x *TrustBundleDataSource) Reset() { *x = TrustBundleDataSource{} - mi := &file_ateapi_proto_msgTypes[46] + mi := &file_ateapi_proto_msgTypes[47] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4144,7 +4214,7 @@ func (x *TrustBundleDataSource) String() string { func (*TrustBundleDataSource) ProtoMessage() {} func (x *TrustBundleDataSource) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[46] + mi := &file_ateapi_proto_msgTypes[47] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4157,7 +4227,7 @@ func (x *TrustBundleDataSource) ProtoReflect() protoreflect.Message { // Deprecated: Use TrustBundleDataSource.ProtoReflect.Descriptor instead. func (*TrustBundleDataSource) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{46} + return file_ateapi_proto_rawDescGZIP(), []int{47} } func (x *TrustBundleDataSource) GetNames() []string { @@ -4196,7 +4266,7 @@ type VolumeMount struct { func (x *VolumeMount) Reset() { *x = VolumeMount{} - mi := &file_ateapi_proto_msgTypes[47] + mi := &file_ateapi_proto_msgTypes[48] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4208,7 +4278,7 @@ func (x *VolumeMount) String() string { func (*VolumeMount) ProtoMessage() {} func (x *VolumeMount) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[47] + mi := &file_ateapi_proto_msgTypes[48] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4221,7 +4291,7 @@ func (x *VolumeMount) ProtoReflect() protoreflect.Message { // Deprecated: Use VolumeMount.ProtoReflect.Descriptor instead. func (*VolumeMount) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{47} + return file_ateapi_proto_rawDescGZIP(), []int{48} } func (x *VolumeMount) GetName() string { @@ -4250,7 +4320,7 @@ type CreateAtespaceRequest struct { func (x *CreateAtespaceRequest) Reset() { *x = CreateAtespaceRequest{} - mi := &file_ateapi_proto_msgTypes[48] + mi := &file_ateapi_proto_msgTypes[49] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4262,7 +4332,7 @@ func (x *CreateAtespaceRequest) String() string { func (*CreateAtespaceRequest) ProtoMessage() {} func (x *CreateAtespaceRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[48] + mi := &file_ateapi_proto_msgTypes[49] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4275,7 +4345,7 @@ func (x *CreateAtespaceRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use CreateAtespaceRequest.ProtoReflect.Descriptor instead. func (*CreateAtespaceRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{48} + return file_ateapi_proto_rawDescGZIP(), []int{49} } func (x *CreateAtespaceRequest) GetAtespace() *Atespace { @@ -4296,7 +4366,7 @@ type GetAtespaceRequest struct { func (x *GetAtespaceRequest) Reset() { *x = GetAtespaceRequest{} - mi := &file_ateapi_proto_msgTypes[49] + mi := &file_ateapi_proto_msgTypes[50] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4308,7 +4378,7 @@ func (x *GetAtespaceRequest) String() string { func (*GetAtespaceRequest) ProtoMessage() {} func (x *GetAtespaceRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[49] + mi := &file_ateapi_proto_msgTypes[50] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4321,7 +4391,7 @@ func (x *GetAtespaceRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetAtespaceRequest.ProtoReflect.Descriptor instead. func (*GetAtespaceRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{49} + return file_ateapi_proto_rawDescGZIP(), []int{50} } func (x *GetAtespaceRequest) GetAtespace() *ObjectRef { @@ -4352,7 +4422,7 @@ type ListAtespacesRequest struct { func (x *ListAtespacesRequest) Reset() { *x = ListAtespacesRequest{} - mi := &file_ateapi_proto_msgTypes[50] + mi := &file_ateapi_proto_msgTypes[51] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4364,7 +4434,7 @@ func (x *ListAtespacesRequest) String() string { func (*ListAtespacesRequest) ProtoMessage() {} func (x *ListAtespacesRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[50] + mi := &file_ateapi_proto_msgTypes[51] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4377,7 +4447,7 @@ func (x *ListAtespacesRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ListAtespacesRequest.ProtoReflect.Descriptor instead. func (*ListAtespacesRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{50} + return file_ateapi_proto_rawDescGZIP(), []int{51} } func (x *ListAtespacesRequest) GetPageSize() int32 { @@ -4406,7 +4476,7 @@ type ListAtespacesResponse struct { func (x *ListAtespacesResponse) Reset() { *x = ListAtespacesResponse{} - mi := &file_ateapi_proto_msgTypes[51] + mi := &file_ateapi_proto_msgTypes[52] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4418,7 +4488,7 @@ func (x *ListAtespacesResponse) String() string { func (*ListAtespacesResponse) ProtoMessage() {} func (x *ListAtespacesResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[51] + mi := &file_ateapi_proto_msgTypes[52] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4431,7 +4501,7 @@ func (x *ListAtespacesResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ListAtespacesResponse.ProtoReflect.Descriptor instead. func (*ListAtespacesResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{51} + return file_ateapi_proto_rawDescGZIP(), []int{52} } func (x *ListAtespacesResponse) GetAtespaces() []*Atespace { @@ -4463,7 +4533,7 @@ type DeleteAtespaceRequest struct { func (x *DeleteAtespaceRequest) Reset() { *x = DeleteAtespaceRequest{} - mi := &file_ateapi_proto_msgTypes[52] + mi := &file_ateapi_proto_msgTypes[53] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4475,7 +4545,7 @@ func (x *DeleteAtespaceRequest) String() string { func (*DeleteAtespaceRequest) ProtoMessage() {} func (x *DeleteAtespaceRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[52] + mi := &file_ateapi_proto_msgTypes[53] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4488,7 +4558,7 @@ func (x *DeleteAtespaceRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteAtespaceRequest.ProtoReflect.Descriptor instead. func (*DeleteAtespaceRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{52} + return file_ateapi_proto_rawDescGZIP(), []int{53} } func (x *DeleteAtespaceRequest) GetAtespace() *ObjectRef { @@ -4519,7 +4589,7 @@ type CreateActorTemplateRequest struct { func (x *CreateActorTemplateRequest) Reset() { *x = CreateActorTemplateRequest{} - mi := &file_ateapi_proto_msgTypes[53] + mi := &file_ateapi_proto_msgTypes[54] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4531,7 +4601,7 @@ func (x *CreateActorTemplateRequest) String() string { func (*CreateActorTemplateRequest) ProtoMessage() {} func (x *CreateActorTemplateRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[53] + mi := &file_ateapi_proto_msgTypes[54] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4544,7 +4614,7 @@ func (x *CreateActorTemplateRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use CreateActorTemplateRequest.ProtoReflect.Descriptor instead. func (*CreateActorTemplateRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{53} + return file_ateapi_proto_rawDescGZIP(), []int{54} } func (x *CreateActorTemplateRequest) GetActorTemplate() *ActorTemplate { @@ -4565,7 +4635,7 @@ type GetActorTemplateRequest struct { func (x *GetActorTemplateRequest) Reset() { *x = GetActorTemplateRequest{} - mi := &file_ateapi_proto_msgTypes[54] + mi := &file_ateapi_proto_msgTypes[55] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4577,7 +4647,7 @@ func (x *GetActorTemplateRequest) String() string { func (*GetActorTemplateRequest) ProtoMessage() {} func (x *GetActorTemplateRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[54] + mi := &file_ateapi_proto_msgTypes[55] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4590,7 +4660,7 @@ func (x *GetActorTemplateRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetActorTemplateRequest.ProtoReflect.Descriptor instead. func (*GetActorTemplateRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{54} + return file_ateapi_proto_rawDescGZIP(), []int{55} } func (x *GetActorTemplateRequest) GetActorTemplate() *ObjectRef { @@ -4627,7 +4697,7 @@ type ListActorTemplatesRequest struct { func (x *ListActorTemplatesRequest) Reset() { *x = ListActorTemplatesRequest{} - mi := &file_ateapi_proto_msgTypes[55] + mi := &file_ateapi_proto_msgTypes[56] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4639,7 +4709,7 @@ func (x *ListActorTemplatesRequest) String() string { func (*ListActorTemplatesRequest) ProtoMessage() {} func (x *ListActorTemplatesRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[55] + mi := &file_ateapi_proto_msgTypes[56] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4652,7 +4722,7 @@ func (x *ListActorTemplatesRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ListActorTemplatesRequest.ProtoReflect.Descriptor instead. func (*ListActorTemplatesRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{55} + return file_ateapi_proto_rawDescGZIP(), []int{56} } func (x *ListActorTemplatesRequest) GetAtespace() string { @@ -4689,7 +4759,7 @@ type ListActorTemplatesResponse struct { func (x *ListActorTemplatesResponse) Reset() { *x = ListActorTemplatesResponse{} - mi := &file_ateapi_proto_msgTypes[56] + mi := &file_ateapi_proto_msgTypes[57] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4701,7 +4771,7 @@ func (x *ListActorTemplatesResponse) String() string { func (*ListActorTemplatesResponse) ProtoMessage() {} func (x *ListActorTemplatesResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[56] + mi := &file_ateapi_proto_msgTypes[57] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4714,7 +4784,7 @@ func (x *ListActorTemplatesResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ListActorTemplatesResponse.ProtoReflect.Descriptor instead. func (*ListActorTemplatesResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{56} + return file_ateapi_proto_rawDescGZIP(), []int{57} } func (x *ListActorTemplatesResponse) GetActorTemplates() []*ActorTemplate { @@ -4746,7 +4816,7 @@ type DeleteActorTemplateRequest struct { func (x *DeleteActorTemplateRequest) Reset() { *x = DeleteActorTemplateRequest{} - mi := &file_ateapi_proto_msgTypes[57] + mi := &file_ateapi_proto_msgTypes[58] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4758,7 +4828,7 @@ func (x *DeleteActorTemplateRequest) String() string { func (*DeleteActorTemplateRequest) ProtoMessage() {} func (x *DeleteActorTemplateRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[57] + mi := &file_ateapi_proto_msgTypes[58] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4771,7 +4841,7 @@ func (x *DeleteActorTemplateRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteActorTemplateRequest.ProtoReflect.Descriptor instead. func (*DeleteActorTemplateRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{57} + return file_ateapi_proto_rawDescGZIP(), []int{58} } func (x *DeleteActorTemplateRequest) GetActorTemplate() *ObjectRef { @@ -4799,7 +4869,7 @@ type GetActorRequest struct { func (x *GetActorRequest) Reset() { *x = GetActorRequest{} - mi := &file_ateapi_proto_msgTypes[58] + mi := &file_ateapi_proto_msgTypes[59] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4811,7 +4881,7 @@ func (x *GetActorRequest) String() string { func (*GetActorRequest) ProtoMessage() {} func (x *GetActorRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[58] + mi := &file_ateapi_proto_msgTypes[59] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4824,7 +4894,7 @@ func (x *GetActorRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetActorRequest.ProtoReflect.Descriptor instead. func (*GetActorRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{58} + return file_ateapi_proto_rawDescGZIP(), []int{59} } func (x *GetActorRequest) GetActor() *ObjectRef { @@ -4847,7 +4917,7 @@ type CreateActorRequest struct { func (x *CreateActorRequest) Reset() { *x = CreateActorRequest{} - mi := &file_ateapi_proto_msgTypes[59] + mi := &file_ateapi_proto_msgTypes[60] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4859,7 +4929,7 @@ func (x *CreateActorRequest) String() string { func (*CreateActorRequest) ProtoMessage() {} func (x *CreateActorRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[59] + mi := &file_ateapi_proto_msgTypes[60] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4872,7 +4942,7 @@ func (x *CreateActorRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use CreateActorRequest.ProtoReflect.Descriptor instead. func (*CreateActorRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{59} + return file_ateapi_proto_rawDescGZIP(), []int{60} } func (x *CreateActorRequest) GetActor() *Actor { @@ -4903,7 +4973,7 @@ type UpdateActorRequest struct { func (x *UpdateActorRequest) Reset() { *x = UpdateActorRequest{} - mi := &file_ateapi_proto_msgTypes[60] + mi := &file_ateapi_proto_msgTypes[61] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4915,7 +4985,7 @@ func (x *UpdateActorRequest) String() string { func (*UpdateActorRequest) ProtoMessage() {} func (x *UpdateActorRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[60] + mi := &file_ateapi_proto_msgTypes[61] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4928,7 +4998,7 @@ func (x *UpdateActorRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use UpdateActorRequest.ProtoReflect.Descriptor instead. func (*UpdateActorRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{60} + return file_ateapi_proto_rawDescGZIP(), []int{61} } func (x *UpdateActorRequest) GetActor() *Actor { @@ -4949,7 +5019,7 @@ type SuspendActorRequest struct { func (x *SuspendActorRequest) Reset() { *x = SuspendActorRequest{} - mi := &file_ateapi_proto_msgTypes[61] + mi := &file_ateapi_proto_msgTypes[62] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -4961,7 +5031,7 @@ func (x *SuspendActorRequest) String() string { func (*SuspendActorRequest) ProtoMessage() {} func (x *SuspendActorRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[61] + mi := &file_ateapi_proto_msgTypes[62] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -4974,7 +5044,7 @@ func (x *SuspendActorRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use SuspendActorRequest.ProtoReflect.Descriptor instead. func (*SuspendActorRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{61} + return file_ateapi_proto_rawDescGZIP(), []int{62} } func (x *SuspendActorRequest) GetActor() *ObjectRef { @@ -4993,7 +5063,7 @@ type SuspendActorResponse struct { func (x *SuspendActorResponse) Reset() { *x = SuspendActorResponse{} - mi := &file_ateapi_proto_msgTypes[62] + mi := &file_ateapi_proto_msgTypes[63] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5005,7 +5075,7 @@ func (x *SuspendActorResponse) String() string { func (*SuspendActorResponse) ProtoMessage() {} func (x *SuspendActorResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[62] + mi := &file_ateapi_proto_msgTypes[63] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5018,7 +5088,7 @@ func (x *SuspendActorResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use SuspendActorResponse.ProtoReflect.Descriptor instead. func (*SuspendActorResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{62} + return file_ateapi_proto_rawDescGZIP(), []int{63} } func (x *SuspendActorResponse) GetActor() *Actor { @@ -5039,7 +5109,7 @@ type PauseActorRequest struct { func (x *PauseActorRequest) Reset() { *x = PauseActorRequest{} - mi := &file_ateapi_proto_msgTypes[63] + mi := &file_ateapi_proto_msgTypes[64] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5051,7 +5121,7 @@ func (x *PauseActorRequest) String() string { func (*PauseActorRequest) ProtoMessage() {} func (x *PauseActorRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[63] + mi := &file_ateapi_proto_msgTypes[64] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5064,7 +5134,7 @@ func (x *PauseActorRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use PauseActorRequest.ProtoReflect.Descriptor instead. func (*PauseActorRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{63} + return file_ateapi_proto_rawDescGZIP(), []int{64} } func (x *PauseActorRequest) GetActor() *ObjectRef { @@ -5083,7 +5153,7 @@ type PauseActorResponse struct { func (x *PauseActorResponse) Reset() { *x = PauseActorResponse{} - mi := &file_ateapi_proto_msgTypes[64] + mi := &file_ateapi_proto_msgTypes[65] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5095,7 +5165,7 @@ func (x *PauseActorResponse) String() string { func (*PauseActorResponse) ProtoMessage() {} func (x *PauseActorResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[64] + mi := &file_ateapi_proto_msgTypes[65] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5108,7 +5178,7 @@ func (x *PauseActorResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use PauseActorResponse.ProtoReflect.Descriptor instead. func (*PauseActorResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{64} + return file_ateapi_proto_rawDescGZIP(), []int{65} } func (x *PauseActorResponse) GetActor() *Actor { @@ -5129,7 +5199,7 @@ type ResumeActorRequest struct { func (x *ResumeActorRequest) Reset() { *x = ResumeActorRequest{} - mi := &file_ateapi_proto_msgTypes[65] + mi := &file_ateapi_proto_msgTypes[66] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5141,7 +5211,7 @@ func (x *ResumeActorRequest) String() string { func (*ResumeActorRequest) ProtoMessage() {} func (x *ResumeActorRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[65] + mi := &file_ateapi_proto_msgTypes[66] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5154,7 +5224,7 @@ func (x *ResumeActorRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ResumeActorRequest.ProtoReflect.Descriptor instead. func (*ResumeActorRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{65} + return file_ateapi_proto_rawDescGZIP(), []int{66} } func (x *ResumeActorRequest) GetActor() *ObjectRef { @@ -5176,7 +5246,7 @@ type ResumeActorResponse struct { func (x *ResumeActorResponse) Reset() { *x = ResumeActorResponse{} - mi := &file_ateapi_proto_msgTypes[66] + mi := &file_ateapi_proto_msgTypes[67] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5188,7 +5258,7 @@ func (x *ResumeActorResponse) String() string { func (*ResumeActorResponse) ProtoMessage() {} func (x *ResumeActorResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[66] + mi := &file_ateapi_proto_msgTypes[67] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5201,7 +5271,7 @@ func (x *ResumeActorResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ResumeActorResponse.ProtoReflect.Descriptor instead. func (*ResumeActorResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{66} + return file_ateapi_proto_rawDescGZIP(), []int{67} } func (x *ResumeActorResponse) GetActor() *Actor { @@ -5231,7 +5301,7 @@ type RevertActorRequest struct { func (x *RevertActorRequest) Reset() { *x = RevertActorRequest{} - mi := &file_ateapi_proto_msgTypes[67] + mi := &file_ateapi_proto_msgTypes[68] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5243,7 +5313,7 @@ func (x *RevertActorRequest) String() string { func (*RevertActorRequest) ProtoMessage() {} func (x *RevertActorRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[67] + mi := &file_ateapi_proto_msgTypes[68] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5256,7 +5326,7 @@ func (x *RevertActorRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use RevertActorRequest.ProtoReflect.Descriptor instead. func (*RevertActorRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{67} + return file_ateapi_proto_rawDescGZIP(), []int{68} } func (x *RevertActorRequest) GetActor() *ObjectRef { @@ -5278,7 +5348,7 @@ type RevertActorResponse struct { func (x *RevertActorResponse) Reset() { *x = RevertActorResponse{} - mi := &file_ateapi_proto_msgTypes[68] + mi := &file_ateapi_proto_msgTypes[69] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5290,7 +5360,7 @@ func (x *RevertActorResponse) String() string { func (*RevertActorResponse) ProtoMessage() {} func (x *RevertActorResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[68] + mi := &file_ateapi_proto_msgTypes[69] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5303,7 +5373,7 @@ func (x *RevertActorResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use RevertActorResponse.ProtoReflect.Descriptor instead. func (*RevertActorResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{68} + return file_ateapi_proto_rawDescGZIP(), []int{69} } func (x *RevertActorResponse) GetActor() *Actor { @@ -5332,7 +5402,7 @@ type DeleteActorRequest struct { func (x *DeleteActorRequest) Reset() { *x = DeleteActorRequest{} - mi := &file_ateapi_proto_msgTypes[69] + mi := &file_ateapi_proto_msgTypes[70] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5344,7 +5414,7 @@ func (x *DeleteActorRequest) String() string { func (*DeleteActorRequest) ProtoMessage() {} func (x *DeleteActorRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[69] + mi := &file_ateapi_proto_msgTypes[70] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5357,7 +5427,7 @@ func (x *DeleteActorRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteActorRequest.ProtoReflect.Descriptor instead. func (*DeleteActorRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{69} + return file_ateapi_proto_rawDescGZIP(), []int{70} } func (x *DeleteActorRequest) GetActor() *ObjectRef { @@ -5395,7 +5465,7 @@ type GetActorEgressPolicyRequest struct { func (x *GetActorEgressPolicyRequest) Reset() { *x = GetActorEgressPolicyRequest{} - mi := &file_ateapi_proto_msgTypes[70] + mi := &file_ateapi_proto_msgTypes[71] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5407,7 +5477,7 @@ func (x *GetActorEgressPolicyRequest) String() string { func (*GetActorEgressPolicyRequest) ProtoMessage() {} func (x *GetActorEgressPolicyRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[70] + mi := &file_ateapi_proto_msgTypes[71] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5420,7 +5490,7 @@ func (x *GetActorEgressPolicyRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetActorEgressPolicyRequest.ProtoReflect.Descriptor instead. func (*GetActorEgressPolicyRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{70} + return file_ateapi_proto_rawDescGZIP(), []int{71} } func (x *GetActorEgressPolicyRequest) GetActor() *ObjectRef { @@ -5451,7 +5521,7 @@ type CreateActorEgressPolicyRequest struct { func (x *CreateActorEgressPolicyRequest) Reset() { *x = CreateActorEgressPolicyRequest{} - mi := &file_ateapi_proto_msgTypes[71] + mi := &file_ateapi_proto_msgTypes[72] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5463,7 +5533,7 @@ func (x *CreateActorEgressPolicyRequest) String() string { func (*CreateActorEgressPolicyRequest) ProtoMessage() {} func (x *CreateActorEgressPolicyRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[71] + mi := &file_ateapi_proto_msgTypes[72] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5476,7 +5546,7 @@ func (x *CreateActorEgressPolicyRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use CreateActorEgressPolicyRequest.ProtoReflect.Descriptor instead. func (*CreateActorEgressPolicyRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{71} + return file_ateapi_proto_rawDescGZIP(), []int{72} } func (x *CreateActorEgressPolicyRequest) GetActor() *ObjectRef { @@ -5514,7 +5584,7 @@ type UpdateActorEgressPolicyRequest struct { func (x *UpdateActorEgressPolicyRequest) Reset() { *x = UpdateActorEgressPolicyRequest{} - mi := &file_ateapi_proto_msgTypes[72] + mi := &file_ateapi_proto_msgTypes[73] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5526,7 +5596,7 @@ func (x *UpdateActorEgressPolicyRequest) String() string { func (*UpdateActorEgressPolicyRequest) ProtoMessage() {} func (x *UpdateActorEgressPolicyRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[72] + mi := &file_ateapi_proto_msgTypes[73] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5539,7 +5609,7 @@ func (x *UpdateActorEgressPolicyRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use UpdateActorEgressPolicyRequest.ProtoReflect.Descriptor instead. func (*UpdateActorEgressPolicyRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{72} + return file_ateapi_proto_rawDescGZIP(), []int{73} } func (x *UpdateActorEgressPolicyRequest) GetActor() *ObjectRef { @@ -5574,7 +5644,7 @@ type DeleteActorEgressPolicyRequest struct { func (x *DeleteActorEgressPolicyRequest) Reset() { *x = DeleteActorEgressPolicyRequest{} - mi := &file_ateapi_proto_msgTypes[73] + mi := &file_ateapi_proto_msgTypes[74] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5586,7 +5656,7 @@ func (x *DeleteActorEgressPolicyRequest) String() string { func (*DeleteActorEgressPolicyRequest) ProtoMessage() {} func (x *DeleteActorEgressPolicyRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[73] + mi := &file_ateapi_proto_msgTypes[74] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5599,7 +5669,7 @@ func (x *DeleteActorEgressPolicyRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteActorEgressPolicyRequest.ProtoReflect.Descriptor instead. func (*DeleteActorEgressPolicyRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{73} + return file_ateapi_proto_rawDescGZIP(), []int{74} } func (x *DeleteActorEgressPolicyRequest) GetActor() *ObjectRef { @@ -5627,7 +5697,7 @@ type GetTagRequest struct { func (x *GetTagRequest) Reset() { *x = GetTagRequest{} - mi := &file_ateapi_proto_msgTypes[74] + mi := &file_ateapi_proto_msgTypes[75] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5639,7 +5709,7 @@ func (x *GetTagRequest) String() string { func (*GetTagRequest) ProtoMessage() {} func (x *GetTagRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[74] + mi := &file_ateapi_proto_msgTypes[75] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5652,7 +5722,7 @@ func (x *GetTagRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetTagRequest.ProtoReflect.Descriptor instead. func (*GetTagRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{74} + return file_ateapi_proto_rawDescGZIP(), []int{75} } func (x *GetTagRequest) GetTag() *ObjectRef { @@ -5691,7 +5761,7 @@ type MintActorJWTRequest struct { func (x *MintActorJWTRequest) Reset() { *x = MintActorJWTRequest{} - mi := &file_ateapi_proto_msgTypes[75] + mi := &file_ateapi_proto_msgTypes[76] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5703,7 +5773,7 @@ func (x *MintActorJWTRequest) String() string { func (*MintActorJWTRequest) ProtoMessage() {} func (x *MintActorJWTRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[75] + mi := &file_ateapi_proto_msgTypes[76] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5716,7 +5786,7 @@ func (x *MintActorJWTRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use MintActorJWTRequest.ProtoReflect.Descriptor instead. func (*MintActorJWTRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{75} + return file_ateapi_proto_rawDescGZIP(), []int{76} } func (x *MintActorJWTRequest) GetActor() *ObjectRef { @@ -5766,7 +5836,7 @@ type MintActorJWTResponse struct { func (x *MintActorJWTResponse) Reset() { *x = MintActorJWTResponse{} - mi := &file_ateapi_proto_msgTypes[76] + mi := &file_ateapi_proto_msgTypes[77] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5778,7 +5848,7 @@ func (x *MintActorJWTResponse) String() string { func (*MintActorJWTResponse) ProtoMessage() {} func (x *MintActorJWTResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[76] + mi := &file_ateapi_proto_msgTypes[77] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5791,7 +5861,7 @@ func (x *MintActorJWTResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use MintActorJWTResponse.ProtoReflect.Descriptor instead. func (*MintActorJWTResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{76} + return file_ateapi_proto_rawDescGZIP(), []int{77} } func (x *MintActorJWTResponse) GetActorJwt() string { @@ -5836,7 +5906,7 @@ type MintActorCertificateRequest struct { func (x *MintActorCertificateRequest) Reset() { *x = MintActorCertificateRequest{} - mi := &file_ateapi_proto_msgTypes[77] + mi := &file_ateapi_proto_msgTypes[78] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5848,7 +5918,7 @@ func (x *MintActorCertificateRequest) String() string { func (*MintActorCertificateRequest) ProtoMessage() {} func (x *MintActorCertificateRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[77] + mi := &file_ateapi_proto_msgTypes[78] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5861,7 +5931,7 @@ func (x *MintActorCertificateRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use MintActorCertificateRequest.ProtoReflect.Descriptor instead. func (*MintActorCertificateRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{77} + return file_ateapi_proto_rawDescGZIP(), []int{78} } func (x *MintActorCertificateRequest) GetActor() *ObjectRef { @@ -5898,7 +5968,7 @@ type MintActorCertificateResponse struct { func (x *MintActorCertificateResponse) Reset() { *x = MintActorCertificateResponse{} - mi := &file_ateapi_proto_msgTypes[78] + mi := &file_ateapi_proto_msgTypes[79] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5910,7 +5980,7 @@ func (x *MintActorCertificateResponse) String() string { func (*MintActorCertificateResponse) ProtoMessage() {} func (x *MintActorCertificateResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[78] + mi := &file_ateapi_proto_msgTypes[79] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5923,7 +5993,7 @@ func (x *MintActorCertificateResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use MintActorCertificateResponse.ProtoReflect.Descriptor instead. func (*MintActorCertificateResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{78} + return file_ateapi_proto_rawDescGZIP(), []int{79} } func (x *MintActorCertificateResponse) GetActorCertificates() [][]byte { @@ -5959,7 +6029,7 @@ type ListTagsRequest struct { func (x *ListTagsRequest) Reset() { *x = ListTagsRequest{} - mi := &file_ateapi_proto_msgTypes[79] + mi := &file_ateapi_proto_msgTypes[80] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -5971,7 +6041,7 @@ func (x *ListTagsRequest) String() string { func (*ListTagsRequest) ProtoMessage() {} func (x *ListTagsRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[79] + mi := &file_ateapi_proto_msgTypes[80] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -5984,7 +6054,7 @@ func (x *ListTagsRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ListTagsRequest.ProtoReflect.Descriptor instead. func (*ListTagsRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{79} + return file_ateapi_proto_rawDescGZIP(), []int{80} } func (x *ListTagsRequest) GetAtespace() string { @@ -6018,7 +6088,7 @@ type ListTagsResponse struct { func (x *ListTagsResponse) Reset() { *x = ListTagsResponse{} - mi := &file_ateapi_proto_msgTypes[80] + mi := &file_ateapi_proto_msgTypes[81] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -6030,7 +6100,7 @@ func (x *ListTagsResponse) String() string { func (*ListTagsResponse) ProtoMessage() {} func (x *ListTagsResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[80] + mi := &file_ateapi_proto_msgTypes[81] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -6043,7 +6113,7 @@ func (x *ListTagsResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ListTagsResponse.ProtoReflect.Descriptor instead. func (*ListTagsResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{80} + return file_ateapi_proto_rawDescGZIP(), []int{81} } func (x *ListTagsResponse) GetTags() []*Tag { @@ -6088,7 +6158,7 @@ type CreateTagRequest struct { func (x *CreateTagRequest) Reset() { *x = CreateTagRequest{} - mi := &file_ateapi_proto_msgTypes[81] + mi := &file_ateapi_proto_msgTypes[82] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -6100,7 +6170,7 @@ func (x *CreateTagRequest) String() string { func (*CreateTagRequest) ProtoMessage() {} func (x *CreateTagRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[81] + mi := &file_ateapi_proto_msgTypes[82] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -6113,7 +6183,7 @@ func (x *CreateTagRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use CreateTagRequest.ProtoReflect.Descriptor instead. func (*CreateTagRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{81} + return file_ateapi_proto_rawDescGZIP(), []int{82} } func (x *CreateTagRequest) GetTag() *Tag { @@ -6143,7 +6213,7 @@ type UpdateTagRequest struct { func (x *UpdateTagRequest) Reset() { *x = UpdateTagRequest{} - mi := &file_ateapi_proto_msgTypes[82] + mi := &file_ateapi_proto_msgTypes[83] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -6155,7 +6225,7 @@ func (x *UpdateTagRequest) String() string { func (*UpdateTagRequest) ProtoMessage() {} func (x *UpdateTagRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[82] + mi := &file_ateapi_proto_msgTypes[83] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -6168,7 +6238,7 @@ func (x *UpdateTagRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use UpdateTagRequest.ProtoReflect.Descriptor instead. func (*UpdateTagRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{82} + return file_ateapi_proto_rawDescGZIP(), []int{83} } func (x *UpdateTagRequest) GetTag() *Tag { @@ -6193,7 +6263,7 @@ type DeleteTagRequest struct { func (x *DeleteTagRequest) Reset() { *x = DeleteTagRequest{} - mi := &file_ateapi_proto_msgTypes[83] + mi := &file_ateapi_proto_msgTypes[84] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -6205,7 +6275,7 @@ func (x *DeleteTagRequest) String() string { func (*DeleteTagRequest) ProtoMessage() {} func (x *DeleteTagRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[83] + mi := &file_ateapi_proto_msgTypes[84] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -6218,7 +6288,7 @@ func (x *DeleteTagRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteTagRequest.ProtoReflect.Descriptor instead. func (*DeleteTagRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{83} + return file_ateapi_proto_rawDescGZIP(), []int{84} } func (x *DeleteTagRequest) GetTag() *ObjectRef { @@ -6257,7 +6327,7 @@ type DeleteOptions struct { func (x *DeleteOptions) Reset() { *x = DeleteOptions{} - mi := &file_ateapi_proto_msgTypes[84] + mi := &file_ateapi_proto_msgTypes[85] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -6269,7 +6339,7 @@ func (x *DeleteOptions) String() string { func (*DeleteOptions) ProtoMessage() {} func (x *DeleteOptions) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[84] + mi := &file_ateapi_proto_msgTypes[85] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -6282,7 +6352,7 @@ func (x *DeleteOptions) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteOptions.ProtoReflect.Descriptor instead. func (*DeleteOptions) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{84} + return file_ateapi_proto_rawDescGZIP(), []int{85} } func (x *DeleteOptions) GetVersion() int64 { @@ -6326,7 +6396,7 @@ type ListWorkerActorAssignmentsRequest struct { func (x *ListWorkerActorAssignmentsRequest) Reset() { *x = ListWorkerActorAssignmentsRequest{} - mi := &file_ateapi_proto_msgTypes[85] + mi := &file_ateapi_proto_msgTypes[86] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -6338,7 +6408,7 @@ func (x *ListWorkerActorAssignmentsRequest) String() string { func (*ListWorkerActorAssignmentsRequest) ProtoMessage() {} func (x *ListWorkerActorAssignmentsRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[85] + mi := &file_ateapi_proto_msgTypes[86] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -6351,7 +6421,7 @@ func (x *ListWorkerActorAssignmentsRequest) ProtoReflect() protoreflect.Message // Deprecated: Use ListWorkerActorAssignmentsRequest.ProtoReflect.Descriptor instead. func (*ListWorkerActorAssignmentsRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{85} + return file_ateapi_proto_rawDescGZIP(), []int{86} } func (x *ListWorkerActorAssignmentsRequest) GetWorker() *ObjectRef { @@ -6388,7 +6458,7 @@ type ListWorkerActorAssignmentsResponse struct { func (x *ListWorkerActorAssignmentsResponse) Reset() { *x = ListWorkerActorAssignmentsResponse{} - mi := &file_ateapi_proto_msgTypes[86] + mi := &file_ateapi_proto_msgTypes[87] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -6400,7 +6470,7 @@ func (x *ListWorkerActorAssignmentsResponse) String() string { func (*ListWorkerActorAssignmentsResponse) ProtoMessage() {} func (x *ListWorkerActorAssignmentsResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[86] + mi := &file_ateapi_proto_msgTypes[87] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -6413,7 +6483,7 @@ func (x *ListWorkerActorAssignmentsResponse) ProtoReflect() protoreflect.Message // Deprecated: Use ListWorkerActorAssignmentsResponse.ProtoReflect.Descriptor instead. func (*ListWorkerActorAssignmentsResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{86} + return file_ateapi_proto_rawDescGZIP(), []int{87} } func (x *ListWorkerActorAssignmentsResponse) GetActorAssignments() []*ActorAssignment { @@ -6451,7 +6521,7 @@ type ListWorkersRequest struct { func (x *ListWorkersRequest) Reset() { *x = ListWorkersRequest{} - mi := &file_ateapi_proto_msgTypes[87] + mi := &file_ateapi_proto_msgTypes[88] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -6463,7 +6533,7 @@ func (x *ListWorkersRequest) String() string { func (*ListWorkersRequest) ProtoMessage() {} func (x *ListWorkersRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[87] + mi := &file_ateapi_proto_msgTypes[88] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -6476,7 +6546,7 @@ func (x *ListWorkersRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ListWorkersRequest.ProtoReflect.Descriptor instead. func (*ListWorkersRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{87} + return file_ateapi_proto_rawDescGZIP(), []int{88} } func (x *ListWorkersRequest) GetPageSize() int32 { @@ -6505,7 +6575,7 @@ type ListWorkersResponse struct { func (x *ListWorkersResponse) Reset() { *x = ListWorkersResponse{} - mi := &file_ateapi_proto_msgTypes[88] + mi := &file_ateapi_proto_msgTypes[89] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -6517,7 +6587,7 @@ func (x *ListWorkersResponse) String() string { func (*ListWorkersResponse) ProtoMessage() {} func (x *ListWorkersResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[88] + mi := &file_ateapi_proto_msgTypes[89] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -6530,7 +6600,7 @@ func (x *ListWorkersResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ListWorkersResponse.ProtoReflect.Descriptor instead. func (*ListWorkersResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{88} + return file_ateapi_proto_rawDescGZIP(), []int{89} } func (x *ListWorkersResponse) GetWorkers() []*Worker { @@ -6560,7 +6630,7 @@ type GetWorkerRequest struct { func (x *GetWorkerRequest) Reset() { *x = GetWorkerRequest{} - mi := &file_ateapi_proto_msgTypes[89] + mi := &file_ateapi_proto_msgTypes[90] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -6572,7 +6642,7 @@ func (x *GetWorkerRequest) String() string { func (*GetWorkerRequest) ProtoMessage() {} func (x *GetWorkerRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[89] + mi := &file_ateapi_proto_msgTypes[90] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -6585,7 +6655,7 @@ func (x *GetWorkerRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetWorkerRequest.ProtoReflect.Descriptor instead. func (*GetWorkerRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{89} + return file_ateapi_proto_rawDescGZIP(), []int{90} } func (x *GetWorkerRequest) GetWorker() *ObjectRef { @@ -6607,7 +6677,7 @@ type CreateWorkerRequest struct { func (x *CreateWorkerRequest) Reset() { *x = CreateWorkerRequest{} - mi := &file_ateapi_proto_msgTypes[90] + mi := &file_ateapi_proto_msgTypes[91] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -6619,7 +6689,7 @@ func (x *CreateWorkerRequest) String() string { func (*CreateWorkerRequest) ProtoMessage() {} func (x *CreateWorkerRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[90] + mi := &file_ateapi_proto_msgTypes[91] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -6632,7 +6702,7 @@ func (x *CreateWorkerRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use CreateWorkerRequest.ProtoReflect.Descriptor instead. func (*CreateWorkerRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{90} + return file_ateapi_proto_rawDescGZIP(), []int{91} } func (x *CreateWorkerRequest) GetWorker() *Worker { @@ -6667,7 +6737,7 @@ type UpdateWorkerRequest struct { func (x *UpdateWorkerRequest) Reset() { *x = UpdateWorkerRequest{} - mi := &file_ateapi_proto_msgTypes[91] + mi := &file_ateapi_proto_msgTypes[92] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -6679,7 +6749,7 @@ func (x *UpdateWorkerRequest) String() string { func (*UpdateWorkerRequest) ProtoMessage() {} func (x *UpdateWorkerRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[91] + mi := &file_ateapi_proto_msgTypes[92] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -6692,7 +6762,7 @@ func (x *UpdateWorkerRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use UpdateWorkerRequest.ProtoReflect.Descriptor instead. func (*UpdateWorkerRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{91} + return file_ateapi_proto_rawDescGZIP(), []int{92} } func (x *UpdateWorkerRequest) GetWorker() *Worker { @@ -6719,7 +6789,7 @@ type DeleteWorkerRequest struct { func (x *DeleteWorkerRequest) Reset() { *x = DeleteWorkerRequest{} - mi := &file_ateapi_proto_msgTypes[92] + mi := &file_ateapi_proto_msgTypes[93] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -6731,7 +6801,7 @@ func (x *DeleteWorkerRequest) String() string { func (*DeleteWorkerRequest) ProtoMessage() {} func (x *DeleteWorkerRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[92] + mi := &file_ateapi_proto_msgTypes[93] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -6744,7 +6814,7 @@ func (x *DeleteWorkerRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DeleteWorkerRequest.ProtoReflect.Descriptor instead. func (*DeleteWorkerRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{92} + return file_ateapi_proto_rawDescGZIP(), []int{93} } func (x *DeleteWorkerRequest) GetWorker() *ObjectRef { @@ -6774,7 +6844,7 @@ type DrainWorkerRequest struct { func (x *DrainWorkerRequest) Reset() { *x = DrainWorkerRequest{} - mi := &file_ateapi_proto_msgTypes[93] + mi := &file_ateapi_proto_msgTypes[94] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -6786,7 +6856,7 @@ func (x *DrainWorkerRequest) String() string { func (*DrainWorkerRequest) ProtoMessage() {} func (x *DrainWorkerRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[93] + mi := &file_ateapi_proto_msgTypes[94] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -6799,7 +6869,7 @@ func (x *DrainWorkerRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use DrainWorkerRequest.ProtoReflect.Descriptor instead. func (*DrainWorkerRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{93} + return file_ateapi_proto_rawDescGZIP(), []int{94} } func (x *DrainWorkerRequest) GetWorker() *ObjectRef { @@ -6837,7 +6907,7 @@ type ListActorsRequest struct { func (x *ListActorsRequest) Reset() { *x = ListActorsRequest{} - mi := &file_ateapi_proto_msgTypes[94] + mi := &file_ateapi_proto_msgTypes[95] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -6849,7 +6919,7 @@ func (x *ListActorsRequest) String() string { func (*ListActorsRequest) ProtoMessage() {} func (x *ListActorsRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[94] + mi := &file_ateapi_proto_msgTypes[95] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -6862,7 +6932,7 @@ func (x *ListActorsRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use ListActorsRequest.ProtoReflect.Descriptor instead. func (*ListActorsRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{94} + return file_ateapi_proto_rawDescGZIP(), []int{95} } func (x *ListActorsRequest) GetAtespace() string { @@ -6898,7 +6968,7 @@ type ListActorsResponse struct { func (x *ListActorsResponse) Reset() { *x = ListActorsResponse{} - mi := &file_ateapi_proto_msgTypes[95] + mi := &file_ateapi_proto_msgTypes[96] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -6910,7 +6980,7 @@ func (x *ListActorsResponse) String() string { func (*ListActorsResponse) ProtoMessage() {} func (x *ListActorsResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[95] + mi := &file_ateapi_proto_msgTypes[96] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -6923,7 +6993,7 @@ func (x *ListActorsResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use ListActorsResponse.ProtoReflect.Descriptor instead. func (*ListActorsResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{95} + return file_ateapi_proto_rawDescGZIP(), []int{96} } func (x *ListActorsResponse) GetActors() []*Actor { @@ -7030,7 +7100,7 @@ type Worker struct { func (x *Worker) Reset() { *x = Worker{} - mi := &file_ateapi_proto_msgTypes[96] + mi := &file_ateapi_proto_msgTypes[97] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -7042,7 +7112,7 @@ func (x *Worker) String() string { func (*Worker) ProtoMessage() {} func (x *Worker) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[96] + mi := &file_ateapi_proto_msgTypes[97] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -7055,7 +7125,7 @@ func (x *Worker) ProtoReflect() protoreflect.Message { // Deprecated: Use Worker.ProtoReflect.Descriptor instead. func (*Worker) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{96} + return file_ateapi_proto_rawDescGZIP(), []int{97} } func (x *Worker) GetMetadata() *ResourceMetadata { @@ -7184,7 +7254,7 @@ type WorkerStatus struct { func (x *WorkerStatus) Reset() { *x = WorkerStatus{} - mi := &file_ateapi_proto_msgTypes[97] + mi := &file_ateapi_proto_msgTypes[98] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -7196,7 +7266,7 @@ func (x *WorkerStatus) String() string { func (*WorkerStatus) ProtoMessage() {} func (x *WorkerStatus) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[97] + mi := &file_ateapi_proto_msgTypes[98] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -7209,7 +7279,7 @@ func (x *WorkerStatus) ProtoReflect() protoreflect.Message { // Deprecated: Use WorkerStatus.ProtoReflect.Descriptor instead. func (*WorkerStatus) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{97} + return file_ateapi_proto_rawDescGZIP(), []int{98} } func (x *WorkerStatus) GetState() WorkerState { @@ -7276,7 +7346,7 @@ type SandboxRuntime struct { func (x *SandboxRuntime) Reset() { *x = SandboxRuntime{} - mi := &file_ateapi_proto_msgTypes[98] + mi := &file_ateapi_proto_msgTypes[99] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -7288,7 +7358,7 @@ func (x *SandboxRuntime) String() string { func (*SandboxRuntime) ProtoMessage() {} func (x *SandboxRuntime) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[98] + mi := &file_ateapi_proto_msgTypes[99] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -7301,7 +7371,7 @@ func (x *SandboxRuntime) ProtoReflect() protoreflect.Message { // Deprecated: Use SandboxRuntime.ProtoReflect.Descriptor instead. func (*SandboxRuntime) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{98} + return file_ateapi_proto_rawDescGZIP(), []int{99} } func (x *SandboxRuntime) GetSandboxClass() string { @@ -7349,7 +7419,7 @@ type VersionedSandboxCompat struct { func (x *VersionedSandboxCompat) Reset() { *x = VersionedSandboxCompat{} - mi := &file_ateapi_proto_msgTypes[99] + mi := &file_ateapi_proto_msgTypes[100] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -7361,7 +7431,7 @@ func (x *VersionedSandboxCompat) String() string { func (*VersionedSandboxCompat) ProtoMessage() {} func (x *VersionedSandboxCompat) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[99] + mi := &file_ateapi_proto_msgTypes[100] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -7374,7 +7444,7 @@ func (x *VersionedSandboxCompat) ProtoReflect() protoreflect.Message { // Deprecated: Use VersionedSandboxCompat.ProtoReflect.Descriptor instead. func (*VersionedSandboxCompat) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{99} + return file_ateapi_proto_rawDescGZIP(), []int{100} } func (x *VersionedSandboxCompat) GetSchemaVersion() string { @@ -7410,7 +7480,7 @@ type AttributeEntry struct { func (x *AttributeEntry) Reset() { *x = AttributeEntry{} - mi := &file_ateapi_proto_msgTypes[100] + mi := &file_ateapi_proto_msgTypes[101] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -7422,7 +7492,7 @@ func (x *AttributeEntry) String() string { func (*AttributeEntry) ProtoMessage() {} func (x *AttributeEntry) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[100] + mi := &file_ateapi_proto_msgTypes[101] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -7435,7 +7505,7 @@ func (x *AttributeEntry) ProtoReflect() protoreflect.Message { // Deprecated: Use AttributeEntry.ProtoReflect.Descriptor instead. func (*AttributeEntry) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{100} + return file_ateapi_proto_rawDescGZIP(), []int{101} } func (x *AttributeEntry) GetKey() string { @@ -7474,7 +7544,7 @@ type WorkerResources struct { func (x *WorkerResources) Reset() { *x = WorkerResources{} - mi := &file_ateapi_proto_msgTypes[101] + mi := &file_ateapi_proto_msgTypes[102] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -7486,7 +7556,7 @@ func (x *WorkerResources) String() string { func (*WorkerResources) ProtoMessage() {} func (x *WorkerResources) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[101] + mi := &file_ateapi_proto_msgTypes[102] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -7499,7 +7569,7 @@ func (x *WorkerResources) ProtoReflect() protoreflect.Message { // Deprecated: Use WorkerResources.ProtoReflect.Descriptor instead. func (*WorkerResources) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{101} + return file_ateapi_proto_rawDescGZIP(), []int{102} } func (x *WorkerResources) GetResources() *Resources { @@ -7552,7 +7622,7 @@ type ActorAssignment struct { func (x *ActorAssignment) Reset() { *x = ActorAssignment{} - mi := &file_ateapi_proto_msgTypes[102] + mi := &file_ateapi_proto_msgTypes[103] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -7564,7 +7634,7 @@ func (x *ActorAssignment) String() string { func (*ActorAssignment) ProtoMessage() {} func (x *ActorAssignment) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[102] + mi := &file_ateapi_proto_msgTypes[103] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -7577,7 +7647,7 @@ func (x *ActorAssignment) ProtoReflect() protoreflect.Message { // Deprecated: Use ActorAssignment.ProtoReflect.Descriptor instead. func (*ActorAssignment) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{102} + return file_ateapi_proto_rawDescGZIP(), []int{103} } func (x *ActorAssignment) GetMetadata() *ResourceMetadata { @@ -7648,7 +7718,7 @@ type RegisterWorkerRequest struct { func (x *RegisterWorkerRequest) Reset() { *x = RegisterWorkerRequest{} - mi := &file_ateapi_proto_msgTypes[103] + mi := &file_ateapi_proto_msgTypes[104] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -7660,7 +7730,7 @@ func (x *RegisterWorkerRequest) String() string { func (*RegisterWorkerRequest) ProtoMessage() {} func (x *RegisterWorkerRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[103] + mi := &file_ateapi_proto_msgTypes[104] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -7673,7 +7743,7 @@ func (x *RegisterWorkerRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use RegisterWorkerRequest.ProtoReflect.Descriptor instead. func (*RegisterWorkerRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{103} + return file_ateapi_proto_rawDescGZIP(), []int{104} } func (x *RegisterWorkerRequest) GetWorker() *ObjectRef { @@ -7714,7 +7784,7 @@ type RegisterWorkerResponse struct { func (x *RegisterWorkerResponse) Reset() { *x = RegisterWorkerResponse{} - mi := &file_ateapi_proto_msgTypes[104] + mi := &file_ateapi_proto_msgTypes[105] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -7726,7 +7796,7 @@ func (x *RegisterWorkerResponse) String() string { func (*RegisterWorkerResponse) ProtoMessage() {} func (x *RegisterWorkerResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[104] + mi := &file_ateapi_proto_msgTypes[105] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -7739,7 +7809,7 @@ func (x *RegisterWorkerResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use RegisterWorkerResponse.ProtoReflect.Descriptor instead. func (*RegisterWorkerResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{104} + return file_ateapi_proto_rawDescGZIP(), []int{105} } func (x *RegisterWorkerResponse) GetWorker() *Worker { @@ -7778,7 +7848,7 @@ type MintAteomActorCertificateRequest struct { func (x *MintAteomActorCertificateRequest) Reset() { *x = MintAteomActorCertificateRequest{} - mi := &file_ateapi_proto_msgTypes[105] + mi := &file_ateapi_proto_msgTypes[106] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -7790,7 +7860,7 @@ func (x *MintAteomActorCertificateRequest) String() string { func (*MintAteomActorCertificateRequest) ProtoMessage() {} func (x *MintAteomActorCertificateRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[105] + mi := &file_ateapi_proto_msgTypes[106] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -7803,7 +7873,7 @@ func (x *MintAteomActorCertificateRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use MintAteomActorCertificateRequest.ProtoReflect.Descriptor instead. func (*MintAteomActorCertificateRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{105} + return file_ateapi_proto_rawDescGZIP(), []int{106} } func (x *MintAteomActorCertificateRequest) GetActor() *ObjectRef { @@ -7840,7 +7910,7 @@ type MintAteomActorCertificateResponse struct { func (x *MintAteomActorCertificateResponse) Reset() { *x = MintAteomActorCertificateResponse{} - mi := &file_ateapi_proto_msgTypes[106] + mi := &file_ateapi_proto_msgTypes[107] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -7852,7 +7922,7 @@ func (x *MintAteomActorCertificateResponse) String() string { func (*MintAteomActorCertificateResponse) ProtoMessage() {} func (x *MintAteomActorCertificateResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[106] + mi := &file_ateapi_proto_msgTypes[107] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -7865,7 +7935,7 @@ func (x *MintAteomActorCertificateResponse) ProtoReflect() protoreflect.Message // Deprecated: Use MintAteomActorCertificateResponse.ProtoReflect.Descriptor instead. func (*MintAteomActorCertificateResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{106} + return file_ateapi_proto_rawDescGZIP(), []int{107} } func (x *MintAteomActorCertificateResponse) GetActorCertificates() [][]byte { @@ -7903,7 +7973,7 @@ type RequestActorSuspendRequest struct { func (x *RequestActorSuspendRequest) Reset() { *x = RequestActorSuspendRequest{} - mi := &file_ateapi_proto_msgTypes[107] + mi := &file_ateapi_proto_msgTypes[108] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -7915,7 +7985,7 @@ func (x *RequestActorSuspendRequest) String() string { func (*RequestActorSuspendRequest) ProtoMessage() {} func (x *RequestActorSuspendRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[107] + mi := &file_ateapi_proto_msgTypes[108] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -7928,7 +7998,7 @@ func (x *RequestActorSuspendRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use RequestActorSuspendRequest.ProtoReflect.Descriptor instead. func (*RequestActorSuspendRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{107} + return file_ateapi_proto_rawDescGZIP(), []int{108} } func (x *RequestActorSuspendRequest) GetWorker() *ObjectRef { @@ -7962,7 +8032,7 @@ type RequestActorSuspendResponse struct { func (x *RequestActorSuspendResponse) Reset() { *x = RequestActorSuspendResponse{} - mi := &file_ateapi_proto_msgTypes[108] + mi := &file_ateapi_proto_msgTypes[109] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -7974,7 +8044,7 @@ func (x *RequestActorSuspendResponse) String() string { func (*RequestActorSuspendResponse) ProtoMessage() {} func (x *RequestActorSuspendResponse) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[108] + mi := &file_ateapi_proto_msgTypes[109] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -7987,7 +8057,7 @@ func (x *RequestActorSuspendResponse) ProtoReflect() protoreflect.Message { // Deprecated: Use RequestActorSuspendResponse.ProtoReflect.Descriptor instead. func (*RequestActorSuspendResponse) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{108} + return file_ateapi_proto_rawDescGZIP(), []int{109} } func (x *RequestActorSuspendResponse) GetActor() *Actor { @@ -8022,7 +8092,7 @@ type AccessPolicy struct { func (x *AccessPolicy) Reset() { *x = AccessPolicy{} - mi := &file_ateapi_proto_msgTypes[109] + mi := &file_ateapi_proto_msgTypes[110] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -8034,7 +8104,7 @@ func (x *AccessPolicy) String() string { func (*AccessPolicy) ProtoMessage() {} func (x *AccessPolicy) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[109] + mi := &file_ateapi_proto_msgTypes[110] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -8047,7 +8117,7 @@ func (x *AccessPolicy) ProtoReflect() protoreflect.Message { // Deprecated: Use AccessPolicy.ProtoReflect.Descriptor instead. func (*AccessPolicy) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{109} + return file_ateapi_proto_rawDescGZIP(), []int{110} } func (x *AccessPolicy) GetMetadata() *ResourceMetadata { @@ -8089,7 +8159,7 @@ type Binding struct { func (x *Binding) Reset() { *x = Binding{} - mi := &file_ateapi_proto_msgTypes[110] + mi := &file_ateapi_proto_msgTypes[111] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -8101,7 +8171,7 @@ func (x *Binding) String() string { func (*Binding) ProtoMessage() {} func (x *Binding) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[110] + mi := &file_ateapi_proto_msgTypes[111] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -8114,7 +8184,7 @@ func (x *Binding) ProtoReflect() protoreflect.Message { // Deprecated: Use Binding.ProtoReflect.Descriptor instead. func (*Binding) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{110} + return file_ateapi_proto_rawDescGZIP(), []int{111} } func (x *Binding) GetRole() string { @@ -8140,7 +8210,7 @@ type GetGlobalAccessPolicyRequest struct { func (x *GetGlobalAccessPolicyRequest) Reset() { *x = GetGlobalAccessPolicyRequest{} - mi := &file_ateapi_proto_msgTypes[111] + mi := &file_ateapi_proto_msgTypes[112] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -8152,7 +8222,7 @@ func (x *GetGlobalAccessPolicyRequest) String() string { func (*GetGlobalAccessPolicyRequest) ProtoMessage() {} func (x *GetGlobalAccessPolicyRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[111] + mi := &file_ateapi_proto_msgTypes[112] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -8165,7 +8235,7 @@ func (x *GetGlobalAccessPolicyRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetGlobalAccessPolicyRequest.ProtoReflect.Descriptor instead. func (*GetGlobalAccessPolicyRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{111} + return file_ateapi_proto_rawDescGZIP(), []int{112} } // CreateGlobalAccessPolicyRequest creates the deployment-wide global access policy singleton. @@ -8182,7 +8252,7 @@ type CreateGlobalAccessPolicyRequest struct { func (x *CreateGlobalAccessPolicyRequest) Reset() { *x = CreateGlobalAccessPolicyRequest{} - mi := &file_ateapi_proto_msgTypes[112] + mi := &file_ateapi_proto_msgTypes[113] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -8194,7 +8264,7 @@ func (x *CreateGlobalAccessPolicyRequest) String() string { func (*CreateGlobalAccessPolicyRequest) ProtoMessage() {} func (x *CreateGlobalAccessPolicyRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[112] + mi := &file_ateapi_proto_msgTypes[113] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -8207,7 +8277,7 @@ func (x *CreateGlobalAccessPolicyRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use CreateGlobalAccessPolicyRequest.ProtoReflect.Descriptor instead. func (*CreateGlobalAccessPolicyRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{112} + return file_ateapi_proto_rawDescGZIP(), []int{113} } func (x *CreateGlobalAccessPolicyRequest) GetAccessPolicy() *AccessPolicy { @@ -8231,7 +8301,7 @@ type UpdateGlobalAccessPolicyRequest struct { func (x *UpdateGlobalAccessPolicyRequest) Reset() { *x = UpdateGlobalAccessPolicyRequest{} - mi := &file_ateapi_proto_msgTypes[113] + mi := &file_ateapi_proto_msgTypes[114] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -8243,7 +8313,7 @@ func (x *UpdateGlobalAccessPolicyRequest) String() string { func (*UpdateGlobalAccessPolicyRequest) ProtoMessage() {} func (x *UpdateGlobalAccessPolicyRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[113] + mi := &file_ateapi_proto_msgTypes[114] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -8256,7 +8326,7 @@ func (x *UpdateGlobalAccessPolicyRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use UpdateGlobalAccessPolicyRequest.ProtoReflect.Descriptor instead. func (*UpdateGlobalAccessPolicyRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{113} + return file_ateapi_proto_rawDescGZIP(), []int{114} } func (x *UpdateGlobalAccessPolicyRequest) GetAccessPolicy() *AccessPolicy { @@ -8280,7 +8350,7 @@ type GetAtespaceAccessPolicyRequest struct { func (x *GetAtespaceAccessPolicyRequest) Reset() { *x = GetAtespaceAccessPolicyRequest{} - mi := &file_ateapi_proto_msgTypes[114] + mi := &file_ateapi_proto_msgTypes[115] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -8292,7 +8362,7 @@ func (x *GetAtespaceAccessPolicyRequest) String() string { func (*GetAtespaceAccessPolicyRequest) ProtoMessage() {} func (x *GetAtespaceAccessPolicyRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[114] + mi := &file_ateapi_proto_msgTypes[115] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -8305,7 +8375,7 @@ func (x *GetAtespaceAccessPolicyRequest) ProtoReflect() protoreflect.Message { // Deprecated: Use GetAtespaceAccessPolicyRequest.ProtoReflect.Descriptor instead. func (*GetAtespaceAccessPolicyRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{114} + return file_ateapi_proto_rawDescGZIP(), []int{115} } func (x *GetAtespaceAccessPolicyRequest) GetAtespace() *ObjectRef { @@ -8334,7 +8404,7 @@ type CreateAtespaceAccessPolicyRequest struct { func (x *CreateAtespaceAccessPolicyRequest) Reset() { *x = CreateAtespaceAccessPolicyRequest{} - mi := &file_ateapi_proto_msgTypes[115] + mi := &file_ateapi_proto_msgTypes[116] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -8346,7 +8416,7 @@ func (x *CreateAtespaceAccessPolicyRequest) String() string { func (*CreateAtespaceAccessPolicyRequest) ProtoMessage() {} func (x *CreateAtespaceAccessPolicyRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[115] + mi := &file_ateapi_proto_msgTypes[116] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -8359,7 +8429,7 @@ func (x *CreateAtespaceAccessPolicyRequest) ProtoReflect() protoreflect.Message // Deprecated: Use CreateAtespaceAccessPolicyRequest.ProtoReflect.Descriptor instead. func (*CreateAtespaceAccessPolicyRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{115} + return file_ateapi_proto_rawDescGZIP(), []int{116} } func (x *CreateAtespaceAccessPolicyRequest) GetAtespace() *ObjectRef { @@ -8395,7 +8465,7 @@ type UpdateAtespaceAccessPolicyRequest struct { func (x *UpdateAtespaceAccessPolicyRequest) Reset() { *x = UpdateAtespaceAccessPolicyRequest{} - mi := &file_ateapi_proto_msgTypes[116] + mi := &file_ateapi_proto_msgTypes[117] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -8407,7 +8477,7 @@ func (x *UpdateAtespaceAccessPolicyRequest) String() string { func (*UpdateAtespaceAccessPolicyRequest) ProtoMessage() {} func (x *UpdateAtespaceAccessPolicyRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[116] + mi := &file_ateapi_proto_msgTypes[117] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -8420,7 +8490,7 @@ func (x *UpdateAtespaceAccessPolicyRequest) ProtoReflect() protoreflect.Message // Deprecated: Use UpdateAtespaceAccessPolicyRequest.ProtoReflect.Descriptor instead. func (*UpdateAtespaceAccessPolicyRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{116} + return file_ateapi_proto_rawDescGZIP(), []int{117} } func (x *UpdateAtespaceAccessPolicyRequest) GetAtespace() *ObjectRef { @@ -8455,7 +8525,7 @@ type DeleteAtespaceAccessPolicyRequest struct { func (x *DeleteAtespaceAccessPolicyRequest) Reset() { *x = DeleteAtespaceAccessPolicyRequest{} - mi := &file_ateapi_proto_msgTypes[117] + mi := &file_ateapi_proto_msgTypes[118] ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) ms.StoreMessageInfo(mi) } @@ -8467,7 +8537,7 @@ func (x *DeleteAtespaceAccessPolicyRequest) String() string { func (*DeleteAtespaceAccessPolicyRequest) ProtoMessage() {} func (x *DeleteAtespaceAccessPolicyRequest) ProtoReflect() protoreflect.Message { - mi := &file_ateapi_proto_msgTypes[117] + mi := &file_ateapi_proto_msgTypes[118] if x != nil { ms := protoimpl.X.MessageStateOf(protoimpl.Pointer(x)) if ms.LoadMessageInfo() == nil { @@ -8480,7 +8550,7 @@ func (x *DeleteAtespaceAccessPolicyRequest) ProtoReflect() protoreflect.Message // Deprecated: Use DeleteAtespaceAccessPolicyRequest.ProtoReflect.Descriptor instead. func (*DeleteAtespaceAccessPolicyRequest) Descriptor() ([]byte, []int) { - return file_ateapi_proto_rawDescGZIP(), []int{117} + return file_ateapi_proto_rawDescGZIP(), []int{118} } func (x *DeleteAtespaceAccessPolicyRequest) GetAtespace() *ObjectRef { @@ -8555,7 +8625,9 @@ const file_ateapi_proto_rawDesc = "" + "\x06status\x18\a \x01(\v2\x13.ateapi.ActorStatusR\x06status\"n\n" + "\fEgressPolicy\x124\n" + "\bmetadata\x18\x01 \x01(\v2\x18.ateapi.ResourceMetadataR\bmetadata\x12(\n" + - "\x05rules\x18\x02 \x03(\v2\x12.ateapi.EgressRuleR\x05rules\"\xa0\x01\n" + + "\x05rules\x18\x02 \x03(\v2\x12.ateapi.EgressRuleR\x05rules\"@\n" + + "\x14EgressPolicyTemplate\x12(\n" + + "\x05rules\x18\x01 \x03(\v2\x12.ateapi.EgressRuleR\x05rules\"\xa0\x01\n" + "\n" + "EgressRule\x12$\n" + "\x04http\x18\x01 \x01(\v2\x10.ateapi.HTTPRuleR\x04http\x12'\n" + @@ -8624,7 +8696,7 @@ const file_ateapi_proto_rawDesc = "" + "\bmetadata\x18\x01 \x01(\v2\x18.ateapi.ResourceMetadataR\bmetadata\";\n" + "\tObjectRef\x12\x1a\n" + "\batespace\x18\x01 \x01(\tR\batespace\x12\x12\n" + - "\x04name\x18\x02 \x01(\tR\x04name\"\xc2\x03\n" + + "\x04name\x18\x02 \x01(\tR\x04name\"\x94\x04\n" + "\rActorTemplate\x124\n" + "\bmetadata\x18\x01 \x01(\v2\x18.ateapi.ResourceMetadataR\bmetadata\x129\n" + "\x0fworker_selector\x18\x02 \x01(\v2\x10.ateapi.SelectorR\x0eworkerSelector\x121\n" + @@ -8635,7 +8707,8 @@ const file_ateapi_proto_rawDesc = "" + "\x0fsnapshot_config\x18\x05 \x01(\v2\x16.ateapi.SnapshotConfigR\x0esnapshotConfig\x12<\n" + "\x0esandbox_config\x18\x06 \x01(\v2\x15.ateapi.SandboxConfigR\rsandboxConfig\x12/\n" + "\tresources\x18\a \x01(\v2\x11.ateapi.ResourcesR\tresources\x123\n" + - "\x06status\x18\b \x01(\v2\x1b.ateapi.ActorTemplateStatusR\x06status\"3\n" + + "\x06status\x18\b \x01(\v2\x1b.ateapi.ActorTemplateStatusR\x06status\x12P\n" + + "\x15default_egress_policy\x18\t \x01(\v2\x1c.ateapi.EgressPolicyTemplateR\x13defaultEgressPolicy\"3\n" + "\tResources\x12&\n" + "\x06limits\x18\x01 \x03(\v2\x0e.ateapi.LimitsR\x06limits\"8\n" + "\x06Limits\x12\x12\n" + @@ -9042,7 +9115,7 @@ func file_ateapi_proto_rawDescGZIP() []byte { } var file_ateapi_proto_enumTypes = make([]protoimpl.EnumInfo, 10) -var file_ateapi_proto_msgTypes = make([]protoimpl.MessageInfo, 121) +var file_ateapi_proto_msgTypes = make([]protoimpl.MessageInfo, 122) var file_ateapi_proto_goTypes = []any{ (SnapshotOwner)(0), // 0: ateapi.SnapshotOwner (SnapshotStorageStatus)(0), // 1: ateapi.SnapshotStorageStatus @@ -9062,120 +9135,121 @@ var file_ateapi_proto_goTypes = []any{ (*ExternalVolume)(nil), // 15: ateapi.ExternalVolume (*Actor)(nil), // 16: ateapi.Actor (*EgressPolicy)(nil), // 17: ateapi.EgressPolicy - (*EgressRule)(nil), // 18: ateapi.EgressRule - (*HTTPRule)(nil), // 19: ateapi.HTTPRule - (*HTTPSRule)(nil), // 20: ateapi.HTTPSRule - (*TLSPassthroughRule)(nil), // 21: ateapi.TLSPassthroughRule - (*Ports)(nil), // 22: ateapi.Ports - (*AllPorts)(nil), // 23: ateapi.AllPorts - (*HttpRuleEffects)(nil), // 24: ateapi.HttpRuleEffects - (*CredentialHeader)(nil), // 25: ateapi.CredentialHeader - (*ActorJWTSource)(nil), // 26: ateapi.ActorJWTSource - (*ActorStatus)(nil), // 27: ateapi.ActorStatus - (*ActorCrash)(nil), // 28: ateapi.ActorCrash - (*WorkerAssignment)(nil), // 29: ateapi.WorkerAssignment - (*TagStatus)(nil), // 30: ateapi.TagStatus - (*Tag)(nil), // 31: ateapi.Tag - (*Atespace)(nil), // 32: ateapi.Atespace - (*ObjectRef)(nil), // 33: ateapi.ObjectRef - (*ActorTemplate)(nil), // 34: ateapi.ActorTemplate - (*Resources)(nil), // 35: ateapi.Resources - (*Limits)(nil), // 36: ateapi.Limits - (*GoldenSnapshotStatus)(nil), // 37: ateapi.GoldenSnapshotStatus - (*ActorTemplateStatus)(nil), // 38: ateapi.ActorTemplateStatus - (*SandboxConfig)(nil), // 39: ateapi.SandboxConfig - (*SnapshotConfig)(nil), // 40: ateapi.SnapshotConfig - (*GoldenSnapshotConfig)(nil), // 41: ateapi.GoldenSnapshotConfig - (*Container)(nil), // 42: ateapi.Container - (*SecurityContext)(nil), // 43: ateapi.SecurityContext - (*Capabilities)(nil), // 44: ateapi.Capabilities - (*EnvVar)(nil), // 45: ateapi.EnvVar - (*ContainerWakeupProbe)(nil), // 46: ateapi.ContainerWakeupProbe - (*HTTPGetAction)(nil), // 47: ateapi.HTTPGetAction - (*Volume)(nil), // 48: ateapi.Volume - (*ImageVolumeSource)(nil), // 49: ateapi.ImageVolumeSource - (*DurableDirVolumeSource)(nil), // 50: ateapi.DurableDirVolumeSource - (*ExternalVolumeTemplate)(nil), // 51: ateapi.ExternalVolumeTemplate - (*SystemInfoVolumeSource)(nil), // 52: ateapi.SystemInfoVolumeSource - (*SystemInfoDataSource)(nil), // 53: ateapi.SystemInfoDataSource - (*ActorMetadataDataSource)(nil), // 54: ateapi.ActorMetadataDataSource - (*ActorMetadataItem)(nil), // 55: ateapi.ActorMetadataItem - (*TrustBundleDataSource)(nil), // 56: ateapi.TrustBundleDataSource - (*VolumeMount)(nil), // 57: ateapi.VolumeMount - (*CreateAtespaceRequest)(nil), // 58: ateapi.CreateAtespaceRequest - (*GetAtespaceRequest)(nil), // 59: ateapi.GetAtespaceRequest - (*ListAtespacesRequest)(nil), // 60: ateapi.ListAtespacesRequest - (*ListAtespacesResponse)(nil), // 61: ateapi.ListAtespacesResponse - (*DeleteAtespaceRequest)(nil), // 62: ateapi.DeleteAtespaceRequest - (*CreateActorTemplateRequest)(nil), // 63: ateapi.CreateActorTemplateRequest - (*GetActorTemplateRequest)(nil), // 64: ateapi.GetActorTemplateRequest - (*ListActorTemplatesRequest)(nil), // 65: ateapi.ListActorTemplatesRequest - (*ListActorTemplatesResponse)(nil), // 66: ateapi.ListActorTemplatesResponse - (*DeleteActorTemplateRequest)(nil), // 67: ateapi.DeleteActorTemplateRequest - (*GetActorRequest)(nil), // 68: ateapi.GetActorRequest - (*CreateActorRequest)(nil), // 69: ateapi.CreateActorRequest - (*UpdateActorRequest)(nil), // 70: ateapi.UpdateActorRequest - (*SuspendActorRequest)(nil), // 71: ateapi.SuspendActorRequest - (*SuspendActorResponse)(nil), // 72: ateapi.SuspendActorResponse - (*PauseActorRequest)(nil), // 73: ateapi.PauseActorRequest - (*PauseActorResponse)(nil), // 74: ateapi.PauseActorResponse - (*ResumeActorRequest)(nil), // 75: ateapi.ResumeActorRequest - (*ResumeActorResponse)(nil), // 76: ateapi.ResumeActorResponse - (*RevertActorRequest)(nil), // 77: ateapi.RevertActorRequest - (*RevertActorResponse)(nil), // 78: ateapi.RevertActorResponse - (*DeleteActorRequest)(nil), // 79: ateapi.DeleteActorRequest - (*GetActorEgressPolicyRequest)(nil), // 80: ateapi.GetActorEgressPolicyRequest - (*CreateActorEgressPolicyRequest)(nil), // 81: ateapi.CreateActorEgressPolicyRequest - (*UpdateActorEgressPolicyRequest)(nil), // 82: ateapi.UpdateActorEgressPolicyRequest - (*DeleteActorEgressPolicyRequest)(nil), // 83: ateapi.DeleteActorEgressPolicyRequest - (*GetTagRequest)(nil), // 84: ateapi.GetTagRequest - (*MintActorJWTRequest)(nil), // 85: ateapi.MintActorJWTRequest - (*MintActorJWTResponse)(nil), // 86: ateapi.MintActorJWTResponse - (*MintActorCertificateRequest)(nil), // 87: ateapi.MintActorCertificateRequest - (*MintActorCertificateResponse)(nil), // 88: ateapi.MintActorCertificateResponse - (*ListTagsRequest)(nil), // 89: ateapi.ListTagsRequest - (*ListTagsResponse)(nil), // 90: ateapi.ListTagsResponse - (*CreateTagRequest)(nil), // 91: ateapi.CreateTagRequest - (*UpdateTagRequest)(nil), // 92: ateapi.UpdateTagRequest - (*DeleteTagRequest)(nil), // 93: ateapi.DeleteTagRequest - (*DeleteOptions)(nil), // 94: ateapi.DeleteOptions - (*ListWorkerActorAssignmentsRequest)(nil), // 95: ateapi.ListWorkerActorAssignmentsRequest - (*ListWorkerActorAssignmentsResponse)(nil), // 96: ateapi.ListWorkerActorAssignmentsResponse - (*ListWorkersRequest)(nil), // 97: ateapi.ListWorkersRequest - (*ListWorkersResponse)(nil), // 98: ateapi.ListWorkersResponse - (*GetWorkerRequest)(nil), // 99: ateapi.GetWorkerRequest - (*CreateWorkerRequest)(nil), // 100: ateapi.CreateWorkerRequest - (*UpdateWorkerRequest)(nil), // 101: ateapi.UpdateWorkerRequest - (*DeleteWorkerRequest)(nil), // 102: ateapi.DeleteWorkerRequest - (*DrainWorkerRequest)(nil), // 103: ateapi.DrainWorkerRequest - (*ListActorsRequest)(nil), // 104: ateapi.ListActorsRequest - (*ListActorsResponse)(nil), // 105: ateapi.ListActorsResponse - (*Worker)(nil), // 106: ateapi.Worker - (*WorkerStatus)(nil), // 107: ateapi.WorkerStatus - (*SandboxRuntime)(nil), // 108: ateapi.SandboxRuntime - (*VersionedSandboxCompat)(nil), // 109: ateapi.VersionedSandboxCompat - (*AttributeEntry)(nil), // 110: ateapi.AttributeEntry - (*WorkerResources)(nil), // 111: ateapi.WorkerResources - (*ActorAssignment)(nil), // 112: ateapi.ActorAssignment - (*RegisterWorkerRequest)(nil), // 113: ateapi.RegisterWorkerRequest - (*RegisterWorkerResponse)(nil), // 114: ateapi.RegisterWorkerResponse - (*MintAteomActorCertificateRequest)(nil), // 115: ateapi.MintAteomActorCertificateRequest - (*MintAteomActorCertificateResponse)(nil), // 116: ateapi.MintAteomActorCertificateResponse - (*RequestActorSuspendRequest)(nil), // 117: ateapi.RequestActorSuspendRequest - (*RequestActorSuspendResponse)(nil), // 118: ateapi.RequestActorSuspendResponse - (*AccessPolicy)(nil), // 119: ateapi.AccessPolicy - (*Binding)(nil), // 120: ateapi.Binding - (*GetGlobalAccessPolicyRequest)(nil), // 121: ateapi.GetGlobalAccessPolicyRequest - (*CreateGlobalAccessPolicyRequest)(nil), // 122: ateapi.CreateGlobalAccessPolicyRequest - (*UpdateGlobalAccessPolicyRequest)(nil), // 123: ateapi.UpdateGlobalAccessPolicyRequest - (*GetAtespaceAccessPolicyRequest)(nil), // 124: ateapi.GetAtespaceAccessPolicyRequest - (*CreateAtespaceAccessPolicyRequest)(nil), // 125: ateapi.CreateAtespaceAccessPolicyRequest - (*UpdateAtespaceAccessPolicyRequest)(nil), // 126: ateapi.UpdateAtespaceAccessPolicyRequest - (*DeleteAtespaceAccessPolicyRequest)(nil), // 127: ateapi.DeleteAtespaceAccessPolicyRequest - nil, // 128: ateapi.Selector.MatchLabelsEntry - nil, // 129: ateapi.ExternalVolume.VolumeContextEntry - nil, // 130: ateapi.Worker.LabelsEntry - (*timestamppb.Timestamp)(nil), // 131: google.protobuf.Timestamp + (*EgressPolicyTemplate)(nil), // 18: ateapi.EgressPolicyTemplate + (*EgressRule)(nil), // 19: ateapi.EgressRule + (*HTTPRule)(nil), // 20: ateapi.HTTPRule + (*HTTPSRule)(nil), // 21: ateapi.HTTPSRule + (*TLSPassthroughRule)(nil), // 22: ateapi.TLSPassthroughRule + (*Ports)(nil), // 23: ateapi.Ports + (*AllPorts)(nil), // 24: ateapi.AllPorts + (*HttpRuleEffects)(nil), // 25: ateapi.HttpRuleEffects + (*CredentialHeader)(nil), // 26: ateapi.CredentialHeader + (*ActorJWTSource)(nil), // 27: ateapi.ActorJWTSource + (*ActorStatus)(nil), // 28: ateapi.ActorStatus + (*ActorCrash)(nil), // 29: ateapi.ActorCrash + (*WorkerAssignment)(nil), // 30: ateapi.WorkerAssignment + (*TagStatus)(nil), // 31: ateapi.TagStatus + (*Tag)(nil), // 32: ateapi.Tag + (*Atespace)(nil), // 33: ateapi.Atespace + (*ObjectRef)(nil), // 34: ateapi.ObjectRef + (*ActorTemplate)(nil), // 35: ateapi.ActorTemplate + (*Resources)(nil), // 36: ateapi.Resources + (*Limits)(nil), // 37: ateapi.Limits + (*GoldenSnapshotStatus)(nil), // 38: ateapi.GoldenSnapshotStatus + (*ActorTemplateStatus)(nil), // 39: ateapi.ActorTemplateStatus + (*SandboxConfig)(nil), // 40: ateapi.SandboxConfig + (*SnapshotConfig)(nil), // 41: ateapi.SnapshotConfig + (*GoldenSnapshotConfig)(nil), // 42: ateapi.GoldenSnapshotConfig + (*Container)(nil), // 43: ateapi.Container + (*SecurityContext)(nil), // 44: ateapi.SecurityContext + (*Capabilities)(nil), // 45: ateapi.Capabilities + (*EnvVar)(nil), // 46: ateapi.EnvVar + (*ContainerWakeupProbe)(nil), // 47: ateapi.ContainerWakeupProbe + (*HTTPGetAction)(nil), // 48: ateapi.HTTPGetAction + (*Volume)(nil), // 49: ateapi.Volume + (*ImageVolumeSource)(nil), // 50: ateapi.ImageVolumeSource + (*DurableDirVolumeSource)(nil), // 51: ateapi.DurableDirVolumeSource + (*ExternalVolumeTemplate)(nil), // 52: ateapi.ExternalVolumeTemplate + (*SystemInfoVolumeSource)(nil), // 53: ateapi.SystemInfoVolumeSource + (*SystemInfoDataSource)(nil), // 54: ateapi.SystemInfoDataSource + (*ActorMetadataDataSource)(nil), // 55: ateapi.ActorMetadataDataSource + (*ActorMetadataItem)(nil), // 56: ateapi.ActorMetadataItem + (*TrustBundleDataSource)(nil), // 57: ateapi.TrustBundleDataSource + (*VolumeMount)(nil), // 58: ateapi.VolumeMount + (*CreateAtespaceRequest)(nil), // 59: ateapi.CreateAtespaceRequest + (*GetAtespaceRequest)(nil), // 60: ateapi.GetAtespaceRequest + (*ListAtespacesRequest)(nil), // 61: ateapi.ListAtespacesRequest + (*ListAtespacesResponse)(nil), // 62: ateapi.ListAtespacesResponse + (*DeleteAtespaceRequest)(nil), // 63: ateapi.DeleteAtespaceRequest + (*CreateActorTemplateRequest)(nil), // 64: ateapi.CreateActorTemplateRequest + (*GetActorTemplateRequest)(nil), // 65: ateapi.GetActorTemplateRequest + (*ListActorTemplatesRequest)(nil), // 66: ateapi.ListActorTemplatesRequest + (*ListActorTemplatesResponse)(nil), // 67: ateapi.ListActorTemplatesResponse + (*DeleteActorTemplateRequest)(nil), // 68: ateapi.DeleteActorTemplateRequest + (*GetActorRequest)(nil), // 69: ateapi.GetActorRequest + (*CreateActorRequest)(nil), // 70: ateapi.CreateActorRequest + (*UpdateActorRequest)(nil), // 71: ateapi.UpdateActorRequest + (*SuspendActorRequest)(nil), // 72: ateapi.SuspendActorRequest + (*SuspendActorResponse)(nil), // 73: ateapi.SuspendActorResponse + (*PauseActorRequest)(nil), // 74: ateapi.PauseActorRequest + (*PauseActorResponse)(nil), // 75: ateapi.PauseActorResponse + (*ResumeActorRequest)(nil), // 76: ateapi.ResumeActorRequest + (*ResumeActorResponse)(nil), // 77: ateapi.ResumeActorResponse + (*RevertActorRequest)(nil), // 78: ateapi.RevertActorRequest + (*RevertActorResponse)(nil), // 79: ateapi.RevertActorResponse + (*DeleteActorRequest)(nil), // 80: ateapi.DeleteActorRequest + (*GetActorEgressPolicyRequest)(nil), // 81: ateapi.GetActorEgressPolicyRequest + (*CreateActorEgressPolicyRequest)(nil), // 82: ateapi.CreateActorEgressPolicyRequest + (*UpdateActorEgressPolicyRequest)(nil), // 83: ateapi.UpdateActorEgressPolicyRequest + (*DeleteActorEgressPolicyRequest)(nil), // 84: ateapi.DeleteActorEgressPolicyRequest + (*GetTagRequest)(nil), // 85: ateapi.GetTagRequest + (*MintActorJWTRequest)(nil), // 86: ateapi.MintActorJWTRequest + (*MintActorJWTResponse)(nil), // 87: ateapi.MintActorJWTResponse + (*MintActorCertificateRequest)(nil), // 88: ateapi.MintActorCertificateRequest + (*MintActorCertificateResponse)(nil), // 89: ateapi.MintActorCertificateResponse + (*ListTagsRequest)(nil), // 90: ateapi.ListTagsRequest + (*ListTagsResponse)(nil), // 91: ateapi.ListTagsResponse + (*CreateTagRequest)(nil), // 92: ateapi.CreateTagRequest + (*UpdateTagRequest)(nil), // 93: ateapi.UpdateTagRequest + (*DeleteTagRequest)(nil), // 94: ateapi.DeleteTagRequest + (*DeleteOptions)(nil), // 95: ateapi.DeleteOptions + (*ListWorkerActorAssignmentsRequest)(nil), // 96: ateapi.ListWorkerActorAssignmentsRequest + (*ListWorkerActorAssignmentsResponse)(nil), // 97: ateapi.ListWorkerActorAssignmentsResponse + (*ListWorkersRequest)(nil), // 98: ateapi.ListWorkersRequest + (*ListWorkersResponse)(nil), // 99: ateapi.ListWorkersResponse + (*GetWorkerRequest)(nil), // 100: ateapi.GetWorkerRequest + (*CreateWorkerRequest)(nil), // 101: ateapi.CreateWorkerRequest + (*UpdateWorkerRequest)(nil), // 102: ateapi.UpdateWorkerRequest + (*DeleteWorkerRequest)(nil), // 103: ateapi.DeleteWorkerRequest + (*DrainWorkerRequest)(nil), // 104: ateapi.DrainWorkerRequest + (*ListActorsRequest)(nil), // 105: ateapi.ListActorsRequest + (*ListActorsResponse)(nil), // 106: ateapi.ListActorsResponse + (*Worker)(nil), // 107: ateapi.Worker + (*WorkerStatus)(nil), // 108: ateapi.WorkerStatus + (*SandboxRuntime)(nil), // 109: ateapi.SandboxRuntime + (*VersionedSandboxCompat)(nil), // 110: ateapi.VersionedSandboxCompat + (*AttributeEntry)(nil), // 111: ateapi.AttributeEntry + (*WorkerResources)(nil), // 112: ateapi.WorkerResources + (*ActorAssignment)(nil), // 113: ateapi.ActorAssignment + (*RegisterWorkerRequest)(nil), // 114: ateapi.RegisterWorkerRequest + (*RegisterWorkerResponse)(nil), // 115: ateapi.RegisterWorkerResponse + (*MintAteomActorCertificateRequest)(nil), // 116: ateapi.MintAteomActorCertificateRequest + (*MintAteomActorCertificateResponse)(nil), // 117: ateapi.MintAteomActorCertificateResponse + (*RequestActorSuspendRequest)(nil), // 118: ateapi.RequestActorSuspendRequest + (*RequestActorSuspendResponse)(nil), // 119: ateapi.RequestActorSuspendResponse + (*AccessPolicy)(nil), // 120: ateapi.AccessPolicy + (*Binding)(nil), // 121: ateapi.Binding + (*GetGlobalAccessPolicyRequest)(nil), // 122: ateapi.GetGlobalAccessPolicyRequest + (*CreateGlobalAccessPolicyRequest)(nil), // 123: ateapi.CreateGlobalAccessPolicyRequest + (*UpdateGlobalAccessPolicyRequest)(nil), // 124: ateapi.UpdateGlobalAccessPolicyRequest + (*GetAtespaceAccessPolicyRequest)(nil), // 125: ateapi.GetAtespaceAccessPolicyRequest + (*CreateAtespaceAccessPolicyRequest)(nil), // 126: ateapi.CreateAtespaceAccessPolicyRequest + (*UpdateAtespaceAccessPolicyRequest)(nil), // 127: ateapi.UpdateAtespaceAccessPolicyRequest + (*DeleteAtespaceAccessPolicyRequest)(nil), // 128: ateapi.DeleteAtespaceAccessPolicyRequest + nil, // 129: ateapi.Selector.MatchLabelsEntry + nil, // 130: ateapi.ExternalVolume.VolumeContextEntry + nil, // 131: ateapi.Worker.LabelsEntry + (*timestamppb.Timestamp)(nil), // 132: google.protobuf.Timestamp } var file_ateapi_proto_depIdxs = []int32{ 1, // 0: ateapi.SnapshotStorage.status:type_name -> ateapi.SnapshotStorageStatus @@ -9183,252 +9257,254 @@ var file_ateapi_proto_depIdxs = []int32{ 0, // 2: ateapi.Snapshot.owner:type_name -> ateapi.SnapshotOwner 2, // 3: ateapi.Snapshot.fidelity:type_name -> ateapi.SnapshotFidelity 11, // 4: ateapi.Snapshot.durable_snapshot:type_name -> ateapi.SnapshotStorage - 128, // 5: ateapi.Selector.match_labels:type_name -> ateapi.Selector.MatchLabelsEntry - 131, // 6: ateapi.ResourceMetadata.create_time:type_name -> google.protobuf.Timestamp - 131, // 7: ateapi.ResourceMetadata.update_time:type_name -> google.protobuf.Timestamp + 129, // 5: ateapi.Selector.match_labels:type_name -> ateapi.Selector.MatchLabelsEntry + 132, // 6: ateapi.ResourceMetadata.create_time:type_name -> google.protobuf.Timestamp + 132, // 7: ateapi.ResourceMetadata.update_time:type_name -> google.protobuf.Timestamp 9, // 8: ateapi.ExternalVolume.status:type_name -> ateapi.ExternalVolume.Status - 129, // 9: ateapi.ExternalVolume.volume_context:type_name -> ateapi.ExternalVolume.VolumeContextEntry + 130, // 9: ateapi.ExternalVolume.volume_context:type_name -> ateapi.ExternalVolume.VolumeContextEntry 14, // 10: ateapi.Actor.metadata:type_name -> ateapi.ResourceMetadata - 33, // 11: ateapi.Actor.actor_template:type_name -> ateapi.ObjectRef + 34, // 11: ateapi.Actor.actor_template:type_name -> ateapi.ObjectRef 13, // 12: ateapi.Actor.worker_selector:type_name -> ateapi.Selector - 33, // 13: ateapi.Actor.source_tag:type_name -> ateapi.ObjectRef - 27, // 14: ateapi.Actor.status:type_name -> ateapi.ActorStatus + 34, // 13: ateapi.Actor.source_tag:type_name -> ateapi.ObjectRef + 28, // 14: ateapi.Actor.status:type_name -> ateapi.ActorStatus 14, // 15: ateapi.EgressPolicy.metadata:type_name -> ateapi.ResourceMetadata - 18, // 16: ateapi.EgressPolicy.rules:type_name -> ateapi.EgressRule - 19, // 17: ateapi.EgressRule.http:type_name -> ateapi.HTTPRule - 20, // 18: ateapi.EgressRule.https:type_name -> ateapi.HTTPSRule - 21, // 19: ateapi.EgressRule.tls_passthrough:type_name -> ateapi.TLSPassthroughRule - 22, // 20: ateapi.HTTPRule.ports:type_name -> ateapi.Ports - 24, // 21: ateapi.HTTPRule.effects:type_name -> ateapi.HttpRuleEffects - 22, // 22: ateapi.HTTPSRule.ports:type_name -> ateapi.Ports - 24, // 23: ateapi.HTTPSRule.effects:type_name -> ateapi.HttpRuleEffects - 22, // 24: ateapi.TLSPassthroughRule.ports:type_name -> ateapi.Ports - 23, // 25: ateapi.Ports.all:type_name -> ateapi.AllPorts - 25, // 26: ateapi.HttpRuleEffects.replace_headers:type_name -> ateapi.CredentialHeader - 26, // 27: ateapi.CredentialHeader.actor_jwt:type_name -> ateapi.ActorJWTSource - 4, // 28: ateapi.ActorStatus.state:type_name -> ateapi.ActorState - 29, // 29: ateapi.ActorStatus.worker_assignment:type_name -> ateapi.WorkerAssignment - 15, // 30: ateapi.ActorStatus.external_volumes:type_name -> ateapi.ExternalVolume - 28, // 31: ateapi.ActorStatus.crash:type_name -> ateapi.ActorCrash - 12, // 32: ateapi.ActorStatus.snapshots:type_name -> ateapi.Snapshot - 131, // 33: ateapi.ActorCrash.crash_time:type_name -> google.protobuf.Timestamp - 33, // 34: ateapi.WorkerAssignment.worker:type_name -> ateapi.ObjectRef - 12, // 35: ateapi.TagStatus.snapshot:type_name -> ateapi.Snapshot - 14, // 36: ateapi.Tag.metadata:type_name -> ateapi.ResourceMetadata - 30, // 37: ateapi.Tag.status:type_name -> ateapi.TagStatus - 3, // 38: ateapi.Tag.scope:type_name -> ateapi.TagScope - 33, // 39: ateapi.Tag.source_actor:type_name -> ateapi.ObjectRef - 14, // 40: ateapi.Atespace.metadata:type_name -> ateapi.ResourceMetadata - 14, // 41: ateapi.ActorTemplate.metadata:type_name -> ateapi.ResourceMetadata - 13, // 42: ateapi.ActorTemplate.worker_selector:type_name -> ateapi.Selector - 42, // 43: ateapi.ActorTemplate.containers:type_name -> ateapi.Container - 48, // 44: ateapi.ActorTemplate.volumes:type_name -> ateapi.Volume - 40, // 45: ateapi.ActorTemplate.snapshot_config:type_name -> ateapi.SnapshotConfig - 39, // 46: ateapi.ActorTemplate.sandbox_config:type_name -> ateapi.SandboxConfig - 35, // 47: ateapi.ActorTemplate.resources:type_name -> ateapi.Resources - 38, // 48: ateapi.ActorTemplate.status:type_name -> ateapi.ActorTemplateStatus - 36, // 49: ateapi.Resources.limits:type_name -> ateapi.Limits - 33, // 50: ateapi.GoldenSnapshotStatus.golden_tag:type_name -> ateapi.ObjectRef - 131, // 51: ateapi.GoldenSnapshotStatus.take_golden_snapshot_at:type_name -> google.protobuf.Timestamp - 37, // 52: ateapi.ActorTemplateStatus.golden_snapshot_status:type_name -> ateapi.GoldenSnapshotStatus - 5, // 53: ateapi.SandboxConfig.sandbox_class:type_name -> ateapi.SandboxClass - 2, // 54: ateapi.SnapshotConfig.preferred_fidelity:type_name -> ateapi.SnapshotFidelity - 41, // 55: ateapi.SnapshotConfig.golden_snapshot_config:type_name -> ateapi.GoldenSnapshotConfig - 6, // 56: ateapi.GoldenSnapshotConfig.mode:type_name -> ateapi.GoldenSnapshotMode - 45, // 57: ateapi.Container.env:type_name -> ateapi.EnvVar - 46, // 58: ateapi.Container.wakeup_probe:type_name -> ateapi.ContainerWakeupProbe - 57, // 59: ateapi.Container.volume_mounts:type_name -> ateapi.VolumeMount - 43, // 60: ateapi.Container.security_context:type_name -> ateapi.SecurityContext - 35, // 61: ateapi.Container.resources:type_name -> ateapi.Resources - 44, // 62: ateapi.SecurityContext.capabilities:type_name -> ateapi.Capabilities - 47, // 63: ateapi.ContainerWakeupProbe.http_get:type_name -> ateapi.HTTPGetAction - 50, // 64: ateapi.Volume.durable_dir:type_name -> ateapi.DurableDirVolumeSource - 51, // 65: ateapi.Volume.external_volume_template:type_name -> ateapi.ExternalVolumeTemplate - 52, // 66: ateapi.Volume.system_info:type_name -> ateapi.SystemInfoVolumeSource - 49, // 67: ateapi.Volume.image:type_name -> ateapi.ImageVolumeSource - 53, // 68: ateapi.SystemInfoVolumeSource.data_sources:type_name -> ateapi.SystemInfoDataSource - 54, // 69: ateapi.SystemInfoDataSource.actor_metadata:type_name -> ateapi.ActorMetadataDataSource - 56, // 70: ateapi.SystemInfoDataSource.trust_bundle:type_name -> ateapi.TrustBundleDataSource - 55, // 71: ateapi.ActorMetadataDataSource.items:type_name -> ateapi.ActorMetadataItem - 7, // 72: ateapi.ActorMetadataItem.field:type_name -> ateapi.ActorMetadataField - 32, // 73: ateapi.CreateAtespaceRequest.atespace:type_name -> ateapi.Atespace - 33, // 74: ateapi.GetAtespaceRequest.atespace:type_name -> ateapi.ObjectRef - 32, // 75: ateapi.ListAtespacesResponse.atespaces:type_name -> ateapi.Atespace - 33, // 76: ateapi.DeleteAtespaceRequest.atespace:type_name -> ateapi.ObjectRef - 94, // 77: ateapi.DeleteAtespaceRequest.options:type_name -> ateapi.DeleteOptions - 34, // 78: ateapi.CreateActorTemplateRequest.actor_template:type_name -> ateapi.ActorTemplate - 33, // 79: ateapi.GetActorTemplateRequest.actor_template:type_name -> ateapi.ObjectRef - 34, // 80: ateapi.ListActorTemplatesResponse.actor_templates:type_name -> ateapi.ActorTemplate - 33, // 81: ateapi.DeleteActorTemplateRequest.actor_template:type_name -> ateapi.ObjectRef - 94, // 82: ateapi.DeleteActorTemplateRequest.options:type_name -> ateapi.DeleteOptions - 33, // 83: ateapi.GetActorRequest.actor:type_name -> ateapi.ObjectRef - 16, // 84: ateapi.CreateActorRequest.actor:type_name -> ateapi.Actor - 16, // 85: ateapi.UpdateActorRequest.actor:type_name -> ateapi.Actor - 33, // 86: ateapi.SuspendActorRequest.actor:type_name -> ateapi.ObjectRef - 16, // 87: ateapi.SuspendActorResponse.actor:type_name -> ateapi.Actor - 33, // 88: ateapi.PauseActorRequest.actor:type_name -> ateapi.ObjectRef - 16, // 89: ateapi.PauseActorResponse.actor:type_name -> ateapi.Actor - 33, // 90: ateapi.ResumeActorRequest.actor:type_name -> ateapi.ObjectRef - 16, // 91: ateapi.ResumeActorResponse.actor:type_name -> ateapi.Actor - 33, // 92: ateapi.RevertActorRequest.actor:type_name -> ateapi.ObjectRef - 16, // 93: ateapi.RevertActorResponse.actor:type_name -> ateapi.Actor - 33, // 94: ateapi.DeleteActorRequest.actor:type_name -> ateapi.ObjectRef - 94, // 95: ateapi.DeleteActorRequest.options:type_name -> ateapi.DeleteOptions - 33, // 96: ateapi.GetActorEgressPolicyRequest.actor:type_name -> ateapi.ObjectRef - 33, // 97: ateapi.CreateActorEgressPolicyRequest.actor:type_name -> ateapi.ObjectRef - 17, // 98: ateapi.CreateActorEgressPolicyRequest.egress_policy:type_name -> ateapi.EgressPolicy - 33, // 99: ateapi.UpdateActorEgressPolicyRequest.actor:type_name -> ateapi.ObjectRef - 17, // 100: ateapi.UpdateActorEgressPolicyRequest.egress_policy:type_name -> ateapi.EgressPolicy - 33, // 101: ateapi.DeleteActorEgressPolicyRequest.actor:type_name -> ateapi.ObjectRef - 94, // 102: ateapi.DeleteActorEgressPolicyRequest.options:type_name -> ateapi.DeleteOptions - 33, // 103: ateapi.GetTagRequest.tag:type_name -> ateapi.ObjectRef - 33, // 104: ateapi.MintActorJWTRequest.actor:type_name -> ateapi.ObjectRef - 131, // 105: ateapi.MintActorJWTResponse.expires_at:type_name -> google.protobuf.Timestamp - 33, // 106: ateapi.MintActorCertificateRequest.actor:type_name -> ateapi.ObjectRef - 31, // 107: ateapi.ListTagsResponse.tags:type_name -> ateapi.Tag - 31, // 108: ateapi.CreateTagRequest.tag:type_name -> ateapi.Tag - 31, // 109: ateapi.UpdateTagRequest.tag:type_name -> ateapi.Tag - 33, // 110: ateapi.DeleteTagRequest.tag:type_name -> ateapi.ObjectRef - 94, // 111: ateapi.DeleteTagRequest.options:type_name -> ateapi.DeleteOptions - 33, // 112: ateapi.ListWorkerActorAssignmentsRequest.worker:type_name -> ateapi.ObjectRef - 112, // 113: ateapi.ListWorkerActorAssignmentsResponse.actor_assignments:type_name -> ateapi.ActorAssignment - 106, // 114: ateapi.ListWorkersResponse.workers:type_name -> ateapi.Worker - 33, // 115: ateapi.GetWorkerRequest.worker:type_name -> ateapi.ObjectRef - 106, // 116: ateapi.CreateWorkerRequest.worker:type_name -> ateapi.Worker - 106, // 117: ateapi.UpdateWorkerRequest.worker:type_name -> ateapi.Worker - 33, // 118: ateapi.DeleteWorkerRequest.worker:type_name -> ateapi.ObjectRef - 94, // 119: ateapi.DeleteWorkerRequest.options:type_name -> ateapi.DeleteOptions - 33, // 120: ateapi.DrainWorkerRequest.worker:type_name -> ateapi.ObjectRef - 16, // 121: ateapi.ListActorsResponse.actors:type_name -> ateapi.Actor - 14, // 122: ateapi.Worker.metadata:type_name -> ateapi.ResourceMetadata - 130, // 123: ateapi.Worker.labels:type_name -> ateapi.Worker.LabelsEntry - 107, // 124: ateapi.Worker.status:type_name -> ateapi.WorkerStatus - 8, // 125: ateapi.WorkerStatus.state:type_name -> ateapi.WorkerState - 111, // 126: ateapi.WorkerStatus.capacity:type_name -> ateapi.WorkerResources - 111, // 127: ateapi.WorkerStatus.allocated:type_name -> ateapi.WorkerResources - 108, // 128: ateapi.WorkerStatus.default_runtime:type_name -> ateapi.SandboxRuntime - 108, // 129: ateapi.WorkerStatus.restorable_runtimes:type_name -> ateapi.SandboxRuntime - 109, // 130: ateapi.SandboxRuntime.version:type_name -> ateapi.VersionedSandboxCompat - 110, // 131: ateapi.VersionedSandboxCompat.attributes:type_name -> ateapi.AttributeEntry - 35, // 132: ateapi.WorkerResources.resources:type_name -> ateapi.Resources - 14, // 133: ateapi.ActorAssignment.metadata:type_name -> ateapi.ResourceMetadata - 33, // 134: ateapi.ActorAssignment.actor:type_name -> ateapi.ObjectRef - 35, // 135: ateapi.ActorAssignment.resources:type_name -> ateapi.Resources - 33, // 136: ateapi.RegisterWorkerRequest.worker:type_name -> ateapi.ObjectRef - 111, // 137: ateapi.RegisterWorkerRequest.capacity:type_name -> ateapi.WorkerResources - 108, // 138: ateapi.RegisterWorkerRequest.default_runtime:type_name -> ateapi.SandboxRuntime - 108, // 139: ateapi.RegisterWorkerRequest.restorable_runtimes:type_name -> ateapi.SandboxRuntime - 106, // 140: ateapi.RegisterWorkerResponse.worker:type_name -> ateapi.Worker - 33, // 141: ateapi.MintAteomActorCertificateRequest.actor:type_name -> ateapi.ObjectRef - 33, // 142: ateapi.RequestActorSuspendRequest.worker:type_name -> ateapi.ObjectRef - 33, // 143: ateapi.RequestActorSuspendRequest.actor:type_name -> ateapi.ObjectRef - 16, // 144: ateapi.RequestActorSuspendResponse.actor:type_name -> ateapi.Actor - 14, // 145: ateapi.AccessPolicy.metadata:type_name -> ateapi.ResourceMetadata - 120, // 146: ateapi.AccessPolicy.bindings:type_name -> ateapi.Binding - 119, // 147: ateapi.CreateGlobalAccessPolicyRequest.access_policy:type_name -> ateapi.AccessPolicy - 119, // 148: ateapi.UpdateGlobalAccessPolicyRequest.access_policy:type_name -> ateapi.AccessPolicy - 33, // 149: ateapi.GetAtespaceAccessPolicyRequest.atespace:type_name -> ateapi.ObjectRef - 33, // 150: ateapi.CreateAtespaceAccessPolicyRequest.atespace:type_name -> ateapi.ObjectRef - 119, // 151: ateapi.CreateAtespaceAccessPolicyRequest.access_policy:type_name -> ateapi.AccessPolicy - 33, // 152: ateapi.UpdateAtespaceAccessPolicyRequest.atespace:type_name -> ateapi.ObjectRef - 119, // 153: ateapi.UpdateAtespaceAccessPolicyRequest.access_policy:type_name -> ateapi.AccessPolicy - 33, // 154: ateapi.DeleteAtespaceAccessPolicyRequest.atespace:type_name -> ateapi.ObjectRef - 94, // 155: ateapi.DeleteAtespaceAccessPolicyRequest.options:type_name -> ateapi.DeleteOptions - 68, // 156: ateapi.Control.GetActor:input_type -> ateapi.GetActorRequest - 69, // 157: ateapi.Control.CreateActor:input_type -> ateapi.CreateActorRequest - 70, // 158: ateapi.Control.UpdateActor:input_type -> ateapi.UpdateActorRequest - 71, // 159: ateapi.Control.SuspendActor:input_type -> ateapi.SuspendActorRequest - 73, // 160: ateapi.Control.PauseActor:input_type -> ateapi.PauseActorRequest - 75, // 161: ateapi.Control.ResumeActor:input_type -> ateapi.ResumeActorRequest - 77, // 162: ateapi.Control.RevertActor:input_type -> ateapi.RevertActorRequest - 79, // 163: ateapi.Control.DeleteActor:input_type -> ateapi.DeleteActorRequest - 80, // 164: ateapi.Control.GetActorEgressPolicy:input_type -> ateapi.GetActorEgressPolicyRequest - 81, // 165: ateapi.Control.CreateActorEgressPolicy:input_type -> ateapi.CreateActorEgressPolicyRequest - 82, // 166: ateapi.Control.UpdateActorEgressPolicy:input_type -> ateapi.UpdateActorEgressPolicyRequest - 83, // 167: ateapi.Control.DeleteActorEgressPolicy:input_type -> ateapi.DeleteActorEgressPolicyRequest - 85, // 168: ateapi.Control.MintActorJWT:input_type -> ateapi.MintActorJWTRequest - 87, // 169: ateapi.Control.MintActorCertificate:input_type -> ateapi.MintActorCertificateRequest - 91, // 170: ateapi.Control.CreateTag:input_type -> ateapi.CreateTagRequest - 84, // 171: ateapi.Control.GetTag:input_type -> ateapi.GetTagRequest - 89, // 172: ateapi.Control.ListTags:input_type -> ateapi.ListTagsRequest - 92, // 173: ateapi.Control.UpdateTag:input_type -> ateapi.UpdateTagRequest - 93, // 174: ateapi.Control.DeleteTag:input_type -> ateapi.DeleteTagRequest - 97, // 175: ateapi.Control.ListWorkers:input_type -> ateapi.ListWorkersRequest - 99, // 176: ateapi.Control.GetWorker:input_type -> ateapi.GetWorkerRequest - 100, // 177: ateapi.Control.CreateWorker:input_type -> ateapi.CreateWorkerRequest - 101, // 178: ateapi.Control.UpdateWorker:input_type -> ateapi.UpdateWorkerRequest - 102, // 179: ateapi.Control.DeleteWorker:input_type -> ateapi.DeleteWorkerRequest - 103, // 180: ateapi.Control.DrainWorker:input_type -> ateapi.DrainWorkerRequest - 95, // 181: ateapi.Control.ListWorkerActorAssignments:input_type -> ateapi.ListWorkerActorAssignmentsRequest - 104, // 182: ateapi.Control.ListActors:input_type -> ateapi.ListActorsRequest - 58, // 183: ateapi.Control.CreateAtespace:input_type -> ateapi.CreateAtespaceRequest - 59, // 184: ateapi.Control.GetAtespace:input_type -> ateapi.GetAtespaceRequest - 60, // 185: ateapi.Control.ListAtespaces:input_type -> ateapi.ListAtespacesRequest - 62, // 186: ateapi.Control.DeleteAtespace:input_type -> ateapi.DeleteAtespaceRequest - 63, // 187: ateapi.Control.CreateActorTemplate:input_type -> ateapi.CreateActorTemplateRequest - 64, // 188: ateapi.Control.GetActorTemplate:input_type -> ateapi.GetActorTemplateRequest - 65, // 189: ateapi.Control.ListActorTemplates:input_type -> ateapi.ListActorTemplatesRequest - 67, // 190: ateapi.Control.DeleteActorTemplate:input_type -> ateapi.DeleteActorTemplateRequest - 121, // 191: ateapi.Control.GetGlobalAccessPolicy:input_type -> ateapi.GetGlobalAccessPolicyRequest - 122, // 192: ateapi.Control.CreateGlobalAccessPolicy:input_type -> ateapi.CreateGlobalAccessPolicyRequest - 123, // 193: ateapi.Control.UpdateGlobalAccessPolicy:input_type -> ateapi.UpdateGlobalAccessPolicyRequest - 124, // 194: ateapi.Control.GetAtespaceAccessPolicy:input_type -> ateapi.GetAtespaceAccessPolicyRequest - 125, // 195: ateapi.Control.CreateAtespaceAccessPolicy:input_type -> ateapi.CreateAtespaceAccessPolicyRequest - 126, // 196: ateapi.Control.UpdateAtespaceAccessPolicy:input_type -> ateapi.UpdateAtespaceAccessPolicyRequest - 127, // 197: ateapi.Control.DeleteAtespaceAccessPolicy:input_type -> ateapi.DeleteAtespaceAccessPolicyRequest - 113, // 198: ateapi.WorkerService.RegisterWorker:input_type -> ateapi.RegisterWorkerRequest - 115, // 199: ateapi.WorkerService.MintAteomActorCertificate:input_type -> ateapi.MintAteomActorCertificateRequest - 117, // 200: ateapi.WorkerService.RequestActorSuspend:input_type -> ateapi.RequestActorSuspendRequest - 16, // 201: ateapi.Control.GetActor:output_type -> ateapi.Actor - 16, // 202: ateapi.Control.CreateActor:output_type -> ateapi.Actor - 16, // 203: ateapi.Control.UpdateActor:output_type -> ateapi.Actor - 72, // 204: ateapi.Control.SuspendActor:output_type -> ateapi.SuspendActorResponse - 74, // 205: ateapi.Control.PauseActor:output_type -> ateapi.PauseActorResponse - 76, // 206: ateapi.Control.ResumeActor:output_type -> ateapi.ResumeActorResponse - 78, // 207: ateapi.Control.RevertActor:output_type -> ateapi.RevertActorResponse - 16, // 208: ateapi.Control.DeleteActor:output_type -> ateapi.Actor - 17, // 209: ateapi.Control.GetActorEgressPolicy:output_type -> ateapi.EgressPolicy - 17, // 210: ateapi.Control.CreateActorEgressPolicy:output_type -> ateapi.EgressPolicy - 17, // 211: ateapi.Control.UpdateActorEgressPolicy:output_type -> ateapi.EgressPolicy - 17, // 212: ateapi.Control.DeleteActorEgressPolicy:output_type -> ateapi.EgressPolicy - 86, // 213: ateapi.Control.MintActorJWT:output_type -> ateapi.MintActorJWTResponse - 88, // 214: ateapi.Control.MintActorCertificate:output_type -> ateapi.MintActorCertificateResponse - 31, // 215: ateapi.Control.CreateTag:output_type -> ateapi.Tag - 31, // 216: ateapi.Control.GetTag:output_type -> ateapi.Tag - 90, // 217: ateapi.Control.ListTags:output_type -> ateapi.ListTagsResponse - 31, // 218: ateapi.Control.UpdateTag:output_type -> ateapi.Tag - 31, // 219: ateapi.Control.DeleteTag:output_type -> ateapi.Tag - 98, // 220: ateapi.Control.ListWorkers:output_type -> ateapi.ListWorkersResponse - 106, // 221: ateapi.Control.GetWorker:output_type -> ateapi.Worker - 106, // 222: ateapi.Control.CreateWorker:output_type -> ateapi.Worker - 106, // 223: ateapi.Control.UpdateWorker:output_type -> ateapi.Worker - 106, // 224: ateapi.Control.DeleteWorker:output_type -> ateapi.Worker - 106, // 225: ateapi.Control.DrainWorker:output_type -> ateapi.Worker - 96, // 226: ateapi.Control.ListWorkerActorAssignments:output_type -> ateapi.ListWorkerActorAssignmentsResponse - 105, // 227: ateapi.Control.ListActors:output_type -> ateapi.ListActorsResponse - 32, // 228: ateapi.Control.CreateAtespace:output_type -> ateapi.Atespace - 32, // 229: ateapi.Control.GetAtespace:output_type -> ateapi.Atespace - 61, // 230: ateapi.Control.ListAtespaces:output_type -> ateapi.ListAtespacesResponse - 32, // 231: ateapi.Control.DeleteAtespace:output_type -> ateapi.Atespace - 34, // 232: ateapi.Control.CreateActorTemplate:output_type -> ateapi.ActorTemplate - 34, // 233: ateapi.Control.GetActorTemplate:output_type -> ateapi.ActorTemplate - 66, // 234: ateapi.Control.ListActorTemplates:output_type -> ateapi.ListActorTemplatesResponse - 34, // 235: ateapi.Control.DeleteActorTemplate:output_type -> ateapi.ActorTemplate - 119, // 236: ateapi.Control.GetGlobalAccessPolicy:output_type -> ateapi.AccessPolicy - 119, // 237: ateapi.Control.CreateGlobalAccessPolicy:output_type -> ateapi.AccessPolicy - 119, // 238: ateapi.Control.UpdateGlobalAccessPolicy:output_type -> ateapi.AccessPolicy - 119, // 239: ateapi.Control.GetAtespaceAccessPolicy:output_type -> ateapi.AccessPolicy - 119, // 240: ateapi.Control.CreateAtespaceAccessPolicy:output_type -> ateapi.AccessPolicy - 119, // 241: ateapi.Control.UpdateAtespaceAccessPolicy:output_type -> ateapi.AccessPolicy - 119, // 242: ateapi.Control.DeleteAtespaceAccessPolicy:output_type -> ateapi.AccessPolicy - 114, // 243: ateapi.WorkerService.RegisterWorker:output_type -> ateapi.RegisterWorkerResponse - 116, // 244: ateapi.WorkerService.MintAteomActorCertificate:output_type -> ateapi.MintAteomActorCertificateResponse - 118, // 245: ateapi.WorkerService.RequestActorSuspend:output_type -> ateapi.RequestActorSuspendResponse - 201, // [201:246] is the sub-list for method output_type - 156, // [156:201] is the sub-list for method input_type - 156, // [156:156] is the sub-list for extension type_name - 156, // [156:156] is the sub-list for extension extendee - 0, // [0:156] is the sub-list for field type_name + 19, // 16: ateapi.EgressPolicy.rules:type_name -> ateapi.EgressRule + 19, // 17: ateapi.EgressPolicyTemplate.rules:type_name -> ateapi.EgressRule + 20, // 18: ateapi.EgressRule.http:type_name -> ateapi.HTTPRule + 21, // 19: ateapi.EgressRule.https:type_name -> ateapi.HTTPSRule + 22, // 20: ateapi.EgressRule.tls_passthrough:type_name -> ateapi.TLSPassthroughRule + 23, // 21: ateapi.HTTPRule.ports:type_name -> ateapi.Ports + 25, // 22: ateapi.HTTPRule.effects:type_name -> ateapi.HttpRuleEffects + 23, // 23: ateapi.HTTPSRule.ports:type_name -> ateapi.Ports + 25, // 24: ateapi.HTTPSRule.effects:type_name -> ateapi.HttpRuleEffects + 23, // 25: ateapi.TLSPassthroughRule.ports:type_name -> ateapi.Ports + 24, // 26: ateapi.Ports.all:type_name -> ateapi.AllPorts + 26, // 27: ateapi.HttpRuleEffects.replace_headers:type_name -> ateapi.CredentialHeader + 27, // 28: ateapi.CredentialHeader.actor_jwt:type_name -> ateapi.ActorJWTSource + 4, // 29: ateapi.ActorStatus.state:type_name -> ateapi.ActorState + 30, // 30: ateapi.ActorStatus.worker_assignment:type_name -> ateapi.WorkerAssignment + 15, // 31: ateapi.ActorStatus.external_volumes:type_name -> ateapi.ExternalVolume + 29, // 32: ateapi.ActorStatus.crash:type_name -> ateapi.ActorCrash + 12, // 33: ateapi.ActorStatus.snapshots:type_name -> ateapi.Snapshot + 132, // 34: ateapi.ActorCrash.crash_time:type_name -> google.protobuf.Timestamp + 34, // 35: ateapi.WorkerAssignment.worker:type_name -> ateapi.ObjectRef + 12, // 36: ateapi.TagStatus.snapshot:type_name -> ateapi.Snapshot + 14, // 37: ateapi.Tag.metadata:type_name -> ateapi.ResourceMetadata + 31, // 38: ateapi.Tag.status:type_name -> ateapi.TagStatus + 3, // 39: ateapi.Tag.scope:type_name -> ateapi.TagScope + 34, // 40: ateapi.Tag.source_actor:type_name -> ateapi.ObjectRef + 14, // 41: ateapi.Atespace.metadata:type_name -> ateapi.ResourceMetadata + 14, // 42: ateapi.ActorTemplate.metadata:type_name -> ateapi.ResourceMetadata + 13, // 43: ateapi.ActorTemplate.worker_selector:type_name -> ateapi.Selector + 43, // 44: ateapi.ActorTemplate.containers:type_name -> ateapi.Container + 49, // 45: ateapi.ActorTemplate.volumes:type_name -> ateapi.Volume + 41, // 46: ateapi.ActorTemplate.snapshot_config:type_name -> ateapi.SnapshotConfig + 40, // 47: ateapi.ActorTemplate.sandbox_config:type_name -> ateapi.SandboxConfig + 36, // 48: ateapi.ActorTemplate.resources:type_name -> ateapi.Resources + 39, // 49: ateapi.ActorTemplate.status:type_name -> ateapi.ActorTemplateStatus + 18, // 50: ateapi.ActorTemplate.default_egress_policy:type_name -> ateapi.EgressPolicyTemplate + 37, // 51: ateapi.Resources.limits:type_name -> ateapi.Limits + 34, // 52: ateapi.GoldenSnapshotStatus.golden_tag:type_name -> ateapi.ObjectRef + 132, // 53: ateapi.GoldenSnapshotStatus.take_golden_snapshot_at:type_name -> google.protobuf.Timestamp + 38, // 54: ateapi.ActorTemplateStatus.golden_snapshot_status:type_name -> ateapi.GoldenSnapshotStatus + 5, // 55: ateapi.SandboxConfig.sandbox_class:type_name -> ateapi.SandboxClass + 2, // 56: ateapi.SnapshotConfig.preferred_fidelity:type_name -> ateapi.SnapshotFidelity + 42, // 57: ateapi.SnapshotConfig.golden_snapshot_config:type_name -> ateapi.GoldenSnapshotConfig + 6, // 58: ateapi.GoldenSnapshotConfig.mode:type_name -> ateapi.GoldenSnapshotMode + 46, // 59: ateapi.Container.env:type_name -> ateapi.EnvVar + 47, // 60: ateapi.Container.wakeup_probe:type_name -> ateapi.ContainerWakeupProbe + 58, // 61: ateapi.Container.volume_mounts:type_name -> ateapi.VolumeMount + 44, // 62: ateapi.Container.security_context:type_name -> ateapi.SecurityContext + 36, // 63: ateapi.Container.resources:type_name -> ateapi.Resources + 45, // 64: ateapi.SecurityContext.capabilities:type_name -> ateapi.Capabilities + 48, // 65: ateapi.ContainerWakeupProbe.http_get:type_name -> ateapi.HTTPGetAction + 51, // 66: ateapi.Volume.durable_dir:type_name -> ateapi.DurableDirVolumeSource + 52, // 67: ateapi.Volume.external_volume_template:type_name -> ateapi.ExternalVolumeTemplate + 53, // 68: ateapi.Volume.system_info:type_name -> ateapi.SystemInfoVolumeSource + 50, // 69: ateapi.Volume.image:type_name -> ateapi.ImageVolumeSource + 54, // 70: ateapi.SystemInfoVolumeSource.data_sources:type_name -> ateapi.SystemInfoDataSource + 55, // 71: ateapi.SystemInfoDataSource.actor_metadata:type_name -> ateapi.ActorMetadataDataSource + 57, // 72: ateapi.SystemInfoDataSource.trust_bundle:type_name -> ateapi.TrustBundleDataSource + 56, // 73: ateapi.ActorMetadataDataSource.items:type_name -> ateapi.ActorMetadataItem + 7, // 74: ateapi.ActorMetadataItem.field:type_name -> ateapi.ActorMetadataField + 33, // 75: ateapi.CreateAtespaceRequest.atespace:type_name -> ateapi.Atespace + 34, // 76: ateapi.GetAtespaceRequest.atespace:type_name -> ateapi.ObjectRef + 33, // 77: ateapi.ListAtespacesResponse.atespaces:type_name -> ateapi.Atespace + 34, // 78: ateapi.DeleteAtespaceRequest.atespace:type_name -> ateapi.ObjectRef + 95, // 79: ateapi.DeleteAtespaceRequest.options:type_name -> ateapi.DeleteOptions + 35, // 80: ateapi.CreateActorTemplateRequest.actor_template:type_name -> ateapi.ActorTemplate + 34, // 81: ateapi.GetActorTemplateRequest.actor_template:type_name -> ateapi.ObjectRef + 35, // 82: ateapi.ListActorTemplatesResponse.actor_templates:type_name -> ateapi.ActorTemplate + 34, // 83: ateapi.DeleteActorTemplateRequest.actor_template:type_name -> ateapi.ObjectRef + 95, // 84: ateapi.DeleteActorTemplateRequest.options:type_name -> ateapi.DeleteOptions + 34, // 85: ateapi.GetActorRequest.actor:type_name -> ateapi.ObjectRef + 16, // 86: ateapi.CreateActorRequest.actor:type_name -> ateapi.Actor + 16, // 87: ateapi.UpdateActorRequest.actor:type_name -> ateapi.Actor + 34, // 88: ateapi.SuspendActorRequest.actor:type_name -> ateapi.ObjectRef + 16, // 89: ateapi.SuspendActorResponse.actor:type_name -> ateapi.Actor + 34, // 90: ateapi.PauseActorRequest.actor:type_name -> ateapi.ObjectRef + 16, // 91: ateapi.PauseActorResponse.actor:type_name -> ateapi.Actor + 34, // 92: ateapi.ResumeActorRequest.actor:type_name -> ateapi.ObjectRef + 16, // 93: ateapi.ResumeActorResponse.actor:type_name -> ateapi.Actor + 34, // 94: ateapi.RevertActorRequest.actor:type_name -> ateapi.ObjectRef + 16, // 95: ateapi.RevertActorResponse.actor:type_name -> ateapi.Actor + 34, // 96: ateapi.DeleteActorRequest.actor:type_name -> ateapi.ObjectRef + 95, // 97: ateapi.DeleteActorRequest.options:type_name -> ateapi.DeleteOptions + 34, // 98: ateapi.GetActorEgressPolicyRequest.actor:type_name -> ateapi.ObjectRef + 34, // 99: ateapi.CreateActorEgressPolicyRequest.actor:type_name -> ateapi.ObjectRef + 17, // 100: ateapi.CreateActorEgressPolicyRequest.egress_policy:type_name -> ateapi.EgressPolicy + 34, // 101: ateapi.UpdateActorEgressPolicyRequest.actor:type_name -> ateapi.ObjectRef + 17, // 102: ateapi.UpdateActorEgressPolicyRequest.egress_policy:type_name -> ateapi.EgressPolicy + 34, // 103: ateapi.DeleteActorEgressPolicyRequest.actor:type_name -> ateapi.ObjectRef + 95, // 104: ateapi.DeleteActorEgressPolicyRequest.options:type_name -> ateapi.DeleteOptions + 34, // 105: ateapi.GetTagRequest.tag:type_name -> ateapi.ObjectRef + 34, // 106: ateapi.MintActorJWTRequest.actor:type_name -> ateapi.ObjectRef + 132, // 107: ateapi.MintActorJWTResponse.expires_at:type_name -> google.protobuf.Timestamp + 34, // 108: ateapi.MintActorCertificateRequest.actor:type_name -> ateapi.ObjectRef + 32, // 109: ateapi.ListTagsResponse.tags:type_name -> ateapi.Tag + 32, // 110: ateapi.CreateTagRequest.tag:type_name -> ateapi.Tag + 32, // 111: ateapi.UpdateTagRequest.tag:type_name -> ateapi.Tag + 34, // 112: ateapi.DeleteTagRequest.tag:type_name -> ateapi.ObjectRef + 95, // 113: ateapi.DeleteTagRequest.options:type_name -> ateapi.DeleteOptions + 34, // 114: ateapi.ListWorkerActorAssignmentsRequest.worker:type_name -> ateapi.ObjectRef + 113, // 115: ateapi.ListWorkerActorAssignmentsResponse.actor_assignments:type_name -> ateapi.ActorAssignment + 107, // 116: ateapi.ListWorkersResponse.workers:type_name -> ateapi.Worker + 34, // 117: ateapi.GetWorkerRequest.worker:type_name -> ateapi.ObjectRef + 107, // 118: ateapi.CreateWorkerRequest.worker:type_name -> ateapi.Worker + 107, // 119: ateapi.UpdateWorkerRequest.worker:type_name -> ateapi.Worker + 34, // 120: ateapi.DeleteWorkerRequest.worker:type_name -> ateapi.ObjectRef + 95, // 121: ateapi.DeleteWorkerRequest.options:type_name -> ateapi.DeleteOptions + 34, // 122: ateapi.DrainWorkerRequest.worker:type_name -> ateapi.ObjectRef + 16, // 123: ateapi.ListActorsResponse.actors:type_name -> ateapi.Actor + 14, // 124: ateapi.Worker.metadata:type_name -> ateapi.ResourceMetadata + 131, // 125: ateapi.Worker.labels:type_name -> ateapi.Worker.LabelsEntry + 108, // 126: ateapi.Worker.status:type_name -> ateapi.WorkerStatus + 8, // 127: ateapi.WorkerStatus.state:type_name -> ateapi.WorkerState + 112, // 128: ateapi.WorkerStatus.capacity:type_name -> ateapi.WorkerResources + 112, // 129: ateapi.WorkerStatus.allocated:type_name -> ateapi.WorkerResources + 109, // 130: ateapi.WorkerStatus.default_runtime:type_name -> ateapi.SandboxRuntime + 109, // 131: ateapi.WorkerStatus.restorable_runtimes:type_name -> ateapi.SandboxRuntime + 110, // 132: ateapi.SandboxRuntime.version:type_name -> ateapi.VersionedSandboxCompat + 111, // 133: ateapi.VersionedSandboxCompat.attributes:type_name -> ateapi.AttributeEntry + 36, // 134: ateapi.WorkerResources.resources:type_name -> ateapi.Resources + 14, // 135: ateapi.ActorAssignment.metadata:type_name -> ateapi.ResourceMetadata + 34, // 136: ateapi.ActorAssignment.actor:type_name -> ateapi.ObjectRef + 36, // 137: ateapi.ActorAssignment.resources:type_name -> ateapi.Resources + 34, // 138: ateapi.RegisterWorkerRequest.worker:type_name -> ateapi.ObjectRef + 112, // 139: ateapi.RegisterWorkerRequest.capacity:type_name -> ateapi.WorkerResources + 109, // 140: ateapi.RegisterWorkerRequest.default_runtime:type_name -> ateapi.SandboxRuntime + 109, // 141: ateapi.RegisterWorkerRequest.restorable_runtimes:type_name -> ateapi.SandboxRuntime + 107, // 142: ateapi.RegisterWorkerResponse.worker:type_name -> ateapi.Worker + 34, // 143: ateapi.MintAteomActorCertificateRequest.actor:type_name -> ateapi.ObjectRef + 34, // 144: ateapi.RequestActorSuspendRequest.worker:type_name -> ateapi.ObjectRef + 34, // 145: ateapi.RequestActorSuspendRequest.actor:type_name -> ateapi.ObjectRef + 16, // 146: ateapi.RequestActorSuspendResponse.actor:type_name -> ateapi.Actor + 14, // 147: ateapi.AccessPolicy.metadata:type_name -> ateapi.ResourceMetadata + 121, // 148: ateapi.AccessPolicy.bindings:type_name -> ateapi.Binding + 120, // 149: ateapi.CreateGlobalAccessPolicyRequest.access_policy:type_name -> ateapi.AccessPolicy + 120, // 150: ateapi.UpdateGlobalAccessPolicyRequest.access_policy:type_name -> ateapi.AccessPolicy + 34, // 151: ateapi.GetAtespaceAccessPolicyRequest.atespace:type_name -> ateapi.ObjectRef + 34, // 152: ateapi.CreateAtespaceAccessPolicyRequest.atespace:type_name -> ateapi.ObjectRef + 120, // 153: ateapi.CreateAtespaceAccessPolicyRequest.access_policy:type_name -> ateapi.AccessPolicy + 34, // 154: ateapi.UpdateAtespaceAccessPolicyRequest.atespace:type_name -> ateapi.ObjectRef + 120, // 155: ateapi.UpdateAtespaceAccessPolicyRequest.access_policy:type_name -> ateapi.AccessPolicy + 34, // 156: ateapi.DeleteAtespaceAccessPolicyRequest.atespace:type_name -> ateapi.ObjectRef + 95, // 157: ateapi.DeleteAtespaceAccessPolicyRequest.options:type_name -> ateapi.DeleteOptions + 69, // 158: ateapi.Control.GetActor:input_type -> ateapi.GetActorRequest + 70, // 159: ateapi.Control.CreateActor:input_type -> ateapi.CreateActorRequest + 71, // 160: ateapi.Control.UpdateActor:input_type -> ateapi.UpdateActorRequest + 72, // 161: ateapi.Control.SuspendActor:input_type -> ateapi.SuspendActorRequest + 74, // 162: ateapi.Control.PauseActor:input_type -> ateapi.PauseActorRequest + 76, // 163: ateapi.Control.ResumeActor:input_type -> ateapi.ResumeActorRequest + 78, // 164: ateapi.Control.RevertActor:input_type -> ateapi.RevertActorRequest + 80, // 165: ateapi.Control.DeleteActor:input_type -> ateapi.DeleteActorRequest + 81, // 166: ateapi.Control.GetActorEgressPolicy:input_type -> ateapi.GetActorEgressPolicyRequest + 82, // 167: ateapi.Control.CreateActorEgressPolicy:input_type -> ateapi.CreateActorEgressPolicyRequest + 83, // 168: ateapi.Control.UpdateActorEgressPolicy:input_type -> ateapi.UpdateActorEgressPolicyRequest + 84, // 169: ateapi.Control.DeleteActorEgressPolicy:input_type -> ateapi.DeleteActorEgressPolicyRequest + 86, // 170: ateapi.Control.MintActorJWT:input_type -> ateapi.MintActorJWTRequest + 88, // 171: ateapi.Control.MintActorCertificate:input_type -> ateapi.MintActorCertificateRequest + 92, // 172: ateapi.Control.CreateTag:input_type -> ateapi.CreateTagRequest + 85, // 173: ateapi.Control.GetTag:input_type -> ateapi.GetTagRequest + 90, // 174: ateapi.Control.ListTags:input_type -> ateapi.ListTagsRequest + 93, // 175: ateapi.Control.UpdateTag:input_type -> ateapi.UpdateTagRequest + 94, // 176: ateapi.Control.DeleteTag:input_type -> ateapi.DeleteTagRequest + 98, // 177: ateapi.Control.ListWorkers:input_type -> ateapi.ListWorkersRequest + 100, // 178: ateapi.Control.GetWorker:input_type -> ateapi.GetWorkerRequest + 101, // 179: ateapi.Control.CreateWorker:input_type -> ateapi.CreateWorkerRequest + 102, // 180: ateapi.Control.UpdateWorker:input_type -> ateapi.UpdateWorkerRequest + 103, // 181: ateapi.Control.DeleteWorker:input_type -> ateapi.DeleteWorkerRequest + 104, // 182: ateapi.Control.DrainWorker:input_type -> ateapi.DrainWorkerRequest + 96, // 183: ateapi.Control.ListWorkerActorAssignments:input_type -> ateapi.ListWorkerActorAssignmentsRequest + 105, // 184: ateapi.Control.ListActors:input_type -> ateapi.ListActorsRequest + 59, // 185: ateapi.Control.CreateAtespace:input_type -> ateapi.CreateAtespaceRequest + 60, // 186: ateapi.Control.GetAtespace:input_type -> ateapi.GetAtespaceRequest + 61, // 187: ateapi.Control.ListAtespaces:input_type -> ateapi.ListAtespacesRequest + 63, // 188: ateapi.Control.DeleteAtespace:input_type -> ateapi.DeleteAtespaceRequest + 64, // 189: ateapi.Control.CreateActorTemplate:input_type -> ateapi.CreateActorTemplateRequest + 65, // 190: ateapi.Control.GetActorTemplate:input_type -> ateapi.GetActorTemplateRequest + 66, // 191: ateapi.Control.ListActorTemplates:input_type -> ateapi.ListActorTemplatesRequest + 68, // 192: ateapi.Control.DeleteActorTemplate:input_type -> ateapi.DeleteActorTemplateRequest + 122, // 193: ateapi.Control.GetGlobalAccessPolicy:input_type -> ateapi.GetGlobalAccessPolicyRequest + 123, // 194: ateapi.Control.CreateGlobalAccessPolicy:input_type -> ateapi.CreateGlobalAccessPolicyRequest + 124, // 195: ateapi.Control.UpdateGlobalAccessPolicy:input_type -> ateapi.UpdateGlobalAccessPolicyRequest + 125, // 196: ateapi.Control.GetAtespaceAccessPolicy:input_type -> ateapi.GetAtespaceAccessPolicyRequest + 126, // 197: ateapi.Control.CreateAtespaceAccessPolicy:input_type -> ateapi.CreateAtespaceAccessPolicyRequest + 127, // 198: ateapi.Control.UpdateAtespaceAccessPolicy:input_type -> ateapi.UpdateAtespaceAccessPolicyRequest + 128, // 199: ateapi.Control.DeleteAtespaceAccessPolicy:input_type -> ateapi.DeleteAtespaceAccessPolicyRequest + 114, // 200: ateapi.WorkerService.RegisterWorker:input_type -> ateapi.RegisterWorkerRequest + 116, // 201: ateapi.WorkerService.MintAteomActorCertificate:input_type -> ateapi.MintAteomActorCertificateRequest + 118, // 202: ateapi.WorkerService.RequestActorSuspend:input_type -> ateapi.RequestActorSuspendRequest + 16, // 203: ateapi.Control.GetActor:output_type -> ateapi.Actor + 16, // 204: ateapi.Control.CreateActor:output_type -> ateapi.Actor + 16, // 205: ateapi.Control.UpdateActor:output_type -> ateapi.Actor + 73, // 206: ateapi.Control.SuspendActor:output_type -> ateapi.SuspendActorResponse + 75, // 207: ateapi.Control.PauseActor:output_type -> ateapi.PauseActorResponse + 77, // 208: ateapi.Control.ResumeActor:output_type -> ateapi.ResumeActorResponse + 79, // 209: ateapi.Control.RevertActor:output_type -> ateapi.RevertActorResponse + 16, // 210: ateapi.Control.DeleteActor:output_type -> ateapi.Actor + 17, // 211: ateapi.Control.GetActorEgressPolicy:output_type -> ateapi.EgressPolicy + 17, // 212: ateapi.Control.CreateActorEgressPolicy:output_type -> ateapi.EgressPolicy + 17, // 213: ateapi.Control.UpdateActorEgressPolicy:output_type -> ateapi.EgressPolicy + 17, // 214: ateapi.Control.DeleteActorEgressPolicy:output_type -> ateapi.EgressPolicy + 87, // 215: ateapi.Control.MintActorJWT:output_type -> ateapi.MintActorJWTResponse + 89, // 216: ateapi.Control.MintActorCertificate:output_type -> ateapi.MintActorCertificateResponse + 32, // 217: ateapi.Control.CreateTag:output_type -> ateapi.Tag + 32, // 218: ateapi.Control.GetTag:output_type -> ateapi.Tag + 91, // 219: ateapi.Control.ListTags:output_type -> ateapi.ListTagsResponse + 32, // 220: ateapi.Control.UpdateTag:output_type -> ateapi.Tag + 32, // 221: ateapi.Control.DeleteTag:output_type -> ateapi.Tag + 99, // 222: ateapi.Control.ListWorkers:output_type -> ateapi.ListWorkersResponse + 107, // 223: ateapi.Control.GetWorker:output_type -> ateapi.Worker + 107, // 224: ateapi.Control.CreateWorker:output_type -> ateapi.Worker + 107, // 225: ateapi.Control.UpdateWorker:output_type -> ateapi.Worker + 107, // 226: ateapi.Control.DeleteWorker:output_type -> ateapi.Worker + 107, // 227: ateapi.Control.DrainWorker:output_type -> ateapi.Worker + 97, // 228: ateapi.Control.ListWorkerActorAssignments:output_type -> ateapi.ListWorkerActorAssignmentsResponse + 106, // 229: ateapi.Control.ListActors:output_type -> ateapi.ListActorsResponse + 33, // 230: ateapi.Control.CreateAtespace:output_type -> ateapi.Atespace + 33, // 231: ateapi.Control.GetAtespace:output_type -> ateapi.Atespace + 62, // 232: ateapi.Control.ListAtespaces:output_type -> ateapi.ListAtespacesResponse + 33, // 233: ateapi.Control.DeleteAtespace:output_type -> ateapi.Atespace + 35, // 234: ateapi.Control.CreateActorTemplate:output_type -> ateapi.ActorTemplate + 35, // 235: ateapi.Control.GetActorTemplate:output_type -> ateapi.ActorTemplate + 67, // 236: ateapi.Control.ListActorTemplates:output_type -> ateapi.ListActorTemplatesResponse + 35, // 237: ateapi.Control.DeleteActorTemplate:output_type -> ateapi.ActorTemplate + 120, // 238: ateapi.Control.GetGlobalAccessPolicy:output_type -> ateapi.AccessPolicy + 120, // 239: ateapi.Control.CreateGlobalAccessPolicy:output_type -> ateapi.AccessPolicy + 120, // 240: ateapi.Control.UpdateGlobalAccessPolicy:output_type -> ateapi.AccessPolicy + 120, // 241: ateapi.Control.GetAtespaceAccessPolicy:output_type -> ateapi.AccessPolicy + 120, // 242: ateapi.Control.CreateAtespaceAccessPolicy:output_type -> ateapi.AccessPolicy + 120, // 243: ateapi.Control.UpdateAtespaceAccessPolicy:output_type -> ateapi.AccessPolicy + 120, // 244: ateapi.Control.DeleteAtespaceAccessPolicy:output_type -> ateapi.AccessPolicy + 115, // 245: ateapi.WorkerService.RegisterWorker:output_type -> ateapi.RegisterWorkerResponse + 117, // 246: ateapi.WorkerService.MintAteomActorCertificate:output_type -> ateapi.MintAteomActorCertificateResponse + 119, // 247: ateapi.WorkerService.RequestActorSuspend:output_type -> ateapi.RequestActorSuspendResponse + 203, // [203:248] is the sub-list for method output_type + 158, // [158:203] is the sub-list for method input_type + 158, // [158:158] is the sub-list for extension type_name + 158, // [158:158] is the sub-list for extension extendee + 0, // [0:158] is the sub-list for field type_name } func init() { file_ateapi_proto_init() } @@ -9442,7 +9518,7 @@ func file_ateapi_proto_init() { GoPackagePath: reflect.TypeOf(x{}).PkgPath(), RawDescriptor: unsafe.Slice(unsafe.StringData(file_ateapi_proto_rawDesc), len(file_ateapi_proto_rawDesc)), NumEnums: 10, - NumMessages: 121, + NumMessages: 122, NumExtensions: 0, NumServices: 2, }, diff --git a/pkg/proto/ateapipb/ateapi.proto b/pkg/proto/ateapipb/ateapi.proto index 232bd44dcd..22c5c3ec0e 100644 --- a/pkg/proto/ateapipb/ateapi.proto +++ b/pkg/proto/ateapipb/ateapi.proto @@ -509,6 +509,20 @@ message EgressPolicy { repeated EgressRule rules = 2; } +// EgressPolicyTemplate defines an initial Actor egress policy without resource +// metadata. Rules have the same defaults, validation, and semantics as +// EgressPolicy.rules. +message EgressPolicyTemplate { + // Rules are an unordered set of allows, with the same precedence and effects + // as EgressPolicy.rules. Traffic is denied when no rule matches. + // + // +k8s:optional + // +k8s:maxItems=256 + // +k8s:listType=atomic + // +k8s:customValidation # no two rules tie on a name and port + repeated EgressRule rules = 1; +} + // EgressRule allows traffic for a given protocol and destination (host name // or IP, and port). The protocol fixes what the gateway matches on and when: // a request, or a TLS connection at its ClientHello. Traffic that matches no @@ -1033,6 +1047,16 @@ message ActorTemplate { // +k8s:optional ActorTemplateStatus status = 8; + + // Initial egress policy, copied atomically when an Actor is created from + // this template, including the golden Actor used for initialization. The + // policy is named "default" in the Actor's atespace, with its own metadata. + // Callers may update or delete the copy independently; changing the Actor's + // template does not update its policy. If absent, no policy is created; + // an empty block creates a policy with no rules. + // + // +k8s:optional + EgressPolicyTemplate default_egress_policy = 9; } message Resources { From 7ce531c47adbf11fc74d0fb5f9ec1a7dda3a8cd2 Mon Sep 17 00:00:00 2001 From: Eitan Yarmush Date: Tue, 6 Oct 2026 16:13:12 +0000 Subject: [PATCH 2/3] Limit template egress policies to golden initialization Expose golden_egress_policy for network access during golden initialization. Create its policy atomically with the golden actor while leaving ordinary actors, including golden snapshot restores, without an inherited runtime policy. Preserve absent and explicitly empty policies. Signed-off-by: Eitan Yarmush --- .../apivalidation/actor_template_test.go | 28 +++---- .../apivalidation/zz_generated.validation.go | 6 +- cmd/ateapi/internal/controlapi/actor.go | 2 +- cmd/ateapi/internal/controlapi/actor_test.go | 5 ++ .../controlapi/template_egress_test.go | 80 +++++++------------ cmd/ateapi/internal/defaults/defaults.go | 2 +- cmd/ateapi/internal/defaults/defaults_test.go | 4 +- docs/api-guide.md | 31 +++---- pkg/proto/ateapipb/ateapi.pb.go | 30 +++---- pkg/proto/ateapipb/ateapi.proto | 14 ++-- 10 files changed, 93 insertions(+), 109 deletions(-) diff --git a/cmd/ateapi/internal/apivalidation/actor_template_test.go b/cmd/ateapi/internal/apivalidation/actor_template_test.go index b75cae337f..9615f42de8 100644 --- a/cmd/ateapi/internal/apivalidation/actor_template_test.go +++ b/cmd/ateapi/internal/apivalidation/actor_template_test.go @@ -35,41 +35,41 @@ func TestValidateCreateActorTemplateRequest(t *testing.T) { &ateapipb.CreateActorTemplateRequest{ActorTemplate: validActorTemplate()}, nil, }, { - "valid default egress rules", + "valid golden egress rules", &ateapipb.CreateActorTemplateRequest{ActorTemplate: validActorTemplate(func(tmpl *ateapipb.ActorTemplate) { - tmpl.DefaultEgressPolicy = &ateapipb.EgressPolicyTemplate{Rules: []*ateapipb.EgressRule{{Http: &ateapipb.HTTPRule{Hostnames: []string{"api.example.com"}, Ports: &ateapipb.Ports{Numbers: []int32{80}}}}}} + tmpl.GoldenEgressPolicy = &ateapipb.EgressPolicyTemplate{Rules: []*ateapipb.EgressRule{{Http: &ateapipb.HTTPRule{Hostnames: []string{"api.example.com"}, Ports: &ateapipb.Ports{Numbers: []int32{80}}}}}} })}, nil, }, { - "empty default egress rules", + "empty golden egress rules", &ateapipb.CreateActorTemplateRequest{ActorTemplate: validActorTemplate(func(tmpl *ateapipb.ActorTemplate) { - tmpl.DefaultEgressPolicy = &ateapipb.EgressPolicyTemplate{} + tmpl.GoldenEgressPolicy = &ateapipb.EgressPolicyTemplate{} })}, nil, }, { - "invalid default egress hostname", + "invalid golden egress hostname", &ateapipb.CreateActorTemplateRequest{ActorTemplate: validActorTemplate(func(tmpl *ateapipb.ActorTemplate) { - tmpl.DefaultEgressPolicy = &ateapipb.EgressPolicyTemplate{Rules: []*ateapipb.EgressRule{{Http: &ateapipb.HTTPRule{Hostnames: []string{"bad/host"}, Ports: &ateapipb.Ports{Numbers: []int32{80}}}}}} + tmpl.GoldenEgressPolicy = &ateapipb.EgressPolicyTemplate{Rules: []*ateapipb.EgressRule{{Http: &ateapipb.HTTPRule{Hostnames: []string{"bad/host"}, Ports: &ateapipb.Ports{Numbers: []int32{80}}}}}} })}, - field.ErrorList{field.Invalid(field.NewPath("actor_template", "default_egress_policy", "rules").Index(0).Child("http", "hostnames").Index(0), nil, "")}, + field.ErrorList{field.Invalid(field.NewPath("actor_template", "golden_egress_policy", "rules").Index(0).Child("http", "hostnames").Index(0), nil, "")}, }, { - "default egress rules tie across protocols", + "golden egress rules tie across protocols", &ateapipb.CreateActorTemplateRequest{ActorTemplate: validActorTemplate(func(tmpl *ateapipb.ActorTemplate) { - tmpl.DefaultEgressPolicy = &ateapipb.EgressPolicyTemplate{Rules: []*ateapipb.EgressRule{ + tmpl.GoldenEgressPolicy = &ateapipb.EgressPolicyTemplate{Rules: []*ateapipb.EgressRule{ {Https: &ateapipb.HTTPSRule{Hostnames: []string{"api.example.com"}, Ports: &ateapipb.Ports{Numbers: []int32{443}}}}, {TlsPassthrough: &ateapipb.TLSPassthroughRule{Hostnames: []string{"api.example.com"}, Ports: &ateapipb.Ports{Numbers: []int32{443}}}}, }} })}, - field.ErrorList{field.Invalid(field.NewPath("actor_template", "default_egress_policy", "rules").Index(1).Child("tls_passthrough", "hostnames").Index(0), nil, "")}, + field.ErrorList{field.Invalid(field.NewPath("actor_template", "golden_egress_policy", "rules").Index(1).Child("tls_passthrough", "hostnames").Index(0), nil, "")}, }, { - "too many default egress rules", + "too many golden egress rules", &ateapipb.CreateActorTemplateRequest{ActorTemplate: validActorTemplate(func(tmpl *ateapipb.ActorTemplate) { - tmpl.DefaultEgressPolicy = &ateapipb.EgressPolicyTemplate{} + tmpl.GoldenEgressPolicy = &ateapipb.EgressPolicyTemplate{} for i := range 257 { - tmpl.DefaultEgressPolicy.Rules = append(tmpl.DefaultEgressPolicy.Rules, &ateapipb.EgressRule{Http: &ateapipb.HTTPRule{Hostnames: []string{fmt.Sprintf("host-%d.example.com", i)}, Ports: &ateapipb.Ports{Numbers: []int32{80}}}}) + tmpl.GoldenEgressPolicy.Rules = append(tmpl.GoldenEgressPolicy.Rules, &ateapipb.EgressRule{Http: &ateapipb.HTTPRule{Hostnames: []string{fmt.Sprintf("host-%d.example.com", i)}, Ports: &ateapipb.Ports{Numbers: []int32{80}}}}) } })}, - field.ErrorList{field.TooMany(field.NewPath("actor_template", "default_egress_policy", "rules"), 257, 256).WithOrigin("maxItems")}, + field.ErrorList{field.TooMany(field.NewPath("actor_template", "golden_egress_policy", "rules"), 257, 256).WithOrigin("maxItems")}, }, { "missing actor_template", &ateapipb.CreateActorTemplateRequest{}, diff --git a/cmd/ateapi/internal/apivalidation/zz_generated.validation.go b/cmd/ateapi/internal/apivalidation/zz_generated.validation.go index 294c61fddb..15331e8441 100644 --- a/cmd/ateapi/internal/apivalidation/zz_generated.validation.go +++ b/cmd/ateapi/internal/apivalidation/zz_generated.validation.go @@ -1202,7 +1202,7 @@ func Validate_ActorTemplate( errs = append(errs, fn(fldPath.Child("status"), obj.Status, oldVal, oldObj != nil)...) } - { // field ateapipb.ActorTemplate.DefaultEgressPolicy + { // field ateapipb.ActorTemplate.GoldenEgressPolicy fn := func( fldPath *field.Path, obj, oldObj *ateapipb.EgressPolicyTemplate, @@ -1227,9 +1227,9 @@ func Validate_ActorTemplate( } oldVal := safe.Field(oldObj, func(oldObj *ateapipb.ActorTemplate) *ateapipb.EgressPolicyTemplate { - return oldObj.DefaultEgressPolicy + return oldObj.GoldenEgressPolicy }) - errs = append(errs, fn(fldPath.Child("default_egress_policy"), obj.DefaultEgressPolicy, oldVal, oldObj != nil)...) + errs = append(errs, fn(fldPath.Child("golden_egress_policy"), obj.GoldenEgressPolicy, oldVal, oldObj != nil)...) } return errs diff --git a/cmd/ateapi/internal/controlapi/actor.go b/cmd/ateapi/internal/controlapi/actor.go index 564d5bbe45..e38991253e 100644 --- a/cmd/ateapi/internal/controlapi/actor.go +++ b/cmd/ateapi/internal/controlapi/actor.go @@ -148,7 +148,7 @@ func (s *ServiceImpl) CreateActor(ctx context.Context, inActor *ateapipb.Actor) // Save the data in the storage layer. var policy *ateapipb.EgressPolicy - if initial := template.GetDefaultEgressPolicy(); initial != nil { + if initial := template.GetGoldenEgressPolicy(); initial != nil && atespace == resources.GoldenActorAtespace { policy = &ateapipb.EgressPolicy{ Metadata: &ateapipb.ResourceMetadata{Atespace: atespace, Name: "default"}, Rules: initial.GetRules(), diff --git a/cmd/ateapi/internal/controlapi/actor_test.go b/cmd/ateapi/internal/controlapi/actor_test.go index e0310e0e91..52a905774e 100644 --- a/cmd/ateapi/internal/controlapi/actor_test.go +++ b/cmd/ateapi/internal/controlapi/actor_test.go @@ -21,6 +21,7 @@ import ( "crypto/rand" "crypto/tls" "crypto/x509" + "errors" "fmt" "strings" "testing" @@ -841,6 +842,7 @@ func TestCreateActor_GoldenTagDefault(t *testing.T) { } if _, err := persistence.UpdateActorTemplate(ctx, resources.ActorTemplateRefFromActorTemplate(tmpl), store.PreconditionFrom(tmpl), func(db *ateapipb.ActorTemplate) error { db.Status = &ateapipb.ActorTemplateStatus{GoldenSnapshotStatus: &ateapipb.GoldenSnapshotStatus{GoldenTag: ref}} + db.GoldenEgressPolicy = &ateapipb.EgressPolicyTemplate{Rules: []*ateapipb.EgressRule{{Https: &ateapipb.HTTPSRule{Hostnames: []string{"init.example.com"}, Ports: &ateapipb.Ports{Numbers: []int32{443}}}}}} return nil }); err != nil { t.Fatal(err) @@ -866,6 +868,9 @@ func TestCreateActor_GoldenTagDefault(t *testing.T) { if gotSnap.GetDurableSnapshot().GetObject().GetSnapshotUri() != tagDurableSnapshotURI(tag, ateapipb.SnapshotStorageStatus_SNAPSHOT_STORAGE_STATUS_COMPLETED) || gotSnap.GetActorTemplateUid() != tmpl.GetMetadata().GetUid() { t.Fatalf("incorrect initial status: %v", created.GetStatus()) } + if _, err := persistence.GetEgressPolicy(ctx, resources.ActorRefFromActor(created)); !errors.Is(err, store.ErrNotFound) { + t.Fatalf("actor restored from a tag inherited golden policy: %v, want NotFound", err) + } if scenario == "own snapshot" { uri, err := resources.NewActorSnapshotURI(tmpl.GetSnapshotConfig().GetStorageLocation(), "team-a", created.GetMetadata().GetUid(), "snapshot") if err != nil { diff --git a/cmd/ateapi/internal/controlapi/template_egress_test.go b/cmd/ateapi/internal/controlapi/template_egress_test.go index 6b9de6da70..970e3a198e 100644 --- a/cmd/ateapi/internal/controlapi/template_egress_test.go +++ b/cmd/ateapi/internal/controlapi/template_egress_test.go @@ -20,14 +20,14 @@ import ( "testing" "github.com/agent-substrate/substrate/cmd/ateapi/internal/store/storetest" + "github.com/agent-substrate/substrate/internal/apierror" "github.com/agent-substrate/substrate/internal/resources" "github.com/agent-substrate/substrate/pkg/proto/ateapipb" "google.golang.org/grpc/codes" - "google.golang.org/grpc/status" "google.golang.org/protobuf/proto" ) -func TestCreateActor_DefaultEgressPolicy(t *testing.T) { +func TestCreateActor_DoesNotInheritGoldenEgressPolicy(t *testing.T) { for _, tt := range []struct { name string policy *ateapipb.EgressPolicyTemplate @@ -47,65 +47,36 @@ func TestCreateActor_DefaultEgressPolicy(t *testing.T) { storetest.MustCreateAtespace(t, ctx, persistence, "actors") tmpl, err := svc.CreateActorTemplate(ctx, &ateapipb.CreateActorTemplateRequest{ActorTemplate: validActorTemplate(func(tmpl *ateapipb.ActorTemplate) { tmpl.Metadata = &ateapipb.ResourceMetadata{Atespace: "templates", Name: "tmpl"} - tmpl.DefaultEgressPolicy = tt.policy + tmpl.GoldenEgressPolicy = tt.policy })}) if err != nil { t.Fatal(err) } tmplRef := resources.ActorTemplateRefFromActorTemplate(tmpl).ToObjectRef() - var policies []*ateapipb.EgressPolicy - for _, name := range []string{"alpha", "beta"} { + for _, name := range []string{"alpha", tmpl.GetMetadata().GetUid()} { actor, err := svc.CreateActor(ctx, &ateapipb.CreateActorRequest{Actor: &ateapipb.Actor{ Metadata: &ateapipb.ResourceMetadata{Atespace: "actors", Name: name}, ActorTemplate: tmplRef, }}) if err != nil { t.Fatal(err) } - policy, err := svc.GetActorEgressPolicy(ctx, &ateapipb.GetActorEgressPolicyRequest{Actor: resources.ActorRefFromActor(actor).ToObjectRef()}) - if tt.policy == nil { - if status.Code(err) != codes.NotFound { - t.Fatalf("policy without default rules: %v, want NotFound", err) - } - continue - } - if err != nil { - t.Fatal(err) + ref := resources.ActorRefFromActor(actor).ToObjectRef() + if _, err := svc.GetActorEgressPolicy(ctx, &ateapipb.GetActorEgressPolicyRequest{Actor: ref}); apierror.Code(err) != codes.NotFound { + t.Fatalf("ordinary actor inherited golden policy: %v, want NotFound", err) } - md := policy.GetMetadata() - if md.GetAtespace() != "actors" || md.GetName() != "default" || md.GetUid() == "" || md.GetUid() == actor.GetMetadata().GetUid() || md.GetVersion() != 1 || md.GetCreateTime() == nil || md.GetUpdateTime() == nil { - t.Errorf("unexpected policy metadata: %v", md) - } - want := &ateapipb.EgressPolicy{Metadata: md, Rules: tmpl.GetDefaultEgressPolicy().GetRules()} - if !proto.Equal(policy, want) { - t.Errorf("policy = %v, want %v", policy, want) + if _, err := svc.CreateActorEgressPolicy(ctx, &ateapipb.CreateActorEgressPolicyRequest{ + Actor: ref, + EgressPolicy: &ateapipb.EgressPolicy{ + Metadata: &ateapipb.ResourceMetadata{Atespace: "actors", Name: "default"}, + Rules: []*ateapipb.EgressRule{{Https: &ateapipb.HTTPSRule{Hostnames: []string{"runtime.example.com"}}}}, + }, + }); err != nil { + t.Fatalf("creating the actor's runtime policy: %v", err) } - policies = append(policies, policy) - } - if len(policies) == 0 { - return - } - if policies[0].GetMetadata().GetUid() == policies[1].GetMetadata().GetUid() { - t.Fatal("actors share a policy UID") - } - - alpha := &ateapipb.ObjectRef{Atespace: "actors", Name: "alpha"} - policies[0].Rules = nil - if _, err := svc.UpdateActorEgressPolicy(ctx, &ateapipb.UpdateActorEgressPolicyRequest{Actor: alpha, EgressPolicy: policies[0]}); err != nil { - t.Fatal(err) - } - if _, err := svc.DeleteActorEgressPolicy(ctx, &ateapipb.DeleteActorEgressPolicyRequest{Actor: alpha}); err != nil { - t.Fatal(err) - } - if _, err := svc.GetActorEgressPolicy(ctx, &ateapipb.GetActorEgressPolicyRequest{Actor: alpha}); status.Code(err) != codes.NotFound { - t.Fatalf("deleted policy: %v, want NotFound", err) - } - betaPolicy, err := svc.GetActorEgressPolicy(ctx, &ateapipb.GetActorEgressPolicyRequest{Actor: &ateapipb.ObjectRef{Atespace: "actors", Name: "beta"}}) - if err != nil || !proto.Equal(betaPolicy, policies[1]) { - t.Fatalf("editing alpha changed beta's policy: %v, %v", betaPolicy, err) } gotTemplate, err := svc.GetActorTemplate(ctx, &ateapipb.GetActorTemplateRequest{ActorTemplate: tmplRef}) if err != nil || !proto.Equal(gotTemplate, tmpl) { - t.Fatalf("editing alpha changed the template: %v, %v", gotTemplate, err) + t.Fatalf("creating runtime policies changed the template: %v, %v", gotTemplate, err) } }) } @@ -120,7 +91,7 @@ func (c *goldenEgressControl) ResumeActor(ctx context.Context, req *ateapipb.Res return c.resume(ctx, req) } -func TestReconcileOne_DefaultEgressPolicyBeforeResume(t *testing.T) { +func TestReconcileOne_GoldenEgressPolicyBeforeResume(t *testing.T) { for _, tt := range []struct { name string policy *ateapipb.EgressPolicyTemplate @@ -136,7 +107,7 @@ func TestReconcileOne_DefaultEgressPolicyBeforeResume(t *testing.T) { storetest.MustCreateAtespace(t, ctx, persistence, "templates") tmpl, err := svc.CreateActorTemplate(ctx, &ateapipb.CreateActorTemplateRequest{ActorTemplate: validActorTemplate(func(tmpl *ateapipb.ActorTemplate) { tmpl.Metadata = &ateapipb.ResourceMetadata{Atespace: "templates", Name: "tmpl"} - tmpl.DefaultEgressPolicy = tt.policy + tmpl.GoldenEgressPolicy = tt.policy })}) if err != nil { t.Fatal(err) @@ -149,24 +120,29 @@ func TestReconcileOne_DefaultEgressPolicyBeforeResume(t *testing.T) { } policy, err := svc.GetActorEgressPolicy(ctx, &ateapipb.GetActorEgressPolicyRequest{Actor: ref}) if tt.policy == nil { - if status.Code(err) != codes.NotFound { - t.Fatalf("golden without default policy: %v, want NotFound", err) + if apierror.Code(err) != codes.NotFound { + t.Fatalf("golden without configured policy: %v, want NotFound", err) } return nil, stop } if err != nil { t.Fatalf("golden policy must exist before resume: %v", err) } - want := &ateapipb.EgressPolicy{Metadata: policy.Metadata, Rules: tmpl.GetDefaultEgressPolicy().GetRules()} + want := &ateapipb.EgressPolicy{Metadata: policy.Metadata, Rules: tmpl.GetGoldenEgressPolicy().GetRules()} if policy.GetMetadata().GetAtespace() != resources.GoldenActorAtespace || policy.GetMetadata().GetName() != "default" || !proto.Equal(policy, want) { t.Fatalf("golden policy = %v, want rules %v in ate-golden", policy, want.Rules) } + if md := policy.GetMetadata(); md.GetUid() == "" || md.GetVersion() != 1 || md.GetCreateTime() == nil || md.GetUpdateTime() == nil { + t.Errorf("unexpected policy metadata: %v", md) + } return nil, stop }} r := newTestTemplateReconciler(persistence, control) defer r.queue.ShutDown() - if _, err := r.reconcileOne(ctx, resources.ActorTemplateRefFromActorTemplate(tmpl)); !errors.Is(err, stop) { - t.Fatalf("reconcile = %v, want to reach resume with the policy present", err) + for range 2 { + if _, err := r.reconcileOne(ctx, resources.ActorTemplateRefFromActorTemplate(tmpl)); !errors.Is(err, stop) { + t.Fatalf("reconcile = %v, want to reach resume with the policy present", err) + } } }) } diff --git a/cmd/ateapi/internal/defaults/defaults.go b/cmd/ateapi/internal/defaults/defaults.go index a628507c61..66e97c18d1 100644 --- a/cmd/ateapi/internal/defaults/defaults.go +++ b/cmd/ateapi/internal/defaults/defaults.go @@ -52,7 +52,7 @@ func applyActorTemplateDefaults(t *ateapipb.ActorTemplate) { return } applySnapshotConfigDefaults(t.SnapshotConfig) - applyEgressRuleDefaults(t.GetDefaultEgressPolicy().GetRules()) + applyEgressRuleDefaults(t.GetGoldenEgressPolicy().GetRules()) for _, c := range t.Containers { applyContainerDefaults(c) } diff --git a/cmd/ateapi/internal/defaults/defaults_test.go b/cmd/ateapi/internal/defaults/defaults_test.go index c31c3f7708..22adb9fae8 100644 --- a/cmd/ateapi/internal/defaults/defaults_test.go +++ b/cmd/ateapi/internal/defaults/defaults_test.go @@ -132,13 +132,13 @@ func TestApply(t *testing.T) { }}, }, { name: "template defaults egress ports", - in: &ateapipb.ActorTemplate{DefaultEgressPolicy: &ateapipb.EgressPolicyTemplate{Rules: []*ateapipb.EgressRule{ + in: &ateapipb.ActorTemplate{GoldenEgressPolicy: &ateapipb.EgressPolicyTemplate{Rules: []*ateapipb.EgressRule{ {Http: &ateapipb.HTTPRule{Hostnames: []string{"api.example.com"}}}, {Https: &ateapipb.HTTPSRule{Hostnames: []string{"api.example.com"}}}, {Https: &ateapipb.HTTPSRule{Hostnames: []string{"custom.example.com"}, Ports: &ateapipb.Ports{Numbers: []int32{8443}}}}, {TlsPassthrough: &ateapipb.TLSPassthroughRule{Hostnames: []string{"tcp.example.com"}}}, }}}, - want: &ateapipb.ActorTemplate{DefaultEgressPolicy: &ateapipb.EgressPolicyTemplate{Rules: []*ateapipb.EgressRule{ + want: &ateapipb.ActorTemplate{GoldenEgressPolicy: &ateapipb.EgressPolicyTemplate{Rules: []*ateapipb.EgressRule{ {Http: &ateapipb.HTTPRule{Hostnames: []string{"api.example.com"}, Ports: &ateapipb.Ports{Numbers: []int32{80}}}}, {Https: &ateapipb.HTTPSRule{Hostnames: []string{"api.example.com"}, Ports: &ateapipb.Ports{Numbers: []int32{443}}}}, {Https: &ateapipb.HTTPSRule{Hostnames: []string{"custom.example.com"}, Ports: &ateapipb.Ports{Numbers: []int32{8443}}}}, diff --git a/docs/api-guide.md b/docs/api-guide.md index ccc486e1ab..e3668084e2 100644 --- a/docs/api-guide.md +++ b/docs/api-guide.md @@ -127,35 +127,38 @@ The `ActorTemplate` defines the code, environment, and state-management policies | `snapshotConfig` | `SnapshotConfig` | **Required.** The base object-storage location snapshots are written under, the snapshot fidelity (`preferredFidelity`) every Pause and Suspend captures (`SNAPSHOT_FIDELITY_ROOTFS` requires `sandboxClass: SANDBOX_CLASS_MICROVM`), and automated golden snapshot creation (`goldenSnapshotConfig.mode`). See [Snapshot Storage Layout](#snapshot-storage-layout). | | `volumes` | `[]Volume` | Optional. Volumes the containers may mount, each a `durableDir`, an `externalVolumeTemplate` (see [CSI Volumes Guide](csi-volumes.md)), or a `systemInfo` volume (see [SystemInfo Volumes](#systeminfo-volumes)). Every declared volume must be mounted by at least one container. A `microvm` template may declare several `durableDir` volumes; a `gvisor` template is limited to one. | | `resources` | `*ResourceRequirements` | Optional. Declares each actor's compute size via `limits` — see [Sandbox Right-Sizing](#sandbox-right-sizing-resources). Immutable, like the rest of the template. | -| `defaultEgressPolicy` | `EgressPolicyTemplate` | Optional. Initial egress policy copied when each actor is created, including the golden actor. Contains only `rules`, with the same defaults and validation as `EgressPolicy.rules`. See [Default Egress Policy](#default-egress-policy-defaultegresspolicy). | +| `goldenEgressPolicy` | `EgressPolicyTemplate` | Optional. Egress policy for the golden actor during initialization. Contains only `rules`, with the same defaults and validation as `EgressPolicy.rules`. See [Golden Egress Policy](#golden-egress-policy-goldenegresspolicy). | The sandbox itself — the binaries (e.g. the gVisor `runsc` binary) and the `pauseImage` holding the sandbox's namespaces — comes from the cluster-scoped [`SandboxConfig`](#3-sandboxconfig-the-sandbox-itself) object the template names via `sandboxConfig.configName`. An actor always resolves the config from its current template — repointing the actor at another template requires the same config. Because a snapshot is not restorable across sandbox runtimes, `sandboxClass` is a **hard scheduling gate**: an actor is only ever placed on a `WorkerPool` whose `sandboxClasses` entry matches. It is AND'd with `workerSelector` (and the actor's `worker_selector`), which can only narrow the eligible pools further. It has no default — `sandboxConfig` is required and its `sandboxClass` must be set — and, like the rest of the template, is immutable, so each template's class is fixed at creation. -### Default Egress Policy (`defaultEgressPolicy`) +### Golden Egress Policy (`goldenEgressPolicy`) -Set `defaultEgressPolicy` on an ActorTemplate to give its golden actor and each -new actor the same initial network access. For example, this template field +Set `goldenEgressPolicy` on an ActorTemplate to give its golden actor network +access during initialization. For example, this template field allows HTTPS to `api.example.com` on the default port, 443: ```yaml -defaultEgressPolicy: +goldenEgressPolicy: rules: - https: hostnames: [api.example.com] ``` -Actor creation atomically creates the actor and its `default` egress policy, -so the policy exists before golden initialization can start. Each policy uses -its actor's atespace (`ate-golden` for the golden actor) and receives its own -UID, version, and timestamps. The template field contains only rules. +The golden actor and its `default` egress policy are created atomically, +so the policy exists before golden initialization can start. The policy lives +in `ate-golden` and receives its own UID, version, and timestamps. The template +field contains only rules. -The rules are copied once at creation. Updating or deleting an actor's policy -does not affect the template or other actors. Changing an actor's template -does not replace its existing policy. Omitting `defaultEgressPolicy` creates -no policy. Setting it to `{}` creates an explicitly empty policy that allows -no destinations. +Actors created from the template start without an egress policy, including +actors restored from its golden snapshot. Configure their network access +separately with `CreateActorEgressPolicy`. + +The golden policy's rules are copied once at creation. Updating or deleting +that policy does not change the template. Omitting `goldenEgressPolicy` +creates no golden policy. Setting it to `{}` creates an explicitly empty +policy that allows no destinations. ### Sandbox Right-Sizing (`resources`) diff --git a/pkg/proto/ateapipb/ateapi.pb.go b/pkg/proto/ateapipb/ateapi.pb.go index b12094c634..9a22ee9b90 100644 --- a/pkg/proto/ateapipb/ateapi.pb.go +++ b/pkg/proto/ateapipb/ateapi.pb.go @@ -2678,17 +2678,17 @@ type ActorTemplate struct { Resources *Resources `protobuf:"bytes,7,opt,name=resources,proto3" json:"resources,omitempty"` // +k8s:optional Status *ActorTemplateStatus `protobuf:"bytes,8,opt,name=status,proto3" json:"status,omitempty"` - // Initial egress policy, copied atomically when an Actor is created from - // this template, including the golden Actor used for initialization. The - // policy is named "default" in the Actor's atespace, with its own metadata. - // Callers may update or delete the copy independently; changing the Actor's - // template does not update its policy. If absent, no policy is created; - // an empty block creates a policy with no rules. + // Egress policy for the golden Actor during initialization. Copied + // atomically when the golden Actor is created, as its "default" policy + // in the reserved ate-golden atespace. Actors created from this template + // do not inherit this policy, including when using the golden snapshot. + // If absent, no policy is created; an empty block creates a policy with + // no rules. // // +k8s:optional - DefaultEgressPolicy *EgressPolicyTemplate `protobuf:"bytes,9,opt,name=default_egress_policy,json=defaultEgressPolicy,proto3" json:"default_egress_policy,omitempty"` - unknownFields protoimpl.UnknownFields - sizeCache protoimpl.SizeCache + GoldenEgressPolicy *EgressPolicyTemplate `protobuf:"bytes,9,opt,name=golden_egress_policy,json=goldenEgressPolicy,proto3" json:"golden_egress_policy,omitempty"` + unknownFields protoimpl.UnknownFields + sizeCache protoimpl.SizeCache } func (x *ActorTemplate) Reset() { @@ -2777,9 +2777,9 @@ func (x *ActorTemplate) GetStatus() *ActorTemplateStatus { return nil } -func (x *ActorTemplate) GetDefaultEgressPolicy() *EgressPolicyTemplate { +func (x *ActorTemplate) GetGoldenEgressPolicy() *EgressPolicyTemplate { if x != nil { - return x.DefaultEgressPolicy + return x.GoldenEgressPolicy } return nil } @@ -8696,7 +8696,7 @@ const file_ateapi_proto_rawDesc = "" + "\bmetadata\x18\x01 \x01(\v2\x18.ateapi.ResourceMetadataR\bmetadata\";\n" + "\tObjectRef\x12\x1a\n" + "\batespace\x18\x01 \x01(\tR\batespace\x12\x12\n" + - "\x04name\x18\x02 \x01(\tR\x04name\"\x94\x04\n" + + "\x04name\x18\x02 \x01(\tR\x04name\"\x92\x04\n" + "\rActorTemplate\x124\n" + "\bmetadata\x18\x01 \x01(\v2\x18.ateapi.ResourceMetadataR\bmetadata\x129\n" + "\x0fworker_selector\x18\x02 \x01(\v2\x10.ateapi.SelectorR\x0eworkerSelector\x121\n" + @@ -8707,8 +8707,8 @@ const file_ateapi_proto_rawDesc = "" + "\x0fsnapshot_config\x18\x05 \x01(\v2\x16.ateapi.SnapshotConfigR\x0esnapshotConfig\x12<\n" + "\x0esandbox_config\x18\x06 \x01(\v2\x15.ateapi.SandboxConfigR\rsandboxConfig\x12/\n" + "\tresources\x18\a \x01(\v2\x11.ateapi.ResourcesR\tresources\x123\n" + - "\x06status\x18\b \x01(\v2\x1b.ateapi.ActorTemplateStatusR\x06status\x12P\n" + - "\x15default_egress_policy\x18\t \x01(\v2\x1c.ateapi.EgressPolicyTemplateR\x13defaultEgressPolicy\"3\n" + + "\x06status\x18\b \x01(\v2\x1b.ateapi.ActorTemplateStatusR\x06status\x12N\n" + + "\x14golden_egress_policy\x18\t \x01(\v2\x1c.ateapi.EgressPolicyTemplateR\x12goldenEgressPolicy\"3\n" + "\tResources\x12&\n" + "\x06limits\x18\x01 \x03(\v2\x0e.ateapi.LimitsR\x06limits\"8\n" + "\x06Limits\x12\x12\n" + @@ -9302,7 +9302,7 @@ var file_ateapi_proto_depIdxs = []int32{ 40, // 47: ateapi.ActorTemplate.sandbox_config:type_name -> ateapi.SandboxConfig 36, // 48: ateapi.ActorTemplate.resources:type_name -> ateapi.Resources 39, // 49: ateapi.ActorTemplate.status:type_name -> ateapi.ActorTemplateStatus - 18, // 50: ateapi.ActorTemplate.default_egress_policy:type_name -> ateapi.EgressPolicyTemplate + 18, // 50: ateapi.ActorTemplate.golden_egress_policy:type_name -> ateapi.EgressPolicyTemplate 37, // 51: ateapi.Resources.limits:type_name -> ateapi.Limits 34, // 52: ateapi.GoldenSnapshotStatus.golden_tag:type_name -> ateapi.ObjectRef 132, // 53: ateapi.GoldenSnapshotStatus.take_golden_snapshot_at:type_name -> google.protobuf.Timestamp diff --git a/pkg/proto/ateapipb/ateapi.proto b/pkg/proto/ateapipb/ateapi.proto index 22c5c3ec0e..098f77c040 100644 --- a/pkg/proto/ateapipb/ateapi.proto +++ b/pkg/proto/ateapipb/ateapi.proto @@ -1048,15 +1048,15 @@ message ActorTemplate { // +k8s:optional ActorTemplateStatus status = 8; - // Initial egress policy, copied atomically when an Actor is created from - // this template, including the golden Actor used for initialization. The - // policy is named "default" in the Actor's atespace, with its own metadata. - // Callers may update or delete the copy independently; changing the Actor's - // template does not update its policy. If absent, no policy is created; - // an empty block creates a policy with no rules. + // Egress policy for the golden Actor during initialization. Copied + // atomically when the golden Actor is created, as its "default" policy + // in the reserved ate-golden atespace. Actors created from this template + // do not inherit this policy, including when using the golden snapshot. + // If absent, no policy is created; an empty block creates a policy with + // no rules. // // +k8s:optional - EgressPolicyTemplate default_egress_policy = 9; + EgressPolicyTemplate golden_egress_policy = 9; } message Resources { From 5ef3537e6e0215d4a81d06ed3c0a82efcf9a3f91 Mon Sep 17 00:00:00 2001 From: Eitan Yarmush Date: Thu, 8 Oct 2026 19:07:06 +0000 Subject: [PATCH 3/3] Require rules in golden egress policies Reject a configured golden policy with no rules, since it grants no access beyond omitting the policy. Keep the policy object for future fields. Signed-off-by: Eitan Yarmush --- .../internal/apivalidation/actor_template_test.go | 10 ++++++++-- .../internal/apivalidation/zz_generated.validation.go | 3 ++- cmd/ateapi/internal/controlapi/template_egress_test.go | 2 -- docs/api-guide.md | 5 ++--- pkg/proto/ateapipb/ateapi.pb.go | 10 +++++----- pkg/proto/ateapipb/ateapi.proto | 10 +++++----- 6 files changed, 22 insertions(+), 18 deletions(-) diff --git a/cmd/ateapi/internal/apivalidation/actor_template_test.go b/cmd/ateapi/internal/apivalidation/actor_template_test.go index 9615f42de8..900989bc79 100644 --- a/cmd/ateapi/internal/apivalidation/actor_template_test.go +++ b/cmd/ateapi/internal/apivalidation/actor_template_test.go @@ -41,11 +41,17 @@ func TestValidateCreateActorTemplateRequest(t *testing.T) { })}, nil, }, { - "empty golden egress rules", + "missing golden egress rules", &ateapipb.CreateActorTemplateRequest{ActorTemplate: validActorTemplate(func(tmpl *ateapipb.ActorTemplate) { tmpl.GoldenEgressPolicy = &ateapipb.EgressPolicyTemplate{} })}, - nil, + field.ErrorList{field.Required(field.NewPath("actor_template", "golden_egress_policy", "rules"), "")}, + }, { + "empty golden egress rules", + &ateapipb.CreateActorTemplateRequest{ActorTemplate: validActorTemplate(func(tmpl *ateapipb.ActorTemplate) { + tmpl.GoldenEgressPolicy = &ateapipb.EgressPolicyTemplate{Rules: []*ateapipb.EgressRule{}} + })}, + field.ErrorList{field.Required(field.NewPath("actor_template", "golden_egress_policy", "rules"), "")}, }, { "invalid golden egress hostname", &ateapipb.CreateActorTemplateRequest{ActorTemplate: validActorTemplate(func(tmpl *ateapipb.ActorTemplate) { diff --git a/cmd/ateapi/internal/apivalidation/zz_generated.validation.go b/cmd/ateapi/internal/apivalidation/zz_generated.validation.go index 15331e8441..baa02d83c6 100644 --- a/cmd/ateapi/internal/apivalidation/zz_generated.validation.go +++ b/cmd/ateapi/internal/apivalidation/zz_generated.validation.go @@ -3481,7 +3481,8 @@ func Validate_EgressPolicyTemplate( errs = append(errs, e...) earlyReturn = true } - if e := validate.OptionalSlice(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 { + if e := validate.RequiredSlice(ctx, op, fldPath, obj, oldObj).MarkShortCircuit(); len(e) != 0 { + errs = append(errs, e...) earlyReturn = true } if earlyReturn { diff --git a/cmd/ateapi/internal/controlapi/template_egress_test.go b/cmd/ateapi/internal/controlapi/template_egress_test.go index 970e3a198e..12b2ac672a 100644 --- a/cmd/ateapi/internal/controlapi/template_egress_test.go +++ b/cmd/ateapi/internal/controlapi/template_egress_test.go @@ -33,7 +33,6 @@ func TestCreateActor_DoesNotInheritGoldenEgressPolicy(t *testing.T) { policy *ateapipb.EgressPolicyTemplate }{ {name: "absent"}, - {name: "empty", policy: &ateapipb.EgressPolicyTemplate{}}, {name: "configured", policy: &ateapipb.EgressPolicyTemplate{Rules: []*ateapipb.EgressRule{ {Http: &ateapipb.HTTPRule{Hostnames: []string{"api.example.com"}}}, {Https: &ateapipb.HTTPSRule{Hostnames: []string{"api.example.com"}}}, @@ -97,7 +96,6 @@ func TestReconcileOne_GoldenEgressPolicyBeforeResume(t *testing.T) { policy *ateapipb.EgressPolicyTemplate }{ {name: "absent"}, - {name: "empty", policy: &ateapipb.EgressPolicyTemplate{}}, {name: "configured", policy: &ateapipb.EgressPolicyTemplate{Rules: []*ateapipb.EgressRule{{Https: &ateapipb.HTTPSRule{Hostnames: []string{"api.example.com"}}}}}}, } { t.Run(tt.name, func(t *testing.T) { diff --git a/docs/api-guide.md b/docs/api-guide.md index e3668084e2..d868e91450 100644 --- a/docs/api-guide.md +++ b/docs/api-guide.md @@ -127,7 +127,7 @@ The `ActorTemplate` defines the code, environment, and state-management policies | `snapshotConfig` | `SnapshotConfig` | **Required.** The base object-storage location snapshots are written under, the snapshot fidelity (`preferredFidelity`) every Pause and Suspend captures (`SNAPSHOT_FIDELITY_ROOTFS` requires `sandboxClass: SANDBOX_CLASS_MICROVM`), and automated golden snapshot creation (`goldenSnapshotConfig.mode`). See [Snapshot Storage Layout](#snapshot-storage-layout). | | `volumes` | `[]Volume` | Optional. Volumes the containers may mount, each a `durableDir`, an `externalVolumeTemplate` (see [CSI Volumes Guide](csi-volumes.md)), or a `systemInfo` volume (see [SystemInfo Volumes](#systeminfo-volumes)). Every declared volume must be mounted by at least one container. A `microvm` template may declare several `durableDir` volumes; a `gvisor` template is limited to one. | | `resources` | `*ResourceRequirements` | Optional. Declares each actor's compute size via `limits` — see [Sandbox Right-Sizing](#sandbox-right-sizing-resources). Immutable, like the rest of the template. | -| `goldenEgressPolicy` | `EgressPolicyTemplate` | Optional. Egress policy for the golden actor during initialization. Contains only `rules`, with the same defaults and validation as `EgressPolicy.rules`. See [Golden Egress Policy](#golden-egress-policy-goldenegresspolicy). | +| `goldenEgressPolicy` | `EgressPolicyTemplate` | Optional. Egress policy for the golden actor during initialization. Requires at least one rule, using the same rule defaults and validation as `EgressPolicy`. See [Golden Egress Policy](#golden-egress-policy-goldenegresspolicy). | The sandbox itself — the binaries (e.g. the gVisor `runsc` binary) and the `pauseImage` holding the sandbox's namespaces — comes from the cluster-scoped [`SandboxConfig`](#3-sandboxconfig-the-sandbox-itself) object the template names via `sandboxConfig.configName`. An actor always resolves the config from its current template — repointing the actor at another template requires the same config. @@ -157,8 +157,7 @@ separately with `CreateActorEgressPolicy`. The golden policy's rules are copied once at creation. Updating or deleting that policy does not change the template. Omitting `goldenEgressPolicy` -creates no golden policy. Setting it to `{}` creates an explicitly empty -policy that allows no destinations. +creates no golden policy. When set, it must contain at least one rule. ### Sandbox Right-Sizing (`resources`) diff --git a/pkg/proto/ateapipb/ateapi.pb.go b/pkg/proto/ateapipb/ateapi.pb.go index 9a22ee9b90..ec5681366b 100644 --- a/pkg/proto/ateapipb/ateapi.pb.go +++ b/pkg/proto/ateapipb/ateapi.pb.go @@ -1310,14 +1310,15 @@ func (x *EgressPolicy) GetRules() []*EgressRule { } // EgressPolicyTemplate defines an initial Actor egress policy without resource -// metadata. Rules have the same defaults, validation, and semantics as +// metadata. Each rule has the same defaults, validation, and semantics as // EgressPolicy.rules. type EgressPolicyTemplate struct { state protoimpl.MessageState `protogen:"open.v1"` // Rules are an unordered set of allows, with the same precedence and effects - // as EgressPolicy.rules. Traffic is denied when no rule matches. + // as EgressPolicy.rules. At least one rule is required. Traffic is denied + // when no rule matches. // - // +k8s:optional + // +k8s:required // +k8s:maxItems=256 // +k8s:listType=atomic // +k8s:customValidation # no two rules tie on a name and port @@ -2682,8 +2683,7 @@ type ActorTemplate struct { // atomically when the golden Actor is created, as its "default" policy // in the reserved ate-golden atespace. Actors created from this template // do not inherit this policy, including when using the golden snapshot. - // If absent, no policy is created; an empty block creates a policy with - // no rules. + // If absent, no policy is created. When set, at least one rule is required. // // +k8s:optional GoldenEgressPolicy *EgressPolicyTemplate `protobuf:"bytes,9,opt,name=golden_egress_policy,json=goldenEgressPolicy,proto3" json:"golden_egress_policy,omitempty"` diff --git a/pkg/proto/ateapipb/ateapi.proto b/pkg/proto/ateapipb/ateapi.proto index 098f77c040..aa017fb73b 100644 --- a/pkg/proto/ateapipb/ateapi.proto +++ b/pkg/proto/ateapipb/ateapi.proto @@ -510,13 +510,14 @@ message EgressPolicy { } // EgressPolicyTemplate defines an initial Actor egress policy without resource -// metadata. Rules have the same defaults, validation, and semantics as +// metadata. Each rule has the same defaults, validation, and semantics as // EgressPolicy.rules. message EgressPolicyTemplate { // Rules are an unordered set of allows, with the same precedence and effects - // as EgressPolicy.rules. Traffic is denied when no rule matches. + // as EgressPolicy.rules. At least one rule is required. Traffic is denied + // when no rule matches. // - // +k8s:optional + // +k8s:required // +k8s:maxItems=256 // +k8s:listType=atomic // +k8s:customValidation # no two rules tie on a name and port @@ -1052,8 +1053,7 @@ message ActorTemplate { // atomically when the golden Actor is created, as its "default" policy // in the reserved ate-golden atespace. Actors created from this template // do not inherit this policy, including when using the golden snapshot. - // If absent, no policy is created; an empty block creates a policy with - // no rules. + // If absent, no policy is created. When set, at least one rule is required. // // +k8s:optional EgressPolicyTemplate golden_egress_policy = 9;