apiVersion: apiextensions.k8s.io/v1
kind: CustomResourceDefinition
metadata:
  annotations:
    cnrm.cloud.google.com/version: 0.0.0-dev
  creationTimestamp: null
  labels:
    cnrm.cloud.google.com/managed-by-kcc: "true"
    cnrm.cloud.google.com/stability-level: stable
    cnrm.cloud.google.com/system: "true"
    cnrm.cloud.google.com/tf2crd: "true"
  name: accesscontextmanagerserviceperimeters.accesscontextmanager.cnrm.cloud.google.com
spec:
  group: accesscontextmanager.cnrm.cloud.google.com
  names:
    categories:
    - gcp
    kind: AccessContextManagerServicePerimeter
    plural: accesscontextmanagerserviceperimeters
    shortNames:
    - gcpaccesscontextmanagerserviceperimeter
    - gcpaccesscontextmanagerserviceperimeters
    singular: accesscontextmanagerserviceperimeter
  preserveUnknownFields: false
  scope: Namespaced
  versions:
  - additionalPrinterColumns:
    - jsonPath: .metadata.creationTimestamp
      name: Age
      type: date
    - description: When 'True', the most recent reconcile of the resource succeeded
      jsonPath: .status.conditions[?(@.type=='Ready')].status
      name: Ready
      type: string
    - description: The reason for the value in 'Ready'
      jsonPath: .status.conditions[?(@.type=='Ready')].reason
      name: Status
      type: string
    - description: The last transition time for the value in 'Status'
      jsonPath: .status.conditions[?(@.type=='Ready')].lastTransitionTime
      name: Status Age
      type: date
    name: v1beta1
    schema:
      openAPIV3Schema:
        properties:
          apiVersion:
            description: 'apiVersion defines the versioned schema of this representation
              of an object. Servers should convert recognized schemas to the latest
              internal value, and may reject unrecognized values. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#resources'
            type: string
          kind:
            description: 'kind is a string value representing the REST resource this
              object represents. Servers may infer this from the endpoint the client
              submits requests to. Cannot be updated. In CamelCase. More info: https://git.k8s.io/community/contributors/devel/api-conventions.md#types-kinds'
            type: string
          metadata:
            type: object
          spec:
            properties:
              accessPolicyRef:
                description: |-
                  The AccessContextManagerAccessPolicy this
                  AccessContextManagerServicePerimeter lives in.
                oneOf:
                - not:
                    required:
                    - external
                  required:
                  - name
                - not:
                    anyOf:
                    - required:
                      - name
                    - required:
                      - namespace
                  required:
                  - external
                properties:
                  external:
                    description: 'Allowed value: string of the format `accessPolicies/{{value}}`,
                      where {{value}} is the `name` field of an `AccessContextManagerAccessPolicy`
                      resource.'
                    type: string
                  name:
                    description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
                    type: string
                  namespace:
                    description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
                    type: string
                type: object
              description:
                description: |-
                  Description of the ServicePerimeter and its use. Does not affect
                  behavior.
                type: string
              perimeterType:
                description: |-
                  Immutable. Specifies the type of the Perimeter. There are two types: regular and
                  bridge. Regular Service Perimeter contains resources, access levels,
                  and restricted services. Every resource can be in at most
                  ONE regular Service Perimeter.

                  In addition to being in a regular service perimeter, a resource can also
                  be in zero or more perimeter bridges. A perimeter bridge only contains
                  resources. Cross project operations are permitted if all effected
                  resources share some perimeter (whether bridge or regular). Perimeter
                  Bridge does not contain access levels or services: those are governed
                  entirely by the regular perimeter that resource is in.

                  Perimeter Bridges are typically useful when building more complex
                  topologies with many independent perimeters that need to share some data
                  with a common perimeter, but should not be able to share data among
                  themselves. Default value: "PERIMETER_TYPE_REGULAR" Possible values: ["PERIMETER_TYPE_REGULAR", "PERIMETER_TYPE_BRIDGE"].
                type: string
              resourceID:
                description: Immutable. Optional. The name of the resource. Used for
                  creation and acquisition. When unset, the value of `metadata.name`
                  is used as the default.
                type: string
              spec:
                description: |-
                  Proposed (or dry run) ServicePerimeter configuration.
                  This configuration allows to specify and test ServicePerimeter configuration
                  without enforcing actual access restrictions. Only allowed to be set when
                  the 'useExplicitDryRunSpec' flag is set.
                properties:
                  accessLevels:
                    items:
                      description: |-
                        (Optional) A list of AccessLevel resource names that allow resources within
                        the ServicePerimeter to be accessed from the internet. AccessLevels listed
                        must be in the same policy as this ServicePerimeter.
                        Referencing a nonexistent AccessLevel is a syntax error. If no
                        AccessLevel names are listed, resources within the perimeter can
                        only be accessed via GCP calls with request origins within the
                        perimeter. For Service Perimeter Bridge, must be empty.
                      oneOf:
                      - not:
                          required:
                          - external
                        required:
                        - name
                      - not:
                          anyOf:
                          - required:
                            - name
                          - required:
                            - namespace
                        required:
                        - external
                      properties:
                        external:
                          description: 'Allowed value: string of the format `{{parent}}/accessLevels/{{value}}`,
                            where {{value}} is the `name` field of an `AccessContextManagerAccessLevel`
                            resource.'
                          type: string
                        name:
                          description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
                          type: string
                        namespace:
                          description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
                          type: string
                      type: object
                    type: array
                  egressPolicies:
                    description: |-
                      List of EgressPolicies to apply to the perimeter. A perimeter may
                      have multiple EgressPolicies, each of which is evaluated separately.
                      Access is granted if any EgressPolicy grants it. Must be empty for
                      a perimeter bridge.
                    items:
                      properties:
                        egressFrom:
                          description: Defines conditions on the source of a request
                            causing this 'EgressPolicy' to apply.
                          properties:
                            identities:
                              items:
                                description: |-
                                  (Optional) A list of identities that are allowed access through this
                                  EgressPolicy. Should be in the format of email address. The email
                                  address should represent individual user or service account only.
                                oneOf:
                                - required:
                                  - serviceAccountRef
                                - required:
                                  - user
                                properties:
                                  serviceAccountRef:
                                    oneOf:
                                    - not:
                                        required:
                                        - external
                                      required:
                                      - name
                                    - not:
                                        anyOf:
                                        - required:
                                          - name
                                        - required:
                                          - namespace
                                      required:
                                      - external
                                    properties:
                                      external:
                                        description: 'Allowed value: string of the
                                          format `serviceAccount:{{value}}`, where
                                          {{value}} is the `email` field of an `IAMServiceAccount`
                                          resource.'
                                        type: string
                                      name:
                                        description: 'Name of the referent. More info:
                                          https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
                                        type: string
                                      namespace:
                                        description: 'Namespace of the referent. More
                                          info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
                                        type: string
                                    type: object
                                  user:
                                    type: string
                                type: object
                              type: array
                            identityType:
                              description: |-
                                Specifies the type of identities that are allowed access to outside the
                                perimeter. If left unspecified, then members of 'identities' field will
                                be allowed access. Possible values: ["IDENTITY_TYPE_UNSPECIFIED", "ANY_IDENTITY", "ANY_USER_ACCOUNT", "ANY_SERVICE_ACCOUNT"].
                              type: string
                          type: object
                        egressTo:
                          description: |-
                            Defines the conditions on the 'ApiOperation' and destination resources that
                            cause this 'EgressPolicy' to apply.
                          properties:
                            externalResources:
                              description: |-
                                A list of external resources that are allowed to be accessed. A request
                                matches if it contains an external resource in this list (Example:
                                s3://bucket/path). Currently '*' is not allowed.
                              items:
                                type: string
                              type: array
                            operations:
                              description: |-
                                A list of 'ApiOperations' that this egress rule applies to. A request matches
                                if it contains an operation/service in this list.
                              items:
                                properties:
                                  methodSelectors:
                                    description: |-
                                      API methods or permissions to allow. Method or permission must belong
                                      to the service specified by 'serviceName' field. A single MethodSelector
                                      entry with '*' specified for the 'method' field will allow all methods
                                      AND permissions for the service specified in 'serviceName'.
                                    items:
                                      properties:
                                        method:
                                          description: |-
                                            Value for 'method' should be a valid method name for the corresponding
                                            'serviceName' in 'ApiOperation'. If '*' used as value for method,
                                            then ALL methods and permissions are allowed.
                                          type: string
                                        permission:
                                          description: |-
                                            Value for permission should be a valid Cloud IAM permission for the
                                            corresponding 'serviceName' in 'ApiOperation'.
                                          type: string
                                      type: object
                                    type: array
                                  serviceName:
                                    description: |-
                                      The name of the API whose methods or permissions the 'IngressPolicy' or
                                      'EgressPolicy' want to allow. A single 'ApiOperation' with serviceName
                                      field set to '*' will allow all methods AND permissions for all services.
                                    type: string
                                type: object
                              type: array
                            resources:
                              items:
                                description: |-
                                  (Optional) A list of resources, currently only projects in the form
                                  "projects/{project_number}". A request
                                  matches if it contains a resource in this list.
                                properties:
                                  projectRef:
                                    oneOf:
                                    - not:
                                        required:
                                        - external
                                      required:
                                      - name
                                    - not:
                                        anyOf:
                                        - required:
                                          - name
                                        - required:
                                          - namespace
                                      required:
                                      - external
                                    properties:
                                      external:
                                        description: 'Allowed value: string of the
                                          format `projects/{{value}}`, where {{value}}
                                          is the `number` field of a `Project` resource.'
                                        type: string
                                      name:
                                        description: 'Name of the referent. More info:
                                          https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
                                        type: string
                                      namespace:
                                        description: 'Namespace of the referent. More
                                          info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
                                        type: string
                                    type: object
                                type: object
                              type: array
                          type: object
                      type: object
                    type: array
                  ingressPolicies:
                    description: |-
                      List of 'IngressPolicies' to apply to the perimeter. A perimeter may
                      have multiple 'IngressPolicies', each of which is evaluated
                      separately. Access is granted if any 'Ingress Policy' grants it.
                      Must be empty for a perimeter bridge.
                    items:
                      properties:
                        ingressFrom:
                          description: |-
                            Defines the conditions on the source of a request causing this 'IngressPolicy'
                            to apply.
                          properties:
                            identities:
                              items:
                                description: |-
                                  (Optional) A list of identities that are allowed access through this
                                  ingress policy. Should be in the format of email address. The email
                                  address should represent individual user or service account only.
                                oneOf:
                                - required:
                                  - serviceAccountRef
                                - required:
                                  - user
                                properties:
                                  serviceAccountRef:
                                    oneOf:
                                    - not:
                                        required:
                                        - external
                                      required:
                                      - name
                                    - not:
                                        anyOf:
                                        - required:
                                          - name
                                        - required:
                                          - namespace
                                      required:
                                      - external
                                    properties:
                                      external:
                                        description: 'Allowed value: string of the
                                          format `serviceAccount:{{value}}`, where
                                          {{value}} is the `email` field of an `IAMServiceAccount`
                                          resource.'
                                        type: string
                                      name:
                                        description: 'Name of the referent. More info:
                                          https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
                                        type: string
                                      namespace:
                                        description: 'Namespace of the referent. More
                                          info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
                                        type: string
                                    type: object
                                  user:
                                    type: string
                                type: object
                              type: array
                            identityType:
                              description: |-
                                Specifies the type of identities that are allowed access from outside the
                                perimeter. If left unspecified, then members of 'identities' field will be
                                allowed access. Possible values: ["IDENTITY_TYPE_UNSPECIFIED", "ANY_IDENTITY", "ANY_USER_ACCOUNT", "ANY_SERVICE_ACCOUNT"].
                              type: string
                            sources:
                              description: Sources that this 'IngressPolicy' authorizes
                                access from.
                              items:
                                properties:
                                  accessLevelRef:
                                    description: |-
                                      An AccessLevel resource name that allow resources within the
                                      ServicePerimeters to be accessed from the internet. AccessLevels
                                      listed must be in the same policy as this ServicePerimeter.
                                      Referencing a nonexistent AccessLevel will cause an error. If no
                                      AccessLevel names are listed, resources within the perimeter can
                                      only be accessed via Google Cloud calls with request origins within
                                      the perimeter.
                                    oneOf:
                                    - not:
                                        required:
                                        - external
                                      required:
                                      - name
                                    - not:
                                        anyOf:
                                        - required:
                                          - name
                                        - required:
                                          - namespace
                                      required:
                                      - external
                                    properties:
                                      external:
                                        description: 'Allowed value: string of the
                                          format `{{parent}}/accessLevels/{{value}}`,
                                          where {{value}} is the `name` field of an
                                          `AccessContextManagerAccessLevel` resource.'
                                        type: string
                                      name:
                                        description: 'Name of the referent. More info:
                                          https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
                                        type: string
                                      namespace:
                                        description: 'Namespace of the referent. More
                                          info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
                                        type: string
                                    type: object
                                  projectRef:
                                    description: |-
                                      (Optional) A Google Cloud resource that is allowed to ingress the
                                      perimeter. Requests from these resources will be allowed to access
                                      perimeter data. Currently only projects are allowed. Format
                                      "projects/{project_number}" The project may be in any Google Cloud
                                      organization, not just the organization that the perimeter is defined in.
                                    oneOf:
                                    - not:
                                        required:
                                        - external
                                      required:
                                      - name
                                    - not:
                                        anyOf:
                                        - required:
                                          - name
                                        - required:
                                          - namespace
                                      required:
                                      - external
                                    properties:
                                      external:
                                        description: 'Allowed value: string of the
                                          format `projects/{{value}}`, where {{value}}
                                          is the `number` field of a `Project` resource.'
                                        type: string
                                      name:
                                        description: 'Name of the referent. More info:
                                          https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
                                        type: string
                                      namespace:
                                        description: 'Namespace of the referent. More
                                          info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
                                        type: string
                                    type: object
                                type: object
                              type: array
                          type: object
                        ingressTo:
                          description: |-
                            Defines the conditions on the 'ApiOperation' and request destination that cause
                            this 'IngressPolicy' to apply.
                          properties:
                            operations:
                              description: |-
                                A list of 'ApiOperations' the sources specified in corresponding 'IngressFrom'
                                are allowed to perform in this 'ServicePerimeter'.
                              items:
                                properties:
                                  methodSelectors:
                                    description: |-
                                      API methods or permissions to allow. Method or permission must belong to
                                      the service specified by serviceName field. A single 'MethodSelector' entry
                                      with '*' specified for the method field will allow all methods AND
                                      permissions for the service specified in 'serviceName'.
                                    items:
                                      properties:
                                        method:
                                          description: |-
                                            Value for method should be a valid method name for the corresponding
                                            serviceName in 'ApiOperation'. If '*' used as value for 'method', then
                                            ALL methods and permissions are allowed.
                                          type: string
                                        permission:
                                          description: |-
                                            Value for permission should be a valid Cloud IAM permission for the
                                            corresponding 'serviceName' in 'ApiOperation'.
                                          type: string
                                      type: object
                                    type: array
                                  serviceName:
                                    description: |-
                                      The name of the API whose methods or permissions the 'IngressPolicy' or
                                      'EgressPolicy' want to allow. A single 'ApiOperation' with 'serviceName'
                                      field set to '*' will allow all methods AND permissions for all services.
                                    type: string
                                type: object
                              type: array
                            resources:
                              items:
                                description: |-
                                  A list of resources, currently only projects in the form
                                  "projects/{project_number}", protected by this ServicePerimeter
                                  that are allowed to be accessed by sources defined in the
                                  corresponding IngressFrom. A request matches if it contains a
                                  resource in this list.
                                properties:
                                  projectRef:
                                    oneOf:
                                    - not:
                                        required:
                                        - external
                                      required:
                                      - name
                                    - not:
                                        anyOf:
                                        - required:
                                          - name
                                        - required:
                                          - namespace
                                      required:
                                      - external
                                    properties:
                                      external:
                                        description: 'Allowed value: string of the
                                          format `projects/{{value}}`, where {{value}}
                                          is the `number` field of a `Project` resource.'
                                        type: string
                                      name:
                                        description: 'Name of the referent. More info:
                                          https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
                                        type: string
                                      namespace:
                                        description: 'Namespace of the referent. More
                                          info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
                                        type: string
                                    type: object
                                type: object
                              type: array
                          type: object
                      type: object
                    type: array
                  resources:
                    items:
                      description: |-
                        (Optional) A list of GCP resources that are inside of the service perimeter.
                        Currently only projects are allowed.
                      properties:
                        projectRef:
                          oneOf:
                          - not:
                              required:
                              - external
                            required:
                            - name
                          - not:
                              anyOf:
                              - required:
                                - name
                              - required:
                                - namespace
                            required:
                            - external
                          properties:
                            external:
                              description: 'Allowed value: string of the format `projects/{{value}}`,
                                where {{value}} is the `number` field of a `Project`
                                resource.'
                              type: string
                            name:
                              description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
                              type: string
                            namespace:
                              description: 'Namespace of the referent. More info:
                                https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
                              type: string
                          type: object
                      type: object
                    type: array
                  restrictedServices:
                    description: |-
                      GCP services that are subject to the Service Perimeter
                      restrictions. Must contain a list of services. For example, if
                      'storage.googleapis.com' is specified, access to the storage
                      buckets inside the perimeter must meet the perimeter's access
                      restrictions.
                    items:
                      type: string
                    type: array
                  vpcAccessibleServices:
                    description: |-
                      Specifies how APIs are allowed to communicate within the Service
                      Perimeter.
                    properties:
                      allowedServices:
                        description: |-
                          The list of APIs usable within the Service Perimeter.
                          Must be empty unless 'enableRestriction' is True.
                        items:
                          type: string
                        type: array
                      enableRestriction:
                        description: |-
                          Whether to restrict API calls within the Service Perimeter to the
                          list of APIs specified in 'allowedServices'.
                        type: boolean
                    type: object
                type: object
              status:
                description: |-
                  ServicePerimeter configuration. Specifies sets of resources,
                  restricted services and access levels that determine
                  perimeter content and boundaries.
                properties:
                  accessLevels:
                    items:
                      description: |-
                        (Optional) A list of AccessLevel resource names that allow resources within
                        the ServicePerimeter to be accessed from the internet. AccessLevels listed
                        must be in the same policy as this ServicePerimeter.
                        Referencing a nonexistent AccessLevel is a syntax error. If no
                        AccessLevel names are listed, resources within the perimeter can
                        only be accessed via GCP calls with request origins within the
                        perimeter. For Service Perimeter Bridge, must be empty.
                      oneOf:
                      - not:
                          required:
                          - external
                        required:
                        - name
                      - not:
                          anyOf:
                          - required:
                            - name
                          - required:
                            - namespace
                        required:
                        - external
                      properties:
                        external:
                          description: 'Allowed value: string of the format `{{parent}}/accessLevels/{{value}}`,
                            where {{value}} is the `name` field of an `AccessContextManagerAccessLevel`
                            resource.'
                          type: string
                        name:
                          description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
                          type: string
                        namespace:
                          description: 'Namespace of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
                          type: string
                      type: object
                    type: array
                  egressPolicies:
                    description: |-
                      List of EgressPolicies to apply to the perimeter. A perimeter may
                      have multiple EgressPolicies, each of which is evaluated separately.
                      Access is granted if any EgressPolicy grants it. Must be empty for
                      a perimeter bridge.
                    items:
                      properties:
                        egressFrom:
                          description: Defines conditions on the source of a request
                            causing this 'EgressPolicy' to apply.
                          properties:
                            identities:
                              items:
                                description: |-
                                  (Optional) A list of identities that are allowed access through this
                                  EgressPolicy. Should be in the format of email address. The email
                                  address should represent individual user or service account only.
                                oneOf:
                                - required:
                                  - serviceAccountRef
                                - required:
                                  - user
                                properties:
                                  serviceAccountRef:
                                    oneOf:
                                    - not:
                                        required:
                                        - external
                                      required:
                                      - name
                                    - not:
                                        anyOf:
                                        - required:
                                          - name
                                        - required:
                                          - namespace
                                      required:
                                      - external
                                    properties:
                                      external:
                                        description: 'Allowed value: string of the
                                          format `serviceAccount:{{value}}`, where
                                          {{value}} is the `email` field of an `IAMServiceAccount`
                                          resource.'
                                        type: string
                                      name:
                                        description: 'Name of the referent. More info:
                                          https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
                                        type: string
                                      namespace:
                                        description: 'Namespace of the referent. More
                                          info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
                                        type: string
                                    type: object
                                  user:
                                    type: string
                                type: object
                              type: array
                            identityType:
                              description: |-
                                Specifies the type of identities that are allowed access to outside the
                                perimeter. If left unspecified, then members of 'identities' field will
                                be allowed access. Possible values: ["IDENTITY_TYPE_UNSPECIFIED", "ANY_IDENTITY", "ANY_USER_ACCOUNT", "ANY_SERVICE_ACCOUNT"].
                              type: string
                          type: object
                        egressTo:
                          description: |-
                            Defines the conditions on the 'ApiOperation' and destination resources that
                            cause this 'EgressPolicy' to apply.
                          properties:
                            externalResources:
                              description: |-
                                A list of external resources that are allowed to be accessed. A request
                                matches if it contains an external resource in this list (Example:
                                s3://bucket/path). Currently '*' is not allowed.
                              items:
                                type: string
                              type: array
                            operations:
                              description: |-
                                A list of 'ApiOperations' that this egress rule applies to. A request matches
                                if it contains an operation/service in this list.
                              items:
                                properties:
                                  methodSelectors:
                                    description: |-
                                      API methods or permissions to allow. Method or permission must belong
                                      to the service specified by 'serviceName' field. A single MethodSelector
                                      entry with '*' specified for the 'method' field will allow all methods
                                      AND permissions for the service specified in 'serviceName'.
                                    items:
                                      properties:
                                        method:
                                          description: |-
                                            Value for 'method' should be a valid method name for the corresponding
                                            'serviceName' in 'ApiOperation'. If '*' used as value for method,
                                            then ALL methods and permissions are allowed.
                                          type: string
                                        permission:
                                          description: |-
                                            Value for permission should be a valid Cloud IAM permission for the
                                            corresponding 'serviceName' in 'ApiOperation'.
                                          type: string
                                      type: object
                                    type: array
                                  serviceName:
                                    description: |-
                                      The name of the API whose methods or permissions the 'IngressPolicy' or
                                      'EgressPolicy' want to allow. A single 'ApiOperation' with serviceName
                                      field set to '*' will allow all methods AND permissions for all services.
                                    type: string
                                type: object
                              type: array
                            resources:
                              items:
                                description: |-
                                  (Optional) A list of resources, currently only projects in the form
                                  "projects/{project_number}". A request
                                  matches if it contains a resource in this list.
                                properties:
                                  projectRef:
                                    oneOf:
                                    - not:
                                        required:
                                        - external
                                      required:
                                      - name
                                    - not:
                                        anyOf:
                                        - required:
                                          - name
                                        - required:
                                          - namespace
                                      required:
                                      - external
                                    properties:
                                      external:
                                        description: 'Allowed value: string of the
                                          format `projects/{{value}}`, where {{value}}
                                          is the `number` field of a `Project` resource.'
                                        type: string
                                      name:
                                        description: 'Name of the referent. More info:
                                          https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
                                        type: string
                                      namespace:
                                        description: 'Namespace of the referent. More
                                          info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
                                        type: string
                                    type: object
                                type: object
                              type: array
                          type: object
                      type: object
                    type: array
                  ingressPolicies:
                    description: |-
                      List of 'IngressPolicies' to apply to the perimeter. A perimeter may
                      have multiple 'IngressPolicies', each of which is evaluated
                      separately. Access is granted if any 'Ingress Policy' grants it.
                      Must be empty for a perimeter bridge.
                    items:
                      properties:
                        ingressFrom:
                          description: |-
                            Defines the conditions on the source of a request causing this 'IngressPolicy'
                            to apply.
                          properties:
                            identities:
                              items:
                                description: |-
                                  (Optional) A list of identities that are allowed access through this
                                  EgressPolicy. Should be in the format of email address. The email
                                  address should represent individual user or service account only.
                                oneOf:
                                - required:
                                  - serviceAccountRef
                                - required:
                                  - user
                                properties:
                                  serviceAccountRef:
                                    oneOf:
                                    - not:
                                        required:
                                        - external
                                      required:
                                      - name
                                    - not:
                                        anyOf:
                                        - required:
                                          - name
                                        - required:
                                          - namespace
                                      required:
                                      - external
                                    properties:
                                      external:
                                        description: 'Allowed value: string of the
                                          format `serviceAccount:{{value}}`, where
                                          {{value}} is the `email` field of an `IAMServiceAccount`
                                          resource.'
                                        type: string
                                      name:
                                        description: 'Name of the referent. More info:
                                          https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
                                        type: string
                                      namespace:
                                        description: 'Namespace of the referent. More
                                          info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
                                        type: string
                                    type: object
                                  user:
                                    type: string
                                type: object
                              type: array
                            identityType:
                              description: |-
                                Specifies the type of identities that are allowed access from outside the
                                perimeter. If left unspecified, then members of 'identities' field will be
                                allowed access. Possible values: ["IDENTITY_TYPE_UNSPECIFIED", "ANY_IDENTITY", "ANY_USER_ACCOUNT", "ANY_SERVICE_ACCOUNT"].
                              type: string
                            sources:
                              description: Sources that this 'IngressPolicy' authorizes
                                access from.
                              items:
                                properties:
                                  accessLevelRef:
                                    description: |-
                                      An AccessLevel resource name that allow resources within the
                                      ServicePerimeters to be accessed from the internet. AccessLevels
                                      listed must be in the same policy as this ServicePerimeter.
                                      Referencing a nonexistent AccessLevel will cause an error. If no
                                      AccessLevel names are listed, resources within the perimeter can
                                      only be accessed via Google Cloud calls with request origins within
                                      the perimeter.
                                    oneOf:
                                    - not:
                                        required:
                                        - external
                                      required:
                                      - name
                                    - not:
                                        anyOf:
                                        - required:
                                          - name
                                        - required:
                                          - namespace
                                      required:
                                      - external
                                    properties:
                                      external:
                                        description: 'Allowed value: string of the
                                          format `{{parent}}/accessLevels/{{value}}`,
                                          where {{value}} is the `name` field of an
                                          `AccessContextManagerAccessLevel` resource.'
                                        type: string
                                      name:
                                        description: 'Name of the referent. More info:
                                          https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
                                        type: string
                                      namespace:
                                        description: 'Namespace of the referent. More
                                          info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
                                        type: string
                                    type: object
                                  projectRef:
                                    description: |-
                                      (Optional) A Google Cloud resource that is allowed to ingress the
                                      perimeter. Requests from these resources will be allowed to access
                                      perimeter data. Currently only projects are allowed. Format
                                      "projects/{project_number}" The project may be in any Google Cloud
                                      organization, not just the organization that the perimeter is defined in.
                                    oneOf:
                                    - not:
                                        required:
                                        - external
                                      required:
                                      - name
                                    - not:
                                        anyOf:
                                        - required:
                                          - name
                                        - required:
                                          - namespace
                                      required:
                                      - external
                                    properties:
                                      external:
                                        description: 'Allowed value: string of the
                                          format `projects/{{value}}`, where {{value}}
                                          is the `number` field of a `Project` resource.'
                                        type: string
                                      name:
                                        description: 'Name of the referent. More info:
                                          https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
                                        type: string
                                      namespace:
                                        description: 'Namespace of the referent. More
                                          info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
                                        type: string
                                    type: object
                                type: object
                              type: array
                          type: object
                        ingressTo:
                          description: |-
                            Defines the conditions on the 'ApiOperation' and request destination that cause
                            this 'IngressPolicy' to apply.
                          properties:
                            operations:
                              description: |-
                                A list of 'ApiOperations' the sources specified in corresponding 'IngressFrom'
                                are allowed to perform in this 'ServicePerimeter'.
                              items:
                                properties:
                                  methodSelectors:
                                    description: |-
                                      API methods or permissions to allow. Method or permission must belong to
                                      the service specified by serviceName field. A single 'MethodSelector' entry
                                      with '*' specified for the method field will allow all methods AND
                                      permissions for the service specified in 'serviceName'.
                                    items:
                                      properties:
                                        method:
                                          description: |-
                                            Value for method should be a valid method name for the corresponding
                                            serviceName in 'ApiOperation'. If '*' used as value for 'method', then
                                            ALL methods and permissions are allowed.
                                          type: string
                                        permission:
                                          description: |-
                                            Value for permission should be a valid Cloud IAM permission for the
                                            corresponding 'serviceName' in 'ApiOperation'.
                                          type: string
                                      type: object
                                    type: array
                                  serviceName:
                                    description: |-
                                      The name of the API whose methods or permissions the 'IngressPolicy' or
                                      'EgressPolicy' want to allow. A single 'ApiOperation' with 'serviceName'
                                      field set to '*' will allow all methods AND permissions for all services.
                                    type: string
                                type: object
                              type: array
                            resources:
                              items:
                                description: |-
                                  A list of resources, currently only projects in the form
                                  "projects/{project_number}", protected by this ServicePerimeter
                                  that are allowed to be accessed by sources defined in the
                                  corresponding IngressFrom. A request matches if it contains a
                                  resource in this list.
                                properties:
                                  projectRef:
                                    oneOf:
                                    - not:
                                        required:
                                        - external
                                      required:
                                      - name
                                    - not:
                                        anyOf:
                                        - required:
                                          - name
                                        - required:
                                          - namespace
                                      required:
                                      - external
                                    properties:
                                      external:
                                        description: 'Allowed value: string of the
                                          format `projects/{{value}}`, where {{value}}
                                          is the `number` field of a `Project` resource.'
                                        type: string
                                      name:
                                        description: 'Name of the referent. More info:
                                          https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
                                        type: string
                                      namespace:
                                        description: 'Namespace of the referent. More
                                          info: https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
                                        type: string
                                    type: object
                                type: object
                              type: array
                          type: object
                      type: object
                    type: array
                  resources:
                    items:
                      description: |-
                        (Optional) A list of GCP resources that are inside of the service perimeter.
                        Currently only projects are allowed.
                      properties:
                        projectRef:
                          oneOf:
                          - not:
                              required:
                              - external
                            required:
                            - name
                          - not:
                              anyOf:
                              - required:
                                - name
                              - required:
                                - namespace
                            required:
                            - external
                          properties:
                            external:
                              description: 'Allowed value: string of the format `projects/{{value}}`,
                                where {{value}} is the `number` field of a `Project`
                                resource.'
                              type: string
                            name:
                              description: 'Name of the referent. More info: https://kubernetes.io/docs/concepts/overview/working-with-objects/names/#names'
                              type: string
                            namespace:
                              description: 'Namespace of the referent. More info:
                                https://kubernetes.io/docs/concepts/overview/working-with-objects/namespaces/'
                              type: string
                          type: object
                      type: object
                    type: array
                  restrictedServices:
                    description: |-
                      GCP services that are subject to the Service Perimeter
                      restrictions. Must contain a list of services. For example, if
                      'storage.googleapis.com' is specified, access to the storage
                      buckets inside the perimeter must meet the perimeter's access
                      restrictions.
                    items:
                      type: string
                    type: array
                  vpcAccessibleServices:
                    description: |-
                      Specifies how APIs are allowed to communicate within the Service
                      Perimeter.
                    properties:
                      allowedServices:
                        description: |-
                          The list of APIs usable within the Service Perimeter.
                          Must be empty unless 'enableRestriction' is True.
                        items:
                          type: string
                        type: array
                      enableRestriction:
                        description: |-
                          Whether to restrict API calls within the Service Perimeter to the
                          list of APIs specified in 'allowedServices'.
                        type: boolean
                    type: object
                type: object
              title:
                description: Human readable title. Must be unique within the Policy.
                type: string
              useExplicitDryRunSpec:
                description: |-
                  Use explicit dry run spec flag. Ordinarily, a dry-run spec implicitly exists
                  for all Service Perimeters, and that spec is identical to the status for those
                  Service Perimeters. When this flag is set, it inhibits the generation of the
                  implicit spec, thereby allowing the user to explicitly provide a
                  configuration ("spec") to use in a dry-run version of the Service Perimeter.
                  This allows the user to test changes to the enforced config ("status") without
                  actually enforcing them. This testing is done through analyzing the differences
                  between currently enforced and suggested restrictions. useExplicitDryRunSpec must
                  bet set to True if any of the fields in the spec are set to non-default values.
                type: boolean
            required:
            - accessPolicyRef
            - title
            type: object
          status:
            properties:
              conditions:
                description: Conditions represent the latest available observation
                  of the resource's current state.
                items:
                  properties:
                    lastTransitionTime:
                      description: Last time the condition transitioned from one status
                        to another.
                      type: string
                    message:
                      description: Human-readable message indicating details about
                        last transition.
                      type: string
                    reason:
                      description: Unique, one-word, CamelCase reason for the condition's
                        last transition.
                      type: string
                    status:
                      description: Status is the status of the condition. Can be True,
                        False, Unknown.
                      type: string
                    type:
                      description: Type is the type of the condition.
                      type: string
                  type: object
                type: array
              createTime:
                description: Time the AccessPolicy was created in UTC.
                type: string
              observedGeneration:
                description: ObservedGeneration is the generation of the resource
                  that was most recently observed by the Config Connector controller.
                  If this is equal to metadata.generation, then that means that the
                  current reported status reflects the most recent desired state of
                  the resource.
                type: integer
              updateTime:
                description: Time the AccessPolicy was updated in UTC.
                type: string
            type: object
        required:
        - spec
        type: object
    served: true
    storage: true
    subresources:
      status: {}
status:
  acceptedNames:
    kind: ""
    plural: ""
  conditions: []
  storedVersions: []
