// Copyright 2020 The gRPC Authors
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
//     http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.

syntax = "proto3";

// NOTE: This proto will very likely move to a different namespace and a
// different git repo in the future.
package grpc.tls.provider.meshca.experimental;

import "envoy/config/core/v3/config_source.proto";
import "google/protobuf/duration.proto";

option go_package = "google.golang.org/grpc/credentials/tls/certprovider/meshca/internal/meshca_experimental";
option java_outer_classname = "MeshCaConfigProto";
option java_multiple_files = true;
option java_package = "io.grpc.tls.provider.meshca.experimental";

// GoogleMeshCaConfig contains all configuration parameters required by the
// MeshCA CertificateProvider plugin implementation.
message GoogleMeshCaConfig {
  // Type of key to be embedded in CSRs sent to the MeshCA.
  enum KeyType {
    KEY_TYPE_UNKNOWN = 0;
    KEY_TYPE_RSA = 1;
  }

  // GoogleMeshCA server endpoint to get CSRs signed via the *CreateCertificate*
  // unary call. This must have :ref:`api_type
  // <envoy_api_field_config.core.v3.ApiConfigSource.api_type>` :ref:`GRPC
  // <envoy_api_enum_value_config.core.v3.ApiConfigSource.ApiType.GRPC>`.
  // STS based call credentials need to be supplied in :ref:`call_credentials
  // <envoy_api_field_config.core.v3.GrpcService.GoogleGrpc.call_credentials>`.
  //
  // If :ref:`timeout envoy_api_field_config.core.v3.GrpcService.timeout` is
  // left unspecified, a default value of 10s will be used.
  envoy.config.core.v3.ApiConfigSource server = 1;

  // Certificate lifetime to request in CSRs sent to the MeshCA.
  //
  // A default value of 24h will be used if left unspecified.
  google.protobuf.Duration certificate_lifetime = 2;

  // How long before certificate expiration should the certificate be renewed.
  //
  // A default value of 12h will be used if left unspecified.
  google.protobuf.Duration renewal_grace_period = 3;

  // Type of key.
  //
  // RSA keys will be used if left unspecified.
  KeyType key_type = 4;

  // Size of the key in bits.
  //
  // 2048 bit keys will be used if left unspecified.
  uint32 key_size = 5;

  // GCE location (region/zone) where the workload is located.
  //
  // GCE/GKE Metadata Server will be contacted if left unspecified.
  string location = 6;
}

