googleapis
diff --git a/‎google/cloud/networkmanagement/v1/networkmanagement_v1.yaml‎
Lines changed: 9 additions & 1 deletion b/‎google/cloud/networkmanagement/v1/networkmanagement_v1.yaml‎
Lines changed: 9 additions & 1 deletion
diff --git a/‎google/cloud/networkmanagement/v1/trace.proto‎
Lines changed: 97 additions & 0 deletions b/‎google/cloud/networkmanagement/v1/trace.proto‎
Lines changed: 97 additions & 0 deletions
@@ -23,7 +23,15 @@ documentation:
     description: Gets information about a location.
 
   - selector: google.cloud.location.Locations.ListLocations
-    description: Lists information about the supported locations for this service.
+    description: |-
+      Lists information about the supported locations for this service.
+      This method can be called in two ways:
+
+      *   **List all public locations:** Use the path `GET /v1/locations`.
+      *   **List project-visible locations:** Use the path
+      `GET /v1/projects/{project_id}/locations`. This may include public
+      locations as well as private or other locations specifically visible
+      to the project.
 
   - selector: google.iam.v1.IAMPolicy.GetIamPolicy
     description: |-
 
@@ -176,6 +176,9 @@ message Step {
     // Forwarding state: arriving at a VPC connector.
     ARRIVE_AT_VPC_CONNECTOR = 24;
 
+    // Forwarding state: arriving at a GKE Pod.
+    ARRIVE_AT_GKE_POD = 44;
+
     // Forwarding state: for packets originating from a serverless endpoint
     // forwarded through Direct VPC egress.
     DIRECT_VPC_EGRESS_CONNECTION = 35;
@@ -184,6 +187,10 @@ message Step {
     // forwarded through public (external) connectivity.
     SERVERLESS_EXTERNAL_CONNECTION = 36;
 
+    // Forwarding state: Layer 7 packet inspection by the firewall endpoint
+    // based on the configured security profile group.
+    NGFW_PACKET_INSPECTION = 47;
+
     // Transition state: packet header translated. The `nat` field is populated
     // with the translation information.
     NAT = 14;
@@ -192,6 +199,20 @@ message Step {
     // `ip_masquerading_skipped` field is populated with the reason.
     SKIP_GKE_POD_IP_MASQUERADING = 40;
 
+    // Transition state: GKE Ingress Network Policy is skipped. The
+    // `gke_network_policy_skipped` field is populated with the reason.
+    SKIP_GKE_INGRESS_NETWORK_POLICY = 41;
+
+    // Transition state: GKE Egress Network Policy is skipped. The
+    // `gke_network_policy_skipped` field is populated with the reason.
+    SKIP_GKE_EGRESS_NETWORK_POLICY = 42;
+
+    // Config checking state: verify ingress GKE network policy.
+    APPLY_INGRESS_GKE_NETWORK_POLICY = 45;
+
+    // Config checking state: verify egress GKE network policy.
+    APPLY_EGRESS_GKE_NETWORK_POLICY = 46;
+
     // Transition state: original connection is terminated and a new proxied
     // connection is initiated.
     PROXY_CONNECTION = 15;
@@ -303,6 +324,13 @@ message Step {
     // skipped.
     IpMasqueradingSkippedInfo ip_masquerading_skipped = 38;
 
+    // Display information of a GKE Network Policy.
+    GkeNetworkPolicyInfo gke_network_policy = 39;
+
+    // Display information of the reason why GKE Network Policy evaluation was
+    // skipped.
+    GkeNetworkPolicySkippedInfo gke_network_policy_skipped = 40;
+
     // Display information of a Cloud SQL instance.
     CloudSQLInstanceInfo cloud_sql_instance = 19;
 
@@ -336,6 +364,9 @@ message Step {
     // Display information of a Serverless network endpoint group backend. Used
     // only for return traces.
     ServerlessNegInfo serverless_neg = 29;
+
+    // Display information of a layer 7 packet inspection by the firewall.
+    NgfwPacketInspectionInfo ngfw_packet_inspection = 42;
   }
 }
 
@@ -1825,6 +1856,13 @@ message DropInfo {
     // Packet is dropped because no matching route was found in the hybrid
     // subnet.
     HYBRID_SUBNET_NO_ROUTE = 106;
+
+    // Packet is dropped by GKE Network Policy.
+    GKE_NETWORK_POLICY = 108;
+
+    // Packet is dropped because there is no valid matching route from the
+    // network of the Google-managed service to the destination.
+    NO_VALID_ROUTE_FROM_GOOGLE_MANAGED_NETWORK_TO_DESTINATION = 110;
   }
 
   // Cause that the packet is dropped.
@@ -1929,6 +1967,57 @@ message IpMasqueradingSkippedInfo {
   string non_masquerade_range = 2;
 }
 
+// For display only. Metadata associated with a GKE Network Policy.
+message GkeNetworkPolicyInfo {
+  // The name of the Network Policy.
+  string display_name = 1;
+
+  // The URI of the Network Policy.
+  // Format for a Network Policy in a zonal cluster:
+  // `projects/<project_id>/zones/<zone>/clusters/<cluster>/k8s/namespaces/<namespace>/networking.k8s.io/networkpolicies/<networkpolicy>`
+  // Format for a Network Policy in a regional cluster:
+  // `projects/<project_id>/locations/<location>/clusters/<cluster>/k8s/namespaces/<namespace>/networking.k8s.io/networkpolicies/<networkpolicy>`
+  string uri = 2;
+
+  // Possible values: INGRESS, EGRESS
+  string direction = 3;
+
+  // Possible values: ALLOW, DENY
+  string action = 4;
+}
+
+// For display only. Contains information about why GKE Network Policy
+// evaluation was skipped.
+message GkeNetworkPolicySkippedInfo {
+  enum Reason {
+    // Unused default value.
+    REASON_UNSPECIFIED = 0;
+
+    // Network Policy is disabled on the cluster.
+    NETWORK_POLICY_DISABLED = 1;
+
+    // Ingress traffic to a Pod from a source on the same Node is always
+    // allowed.
+    INGRESS_SOURCE_ON_SAME_NODE = 2;
+
+    // Egress traffic from a Pod that uses the Node's network namespace is not
+    // subject to Network Policy.
+    EGRESS_FROM_NODE_NETWORK_NAMESPACE_POD = 3;
+
+    // Network Policy is not applied to response traffic. This is because GKE
+    // Network Policy evaluation is stateful in both GKE Dataplane V2 (eBPF) and
+    // legacy (iptables) implementations.
+    NETWORK_POLICY_NOT_APPLIED_TO_RESPONSE_TRAFFIC = 4;
+
+    // Network Policy evaluation is currently not supported for clusters with
+    // FQDN Network Policies enabled.
+    NETWORK_POLICY_ANALYSIS_UNSUPPORTED = 100;
+  }
+
+  // Reason why Network Policy evaluation was skipped.<
4D1C
/div>
+  Reason reason = 1;
+}
+
 // For display only. Metadata associated with a Cloud SQL instance.
 message CloudSQLInstanceInfo {
   // Name of a Cloud SQL instance.
@@ -2330,3 +2419,11 @@ message ServerlessNegInfo {
   // URI of the serverless network endpoint group.
   string neg_uri = 1;
 }
+
+// For display only. Metadata associated with a layer 7 packet inspection by the
+// firewall.
+message NgfwPacketInspectionInfo {
+  // URI of the security profile group associated with this firewall packet
+  // inspection.
+  string security_profile_group_uri = 1;
+}