From f94bb12a58de6b6d9da7b236fe5c78c9c2be1f33 Mon Sep 17 00:00:00 2001 From: dobrac <4323173+dobrac@users.noreply.github.com> Date: Fri, 13 Nov 2026 15:21:56 +0000 Subject: [PATCH] chore: sync infra OpenAPI specs --- spec/openapi.infra.yaml | 121 +++++++++++++- src/core/shared/contracts/infra-api.types.ts | 167 +++++++++++++++++-- 2 files changed, 275 insertions(+), 13 deletions(-) diff --git a/spec/openapi.infra.yaml b/spec/openapi.infra.yaml index 0e54deeaf..86b0b8b14 100644 --- a/spec/openapi.infra.yaml +++ b/spec/openapi.infra.yaml @@ -438,6 +438,39 @@ components: $ref: "#/components/schemas/Error" schemas: + TelemetryNames: + type: object + required: [teams, clusters] + properties: + teams: + type: object + additionalProperties: + $ref: "#/components/schemas/TelemetryTeamName" + clusters: + type: array + items: + $ref: "#/components/schemas/TelemetryClusterName" + TelemetryTeamName: + type: object + required: [name] + properties: + name: + type: string + clusterId: + type: string + format: uuid + TelemetryClusterName: + type: object + required: [id, name] + properties: + id: + type: string + format: uuid + name: + type: string + clientId: + type: string + Rig: description: An orchestrator node pool backed by one cloud scaling group required: @@ -1858,6 +1891,10 @@ components: type: string nullable: true + telemetry_client_id: + type: string + minLength: 1 + ClusterUpdateRequest: type: object description: >- @@ -1976,7 +2013,9 @@ components: description: Tag the build is assigned under status: type: string - description: Build status as stored, for example ready, snapshotting or waiting + deprecated: true + x-deprecated-reason: Use statusGroup + description: Same value as statusGroup statusGroup: $ref: "#/components/schemas/AdminSandboxBuildStatusGroup" clusterNodeID: @@ -2185,7 +2224,9 @@ components: description: Tag the build is assigned under status: type: string - description: Build status as stored, for example ready, snapshotting or waiting + deprecated: true + x-deprecated-reason: Use statusGroup + description: Same value as statusGroup statusGroup: allOf: - $ref: "#/components/schemas/AdminSandboxBuildStatusGroup" @@ -3115,6 +3156,7 @@ components: type: string description: AWS Access Key ID for ECR authentication awsSecretAccessKey: + format: password type: string description: AWS Secret Access Key for ECR authentication awsRegion: @@ -3132,6 +3174,7 @@ components: enum: [gcp] description: Type of registry authentication serviceAccountJson: + format: password type: string description: Service Account JSON for GCP authentication @@ -3150,6 +3193,7 @@ components: type: string description: Username to use for the registry password: + format: password type: string description: Password to use for the registry @@ -3567,6 +3611,8 @@ components: - teamID - sandboxID - executionID + - networkMode + - volumesAttached properties: teamID: type: string @@ -3583,6 +3629,12 @@ components: type: string format: date-time description: Deadline of the operation holding the sandbox's lifecycle, absent when it is not held + networkMode: + type: string + description: Network the execution runs on, legacy, egress-router or full-router + volumesAttached: + type: boolean + description: Whether the sandbox runs with managed volumes attached NodeDetail: required: @@ -4058,6 +4110,7 @@ components: lower-cased before storage and returned in that canonical form; the sec_ prefix is reserved for secret identifiers. value: + format: password type: string description: Runtime marker stored as the secret's first version. The runtime resolves it to a value at sandbox egress. metadata: @@ -4069,6 +4122,7 @@ components: - value properties: value: + format: password type: string description: Runtime marker stored as the secret's new version. The runtime resolves it to a value at sandbox egress. metadata: @@ -4155,6 +4209,7 @@ components: type: boolean default: true signatureSecret: + format: password type: string description: Secret used to sign the webhook payloads WebhookCreation: @@ -4239,6 +4294,7 @@ components: items: type: string signatureSecret: + format: password type: string description: Secret used to sign the webhook payloads WebhookDelivery: @@ -4445,6 +4501,10 @@ components: type: string nullable: true + telemetry_client_id: + type: string + minLength: 1 + ManagementClusterProjects: type: object required: [project_ids] @@ -7635,13 +7695,33 @@ paths: "500": $ref: "#/components/responses/500" + /unstable/management/telemetry/names: + get: + operationId: managementTelemetryNames + summary: Read team and cluster names for telemetry. + description: Requires a direct mutual TLS connection from the configured telemetry reader service identity. Bearer tokens and forwarded identity headers are not accepted. Returns regional team and cluster names without connection credentials. Deleted projects and clusters being deleted are omitted. + tags: [admin] + security: [] + x-mutual-tls-required: true + responses: + "200": + description: Current regional names. + content: + application/json: + schema: + $ref: "#/components/schemas/TelemetryNames" + "401": + $ref: "#/components/responses/401" + "500": + $ref: "#/components/responses/500" + /unstable/management/clusters/{clusterID}: parameters: - $ref: "#/components/parameters/clusterID" put: operationId: managementRegisterCluster summary: Register a cluster. - description: A cluster registered here for the first time starts with deletion protection turned off. Registering an existing cluster again with the same name and auth organization updates its endpoint, TLS setting, sandbox proxy domain and token and keeps its stored deletion protection; a different name or auth organization returns a conflict with error_code cluster_registration_conflict. An invalid registration returns 400 with error_code cluster_registration_invalid. + description: A cluster registered here for the first time starts with deletion protection turned off. Registering an existing cluster again with the same auth organization updates its endpoint, TLS setting, sandbox proxy domain and token, while preserving its regional display name and deletion protection. An omitted telemetry client ID preserves the stored mapping. A different auth organization returns a conflict with error_code cluster_registration_conflict. An invalid registration returns 400 with error_code cluster_registration_invalid. tags: [admin] security: - AdminJWTAuth: [] @@ -7681,6 +7761,41 @@ paths: "500": $ref: "#/components/responses/500" + /unstable/management/clusters/{clusterID}/telemetry: + parameters: + - $ref: "#/components/parameters/clusterID" + put: + operationId: managementUpdateClusterTelemetry + summary: Update the telemetry identity of an existing cluster. + description: Changes only the telemetry client mapping. Missing or deleting clusters are refused; connection settings, credentials and names are preserved. + tags: [admin] + security: + - AdminJWTAuth: [] + requestBody: + required: true + content: + application/json: + schema: + type: object + required: [telemetry_client_id] + properties: + telemetry_client_id: + type: string + minLength: 1 + responses: + "204": + description: Telemetry identity updated. + "400": + $ref: "#/components/responses/400" + "401": + $ref: "#/components/responses/401" + "404": + $ref: "#/components/responses/404" + "409": + $ref: "#/components/responses/409" + "500": + $ref: "#/components/responses/500" + /unstable/management/clusters/{clusterID}/projects: parameters: - $ref: "#/components/parameters/clusterID" diff --git a/src/core/shared/contracts/infra-api.types.ts b/src/core/shared/contracts/infra-api.types.ts index fa350c697..7170e698f 100644 --- a/src/core/shared/contracts/infra-api.types.ts +++ b/src/core/shared/contracts/infra-api.types.ts @@ -3468,6 +3468,26 @@ export interface paths { patch?: never trace?: never } + '/unstable/management/telemetry/names': { + parameters: { + query?: never + header?: never + path?: never + cookie?: never + } + /** + * Read team and cluster names for telemetry. + * @description Requires a direct mutual TLS connection from the configured telemetry reader service identity. Bearer tokens and forwarded identity headers are not accepted. Returns regional team and cluster names without connection credentials. Deleted projects and clusters being deleted are omitted. + */ + get: operations['managementTelemetryNames'] + put?: never + post?: never + delete?: never + options?: never + head?: never + patch?: never + trace?: never + } '/unstable/management/clusters/{clusterID}': { parameters: { query?: never @@ -3481,7 +3501,7 @@ export interface paths { get?: never /** * Register a cluster. - * @description A cluster registered here for the first time starts with deletion protection turned off. Registering an existing cluster again with the same name and auth organization updates its endpoint, TLS setting, sandbox proxy domain and token and keeps its stored deletion protection; a different name or auth organization returns a conflict with error_code cluster_registration_conflict. An invalid registration returns 400 with error_code cluster_registration_invalid. + * @description A cluster registered here for the first time starts with deletion protection turned off. Registering an existing cluster again with the same auth organization updates its endpoint, TLS setting, sandbox proxy domain and token, while preserving its regional display name and deletion protection. An omitted telemetry client ID preserves the stored mapping. A different auth organization returns a conflict with error_code cluster_registration_conflict. An invalid registration returns 400 with error_code cluster_registration_invalid. */ put: operations['managementRegisterCluster'] post?: never @@ -3495,6 +3515,29 @@ export interface paths { patch?: never trace?: never } + '/unstable/management/clusters/{clusterID}/telemetry': { + parameters: { + query?: never + header?: never + path: { + /** @description Identifier of the cluster */ + clusterID: components['parameters']['clusterID'] + } + cookie?: never + } + get?: never + /** + * Update the telemetry identity of an existing cluster. + * @description Changes only the telemetry client mapping. Missing or deleting clusters are refused; connection settings, credentials and names are preserved. + */ + put: operations['managementUpdateClusterTelemetry'] + post?: never + delete?: never + options?: never + head?: never + patch?: never + trace?: never + } '/unstable/management/clusters/{clusterID}/projects': { parameters: { query?: never @@ -5453,6 +5496,23 @@ export interface paths { export type webhooks = Record export interface components { schemas: { + TelemetryNames: { + teams: { + [key: string]: components['schemas']['TelemetryTeamName'] + } + clusters: components['schemas']['TelemetryClusterName'][] + } + TelemetryTeamName: { + name: string + /** Format: uuid */ + clusterId?: string + } + TelemetryClusterName: { + /** Format: uuid */ + id: string + name: string + clientId?: string + } /** @description An orchestrator node pool backed by one cloud scaling group */ Rig: { /** @description Rig identifier (e.g. "default") */ @@ -6262,6 +6322,7 @@ export interface components { token: string sandbox_proxy_domain?: string | null auth_org_id?: string | null + telemetry_client_id?: string } /** @description Partial update; only the properties present are written. An explicit null or an empty string clears `sandboxProxyDomain` or `authOrgId`. */ ClusterUpdateRequest: { @@ -6318,7 +6379,10 @@ export interface components { templateID: string /** @description Tag the build is assigned under */ tag: string - /** @description Build status as stored, for example ready, snapshotting or waiting */ + /** + * @deprecated + * @description Same value as statusGroup + */ status: string statusGroup: components['schemas']['AdminSandboxBuildStatusGroup'] /** @description Node that produced the build, null when it was not recorded */ @@ -6449,7 +6513,10 @@ export interface components { templateId: string /** @description Tag the build is assigned under */ tag: string - /** @description Build status as stored, for example ready, snapshotting or waiting */ + /** + * @deprecated + * @description Same value as statusGroup + */ status: string /** @description Coarse build state, null when the stored group is not one of the known values */ statusGroup: components['schemas']['AdminSandboxBuildStatusGroup'] | null @@ -6967,7 +7034,10 @@ export interface components { type: 'aws' /** @description AWS Access Key ID for ECR authentication */ awsAccessKeyId: string - /** @description AWS Secret Access Key for ECR authentication */ + /** + * Format: password + * @description AWS Secret Access Key for ECR authentication + */ awsSecretAccessKey: string /** @description AWS Region where the ECR registry is located */ awsRegion: string @@ -6978,7 +7048,10 @@ export interface components { * @enum {string} */ type: 'gcp' - /** @description Service Account JSON for GCP authentication */ + /** + * Format: password + * @description Service Account JSON for GCP authentication + */ serviceAccountJson: string } GeneralRegistry: { @@ -6989,7 +7062,10 @@ export interface components { type: 'registry' /** @description Username to use for the registry */ username: string - /** @description Password to use for the registry */ + /** + * Format: password + * @description Password to use for the registry + */ password: string } /** @description Exactly one of fromImage or fromTemplate must be given and non-empty. */ @@ -7285,6 +7361,10 @@ export interface components { * @description Deadline of the operation holding the sandbox's lifecycle, absent when it is not held */ lifecycleHoldUntil?: string + /** @description Network the execution runs on, legacy, egress-router or full-router */ + networkMode: string + /** @description Whether the sandbox runs with managed volumes attached */ + volumesAttached: boolean } NodeDetail: { /** @description Identifier of the cluster */ @@ -7557,12 +7637,18 @@ export interface components { NewSecret: { /** @description Name of the secret, unique within the project. Names are lower-cased before storage and returned in that canonical form; the sec_ prefix is reserved for secret identifiers. */ name: string - /** @description Runtime marker stored as the secret's first version. The runtime resolves it to a value at sandbox egress. */ + /** + * Format: password + * @description Runtime marker stored as the secret's first version. The runtime resolves it to a value at sandbox egress. + */ value: string metadata?: components['schemas']['SecretMetadata'] } SecretUpdate: { - /** @description Runtime marker stored as the secret's new version. The runtime resolves it to a value at sandbox egress. */ + /** + * Format: password + * @description Runtime marker stored as the secret's new version. The runtime resolves it to a value at sandbox egress. + */ value: string metadata?: components['schemas']['SecretMetadata'] } @@ -7628,7 +7714,10 @@ export interface components { events: string[] /** @default true */ enabled: boolean - /** @description Secret used to sign the webhook payloads */ + /** + * Format: password + * @description Secret used to sign the webhook payloads + */ signatureSecret: string } /** @description Webhook creation response */ @@ -7675,7 +7764,10 @@ export interface components { /** Format: uri */ url?: string events?: string[] - /** @description Secret used to sign the webhook payloads */ + /** + * Format: password + * @description Secret used to sign the webhook payloads + */ signatureSecret?: string } /** @description Webhook delivery attempt */ @@ -7802,6 +7894,7 @@ export interface components { token: string sandbox_proxy_domain?: string | null auth_org_id?: string | null + telemetry_client_id?: string } ManagementClusterProjects: { project_ids: string[] @@ -8152,6 +8245,28 @@ export interface components { } export type $defs = Record export interface operations { + managementTelemetryNames: { + parameters: { + query?: never + header?: never + path?: never + cookie?: never + } + requestBody?: never + responses: { + /** @description Current regional names. */ + 200: { + headers: { + [name: string]: unknown + } + content: { + 'application/json': components['schemas']['TelemetryNames'] + } + } + 401: components['responses']['401'] + 500: components['responses']['500'] + } + } managementRegisterCluster: { parameters: { query?: never @@ -8206,6 +8321,38 @@ export interface operations { 500: components['responses']['500'] } } + managementUpdateClusterTelemetry: { + parameters: { + query?: never + header?: never + path: { + /** @description Identifier of the cluster */ + clusterID: components['parameters']['clusterID'] + } + cookie?: never + } + requestBody: { + content: { + 'application/json': { + telemetry_client_id: string + } + } + } + responses: { + /** @description Telemetry identity updated. */ + 204: { + headers: { + [name: string]: unknown + } + content?: never + } + 400: components['responses']['400'] + 401: components['responses']['401'] + 404: components['responses']['404'] + 409: components['responses']['409'] + 500: components['responses']['500'] + } + } managementListClusterProjects: { parameters: { query?: never