Sync: sync/1f2c704523

nebius/kms/v1/asymmetric_key.proto

@@ -40,7 +40,9 @@ message AsymmetricKey {
 
 message AsymmetricKeySpec {
   // Description of the key.
-  string description = 1;
+  string description = 1 [(buf.validate.field) = {
+    string: {max_bytes: 1024}
+  }];
 
   // Cryptographic algorithm that should be used with the key.
   // Must be specified only during create operations. Cannot be updated.

nebius/kms/v1/symmetric_key.proto

@@ -41,7 +41,9 @@ message SymmetricKey {
 
 message SymmetricKeySpec {
   // Description of the key.
-  string description = 1;
+  string description = 1 [(buf.validate.field) = {
+    string: {max_bytes: 1024}
+  }];
 
   // Encryption algorithm that should be used when using the key to encrypt plaintext.
   // Must be specified only during create operations. Cannot be updated.

nebius/mk8s/v1/cluster.proto

@@ -85,7 +85,23 @@ message ControlPlaneEndpointsSpec {
   PublicEndpointSpec public_endpoint = 1 [(field_behavior) = MEANINGFUL_EMPTY_VALUE];
 }
 
-message PublicEndpointSpec {}
+message PublicEndpointSpec {
+  // List of CIDR blocks from which access to public endpoint is allowed.
+  // If field is not set, or list is empty, it means that access is not restricted at all.
+  repeated string allowed_cidrs = 2 [(buf.validate.field) = {
+    repeated: {
+      items: {
+        cel: [
+          {
+            id: "string.valid_ipv4_cidr"
+            message: "Value must be a valid IPv4 CIDR, the prefix must have all zeros for the masked bits of the prefix (e.g. `127.0.0.0/16`, not `127.0.0.1/16`)."
+            expression: "this.isIpPrefix(4, true)"
+          }
+        ]
+      }
+    }
+  }];
+}
 
 message KubeNetworkSpec {
   // CIDR blocks for Service ClusterIP allocation.

nebius/mk8s/v1/node_group.proto

@@ -211,11 +211,18 @@ message NetworkInterfaceTemplate {
   // By default Cluster control plane subnet_id used.
   // Subnet should be located in the same network with control plane.
   string subnet_id = 3 [(field_behavior) = NON_EMPTY_DEFAULT];
+
+  // User provided VPC Security Groups which will be assigned to all nodes of this NodeGroup.
+  repeated SecurityGroup security_groups = 7;
 }
 
 // Describes a public IP address.
 message PublicIPAddress {}
 
+message SecurityGroup {
+  string id = 1;
+}
+
 message AttachedFilesystemSpec {
   enum AttachMode {
     UNSPECIFIED = 0;