iam

type CreateWorkloadIdentityPoolProviderRequest struct {

	// Required. The pool to create this provider in.
	Parent string `protobuf:"bytes,1,opt,name=parent,proto3" json:"parent,omitempty"`
	// Required. The provider to create.
	WorkloadIdentityPoolProvider *WorkloadIdentityPoolProvider `` /* 149-byte string literal not displayed */
	// Required. The ID for the provider, which becomes the
	// final component of the resource name. This value must be 4-32 characters,
	// and may contain the characters [a-z0-9-]. The prefix `gcp-` is
	// reserved for use by Google, and may not be specified.
	WorkloadIdentityPoolProviderId string `` /* 157-byte string literal not displayed */
	// contains filtered or unexported fields
}

type CreateWorkloadIdentityPoolRequest struct {

	// Required. The parent resource to create the pool in. The only supported
	// location is `global`.
	Parent string `protobuf:"bytes,1,opt,name=parent,proto3" json:"parent,omitempty"`
	// Required. The pool to create.
	WorkloadIdentityPool *WorkloadIdentityPool `protobuf:"bytes,2,opt,name=workload_identity_pool,json=workloadIdentityPool,proto3" json:"workload_identity_pool,omitempty"`
	// Required. The ID to use for the pool, which becomes the
	// final component of the resource name. This value should be 4-32 characters,
	// and may contain the characters [a-z0-9-]. The prefix `gcp-` is
	// reserved for use by Google, and may not be specified.
	WorkloadIdentityPoolId string `` /* 131-byte string literal not displayed */
	// contains filtered or unexported fields
}

type DeleteWorkloadIdentityPoolProviderRequest struct {

	// Required. The name of the provider to delete.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type DeleteWorkloadIdentityPoolRequest struct {

	// Required. The name of the pool to delete.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type GetWorkloadIdentityPoolProviderRequest struct {

	// Required. The name of the provider to retrieve.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type GetWorkloadIdentityPoolRequest struct {

	// Required. The name of the pool to retrieve.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type ListWorkloadIdentityPoolProvidersRequest struct {

	// Required. The pool to list providers for.
	Parent string `protobuf:"bytes,1,opt,name=parent,proto3" json:"parent,omitempty"`
	// The maximum number of providers to return.
	// If unspecified, at most 50 providers are returned.
	// The maximum value is 100; values above 100 are truncated to 100.
	PageSize int32 `protobuf:"varint,2,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
	// A page token, received from a previous
	// `ListWorkloadIdentityPoolProviders` call. Provide this to retrieve the
	// subsequent page.
	PageToken string `protobuf:"bytes,3,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
	// Whether to return soft-deleted providers.
	ShowDeleted bool `protobuf:"varint,4,opt,name=show_deleted,json=showDeleted,proto3" json:"show_deleted,omitempty"`
	// contains filtered or unexported fields
}

type ListWorkloadIdentityPoolProvidersResponse struct {

	// A list of providers.
	WorkloadIdentityPoolProviders []*WorkloadIdentityPoolProvider `` /* 152-byte string literal not displayed */
	// A token, which can be sent as `page_token` to retrieve the next page.
	// If this field is omitted, there are no subsequent pages.
	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
	// contains filtered or unexported fields
}

type ListWorkloadIdentityPoolsRequest struct {

	// Required. The parent resource to list pools for.
	Parent string `protobuf:"bytes,1,opt,name=parent,proto3" json:"parent,omitempty"`
	// The maximum number of pools to return.
	// If unspecified, at most 50 pools are returned.
	// The maximum value is 1000; values above are 1000 truncated to 1000.
	PageSize int32 `protobuf:"varint,2,opt,name=page_size,json=pageSize,proto3" json:"page_size,omitempty"`
	// A page token, received from a previous `ListWorkloadIdentityPools`
	// call. Provide this to retrieve the subsequent page.
	PageToken string `protobuf:"bytes,3,opt,name=page_token,json=pageToken,proto3" json:"page_token,omitempty"`
	// Whether to return soft-deleted pools.
	ShowDeleted bool `protobuf:"varint,4,opt,name=show_deleted,json=showDeleted,proto3" json:"show_deleted,omitempty"`
	// contains filtered or unexported fields
}

type ListWorkloadIdentityPoolsResponse struct {

	// A list of pools.
	WorkloadIdentityPools []*WorkloadIdentityPool `` /* 126-byte string literal not displayed */
	// A token, which can be sent as `page_token` to retrieve the next page.
	// If this field is omitted, there are no subsequent pages.
	NextPageToken string `protobuf:"bytes,2,opt,name=next_page_token,json=nextPageToken,proto3" json:"next_page_token,omitempty"`
	// contains filtered or unexported fields
}

type UndeleteWorkloadIdentityPoolProviderRequest struct {

	// Required. The name of the provider to undelete.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type UndeleteWorkloadIdentityPoolRequest struct {

	// Required. The name of the pool to undelete.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// contains filtered or unexported fields
}

type UnimplementedWorkloadIdentityPoolsServer struct {
}

type UpdateWorkloadIdentityPoolProviderRequest struct {

	// Required. The provider to update.
	WorkloadIdentityPoolProvider *WorkloadIdentityPoolProvider `` /* 149-byte string literal not displayed */
	// Required. The list of fields to update.
	UpdateMask *fieldmaskpb.FieldMask `protobuf:"bytes,2,opt,name=update_mask,json=updateMask,proto3" json:"update_mask,omitempty"`
	// contains filtered or unexported fields
}

type UpdateWorkloadIdentityPoolRequest struct {

	// Required. The pool to update. The `name` field is used to identify the pool.
	WorkloadIdentityPool *WorkloadIdentityPool `protobuf:"bytes,1,opt,name=workload_identity_pool,json=workloadIdentityPool,proto3" json:"workload_identity_pool,omitempty"`
	// Required. The list of fields update.
	UpdateMask *fieldmaskpb.FieldMask `protobuf:"bytes,2,opt,name=update_mask,json=updateMask,proto3" json:"update_mask,omitempty"`
	// contains filtered or unexported fields
}

type WorkloadIdentityPool struct {

	// Output only. The resource name of the pool.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// A display name for the pool. Cannot exceed 32 characters.
	DisplayName string `protobuf:"bytes,2,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"`
	// A description of the pool. Cannot exceed 256 characters.
	Description string `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty"`
	// Output only. The state of the pool.
	State WorkloadIdentityPool_State `protobuf:"varint,4,opt,name=state,proto3,enum=google.iam.v1beta.WorkloadIdentityPool_State" json:"state,omitempty"`
	// Whether the pool is disabled. You cannot use a disabled pool to exchange
	// tokens, or use existing tokens to access resources. If
	// the pool is re-enabled, existing tokens grant access again.
	Disabled bool `protobuf:"varint,5,opt,name=disabled,proto3" json:"disabled,omitempty"`
	// contains filtered or unexported fields
}

type WorkloadIdentityPoolOperationMetadata struct {
	// contains filtered or unexported fields
}

type WorkloadIdentityPoolProvider struct {

	// Output only. The resource name of the provider.
	Name string `protobuf:"bytes,1,opt,name=name,proto3" json:"name,omitempty"`
	// A display name for the provider. Cannot exceed 32 characters.
	DisplayName string `protobuf:"bytes,2,opt,name=display_name,json=displayName,proto3" json:"display_name,omitempty"`
	// A description for the provider. Cannot exceed 256 characters.
	Description string `protobuf:"bytes,3,opt,name=description,proto3" json:"description,omitempty"`
	// Output only. The state of the provider.
	State WorkloadIdentityPoolProvider_State `protobuf:"varint,4,opt,name=state,proto3,enum=google.iam.v1beta.WorkloadIdentityPoolProvider_State" json:"state,omitempty"`
	// Whether the provider is disabled. You cannot use a disabled provider to
	// exchange tokens. However, existing tokens still grant access.
	Disabled bool `protobuf:"varint,5,opt,name=disabled,proto3" json:"disabled,omitempty"`
	// Maps attributes from authentication credentials issued by an external
	// identity provider to Google Cloud attributes, such as `subject` and
	// `segment`.
	//
	// Each key must be a string specifying the Google Cloud IAM attribute to
	// map to.
	//
	// The following keys are supported:
	//
	// * `google.subject`: The principal IAM is authenticating. You can reference
	//                     this value in IAM bindings. This is also the
	//                     subject that appears in Cloud Logging logs.
	//                     Cannot exceed 127 characters.
	//
	// * `google.groups`: Groups the external identity belongs to. You can grant
	//                    groups access to resources using an IAM `principalSet`
	//                    binding; access applies to all members of the group.
	//
	// You can also provide custom attributes by specifying
	// `attribute.{custom_attribute}`, where `{custom_attribute}` is the name of
	// the custom attribute to be mapped. You can define a maximum of 50 custom
	// attributes. The maximum length of a mapped attribute key is
	// 100 characters, and the key may only contain the characters [a-z0-9_].
	//
	// You can reference these attributes in IAM policies to define fine-grained
	// access for a workload to Google Cloud resources. For example:
	//
	// * `google.subject`:
	// `principal://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/subject/{value}`
	//
	// * `google.groups`:
	// `principalSet://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/group/{value}`
	//
	// * `attribute.{custom_attribute}`:
	// `principalSet://iam.googleapis.com/projects/{project}/locations/{location}/workloadIdentityPools/{pool}/attribute.{custom_attribute}/{value}`
	//
	// Each value must be a [Common Expression Language]
	// (https://opensource.google/projects/cel) function that maps an
	// identity provider credential to the normalized attribute specified by the
	// corresponding map key.
	//
	// You can use the `assertion` keyword in the expression to access a JSON
	// representation of the authentication credential issued by the provider.
	//
	// The maximum length of an attribute mapping expression is 2048 characters.
	// When evaluated, the total size of all mapped attributes must not exceed
	// 8KB.
	//
	// For AWS providers, the following rules apply:
	//
	// - If no attribute mapping is defined, the following default mapping
	//   applies:
	//
	//   “`
	//   {
	//     "google.subject":"assertion.arn",
	//     "attribute.aws_role":
	//         "assertion.arn.contains('assumed-role')"
	//         " ? assertion.arn.extract('{account_arn}assumed-role/')"
	//         "   + 'assumed-role/'"
	//         "   + assertion.arn.extract('assumed-role/{role_name}/')"
	//         " : assertion.arn",
	//   }
	//   “`
	//
	// - If any custom attribute mappings are defined, they must include a mapping
	//   to the `google.subject` attribute.
	//
	//
	// For OIDC providers, the following rules apply:
	//
	// - Custom attribute mappings must be defined, and must include a mapping to
	//   the `google.subject` attribute. For example, the following maps the
	//   `sub` claim of the incoming credential to the `subject` attribute on
	//   a Google token.
	//
	//   “`
	//   {"google.subject": "assertion.sub"}
	//   “`
	AttributeMapping map[string]string `` /* 197-byte string literal not displayed */
	// [A Common Expression Language](https://opensource.google/projects/cel)
	// expression, in plain text, to restrict what otherwise valid authentication
	// credentials issued by the provider should not be accepted.
	//
	// The expression must output a boolean representing whether to allow the
	// federation.
	//
	// The following keywords may be referenced in the expressions:
	//
	// * `assertion`: JSON representing the authentication credential issued by
	//                the provider.
	// * `google`: The Google attributes mapped from the assertion in the
	//             `attribute_mappings`.
	// * `attribute`: The custom attributes mapped from the assertion in the
	//                `attribute_mappings`.
	//
	// The maximum length of the attribute condition expression is 4096
	// characters. If unspecified, all valid authentication credential are
	// accepted.
	//
	// The following example shows how to only allow credentials with a mapped
	// `google.groups` value of `admins`:
	//
	// “`
	// "'admins' in google.groups"
	// “`
	AttributeCondition string `protobuf:"bytes,7,opt,name=attribute_condition,json=attributeCondition,proto3" json:"attribute_condition,omitempty"`
	// Identity provider configuration types.
	//
	// Types that are assignable to ProviderConfig:
	//	*WorkloadIdentityPoolProvider_Aws_
	//	*WorkloadIdentityPoolProvider_Oidc_
	ProviderConfig isWorkloadIdentityPoolProvider_ProviderConfig `protobuf_oneof:"provider_config"`
	// contains filtered or unexported fields
}

type WorkloadIdentityPoolProviderOperationMetadata struct {
	// contains filtered or unexported fields
}

type WorkloadIdentityPoolProvider_Aws struct {

	// Required. The AWS account ID.
	AccountId string `protobuf:"bytes,1,opt,name=account_id,json=accountId,proto3" json:"account_id,omitempty"`
	// contains filtered or unexported fields
}

type WorkloadIdentityPoolProvider_Aws_ struct {
	// An Amazon Web Services identity provider.
	Aws *WorkloadIdentityPoolProvider_Aws `protobuf:"bytes,8,opt,name=aws,proto3,oneof"`
}

type WorkloadIdentityPoolProvider_Oidc struct {

	// Required. The OIDC issuer URL.
	IssuerUri string `protobuf:"bytes,1,opt,name=issuer_uri,json=issuerUri,proto3" json:"issuer_uri,omitempty"`
	// Acceptable values for the `aud` field (audience) in the OIDC token. Token
	// exchange requests are rejected if the token audience does not match one
	// of the configured values. Each audience may be at most 256 characters. A
	// maximum of 10 audiences may be configured.
	//
	// If this list is empty, the OIDC token audience must be equal to
	// the full canonical resource name of the WorkloadIdentityPoolProvider,
	// with or without the HTTPS prefix. For example:
	//
	// “`
	// //iam.googleapis.com/projects/<project-number>/locations/<location>/workloadIdentityPools/<pool-id>/providers/<provider-id>
	// https://iam.googleapis.com/projects/<project-number>/locations/<location>/workloadIdentityPools/<pool-id>/providers/<provider-id>
	// “`
	AllowedAudiences []string `protobuf:"bytes,2,rep,name=allowed_audiences,json=allowedAudiences,proto3" json:"allowed_audiences,omitempty"`
	// contains filtered or unexported fields
}

type WorkloadIdentityPoolProvider_Oidc_ struct {
	// An OpenId Connect 1.0 identity provider.
	Oidc *WorkloadIdentityPoolProvider_Oidc `protobuf:"bytes,9,opt,name=oidc,proto3,oneof"`
}

type WorkloadIdentityPoolProvider_State int32

type WorkloadIdentityPool_State int32

type WorkloadIdentityPoolsClient interface {
	// Lists all non-deleted
	// [WorkloadIdentityPool][google.iam.v1beta.WorkloadIdentityPool]s in a
	// project. If `show_deleted` is set to `true`, then deleted pools are also
	// listed.
	ListWorkloadIdentityPools(ctx context.Context, in *ListWorkloadIdentityPoolsRequest, opts ...grpc.CallOption) (*ListWorkloadIdentityPoolsResponse, error)
	// Gets an individual
	// [WorkloadIdentityPool][google.iam.v1beta.WorkloadIdentityPool].
	GetWorkloadIdentityPool(ctx context.Context, in *GetWorkloadIdentityPoolRequest, opts ...grpc.CallOption) (*WorkloadIdentityPool, error)
	// Creates a new
	// [WorkloadIdentityPool][google.iam.v1beta.WorkloadIdentityPool].
	//
	// You cannot reuse the name of a deleted pool until 30 days after deletion.
	CreateWorkloadIdentityPool(ctx context.Context, in *CreateWorkloadIdentityPoolRequest, opts ...grpc.CallOption) (*longrunning.Operation, error)
	// Updates an existing
	// [WorkloadIdentityPool][google.iam.v1beta.WorkloadIdentityPool].
	UpdateWorkloadIdentityPool(ctx context.Context, in *UpdateWorkloadIdentityPoolRequest, opts ...grpc.CallOption) (*longrunning.Operation, error)
	// Deletes a
	// [WorkloadIdentityPool][google.iam.v1beta.WorkloadIdentityPool].
	//
	// You cannot use a deleted pool to exchange external
	// credentials for Google Cloud credentials. However, deletion does
	// not revoke credentials that have already been issued.
	// Credentials issued for a deleted pool do not grant access to resources.
	// If the pool is undeleted, and the credentials are not expired, they
	// grant access again.
	// You can undelete a pool for 30 days. After 30 days, deletion is
	// permanent.
	// You cannot update deleted pools. However, you can view and list them.
	DeleteWorkloadIdentityPool(ctx context.Context, in *DeleteWorkloadIdentityPoolRequest, opts ...grpc.CallOption) (*longrunning.Operation, error)
	// Undeletes a [WorkloadIdentityPool][google.iam.v1beta.WorkloadIdentityPool],
	// as long as it was deleted fewer than 30 days ago.
	UndeleteWorkloadIdentityPool(ctx context.Context, in *UndeleteWorkloadIdentityPoolRequest, opts ...grpc.CallOption) (*longrunning.Operation, error)
	// Lists all non-deleted
	// [WorkloadIdentityPoolProvider][google.iam.v1beta.WorkloadIdentityPoolProvider]s
	// in a [WorkloadIdentityPool][google.iam.v1beta.WorkloadIdentityPool].
	// If `show_deleted` is set to `true`, then deleted providers are also listed.
	ListWorkloadIdentityPoolProviders(ctx context.Context, in *ListWorkloadIdentityPoolProvidersRequest, opts ...grpc.CallOption) (*ListWorkloadIdentityPoolProvidersResponse, error)
	// Gets an individual
	// [WorkloadIdentityPoolProvider][google.iam.v1beta.WorkloadIdentityPoolProvider].
	GetWorkloadIdentityPoolProvider(ctx context.Context, in *GetWorkloadIdentityPoolProviderRequest, opts ...grpc.CallOption) (*WorkloadIdentityPoolProvider, error)
	// Creates a new
	// [WorkloadIdentityPoolProvider][google.iam.v1beta.WorkloadIdentityProvider]
	// in a [WorkloadIdentityPool][google.iam.v1beta.WorkloadIdentityPool].
	//
	// You cannot reuse the name of a deleted provider until 30 days after
	// deletion.
	CreateWorkloadIdentityPoolProvider(ctx context.Context, in *CreateWorkloadIdentityPoolProviderRequest, opts ...grpc.CallOption) (*longrunning.Operation, error)
	// Updates an existing
	// [WorkloadIdentityPoolProvider][google.iam.v1beta.WorkloadIdentityProvider].
	UpdateWorkloadIdentityPoolProvider(ctx context.Context, in *UpdateWorkloadIdentityPoolProviderRequest, opts ...grpc.CallOption) (*longrunning.Operation, error)
	// Deletes a
	// [WorkloadIdentityPoolProvider][google.iam.v1beta.WorkloadIdentityProvider].
	// Deleting a provider does not revoke credentials that have already been
	// issued; they continue to grant access.
	// You can undelete a provider for 30 days. After 30 days, deletion is
	// permanent.
	// You cannot update deleted providers. However, you can view and list them.
	DeleteWorkloadIdentityPoolProvider(ctx context.Context, in *DeleteWorkloadIdentityPoolProviderRequest, opts ...grpc.CallOption) (*longrunning.Operation, error)
	// Undeletes a
	// [WorkloadIdentityPoolProvider][google.iam.v1beta.WorkloadIdentityProvider],
	// as long as it was deleted fewer than 30 days ago.
	UndeleteWorkloadIdentityPoolProvider(ctx context.Context, in *UndeleteWorkloadIdentityPoolProviderRequest, opts ...grpc.CallOption) (*longrunning.Operation, error)
}

type WorkloadIdentityPoolsServer interface {
	// Lists all non-deleted
	// [WorkloadIdentityPool][google.iam.v1beta.WorkloadIdentityPool]s in a
	// project. If `show_deleted` is set to `true`, then deleted pools are also
	// listed.
	ListWorkloadIdentityPools(context.Context, *ListWorkloadIdentityPoolsRequest) (*ListWorkloadIdentityPoolsResponse, error)
	// Gets an individual
	// [WorkloadIdentityPool][google.iam.v1beta.WorkloadIdentityPool].
	GetWorkloadIdentityPool(context.Context, *GetWorkloadIdentityPoolRequest) (*WorkloadIdentityPool, error)
	// Creates a new
	// [WorkloadIdentityPool][google.iam.v1beta.WorkloadIdentityPool].
	//
	// You cannot reuse the name of a deleted pool until 30 days after deletion.
	CreateWorkloadIdentityPool(context.Context, *CreateWorkloadIdentityPoolRequest) (*longrunning.Operation, error)
	// Updates an existing
	// [WorkloadIdentityPool][google.iam.v1beta.WorkloadIdentityPool].
	UpdateWorkloadIdentityPool(context.Context, *UpdateWorkloadIdentityPoolRequest) (*longrunning.Operation, error)
	// Deletes a
	// [WorkloadIdentityPool][google.iam.v1beta.WorkloadIdentityPool].
	//
	// You cannot use a deleted pool to exchange external
	// credentials for Google Cloud credentials. However, deletion does
	// not revoke credentials that have already been issued.
	// Credentials issued for a deleted pool do not grant access to resources.
	// If the pool is undeleted, and the credentials are not expired, they
	// grant access again.
	// You can undelete a pool for 30 days. After 30 days, deletion is
	// permanent.
	// You cannot update deleted pools. However, you can view and list them.
	DeleteWorkloadIdentityPool(context.Context, *DeleteWorkloadIdentityPoolRequest) (*longrunning.Operation, error)
	// Undeletes a [WorkloadIdentityPool][google.iam.v1beta.WorkloadIdentityPool],
	// as long as it was deleted fewer than 30 days ago.
	UndeleteWorkloadIdentityPool(context.Context, *UndeleteWorkloadIdentityPoolRequest) (*longrunning.Operation, error)
	// Lists all non-deleted
	// [WorkloadIdentityPoolProvider][google.iam.v1beta.WorkloadIdentityPoolProvider]s
	// in a [WorkloadIdentityPool][google.iam.v1beta.WorkloadIdentityPool].
	// If `show_deleted` is set to `true`, then deleted providers are also listed.
	ListWorkloadIdentityPoolProviders(context.Context, *ListWorkloadIdentityPoolProvidersRequest) (*ListWorkloadIdentityPoolProvidersResponse, error)
	// Gets an individual
	// [WorkloadIdentityPoolProvider][google.iam.v1beta.WorkloadIdentityPoolProvider].
	GetWorkloadIdentityPoolProvider(context.Context, *GetWorkloadIdentityPoolProviderRequest) (*WorkloadIdentityPoolProvider, error)
	// Creates a new
	// [WorkloadIdentityPoolProvider][google.iam.v1beta.WorkloadIdentityProvider]
	// in a [WorkloadIdentityPool][google.iam.v1beta.WorkloadIdentityPool].
	//
	// You cannot reuse the name of a deleted provider until 30 days after
	// deletion.
	CreateWorkloadIdentityPoolProvider(context.Context, *CreateWorkloadIdentityPoolProviderRequest) (*longrunning.Operation, error)
	// Updates an existing
	// [WorkloadIdentityPoolProvider][google.iam.v1beta.WorkloadIdentityProvider].
	UpdateWorkloadIdentityPoolProvider(context.Context, *UpdateWorkloadIdentityPoolProviderRequest) (*longrunning.Operation, error)
	// Deletes a
	// [WorkloadIdentityPoolProvider][google.iam.v1beta.WorkloadIdentityProvider].
	// Deleting a provider does not revoke credentials that have already been
	// issued; they continue to grant access.
	// You can undelete a provider for 30 days. After 30 days, deletion is
	// permanent.
	// You cannot update deleted providers. However, you can view and list them.
	DeleteWorkloadIdentityPoolProvider(context.Context, *DeleteWorkloadIdentityPoolProviderRequest) (*longrunning.Operation, error)
	// Undeletes a
	// [WorkloadIdentityPoolProvider][google.iam.v1beta.WorkloadIdentityProvider],
	// as long as it was deleted fewer than 30 days ago.
	UndeleteWorkloadIdentityPoolProvider(context.Context, *UndeleteWorkloadIdentityPoolProviderRequest) (*longrunning.Operation, error)
}