Sync: sync/5a324d76d6

nebius/ai/v1/endpoint.proto

@@ -388,6 +388,9 @@ message EndpointStatus {
 
     // The endpoint encountered an error.
     ERROR = 8;
+
+    // The endpoint is pulling an image (STARTING -> IMAGE_PULLING -> RUNNING).
+    IMAGE_PULLING = 9;
   }
 }
 
@@ -446,5 +449,8 @@ message EndpointInstanceStatus {
 
     // The endpoint encountered an error.
     ERROR = 8;
+
+    // The endpoint is pulling an image (STARTING -> IMAGE_PULLING -> RUNNING).
+    IMAGE_PULLING = 9;
   }
 }

nebius/ai/v1/job.proto

@@ -387,6 +387,9 @@ message JobStatus {
 
     // The job encountered an internal error.
     ERROR = 9;
+
+    // The job is pulling an image (STARTING -> IMAGE_PULLING -> RUNNING).
+    IMAGE_PULLING = 10;
   }
 }
 
@@ -451,5 +454,8 @@ message JobInstanceStatus {
 
     // The job encountered an internal error.
     ERROR = 10;
+
+    // The job is pulling an image (STARTING -> IMAGE_PULLING -> RUNNING).
+    IMAGE_PULLING = 11;
   }
 }

nebius/common/v1/metadata.proto

@@ -20,7 +20,9 @@ message ResourceMetadata {
   string parent_id = 2 [(buf.validate.field).required = true];
 
   // Human readable name for the resource.
-  string name = 3;
+  string name = 3 [(buf.validate.field) = {
+    string: {max_bytes: 1024}
+  }];
 
   // Version of the resource for safe concurrent modifications and consistent reads.
   // Positive and monotonically increases on each resource spec change (but *not* on each change of the
@@ -45,5 +47,8 @@ message ResourceMetadata {
 message GetByNameRequest {
   string parent_id = 1 [(buf.validate.field).required = true];
 
-  string name = 2 [(buf.validate.field).required = true];
+  string name = 2 [(buf.validate.field) = {
+    string: {max_bytes: 1024}
+    required: true
+  }];
 }

nebius/compute/v1/disk.proto

@@ -68,6 +68,8 @@ message DiskSpec {
     string source_image_id = 8 [(field_behavior) = IMMUTABLE];
 
     SourceImageFamily source_image_family = 10 [(field_behavior) = IMMUTABLE];
+
+    string source_snapshot_id = 13 [(field_behavior) = IMMUTABLE];
   }
 
   // Defines how data on the disk is encrypted. By default, no encryption is applied.

nebius/compute/v1/instance.proto

@@ -43,7 +43,7 @@ message InstanceSpec {
   }];
 
   // Specified boot disk attached to the instance.
-  AttachedDiskSpec boot_disk = 5;
+  AttachedDiskSpec boot_disk = 5 [(buf.validate.field).required = true];
 
   // List of additional data disks attached to the instance beyond the boot disk.
   repeated AttachedDiskSpec secondary_disks = 6;

nebius/iam/v1/federated_credentials_service.proto

@@ -14,8 +14,10 @@ option java_outer_classname = "FederatedCredentialsServiceProto";
 option java_package = "ai.nebius.pub.iam.v1";
 
 // [PUBLIC PREVIEW]
-// This feature is currently available only for early adopters.
-// Contact the support team to check whether your tenant is eligible for it.
+// The federated credentials feature is currently fully available with Nebius Managed Kubernetes issuers.
+// Custom external credentials providers are available only for early adopters.
+// Contact the support team to check whether this feature is available for your tenant.
+// Alternatively, you can use them in conjunction with local JWK set storage without limitations.
 service FederatedCredentialsService {
   option (api_service_name) = "cpl.iam";
 

nebius/kms/v1/asymmetric_key.proto

@@ -29,7 +29,9 @@ enum AsymmetricAlgorithm {
 
 // An asymmetric KMS key that may contain several versions of the cryptographic material.
 message AsymmetricKey {
-  common.v1.ResourceMetadata metadata = 1;
+  common.v1.ResourceMetadata metadata = 1 [(nid) = {
+    parent_resource: ["project"]
+  }];
 
   // The specifications of the asymmetric key.
   AsymmetricKeySpec spec = 2;

nebius/kms/v1/asymmetric_key_service.proto

@@ -46,15 +46,25 @@ service AsymmetricKeyService {
 
 message CreateAsymmetricKeyRequest {
   // The metadata for the resource.
-  common.v1.ResourceMetadata metadata = 1 [(buf.validate.field).required = true];
+  common.v1.ResourceMetadata metadata = 1 [
+    (buf.validate.field).required = true,
+    (nid) = {
+      parent_resource: ["project"]
+    }
+  ];
 
   // The specifications for creating an asymmetric key.
   AsymmetricKeySpec spec = 2 [(buf.validate.field).required = true];
 }
 
 message UpdateAsymmetricKeyRequest {
   // The metadata for the resource.
-  common.v1.ResourceMetadata metadata = 1 [(buf.validate.field).required = true];
+  common.v1.ResourceMetadata metadata = 1 [
+    (buf.validate.field).required = true,
+    (nid) = {
+      parent_resource: ["project"]
+    }
+  ];
 
   // The specifications for updating an asymmetric key.
   AsymmetricKeySpec spec = 2;
@@ -63,7 +73,12 @@ message UpdateAsymmetricKeyRequest {
 message GetAsymmetricKeyRequest {
   // ID of the asymmetric KMS key to return.
   // To get the ID of an asymmetric KMS key use an [AsymmetricKeyService.List] request.
-  string id = 1 [(buf.validate.field).required = true];
+  string id = 1 [
+    (buf.validate.field).required = true,
+    (nid) = {
+      resource: ["kmsasymkey"]
+    }
+  ];
 
   // By default, Get doesn't return resource if it is scheduled for deletion.
   // If show_scheduled_for_deletion = true, the Get operation returns the resource even if it is scheduled for deletion.
@@ -74,14 +89,24 @@ message GetAsymmetricKeyRequest {
 message GetAsymmetricKeyByNameRequest {
   // Parent Id and name of the asymmetric KMS key to return.
   // To get the name of an asymmetric KMS key use an [AsymmetricKeyService.List] request.
-  string parent_id = 1 [(buf.validate.field).required = true];
+  string parent_id = 1 [
+    (buf.validate.field).required = true,
+    (nid) = {
+      resource: ["project"]
+    }
+  ];
 
   string name = 2 [(buf.validate.field).required = true];
 }
 
 message ListAsymmetricKeysRequest {
   // ID of the container to list asymmetric KMS keys in.
-  string parent_id = 1 [(buf.validate.field).required = true];
+  string parent_id = 1 [
+    (buf.validate.field).required = true,
+    (nid) = {
+      resource: ["project"]
+    }
+  ];
 
   // The maximum number of results per page to return. If the number of available
   // results is larger than [page_size], the service returns a [ListAsymmetricKeysResponse.next_page_token]
@@ -113,12 +138,22 @@ message ListAsymmetricKeysResponse {
 message DeleteAsymmetricKeyRequest {
   // ID of the asymmetric KMS key to schedule for deletion.
   // To get the ID of an asymmetric KMS key use an [AsymmetricKeyService.List] request.
-  string id = 1 [(buf.validate.field).required = true];
+  string id = 1 [
+    (buf.validate.field).required = true,
+    (nid) = {
+      resource: ["kmsasymkey"]
+    }
+  ];
 }
 
 message UpdateAsymmetricKeyDeletionDelayRequest {
   // ID of the asymmetric KMS key scheduled for deletion.
-  string id = 1 [(buf.validate.field).required = true];
+  string id = 1 [
+    (buf.validate.field).required = true,
+    (nid) = {
+      resource: ["kmsasymkey"]
+    }
+  ];
 
   // Deletion delay applied from the update timestamp.
   // Example: "86400s" (1 day). Valid range: 86400s (1 day) to 2592000s (30 days).
@@ -133,7 +168,12 @@ message UpdateAsymmetricKeyDeletionDelayRequest {
 
 message UndeleteAsymmetricKeyRequest {
   // ID of the asymmetric KMS key to restore.
-  string id = 1 [(buf.validate.field).required = true];
+  string id = 1 [
+    (buf.validate.field).required = true,
+    (nid) = {
+      resource: ["kmsasymkey"]
+    }
+  ];
 
   // A new name in case the current one is already in use.
   string name = 2;

nebius/kms/v1/symmetric_key.proto

@@ -30,7 +30,9 @@ enum SymmetricAlgorithm {
 
 // A symmetric KMS key.
 message SymmetricKey {
-  common.v1.ResourceMetadata metadata = 1;
+  common.v1.ResourceMetadata metadata = 1 [(nid) = {
+    parent_resource: ["project"]
+  }];
 
   // The specifications of the symmetric key.
   SymmetricKeySpec spec = 2;

nebius/kms/v1/symmetric_key_service.proto

@@ -49,14 +49,24 @@ service SymmetricKeyService {
 }
 
 message CreateSymmetricKeyRequest {
-  common.v1.ResourceMetadata metadata = 1 [(buf.validate.field).required = true];
+  common.v1.ResourceMetadata metadata = 1 [
+    (buf.validate.field).required = true,
+    (nid) = {
+      parent_resource: ["project"]
+    }
+  ];
 
   SymmetricKeySpec spec = 2 [(buf.validate.field).required = true];
 }
 
 message UpdateSymmetricKeyRequest {
   // The metadata for the resource.
-  common.v1.ResourceMetadata metadata = 1 [(buf.validate.field).required = true];
+  common.v1.ResourceMetadata metadata = 1 [
+    (buf.validate.field).required = true,
+    (nid) = {
+      parent_resource: ["project"]
+    }
+  ];
 
   // The specifications for updating a symmetric key.
   SymmetricKeySpec spec = 2;
@@ -65,7 +75,12 @@ message UpdateSymmetricKeyRequest {
 message GetSymmetricKeyRequest {
   // ID of the symmetric KMS key to return.
   // To get the ID of a symmetric KMS key use a [SymmetricKeyService.List] request.
-  string id = 1 [(buf.validate.field).required = true];
+  string id = 1 [
+    (buf.validate.field).required = true,
+    (nid) = {
+      resource: ["kmssymkey"]
+    }
+  ];
 
   // By default, Get doesn't return resource if it is scheduled for deletion.
   // If show_scheduled_for_deletion = true, the Get operation returns the resource even if it is scheduled for deletion.
@@ -76,13 +91,23 @@ message GetSymmetricKeyRequest {
 message GetSymmetricKeyByNameRequest {
   // ParentId and name of the symmetric KMS key to return.
   // To get the name of a symmetric KMS key use a [SymmetricKeyService.List] request.
-  string parent_id = 1 [(buf.validate.field).required = true];
+  string parent_id = 1 [
+    (buf.validate.field).required = true,
+    (nid) = {
+      resource: ["project"]
+    }
+  ];
 
   string name = 2 [(buf.validate.field).required = true];
 }
 
 message ListSymmetricKeysRequest {
-  string parent_id = 1 [(buf.validate.field).required = true];
+  string parent_id = 1 [
+    (buf.validate.field).required = true,
+    (nid) = {
+      resource: ["project"]
+    }
+  ];
 
   // The maximum number of results per page to return. If the number of available
   // results is larger than [page_size], the service returns a [ListSymmetricKeysResponse.next_page_token]
@@ -113,18 +138,33 @@ message ListSymmetricKeysResponse {
 
 message RotateSymmetricKeyRequest {
   // ID of the key to be rotated.
-  string id = 1 [(buf.validate.field).required = true];
+  string id = 1 [
+    (buf.validate.field).required = true,
+    (nid) = {
+      resource: ["kmssymkey"]
+    }
+  ];
 }
 
 message DeleteSymmetricKeyRequest {
   // ID of the symmetric KMS key to schedule for deletion.
   // To get the ID of a symmetric KMS key use a [SymmetricKeyService.List] request.
-  string id = 1 [(buf.validate.field).required = true];
+  string id = 1 [
+    (buf.validate.field).required = true,
+    (nid) = {
+      resource: ["kmssymkey"]
+    }
+  ];
 }
 
 message UpdateSymmetricKeyDeletionDelayRequest {
   // ID of the symmetric KMS key scheduled for deletion.
-  string id = 1 [(buf.validate.field).required = true];
+  string id = 1 [
+    (buf.validate.field).required = true,
+    (nid) = {
+      resource: ["kmssymkey"]
+    }
+  ];
 
   // Deletion delay applied from the update timestamp.
   // Example: "86400s" (1 day). Valid range: 86400s (1 day) to 2592000s (30 days).
@@ -139,7 +179,12 @@ message UpdateSymmetricKeyDeletionDelayRequest {
 
 message UndeleteSymmetricKeyRequest {
   // ID of the symmetric KMS key to restore.
-  string id = 1 [(buf.validate.field).required = true];
+  string id = 1 [
+    (buf.validate.field).required = true,
+    (nid) = {
+      resource: ["kmssymkey"]
+    }
+  ];
 
   // A new name in case the current one is already in use.
   string name = 2;

nebius/mk8s/v1/cluster.proto

@@ -20,6 +20,11 @@ message Cluster {
           id: "metadata_name"
           message: "'name' must be 1 to 63 characters long and use only letters, digits, '-', or '_', starting and ending with a letter or digit"
           expression: "size(this.name) >= 1 && size(this.name) <= 63 && this.name.matches('^(([A-Za-z0-9][-A-Za-z0-9_]*)?[A-Za-z0-9])?$')"
+        },
+        {
+          id: "metadata_parent_id"
+          message: "'parent_id' must be no more than 63 characters long"
+          expression: "size(this.parent_id) <= 63"
         }
       ]
     },

nebius/mk8s/v1/cluster_service.proto

@@ -47,6 +47,11 @@ message CreateClusterRequest {
           id: "metadata_name"
           message: "'name' must be 1 to 63 characters long and use only letters, digits, '-', or '_', starting and ending with a letter or digit"
           expression: "size(this.name) >= 1 && size(this.name) <= 63 && this.name.matches('^(([A-Za-z0-9][-A-Za-z0-9_]*)?[A-Za-z0-9])?$')"
+        },
+        {
+          id: "metadata_parent_id"
+          message: "'parent_id' must be no more than 63 characters long"
+          expression: "size(this.parent_id) <= 63"
         }
       ]
       required: true

nebius/mysterybox/v1/secret.proto

@@ -13,7 +13,9 @@ option java_outer_classname = "SecretProto";
 option java_package = "ai.nebius.pub.mysterybox.v1";
 
 message Secret {
-  common.v1.ResourceMetadata metadata = 1;
+  common.v1.ResourceMetadata metadata = 1 [(nid) = {
+    parent_resource: ["project"]
+  }];
 
   // The specifications for creating a secret.
   SecretSpec spec = 2;
@@ -27,7 +29,12 @@ message SecretSpec {
   string description = 1;
 
   // Specifies the primary version of the secret to update its payload. This parameter should only be provided during update operations.
-  optional string primary_version_id = 3 [(field_behavior) = NON_EMPTY_DEFAULT];
+  optional string primary_version_id = 3 [
+    (field_behavior) = NON_EMPTY_DEFAULT,
+    (nid) = {
+      resource: ["mbsecver"]
+    }
+  ];
 
   // Secret's version specification, defines the secret version, including its payload. This parameter must be specified only during create
   // operations.
@@ -57,5 +64,7 @@ message SecretStatus {
   // Time when key should be totally deleted from DB
   google.protobuf.Timestamp purge_at = 3;
 
-  string effective_kms_key_id = 4;
+  string effective_kms_key_id = 4 [(nid) = {
+    resource: ["kmssymkey"]
+  }];
 }