com.pulumi.gcp.networkservices.kotlin.AuthzExtensionArgs.kt Maven / Gradle / Ivy
Go to download
Show more of this group Show more artifacts with this name
Show all versions of pulumi-gcp-kotlin Show documentation
Show all versions of pulumi-gcp-kotlin Show documentation
Build cloud applications and infrastructure by combining the safety and reliability of infrastructure as code with the power of the Kotlin programming language.
@file:Suppress("NAME_SHADOWING", "DEPRECATION")
package com.pulumi.gcp.networkservices.kotlin
import com.pulumi.core.Output
import com.pulumi.core.Output.of
import com.pulumi.gcp.networkservices.AuthzExtensionArgs.builder
import com.pulumi.kotlin.ConvertibleToJava
import com.pulumi.kotlin.PulumiTagMarker
import kotlin.Boolean
import kotlin.Pair
import kotlin.String
import kotlin.Suppress
import kotlin.collections.List
import kotlin.collections.Map
import kotlin.jvm.JvmName
/**
* AuthzExtension is a resource that allows traffic forwarding to a callout backend service to make an authorization decision.
* To get more information about AuthzExtension, see:
* * [API documentation](https://cloud.google.com/service-extensions/docs/reference/rest/v1beta1/projects.locations.authzExtensions)
* ## Example Usage
* ### Network Services Authz Extension Basic
*
* ```typescript
* import * as pulumi from "@pulumi/pulumi";
* import * as gcp from "@pulumi/gcp";
* const _default = new gcp.compute.RegionBackendService("default", {
* name: "authz-service",
* project: "my-project-name",
* region: "us-west1",
* protocol: "HTTP2",
* loadBalancingScheme: "INTERNAL_MANAGED",
* portName: "grpc",
* });
* const defaultAuthzExtension = new gcp.networkservices.AuthzExtension("default", {
* name: "my-authz-ext",
* project: "my-project-name",
* location: "us-west1",
* description: "my description",
* loadBalancingScheme: "INTERNAL_MANAGED",
* authority: "ext11.com",
* service: _default.selfLink,
* timeout: "0.1s",
* failOpen: false,
* forwardHeaders: ["Authorization"],
* });
* ```
* ```python
* import pulumi
* import pulumi_gcp as gcp
* default = gcp.compute.RegionBackendService("default",
* name="authz-service",
* project="my-project-name",
* region="us-west1",
* protocol="HTTP2",
* load_balancing_scheme="INTERNAL_MANAGED",
* port_name="grpc")
* default_authz_extension = gcp.networkservices.AuthzExtension("default",
* name="my-authz-ext",
* project="my-project-name",
* location="us-west1",
* description="my description",
* load_balancing_scheme="INTERNAL_MANAGED",
* authority="ext11.com",
* service=default.self_link,
* timeout="0.1s",
* fail_open=False,
* forward_headers=["Authorization"])
* ```
* ```csharp
* using System.Collections.Generic;
* using System.Linq;
* using Pulumi;
* using Gcp = Pulumi.Gcp;
* return await Deployment.RunAsync(() =>
* {
* var @default = new Gcp.Compute.RegionBackendService("default", new()
* {
* Name = "authz-service",
* Project = "my-project-name",
* Region = "us-west1",
* Protocol = "HTTP2",
* LoadBalancingScheme = "INTERNAL_MANAGED",
* PortName = "grpc",
* });
* var defaultAuthzExtension = new Gcp.NetworkServices.AuthzExtension("default", new()
* {
* Name = "my-authz-ext",
* Project = "my-project-name",
* Location = "us-west1",
* Description = "my description",
* LoadBalancingScheme = "INTERNAL_MANAGED",
* Authority = "ext11.com",
* Service = @default.SelfLink,
* Timeout = "0.1s",
* FailOpen = false,
* ForwardHeaders = new[]
* {
* "Authorization",
* },
* });
* });
* ```
* ```go
* package main
* import (
* "github.com/pulumi/pulumi-gcp/sdk/v8/go/gcp/compute"
* "github.com/pulumi/pulumi-gcp/sdk/v8/go/gcp/networkservices"
* "github.com/pulumi/pulumi/sdk/v3/go/pulumi"
* )
* func main() {
* pulumi.Run(func(ctx *pulumi.Context) error {
* _, err := compute.NewRegionBackendService(ctx, "default", &compute.RegionBackendServiceArgs{
* Name: pulumi.String("authz-service"),
* Project: pulumi.String("my-project-name"),
* Region: pulumi.String("us-west1"),
* Protocol: pulumi.String("HTTP2"),
* LoadBalancingScheme: pulumi.String("INTERNAL_MANAGED"),
* PortName: pulumi.String("grpc"),
* })
* if err != nil {
* return err
* }
* _, err = networkservices.NewAuthzExtension(ctx, "default", &networkservices.AuthzExtensionArgs{
* Name: pulumi.String("my-authz-ext"),
* Project: pulumi.String("my-project-name"),
* Location: pulumi.String("us-west1"),
* Description: pulumi.String("my description"),
* LoadBalancingScheme: pulumi.String("INTERNAL_MANAGED"),
* Authority: pulumi.String("ext11.com"),
* Service: _default.SelfLink,
* Timeout: pulumi.String("0.1s"),
* FailOpen: pulumi.Bool(false),
* ForwardHeaders: pulumi.StringArray{
* pulumi.String("Authorization"),
* },
* })
* if err != nil {
* return err
* }
* return nil
* })
* }
* ```
* ```java
* package generated_program;
* import com.pulumi.Context;
* import com.pulumi.Pulumi;
* import com.pulumi.core.Output;
* import com.pulumi.gcp.compute.RegionBackendService;
* import com.pulumi.gcp.compute.RegionBackendServiceArgs;
* import com.pulumi.gcp.networkservices.AuthzExtension;
* import com.pulumi.gcp.networkservices.AuthzExtensionArgs;
* import java.util.List;
* import java.util.ArrayList;
* import java.util.Map;
* import java.io.File;
* import java.nio.file.Files;
* import java.nio.file.Paths;
* public class App {
* public static void main(String[] args) {
* Pulumi.run(App::stack);
* }
* public static void stack(Context ctx) {
* var default_ = new RegionBackendService("default", RegionBackendServiceArgs.builder()
* .name("authz-service")
* .project("my-project-name")
* .region("us-west1")
* .protocol("HTTP2")
* .loadBalancingScheme("INTERNAL_MANAGED")
* .portName("grpc")
* .build());
* var defaultAuthzExtension = new AuthzExtension("defaultAuthzExtension", AuthzExtensionArgs.builder()
* .name("my-authz-ext")
* .project("my-project-name")
* .location("us-west1")
* .description("my description")
* .loadBalancingScheme("INTERNAL_MANAGED")
* .authority("ext11.com")
* .service(default_.selfLink())
* .timeout("0.1s")
* .failOpen(false)
* .forwardHeaders("Authorization")
* .build());
* }
* }
* ```
* ```yaml
* resources:
* default:
* type: gcp:compute:RegionBackendService
* properties:
* name: authz-service
* project: my-project-name
* region: us-west1
* protocol: HTTP2
* loadBalancingScheme: INTERNAL_MANAGED
* portName: grpc
* defaultAuthzExtension:
* type: gcp:networkservices:AuthzExtension
* name: default
* properties:
* name: my-authz-ext
* project: my-project-name
* location: us-west1
* description: my description
* loadBalancingScheme: INTERNAL_MANAGED
* authority: ext11.com
* service: ${default.selfLink}
* timeout: 0.1s
* failOpen: false
* forwardHeaders:
* - Authorization
* ```
*
* ## Import
* AuthzExtension can be imported using any of these accepted formats:
* * `projects/{{project}}/locations/{{location}}/authzExtensions/{{name}}`
* * `{{project}}/{{location}}/{{name}}`
* * `{{location}}/{{name}}`
* * `{{name}}`
* When using the `pulumi import` command, AuthzExtension can be imported using one of the formats above. For example:
* ```sh
* $ pulumi import gcp:networkservices/authzExtension:AuthzExtension default projects/{{project}}/locations/{{location}}/authzExtensions/{{name}}
* ```
* ```sh
* $ pulumi import gcp:networkservices/authzExtension:AuthzExtension default {{project}}/{{location}}/{{name}}
* ```
* ```sh
* $ pulumi import gcp:networkservices/authzExtension:AuthzExtension default {{location}}/{{name}}
* ```
* ```sh
* $ pulumi import gcp:networkservices/authzExtension:AuthzExtension default {{name}}
* ```
* @property authority The :authority header in the gRPC request sent from Envoy to the extension service.
* @property description A human-readable description of the resource.
* @property failOpen Determines how the proxy behaves if the call to the extension fails or times out.
* When set to TRUE, request or response processing continues without error. Any subsequent extensions in the extension chain are also executed. When set to FALSE or the default setting of FALSE is used, one of the following happens:
* * If response headers have not been delivered to the downstream client, a generic 500 error is returned to the client. The error response can be tailored by configuring a custom error response in the load balancer.
* * If response headers have been delivered, then the HTTP stream to the downstream client is reset.
* @property forwardHeaders List of the HTTP headers to forward to the extension (from the client). If omitted, all headers are sent. Each element is a string indicating the header name.
* @property labels Set of labels associated with the AuthzExtension resource.
* **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
* Please refer to the field `effective_labels` for all of the labels present on the resource.
* @property loadBalancingScheme All backend services and forwarding rules referenced by this extension must share the same load balancing scheme.
* For more information, refer to [Backend services overview](https://cloud.google.com/load-balancing/docs/backend-service).
* Possible values are: `INTERNAL_MANAGED`, `EXTERNAL_MANAGED`.
* @property location The location of the resource.
* - - -
* @property metadata The metadata provided here is included as part of the metadata_context (of type google.protobuf.Struct) in the ProcessingRequest message sent to the extension server. The metadata is available under the namespace com.google.authz_extension.. The following variables are supported in the metadata Struct:
* {forwarding_rule_id} - substituted with the forwarding rule's fully qualified resource name.
* @property name Identifier. Name of the AuthzExtension resource.
* @property project The ID of the project in which the resource belongs.
* If it is not provided, the provider project is used.
* @property service The reference to the service that runs the extension.
* To configure a callout extension, service must be a fully-qualified reference to a [backend service](https://cloud.google.com/compute/docs/reference/rest/v1/backendServices) in the format:
* https://www.googleapis.com/compute/v1/projects/{project}/regions/{region}/backendServices/{backendService} or https://www.googleapis.com/compute/v1/projects/{project}/global/backendServices/{backendService}.
* @property timeout Specifies the timeout for each individual message on the stream. The timeout must be between 10-10000 milliseconds.
* @property wireFormat The format of communication supported by the callout extension.
* Default value is `EXT_PROC_GRPC`.
* Possible values are: `WIRE_FORMAT_UNSPECIFIED`, `EXT_PROC_GRPC`.
*/
public data class AuthzExtensionArgs(
public val authority: Output? = null,
public val description: Output? = null,
public val failOpen: Output? = null,
public val forwardHeaders: Output>? = null,
public val labels: Output>? = null,
public val loadBalancingScheme: Output? = null,
public val location: Output? = null,
public val metadata: Output>? = null,
public val name: Output? = null,
public val project: Output? = null,
public val service: Output? = null,
public val timeout: Output? = null,
public val wireFormat: Output? = null,
) : ConvertibleToJava {
override fun toJava(): com.pulumi.gcp.networkservices.AuthzExtensionArgs =
com.pulumi.gcp.networkservices.AuthzExtensionArgs.builder()
.authority(authority?.applyValue({ args0 -> args0 }))
.description(description?.applyValue({ args0 -> args0 }))
.failOpen(failOpen?.applyValue({ args0 -> args0 }))
.forwardHeaders(forwardHeaders?.applyValue({ args0 -> args0.map({ args0 -> args0 }) }))
.labels(labels?.applyValue({ args0 -> args0.map({ args0 -> args0.key.to(args0.value) }).toMap() }))
.loadBalancingScheme(loadBalancingScheme?.applyValue({ args0 -> args0 }))
.location(location?.applyValue({ args0 -> args0 }))
.metadata(
metadata?.applyValue({ args0 ->
args0.map({ args0 ->
args0.key.to(args0.value)
}).toMap()
}),
)
.name(name?.applyValue({ args0 -> args0 }))
.project(project?.applyValue({ args0 -> args0 }))
.service(service?.applyValue({ args0 -> args0 }))
.timeout(timeout?.applyValue({ args0 -> args0 }))
.wireFormat(wireFormat?.applyValue({ args0 -> args0 })).build()
}
/**
* Builder for [AuthzExtensionArgs].
*/
@PulumiTagMarker
public class AuthzExtensionArgsBuilder internal constructor() {
private var authority: Output? = null
private var description: Output? = null
private var failOpen: Output? = null
private var forwardHeaders: Output>? = null
private var labels: Output>? = null
private var loadBalancingScheme: Output? = null
private var location: Output? = null
private var metadata: Output>? = null
private var name: Output? = null
private var project: Output? = null
private var service: Output? = null
private var timeout: Output? = null
private var wireFormat: Output? = null
/**
* @param value The :authority header in the gRPC request sent from Envoy to the extension service.
*/
@JvmName("xtvymnmvuwypcrip")
public suspend fun authority(`value`: Output) {
this.authority = value
}
/**
* @param value A human-readable description of the resource.
*/
@JvmName("gfduytgxthkcnyaj")
public suspend fun description(`value`: Output) {
this.description = value
}
/**
* @param value Determines how the proxy behaves if the call to the extension fails or times out.
* When set to TRUE, request or response processing continues without error. Any subsequent extensions in the extension chain are also executed. When set to FALSE or the default setting of FALSE is used, one of the following happens:
* * If response headers have not been delivered to the downstream client, a generic 500 error is returned to the client. The error response can be tailored by configuring a custom error response in the load balancer.
* * If response headers have been delivered, then the HTTP stream to the downstream client is reset.
*/
@JvmName("flkbwhxnhivdgmbl")
public suspend fun failOpen(`value`: Output) {
this.failOpen = value
}
/**
* @param value List of the HTTP headers to forward to the extension (from the client). If omitted, all headers are sent. Each element is a string indicating the header name.
*/
@JvmName("dadhbftrranfhiby")
public suspend fun forwardHeaders(`value`: Output>) {
this.forwardHeaders = value
}
@JvmName("njshuduneueqmmgl")
public suspend fun forwardHeaders(vararg values: Output) {
this.forwardHeaders = Output.all(values.asList())
}
/**
* @param values List of the HTTP headers to forward to the extension (from the client). If omitted, all headers are sent. Each element is a string indicating the header name.
*/
@JvmName("hxrheemrjjuvvbgt")
public suspend fun forwardHeaders(values: List>) {
this.forwardHeaders = Output.all(values)
}
/**
* @param value Set of labels associated with the AuthzExtension resource.
* **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
* Please refer to the field `effective_labels` for all of the labels present on the resource.
*/
@JvmName("xnmypkmvdpwjlyrr")
public suspend fun labels(`value`: Output>) {
this.labels = value
}
/**
* @param value All backend services and forwarding rules referenced by this extension must share the same load balancing scheme.
* For more information, refer to [Backend services overview](https://cloud.google.com/load-balancing/docs/backend-service).
* Possible values are: `INTERNAL_MANAGED`, `EXTERNAL_MANAGED`.
*/
@JvmName("qheehptwmsdsputj")
public suspend fun loadBalancingScheme(`value`: Output) {
this.loadBalancingScheme = value
}
/**
* @param value The location of the resource.
* - - -
*/
@JvmName("lbifcfxbblasytdu")
public suspend fun location(`value`: Output) {
this.location = value
}
/**
* @param value The metadata provided here is included as part of the metadata_context (of type google.protobuf.Struct) in the ProcessingRequest message sent to the extension server. The metadata is available under the namespace com.google.authz_extension.. The following variables are supported in the metadata Struct:
* {forwarding_rule_id} - substituted with the forwarding rule's fully qualified resource name.
*/
@JvmName("cjmvemntweaqmycp")
public suspend fun metadata(`value`: Output>) {
this.metadata = value
}
/**
* @param value Identifier. Name of the AuthzExtension resource.
*/
@JvmName("tcdcketqfqqguucj")
public suspend fun name(`value`: Output) {
this.name = value
}
/**
* @param value The ID of the project in which the resource belongs.
* If it is not provided, the provider project is used.
*/
@JvmName("bkasstjccoupsveb")
public suspend fun project(`value`: Output) {
this.project = value
}
/**
* @param value The reference to the service that runs the extension.
* To configure a callout extension, service must be a fully-qualified reference to a [backend service](https://cloud.google.com/compute/docs/reference/rest/v1/backendServices) in the format:
* https://www.googleapis.com/compute/v1/projects/{project}/regions/{region}/backendServices/{backendService} or https://www.googleapis.com/compute/v1/projects/{project}/global/backendServices/{backendService}.
*/
@JvmName("ugcdsevubpwyuovk")
public suspend fun service(`value`: Output) {
this.service = value
}
/**
* @param value Specifies the timeout for each individual message on the stream. The timeout must be between 10-10000 milliseconds.
*/
@JvmName("dqmxetwuisdxepnn")
public suspend fun timeout(`value`: Output) {
this.timeout = value
}
/**
* @param value The format of communication supported by the callout extension.
* Default value is `EXT_PROC_GRPC`.
* Possible values are: `WIRE_FORMAT_UNSPECIFIED`, `EXT_PROC_GRPC`.
*/
@JvmName("vpvkginfabuirdxd")
public suspend fun wireFormat(`value`: Output) {
this.wireFormat = value
}
/**
* @param value The :authority header in the gRPC request sent from Envoy to the extension service.
*/
@JvmName("fytekaevwtfoenor")
public suspend fun authority(`value`: String?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.authority = mapped
}
/**
* @param value A human-readable description of the resource.
*/
@JvmName("sfujuqsdeiiflsvd")
public suspend fun description(`value`: String?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.description = mapped
}
/**
* @param value Determines how the proxy behaves if the call to the extension fails or times out.
* When set to TRUE, request or response processing continues without error. Any subsequent extensions in the extension chain are also executed. When set to FALSE or the default setting of FALSE is used, one of the following happens:
* * If response headers have not been delivered to the downstream client, a generic 500 error is returned to the client. The error response can be tailored by configuring a custom error response in the load balancer.
* * If response headers have been delivered, then the HTTP stream to the downstream client is reset.
*/
@JvmName("ltcnbjqkegyredqw")
public suspend fun failOpen(`value`: Boolean?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.failOpen = mapped
}
/**
* @param value List of the HTTP headers to forward to the extension (from the client). If omitted, all headers are sent. Each element is a string indicating the header name.
*/
@JvmName("ywrhmrdwmxielley")
public suspend fun forwardHeaders(`value`: List?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.forwardHeaders = mapped
}
/**
* @param values List of the HTTP headers to forward to the extension (from the client). If omitted, all headers are sent. Each element is a string indicating the header name.
*/
@JvmName("vcrkidtobaixdrwy")
public suspend fun forwardHeaders(vararg values: String) {
val toBeMapped = values.toList()
val mapped = toBeMapped.let({ args0 -> of(args0) })
this.forwardHeaders = mapped
}
/**
* @param value Set of labels associated with the AuthzExtension resource.
* **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
* Please refer to the field `effective_labels` for all of the labels present on the resource.
*/
@JvmName("xfhwcapswpruwbim")
public suspend fun labels(`value`: Map?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.labels = mapped
}
/**
* @param values Set of labels associated with the AuthzExtension resource.
* **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
* Please refer to the field `effective_labels` for all of the labels present on the resource.
*/
@JvmName("bdatmldeajypfmua")
public fun labels(vararg values: Pair) {
val toBeMapped = values.toMap()
val mapped = toBeMapped.let({ args0 -> of(args0) })
this.labels = mapped
}
/**
* @param value All backend services and forwarding rules referenced by this extension must share the same load balancing scheme.
* For more information, refer to [Backend services overview](https://cloud.google.com/load-balancing/docs/backend-service).
* Possible values are: `INTERNAL_MANAGED`, `EXTERNAL_MANAGED`.
*/
@JvmName("wehwnieumdfuuwnc")
public suspend fun loadBalancingScheme(`value`: String?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.loadBalancingScheme = mapped
}
/**
* @param value The location of the resource.
* - - -
*/
@JvmName("mpfxqttwrjxbwjvy")
public suspend fun location(`value`: String?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.location = mapped
}
/**
* @param value The metadata provided here is included as part of the metadata_context (of type google.protobuf.Struct) in the ProcessingRequest message sent to the extension server. The metadata is available under the namespace com.google.authz_extension.. The following variables are supported in the metadata Struct:
* {forwarding_rule_id} - substituted with the forwarding rule's fully qualified resource name.
*/
@JvmName("gppjnmnwkpttbhre")
public suspend fun metadata(`value`: Map?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.metadata = mapped
}
/**
* @param values The metadata provided here is included as part of the metadata_context (of type google.protobuf.Struct) in the ProcessingRequest message sent to the extension server. The metadata is available under the namespace com.google.authz_extension.. The following variables are supported in the metadata Struct:
* {forwarding_rule_id} - substituted with the forwarding rule's fully qualified resource name.
*/
@JvmName("llenylxuwtnastvu")
public fun metadata(vararg values: Pair) {
val toBeMapped = values.toMap()
val mapped = toBeMapped.let({ args0 -> of(args0) })
this.metadata = mapped
}
/**
* @param value Identifier. Name of the AuthzExtension resource.
*/
@JvmName("hitnnpilixciancl")
public suspend fun name(`value`: String?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.name = mapped
}
/**
* @param value The ID of the project in which the resource belongs.
* If it is not provided, the provider project is used.
*/
@JvmName("iicaabjfeitsveyq")
public suspend fun project(`value`: String?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.project = mapped
}
/**
* @param value The reference to the service that runs the extension.
* To configure a callout extension, service must be a fully-qualified reference to a [backend service](https://cloud.google.com/compute/docs/reference/rest/v1/backendServices) in the format:
* https://www.googleapis.com/compute/v1/projects/{project}/regions/{region}/backendServices/{backendService} or https://www.googleapis.com/compute/v1/projects/{project}/global/backendServices/{backendService}.
*/
@JvmName("kyrhxaemfltfyqhx")
public suspend fun service(`value`: String?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.service = mapped
}
/**
* @param value Specifies the timeout for each individual message on the stream. The timeout must be between 10-10000 milliseconds.
*/
@JvmName("yyrlsgcabhoutogq")
public suspend fun timeout(`value`: String?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.timeout = mapped
}
/**
* @param value The format of communication supported by the callout extension.
* Default value is `EXT_PROC_GRPC`.
* Possible values are: `WIRE_FORMAT_UNSPECIFIED`, `EXT_PROC_GRPC`.
*/
@JvmName("gvfxywuuwwgudyme")
public suspend fun wireFormat(`value`: String?) {
val toBeMapped = value
val mapped = toBeMapped?.let({ args0 -> of(args0) })
this.wireFormat = mapped
}
internal fun build(): AuthzExtensionArgs = AuthzExtensionArgs(
authority = authority,
description = description,
failOpen = failOpen,
forwardHeaders = forwardHeaders,
labels = labels,
loadBalancingScheme = loadBalancingScheme,
location = location,
metadata = metadata,
name = name,
project = project,
service = service,
timeout = timeout,
wireFormat = wireFormat,
)
}
© 2015 - 2025 Weber Informatics LLC | Privacy Policy