Skip to content

Commit a645f53

Browse files
abheda-crestabd-goog
abheda-crest
authored and
abd-goog
committed
Add support for regional secret resource google_secret_manager_regional_secret (GoogleCloudPlatform#11678)
1 parent 7e0e669 commit a645f53

16 files changed

+1900
-0
lines changed

‎mmv1/products/secretmanager/go_product.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -15,6 +15,7 @@
1515
---
1616
name: 'SecretManager'
1717
display_name: 'Secret Manager'
18+
legacy_name: 'secret_manager'
1819
versions:
1920
- name: 'ga'
2021
base_url: 'https://secretmanager.googleapis.com/v1/'

‎mmv1/products/secretmanager/product.yaml

+1
Original file line numberDiff line numberDiff line change
@@ -14,6 +14,7 @@
1414
--- !ruby/object:Api::Product
1515
name: SecretManager
1616
display_name: Secret Manager
17+
legacy_name: secret_manager
1718
versions:
1819
- !ruby/object:Api::Product::Version
1920
name: ga

‎mmv1/products/secretmanagerregional/RegionalSecret.yaml

+222
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,222 @@
1+
# Copyright 2024 Google Inc.
2+
# Licensed under the Apache License, Version 2.0 (the "License");
3+
# you may not use this file except in compliance with the License.
4+
# You may obtain a copy of the License at
5+
#
6+
# http://www.apache.org/licenses/LICENSE-2.0
7+
#
8+
# Unless required by applicable law or agreed to in writing, software
9+
# distributed under the License is distributed on an "AS IS" BASIS,
10+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
# See the License for the specific language governing permissions and
12+
# limitations under the License.
13+
14+
--- !ruby/object:Api::Resource
15+
name: RegionalSecret
16+
self_link: projects/{{project}}/locations/{{location}}/secrets/{{secret_id}}
17+
base_url: projects/{{project}}/locations/{{location}}/secrets
18+
create_url: projects/{{project}}/locations/{{location}}/secrets?secretId={{secret_id}}
19+
update_verb: :PATCH
20+
update_mask: true
21+
references: !ruby/object:Api::Resource::ReferenceLinks
22+
# TODO : Update the below api reference link
23+
api: 'https://cloud.google.com/secret-manager/docs/reference/rest/v1/projects.secrets'
24+
description: |
25+
A Regional Secret is a logical secret whose value and versions can be created and accessed within a region only.
26+
iam_policy: !ruby/object:Api::Resource::IamPolicy
27+
parent_resource_attribute: secret_id
28+
method_name_separator: ':'
29+
allowed_iam_role: roles/secretmanager.secretAccessor
30+
iam_conditions_request_type: :QUERY_PARAM_NESTED
31+
example_config_body: 'templates/terraform/iam/example_config_body/secret_manager_regional_secret.tf.erb'
32+
import_format: [
33+
'projects/{{project}}/locations/{{location}}/secrets/{{secret_id}}',
34+
'{{secret_id}}',
35+
]
36+
examples:
37+
- !ruby/object:Provider::Terraform::Examples
38+
name: 'regional_secret_config_basic'
39+
primary_resource_id: 'regional-secret-basic'
40+
primary_resource_name: 'fmt.Sprintf("tf-test-tf-reg-secret%s", context["random_suffix"])'
41+
vars:
42+
secret_id: 'tf-reg-secret'
43+
- !ruby/object:Provider::Terraform::Examples
44+
name: 'regional_secret_with_cmek'
45+
primary_resource_id: 'regional-secret-with-cmek'
46+
vars:
47+
secret_id: 'tf-reg-secret'
48+
kms_key_name: 'kms-key'
49+
test_vars_overrides:
50+
kms_key_name: 'acctest.BootstrapKMSKeyInLocation(t, "us-central1").CryptoKey.Name'
51+
- !ruby/object:Provider::Terraform::Examples
52+
name: 'regional_secret_with_rotation'
53+
primary_resource_id: 'regional-secret-with-rotation'
54+
vars:
55+
secret_id: 'tf-reg-secret'
56+
topic_id: 'tf-topic'
57+
timestamp: '2045-11-30T00:00:00Z'
58+
test_vars_overrides:
59+
timestamp: '"2122-11-30T00:00:00Z"'
60+
- !ruby/object:Provider::Terraform::Examples
61+
name: 'regional_secret_with_ttl'
62+
primary_resource_id: 'regional-secret-with-ttl'
63+
vars:
64+
secret_id: 'tf-reg-secret'
65+
- !ruby/object:Provider::Terraform::Examples
66+
name: 'regional_secret_with_expire_time'
67+
primary_resource_id: 'regional-secret-with-expire-time'
68+
vars:
69+
secret_id: 'tf-reg-secret'
70+
timestamp: '2055-11-30T00:00:00Z'
71+
test_vars_overrides:
72+
timestamp: '"2122-11-30T00:00:00Z"'
73+
- !ruby/object:Provider::Terraform::Examples
74+
name: 'regional_secret_with_version_destroy_ttl'
75+
primary_resource_id: 'regional-secret-with-version-destroy-ttl'
76+
vars:
77+
secret_id: 'tf-reg-secret'
78+
import_format: ['projects/{{project}}/locations/{{location}}/secrets/{{secret_id}}']
79+
custom_code: !ruby/object:Provider::Terraform::CustomCode
80+
pre_update: templates/terraform/pre_update/secret_manager_regional_secret.go.erb
81+
parameters:
82+
- !ruby/object:Api::Type::String
83+
name: location
84+
description: |
85+
The location of the regional secret. eg us-central1
86+
required: true
87+
immutable: true
88+
url_param_only: true
89+
- !ruby/object:Api::Type::String
90+
name: secretId
91+
description: |
92+
This must be unique within the project.
93+
required: true
94+
immutable: true
95+
url_param_only: true
96+
properties:
97+
- !ruby/object:Api::Type::String
98+
name: name
99+
output: true
100+
description: |
101+
The resource name of the regional secret. Format:
102+
`projects/{{project}}/locations/{{location}}/secrets/{{secret_id}}`
103+
- !ruby/object:Api::Type::String
104+
name: createTime
105+
output: true
106+
description: |
107+
The time at which the regional secret was created.
108+
- !ruby/object:Api::Type::KeyValueLabels
109+
name: labels
110+
description: |
111+
The labels assigned to this regional secret.
112+
113+
Label keys must be between 1 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes,
114+
and must conform to the following PCRE regular expression: [\p{Ll}\p{Lo}][\p{Ll}\p{Lo}\p{N}_-]{0,62}
115+
116+
Label values must be between 0 and 63 characters long, have a UTF-8 encoding of maximum 128 bytes,
117+
and must conform to the following PCRE regular expression: [\p{Ll}\p{Lo}\p{N}_-]{0,63}
118+
119+
No more than 64 labels can be assigned to a given resource.
120+
121+
An object containing a list of "key": value pairs. Example:
122+
{ "name": "wrench", "mass": "1.3kg", "count": "3" }.
123+
- !ruby/object:Api::Type::KeyValueAnnotations
124+
name: annotations
125+
description: |
126+
Custom metadata about the regional secret.
127+
128+
Annotations are distinct from various forms of labels. Annotations exist to allow
129+
client tools to store their own state information without requiring a database.
130+
131+
Annotation keys must be between 1 and 63 characters long, have a UTF-8 encoding of
132+
maximum 128 bytes, begin and end with an alphanumeric character ([a-z0-9A-Z]), and
133+
may have dashes (-), underscores (_), dots (.), and alphanumerics in between these
134+
symbols.
135+
136+
The total size of annotation keys and values must be less than 16KiB.
137+
138+
An object containing a list of "key": value pairs. Example:
139+
{ "name": "wrench", "mass": "1.3kg", "count": "3" }.
140+
# TODO : Add versionAliases field support once google_secret_manager_regional_secret_version is added
141+
# - !ruby/object:Api::Type::KeyValuePairs
142+
# name: versionAliases
143+
# description: |
144+
# Mapping from version alias to version name.
145+
146+
# A version alias is a string with a maximum length of 63 characters and can contain
147+
# uppercase and lowercase letters, numerals, and the hyphen (-) and underscore ('_')
148+
# characters. An alias string must start with a letter and cannot be the string
149+
# 'latest' or 'NEW'. No more than 50 aliases can be assigned to a given secret.
150+
151+
# An object containing a list of "key": value pairs. Example:
152+
# { "name": "wrench", "mass": "1.3kg", "count": "3" }.
153+
- !ruby/object:Api::Type::NestedObject
154+
name: customerManagedEncryption
155+
description: |
156+
The customer-managed encryption configuration of the regional secret.
157+
properties:
158+
- !ruby/object:Api::Type::String
159+
name: kmsKeyName
160+
required: true
161+
description: |
162+
The resource name of the Cloud KMS CryptoKey used to encrypt secret payloads.
163+
- !ruby/object:Api::Type::Array
164+
name: topics
165+
description: |
166+
A list of up to 10 Pub/Sub topics to which messages are published when control plane
167+
operations are called on the regional secret or its versions.
168+
item_type: !ruby/object:Api::Type::NestedObject
169+
properties:
170+
- !ruby/object:Api::Type::String
171+
name: name
172+
required: true
173+
description: |
174+
The resource name of the Pub/Sub topic that will be published to, in the following
175+
format: projects/*/topics/*. For publication to succeed, the Secret Manager Service
176+
Agent service account must have pubsub.publisher permissions on the topic.
177+
- !ruby/object:Api::Type::NestedObject
178+
name: rotation
179+
required_with:
180+
- topics
181+
description: |
182+
The rotation time and period for a regional secret. At `next_rotation_time`, Secret Manager
183+
will send a Pub/Sub notification to the topics configured on the Secret. `topics` must be
184+
set to configure rotation.
185+
properties:
186+
- !ruby/object:Api::Type::String
187+
name: nextRotationTime
188+
description: |
189+
Timestamp in UTC at which the Secret is scheduled to rotate.
190+
A timestamp in RFC3339 UTC "Zulu" format, with nanosecond resolution and up to nine
191+
fractional digits. Examples: "2014-10-02T15:01:23Z" and "2014-10-02T15:01:23.045123456Z".
192+
- !ruby/object:Api::Type::String
193+
name: rotationPeriod
194+
description: |
195+
The Duration between rotation notifications. Must be in seconds and at least 3600s (1h)
196+
and at most 3153600000s (100 years). If rotationPeriod is set, `next_rotation_time` must
197+
be set. `next_rotation_time` will be advanced by this period when the service
198+
automatically sends rotation notifications.
199+
required_with:
200+
- rotation.0.next_rotation_time
201+
- !ruby/object:Api::Type::String
202+
name: expireTime
203+
description: |
204+
Timestamp in UTC when the regional secret is scheduled to expire. This is always provided on
205+
output, regardless of what was sent on input. A timestamp in RFC3339 UTC "Zulu" format, with
206+
nanosecond resolution and up to nine fractional digits. Examples: "2014-10-02T15:01:23Z" and
207+
"2014-10-02T15:01:23.045123456Z". Only one of `expire_time` or `ttl` can be provided.
208+
default_from_api: true
209+
- !ruby/object:Api::Type::String
210+
name: ttl
211+
description: |
212+
The TTL for the regional secret. A duration in seconds with up to nine fractional digits,
213+
terminated by 's'. Example: "3.5s". Only one of `ttl` or `expire_time` can be provided.
214+
ignore_read: true
215+
- !ruby/object:Api::Type::String
216+
name: versionDestroyTtl
217+
description: |
218+
Secret Version TTL after destruction request.
219+
This is a part of the delayed delete feature on Secret Version.
220+
For secret with versionDestroyTtl>0, version destruction doesn't happen immediately
221+
on calling destroy instead the version goes to a disabled state and
222+
the actual destruction happens after this TTL expires. It must be atleast 24h.

‎mmv1/products/secretmanagerregional/product.yaml

+26
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,26 @@
1+
# Copyright 2024 Google Inc.
2+
# Licensed under the Apache License, Version 2.0 (the "License");
3+
# you may not use this file except in compliance with the License.
4+
# You may obtain a copy of the License at
5+
#
6+
# http://www.apache.org/licenses/LICENSE-2.0
7+
#
8+
# Unless required by applicable law or agreed to in writing, software
9+
# distributed under the License is distributed on an "AS IS" BASIS,
10+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
11+
# See the License for the specific language governing permissions and
12+
# limitations under the License.
13+
14+
--- !ruby/object:Api::Product
15+
name: SecretManagerRegional
16+
display_name: Secret Manager
17+
legacy_name: secret_manager
18+
versions:
19+
- !ruby/object:Api::Product::Version
20+
name: ga
21+
base_url: https://secretmanager.{{location}}.rep.googleapis.com/v1/
22+
- !ruby/object:Api::Product::Version
23+
name: beta
24+
base_url: https://secretmanager.{{location}}.rep.googleapis.com/v1/
25+
scopes:
26+
- https://www.googleapis.com/auth/cloud-platform

‎mmv1/templates/terraform/examples/regional_secret_config_basic.tf.erb

+14
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,14 @@
1+
resource "google_secret_manager_regional_secret" "<%= ctx[:primary_resource_id] %>" {
2+
secret_id = "<%= ctx[:vars]['secret_id'] %>"
3+
location = "us-central1"
4+
5+
labels = {
6+
label = "my-label"
7+
}
8+
9+
annotations = {
10+
key1 = "value1",
11+
key2 = "value2",
12+
key3 = "value3"
13+
}
14+
}

‎mmv1/templates/terraform/examples/regional_secret_with_cmek.tf.erb

+18
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,18 @@
1+
data "google_project" "project" {}
2+
3+
resource "google_kms_crypto_key_iam_member" "kms-secret-binding" {
4+
crypto_key_id = "<%= ctx[:vars]['kms_key_name'] %>"
5+
role = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
6+
member = "serviceAccount:service-${data.google_project.project.number}@gcp-sa-secretmanager.iam.gserviceaccount.com"
7+
}
8+
9+
resource "google_secret_manager_regional_secret" "<%= ctx[:primary_resource_id] %>" {
10+
secret_id = "<%= ctx[:vars]['secret_id'] %>"
11+
location = "us-central1"
12+
13+
customer_managed_encryption {
14+
kms_key_name = "<%= ctx[:vars]['kms_key_name'] %>"
15+
}
16+
17+
depends_on = [ google_kms_crypto_key_iam_member.kms-secret-binding ]
18+
}

‎mmv1/templates/terraform/examples/regional_secret_with_expire_time.tf.erb

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
resource "google_secret_manager_regional_secret" "<%= ctx[:primary_resource_id] %>" {
2+
secret_id = "<%= ctx[:vars]['secret_id'] %>"
3+
location = "us-central1"
4+
5+
labels = {
6+
label = "my-label"
7+
}
8+
9+
annotations = {
10+
key1 = "value1",
11+
key2 = "value2",
12+
key3 = "value3"
13+
}
14+
15+
expire_time = "<%= ctx[:vars]['timestamp'] %>"
16+
}

‎mmv1/templates/terraform/examples/regional_secret_with_rotation.tf.erb

+29
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,29 @@
1+
data "google_project" "project" {}
2+
3+
resource "google_pubsub_topic" "topic" {
4+
name = "<%= ctx[:vars]['topic_id'] %>"
5+
}
6+
7+
resource "google_pubsub_topic_iam_member" "secrets_manager_access" {
8+
topic = google_pubsub_topic.topic.name
9+
role = "roles/pubsub.publisher"
10+
member = "serviceAccount:service-${data.google_project.project.number}@gcp-sa-secretmanager.iam.gserviceaccount.com"
11+
}
12+
13+
resource "google_secret_manager_regional_secret" "<%= ctx[:primary_resource_id] %>" {
14+
secret_id = "<%= ctx[:vars]['secret_id'] %>"
15+
location = "us-central1"
16+
17+
topics {
18+
name = google_pubsub_topic.topic.id
19+
}
20+
21+
rotation {
22+
rotation_period = "3600s"
23+
next_rotation_time = "<%= ctx[:vars]['timestamp'] %>"
24+
}
25+
26+
depends_on = [
27+
google_pubsub_topic_iam_member.secrets_manager_access,
28+
]
29+
}

‎mmv1/templates/terraform/examples/regional_secret_with_ttl.tf.erb

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
resource "google_secret_manager_regional_secret" "<%= ctx[:primary_resource_id] %>" {
2+
secret_id = "<%= ctx[:vars]['secret_id'] %>"
3+
location = "us-central1"
4+
5+
labels = {
6+
label = "my-label"
7+
}
8+
9+
annotations = {
10+
key1 = "value1",
11+
key2 = "value2",
12+
key3 = "value3"
13+
}
14+
15+
ttl = "36000s"
16+
}

‎mmv1/templates/terraform/examples/regional_secret_with_version_destroy_ttl.tf.erb

+16
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,16 @@
1+
resource "google_secret_manager_regional_secret" "<%= ctx[:primary_resource_id] %>" {
2+
secret_id = "<%= ctx[:vars]['secret_id'] %>"
3+
location = "us-central1"
4+
5+
labels = {
6+
label = "my-label"
7+
}
8+
9+
annotations = {
10+
key1 = "value1",
11+
key2 = "value2",
12+
key3 = "value3"
13+
}
14+
15+
version_destroy_ttl = "86400s"
16+
}

‎mmv1/templates/terraform/iam/example_config_body/secret_manager_regional_secret.tf.erb

+3
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,3 @@
1+
project = google_secret_manager_regional_secret.regional-secret-basic.project
2+
location = google_secret_manager_regional_secret.regional-secret-basic.location
3+
secret_id = google_secret_manager_regional_secret.regional-secret-basic.secret_id

0 commit comments

Comments
 (0)