Skip to content

Commit 0345704

Browse files
Google APIscopybara-github
Google APIs
authored and
copybara-github
committed
feat: Add Secret Version Delayed Destroy changes for client libraries
docs: Users can now enable secret version delayed destruction PiperOrigin-RevId: 626820938
1 parent c1624ae commit 0345704

4 files changed

Lines changed: 184 additions & 34 deletions

File tree

‎google/cloud/secretmanager/v1/BUILD.bazel‎

Lines changed: 4 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -76,12 +76,15 @@ java_gapic_library(
7676
rest_numeric_enums = True,
7777
service_yaml = "secretmanager_v1.yaml",
7878
test_deps = [
79+
"//google/cloud/location:location_java_grpc",
7980
":secretmanager_java_grpc",
8081
"//google/iam/v1:iam_java_grpc",
8182
],
8283
transport = "grpc+rest",
8384
deps = [
8485
":secretmanager_java_proto",
86+
"//google/api:api_java_proto",
87+
"//google/cloud/location:location_java_proto",
8588
"//google/iam/v1:iam_java_proto",
8689
],
8790
)
@@ -141,6 +144,7 @@ go_gapic_library(
141144
transport = "grpc+rest",
142145
deps = [
143146
":secretmanager_go_proto",
147+
"//google/cloud/location:location_go_proto",
144148
"//google/iam/v1:iam_go_proto",
145149
"@io_bazel_rules_go//proto/wkt:duration_go_proto",
146150
],

‎google/cloud/secretmanager/v1/resources.proto‎

Lines changed: 49 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -41,20 +41,23 @@ message Secret {
4141
option (google.api.resource) = {
4242
type: "secretmanager.googleapis.com/Secret"
4343
pattern: "projects/{project}/secrets/{secret}"
44+
pattern: "projects/{project}/locations/{location}/secrets/{secret}"
45+
plural: "secrets"
46+
singular: "secret"
4447
};
4548

4649
// Output only. The resource name of the
4750
// [Secret][google.cloud.secretmanager.v1.Secret] in the format
4851
// `projects/*/secrets/*`.
4952
string name = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
5053

51-
// Required. Immutable. The replication policy of the secret data attached to
54+
// Optional. Immutable. The replication policy of the secret data attached to
5255
// the [Secret][google.cloud.secretmanager.v1.Secret].
5356
//
5457
// The replication policy cannot be changed after the Secret has been created.
5558
Replication replication = 2 [
5659
(google.api.field_behavior) = IMMUTABLE,
57-
(google.api.field_behavior) = REQUIRED
60+
(google.api.field_behavior) = OPTIONAL
5861
];
5962

6063
// Output only. The time at which the
@@ -120,7 +123,7 @@ message Secret {
120123
// No more than 50 aliases can be assigned to a given secret.
121124
//
122125
// Version-Alias pairs will be viewable via GetSecret and modifiable via
123-
// UpdateSecret. At launch access by alias will only be supported on
126+
// UpdateSecret. Access by alias is only be supported on
124127
// GetSecretVersion and AccessSecretVersion.
125128
map<string, int64> version_aliases = 11
126129
[(google.api.field_behavior) = OPTIONAL];
@@ -138,13 +141,37 @@ message Secret {
138141
//
139142
// The total size of annotation keys and values must be less than 16KiB.
140143
map<string, string> annotations = 13 [(google.api.field_behavior) = OPTIONAL];
144+
145+
// Optional. Secret Version TTL after destruction request
146+
//
147+
// This is a part of the Delayed secret version destroy feature.
148+
// For secret with TTL>0, version destruction doesn't happen immediately
149+
// on calling destroy instead the version goes to a disabled state and
150+
// destruction happens after the TTL expires.
151+
google.protobuf.Duration version_destroy_ttl = 14
152+
[(google.api.field_behavior) = OPTIONAL];
153+
154+
// Optional. The customer-managed encryption configuration of the Regionalised
155+
// Secrets. If no configuration is provided, Google-managed default encryption
156+
// is used.
157+
//
158+
// Updates to the [Secret][google.cloud.secretmanager.v1.Secret] encryption
159+
// configuration only apply to
160+
// [SecretVersions][google.cloud.secretmanager.v1.SecretVersion] added
161+
// afterwards. They do not apply retroactively to existing
162+
// [SecretVersions][google.cloud.secretmanager.v1.SecretVersion].
163+
CustomerManagedEncryption customer_managed_encryption = 15
164+
[(google.api.field_behavior) = OPTIONAL];
141165
}
142166

143167
// A secret version resource in the Secret Manager API.
144168
message SecretVersion {
145169
option (google.api.resource) = {
146170
type: "secretmanager.googleapis.com/SecretVersion"
147171
pattern: "projects/{project}/secrets/{secret}/versions/{secret_version}"
172+
pattern: "projects/{project}/locations/{location}/secrets/{secret}/versions/{secret_version}"
173+
plural: "secretVersions"
174+
singular: "secretVersion"
148175
};
149176

150177
// The state of a
@@ -213,6 +240,22 @@ message SecretVersion {
213240
// [SecretManagerService.AddSecretVersion][google.cloud.secretmanager.v1.SecretManagerService.AddSecretVersion].
214241
bool client_specified_payload_checksum = 7
215242
[(google.api.field_behavior) = OUTPUT_ONLY];
243+
244+
// Optional. Output only. Scheduled destroy time for secret version.
245+
// This is a part of the Delayed secret version destroy feature. For a
246+
// Secret with a valid version destroy TTL, when a secert version is
247+
// destroyed, the version is moved to disabled state and it is scheduled for
248+
// destruction. The version is destroyed only after the
249+
// `scheduled_destroy_time`.
250+
google.protobuf.Timestamp scheduled_destroy_time = 8
251+
[(google.api.field_behavior) = OUTPUT_ONLY];
252+
253+
// Output only. The customer-managed encryption status of the
254+
// [SecretVersion][google.cloud.secretmanager.v1.SecretVersion]. Only
255+
// populated if customer-managed encryption is used and
256+
// [Secret][google.cloud.secretmanager.v1.Secret] is a Regionalised Secret.
257+
CustomerManagedEncryptionStatus customer_managed_encryption = 9
258+
[(google.api.field_behavior) = OUTPUT_ONLY];
216259
}
217260

218261
// A policy that defines the replication and encryption configuration of data.
@@ -381,8 +424,9 @@ message Topic {
381424

382425
// Required. The resource name of the Pub/Sub topic that will be published to,
383426
// in the following format: `projects/*/topics/*`. For publication to succeed,
384-
// the Secret Manager P4SA must have `pubsub.publisher` permissions on the
385-
// topic.
427+
// the Secret Manager service agent must have the `pubsub.topic.publish`
428+
// permission on the topic. The Pub/Sub Publisher role
429+
// (`roles/pubsub.publisher`) includes this permission.
386430
string name = 1 [(google.api.field_behavior) = REQUIRED];
387431
}
388432

‎google/cloud/secretmanager/v1/secretmanager_v1.yaml‎

Lines changed: 45 additions & 9 deletions
Original file line numberDiff line numberDiff line change
@@ -4,6 +4,7 @@ name: secretmanager.googleapis.com
44
title: Secret Manager API
55

66
apis:
7+
- name: google.cloud.location.Locations
78
- name: google.cloud.secretmanager.v1.SecretManagerService
89

910
documentation:
@@ -18,15 +19,6 @@ documentation:
1819
- selector: google.cloud.location.Locations.ListLocations
1920
description: Lists information about the supported locations for this service.
2021

21-
backend:
22-
rules:
23-
- selector: google.cloud.location.Locations.GetLocation
24-
deadline: 60.0
25-
- selector: google.cloud.location.Locations.ListLocations
26-
deadline: 60.0
27-
- selector: 'google.cloud.secretmanager.v1.SecretManagerService.*'
28-
deadline: 60.0
29-
3022
http:
3123
rules:
3224
- selector: google.cloud.location.Locations.GetLocation
@@ -48,3 +40,47 @@ authentication:
4840
oauth:
4941
canonical_scopes: |-
5042
https://www.googleapis.com/auth/cloud-platform
43+
44+
publishing:
45+
new_issue_uri: https://issuetracker.google.com/issues/new?component=784854&template=1380926
46+
documentation_uri: https://cloud.google.com/secret-manager/docs/overview
47+
api_short_name: secretmanager
48+
github_label: 'api: secretmanager'
49+
doc_tag_prefix: secretmanager
50+
organization: CLOUD
51+
library_settings:
52+
- version: google.cloud.secretmanager.v1
53+
launch_stage: GA
54+
java_settings:
55+
common:
56+
destinations:
57+
- PACKAGE_MANAGER
58+
cpp_settings:
59+
common:
60+
destinations:
61+
- PACKAGE_MANAGER
62+
php_settings:
63+
common:
64+
destinations:
65+
- PACKAGE_MANAGER
66+
python_settings:
67+
common:
68+
destinations:
69+
- PACKAGE_MANAGER
70+
node_settings:
71+
common:
72+
destinations:
73+
- PACKAGE_MANAGER
74+
dotnet_settings:
75+
common:
76+
destinations:
77+
- PACKAGE_MANAGER
78+
ruby_settings:
79+
common:
80+
destinations:
81+
- PACKAGE_MANAGER
82+
go_settings:
83+
common:
84+
destinations:
85+
- PACKAGE_MANAGER
86+
proto_reference_documentation_uri: https://cloud.google.com/secret-manager/docs/reference/rpc

0 commit comments

Comments
 (0)