Skip to content

Commit 070b0fd

Browse files
Google APIscopybara-github
Google APIs
authored and
copybara-github
committed
feat: add Database.SourceInfo and Database.source_info (information about database provenance, specifically for restored databases)
feat: add Database.CmekConfig and Database.cmek_config (information about CMEK enablement) feat: allow specifying an encryption_config when restoring a database feat: add Database.delete_time (the time a database was deleted, if it ever was) feat: add Database.previous_id (if a database was deleted, what ID it was using beforehand) docs: fix assorted capitalization issues with the word "ID" docs: clarify restore details PiperOrigin-RevId: 671737474
1 parent eb4c1ec commit 070b0fd

2 files changed

Lines changed: 136 additions & 11 deletions

File tree

‎google/firestore/admin/v1/database.proto‎

Lines changed: 117 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,10 @@ option java_package = "com.google.firestore.admin.v1";
2929
option objc_class_prefix = "GCFS";
3030
option php_namespace = "Google\\Cloud\\Firestore\\Admin\\V1";
3131
option ruby_package = "Google::Cloud::Firestore::Admin::V1";
32+
option (google.api.resource_definition) = {
33+
type: "firestore.googleapis.com/Operation"
34+
pattern: "projects/{project}/databases/{database}/operations/{operation}"
35+
};
3236

3337
// A Cloud Firestore Database.
3438
message Database {
@@ -44,7 +48,7 @@ message Database {
4448
//
4549
// Mode changes are only allowed if the database is empty.
4650
enum DatabaseType {
47-
// The default value. This value is used if the database type is omitted.
51+
// Not used.
4852
DATABASE_TYPE_UNSPECIFIED = 0;
4953

5054
// Firestore Native Mode
@@ -128,6 +132,101 @@ message Database {
128132
DELETE_PROTECTION_ENABLED = 2;
129133
}
130134

135+
// The CMEK (Customer Managed Encryption Key) configuration for a Firestore
136+
// database. If not present, the database is secured by the default Google
137+
// encryption key.
138+
message CmekConfig {
139+
// Required. Only keys in the same location as this database are allowed to
140+
// be used for encryption.
141+
//
142+
// For Firestore's nam5 multi-region, this corresponds to Cloud KMS
143+
// multi-region us. For Firestore's eur3 multi-region, this corresponds to
144+
// Cloud KMS multi-region europe. See
145+
// https://cloud.google.com/kms/docs/locations.
146+
//
147+
// The expected format is
148+
// `projects/{project_id}/locations/{kms_location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}`.
149+
string kms_key_name = 1 [(google.api.field_behavior) = REQUIRED];
150+
151+
// Output only. Currently in-use [KMS key
152+
// versions](https://cloud.google.com/kms/docs/resource-hierarchy#key_versions).
153+
// During [key rotation](https://cloud.google.com/kms/docs/key-rotation),
154+
// there can be multiple in-use key versions.
155+
//
156+
// The expected format is
157+
// `projects/{project_id}/locations/{kms_location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}/cryptoKeyVersions/{key_version}`.
158+
repeated string active_key_version = 2
159+
[(google.api.field_behavior) = OUTPUT_ONLY];
160+
}
161+
162+
// Information about the provenance of this database.
163+
message SourceInfo {
164+
// Information about a backup that was used to restore a database.
165+
message BackupSource {
166+
// The resource name of the backup that was used to restore this
167+
// database. Format:
168+
// `projects/{project}/locations/{location}/backups/{backup}`.
169+
string backup = 1 [(google.api.resource_reference) = {
170+
type: "firestore.googleapis.com/Backup"
171+
}];
172+
}
173+
174+
// The source from which this database is derived.
175+
oneof source {
176+
// If set, this database was restored from the specified backup (or a
177+
// snapshot thereof).
178+
BackupSource backup = 1;
179+
}
180+
181+
// The associated long-running operation. This field may not be set after
182+
// the operation has completed. Format:
183+
// `projects/{project}/databases/{database}/operations/{operation}`.
184+
string operation = 3 [(google.api.resource_reference) = {
185+
type: "firestore.googleapis.com/Operation"
186+
}];
187+
}
188+
189+
// Encryption configuration for a new database being created from another
190+
// source.
191+
//
192+
// The source could be a [Backup][google.firestore.admin.v1.Backup] .
193+
message EncryptionConfig {
194+
// The configuration options for using Google default encryption.
195+
message GoogleDefaultEncryptionOptions {}
196+
197+
// The configuration options for using the same encryption method as the
198+
// source.
199+
message SourceEncryptionOptions {}
200+
201+
// The configuration options for using CMEK (Customer Managed Encryption
202+
// Key) encryption.
203+
message CustomerManagedEncryptionOptions {
204+
// Required. Only keys in the same location as the database are allowed to
205+
// be used for encryption.
206+
//
207+
// For Firestore's nam5 multi-region, this corresponds to Cloud KMS
208+
// multi-region us. For Firestore's eur3 multi-region, this corresponds to
209+
// Cloud KMS multi-region europe. See
210+
// https://cloud.google.com/kms/docs/locations.
211+
//
212+
// The expected format is
213+
// `projects/{project_id}/locations/{kms_location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}`.
214+
string kms_key_name = 1 [(google.api.field_behavior) = REQUIRED];
215+
}
216+
217+
// The method for encrypting the database.
218+
oneof encryption_type {
219+
// Use Google default encryption.
220+
GoogleDefaultEncryptionOptions google_default_encryption = 1;
221+
222+
// The database will use the same encryption configuration as the source.
223+
SourceEncryptionOptions use_source_encryption = 2;
224+
225+
// Use Customer Managed Encryption Keys (CMEK) for encryption.
226+
CustomerManagedEncryptionOptions customer_managed_encryption = 3;
227+
}
228+
}
229+
131230
// The resource name of the Database.
132231
// Format: `projects/{project}/databases/{database}`
133232
string name = 1;
@@ -146,6 +245,11 @@ message Database {
146245
google.protobuf.Timestamp update_time = 6
147246
[(google.api.field_behavior) = OUTPUT_ONLY];
148247

248+
// Output only. The timestamp at which this database was deleted. Only set if
249+
// the database has been deleted.
250+
google.protobuf.Timestamp delete_time = 7
251+
[(google.api.field_behavior) = OUTPUT_ONLY];
252+
149253
// The location of the database. Available locations are listed at
150254
// https://cloud.google.com/firestore/docs/locations.
151255
string location_id = 9;
@@ -189,8 +293,8 @@ message Database {
189293
AppEngineIntegrationMode app_engine_integration_mode = 19;
190294

191295
// Output only. The key_prefix for this database. This key_prefix is used, in
192-
// combination with the project id ("<key prefix>~<project id>") to construct
193-
// the application id that is returned from the Cloud Datastore APIs in Google
296+
// combination with the project ID ("<key prefix>~<project id>") to construct
297+
// the application ID that is returned from the Cloud Datastore APIs in Google
194298
// App Engine first generation runtimes.
195299
//
196300
// This value may be empty in which case the appid to use for URL-encoded keys
@@ -200,6 +304,16 @@ message Database {
200304
// State of delete protection for the database.
201305
DeleteProtectionState delete_protection_state = 22;
202306

307+
// Optional. Presence indicates CMEK is enabled for this database.
308+
CmekConfig cmek_config = 23 [(google.api.field_behavior) = OPTIONAL];
309+
310+
// Output only. The database resource's prior database ID. This field is only
311+
// populated for deleted databases.
312+
string previous_id = 25 [(google.api.field_behavior) = OUTPUT_ONLY];
313+
314+
// Output only. Information about the provenance of this database.
315+
SourceInfo source_info = 26 [(google.api.field_behavior) = OUTPUT_ONLY];
316+
203317
// This checksum is computed by the server based on the value of other
204318
// fields, and may be sent on update and delete requests to ensure the
205319
// client has an up-to-date value before proceeding.

‎google/firestore/admin/v1/firestore_admin.proto‎

Lines changed: 19 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -434,7 +434,7 @@ message CreateDatabaseRequest {
434434
// with first character a letter and the last a letter or a number. Must not
435435
// be UUID-like /[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}/.
436436
//
437-
// "(default)" database id is also valid.
437+
// "(default)" database ID is also valid.
438438
string database_id = 3 [(google.api.field_behavior) = REQUIRED];
439439
}
440440

@@ -730,8 +730,8 @@ message ExportDocumentsRequest {
730730
}
731731
];
732732

733-
// Which collection ids to export. Unspecified means all collections. Each
734-
// collection id in this list must be unique.
733+
// Which collection IDs to export. Unspecified means all collections. Each
734+
// collection ID in this list must be unique.
735735
repeated string collection_ids = 2;
736736

737737
// The output URI. Currently only supports Google Cloud Storage URIs of the
@@ -774,8 +774,8 @@ message ImportDocumentsRequest {
774774
}
775775
];
776776

777-
// Which collection ids to import. Unspecified means all collections included
778-
// in the import. Each collection id in this list must be unique.
777+
// Which collection IDs to import. Unspecified means all collections included
778+
// in the import. Each collection ID in this list must be unique.
779779
repeated string collection_ids = 2;
780780

781781
// Location of the exported files.
@@ -898,7 +898,7 @@ message DeleteBackupRequest {
898898
}
899899

900900
// The request message for
901-
// [FirestoreAdmin.RestoreDatabase][google.firestore.admin.v1.RestoreDatabase].
901+
// [FirestoreAdmin.RestoreDatabase][google.firestore.admin.v1.FirestoreAdmin.RestoreDatabase].
902902
message RestoreDatabaseRequest {
903903
// Required. The project to restore the database in. Format is
904904
// `projects/{project_id}`.
@@ -910,24 +910,35 @@ message RestoreDatabaseRequest {
910910
];
911911

912912
// Required. The ID to use for the database, which will become the final
913-
// component of the database's resource name. This database id must not be
913+
// component of the database's resource name. This database ID must not be
914914
// associated with an existing database.
915915
//
916916
// This value should be 4-63 characters. Valid characters are /[a-z][0-9]-/
917917
// with first character a letter and the last a letter or a number. Must not
918918
// be UUID-like /[0-9a-f]{8}(-[0-9a-f]{4}){3}-[0-9a-f]{12}/.
919919
//
920-
// "(default)" database id is also valid.
920+
// "(default)" database ID is also valid.
921921
string database_id = 2 [(google.api.field_behavior) = REQUIRED];
922922

923923
// Required. Backup to restore from. Must be from the same project as the
924924
// parent.
925925
//
926+
// The restored database will be created in the same location as the source
927+
// backup.
928+
//
926929
// Format is: `projects/{project_id}/locations/{location}/backups/{backup}`
927930
string backup = 3 [
928931
(google.api.field_behavior) = REQUIRED,
929932
(google.api.resource_reference) = {
930933
type: "firestore.googleapis.com/Backup"
931934
}
932935
];
936+
937+
// Optional. Encryption configuration for the restored database.
938+
//
939+
// If this field is not specified, the restored database will use
940+
// the same encryption configuration as the backup, namely
941+
// [use_source_encryption][google.firestore.admin.v1.Database.EncryptionConfig.use_source_encryption].
942+
Database.EncryptionConfig encryption_config = 9
943+
[(google.api.field_behavior) = OPTIONAL];
933944
}

0 commit comments

Comments
 (0)