Skip to content

Commit eabec5a

Browse files
Google APIscopybara-github
Google APIs
authored and
copybara-github
committed
feat: Publish new fields to support Customer Managed Encryption Keys (CMEK) on the existing Cloud Bigtable service methods.
PiperOrigin-RevId: 359130387
1 parent 8c058c5 commit eabec5a

3 files changed

Lines changed: 99 additions & 9 deletions

File tree

‎google/bigtable/admin/v2/BUILD.bazel‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -26,6 +26,7 @@ proto_library(
2626
"//google/iam/v1:iam_policy_proto",
2727
"//google/iam/v1:policy_proto",
2828
"//google/longrunning:operations_proto",
29+
"//google/rpc:status_proto",
2930
"@com_google_protobuf//:duration_proto",
3031
"@com_google_protobuf//:empty_proto",
3132
"@com_google_protobuf//:field_mask_proto",
@@ -119,6 +120,7 @@ go_proto_library(
119120
"//google/api:annotations_go_proto",
120121
"//google/iam/v1:iam_go_proto",
121122
"//google/longrunning:longrunning_go_proto",
123+
"//google/rpc:status_go_proto",
122124
],
123125
)
124126

@@ -132,8 +134,8 @@ go_gapic_library(
132134
":admin_go_proto",
133135
"//google/iam/v1:iam_go_proto",
134136
"//google/longrunning:longrunning_go_proto",
135-
"@com_google_cloud_go//longrunning:go_default_library",
136137
"@com_google_cloud_go//longrunning/autogen:go_default_library",
138+
"@com_google_cloud_go//longrunning:go_default_library",
137139
"@io_bazel_rules_go//proto/wkt:duration_go_proto",
138140
],
139141
)

‎google/bigtable/admin/v2/instance.proto‎

Lines changed: 26 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Copyright 2019 Google LLC.
1+
// Copyright 2021 Google LLC
22
//
33
// Licensed under the Apache License, Version 2.0 (the "License");
44
// you may not use this file except in compliance with the License.
@@ -11,7 +11,6 @@
1111
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
1212
// See the License for the specific language governing permissions and
1313
// limitations under the License.
14-
//
1514

1615
syntax = "proto3";
1716

@@ -28,6 +27,10 @@ option java_outer_classname = "InstanceProto";
2827
option java_package = "com.google.bigtable.admin.v2";
2928
option php_namespace = "Google\\Cloud\\Bigtable\\Admin\\V2";
3029
option ruby_package = "Google::Cloud::Bigtable::Admin::V2";
30+
option (google.api.resource_definition) = {
31+
type: "cloudkms.googleapis.com/CryptoKey"
32+
pattern: "projects/{project}/locations/{location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}"
33+
};
3134

3235
// A collection of Bigtable [Tables][google.bigtable.admin.v2.Table] and
3336
// the resources that serve them.
@@ -113,6 +116,22 @@ message Cluster {
113116
pattern: "projects/{project}/instances/{instance}/clusters/{cluster}"
114117
};
115118

119+
// Cloud Key Management Service (Cloud KMS) settings for a CMEK-protected
120+
// cluster.
121+
message EncryptionConfig {
122+
// Describes the Cloud KMS encryption key that will be used to protect the
123+
// destination Bigtable cluster. The requirements for this key are:
124+
// 1) The Cloud Bigtable service account associated with the project that
125+
// contains this cluster must be granted the
126+
// `cloudkms.cryptoKeyEncrypterDecrypter` role on the CMEK key.
127+
// 2) Only regional keys can be used and the region of the CMEK key must
128+
// match the region of the cluster.
129+
// 3) All clusters within an instance must use the same CMEK key.
130+
string kms_key_name = 1 [(google.api.resource_reference) = {
131+
type: "cloudkms.googleapis.com/CryptoKey"
132+
}];
133+
}
134+
116135
// Possible states of a cluster.
117136
enum State {
118137
// The state of the cluster could not be determined.
@@ -162,6 +181,10 @@ message Cluster {
162181
// The type of storage used by this cluster to serve its
163182
// parent instance's tables, unless explicitly overridden.
164183
StorageType default_storage_type = 5;
184+
185+
// Immutable. The encryption configuration for CMEK-protected clusters.
186+
EncryptionConfig encryption_config = 6
187+
[(google.api.field_behavior) = IMMUTABLE];
165188
}
166189

167190
// A configuration object describing how Cloud Bigtable should treat traffic
@@ -194,7 +217,7 @@ message AppProfile {
194217

195218
// (`OutputOnly`)
196219
// The unique name of the app profile. Values are of the form
197-
// `projects/<project>/instances/<instance>/appProfiles/[_a-zA-Z0-9][-_.a-zA-Z0-9]*`.
220+
// `projects/{project}/instances/{instance}/appProfiles/[_a-zA-Z0-9][-_.a-zA-Z0-9]*`.
198221
string name = 1;
199222

200223
// Strongly validated etag for optimistic concurrency control. Preserve the

‎google/bigtable/admin/v2/table.proto‎

Lines changed: 70 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -1,4 +1,4 @@
1-
// Copyright 2020 Google LLC
1+
// Copyright 2021 Google LLC
22
//
33
// Licensed under the Apache License, Version 2.0 (the "License");
44
// you may not use this file except in compliance with the License.
@@ -20,6 +20,7 @@ import "google/api/field_behavior.proto";
2020
import "google/api/resource.proto";
2121
import "google/protobuf/duration.proto";
2222
import "google/protobuf/timestamp.proto";
23+
import "google/rpc/status.proto";
2324

2425
option csharp_namespace = "Google.Cloud.Bigtable.Admin.V2";
2526
option go_package = "google.golang.org/genproto/googleapis/bigtable/admin/v2;admin";
@@ -28,6 +29,10 @@ option java_outer_classname = "TableProto";
2829
option java_package = "com.google.bigtable.admin.v2";
2930
option php_namespace = "Google\\Cloud\\Bigtable\\Admin\\V2";
3031
option ruby_package = "Google::Cloud::Bigtable::Admin::V2";
32+
option (google.api.resource_definition) = {
33+
type: "cloudkms.googleapis.com/CryptoKeyVersion"
34+
pattern: "projects/{project}/locations/{location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}/cryptoKeyVersions/{crypto_key_version}"
35+
};
3136

3237
// Indicates the type of the restore source.
3338
enum RestoreSourceType {
@@ -92,6 +97,14 @@ message Table {
9297

9398
// Output only. The state of replication for the table in this cluster.
9499
ReplicationState replication_state = 1;
100+
101+
// Output only. The encryption information for the table in this cluster.
102+
// If the encryption key protecting this resource is customer managed, then
103+
// its version can be rotated in Cloud Key Management Service (Cloud KMS).
104+
// The primary version of the key and its status will be reflected here when
105+
// changes propagate from Cloud KMS.
106+
repeated EncryptionInfo encryption_info = 2
107+
[(google.api.field_behavior) = OUTPUT_ONLY];
95108
}
96109

97110
// Possible timestamp granularities to use when keeping multiple versions
@@ -120,20 +133,23 @@ message Table {
120133
// state.
121134
REPLICATION_VIEW = 3;
122135

136+
// Only populates 'name' and fields related to the table's encryption state.
137+
ENCRYPTION_VIEW = 5;
138+
123139
// Populates all fields.
124140
FULL = 4;
125141
}
126142

127-
// Output only. The unique name of the table. Values are of the form
128-
// `projects/<project>/instances/<instance>/tables/[_a-zA-Z0-9][-_.a-zA-Z0-9]*`.
143+
// The unique name of the table. Values are of the form
144+
// `projects/{project}/instances/{instance}/tables/[_a-zA-Z0-9][-_.a-zA-Z0-9]*`.
129145
// Views: `NAME_ONLY`, `SCHEMA_VIEW`, `REPLICATION_VIEW`, `FULL`
130146
string name = 1;
131147

132148
// Output only. Map from cluster ID to per-cluster table state.
133149
// If it could not be determined whether or not the table has data in a
134150
// particular cluster (for example, if its zone is unavailable), then
135151
// there will be an entry for the cluster with UNKNOWN `replication_status`.
136-
// Views: `REPLICATION_VIEW`, `FULL`
152+
// Views: `REPLICATION_VIEW`, `ENCRYPTION_VIEW`, `FULL`
137153
map<string, ClusterState> cluster_states = 2;
138154

139155
// (`CreationOnly`)
@@ -196,6 +212,51 @@ message GcRule {
196212
}
197213
}
198214

215+
// Encryption information for a given resource.
216+
// If this resource is protected with customer managed encryption, the in-use
217+
// Cloud Key Management Service (Cloud KMS) key version is specified along with
218+
// its status.
219+
message EncryptionInfo {
220+
// Possible encryption types for a resource.
221+
enum EncryptionType {
222+
// Encryption type was not specified, though data at rest remains encrypted.
223+
ENCRYPTION_TYPE_UNSPECIFIED = 0;
224+
225+
// The data backing this resource is encrypted at rest with a key that is
226+
// fully managed by Google. No key version or status will be populated.
227+
// This is the default state.
228+
GOOGLE_DEFAULT_ENCRYPTION = 1;
229+
230+
// The data backing this resource is encrypted at rest with a key that is
231+
// managed by the customer.
232+
// The in-use version of the key and its status are populated for
233+
// CMEK-protected tables.
234+
// CMEK-protected backups are pinned to the key version that was in use at
235+
// the time the backup was taken. This key version is populated but its
236+
// status is not tracked and is reported as `UNKNOWN`.
237+
CUSTOMER_MANAGED_ENCRYPTION = 2;
238+
}
239+
240+
// Output only. The type of encryption used to protect this resource.
241+
EncryptionType encryption_type = 3
242+
[(google.api.field_behavior) = OUTPUT_ONLY];
243+
244+
// Output only. The status of encrypt/decrypt calls on underlying data for
245+
// this resource. Regardless of status, the existing data is always encrypted
246+
// at rest.
247+
google.rpc.Status encryption_status = 4
248+
[(google.api.field_behavior) = OUTPUT_ONLY];
249+
250+
// Output only. The version of the Cloud KMS key specified in the parent
251+
// cluster that is in use for the data underlying this table.
252+
string kms_key_version = 2 [
253+
(google.api.field_behavior) = OUTPUT_ONLY,
254+
(google.api.resource_reference) = {
255+
type: "cloudkms.googleapis.com/CryptoKeyVersion"
256+
}
257+
];
258+
}
259+
199260
// A snapshot of a table at a particular time. A snapshot can be used as a
200261
// checkpoint for data restoration or a data source for a new table.
201262
//
@@ -225,7 +286,7 @@ message Snapshot {
225286

226287
// Output only. The unique name of the snapshot.
227288
// Values are of the form
228-
// `projects/<project>/instances/<instance>/clusters/<cluster>/snapshots/<snapshot>`.
289+
// `projects/{project}/instances/{instance}/clusters/{cluster}/snapshots/{snapshot}`.
229290
string name = 1;
230291

231292
// Output only. The source table at the time the snapshot was taken.
@@ -318,6 +379,10 @@ message Backup {
318379

319380
// Output only. The current state of the backup.
320381
State state = 7 [(google.api.field_behavior) = OUTPUT_ONLY];
382+
383+
// Output only. The encryption information for the backup.
384+
EncryptionInfo encryption_info = 9
385+
[(google.api.field_behavior) = OUTPUT_ONLY];
321386
}
322387

323388
// Information about a backup.

0 commit comments

Comments
 (0)