Skip to content
This repository was archived by the owner on Jul 13, 2023. It is now read-only.

Commit f62a19c

Browse files
gcf-owl-bot[bot]gcf-owl-bot[bot]
authored
feat: add a new EkmService API (#532)
PiperOrigin-RevId: 425982419 Source-Link: googleapis/googleapis@8dff569 Source-Link: https://github.com/googleapis/googleapis-gen/commit/b1538df1643922606d00ec0365c1e0a51bfbcabf Copy-Tag: eyJwIjoiLmdpdGh1Yi8uT3dsQm90LnlhbWwiLCJoIjoiYjE1MzhkZjE2NDM5MjI2MDZkMDBlYzAzNjVjMWUwYTUxYmZiY2FiZiJ9 See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md Co-authored-by: Owl Bot <gcf-owl-bot[bot]@users.noreply.github.com>
1 parent ac2209d commit f62a19c

48 files changed

Lines changed: 13041 additions & 4198 deletions

File tree

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

‎protos/google/cloud/kms/v1/ekm_service.proto‎

Lines changed: 293 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,293 @@
1+
// Copyright 2021 Google LLC
2+
//
3+
// Licensed under the Apache License, Version 2.0 (the "License");
4+
// you may not use this file except in compliance with the License.
5+
// You may obtain a copy of the License at
6+
//
7+
// http://www.apache.org/licenses/LICENSE-2.0
8+
//
9+
// Unless required by applicable law or agreed to in writing, software
10+
// distributed under the License is distributed on an "AS IS" BASIS,
11+
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
// See the License for the specific language governing permissions and
13+
// limitations under the License.
14+
15+
syntax = "proto3";
16+
17+
package google.cloud.kms.v1;
18+
19+
import "google/api/annotations.proto";
20+
import "google/api/client.proto";
21+
import "google/api/field_behavior.proto";
22+
import "google/api/resource.proto";
23+
import "google/protobuf/field_mask.proto";
24+
import "google/protobuf/timestamp.proto";
25+
26+
option cc_enable_arenas = true;
27+
option csharp_namespace = "Google.Cloud.Kms.V1";
28+
option go_package = "google.golang.org/genproto/googleapis/cloud/kms/v1;kms";
29+
option java_multiple_files = true;
30+
option java_outer_classname = "EkmServiceProto";
31+
option java_package = "com.google.cloud.kms.v1";
32+
option php_namespace = "Google\\Cloud\\Kms\\V1";
33+
option (google.api.resource_definition) = {
34+
type: "servicedirectory.googleapis.com/Service"
35+
pattern: "projects/{project}/locations/{location}/namespaces/{namespace}/services/{service}"
36+
};
37+
38+
// Google Cloud Key Management EKM Service
39+
//
40+
// Manages external cryptographic keys and operations using those keys.
41+
// Implements a REST model with the following objects:
42+
// * [EkmConnection][google.cloud.kms.v1.EkmConnection]
43+
service EkmService {
44+
option (google.api.default_host) = "cloudkms.googleapis.com";
45+
option (google.api.oauth_scopes) =
46+
"https://www.googleapis.com/auth/cloud-platform,"
47+
"https://www.googleapis.com/auth/cloudkms";
48+
49+
// Lists [EkmConnections][google.cloud.kms.v1.EkmConnection].
50+
rpc ListEkmConnections(ListEkmConnectionsRequest)
51+
returns (ListEkmConnectionsResponse) {
52+
option (google.api.http) = {
53+
get: "/v1/{parent=projects/*/locations/*}/ekmConnections"
54+
};
55+
option (google.api.method_signature) = "parent";
56+
}
57+
58+
// Returns metadata for a given
59+
// [EkmConnection][google.cloud.kms.v1.EkmConnection].
60+
rpc GetEkmConnection(GetEkmConnectionRequest) returns (EkmConnection) {
61+
option (google.api.http) = {
62+
get: "/v1/{name=projects/*/locations/*/ekmConnections/*}"
63+
};
64+
option (google.api.method_signature) = "name";
65+
}
66+
67+
// Creates a new [EkmConnection][google.cloud.kms.v1.EkmConnection] in a given
68+
// Project and Location.
69+
rpc CreateEkmConnection(CreateEkmConnectionRequest) returns (EkmConnection) {
70+
option (google.api.http) = {
71+
post: "/v1/{parent=projects/*/locations/*}/ekmConnections"
72+
body: "ekm_connection"
73+
};
74+
option (google.api.method_signature) =
75+
"parent,ekm_connection_id,ekm_connection";
76+
}
77+
78+
// Updates an [EkmConnection][google.cloud.kms.v1.EkmConnection]'s metadata.
79+
rpc UpdateEkmConnection(UpdateEkmConnectionRequest) returns (EkmConnection) {
80+
option (google.api.http) = {
81+
patch: "/v1/{ekm_connection.name=projects/*/locations/*/ekmConnections/*}"
82+
body: "ekm_connection"
83+
};
84+
option (google.api.method_signature) = "ekm_connection,update_mask";
85+
}
86+
}
87+
88+
// Request message for [KeyManagementService.ListEkmConnections][].
89+
message ListEkmConnectionsRequest {
90+
// Required. The resource name of the location associated with the
91+
// [EkmConnections][google.cloud.kms.v1.EkmConnection] to list, in the format
92+
// `projects/*/locations/*`.
93+
string parent = 1 [
94+
(google.api.field_behavior) = REQUIRED,
95+
(google.api.resource_reference) = {
96+
type: "locations.googleapis.com/Location"
97+
}
98+
];
99+
100+
// Optional. Optional limit on the number of
101+
// [EkmConnections][google.cloud.kms.v1.EkmConnection] to include in the
102+
// response. Further [EkmConnections][google.cloud.kms.v1.EkmConnection] can
103+
// subsequently be obtained by including the
104+
// [ListEkmConnectionsResponse.next_page_token][google.cloud.kms.v1.ListEkmConnectionsResponse.next_page_token]
105+
// in a subsequent request. If unspecified, the server will pick an
106+
// appropriate default.
107+
int32 page_size = 2 [(google.api.field_behavior) = OPTIONAL];
108+
109+
// Optional. Optional pagination token, returned earlier via
110+
// [ListEkmConnectionsResponse.next_page_token][google.cloud.kms.v1.ListEkmConnectionsResponse.next_page_token].
111+
string page_token = 3 [(google.api.field_behavior) = OPTIONAL];
112+
113+
// Optional. Only include resources that match the filter in the response. For
114+
// more information, see
115+
// [Sorting and filtering list
116+
// results](https://cloud.google.com/kms/docs/sorting-and-filtering).
117+
string filter = 4 [(google.api.field_behavior) = OPTIONAL];
118+
119+
// Optional. Specify how the results should be sorted. If not specified, the
120+
// results will be sorted in the default order. For more information, see
121+
// [Sorting and filtering list
122+
// results](https://cloud.google.com/kms/docs/sorting-and-filtering).
123+
string order_by = 5 [(google.api.field_behavior) = OPTIONAL];
124+
}
125+
126+
// Response message for [KeyManagementService.ListEkmConnections][].
127+
message ListEkmConnectionsResponse {
128+
// The list of [EkmConnections][google.cloud.kms.v1.EkmConnection].
129+
repeated EkmConnection ekm_connections = 1;
130+
131+
// A token to retrieve next page of results. Pass this value in
132+
// [ListEkmConnectionsRequest.page_token][google.cloud.kms.v1.ListEkmConnectionsRequest.page_token]
133+
// to retrieve the next page of results.
134+
string next_page_token = 2;
135+
136+
// The total number of [EkmConnections][google.cloud.kms.v1.EkmConnection]
137+
// that matched the query.
138+
int32 total_size = 3;
139+
}
140+
141+
// Request message for [KeyManagementService.GetEkmConnection][].
142+
message GetEkmConnectionRequest {
143+
// Required. The [name][google.cloud.kms.v1.EkmConnection.name] of the
144+
// [EkmConnection][google.cloud.kms.v1.EkmConnection] to get.
145+
string name = 1 [
146+
(google.api.field_behavior) = REQUIRED,
147+
(google.api.resource_reference) = {
148+
type: "cloudkms.googleapis.com/EkmConnection"
149+
}
150+
];
151+
}
152+
153+
// Request message for [KeyManagementService.CreateEkmConnection][].
154+
message CreateEkmConnectionRequest {
155+
// Required. The resource name of the location associated with the
156+
// [EkmConnection][google.cloud.kms.v1.EkmConnection], in the format
157+
// `projects/*/locations/*`.
158+
string parent = 1 [
159+
(google.api.field_behavior) = REQUIRED,
160+
(google.api.resource_reference) = {
161+
type: "locations.googleapis.com/Location"
162+
}
163+
];
164+
165+
// Required. It must be unique within a location and match the regular
166+
// expression `[a-zA-Z0-9_-]{1,63}`.
167+
string ekm_connection_id = 2 [(google.api.field_behavior) = REQUIRED];
168+
169+
// Required. An [EkmConnection][google.cloud.kms.v1.EkmConnection] with
170+
// initial field values.
171+
EkmConnection ekm_connection = 3 [(google.api.field_behavior) = REQUIRED];
172+
}
173+
174+
// Request message for [KeyManagementService.UpdateEkmConnection][].
175+
message UpdateEkmConnectionRequest {
176+
// Required. [EkmConnection][google.cloud.kms.v1.EkmConnection] with updated
177+
// values.
178+
EkmConnection ekm_connection = 1 [(google.api.field_behavior) = REQUIRED];
179+
180+
// Required. List of fields to be updated in this request.
181+
google.protobuf.FieldMask update_mask = 2
182+
[(google.api.field_behavior) = REQUIRED];
183+
}
184+
185+
// A [Certificate][google.cloud.kms.v1.Certificate] represents an X.509
186+
// certificate used to authenticate HTTPS connections to EKM replicas.
187+
message Certificate {
188+
// Required. The raw certificate bytes in DER format.
189+
bytes raw_der = 1 [(google.api.field_behavior) = REQUIRED];
190+
191+
// Output only. True if the certificate was parsed successfully.
192+
bool parsed = 2 [(google.api.field_behavior) = OUTPUT_ONLY];
193+
194+
// Output only. The issuer distinguished name in RFC 2253 format. Only present
195+
// if [parsed][google.cloud.kms.v1.Certificate.parsed] is true.
196+
string issuer = 3 [(google.api.field_behavior) = OUTPUT_ONLY];
197+
198+
// Output only. The subject distinguished name in RFC 2253 format. Only
199+
// present if [parsed][google.cloud.kms.v1.Certificate.parsed] is true.
200+
string subject = 4 [(google.api.field_behavior) = OUTPUT_ONLY];
201+
202+
// Output only. The subject Alternative DNS names. Only present if
203+
// [parsed][google.cloud.kms.v1.Certificate.parsed] is true.
204+
repeated string subject_alternative_dns_names = 5
205+
[(google.api.field_behavior) = OUTPUT_ONLY];
206+
207+
// Output only. The certificate is not valid before this time. Only present if
208+
// [parsed][google.cloud.kms.v1.Certificate.parsed] is true.
209+
google.protobuf.Timestamp not_before_time = 6
210+
[(google.api.field_behavior) = OUTPUT_ONLY];
211+
212+
// Output only. The certificate is not valid after this time. Only present if
213+
// [parsed][google.cloud.kms.v1.Certificate.parsed] is true.
214+
google.protobuf.Timestamp not_after_time = 7
215+
[(google.api.field_behavior) = OUTPUT_ONLY];
216+
217+
// Output only. The certificate serial number as a hex string. Only present if
218+
// [parsed][google.cloud.kms.v1.Certificate.parsed] is true.
219+
string serial_number = 8 [(google.api.field_behavior) = OUTPUT_ONLY];
220+
221+
// Output only. The SHA-256 certificate fingerprint as a hex string. Only
222+
// present if [parsed][google.cloud.kms.v1.Certificate.parsed] is true.
223+
string sha256_fingerprint = 9 [(google.api.field_behavior) = OUTPUT_ONLY];
224+
}
225+
226+
// An [EkmConnection][google.cloud.kms.v1.EkmConnection] represents an
227+
// individual EKM connection. It can be used for creating
228+
// [CryptoKeys][google.cloud.kms.v1.CryptoKey] and
229+
// [CryptoKeyVersions][google.cloud.kms.v1.CryptoKeyVersion] with a
230+
// [ProtectionLevel][google.cloud.kms.v1.ProtectionLevel] of
231+
// [EXTERNAL_VPC][CryptoKeyVersion.ProtectionLevel.EXTERNAL_VPC], as well as
232+
// performing cryptographic operations using keys created within the
233+
// [EkmConnection][google.cloud.kms.v1.EkmConnection].
234+
message EkmConnection {
235+
option (google.api.resource) = {
236+
type: "cloudkms.googleapis.com/EkmConnection"
237+
pattern: "projects/{project}/locations/{location}/ekmConnections/{ekm_connection}"
238+
};
239+
240+
// A [ServiceResolver][google.cloud.kms.v1.EkmConnection.ServiceResolver]
241+
// represents an EKM replica that can be reached within an
242+
// [EkmConnection][google.cloud.kms.v1.EkmConnection].
243+
message ServiceResolver {
244+
// Required. The resource name of the Service Directory service pointing to
245+
// an EKM replica, in the format
246+
// `projects/*/locations/*/namespaces/*/services/*`.
247+
string service_directory_service = 1 [
248+
(google.api.field_behavior) = REQUIRED,
249+
(google.api.resource_reference) = {
250+
type: "servicedirectory.googleapis.com/Service"
251+
}
252+
];
253+
254+
// Optional. The filter applied to the endpoints of the resolved service. If
255+
// no filter is specified, all endpoints will be considered. An endpoint
256+
// will be chosen arbitrarily from the filtered list for each request.
257+
//
258+
// For endpoint filter syntax and examples, see
259+
// https://cloud.google.com/service-directory/docs/reference/rpc/google.cloud.servicedirectory.v1#resolveservicerequest.
260+
string endpoint_filter = 2 [(google.api.field_behavior) = OPTIONAL];
261+
262+
// Required. The hostname of the EKM replica used at TLS and HTTP layers.
263+
string hostname = 3 [(google.api.field_behavior) = REQUIRED];
264+
265+
// Required. A list of leaf server certificates used to authenticate HTTPS
266+
// connections to the EKM replica.
267+
repeated Certificate server_certificates = 4
268+
[(google.api.field_behavior) = REQUIRED];
269+
}
270+
271+
// Output only. The resource name for the
272+
// [EkmConnection][google.cloud.kms.v1.EkmConnection] in the format
273+
// `projects/*/locations/*/ekmConnections/*`.
274+
string name = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
275+
276+
// Output only. The time at which the
277+
// [EkmConnection][google.cloud.kms.v1.EkmConnection] was created.
278+
google.protobuf.Timestamp create_time = 2
279+
[(google.api.field_behavior) = OUTPUT_ONLY];
280+
281+
// A list of
282+
// [ServiceResolvers][google.cloud.kms.v1.EkmConnection.ServiceResolver] where
283+
// the EKM can be reached. There should be one ServiceResolver per EKM
284+
// replica. Currently, only a single
285+
// [ServiceResolver][google.cloud.kms.v1.EkmConnection.ServiceResolver] is
286+
// supported.
287+
repeated ServiceResolver service_resolvers = 3;
288+
289+
// This checksum is computed by the server based on the value of other fields,
290+
// and may be sent on update requests to ensure the client has an up-to-date
291+
// value before proceeding.
292+
string etag = 5;
293+
}

0 commit comments

Comments
 (0)