Skip to content

Commit e44427d

Browse files
gcf-owl-bot[bot]gcf-owl-bot[bot]
authored
feat: Add support for project level key usage tracking (#32447)
feat: Added DeleteCryptoKey and DeleteCryptoKeyVersion RPCs to permanently remove resources feat: Introduced the RetiredResource resource to track records of deleted keys and prevent the reuse of their resource names feat: Added ListRetiredResources and GetRetiredResource RPCs to manage and view these records PiperOrigin-RevId: 868670725 Source-Link: googleapis/googleapis@f248ed0 Source-Link: googleapis/googleapis-gen@78b3172 Copy-Tag: eyJwIjoiZ29vZ2xlLWNsb3VkLWttcy1pbnZlbnRvcnktdjEvLk93bEJvdC55YW1sIiwiaCI6Ijc4YjMxNzIxNmE5NjFlMTBmNDI2NDg3ZjEwOTcyODA0OTEyYjg1ZWMifQ== * 🦉 Updates from OwlBot post-processor See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md feat: Add KeyProjectResolutionMode to AutokeyConfig to support project-level configurations feat: Add more post-quantum (PQ) signature algorithms to CryptoKeyVersion docs: Update documentation for AutokeyAdmin service and messages to support folder and project-level configurations docs: Clarify supported resources for the crypto_key_backend field in ImportJob PiperOrigin-RevId: 870858133 Source-Link: googleapis/googleapis@b026ba8 Source-Link: googleapis/googleapis-gen@958c60c Copy-Tag: eyJwIjoiZ29vZ2xlLWNsb3VkLWttcy1pbnZlbnRvcnktdjEvLk93bEJvdC55YW1sIiwiaCI6Ijk1OGM2MGM5ODQ0ZTZiMWM0Mzc4YzQzZTM0ZWJlODdlNjYxYTMzMjAifQ== * 🦉 Updates from OwlBot post-processor See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md * feat: Add support for project level key usage tracking docs: Add support for project level key usage tracking PiperOrigin-RevId: 871667322 Source-Link: googleapis/googleapis@1133adb Source-Link: googleapis/googleapis-gen@d0121e3 Copy-Tag: eyJwIjoiZ29vZ2xlLWNsb3VkLWttcy1pbnZlbnRvcnktdjEvLk93bEJvdC55YW1sIiwiaCI6ImQwMTIxZTM3YmE1ZmE5OWYxMmFiMTk2NzU5MjYzNWMyODk3MjBkMWMifQ== * 🦉 Updates from OwlBot post-processor See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md --------- Co-authored-by: Owl Bot <gcf-owl-bot[bot]@users.noreply.github.com>
1 parent c549d2e commit e44427d

File tree

12 files changed

+234
-38
lines changed

12 files changed

+234
-38
lines changed

‎google-cloud-kms-inventory-v1/lib/google/cloud/kms/inventory/v1/key_dashboard_service_pb.rb‎

Lines changed: 1 addition & 1 deletion
Some generated files are not rendered by default. Learn more about customizing how changed files appear on GitHub.

‎google-cloud-kms-inventory-v1/lib/google/cloud/kms/inventory/v1/key_tracking_service/client.rb‎

Lines changed: 24 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -191,10 +191,16 @@ def logger
191191

192192
##
193193
# Returns aggregate information about the resources protected by the given
194-
# Cloud KMS {::Google::Cloud::Kms::V1::CryptoKey CryptoKey}. Only resources within
195-
# the same Cloud organization as the key will be returned. The project that
196-
# holds the key must be part of an organization in order for this call to
197-
# succeed.
194+
# Cloud KMS {::Google::Cloud::Kms::V1::CryptoKey CryptoKey}. By default,
195+
# summary of resources within the same Cloud organization as the key will be
196+
# returned, which requires the KMS organization service account to be
197+
# configured(refer
198+
# https://docs.cloud.google.com/kms/docs/view-key-usage#required-roles).
199+
# If the KMS organization service account is not configured or key's project
200+
# is not part of an organization, set
201+
# {::Google::Cloud::Kms::Inventory::V1::GetProtectedResourcesSummaryRequest#fallback_scope fallback_scope}
202+
# to `FALLBACK_SCOPE_PROJECT` to retrieve a summary of protected resources
203+
# within the key's project.
198204
#
199205
# @overload get_protected_resources_summary(request, options = nil)
200206
# Pass arguments to `get_protected_resources_summary` via a request object, either of type
@@ -206,14 +212,17 @@ def logger
206212
# @param options [::Gapic::CallOptions, ::Hash]
207213
# Overrides the default settings for this call, e.g, timeout, retries, etc. Optional.
208214
#
209-
# @overload get_protected_resources_summary(name: nil)
215+
# @overload get_protected_resources_summary(name: nil, fallback_scope: nil)
210216
# Pass arguments to `get_protected_resources_summary` via keyword arguments. Note that at
211217
# least one keyword argument is required. To specify no parameters, or to keep all
212218
# the default parameter values, pass an empty Hash as a request object (see above).
213219
#
214220
# @param name [::String]
215221
# Required. The resource name of the
216222
# {::Google::Cloud::Kms::V1::CryptoKey CryptoKey}.
223+
# @param fallback_scope [::Google::Cloud::Kms::Inventory::V1::FallbackScope]
224+
# Optional. The scope to use if the kms organization service account is not
225+
# configured.
217226
#
218227
# @yield [response, operation] Access the result along with the RPC operation
219228
# @yieldparam response [::Google::Cloud::Kms::Inventory::V1::ProtectedResourcesSummary]
@@ -281,7 +290,8 @@ def get_protected_resources_summary request, options = nil
281290

282291
##
283292
# Returns metadata about the resources protected by the given Cloud KMS
284-
# {::Google::Cloud::Kms::V1::CryptoKey CryptoKey} in the given Cloud organization.
293+
# {::Google::Cloud::Kms::V1::CryptoKey CryptoKey} in the given Cloud
294+
# organization/project.
285295
#
286296
# @overload search_protected_resources(request, options = nil)
287297
# Pass arguments to `search_protected_resources` via a request object, either of type
@@ -299,8 +309,14 @@ def get_protected_resources_summary request, options = nil
299309
# the default parameter values, pass an empty Hash as a request object (see above).
300310
#
301311
# @param scope [::String]
302-
# Required. Resource name of the organization.
303-
# Example: organizations/123
312+
# Required. A scope can be an organization or a project. Resources protected
313+
# by the crypto key in provided scope will be returned.
314+
#
315+
# The following values are allowed:
316+
#
317+
# * organizations/\\{ORGANIZATION_NUMBER} (e.g., "organizations/12345678")
318+
# * projects/\\{PROJECT_ID} (e.g., "projects/foo-bar")
319+
# * projects/\\{PROJECT_NUMBER} (e.g., "projects/12345678")
304320
# @param crypto_key [::String]
305321
# Required. The resource name of the
306322
# {::Google::Cloud::Kms::V1::CryptoKey CryptoKey}.

‎google-cloud-kms-inventory-v1/lib/google/cloud/kms/inventory/v1/key_tracking_service/paths.rb‎

Lines changed: 14 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -39,6 +39,20 @@ def organization_path organization:
3939
"organizations/#{organization}"
4040
end
4141

42+
##
43+
# Create a fully-qualified Project resource string.
44+
#
45+
# The resource will be in the following format:
46+
#
47+
# `projects/{project}`
48+
#
49+
# @param project [String]
50+
#
51+
# @return [::String]
52+
def project_path project:
53+
"projects/#{project}"
54+
end
55+
4256
##
4357
# Create a fully-qualified ProtectedResourcesSummary resource string.
4458
#

‎google-cloud-kms-inventory-v1/lib/google/cloud/kms/inventory/v1/key_tracking_service/rest/client.rb‎

Lines changed: 24 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -184,10 +184,16 @@ def logger
184184

185185
##
186186
# Returns aggregate information about the resources protected by the given
187-
# Cloud KMS {::Google::Cloud::Kms::V1::CryptoKey CryptoKey}. Only resources within
188-
# the same Cloud organization as the key will be returned. The project that
189-
# holds the key must be part of an organization in order for this call to
190-
# succeed.
187+
# Cloud KMS {::Google::Cloud::Kms::V1::CryptoKey CryptoKey}. By default,
188+
# summary of resources within the same Cloud organization as the key will be
189+
# returned, which requires the KMS organization service account to be
190+
# configured(refer
191+
# https://docs.cloud.google.com/kms/docs/view-key-usage#required-roles).
192+
# If the KMS organization service account is not configured or key's project
193+
# is not part of an organization, set
194+
# {::Google::Cloud::Kms::Inventory::V1::GetProtectedResourcesSummaryRequest#fallback_scope fallback_scope}
195+
# to `FALLBACK_SCOPE_PROJECT` to retrieve a summary of protected resources
196+
# within the key's project.
191197
#
192198
# @overload get_protected_resources_summary(request, options = nil)
193199
# Pass arguments to `get_protected_resources_summary` via a request object, either of type
@@ -199,14 +205,17 @@ def logger
199205
# @param options [::Gapic::CallOptions, ::Hash]
200206
# Overrides the default settings for this call, e.g, timeout, retries etc. Optional.
201207
#
202-
# @overload get_protected_resources_summary(name: nil)
208+
# @overload get_protected_resources_summary(name: nil, fallback_scope: nil)
203209
# Pass arguments to `get_protected_resources_summary` via keyword arguments. Note that at
204210
# least one keyword argument is required. To specify no parameters, or to keep all
205211
# the default parameter values, pass an empty Hash as a request object (see above).
206212
#
207213
# @param name [::String]
208214
# Required. The resource name of the
209215
# {::Google::Cloud::Kms::V1::CryptoKey CryptoKey}.
216+
# @param fallback_scope [::Google::Cloud::Kms::Inventory::V1::FallbackScope]
217+
# Optional. The scope to use if the kms organization service account is not
218+
# configured.
210219
# @yield [result, operation] Access the result along with the TransportOperation object
211220
# @yieldparam result [::Google::Cloud::Kms::Inventory::V1::ProtectedResourcesSummary]
212221
# @yieldparam operation [::Gapic::Rest::TransportOperation]
@@ -267,7 +276,8 @@ def get_protected_resources_summary request, options = nil
267276

268277
##
269278
# Returns metadata about the resources protected by the given Cloud KMS
270-
# {::Google::Cloud::Kms::V1::CryptoKey CryptoKey} in the given Cloud organization.
279+
# {::Google::Cloud::Kms::V1::CryptoKey CryptoKey} in the given Cloud
280+
# organization/project.
271281
#
272282
# @overload search_protected_resources(request, options = nil)
273283
# Pass arguments to `search_protected_resources` via a request object, either of type
@@ -285,8 +295,14 @@ def get_protected_resources_summary request, options = nil
285295
# the default parameter values, pass an empty Hash as a request object (see above).
286296
#
287297
# @param scope [::String]
288-
# Required. Resource name of the organization.
289-
# Example: organizations/123
298+
# Required. A scope can be an organization or a project. Resources protected
299+
# by the crypto key in provided scope will be returned.
300+
#
301+
# The following values are allowed:
302+
#
303+
# * organizations/\\{ORGANIZATION_NUMBER} (e.g., "organizations/12345678")
304+
# * projects/\\{PROJECT_ID} (e.g., "projects/foo-bar")
305+
# * projects/\\{PROJECT_NUMBER} (e.g., "projects/12345678")
290306
# @param crypto_key [::String]
291307
# Required. The resource name of the
292308
# {::Google::Cloud::Kms::V1::CryptoKey CryptoKey}.

‎google-cloud-kms-inventory-v1/lib/google/cloud/kms/inventory/v1/key_tracking_service/rest/service_stub.rb‎

Lines changed: 7 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -193,6 +193,13 @@ def self.transcode_search_protected_resources_request request_pb
193193
["scope", %r{^organizations/[^/]+/?$}, false]
194194
]
195195
)
196+
.with_bindings(
197+
uri_method: :get,
198+
uri_template: "/v1/{scope}/protectedResources:search",
199+
matches: [
200+
["scope", %r{^projects/[^/]+/?$}, false]
201+
]
202+
)
196203
transcoder.transcode request_pb
197204
end
198205
end

0 commit comments

Comments
 (0)