Skip to content

Commit 965dbc7

Browse files
yoshi-automationyoshi-automation
authored
feat: Rotation for Secrets (#95)
Users can now configure rotation schedules for their secrets. Secret Manager sends messages to PubSub topics configured on the secret based on the provided rotation frequency and rotation time. Committer: @rlingutla PiperOrigin-RevId: 365574085 Source-Author: Google APIs <noreply@google.com> Source-Date: Mon Mar 29 07:58:13 2021 -0700 Source-Repo: googleapis/googleapis Source-Sha: 6c7693680fe320b4705dd8500c255843749eb58a Source-Link: googleapis/googleapis@6c76936
1 parent 72e5dde commit 965dbc7

5 files changed

Lines changed: 56 additions & 3 deletions

File tree

‎packages/google-cloud-secret-manager/google/cloud/secretmanager/__init__.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -27,6 +27,7 @@
2727
)
2828
from google.cloud.secretmanager_v1.types.resources import Replication
2929
from google.cloud.secretmanager_v1.types.resources import ReplicationStatus
30+
from google.cloud.secretmanager_v1.types.resources import Rotation
3031
from google.cloud.secretmanager_v1.types.resources import Secret
3132
from google.cloud.secretmanager_v1.types.resources import SecretPayload
3233
from google.cloud.secretmanager_v1.types.resources import SecretVersion
@@ -66,6 +67,7 @@
6667
"ListSecretsResponse",
6768
"Replication",
6869
"ReplicationStatus",
70+
"Rotation",
6971
"Secret",
7072
"SecretManagerServiceAsyncClient",
7173
"SecretManagerServiceClient",

‎packages/google-cloud-secret-manager/google/cloud/secretmanager_v1/__init__.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
from .types.resources import CustomerManagedEncryptionStatus
2121
from .types.resources import Replication
2222
from .types.resources import ReplicationStatus
23+
from .types.resources import Rotation
2324
from .types.resources import Secret
2425
from .types.resources import SecretPayload
2526
from .types.resources import SecretVersion
@@ -60,6 +61,7 @@
6061
"ListSecretsResponse",
6162
"Replication",
6263
"ReplicationStatus",
64+
"Rotation",
6365
"Secret",
6466
"SecretPayload",
6567
"SecretVersion",

‎packages/google-cloud-secret-manager/google/cloud/secretmanager_v1/types/__init__.py‎

Lines changed: 2 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -20,6 +20,7 @@
2020
CustomerManagedEncryptionStatus,
2121
Replication,
2222
ReplicationStatus,
23+
Rotation,
2324
Secret,
2425
SecretPayload,
2526
SecretVersion,
@@ -48,6 +49,7 @@
4849
"CustomerManagedEncryptionStatus",
4950
"Replication",
5051
"ReplicationStatus",
52+
"Rotation",
5153
"Secret",
5254
"SecretPayload",
5355
"SecretVersion",

‎packages/google-cloud-secret-manager/google/cloud/secretmanager_v1/types/resources.py‎

Lines changed: 47 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -32,6 +32,7 @@
3232
"ReplicationStatus",
3333
"CustomerManagedEncryptionStatus",
3434
"Topic",
35+
"Rotation",
3536
"SecretPayload",
3637
},
3738
)
@@ -88,6 +89,10 @@ class Secret(proto.Message):
8889
ttl (google.protobuf.duration_pb2.Duration):
8990
Input only. The TTL for the
9091
[Secret][google.cloud.secretmanager.v1.Secret].
92+
rotation (google.cloud.secretmanager_v1.types.Rotation):
93+
Optional. Rotation policy attached to the
94+
[Secret][google.cloud.secretmanager.v1.Secret]. May be
95+
excluded if there is no rotation policy.
9196
"""
9297

9398
name = proto.Field(proto.STRING, number=1)
@@ -108,6 +113,8 @@ class Secret(proto.Message):
108113
proto.MESSAGE, number=7, oneof="expiration", message=duration.Duration,
109114
)
110115

116+
rotation = proto.Field(proto.MESSAGE, number=9, message="Rotation",)
117+
111118

112119
class SecretVersion(proto.Message):
113120
r"""A secret version resource in the Secret Manager API.
@@ -407,6 +414,46 @@ class Topic(proto.Message):
407414
name = proto.Field(proto.STRING, number=1)
408415

409416

417+
class Rotation(proto.Message):
418+
r"""The rotation time and period for a
419+
[Secret][google.cloud.secretmanager.v1.Secret]. At
420+
next_rotation_time, Secret Manager will send a Pub/Sub notification
421+
to the topics configured on the Secret.
422+
[Secret.topics][google.cloud.secretmanager.v1.Secret.topics] must be
423+
set to configure rotation.
424+
425+
Attributes:
426+
next_rotation_time (google.protobuf.timestamp_pb2.Timestamp):
427+
Optional. Timestamp in UTC at which the
428+
[Secret][google.cloud.secretmanager.v1.Secret] is scheduled
429+
to rotate.
430+
431+
[next_rotation_time][google.cloud.secretmanager.v1.Rotation.next_rotation_time]
432+
MUST be set if
433+
[rotation_period][google.cloud.secretmanager.v1.Rotation.rotation_period]
434+
is set.
435+
rotation_period (google.protobuf.duration_pb2.Duration):
436+
Input only. The Duration between rotation notifications.
437+
Must be in seconds and at least 3600s (1h) and at most
438+
3153600000s (100 years).
439+
440+
If
441+
[rotation_period][google.cloud.secretmanager.v1.Rotation.rotation_period]
442+
is set,
443+
[next_rotation_time][google.cloud.secretmanager.v1.Rotation.next_rotation_time]
444+
must be set.
445+
[next_rotation_time][google.cloud.secretmanager.v1.Rotation.next_rotation_time]
446+
will be advanced by this period when the service
447+
automatically sends rotation notifications.
448+
"""
449+
450+
next_rotation_time = proto.Field(
451+
proto.MESSAGE, number=1, message=timestamp.Timestamp,
452+
)
453+
454+
rotation_period = proto.Field(proto.MESSAGE, number=2, message=duration.Duration,)
455+
456+
410457
class SecretPayload(proto.Message):
411458
r"""A secret payload resource in the Secret Manager API. This contains
412459
the sensitive secret payload that is associated with a

‎packages/google-cloud-secret-manager/synth.metadata‎

Lines changed: 3 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -4,15 +4,15 @@
44
"git": {
55
"name": ".",
66
"remote": "https://github.com/googleapis/python-secret-manager.git",
7-
"sha": "0006fbaf97f1e02217d127d45c85efd4f47cc14a"
7+
"sha": "c862bbe5ab67903aa6669fd4a75acf5de1be6f98"
88
}
99
},
1010
{
1111
"git": {
1212
"name": "googleapis",
1313
"remote": "https://github.com/googleapis/googleapis.git",
14-
"sha": "2124b6251e56e2ec8dd5c47e7d3815d7d5841880",
15-
"internalRef": "364422694"
14+
"sha": "6c7693680fe320b4705dd8500c255843749eb58a",
15+
"internalRef": "365574085"
1616
}
1717
},
1818
{

0 commit comments

Comments
 (0)