google-cloud-kms-v1 0.6.2 → 0.10.0

data/lib/google/cloud/kms/v1/key_management_service/client.rb

@@ -52,13 +52,12 @@ module Google
             # See {::Google::Cloud::Kms::V1::KeyManagementService::Client::Configuration}
             # for a description of the configuration fields.
             #
-            # ## Example
+            # @example
             #
-            # To modify the configuration for all KeyManagementService clients:
-            #
-            #     ::Google::Cloud::Kms::V1::KeyManagementService::Client.configure do |config|
-            #       config.timeout = 10.0
-            #     end
+            #   # Modify the configuration for all KeyManagementService clients
+            #   ::Google::Cloud::Kms::V1::KeyManagementService::Client.configure do |config|
+            #     config.timeout = 10.0
+            #   end
             #
             # @yield [config] Configure the Client client.
             # @yieldparam config [Client::Configuration]
@@ -150,6 +149,21 @@ module Google
                   initial_delay: 0.1, max_delay: 60.0, multiplier: 1.3, retry_codes: [14, 4]
                 }
 
+                default_config.rpcs.update_crypto_key_primary_version.timeout = 60.0
+                default_config.rpcs.update_crypto_key_primary_version.retry_policy = {
+                  initial_delay: 0.1, max_delay: 60.0, multiplier: 1.3, retry_codes: [14, 4]
+                }
+
+                default_config.rpcs.destroy_crypto_key_version.timeout = 60.0
+                default_config.rpcs.destroy_crypto_key_version.retry_policy = {
+                  initial_delay: 0.1, max_delay: 60.0, multiplier: 1.3, retry_codes: [14, 4]
+                }
+
+                default_config.rpcs.restore_crypto_key_version.timeout = 60.0
+                default_config.rpcs.restore_crypto_key_version.retry_policy = {
+                  initial_delay: 0.1, max_delay: 60.0, multiplier: 1.3, retry_codes: [14, 4]
+                }
+
                 default_config.rpcs.encrypt.timeout = 60.0
                 default_config.rpcs.encrypt.retry_policy = {
                   initial_delay: 0.1, max_delay: 60.0, multiplier: 1.3, retry_codes: [14, 4]
@@ -170,18 +184,18 @@ module Google
                   initial_delay: 0.1, max_delay: 60.0, multiplier: 1.3, retry_codes: [14, 4]
                 }
 
-                default_config.rpcs.update_crypto_key_primary_version.timeout = 60.0
-                default_config.rpcs.update_crypto_key_primary_version.retry_policy = {
+                default_config.rpcs.mac_sign.timeout = 60.0
+                default_config.rpcs.mac_sign.retry_policy = {
                   initial_delay: 0.1, max_delay: 60.0, multiplier: 1.3, retry_codes: [14, 4]
                 }
 
-                default_config.rpcs.destroy_crypto_key_version.timeout = 60.0
-                default_config.rpcs.destroy_crypto_key_version.retry_policy = {
+                default_config.rpcs.mac_verify.timeout = 60.0
+                default_config.rpcs.mac_verify.retry_policy = {
                   initial_delay: 0.1, max_delay: 60.0, multiplier: 1.3, retry_codes: [14, 4]
                 }
 
-                default_config.rpcs.restore_crypto_key_version.timeout = 60.0
-                default_config.rpcs.restore_crypto_key_version.retry_policy = {
+                default_config.rpcs.generate_random_bytes.timeout = 60.0
+                default_config.rpcs.generate_random_bytes.retry_policy = {
                   initial_delay: 0.1, max_delay: 60.0, multiplier: 1.3, retry_codes: [14, 4]
                 }
 
@@ -214,19 +228,15 @@ module Google
             ##
             # Create a new KeyManagementService client object.
             #
-            # ## Examples
-            #
-            # To create a new KeyManagementService client with the default
-            # configuration:
+            # @example
             #
-            #     client = ::Google::Cloud::Kms::V1::KeyManagementService::Client.new
+            #   # Create a client using the default configuration
+            #   client = ::Google::Cloud::Kms::V1::KeyManagementService::Client.new
             #
-            # To create a new KeyManagementService client with a custom
-            # configuration:
-            #
-            #     client = ::Google::Cloud::Kms::V1::KeyManagementService::Client.new do |config|
-            #       config.timeout = 10.0
-            #     end
+            #   # Create a client using a custom configuration
+            #   client = ::Google::Cloud::Kms::V1::KeyManagementService::Client.new do |config|
+            #     config.timeout = 10.0
+            #   end
             #
             # @yield [config] Configure the KeyManagementService client.
             # @yieldparam config [Client::Configuration]
@@ -246,10 +256,9 @@ module Google
 
               # Create credentials
               credentials = @config.credentials
-              # Use self-signed JWT if the scope and endpoint are unchanged from default,
+              # Use self-signed JWT if the endpoint is unchanged from default,
               # but only if the default endpoint does not have a region prefix.
-              enable_self_signed_jwt = @config.scope == Client.configure.scope &&
-                                       @config.endpoint == Client.configure.endpoint &&
+              enable_self_signed_jwt = @config.endpoint == Client.configure.endpoint &&
                                        !@config.endpoint.split(".").first.include?("-")
               credentials ||= Credentials.default scope: @config.scope,
                                                   enable_self_signed_jwt: enable_self_signed_jwt
@@ -344,7 +353,9 @@ module Google
               options.apply_defaults timeout:      @config.rpcs.list_key_rings.timeout,
                                      metadata:     metadata,
                                      retry_policy: @config.rpcs.list_key_rings.retry_policy
-              options.apply_defaults metadata:     @config.metadata,
+
+              options.apply_defaults timeout:      @config.timeout,
+                                     metadata:     @config.metadata,
                                      retry_policy: @config.retry_policy
 
               @key_management_service_stub.call_rpc :list_key_rings, request, options: options do |response, operation|
@@ -432,7 +443,9 @@ module Google
               options.apply_defaults timeout:      @config.rpcs.list_crypto_keys.timeout,
                                      metadata:     metadata,
                                      retry_policy: @config.rpcs.list_crypto_keys.retry_policy
-              options.apply_defaults metadata:     @config.metadata,
+
+              options.apply_defaults timeout:      @config.timeout,
+                                     metadata:     @config.metadata,
                                      retry_policy: @config.retry_policy
 
               @key_management_service_stub.call_rpc :list_crypto_keys, request, options: options do |response, operation|
@@ -521,7 +534,9 @@ module Google
               options.apply_defaults timeout:      @config.rpcs.list_crypto_key_versions.timeout,
                                      metadata:     metadata,
                                      retry_policy: @config.rpcs.list_crypto_key_versions.retry_policy
-              options.apply_defaults metadata:     @config.metadata,
+
+              options.apply_defaults timeout:      @config.timeout,
+                                     metadata:     @config.metadata,
                                      retry_policy: @config.retry_policy
 
               @key_management_service_stub.call_rpc :list_crypto_key_versions, request, options: options do |response, operation|
@@ -607,7 +622,9 @@ module Google
               options.apply_defaults timeout:      @config.rpcs.list_import_jobs.timeout,
                                      metadata:     metadata,
                                      retry_policy: @config.rpcs.list_import_jobs.retry_policy
-              options.apply_defaults metadata:     @config.metadata,
+
+              options.apply_defaults timeout:      @config.timeout,
+                                     metadata:     @config.metadata,
                                      retry_policy: @config.retry_policy
 
               @key_management_service_stub.call_rpc :list_import_jobs, request, options: options do |response, operation|
@@ -674,7 +691,9 @@ module Google
               options.apply_defaults timeout:      @config.rpcs.get_key_ring.timeout,
                                      metadata:     metadata,
                                      retry_policy: @config.rpcs.get_key_ring.retry_policy
-              options.apply_defaults metadata:     @config.metadata,
+
+              options.apply_defaults timeout:      @config.timeout,
+                                     metadata:     @config.metadata,
                                      retry_policy: @config.retry_policy
 
               @key_management_service_stub.call_rpc :get_key_ring, request, options: options do |response, operation|
@@ -741,7 +760,9 @@ module Google
               options.apply_defaults timeout:      @config.rpcs.get_crypto_key.timeout,
                                      metadata:     metadata,
                                      retry_policy: @config.rpcs.get_crypto_key.retry_policy
-              options.apply_defaults metadata:     @config.metadata,
+
+              options.apply_defaults timeout:      @config.timeout,
+                                     metadata:     @config.metadata,
                                      retry_policy: @config.retry_policy
 
               @key_management_service_stub.call_rpc :get_crypto_key, request, options: options do |response, operation|
@@ -807,7 +828,9 @@ module Google
               options.apply_defaults timeout:      @config.rpcs.get_crypto_key_version.timeout,
                                      metadata:     metadata,
                                      retry_policy: @config.rpcs.get_crypto_key_version.retry_policy
-              options.apply_defaults metadata:     @config.metadata,
+
+              options.apply_defaults timeout:      @config.timeout,
+                                     metadata:     @config.metadata,
                                      retry_policy: @config.retry_policy
 
               @key_management_service_stub.call_rpc :get_crypto_key_version, request, options: options do |response, operation|
@@ -877,7 +900,9 @@ module Google
               options.apply_defaults timeout:      @config.rpcs.get_public_key.timeout,
                                      metadata:     metadata,
                                      retry_policy: @config.rpcs.get_public_key.retry_policy
-              options.apply_defaults metadata:     @config.metadata,
+
+              options.apply_defaults timeout:      @config.timeout,
+                                     metadata:     @config.metadata,
                                      retry_policy: @config.retry_policy
 
               @key_management_service_stub.call_rpc :get_public_key, request, options: options do |response, operation|
@@ -943,7 +968,9 @@ module Google
               options.apply_defaults timeout:      @config.rpcs.get_import_job.timeout,
                                      metadata:     metadata,
                                      retry_policy: @config.rpcs.get_import_job.retry_policy
-              options.apply_defaults metadata:     @config.metadata,
+
+              options.apply_defaults timeout:      @config.timeout,
+                                     metadata:     @config.metadata,
                                      retry_policy: @config.retry_policy
 
               @key_management_service_stub.call_rpc :get_import_job, request, options: options do |response, operation|
@@ -1015,7 +1042,9 @@ module Google
               options.apply_defaults timeout:      @config.rpcs.create_key_ring.timeout,
                                      metadata:     metadata,
                                      retry_policy: @config.rpcs.create_key_ring.retry_policy
-              options.apply_defaults metadata:     @config.metadata,
+
+              options.apply_defaults timeout:      @config.timeout,
+                                     metadata:     @config.metadata,
                                      retry_policy: @config.retry_policy
 
               @key_management_service_stub.call_rpc :create_key_ring, request, options: options do |response, operation|
@@ -1097,7 +1126,9 @@ module Google
               options.apply_defaults timeout:      @config.rpcs.create_crypto_key.timeout,
                                      metadata:     metadata,
                                      retry_policy: @config.rpcs.create_crypto_key.retry_policy
-              options.apply_defaults metadata:     @config.metadata,
+
+              options.apply_defaults timeout:      @config.timeout,
+                                     metadata:     @config.metadata,
                                      retry_policy: @config.retry_policy
 
               @key_management_service_stub.call_rpc :create_crypto_key, request, options: options do |response, operation|
@@ -1170,7 +1201,9 @@ module Google
               options.apply_defaults timeout:      @config.rpcs.create_crypto_key_version.timeout,
                                      metadata:     metadata,
                                      retry_policy: @config.rpcs.create_crypto_key_version.retry_policy
-              options.apply_defaults metadata:     @config.metadata,
+
+              options.apply_defaults timeout:      @config.timeout,
+                                     metadata:     @config.metadata,
                                      retry_policy: @config.retry_policy
 
               @key_management_service_stub.call_rpc :create_crypto_key_version, request, options: options do |response, operation|
@@ -1182,11 +1215,12 @@ module Google
             end
 
             ##
-            # Imports a new {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} into an existing {::Google::Cloud::Kms::V1::CryptoKey CryptoKey} using the
-            # wrapped key material provided in the request.
+            # Import wrapped key material into a {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}.
             #
-            # The version ID will be assigned the next sequential id within the
-            # {::Google::Cloud::Kms::V1::CryptoKey CryptoKey}.
+            # All requests must specify a {::Google::Cloud::Kms::V1::CryptoKey CryptoKey}. If a {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} is
+            # additionally specified in the request, key material will be reimported into
+            # that version. Otherwise, a new version will be created, and will be
+            # assigned the next sequential id within the {::Google::Cloud::Kms::V1::CryptoKey CryptoKey}.
             #
             # @overload import_crypto_key_version(request, options = nil)
             #   Pass arguments to `import_crypto_key_version` via a request object, either of type
@@ -1198,14 +1232,32 @@ module Google
             #   @param options [::Gapic::CallOptions, ::Hash]
             #     Overrides the default settings for this call, e.g, timeout, retries, etc. Optional.
             #
-            # @overload import_crypto_key_version(parent: nil, algorithm: nil, import_job: nil, rsa_aes_wrapped_key: nil)
+            # @overload import_crypto_key_version(parent: nil, crypto_key_version: nil, algorithm: nil, import_job: nil, rsa_aes_wrapped_key: nil)
             #   Pass arguments to `import_crypto_key_version` via keyword arguments. Note that at
             #   least one keyword argument is required. To specify no parameters, or to keep all
             #   the default parameter values, pass an empty Hash as a request object (see above).
             #
             #   @param parent [::String]
-            #     Required. The {::Google::Cloud::Kms::V1::CryptoKey#name name} of the {::Google::Cloud::Kms::V1::CryptoKey CryptoKey} to
-            #     be imported into.
+            #     Required. The {::Google::Cloud::Kms::V1::CryptoKey#name name} of the {::Google::Cloud::Kms::V1::CryptoKey CryptoKey} to be imported into.
+            #
+            #     The create permission is only required on this key when creating a new
+            #     {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}.
+            #   @param crypto_key_version [::String]
+            #     Optional. The optional {::Google::Cloud::Kms::V1::CryptoKeyVersion#name name} of an existing
+            #     {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} to target for an import operation.
+            #     If this field is not present, a new {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} containing the
+            #     supplied key material is created.
+            #
+            #     If this field is present, the supplied key material is imported into
+            #     the existing {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}. To import into an existing
+            #     {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion}, the {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} must be a child of
+            #     {::Google::Cloud::Kms::V1::ImportCryptoKeyVersionRequest#parent ImportCryptoKeyVersionRequest.parent}, have been previously created via
+            #     [ImportCryptoKeyVersion][], and be in
+            #     {::Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionState::DESTROYED DESTROYED} or
+            #     {::Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionState::IMPORT_FAILED IMPORT_FAILED}
+            #     state. The key material and algorithm must match the previous
+            #     {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} exactly if the {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} has ever contained
+            #     key material.
             #   @param algorithm [::Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionAlgorithm]
             #     Required. The {::Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionAlgorithm algorithm} of
             #     the key being imported. This does not need to match the
@@ -1273,7 +1325,9 @@ module Google
               options.apply_defaults timeout:      @config.rpcs.import_crypto_key_version.timeout,
                                      metadata:     metadata,
                                      retry_policy: @config.rpcs.import_crypto_key_version.retry_policy
-              options.apply_defaults metadata:     @config.metadata,
+
+              options.apply_defaults timeout:      @config.timeout,
+                                     metadata:     @config.metadata,
                                      retry_policy: @config.retry_policy
 
               @key_management_service_stub.call_rpc :import_crypto_key_version, request, options: options do |response, operation|
@@ -1347,7 +1401,9 @@ module Google
               options.apply_defaults timeout:      @config.rpcs.create_import_job.timeout,
                                      metadata:     metadata,
                                      retry_policy: @config.rpcs.create_import_job.retry_policy
-              options.apply_defaults metadata:     @config.metadata,
+
+              options.apply_defaults timeout:      @config.timeout,
+                                     metadata:     @config.metadata,
                                      retry_policy: @config.retry_policy
 
               @key_management_service_stub.call_rpc :create_import_job, request, options: options do |response, operation|
@@ -1415,7 +1471,9 @@ module Google
               options.apply_defaults timeout:      @config.rpcs.update_crypto_key.timeout,
                                      metadata:     metadata,
                                      retry_policy: @config.rpcs.update_crypto_key.retry_policy
-              options.apply_defaults metadata:     @config.metadata,
+
+              options.apply_defaults timeout:      @config.timeout,
+                                     metadata:     @config.metadata,
                                      retry_policy: @config.retry_policy
 
               @key_management_service_stub.call_rpc :update_crypto_key, request, options: options do |response, operation|
@@ -1489,7 +1547,9 @@ module Google
               options.apply_defaults timeout:      @config.rpcs.update_crypto_key_version.timeout,
                                      metadata:     metadata,
                                      retry_policy: @config.rpcs.update_crypto_key_version.retry_policy
-              options.apply_defaults metadata:     @config.metadata,
+
+              options.apply_defaults timeout:      @config.timeout,
+                                     metadata:     @config.metadata,
                                      retry_policy: @config.retry_policy
 
               @key_management_service_stub.call_rpc :update_crypto_key_version, request, options: options do |response, operation|
@@ -1500,6 +1560,233 @@ module Google
               raise ::Google::Cloud::Error.from_error(e)
             end
 
+            ##
+            # Update the version of a {::Google::Cloud::Kms::V1::CryptoKey CryptoKey} that will be used in {::Google::Cloud::Kms::V1::KeyManagementService::Client#encrypt Encrypt}.
+            #
+            # Returns an error if called on a key whose purpose is not
+            # {::Google::Cloud::Kms::V1::CryptoKey::CryptoKeyPurpose::ENCRYPT_DECRYPT ENCRYPT_DECRYPT}.
+            #
+            # @overload update_crypto_key_primary_version(request, options = nil)
+            #   Pass arguments to `update_crypto_key_primary_version` via a request object, either of type
+            #   {::Google::Cloud::Kms::V1::UpdateCryptoKeyPrimaryVersionRequest} or an equivalent Hash.
+            #
+            #   @param request [::Google::Cloud::Kms::V1::UpdateCryptoKeyPrimaryVersionRequest, ::Hash]
+            #     A request object representing the call parameters. Required. To specify no
+            #     parameters, or to keep all the default parameter values, pass an empty Hash.
+            #   @param options [::Gapic::CallOptions, ::Hash]
+            #     Overrides the default settings for this call, e.g, timeout, retries, etc. Optional.
+            #
+            # @overload update_crypto_key_primary_version(name: nil, crypto_key_version_id: nil)
+            #   Pass arguments to `update_crypto_key_primary_version` via keyword arguments. Note that at
+            #   least one keyword argument is required. To specify no parameters, or to keep all
+            #   the default parameter values, pass an empty Hash as a request object (see above).
+            #
+            #   @param name [::String]
+            #     Required. The resource name of the {::Google::Cloud::Kms::V1::CryptoKey CryptoKey} to update.
+            #   @param crypto_key_version_id [::String]
+            #     Required. The id of the child {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} to use as primary.
+            #
+            # @yield [response, operation] Access the result along with the RPC operation
+            # @yieldparam response [::Google::Cloud::Kms::V1::CryptoKey]
+            # @yieldparam operation [::GRPC::ActiveCall::Operation]
+            #
+            # @return [::Google::Cloud::Kms::V1::CryptoKey]
+            #
+            # @raise [::Google::Cloud::Error] if the RPC is aborted.
+            #
+            def update_crypto_key_primary_version request, options = nil
+              raise ::ArgumentError, "request must be provided" if request.nil?
+
+              request = ::Gapic::Protobuf.coerce request, to: ::Google::Cloud::Kms::V1::UpdateCryptoKeyPrimaryVersionRequest
+
+              # Converts hash and nil to an options object
+              options = ::Gapic::CallOptions.new(**options.to_h) if options.respond_to? :to_h
+
+              # Customize the options with defaults
+              metadata = @config.rpcs.update_crypto_key_primary_version.metadata.to_h
+
+              # Set x-goog-api-client and x-goog-user-project headers
+              metadata[:"x-goog-api-client"] ||= ::Gapic::Headers.x_goog_api_client \
+                lib_name: @config.lib_name, lib_version: @config.lib_version,
+                gapic_version: ::Google::Cloud::Kms::V1::VERSION
+              metadata[:"x-goog-user-project"] = @quota_project_id if @quota_project_id
+
+              header_params = {
+                "name" => request.name
+              }
+              request_params_header = header_params.map { |k, v| "#{k}=#{v}" }.join("&")
+              metadata[:"x-goog-request-params"] ||= request_params_header
+
+              options.apply_defaults timeout:      @config.rpcs.update_crypto_key_primary_version.timeout,
+                                     metadata:     metadata,
+                                     retry_policy: @config.rpcs.update_crypto_key_primary_version.retry_policy
+
+              options.apply_defaults timeout:      @config.timeout,
+                                     metadata:     @config.metadata,
+                                     retry_policy: @config.retry_policy
+
+              @key_management_service_stub.call_rpc :update_crypto_key_primary_version, request, options: options do |response, operation|
+                yield response, operation if block_given?
+                return response
+              end
+            rescue ::GRPC::BadStatus => e
+              raise ::Google::Cloud::Error.from_error(e)
+            end
+
+            ##
+            # Schedule a {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} for destruction.
+            #
+            # Upon calling this method, {::Google::Cloud::Kms::V1::CryptoKeyVersion#state CryptoKeyVersion.state} will be set to
+            # {::Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionState::DESTROY_SCHEDULED DESTROY_SCHEDULED},
+            # and {::Google::Cloud::Kms::V1::CryptoKeyVersion#destroy_time destroy_time} will be set to the time
+            # {::Google::Cloud::Kms::V1::CryptoKey#destroy_scheduled_duration destroy_scheduled_duration} in the
+            # future. At that time, the {::Google::Cloud::Kms::V1::CryptoKeyVersion#state state} will
+            # automatically change to
+            # {::Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionState::DESTROYED DESTROYED}, and the key
+            # material will be irrevocably destroyed.
+            #
+            # Before the {::Google::Cloud::Kms::V1::CryptoKeyVersion#destroy_time destroy_time} is reached,
+            # {::Google::Cloud::Kms::V1::KeyManagementService::Client#restore_crypto_key_version RestoreCryptoKeyVersion} may be called to reverse the process.
+            #
+            # @overload destroy_crypto_key_version(request, options = nil)
+            #   Pass arguments to `destroy_crypto_key_version` via a request object, either of type
+            #   {::Google::Cloud::Kms::V1::DestroyCryptoKeyVersionRequest} or an equivalent Hash.
+            #
+            #   @param request [::Google::Cloud::Kms::V1::DestroyCryptoKeyVersionRequest, ::Hash]
+            #     A request object representing the call parameters. Required. To specify no
+            #     parameters, or to keep all the default parameter values, pass an empty Hash.
+            #   @param options [::Gapic::CallOptions, ::Hash]
+            #     Overrides the default settings for this call, e.g, timeout, retries, etc. Optional.
+            #
+            # @overload destroy_crypto_key_version(name: nil)
+            #   Pass arguments to `destroy_crypto_key_version` via keyword arguments. Note that at
+            #   least one keyword argument is required. To specify no parameters, or to keep all
+            #   the default parameter values, pass an empty Hash as a request object (see above).
+            #
+            #   @param name [::String]
+            #     Required. The resource name of the {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} to destroy.
+            #
+            # @yield [response, operation] Access the result along with the RPC operation
+            # @yieldparam response [::Google::Cloud::Kms::V1::CryptoKeyVersion]
+            # @yieldparam operation [::GRPC::ActiveCall::Operation]
+            #
+            # @return [::Google::Cloud::Kms::V1::CryptoKeyVersion]
+            #
+            # @raise [::Google::Cloud::Error] if the RPC is aborted.
+            #
+            def destroy_crypto_key_version request, options = nil
+              raise ::ArgumentError, "request must be provided" if request.nil?
+
+              request = ::Gapic::Protobuf.coerce request, to: ::Google::Cloud::Kms::V1::DestroyCryptoKeyVersionRequest
+
+              # Converts hash and nil to an options object
+              options = ::Gapic::CallOptions.new(**options.to_h) if options.respond_to? :to_h
+
+              # Customize the options with defaults
+              metadata = @config.rpcs.destroy_crypto_key_version.metadata.to_h
+
+              # Set x-goog-api-client and x-goog-user-project headers
+              metadata[:"x-goog-api-client"] ||= ::Gapic::Headers.x_goog_api_client \
+                lib_name: @config.lib_name, lib_version: @config.lib_version,
+                gapic_version: ::Google::Cloud::Kms::V1::VERSION
+              metadata[:"x-goog-user-project"] = @quota_project_id if @quota_project_id
+
+              header_params = {
+                "name" => request.name
+              }
+              request_params_header = header_params.map { |k, v| "#{k}=#{v}" }.join("&")
+              metadata[:"x-goog-request-params"] ||= request_params_header
+
+              options.apply_defaults timeout:      @config.rpcs.destroy_crypto_key_version.timeout,
+                                     metadata:     metadata,
+                                     retry_policy: @config.rpcs.destroy_crypto_key_version.retry_policy
+
+              options.apply_defaults timeout:      @config.timeout,
+                                     metadata:     @config.metadata,
+                                     retry_policy: @config.retry_policy
+
+              @key_management_service_stub.call_rpc :destroy_crypto_key_version, request, options: options do |response, operation|
+                yield response, operation if block_given?
+                return response
+              end
+            rescue ::GRPC::BadStatus => e
+              raise ::Google::Cloud::Error.from_error(e)
+            end
+
+            ##
+            # Restore a {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} in the
+            # {::Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionState::DESTROY_SCHEDULED DESTROY_SCHEDULED}
+            # state.
+            #
+            # Upon restoration of the CryptoKeyVersion, {::Google::Cloud::Kms::V1::CryptoKeyVersion#state state}
+            # will be set to {::Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionState::DISABLED DISABLED},
+            # and {::Google::Cloud::Kms::V1::CryptoKeyVersion#destroy_time destroy_time} will be cleared.
+            #
+            # @overload restore_crypto_key_version(request, options = nil)
+            #   Pass arguments to `restore_crypto_key_version` via a request object, either of type
+            #   {::Google::Cloud::Kms::V1::RestoreCryptoKeyVersionRequest} or an equivalent Hash.
+            #
+            #   @param request [::Google::Cloud::Kms::V1::RestoreCryptoKeyVersionRequest, ::Hash]
+            #     A request object representing the call parameters. Required. To specify no
+            #     parameters, or to keep all the default parameter values, pass an empty Hash.
+            #   @param options [::Gapic::CallOptions, ::Hash]
+            #     Overrides the default settings for this call, e.g, timeout, retries, etc. Optional.
+            #
+            # @overload restore_crypto_key_version(name: nil)
+            #   Pass arguments to `restore_crypto_key_version` via keyword arguments. Note that at
+            #   least one keyword argument is required. To specify no parameters, or to keep all
+            #   the default parameter values, pass an empty Hash as a request object (see above).
+            #
+            #   @param name [::String]
+            #     Required. The resource name of the {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} to restore.
+            #
+            # @yield [response, operation] Access the result along with the RPC operation
+            # @yieldparam response [::Google::Cloud::Kms::V1::CryptoKeyVersion]
+            # @yieldparam operation [::GRPC::ActiveCall::Operation]
+            #
+            # @return [::Google::Cloud::Kms::V1::CryptoKeyVersion]
+            #
+            # @raise [::Google::Cloud::Error] if the RPC is aborted.
+            #
+            def restore_crypto_key_version request, options = nil
+              raise ::ArgumentError, "request must be provided" if request.nil?
+
+              request = ::Gapic::Protobuf.coerce request, to: ::Google::Cloud::Kms::V1::RestoreCryptoKeyVersionRequest
+
+              # Converts hash and nil to an options object
+              options = ::Gapic::CallOptions.new(**options.to_h) if options.respond_to? :to_h
+
+              # Customize the options with defaults
+              metadata = @config.rpcs.restore_crypto_key_version.metadata.to_h
+
+              # Set x-goog-api-client and x-goog-user-project headers
+              metadata[:"x-goog-api-client"] ||= ::Gapic::Headers.x_goog_api_client \
+                lib_name: @config.lib_name, lib_version: @config.lib_version,
+                gapic_version: ::Google::Cloud::Kms::V1::VERSION
+              metadata[:"x-goog-user-project"] = @quota_project_id if @quota_project_id
+
+              header_params = {
+                "name" => request.name
+              }
+              request_params_header = header_params.map { |k, v| "#{k}=#{v}" }.join("&")
+              metadata[:"x-goog-request-params"] ||= request_params_header
+
+              options.apply_defaults timeout:      @config.rpcs.restore_crypto_key_version.timeout,
+                                     metadata:     metadata,
+                                     retry_policy: @config.rpcs.restore_crypto_key_version.retry_policy
+
+              options.apply_defaults timeout:      @config.timeout,
+                                     metadata:     @config.metadata,
+                                     retry_policy: @config.retry_policy
+
+              @key_management_service_stub.call_rpc :restore_crypto_key_version, request, options: options do |response, operation|
+                yield response, operation if block_given?
+                return response
+              end
+            rescue ::GRPC::BadStatus => e
+              raise ::Google::Cloud::Error.from_error(e)
+            end
+
             ##
             # Encrypts data, so that it can only be recovered by a call to {::Google::Cloud::Kms::V1::KeyManagementService::Client#decrypt Decrypt}.
             # The {::Google::Cloud::Kms::V1::CryptoKey#purpose CryptoKey.purpose} must be
@@ -1559,8 +1846,6 @@ module Google
             #     different languages. However, it is a non-negative integer, which will
             #     never exceed 2^32-1, and can be safely downconverted to uint32 in languages
             #     that support this type.
-            #
-            #     NOTE: This field is in Beta.
             #   @param additional_authenticated_data_crc32c [::Google::Protobuf::Int64Value, ::Hash]
             #     Optional. An optional CRC32C checksum of the
             #     {::Google::Cloud::Kms::V1::EncryptRequest#additional_authenticated_data EncryptRequest.additional_authenticated_data}. If specified,
@@ -1577,8 +1862,6 @@ module Google
             #     never exceed 2^32-1, and can be safely downconverted to uint32 in languages
             #     that support this type.
             #
-            #     NOTE: This field is in Beta.
-            #
             # @yield [response, operation] Access the result along with the RPC operation
             # @yieldparam response [::Google::Cloud::Kms::V1::EncryptResponse]
             # @yieldparam operation [::GRPC::ActiveCall::Operation]
@@ -1613,7 +1896,9 @@ module Google
               options.apply_defaults timeout:      @config.rpcs.encrypt.timeout,
                                      metadata:     metadata,
                                      retry_policy: @config.rpcs.encrypt.retry_policy
-              options.apply_defaults metadata:     @config.metadata,
+
+              options.apply_defaults timeout:      @config.timeout,
+                                     metadata:     @config.metadata,
                                      retry_policy: @config.retry_policy
 
               @key_management_service_stub.call_rpc :encrypt, request, options: options do |response, operation|
@@ -1666,8 +1951,6 @@ module Google
             #     different languages. However, it is a non-negative integer, which will
             #     never exceed 2^32-1, and can be safely downconverted to uint32 in languages
             #     that support this type.
-            #
-            #     NOTE: This field is in Beta.
             #   @param additional_authenticated_data_crc32c [::Google::Protobuf::Int64Value, ::Hash]
             #     Optional. An optional CRC32C checksum of the
             #     {::Google::Cloud::Kms::V1::DecryptRequest#additional_authenticated_data DecryptRequest.additional_authenticated_data}. If specified,
@@ -1684,8 +1967,6 @@ module Google
             #     never exceed 2^32-1, and can be safely downconverted to uint32 in languages
             #     that support this type.
             #
-            #     NOTE: This field is in Beta.
-            #
             # @yield [response, operation] Access the result along with the RPC operation
             # @yieldparam response [::Google::Cloud::Kms::V1::DecryptResponse]
             # @yieldparam operation [::GRPC::ActiveCall::Operation]
@@ -1720,7 +2001,9 @@ module Google
               options.apply_defaults timeout:      @config.rpcs.decrypt.timeout,
                                      metadata:     metadata,
                                      retry_policy: @config.rpcs.decrypt.retry_policy
-              options.apply_defaults metadata:     @config.metadata,
+
+              options.apply_defaults timeout:      @config.timeout,
+                                     metadata:     @config.metadata,
                                      retry_policy: @config.retry_policy
 
               @key_management_service_stub.call_rpc :decrypt, request, options: options do |response, operation|
@@ -1746,7 +2029,7 @@ module Google
             #   @param options [::Gapic::CallOptions, ::Hash]
             #     Overrides the default settings for this call, e.g, timeout, retries, etc. Optional.
             #
-            # @overload asymmetric_sign(name: nil, digest: nil, digest_crc32c: nil)
+            # @overload asymmetric_sign(name: nil, digest: nil, digest_crc32c: nil, data: nil, data_crc32c: nil)
             #   Pass arguments to `asymmetric_sign` via keyword arguments. Note that at
             #   least one keyword argument is required. To specify no parameters, or to keep all
             #   the default parameter values, pass an empty Hash as a request object (see above).
@@ -1754,7 +2037,7 @@ module Google
             #   @param name [::String]
             #     Required. The resource name of the {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} to use for signing.
             #   @param digest [::Google::Cloud::Kms::V1::Digest, ::Hash]
-            #     Required. The digest of the data to sign. The digest must be produced with
+            #     Optional. The digest of the data to sign. The digest must be produced with
             #     the same digest algorithm as specified by the key version's
             #     {::Google::Cloud::Kms::V1::CryptoKeyVersion#algorithm algorithm}.
             #   @param digest_crc32c [::Google::Protobuf::Int64Value, ::Hash]
@@ -1771,8 +2054,24 @@ module Google
             #     different languages. However, it is a non-negative integer, which will
             #     never exceed 2^32-1, and can be safely downconverted to uint32 in languages
             #     that support this type.
-            #
-            #     NOTE: This field is in Beta.
+            #   @param data [::String]
+            #     Optional. This field will only be honored for RAW_PKCS1 keys.
+            #     The data to sign. A digest is computed over the data that will be signed,
+            #     PKCS #1 padding is applied to the digest directly and then encrypted.
+            #   @param data_crc32c [::Google::Protobuf::Int64Value, ::Hash]
+            #     Optional. An optional CRC32C checksum of the {::Google::Cloud::Kms::V1::AsymmetricSignRequest#data AsymmetricSignRequest.data}. If
+            #     specified, {::Google::Cloud::Kms::V1::KeyManagementService::Client KeyManagementService} will verify the integrity of the
+            #     received {::Google::Cloud::Kms::V1::AsymmetricSignRequest#data AsymmetricSignRequest.data} using this checksum.
+            #     {::Google::Cloud::Kms::V1::KeyManagementService::Client KeyManagementService} will report an error if the checksum verification
+            #     fails. If you receive a checksum error, your client should verify that
+            #     CRC32C({::Google::Cloud::Kms::V1::AsymmetricSignRequest#data AsymmetricSignRequest.data}) is equal to
+            #     {::Google::Cloud::Kms::V1::AsymmetricSignRequest#data_crc32c AsymmetricSignRequest.data_crc32c}, and if so, perform a limited
+            #     number of retries. A persistent mismatch may indicate an issue in your
+            #     computation of the CRC32C checksum.
+            #     Note: This field is defined as int64 for reasons of compatibility across
+            #     different languages. However, it is a non-negative integer, which will
+            #     never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+            #     that support this type.
             #
             # @yield [response, operation] Access the result along with the RPC operation
             # @yieldparam response [::Google::Cloud::Kms::V1::AsymmetricSignResponse]
@@ -1808,7 +2107,9 @@ module Google
               options.apply_defaults timeout:      @config.rpcs.asymmetric_sign.timeout,
                                      metadata:     metadata,
                                      retry_policy: @config.rpcs.asymmetric_sign.retry_policy
-              options.apply_defaults metadata:     @config.metadata,
+
+              options.apply_defaults timeout:      @config.timeout,
+                                     metadata:     @config.metadata,
                                      retry_policy: @config.retry_policy
 
               @key_management_service_stub.call_rpc :asymmetric_sign, request, options: options do |response, operation|
@@ -1860,8 +2161,6 @@ module Google
             #     never exceed 2^32-1, and can be safely downconverted to uint32 in languages
             #     that support this type.
             #
-            #     NOTE: This field is in Beta.
-            #
             # @yield [response, operation] Access the result along with the RPC operation
             # @yieldparam response [::Google::Cloud::Kms::V1::AsymmetricDecryptResponse]
             # @yieldparam operation [::GRPC::ActiveCall::Operation]
@@ -1896,7 +2195,9 @@ module Google
               options.apply_defaults timeout:      @config.rpcs.asymmetric_decrypt.timeout,
                                      metadata:     metadata,
                                      retry_policy: @config.rpcs.asymmetric_decrypt.retry_policy
-              options.apply_defaults metadata:     @config.metadata,
+
+              options.apply_defaults timeout:      @config.timeout,
+                                     metadata:     @config.metadata,
                                      retry_policy: @config.retry_policy
 
               @key_management_service_stub.call_rpc :asymmetric_decrypt, request, options: options do |response, operation|
@@ -1908,49 +2209,63 @@ module Google
             end
 
             ##
-            # Update the version of a {::Google::Cloud::Kms::V1::CryptoKey CryptoKey} that will be used in {::Google::Cloud::Kms::V1::KeyManagementService::Client#encrypt Encrypt}.
-            #
-            # Returns an error if called on a key whose purpose is not
-            # {::Google::Cloud::Kms::V1::CryptoKey::CryptoKeyPurpose::ENCRYPT_DECRYPT ENCRYPT_DECRYPT}.
+            # Signs data using a {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} with {::Google::Cloud::Kms::V1::CryptoKey#purpose CryptoKey.purpose}
+            # MAC, producing a tag that can be verified by another source with the
+            # same key.
             #
-            # @overload update_crypto_key_primary_version(request, options = nil)
-            #   Pass arguments to `update_crypto_key_primary_version` via a request object, either of type
-            #   {::Google::Cloud::Kms::V1::UpdateCryptoKeyPrimaryVersionRequest} or an equivalent Hash.
+            # @overload mac_sign(request, options = nil)
+            #   Pass arguments to `mac_sign` via a request object, either of type
+            #   {::Google::Cloud::Kms::V1::MacSignRequest} or an equivalent Hash.
             #
-            #   @param request [::Google::Cloud::Kms::V1::UpdateCryptoKeyPrimaryVersionRequest, ::Hash]
+            #   @param request [::Google::Cloud::Kms::V1::MacSignRequest, ::Hash]
             #     A request object representing the call parameters. Required. To specify no
             #     parameters, or to keep all the default parameter values, pass an empty Hash.
             #   @param options [::Gapic::CallOptions, ::Hash]
             #     Overrides the default settings for this call, e.g, timeout, retries, etc. Optional.
             #
-            # @overload update_crypto_key_primary_version(name: nil, crypto_key_version_id: nil)
-            #   Pass arguments to `update_crypto_key_primary_version` via keyword arguments. Note that at
+            # @overload mac_sign(name: nil, data: nil, data_crc32c: nil)
+            #   Pass arguments to `mac_sign` via keyword arguments. Note that at
             #   least one keyword argument is required. To specify no parameters, or to keep all
             #   the default parameter values, pass an empty Hash as a request object (see above).
             #
             #   @param name [::String]
-            #     Required. The resource name of the {::Google::Cloud::Kms::V1::CryptoKey CryptoKey} to update.
-            #   @param crypto_key_version_id [::String]
-            #     Required. The id of the child {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} to use as primary.
+            #     Required. The resource name of the {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} to use for signing.
+            #   @param data [::String]
+            #     Required. The data to sign. The MAC tag is computed over this data field based on
+            #     the specific algorithm.
+            #   @param data_crc32c [::Google::Protobuf::Int64Value, ::Hash]
+            #     Optional. An optional CRC32C checksum of the {::Google::Cloud::Kms::V1::MacSignRequest#data MacSignRequest.data}. If
+            #     specified, {::Google::Cloud::Kms::V1::KeyManagementService::Client KeyManagementService} will verify the integrity of the
+            #     received {::Google::Cloud::Kms::V1::MacSignRequest#data MacSignRequest.data} using this checksum.
+            #     {::Google::Cloud::Kms::V1::KeyManagementService::Client KeyManagementService} will report an error if the checksum verification
+            #     fails. If you receive a checksum error, your client should verify that
+            #     CRC32C({::Google::Cloud::Kms::V1::MacSignRequest#data MacSignRequest.data}) is equal to
+            #     {::Google::Cloud::Kms::V1::MacSignRequest#data_crc32c MacSignRequest.data_crc32c}, and if so, perform a limited
+            #     number of retries. A persistent mismatch may indicate an issue in your
+            #     computation of the CRC32C checksum.
+            #     Note: This field is defined as int64 for reasons of compatibility across
+            #     different languages. However, it is a non-negative integer, which will
+            #     never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+            #     that support this type.
             #
             # @yield [response, operation] Access the result along with the RPC operation
-            # @yieldparam response [::Google::Cloud::Kms::V1::CryptoKey]
+            # @yieldparam response [::Google::Cloud::Kms::V1::MacSignResponse]
             # @yieldparam operation [::GRPC::ActiveCall::Operation]
             #
-            # @return [::Google::Cloud::Kms::V1::CryptoKey]
+            # @return [::Google::Cloud::Kms::V1::MacSignResponse]
             #
             # @raise [::Google::Cloud::Error] if the RPC is aborted.
             #
-            def update_crypto_key_primary_version request, options = nil
+            def mac_sign request, options = nil
               raise ::ArgumentError, "request must be provided" if request.nil?
 
-              request = ::Gapic::Protobuf.coerce request, to: ::Google::Cloud::Kms::V1::UpdateCryptoKeyPrimaryVersionRequest
+              request = ::Gapic::Protobuf.coerce request, to: ::Google::Cloud::Kms::V1::MacSignRequest
 
               # Converts hash and nil to an options object
               options = ::Gapic::CallOptions.new(**options.to_h) if options.respond_to? :to_h
 
               # Customize the options with defaults
-              metadata = @config.rpcs.update_crypto_key_primary_version.metadata.to_h
+              metadata = @config.rpcs.mac_sign.metadata.to_h
 
               # Set x-goog-api-client and x-goog-user-project headers
               metadata[:"x-goog-api-client"] ||= ::Gapic::Headers.x_goog_api_client \
@@ -1964,13 +2279,15 @@ module Google
               request_params_header = header_params.map { |k, v| "#{k}=#{v}" }.join("&")
               metadata[:"x-goog-request-params"] ||= request_params_header
 
-              options.apply_defaults timeout:      @config.rpcs.update_crypto_key_primary_version.timeout,
+              options.apply_defaults timeout:      @config.rpcs.mac_sign.timeout,
                                      metadata:     metadata,
-                                     retry_policy: @config.rpcs.update_crypto_key_primary_version.retry_policy
-              options.apply_defaults metadata:     @config.metadata,
+                                     retry_policy: @config.rpcs.mac_sign.retry_policy
+
+              options.apply_defaults timeout:      @config.timeout,
+                                     metadata:     @config.metadata,
                                      retry_policy: @config.retry_policy
 
-              @key_management_service_stub.call_rpc :update_crypto_key_primary_version, request, options: options do |response, operation|
+              @key_management_service_stub.call_rpc :mac_sign, request, options: options do |response, operation|
                 yield response, operation if block_given?
                 return response
               end
@@ -1979,55 +2296,79 @@ module Google
             end
 
             ##
-            # Schedule a {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} for destruction.
+            # Verifies MAC tag using a {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} with {::Google::Cloud::Kms::V1::CryptoKey#purpose CryptoKey.purpose}
+            # MAC, and returns a response that indicates whether or not the verification
+            # was successful.
             #
-            # Upon calling this method, {::Google::Cloud::Kms::V1::CryptoKeyVersion#state CryptoKeyVersion.state} will be set to
-            # {::Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionState::DESTROY_SCHEDULED DESTROY_SCHEDULED}
-            # and {::Google::Cloud::Kms::V1::CryptoKeyVersion#destroy_time destroy_time} will be set to a time 24
-            # hours in the future, at which point the {::Google::Cloud::Kms::V1::CryptoKeyVersion#state state}
-            # will be changed to
-            # {::Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionState::DESTROYED DESTROYED}, and the key
-            # material will be irrevocably destroyed.
-            #
-            # Before the {::Google::Cloud::Kms::V1::CryptoKeyVersion#destroy_time destroy_time} is reached,
-            # {::Google::Cloud::Kms::V1::KeyManagementService::Client#restore_crypto_key_version RestoreCryptoKeyVersion} may be called to reverse the process.
+            # @overload mac_verify(request, options = nil)
+            #   Pass arguments to `mac_verify` via a request object, either of type
+            #   {::Google::Cloud::Kms::V1::MacVerifyRequest} or an equivalent Hash.
             #
-            # @overload destroy_crypto_key_version(request, options = nil)
-            #   Pass arguments to `destroy_crypto_key_version` via a request object, either of type
-            #   {::Google::Cloud::Kms::V1::DestroyCryptoKeyVersionRequest} or an equivalent Hash.
-            #
-            #   @param request [::Google::Cloud::Kms::V1::DestroyCryptoKeyVersionRequest, ::Hash]
+            #   @param request [::Google::Cloud::Kms::V1::MacVerifyRequest, ::Hash]
             #     A request object representing the call parameters. Required. To specify no
             #     parameters, or to keep all the default parameter values, pass an empty Hash.
             #   @param options [::Gapic::CallOptions, ::Hash]
             #     Overrides the default settings for this call, e.g, timeout, retries, etc. Optional.
             #
-            # @overload destroy_crypto_key_version(name: nil)
-            #   Pass arguments to `destroy_crypto_key_version` via keyword arguments. Note that at
+            # @overload mac_verify(name: nil, data: nil, data_crc32c: nil, mac: nil, mac_crc32c: nil)
+            #   Pass arguments to `mac_verify` via keyword arguments. Note that at
             #   least one keyword argument is required. To specify no parameters, or to keep all
             #   the default parameter values, pass an empty Hash as a request object (see above).
             #
             #   @param name [::String]
-            #     Required. The resource name of the {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} to destroy.
+            #     Required. The resource name of the {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} to use for verification.
+            #   @param data [::String]
+            #     Required. The data used previously as a {::Google::Cloud::Kms::V1::MacSignRequest#data MacSignRequest.data} to generate the MAC
+            #     tag.
+            #   @param data_crc32c [::Google::Protobuf::Int64Value, ::Hash]
+            #     Optional. An optional CRC32C checksum of the {::Google::Cloud::Kms::V1::MacVerifyRequest#data MacVerifyRequest.data}. If
+            #     specified, {::Google::Cloud::Kms::V1::KeyManagementService::Client KeyManagementService} will verify the integrity of the
+            #     received {::Google::Cloud::Kms::V1::MacVerifyRequest#data MacVerifyRequest.data} using this checksum.
+            #     {::Google::Cloud::Kms::V1::KeyManagementService::Client KeyManagementService} will report an error if the checksum verification
+            #     fails. If you receive a checksum error, your client should verify that
+            #     CRC32C({::Google::Cloud::Kms::V1::MacVerifyRequest#data MacVerifyRequest.data}) is equal to
+            #     {::Google::Cloud::Kms::V1::MacVerifyRequest#data_crc32c MacVerifyRequest.data_crc32c}, and if so, perform a limited
+            #     number of retries. A persistent mismatch may indicate an issue in your
+            #     computation of the CRC32C checksum.
+            #     Note: This field is defined as int64 for reasons of compatibility across
+            #     different languages. However, it is a non-negative integer, which will
+            #     never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+            #     that support this type.
+            #   @param mac [::String]
+            #     Required. The signature to verify.
+            #   @param mac_crc32c [::Google::Protobuf::Int64Value, ::Hash]
+            #     Optional. An optional CRC32C checksum of the {::Google::Cloud::Kms::V1::MacVerifyRequest#mac MacVerifyRequest.mac}. If
+            #     specified, {::Google::Cloud::Kms::V1::KeyManagementService::Client KeyManagementService} will verify the integrity of the
+            #     received {::Google::Cloud::Kms::V1::MacVerifyRequest#mac MacVerifyRequest.mac} using this checksum.
+            #     {::Google::Cloud::Kms::V1::KeyManagementService::Client KeyManagementService} will report an error if the checksum verification
+            #     fails. If you receive a checksum error, your client should verify that
+            #     CRC32C([MacVerifyRequest.tag][]) is equal to
+            #     {::Google::Cloud::Kms::V1::MacVerifyRequest#mac_crc32c MacVerifyRequest.mac_crc32c}, and if so, perform a limited
+            #     number of retries. A persistent mismatch may indicate an issue in your
+            #     computation of the CRC32C checksum.
+            #     Note: This field is defined as int64 for reasons of compatibility across
+            #     different languages. However, it is a non-negative integer, which will
+            #     never exceed 2^32-1, and can be safely downconverted to uint32 in languages
+            #     that support this type.
             #
             # @yield [response, operation] Access the result along with the RPC operation
-            # @yieldparam response [::Google::Cloud::Kms::V1::CryptoKeyVersion]
+            # @yieldparam response [::Google::Cloud::Kms::V1::MacVerifyResponse]
             # @yieldparam operation [::GRPC::ActiveCall::Operation]
             #
-            # @return [::Google::Cloud::Kms::V1::CryptoKeyVersion]
+            # @return [::Google::Cloud::Kms::V1::MacVerifyResponse]
             #
             # @raise [::Google::Cloud::Error] if the RPC is aborted.
             #
-            def destroy_crypto_key_version request, options = nil
+            def mac_verify request, options = nil
               raise ::ArgumentError, "request must be provided" if request.nil?
 
-              request = ::Gapic::Protobuf.coerce request, to: ::Google::Cloud::Kms::V1::DestroyCryptoKeyVersionRequest
+              request = ::Gapic::Protobuf.coerce request, to: ::Google::Cloud::Kms::V1::MacVerifyRequest
 
               # Converts hash and nil to an options object
               options = ::Gapic::CallOptions.new(**options.to_h) if options.respond_to? :to_h
 
               # Customize the options with defaults
-              metadata = @config.rpcs.destroy_crypto_key_version.metadata.to_h
+              metadata = @config.rpcs.mac_verify.metadata.to_h
 
               # Set x-goog-api-client and x-goog-user-project headers
               metadata[:"x-goog-api-client"] ||= ::Gapic::Headers.x_goog_api_client \
@@ -2041,13 +2382,15 @@ module Google
               request_params_header = header_params.map { |k, v| "#{k}=#{v}" }.join("&")
               metadata[:"x-goog-request-params"] ||= request_params_header
 
-              options.apply_defaults timeout:      @config.rpcs.destroy_crypto_key_version.timeout,
+              options.apply_defaults timeout:      @config.rpcs.mac_verify.timeout,
                                      metadata:     metadata,
-                                     retry_policy: @config.rpcs.destroy_crypto_key_version.retry_policy
-              options.apply_defaults metadata:     @config.metadata,
+                                     retry_policy: @config.rpcs.mac_verify.retry_policy
+
+              options.apply_defaults timeout:      @config.timeout,
+                                     metadata:     @config.metadata,
                                      retry_policy: @config.retry_policy
 
-              @key_management_service_stub.call_rpc :destroy_crypto_key_version, request, options: options do |response, operation|
+              @key_management_service_stub.call_rpc :mac_verify, request, options: options do |response, operation|
                 yield response, operation if block_given?
                 return response
               end
@@ -2056,50 +2399,52 @@ module Google
             end
 
             ##
-            # Restore a {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} in the
-            # {::Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionState::DESTROY_SCHEDULED DESTROY_SCHEDULED}
-            # state.
+            # Generate random bytes using the Cloud KMS randomness source in the provided
+            # location.
             #
-            # Upon restoration of the CryptoKeyVersion, {::Google::Cloud::Kms::V1::CryptoKeyVersion#state state}
-            # will be set to {::Google::Cloud::Kms::V1::CryptoKeyVersion::CryptoKeyVersionState::DISABLED DISABLED},
-            # and {::Google::Cloud::Kms::V1::CryptoKeyVersion#destroy_time destroy_time} will be cleared.
-            #
-            # @overload restore_crypto_key_version(request, options = nil)
-            #   Pass arguments to `restore_crypto_key_version` via a request object, either of type
-            #   {::Google::Cloud::Kms::V1::RestoreCryptoKeyVersionRequest} or an equivalent Hash.
+            # @overload generate_random_bytes(request, options = nil)
+            #   Pass arguments to `generate_random_bytes` via a request object, either of type
+            #   {::Google::Cloud::Kms::V1::GenerateRandomBytesRequest} or an equivalent Hash.
             #
-            #   @param request [::Google::Cloud::Kms::V1::RestoreCryptoKeyVersionRequest, ::Hash]
+            #   @param request [::Google::Cloud::Kms::V1::GenerateRandomBytesRequest, ::Hash]
             #     A request object representing the call parameters. Required. To specify no
             #     parameters, or to keep all the default parameter values, pass an empty Hash.
             #   @param options [::Gapic::CallOptions, ::Hash]
             #     Overrides the default settings for this call, e.g, timeout, retries, etc. Optional.
             #
-            # @overload restore_crypto_key_version(name: nil)
-            #   Pass arguments to `restore_crypto_key_version` via keyword arguments. Note that at
+            # @overload generate_random_bytes(location: nil, length_bytes: nil, protection_level: nil)
+            #   Pass arguments to `generate_random_bytes` via keyword arguments. Note that at
             #   least one keyword argument is required. To specify no parameters, or to keep all
             #   the default parameter values, pass an empty Hash as a request object (see above).
             #
-            #   @param name [::String]
-            #     Required. The resource name of the {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersion} to restore.
+            #   @param location [::String]
+            #     The project-specific location in which to generate random bytes.
+            #     For example, "projects/my-project/locations/us-central1".
+            #   @param length_bytes [::Integer]
+            #     The length in bytes of the amount of randomness to retrieve.  Minimum 8
+            #     bytes, maximum 1024 bytes.
+            #   @param protection_level [::Google::Cloud::Kms::V1::ProtectionLevel]
+            #     The {::Google::Cloud::Kms::V1::ProtectionLevel ProtectionLevel} to use when generating the random data. Defaults to
+            #     {::Google::Cloud::Kms::V1::ProtectionLevel::SOFTWARE SOFTWARE}.
             #
             # @yield [response, operation] Access the result along with the RPC operation
-            # @yieldparam response [::Google::Cloud::Kms::V1::CryptoKeyVersion]
+            # @yieldparam response [::Google::Cloud::Kms::V1::GenerateRandomBytesResponse]
             # @yieldparam operation [::GRPC::ActiveCall::Operation]
             #
-            # @return [::Google::Cloud::Kms::V1::CryptoKeyVersion]
+            # @return [::Google::Cloud::Kms::V1::GenerateRandomBytesResponse]
             #
             # @raise [::Google::Cloud::Error] if the RPC is aborted.
             #
-            def restore_crypto_key_version request, options = nil
+            def generate_random_bytes request, options = nil
               raise ::ArgumentError, "request must be provided" if request.nil?
 
-              request = ::Gapic::Protobuf.coerce request, to: ::Google::Cloud::Kms::V1::RestoreCryptoKeyVersionRequest
+              request = ::Gapic::Protobuf.coerce request, to: ::Google::Cloud::Kms::V1::GenerateRandomBytesRequest
 
               # Converts hash and nil to an options object
               options = ::Gapic::CallOptions.new(**options.to_h) if options.respond_to? :to_h
 
               # Customize the options with defaults
-              metadata = @config.rpcs.restore_crypto_key_version.metadata.to_h
+              metadata = @config.rpcs.generate_random_bytes.metadata.to_h
 
               # Set x-goog-api-client and x-goog-user-project headers
               metadata[:"x-goog-api-client"] ||= ::Gapic::Headers.x_goog_api_client \
@@ -2108,18 +2453,20 @@ module Google
               metadata[:"x-goog-user-project"] = @quota_project_id if @quota_project_id
 
               header_params = {
-                "name" => request.name
+                "location" => request.location
               }
               request_params_header = header_params.map { |k, v| "#{k}=#{v}" }.join("&")
               metadata[:"x-goog-request-params"] ||= request_params_header
 
-              options.apply_defaults timeout:      @config.rpcs.restore_crypto_key_version.timeout,
+              options.apply_defaults timeout:      @config.rpcs.generate_random_bytes.timeout,
                                      metadata:     metadata,
-                                     retry_policy: @config.rpcs.restore_crypto_key_version.retry_policy
-              options.apply_defaults metadata:     @config.metadata,
+                                     retry_policy: @config.rpcs.generate_random_bytes.retry_policy
+
+              options.apply_defaults timeout:      @config.timeout,
+                                     metadata:     @config.metadata,
                                      retry_policy: @config.retry_policy
 
-              @key_management_service_stub.call_rpc :restore_crypto_key_version, request, options: options do |response, operation|
+              @key_management_service_stub.call_rpc :generate_random_bytes, request, options: options do |response, operation|
                 yield response, operation if block_given?
                 return response
               end
@@ -2140,22 +2487,21 @@ module Google
             # Configuration can be applied globally to all clients, or to a single client
             # on construction.
             #
-            # # Examples
-            #
-            # To modify the global config, setting the timeout for list_key_rings
-            # to 20 seconds, and all remaining timeouts to 10 seconds:
+            # @example
             #
-            #     ::Google::Cloud::Kms::V1::KeyManagementService::Client.configure do |config|
-            #       config.timeout = 10.0
-            #       config.rpcs.list_key_rings.timeout = 20.0
-            #     end
+            #   # Modify the global config, setting the timeout for
+            #   # list_key_rings to 20 seconds,
+            #   # and all remaining timeouts to 10 seconds.
+            #   ::Google::Cloud::Kms::V1::KeyManagementService::Client.configure do |config|
+            #     config.timeout = 10.0
+            #     config.rpcs.list_key_rings.timeout = 20.0
+            #   end
             #
-            # To apply the above configuration only to a new client:
-            #
-            #     client = ::Google::Cloud::Kms::V1::KeyManagementService::Client.new do |config|
-            #       config.timeout = 10.0
-            #       config.rpcs.list_key_rings.timeout = 20.0
-            #     end
+            #   # Apply the above configuration only to a new client.
+            #   client = ::Google::Cloud::Kms::V1::KeyManagementService::Client.new do |config|
+            #     config.timeout = 10.0
+            #     config.rpcs.list_key_rings.timeout = 20.0
+            #   end
             #
             # @!attribute [rw] endpoint
             #   The hostname or hostname:port of the service endpoint.
@@ -2344,6 +2690,21 @@ module Google
                 #
                 attr_reader :update_crypto_key_version
                 ##
+                # RPC-specific configuration for `update_crypto_key_primary_version`
+                # @return [::Gapic::Config::Method]
+                #
+                attr_reader :update_crypto_key_primary_version
+                ##
+                # RPC-specific configuration for `destroy_crypto_key_version`
+                # @return [::Gapic::Config::Method]
+                #
+                attr_reader :destroy_crypto_key_version
+                ##
+                # RPC-specific configuration for `restore_crypto_key_version`
+                # @return [::Gapic::Config::Method]
+                #
+                attr_reader :restore_crypto_key_version
+                ##
                 # RPC-specific configuration for `encrypt`
                 # @return [::Gapic::Config::Method]
                 #
@@ -2364,20 +2725,20 @@ module Google
                 #
                 attr_reader :asymmetric_decrypt
                 ##
-                # RPC-specific configuration for `update_crypto_key_primary_version`
+                # RPC-specific configuration for `mac_sign`
                 # @return [::Gapic::Config::Method]
                 #
-                attr_reader :update_crypto_key_primary_version
+                attr_reader :mac_sign
                 ##
-                # RPC-specific configuration for `destroy_crypto_key_version`
+                # RPC-specific configuration for `mac_verify`
                 # @return [::Gapic::Config::Method]
                 #
-                attr_reader :destroy_crypto_key_version
+                attr_reader :mac_verify
                 ##
-                # RPC-specific configuration for `restore_crypto_key_version`
+                # RPC-specific configuration for `generate_random_bytes`
                 # @return [::Gapic::Config::Method]
                 #
-                attr_reader :restore_crypto_key_version
+                attr_reader :generate_random_bytes
 
                 # @private
                 def initialize parent_rpcs = nil
@@ -2413,6 +2774,12 @@ module Google
                   @update_crypto_key = ::Gapic::Config::Method.new update_crypto_key_config
                   update_crypto_key_version_config = parent_rpcs.update_crypto_key_version if parent_rpcs.respond_to? :update_crypto_key_version
                   @update_crypto_key_version = ::Gapic::Config::Method.new update_crypto_key_version_config
+                  update_crypto_key_primary_version_config = parent_rpcs.update_crypto_key_primary_version if parent_rpcs.respond_to? :update_crypto_key_primary_version
+                  @update_crypto_key_primary_version = ::Gapic::Config::Method.new update_crypto_key_primary_version_config
+                  destroy_crypto_key_version_config = parent_rpcs.destroy_crypto_key_version if parent_rpcs.respond_to? :destroy_crypto_key_version
+                  @destroy_crypto_key_version = ::Gapic::Config::Method.new destroy_crypto_key_version_config
+                  restore_crypto_key_version_config = parent_rpcs.restore_crypto_key_version if parent_rpcs.respond_to? :restore_crypto_key_version
+                  @restore_crypto_key_version = ::Gapic::Config::Method.new restore_crypto_key_version_config
                   encrypt_config = parent_rpcs.encrypt if parent_rpcs.respond_to? :encrypt
                   @encrypt = ::Gapic::Config::Method.new encrypt_config
                   decrypt_config = parent_rpcs.decrypt if parent_rpcs.respond_to? :decrypt
@@ -2421,12 +2788,12 @@ module Google
                   @asymmetric_sign = ::Gapic::Config::Method.new asymmetric_sign_config
                   asymmetric_decrypt_config = parent_rpcs.asymmetric_decrypt if parent_rpcs.respond_to? :asymmetric_decrypt
                   @asymmetric_decrypt = ::Gapic::Config::Method.new asymmetric_decrypt_config
-                  update_crypto_key_primary_version_config = parent_rpcs.update_crypto_key_primary_version if parent_rpcs.respond_to? :update_crypto_key_primary_version
-                  @update_crypto_key_primary_version = ::Gapic::Config::Method.new update_crypto_key_primary_version_config
-                  destroy_crypto_key_version_config = parent_rpcs.destroy_crypto_key_version if parent_rpcs.respond_to? :destroy_crypto_key_version
-                  @destroy_crypto_key_version = ::Gapic::Config::Method.new destroy_crypto_key_version_config
-                  restore_crypto_key_version_config = parent_rpcs.restore_crypto_key_version if parent_rpcs.respond_to? :restore_crypto_key_version
-                  @restore_crypto_key_version = ::Gapic::Config::Method.new restore_crypto_key_version_config
+                  mac_sign_config = parent_rpcs.mac_sign if parent_rpcs.respond_to? :mac_sign
+                  @mac_sign = ::Gapic::Config::Method.new mac_sign_config
+                  mac_verify_config = parent_rpcs.mac_verify if parent_rpcs.respond_to? :mac_verify
+                  @mac_verify = ::Gapic::Config::Method.new mac_verify_config
+                  generate_random_bytes_config = parent_rpcs.generate_random_bytes if parent_rpcs.respond_to? :generate_random_bytes
+                  @generate_random_bytes = ::Gapic::Config::Method.new generate_random_bytes_config
 
                   yield self if block_given?
                 end