google-cloud-kms-v1 0.9.0 → 0.11.0

This diff represents the content of publicly available package versions that have been released to one of the supported registries. The information contained in this diff is provided for informational purposes only and reflects changes between package versions as they appear in their respective public registries.
Files changed (22) hide show
  1. checksums.yaml +4 -4
  2. data/.yardopts +1 -1
  3. data/AUTHENTICATION.md +13 -31
  4. data/README.md +4 -4
  5. data/lib/google/cloud/kms/v1/ekm_service/client.rb +731 -0
  6. data/lib/google/cloud/kms/v1/ekm_service/credentials.rb +52 -0
  7. data/lib/google/cloud/kms/v1/ekm_service/paths.rb +90 -0
  8. data/lib/google/cloud/kms/v1/ekm_service.rb +53 -0
  9. data/lib/google/cloud/kms/v1/ekm_service_pb.rb +79 -0
  10. data/lib/google/cloud/kms/v1/ekm_service_services_pb.rb +57 -0
  11. data/lib/google/cloud/kms/v1/iam_policy/client.rb +60 -9
  12. data/lib/google/cloud/kms/v1/key_management_service/client.rb +975 -340
  13. data/lib/google/cloud/kms/v1/resources_pb.rb +13 -1
  14. data/lib/google/cloud/kms/v1/service_pb.rb +3 -0
  15. data/lib/google/cloud/kms/v1/service_services_pb.rb +84 -48
  16. data/lib/google/cloud/kms/v1/version.rb +1 -1
  17. data/lib/google/cloud/kms/v1.rb +2 -1
  18. data/proto_docs/google/api/resource.rb +10 -71
  19. data/proto_docs/google/cloud/kms/v1/ekm_service.rb +226 -0
  20. data/proto_docs/google/cloud/kms/v1/resources.rb +308 -160
  21. data/proto_docs/google/cloud/kms/v1/service.rb +661 -390
  22. metadata +10 -3
data/lib/google/cloud/kms/v1/resources_pb.rb CHANGED
@@ -6,7 +6,6 @@ require 'google/api/resource_pb'
6
6
  require 'google/protobuf/duration_pb'
7
7
  require 'google/protobuf/timestamp_pb'
8
8
  require 'google/protobuf/wrappers_pb'
9
- require 'google/api/annotations_pb'
10
9
  require 'google/protobuf'
11
10
 
12
11
  Google::Protobuf::DescriptorPool.generated_pool.build do
@@ -25,6 +24,7 @@ Google::Protobuf::DescriptorPool.generated_pool.build do
25
24
  map :labels, :string, :string, 10
26
25
  optional :import_only, :bool, 13
27
26
  optional :destroy_scheduled_duration, :message, 14, "google.protobuf.Duration"
27
+ optional :crypto_key_backend, :string, 15
28
28
  oneof :rotation_schedule do
29
29
  optional :rotation_period, :message, 8, "google.protobuf.Duration"
30
30
  end
@@ -43,6 +43,12 @@ Google::Protobuf::DescriptorPool.generated_pool.build do
43
43
  add_message "google.cloud.kms.v1.KeyOperationAttestation" do
44
44
  optional :format, :enum, 4, "google.cloud.kms.v1.KeyOperationAttestation.AttestationFormat"
45
45
  optional :content, :bytes, 5
46
+ optional :cert_chains, :message, 6, "google.cloud.kms.v1.KeyOperationAttestation.CertificateChains"
47
+ end
48
+ add_message "google.cloud.kms.v1.KeyOperationAttestation.CertificateChains" do
49
+ repeated :cavium_certs, :string, 1
50
+ repeated :google_card_certs, :string, 2
51
+ repeated :google_partition_certs, :string, 3
46
52
  end
47
53
  add_enum "google.cloud.kms.v1.KeyOperationAttestation.AttestationFormat" do
48
54
  value :ATTESTATION_FORMAT_UNSPECIFIED, 0
@@ -76,6 +82,9 @@ Google::Protobuf::DescriptorPool.generated_pool.build do
76
82
  value :RSA_SIGN_PKCS1_3072_SHA256, 6
77
83
  value :RSA_SIGN_PKCS1_4096_SHA256, 7
78
84
  value :RSA_SIGN_PKCS1_4096_SHA512, 16
85
+ value :RSA_SIGN_RAW_PKCS1_2048, 28
86
+ value :RSA_SIGN_RAW_PKCS1_3072, 29
87
+ value :RSA_SIGN_RAW_PKCS1_4096, 30
79
88
  value :RSA_DECRYPT_OAEP_2048_SHA256, 8
80
89
  value :RSA_DECRYPT_OAEP_3072_SHA256, 9
81
90
  value :RSA_DECRYPT_OAEP_4096_SHA256, 10
@@ -138,12 +147,14 @@ Google::Protobuf::DescriptorPool.generated_pool.build do
138
147
  end
139
148
  add_message "google.cloud.kms.v1.ExternalProtectionLevelOptions" do
140
149
  optional :external_key_uri, :string, 1
150
+ optional :ekm_connection_key_path, :string, 2
141
151
  end
142
152
  add_enum "google.cloud.kms.v1.ProtectionLevel" do
143
153
  value :PROTECTION_LEVEL_UNSPECIFIED, 0
144
154
  value :SOFTWARE, 1
145
155
  value :HSM, 2
146
156
  value :EXTERNAL, 3
157
+ value :EXTERNAL_VPC, 4
147
158
  end
148
159
  end
149
160
  end
@@ -157,6 +168,7 @@ module Google
157
168
  CryptoKey::CryptoKeyPurpose = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose").enummodule
158
169
  CryptoKeyVersionTemplate = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("google.cloud.kms.v1.CryptoKeyVersionTemplate").msgclass
159
170
  KeyOperationAttestation = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("google.cloud.kms.v1.KeyOperationAttestation").msgclass
171
+ KeyOperationAttestation::CertificateChains = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("google.cloud.kms.v1.KeyOperationAttestation.CertificateChains").msgclass
160
172
  KeyOperationAttestation::AttestationFormat = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("google.cloud.kms.v1.KeyOperationAttestation.AttestationFormat").enummodule
161
173
  CryptoKeyVersion = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("google.cloud.kms.v1.CryptoKeyVersion").msgclass
162
174
  CryptoKeyVersion::CryptoKeyVersionAlgorithm = ::Google::Protobuf::DescriptorPool.generated_pool.lookup("google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionAlgorithm").enummodule
data/lib/google/cloud/kms/v1/service_pb.rb CHANGED
@@ -142,6 +142,8 @@ Google::Protobuf::DescriptorPool.generated_pool.build do
142
142
  optional :name, :string, 1
143
143
  optional :digest, :message, 3, "google.cloud.kms.v1.Digest"
144
144
  optional :digest_crc32c, :message, 4, "google.protobuf.Int64Value"
145
+ optional :data, :bytes, 6
146
+ optional :data_crc32c, :message, 7, "google.protobuf.Int64Value"
145
147
  end
146
148
  add_message "google.cloud.kms.v1.AsymmetricDecryptRequest" do
147
149
  optional :name, :string, 1
@@ -184,6 +186,7 @@ Google::Protobuf::DescriptorPool.generated_pool.build do
184
186
  optional :signature_crc32c, :message, 2, "google.protobuf.Int64Value"
185
187
  optional :verified_digest_crc32c, :bool, 3
186
188
  optional :name, :string, 4
189
+ optional :verified_data_crc32c, :bool, 5
187
190
  optional :protection_level, :enum, 6, "google.cloud.kms.v1.ProtectionLevel"
188
191
  end
189
192
  add_message "google.cloud.kms.v1.AsymmetricDecryptResponse" do
data/lib/google/cloud/kms/v1/service_services_pb.rb CHANGED
@@ -54,102 +54,138 @@ module Google
54
54
  rpc :ListImportJobs, ::Google::Cloud::Kms::V1::ListImportJobsRequest, ::Google::Cloud::Kms::V1::ListImportJobsResponse
55
55
  # Returns metadata for a given [KeyRing][google.cloud.kms.v1.KeyRing].
56
56
  rpc :GetKeyRing, ::Google::Cloud::Kms::V1::GetKeyRingRequest, ::Google::Cloud::Kms::V1::KeyRing
57
- # Returns metadata for a given [CryptoKey][google.cloud.kms.v1.CryptoKey], as well as its
58
- # [primary][google.cloud.kms.v1.CryptoKey.primary] [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion].
57
+ # Returns metadata for a given [CryptoKey][google.cloud.kms.v1.CryptoKey], as
58
+ # well as its [primary][google.cloud.kms.v1.CryptoKey.primary]
59
+ # [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion].
59
60
  rpc :GetCryptoKey, ::Google::Cloud::Kms::V1::GetCryptoKeyRequest, ::Google::Cloud::Kms::V1::CryptoKey
60
- # Returns metadata for a given [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion].
61
+ # Returns metadata for a given
62
+ # [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion].
61
63
  rpc :GetCryptoKeyVersion, ::Google::Cloud::Kms::V1::GetCryptoKeyVersionRequest, ::Google::Cloud::Kms::V1::CryptoKeyVersion
62
- # Returns the public key for the given [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. The
64
+ # Returns the public key for the given
65
+ # [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]. The
63
66
  # [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] must be
64
- # [ASYMMETRIC_SIGN][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ASYMMETRIC_SIGN] or
67
+ # [ASYMMETRIC_SIGN][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ASYMMETRIC_SIGN]
68
+ # or
65
69
  # [ASYMMETRIC_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ASYMMETRIC_DECRYPT].
66
70
  rpc :GetPublicKey, ::Google::Cloud::Kms::V1::GetPublicKeyRequest, ::Google::Cloud::Kms::V1::PublicKey
67
71
  # Returns metadata for a given [ImportJob][google.cloud.kms.v1.ImportJob].
68
72
  rpc :GetImportJob, ::Google::Cloud::Kms::V1::GetImportJobRequest, ::Google::Cloud::Kms::V1::ImportJob
69
- # Create a new [KeyRing][google.cloud.kms.v1.KeyRing] in a given Project and Location.
73
+ # Create a new [KeyRing][google.cloud.kms.v1.KeyRing] in a given Project and
74
+ # Location.
70
75
  rpc :CreateKeyRing, ::Google::Cloud::Kms::V1::CreateKeyRingRequest, ::Google::Cloud::Kms::V1::KeyRing
71
- # Create a new [CryptoKey][google.cloud.kms.v1.CryptoKey] within a [KeyRing][google.cloud.kms.v1.KeyRing].
76
+ # Create a new [CryptoKey][google.cloud.kms.v1.CryptoKey] within a
77
+ # [KeyRing][google.cloud.kms.v1.KeyRing].
72
78
  #
73
79
  # [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] and
74
80
  # [CryptoKey.version_template.algorithm][google.cloud.kms.v1.CryptoKeyVersionTemplate.algorithm]
75
81
  # are required.
76
82
  rpc :CreateCryptoKey, ::Google::Cloud::Kms::V1::CreateCryptoKeyRequest, ::Google::Cloud::Kms::V1::CryptoKey
77
- # Create a new [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in a [CryptoKey][google.cloud.kms.v1.CryptoKey].
83
+ # Create a new [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in a
84
+ # [CryptoKey][google.cloud.kms.v1.CryptoKey].
78
85
  #
79
86
  # The server will assign the next sequential id. If unset,
80
87
  # [state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to
81
88
  # [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED].
82
89
  rpc :CreateCryptoKeyVersion, ::Google::Cloud::Kms::V1::CreateCryptoKeyVersionRequest, ::Google::Cloud::Kms::V1::CryptoKeyVersion
83
- # Import wrapped key material into a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion].
90
+ # Import wrapped key material into a
91
+ # [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion].
84
92
  #
85
- # All requests must specify a [CryptoKey][google.cloud.kms.v1.CryptoKey]. If a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] is
86
- # additionally specified in the request, key material will be reimported into
87
- # that version. Otherwise, a new version will be created, and will be
88
- # assigned the next sequential id within the [CryptoKey][google.cloud.kms.v1.CryptoKey].
93
+ # All requests must specify a [CryptoKey][google.cloud.kms.v1.CryptoKey]. If
94
+ # a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] is additionally
95
+ # specified in the request, key material will be reimported into that
96
+ # version. Otherwise, a new version will be created, and will be assigned the
97
+ # next sequential id within the [CryptoKey][google.cloud.kms.v1.CryptoKey].
89
98
  rpc :ImportCryptoKeyVersion, ::Google::Cloud::Kms::V1::ImportCryptoKeyVersionRequest, ::Google::Cloud::Kms::V1::CryptoKeyVersion
90
- # Create a new [ImportJob][google.cloud.kms.v1.ImportJob] within a [KeyRing][google.cloud.kms.v1.KeyRing].
99
+ # Create a new [ImportJob][google.cloud.kms.v1.ImportJob] within a
100
+ # [KeyRing][google.cloud.kms.v1.KeyRing].
91
101
  #
92
- # [ImportJob.import_method][google.cloud.kms.v1.ImportJob.import_method] is required.
102
+ # [ImportJob.import_method][google.cloud.kms.v1.ImportJob.import_method] is
103
+ # required.
93
104
  rpc :CreateImportJob, ::Google::Cloud::Kms::V1::CreateImportJobRequest, ::Google::Cloud::Kms::V1::ImportJob
94
105
  # Update a [CryptoKey][google.cloud.kms.v1.CryptoKey].
95
106
  rpc :UpdateCryptoKey, ::Google::Cloud::Kms::V1::UpdateCryptoKeyRequest, ::Google::Cloud::Kms::V1::CryptoKey
96
- # Update a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]'s metadata.
107
+ # Update a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]'s
108
+ # metadata.
97
109
  #
98
110
  # [state][google.cloud.kms.v1.CryptoKeyVersion.state] may be changed between
99
- # [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED] and
100
- # [DISABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED] using this
101
- # method. See [DestroyCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.DestroyCryptoKeyVersion] and [RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion] to
102
- # move between other states.
111
+ # [ENABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.ENABLED]
112
+ # and
113
+ # [DISABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED]
114
+ # using this method. See
115
+ # [DestroyCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.DestroyCryptoKeyVersion]
116
+ # and
117
+ # [RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion]
118
+ # to move between other states.
103
119
  rpc :UpdateCryptoKeyVersion, ::Google::Cloud::Kms::V1::UpdateCryptoKeyVersionRequest, ::Google::Cloud::Kms::V1::CryptoKeyVersion
104
- # Update the version of a [CryptoKey][google.cloud.kms.v1.CryptoKey] that will be used in [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt].
120
+ # Update the version of a [CryptoKey][google.cloud.kms.v1.CryptoKey] that
121
+ # will be used in
122
+ # [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt].
105
123
  #
106
124
  # Returns an error if called on a key whose purpose is not
107
125
  # [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT].
108
126
  rpc :UpdateCryptoKeyPrimaryVersion, ::Google::Cloud::Kms::V1::UpdateCryptoKeyPrimaryVersionRequest, ::Google::Cloud::Kms::V1::CryptoKey
109
- # Schedule a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] for destruction.
127
+ # Schedule a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] for
128
+ # destruction.
110
129
  #
111
- # Upon calling this method, [CryptoKeyVersion.state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to
130
+ # Upon calling this method,
131
+ # [CryptoKeyVersion.state][google.cloud.kms.v1.CryptoKeyVersion.state] will
132
+ # be set to
112
133
  # [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED],
113
- # and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be set to the time
114
- # [destroy_scheduled_duration][google.cloud.kms.v1.CryptoKey.destroy_scheduled_duration] in the
115
- # future. At that time, the [state][google.cloud.kms.v1.CryptoKeyVersion.state] will
116
- # automatically change to
117
- # [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED], and the key
118
- # material will be irrevocably destroyed.
134
+ # and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will
135
+ # be set to the time
136
+ # [destroy_scheduled_duration][google.cloud.kms.v1.CryptoKey.destroy_scheduled_duration]
137
+ # in the future. At that time, the
138
+ # [state][google.cloud.kms.v1.CryptoKeyVersion.state] will automatically
139
+ # change to
140
+ # [DESTROYED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROYED],
141
+ # and the key material will be irrevocably destroyed.
119
142
  #
120
- # Before the [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] is reached,
121
- # [RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion] may be called to reverse the process.
143
+ # Before the
144
+ # [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] is
145
+ # reached,
146
+ # [RestoreCryptoKeyVersion][google.cloud.kms.v1.KeyManagementService.RestoreCryptoKeyVersion]
147
+ # may be called to reverse the process.
122
148
  rpc :DestroyCryptoKeyVersion, ::Google::Cloud::Kms::V1::DestroyCryptoKeyVersionRequest, ::Google::Cloud::Kms::V1::CryptoKeyVersion
123
149
  # Restore a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] in the
124
150
  # [DESTROY_SCHEDULED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DESTROY_SCHEDULED]
125
151
  # state.
126
152
  #
127
- # Upon restoration of the CryptoKeyVersion, [state][google.cloud.kms.v1.CryptoKeyVersion.state]
128
- # will be set to [DISABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED],
129
- # and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will be cleared.
153
+ # Upon restoration of the CryptoKeyVersion,
154
+ # [state][google.cloud.kms.v1.CryptoKeyVersion.state] will be set to
155
+ # [DISABLED][google.cloud.kms.v1.CryptoKeyVersion.CryptoKeyVersionState.DISABLED],
156
+ # and [destroy_time][google.cloud.kms.v1.CryptoKeyVersion.destroy_time] will
157
+ # be cleared.
130
158
  rpc :RestoreCryptoKeyVersion, ::Google::Cloud::Kms::V1::RestoreCryptoKeyVersionRequest, ::Google::Cloud::Kms::V1::CryptoKeyVersion
131
- # Encrypts data, so that it can only be recovered by a call to [Decrypt][google.cloud.kms.v1.KeyManagementService.Decrypt].
132
- # The [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] must be
159
+ # Encrypts data, so that it can only be recovered by a call to
160
+ # [Decrypt][google.cloud.kms.v1.KeyManagementService.Decrypt]. The
161
+ # [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] must be
133
162
  # [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT].
134
163
  rpc :Encrypt, ::Google::Cloud::Kms::V1::EncryptRequest, ::Google::Cloud::Kms::V1::EncryptResponse
135
- # Decrypts data that was protected by [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt]. The [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose]
136
- # must be [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT].
164
+ # Decrypts data that was protected by
165
+ # [Encrypt][google.cloud.kms.v1.KeyManagementService.Encrypt]. The
166
+ # [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] must be
167
+ # [ENCRYPT_DECRYPT][google.cloud.kms.v1.CryptoKey.CryptoKeyPurpose.ENCRYPT_DECRYPT].
137
168
  rpc :Decrypt, ::Google::Cloud::Kms::V1::DecryptRequest, ::Google::Cloud::Kms::V1::DecryptResponse
138
- # Signs data using a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose]
169
+ # Signs data using a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]
170
+ # with [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose]
139
171
  # ASYMMETRIC_SIGN, producing a signature that can be verified with the public
140
- # key retrieved from [GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey].
172
+ # key retrieved from
173
+ # [GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey].
141
174
  rpc :AsymmetricSign, ::Google::Cloud::Kms::V1::AsymmetricSignRequest, ::Google::Cloud::Kms::V1::AsymmetricSignResponse
142
175
  # Decrypts data that was encrypted with a public key retrieved from
143
- # [GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey] corresponding to a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with
144
- # [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] ASYMMETRIC_DECRYPT.
176
+ # [GetPublicKey][google.cloud.kms.v1.KeyManagementService.GetPublicKey]
177
+ # corresponding to a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]
178
+ # with [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose]
179
+ # ASYMMETRIC_DECRYPT.
145
180
  rpc :AsymmetricDecrypt, ::Google::Cloud::Kms::V1::AsymmetricDecryptRequest, ::Google::Cloud::Kms::V1::AsymmetricDecryptResponse
146
- # Signs data using a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose]
147
- # MAC, producing a tag that can be verified by another source with the
148
- # same key.
181
+ # Signs data using a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion]
182
+ # with [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] MAC,
183
+ # producing a tag that can be verified by another source with the same key.
149
184
  rpc :MacSign, ::Google::Cloud::Kms::V1::MacSignRequest, ::Google::Cloud::Kms::V1::MacSignResponse
150
- # Verifies MAC tag using a [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose]
151
- # MAC, and returns a response that indicates whether or not the verification
152
- # was successful.
185
+ # Verifies MAC tag using a
186
+ # [CryptoKeyVersion][google.cloud.kms.v1.CryptoKeyVersion] with
187
+ # [CryptoKey.purpose][google.cloud.kms.v1.CryptoKey.purpose] MAC, and returns
188
+ # a response that indicates whether or not the verification was successful.
153
189
  rpc :MacVerify, ::Google::Cloud::Kms::V1::MacVerifyRequest, ::Google::Cloud::Kms::V1::MacVerifyResponse
154
190
  # Generate random bytes using the Cloud KMS randomness source in the provided
155
191
  # location.
data/lib/google/cloud/kms/v1/version.rb CHANGED
@@ -21,7 +21,7 @@ module Google
21
21
  module Cloud
22
22
  module Kms
23
23
  module V1
24
- VERSION = "0.9.0"
24
+ VERSION = "0.11.0"
25
25
  end
26
26
  end
27
27
  end
data/lib/google/cloud/kms/v1.rb CHANGED
@@ -16,6 +16,7 @@
16
16
 
17
17
  # Auto-generated by gapic-generator-ruby. DO NOT EDIT!
18
18
 
19
+ require "google/cloud/kms/v1/ekm_service"
19
20
  require "google/cloud/kms/v1/key_management_service"
20
21
  require "google/cloud/kms/v1/iam_policy"
21
22
  require "google/cloud/kms/v1/version"
@@ -27,7 +28,7 @@ module Google
27
28
  # To load this package, including all its services, and instantiate a client:
28
29
  #
29
30
  # require "google/cloud/kms/v1"
30
- # client = ::Google::Cloud::Kms::V1::KeyManagementService::Client.new
31
+ # client = ::Google::Cloud::Kms::V1::EkmService::Client.new
31
32
  #
32
33
  module V1
33
34
  end
data/proto_docs/google/api/resource.rb CHANGED
@@ -33,11 +33,7 @@ module Google
33
33
  # // For Kubernetes resources, the format is {api group}/{kind}.
34
34
  # option (google.api.resource) = {
35
35
  # type: "pubsub.googleapis.com/Topic"
36
- # name_descriptor: {
37
- # pattern: "projects/{project}/topics/{topic}"
38
- # parent_type: "cloudresourcemanager.googleapis.com/Project"
39
- # parent_name_extractor: "projects/{project}"
40
- # }
36
+ # pattern: "projects/{project}/topics/{topic}"
41
37
  # };
42
38
  # }
43
39
  #
@@ -45,10 +41,7 @@ module Google
45
41
  #
46
42
  # resources:
47
43
  # - type: "pubsub.googleapis.com/Topic"
48
- # name_descriptor:
49
- # - pattern: "projects/{project}/topics/{topic}"
50
- # parent_type: "cloudresourcemanager.googleapis.com/Project"
51
- # parent_name_extractor: "projects/{project}"
44
+ # pattern: "projects/{project}/topics/{topic}"
52
45
  #
53
46
  # Sometimes, resources have multiple patterns, typically because they can
54
47
  # live under multiple parents.
@@ -58,26 +51,10 @@ module Google
58
51
  # message LogEntry {
59
52
  # option (google.api.resource) = {
60
53
  # type: "logging.googleapis.com/LogEntry"
61
- # name_descriptor: {
62
- # pattern: "projects/{project}/logs/{log}"
63
- # parent_type: "cloudresourcemanager.googleapis.com/Project"
64
- # parent_name_extractor: "projects/{project}"
65
- # }
66
- # name_descriptor: {
67
- # pattern: "folders/{folder}/logs/{log}"
68
- # parent_type: "cloudresourcemanager.googleapis.com/Folder"
69
- # parent_name_extractor: "folders/{folder}"
70
- # }
71
- # name_descriptor: {
72
- # pattern: "organizations/{organization}/logs/{log}"
73
- # parent_type: "cloudresourcemanager.googleapis.com/Organization"
74
- # parent_name_extractor: "organizations/{organization}"
75
- # }
76
- # name_descriptor: {
77
- # pattern: "billingAccounts/{billing_account}/logs/{log}"
78
- # parent_type: "billing.googleapis.com/BillingAccount"
79
- # parent_name_extractor: "billingAccounts/{billing_account}"
80
- # }
54
+ # pattern: "projects/{project}/logs/{log}"
55
+ # pattern: "folders/{folder}/logs/{log}"
56
+ # pattern: "organizations/{organization}/logs/{log}"
57
+ # pattern: "billingAccounts/{billing_account}/logs/{log}"
81
58
  # };
82
59
  # }
83
60
  #
@@ -85,48 +62,10 @@ module Google
85
62
  #
86
63
  # resources:
87
64
  # - type: 'logging.googleapis.com/LogEntry'
88
- # name_descriptor:
89
- # - pattern: "projects/{project}/logs/{log}"
90
- # parent_type: "cloudresourcemanager.googleapis.com/Project"
91
- # parent_name_extractor: "projects/{project}"
92
- # - pattern: "folders/{folder}/logs/{log}"
93
- # parent_type: "cloudresourcemanager.googleapis.com/Folder"
94
- # parent_name_extractor: "folders/{folder}"
95
- # - pattern: "organizations/{organization}/logs/{log}"
96
- # parent_type: "cloudresourcemanager.googleapis.com/Organization"
97
- # parent_name_extractor: "organizations/{organization}"
98
- # - pattern: "billingAccounts/{billing_account}/logs/{log}"
99
- # parent_type: "billing.googleapis.com/BillingAccount"
100
- # parent_name_extractor: "billingAccounts/{billing_account}"
101
- #
102
- # For flexible resources, the resource name doesn't contain parent names, but
103
- # the resource itself has parents for policy evaluation.
104
- #
105
- # Example:
106
- #
107
- # message Shelf {
108
- # option (google.api.resource) = {
109
- # type: "library.googleapis.com/Shelf"
110
- # name_descriptor: {
111
- # pattern: "shelves/{shelf}"
112
- # parent_type: "cloudresourcemanager.googleapis.com/Project"
113
- # }
114
- # name_descriptor: {
115
- # pattern: "shelves/{shelf}"
116
- # parent_type: "cloudresourcemanager.googleapis.com/Folder"
117
- # }
118
- # };
119
- # }
120
- #
121
- # The ResourceDescriptor Yaml config will look like:
122
- #
123
- # resources:
124
- # - type: 'library.googleapis.com/Shelf'
125
- # name_descriptor:
126
- # - pattern: "shelves/{shelf}"
127
- # parent_type: "cloudresourcemanager.googleapis.com/Project"
128
- # - pattern: "shelves/{shelf}"
129
- # parent_type: "cloudresourcemanager.googleapis.com/Folder"
65
+ # pattern: "projects/{project}/logs/{log}"
66
+ # pattern: "folders/{folder}/logs/{log}"
67
+ # pattern: "organizations/{organization}/logs/{log}"
68
+ # pattern: "billingAccounts/{billing_account}/logs/{log}"
130
69
  # @!attribute [rw] type
131
70
  # @return [::String]
132
71
  # The resource type. It must be in the format of
data/proto_docs/google/cloud/kms/v1/ekm_service.rb ADDED
@@ -0,0 +1,226 @@
1
+ # frozen_string_literal: true
2
+
3
+ # Copyright 2022 Google LLC
4
+ #
5
+ # Licensed under the Apache License, Version 2.0 (the "License");
6
+ # you may not use this file except in compliance with the License.
7
+ # You may obtain a copy of the License at
8
+ #
9
+ # https://www.apache.org/licenses/LICENSE-2.0
10
+ #
11
+ # Unless required by applicable law or agreed to in writing, software
12
+ # distributed under the License is distributed on an "AS IS" BASIS,
13
+ # WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14
+ # See the License for the specific language governing permissions and
15
+ # limitations under the License.
16
+
17
+ # Auto-generated by gapic-generator-ruby. DO NOT EDIT!
18
+
19
+
20
+ module Google
21
+ module Cloud
22
+ module Kms
23
+ module V1
24
+ # Request message for [KeyManagementService.ListEkmConnections][].
25
+ # @!attribute [rw] parent
26
+ # @return [::String]
27
+ # Required. The resource name of the location associated with the
28
+ # {::Google::Cloud::Kms::V1::EkmConnection EkmConnections} to list, in the format
29
+ # `projects/*/locations/*`.
30
+ # @!attribute [rw] page_size
31
+ # @return [::Integer]
32
+ # Optional. Optional limit on the number of
33
+ # {::Google::Cloud::Kms::V1::EkmConnection EkmConnections} to include in the
34
+ # response. Further {::Google::Cloud::Kms::V1::EkmConnection EkmConnections} can
35
+ # subsequently be obtained by including the
36
+ # {::Google::Cloud::Kms::V1::ListEkmConnectionsResponse#next_page_token ListEkmConnectionsResponse.next_page_token}
37
+ # in a subsequent request. If unspecified, the server will pick an
38
+ # appropriate default.
39
+ # @!attribute [rw] page_token
40
+ # @return [::String]
41
+ # Optional. Optional pagination token, returned earlier via
42
+ # {::Google::Cloud::Kms::V1::ListEkmConnectionsResponse#next_page_token ListEkmConnectionsResponse.next_page_token}.
43
+ # @!attribute [rw] filter
44
+ # @return [::String]
45
+ # Optional. Only include resources that match the filter in the response. For
46
+ # more information, see
47
+ # [Sorting and filtering list
48
+ # results](https://cloud.google.com/kms/docs/sorting-and-filtering).
49
+ # @!attribute [rw] order_by
50
+ # @return [::String]
51
+ # Optional. Specify how the results should be sorted. If not specified, the
52
+ # results will be sorted in the default order. For more information, see
53
+ # [Sorting and filtering list
54
+ # results](https://cloud.google.com/kms/docs/sorting-and-filtering).
55
+ class ListEkmConnectionsRequest
56
+ include ::Google::Protobuf::MessageExts
57
+ extend ::Google::Protobuf::MessageExts::ClassMethods
58
+ end
59
+
60
+ # Response message for [KeyManagementService.ListEkmConnections][].
61
+ # @!attribute [rw] ekm_connections
62
+ # @return [::Array<::Google::Cloud::Kms::V1::EkmConnection>]
63
+ # The list of {::Google::Cloud::Kms::V1::EkmConnection EkmConnections}.
64
+ # @!attribute [rw] next_page_token
65
+ # @return [::String]
66
+ # A token to retrieve next page of results. Pass this value in
67
+ # {::Google::Cloud::Kms::V1::ListEkmConnectionsRequest#page_token ListEkmConnectionsRequest.page_token}
68
+ # to retrieve the next page of results.
69
+ # @!attribute [rw] total_size
70
+ # @return [::Integer]
71
+ # The total number of {::Google::Cloud::Kms::V1::EkmConnection EkmConnections}
72
+ # that matched the query.
73
+ class ListEkmConnectionsResponse
74
+ include ::Google::Protobuf::MessageExts
75
+ extend ::Google::Protobuf::MessageExts::ClassMethods
76
+ end
77
+
78
+ # Request message for [KeyManagementService.GetEkmConnection][].
79
+ # @!attribute [rw] name
80
+ # @return [::String]
81
+ # Required. The {::Google::Cloud::Kms::V1::EkmConnection#name name} of the
82
+ # {::Google::Cloud::Kms::V1::EkmConnection EkmConnection} to get.
83
+ class GetEkmConnectionRequest
84
+ include ::Google::Protobuf::MessageExts
85
+ extend ::Google::Protobuf::MessageExts::ClassMethods
86
+ end
87
+
88
+ # Request message for [KeyManagementService.CreateEkmConnection][].
89
+ # @!attribute [rw] parent
90
+ # @return [::String]
91
+ # Required. The resource name of the location associated with the
92
+ # {::Google::Cloud::Kms::V1::EkmConnection EkmConnection}, in the format
93
+ # `projects/*/locations/*`.
94
+ # @!attribute [rw] ekm_connection_id
95
+ # @return [::String]
96
+ # Required. It must be unique within a location and match the regular
97
+ # expression `[a-zA-Z0-9_-]{1,63}`.
98
+ # @!attribute [rw] ekm_connection
99
+ # @return [::Google::Cloud::Kms::V1::EkmConnection]
100
+ # Required. An {::Google::Cloud::Kms::V1::EkmConnection EkmConnection} with
101
+ # initial field values.
102
+ class CreateEkmConnectionRequest
103
+ include ::Google::Protobuf::MessageExts
104
+ extend ::Google::Protobuf::MessageExts::ClassMethods
105
+ end
106
+
107
+ # Request message for [KeyManagementService.UpdateEkmConnection][].
108
+ # @!attribute [rw] ekm_connection
109
+ # @return [::Google::Cloud::Kms::V1::EkmConnection]
110
+ # Required. {::Google::Cloud::Kms::V1::EkmConnection EkmConnection} with updated
111
+ # values.
112
+ # @!attribute [rw] update_mask
113
+ # @return [::Google::Protobuf::FieldMask]
114
+ # Required. List of fields to be updated in this request.
115
+ class UpdateEkmConnectionRequest
116
+ include ::Google::Protobuf::MessageExts
117
+ extend ::Google::Protobuf::MessageExts::ClassMethods
118
+ end
119
+
120
+ # A {::Google::Cloud::Kms::V1::Certificate Certificate} represents an X.509
121
+ # certificate used to authenticate HTTPS connections to EKM replicas.
122
+ # @!attribute [rw] raw_der
123
+ # @return [::String]
124
+ # Required. The raw certificate bytes in DER format.
125
+ # @!attribute [r] parsed
126
+ # @return [::Boolean]
127
+ # Output only. True if the certificate was parsed successfully.
128
+ # @!attribute [r] issuer
129
+ # @return [::String]
130
+ # Output only. The issuer distinguished name in RFC 2253 format. Only present
131
+ # if {::Google::Cloud::Kms::V1::Certificate#parsed parsed} is true.
132
+ # @!attribute [r] subject
133
+ # @return [::String]
134
+ # Output only. The subject distinguished name in RFC 2253 format. Only
135
+ # present if {::Google::Cloud::Kms::V1::Certificate#parsed parsed} is true.
136
+ # @!attribute [r] subject_alternative_dns_names
137
+ # @return [::Array<::String>]
138
+ # Output only. The subject Alternative DNS names. Only present if
139
+ # {::Google::Cloud::Kms::V1::Certificate#parsed parsed} is true.
140
+ # @!attribute [r] not_before_time
141
+ # @return [::Google::Protobuf::Timestamp]
142
+ # Output only. The certificate is not valid before this time. Only present if
143
+ # {::Google::Cloud::Kms::V1::Certificate#parsed parsed} is true.
144
+ # @!attribute [r] not_after_time
145
+ # @return [::Google::Protobuf::Timestamp]
146
+ # Output only. The certificate is not valid after this time. Only present if
147
+ # {::Google::Cloud::Kms::V1::Certificate#parsed parsed} is true.
148
+ # @!attribute [r] serial_number
149
+ # @return [::String]
150
+ # Output only. The certificate serial number as a hex string. Only present if
151
+ # {::Google::Cloud::Kms::V1::Certificate#parsed parsed} is true.
152
+ # @!attribute [r] sha256_fingerprint
153
+ # @return [::String]
154
+ # Output only. The SHA-256 certificate fingerprint as a hex string. Only
155
+ # present if {::Google::Cloud::Kms::V1::Certificate#parsed parsed} is true.
156
+ class Certificate
157
+ include ::Google::Protobuf::MessageExts
158
+ extend ::Google::Protobuf::MessageExts::ClassMethods
159
+ end
160
+
161
+ # An {::Google::Cloud::Kms::V1::EkmConnection EkmConnection} represents an
162
+ # individual EKM connection. It can be used for creating
163
+ # {::Google::Cloud::Kms::V1::CryptoKey CryptoKeys} and
164
+ # {::Google::Cloud::Kms::V1::CryptoKeyVersion CryptoKeyVersions} with a
165
+ # {::Google::Cloud::Kms::V1::ProtectionLevel ProtectionLevel} of
166
+ # [EXTERNAL_VPC][CryptoKeyVersion.ProtectionLevel.EXTERNAL_VPC], as well as
167
+ # performing cryptographic operations using keys created within the
168
+ # {::Google::Cloud::Kms::V1::EkmConnection EkmConnection}.
169
+ # @!attribute [r] name
170
+ # @return [::String]
171
+ # Output only. The resource name for the
172
+ # {::Google::Cloud::Kms::V1::EkmConnection EkmConnection} in the format
173
+ # `projects/*/locations/*/ekmConnections/*`.
174
+ # @!attribute [r] create_time
175
+ # @return [::Google::Protobuf::Timestamp]
176
+ # Output only. The time at which the
177
+ # {::Google::Cloud::Kms::V1::EkmConnection EkmConnection} was created.
178
+ # @!attribute [rw] service_resolvers
179
+ # @return [::Array<::Google::Cloud::Kms::V1::EkmConnection::ServiceResolver>]
180
+ # A list of
181
+ # {::Google::Cloud::Kms::V1::EkmConnection::ServiceResolver ServiceResolvers} where
182
+ # the EKM can be reached. There should be one ServiceResolver per EKM
183
+ # replica. Currently, only a single
184
+ # {::Google::Cloud::Kms::V1::EkmConnection::ServiceResolver ServiceResolver} is
185
+ # supported.
186
+ # @!attribute [rw] etag
187
+ # @return [::String]
188
+ # This checksum is computed by the server based on the value of other fields,
189
+ # and may be sent on update requests to ensure the client has an up-to-date
190
+ # value before proceeding.
191
+ class EkmConnection
192
+ include ::Google::Protobuf::MessageExts
193
+ extend ::Google::Protobuf::MessageExts::ClassMethods
194
+
195
+ # A {::Google::Cloud::Kms::V1::EkmConnection::ServiceResolver ServiceResolver}
196
+ # represents an EKM replica that can be reached within an
197
+ # {::Google::Cloud::Kms::V1::EkmConnection EkmConnection}.
198
+ # @!attribute [rw] service_directory_service
199
+ # @return [::String]
200
+ # Required. The resource name of the Service Directory service pointing to
201
+ # an EKM replica, in the format
202
+ # `projects/*/locations/*/namespaces/*/services/*`.
203
+ # @!attribute [rw] endpoint_filter
204
+ # @return [::String]
205
+ # Optional. The filter applied to the endpoints of the resolved service. If
206
+ # no filter is specified, all endpoints will be considered. An endpoint
207
+ # will be chosen arbitrarily from the filtered list for each request.
208
+ #
209
+ # For endpoint filter syntax and examples, see
210
+ # https://cloud.google.com/service-directory/docs/reference/rpc/google.cloud.servicedirectory.v1#resolveservicerequest.
211
+ # @!attribute [rw] hostname
212
+ # @return [::String]
213
+ # Required. The hostname of the EKM replica used at TLS and HTTP layers.
214
+ # @!attribute [rw] server_certificates
215
+ # @return [::Array<::Google::Cloud::Kms::V1::Certificate>]
216
+ # Required. A list of leaf server certificates used to authenticate HTTPS
217
+ # connections to the EKM replica.
218
+ class ServiceResolver
219
+ include ::Google::Protobuf::MessageExts
220
+ extend ::Google::Protobuf::MessageExts::ClassMethods
221
+ end
222
+ end
223
+ end
224
+ end
225
+ end
226
+ end