feat(secretmanager): Added samples for labels and annotations

Author: durgesh-ninave-crest

secretmanager/snippets/delete_secret_annotation.py

@@ -0,0 +1,68 @@
+#!/usr/bin/env python
+
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+
+# [START secretmanager_delete_secret_annotation]
+import argparse
+
+# Import the Secret Manager client library.
+from google.cloud import secretmanager
+
+
+def delete_secret_annotation(
+    project_id: str, secret_id: str, annotation_key: str
+) -> secretmanager.UpdateSecretRequest:
+    """
+    Delete a annotation on an existing secret.
+    """
+
+    # Create the Secret Manager client.
+    client = secretmanager.SecretManagerServiceClient()
+
+    # Build the resource name of the secret.
+    name = client.secret_path(project_id, secret_id)
+
+    # Get the secret.
+    response = client.get_secret(request={"name": name})
+
+    annotations = response.annotations
+
+    # Delete the annotation
+    annotations.pop(annotation_key, None)
+
+    # Update the secret.
+    secret = {"name": name, "annotations": annotations}
+    update_mask = {"paths": ["annotations"]}
+    response = client.update_secret(
+        request={"secret": secret, "update_mask": update_mask}
+    )
+
+    # Print the new secret name.
+    print(f"Updated secret: {response.name}")
+
+    return response
+
+
+# [END secretmanager_delete_secret_annotation]
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(
+        description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter
+    )
+    parser.add_argument("project_id", help="id of the GCP project")
+    parser.add_argument("secret_id", help="id of the secret to act on")
+    parser.add_argument("annotation_key", help="key of the annotation to be deleted")
+    args = parser.parse_args()
+
+    delete_secret_annotation(args.project_id, args.secret_id, args.annotation_key)

secretmanager/snippets/edit_secret_labels.py

@@ -0,0 +1,75 @@
+#!/usr/bin/env python
+
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+
+# [START secretmanager_edit_secret_labels]
+
+import argparse
+from typing import Dict
+
+# Import the Secret Manager client library.
+from google.cloud import secretmanager
+
+
+def edit_secret_labels(
+    project_id: str, secret_id: str, new_labels: Dict[str, str]
+) -> secretmanager.UpdateSecretRequest:
+    """
+    Create or update a label on an existing secret.
+    """
+
+    # Create the Secret Manager client.
+    client = secretmanager.SecretManagerServiceClient()
+
+    # Build the resource name of the secret.
+    name = client.secret_path(project_id, secret_id)
+
+    # Get the secret.
+    response = client.get_secret(request={"name": name})
+
+    labels = response.labels
+
+    # Update the labels
+    for label_key in new_labels:
+        labels[label_key] = new_labels[label_key]
+
+    # Update the secret.
+    secret = {"name": name, "labels": labels}
+    update_mask = {"paths": ["labels"]}
+    response = client.update_secret(
+        request={"secret": secret, "update_mask": update_mask}
+    )
+
+    # Print the new secret name.
+    print(f"Updated secret: {response.name}")
+
+    return response
+
+
+# [END secretmanager_edit_secret_labels]
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(
+        description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter
+    )
+    parser.add_argument("project_id", help="id of the GCP project")
+    parser.add_argument("secret_id", help="id of the secret to act on")
+    parser.add_argument("label_key", help="key of the label to be added/updated")
+    parser.add_argument("label_value", help="value of the label to be added/updated")
+    args = parser.parse_args()
+
+    labels = {args.label_key: args.label_value}
+    edit_secret_labels(
+        args.project_id, args.secret_id, labels
+    )

secretmanager/snippets/regional_samples/delete_regional_secret_annotation.py

@@ -0,0 +1,78 @@
+#!/usr/bin/env python
+
+# Copyright 2025 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#     http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+
+# [START secretmanager_delete_regional_secret_annotation]
+import argparse
+
+# Import the Secret Manager client library.
+from google.cloud import secretmanager_v1
+
+
+def delete_regional_secret_annotation(
+    project_id: str, location_id: str, secret_id: str, annotation_key: str
+) -> secretmanager_v1.UpdateSecretRequest:
+    """
+    Delete a annotation on an existing secret.
+    """
+
+    # Endpoint to call the regional Secret Manager API.
+    api_endpoint = f"secretmanager.{location_id}.rep.googleapis.com"
+
+    # Create the Secret Manager client.
+    client = secretmanager_v1.SecretManagerServiceClient(
+        client_options={"api_endpoint": api_endpoint},
+    )
+
+    # Build the resource name of the parent secret.
+    name = f"projects/{project_id}/locations/{location_id}/secrets/{secret_id}"
+
+    # Get the secret.
+    response = client.get_secret(request={"name": name})
+
+    annotations = response.annotations
+
+    # Delete the annotation
+    annotations.pop(annotation_key, None)
+
+    # Update the secret.
+    secret = {"name": name, "annotations": annotations}
+    update_mask = {"paths": ["annotations"]}
+    response = client.update_secret(
+        request={"secret": secret, "update_mask": update_mask}
+    )
+
+    # Print the new secret name.
+    print(f"Updated secret: {response.name}")
+
+    return response
+
+
+# [END secretmanager_delete_regional_secret_annotation]
+
+if __name__ == "__main__":
+    parser = argparse.ArgumentParser(
+        description=__doc__, formatter_class=argparse.RawDescriptionHelpFormatter
+    )
+    parser.add_argument("project_id", help="id of the GCP project")
+    parser.add_argument(
+        "location_id", help="id of the location where secret is to be created"
+    )
+    parser.add_argument("secret_id", help="id of the secret to act on")
+    parser.add_argument("annotation_key", help="key of the annotation to be deleted")
+    args = parser.parse_args()
+
+    delete_regional_secret_annotation(
+        args.project_id, args.location_id, args.secret_id, args.annotation_key
+    )

secretmanager/snippets/regional_samples/snippets_test.py

@@ -32,6 +32,7 @@
 from regional_samples import create_regional_secret_with_labels
 from regional_samples import create_regional_secret_with_tags
 from regional_samples import delete_regional_secret
+from regional_samples import delete_regional_secret_annotation
 from regional_samples import delete_regional_secret_label
 from regional_samples import delete_regional_secret_with_etag
 from regional_samples import destroy_regional_secret_version
@@ -469,6 +470,24 @@ def test_create_regional_secret_with_label(
     assert secret_id in secret.name
 
 
+def test_delete_regional_secret_annotation(
+    regional_client: secretmanager_v1.SecretManagerServiceClient,
+    project_id: str,
+    location_id: str,
+    regional_secret: Tuple[str, str],
+    annotation_key: str,
+) -> None:
+    secret_id, _ = regional_secret
+    delete_regional_secret_annotation.delete_regional_secret_annotation(
+        project_id, location_id, secret_id, annotation_key
+    )
+    with pytest.raises(exceptions.NotFound):
+        name = f"projects/{project_id}/locations/{location_id}/secrets/{secret_id}/versions/latest"
+        retry_client_access_regional_secret_version(
+            regional_client, request={"name": name}
+        )
+
+
 def test_delete_regional_secret_labels(
     regional_client: secretmanager_v1.SecretManagerServiceClient,
     project_id: str,

secretmanager/snippets/snippets_test.py

@@ -37,6 +37,7 @@
 from create_secret_with_user_managed_replication import create_ummr_secret
 from create_update_secret_label import create_update_secret_label
 from delete_secret import delete_secret
+from delete_secret_annotation import delete_secret_annotation
 from delete_secret_label import delete_secret_label
 from delete_secret_with_etag import delete_secret_with_etag
 from destroy_secret_version import destroy_secret_version
@@ -45,6 +46,7 @@
 from disable_secret_version_with_etag import disable_secret_version_with_etag
 from disable_secret_with_delayed_destroy import disable_secret_with_delayed_destroy
 from edit_secret_annotations import edit_secret_annotations
+from edit_secret_labels import edit_secret_labels
 from enable_secret_version import enable_secret_version
 from enable_secret_version_with_etag import enable_secret_version_with_etag
 from get_secret import get_secret
@@ -485,6 +487,19 @@ def test_delete_secret(
         retry_client_access_secret_version(client, request={"name": name})
 
 
+def test_delete_secret_annotation(
+    client: secretmanager.SecretManagerServiceClient,
+    secret: Tuple[str, str, str],
+    annotation_key: str,
+) -> None:
+    project_id, secret_id, _ = secret
+    delete_secret_annotation(project_id, secret_id, annotation_key)
+    with pytest.raises(exceptions.NotFound):
+        print(f"{client}")
+        name = f"projects/{project_id}/secrets/{secret_id}/versions/latest"
+        retry_client_access_secret_version(client, request={"name": name})
+
+
 def test_delete_secret_labels(
     client: secretmanager.SecretManagerServiceClient,
     secret: Tuple[str, str, str],
@@ -704,6 +719,16 @@ def test_edit_secret_annotations(
     assert updated_secret.annotations[annotation_key] == updated_annotation_value
 
 
+def test_edit_secret_labels(
+    secret: Tuple[str, str, str], label_key: str
+) -> None:
+    project_id, secret_id, _ = secret
+    updated_label_value = "updatedlabelvalue"
+    labels = {label_key: updated_label_value}
+    updated_secret = edit_secret_labels(project_id, secret_id, labels)
+    assert updated_secret.labels[label_key] == updated_label_value
+
+
 def test_update_secret(secret: Tuple[str, str, str]) -> None:
     project_id, secret_id, _ = secret
     updated_secret = update_secret(project_id, secret_id)