Add new encryption_spec field (#15068) (#24328)

[upstream:a71440718aca830a9504c23ef92e87e21e34e290]

Signed-off-by: Modular Magician <[email protected]>

Author: modular-magician

.changelog/15068.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+privateca: added `encryption_spec` field to `google_privateca_ca_pool` resource
+```

google/services/privateca/resource_privateca_ca_pool.go

@@ -78,6 +78,26 @@ running 'gcloud privateca locations list'.`,
 				ValidateFunc: verify.ValidateEnum([]string{"ENTERPRISE", "DEVOPS"}),
 				Description:  `The Tier of this CaPool. Possible values: ["ENTERPRISE", "DEVOPS"]`,
 			},
+			"encryption_spec": {
+				Type:     schema.TypeList,
+				Optional: true,
+				ForceNew: true,
+				Description: `Used when customer would like to encrypt data at rest. The customer-provided key will be used
+to encrypt the Subject, SubjectAltNames and PEM-encoded certificate fields. When unspecified,
+customer data will remain unencrypted.`,
+				MaxItems: 1,
+				Elem: &schema.Resource{
+					Schema: map[string]*schema.Schema{
+						"cloud_kms_key": {
+							Type:     schema.TypeString,
+							Optional: true,
+							ForceNew: true,
+							Description: `The resource name for an existing Cloud KMS key in the format
+'projects/*/locations/*/keyRings/*/cryptoKeys/*'.`,
+						},
+					},
+				},
+			},
 			"issuance_policy": {
 				Type:        schema.TypeList,
 				Optional:    true,
@@ -659,6 +679,12 @@ func resourcePrivatecaCaPoolCreate(d *schema.ResourceData, meta interface{}) err
 	} else if v, ok := d.GetOkExists("publishing_options"); !tpgresource.IsEmptyValue(reflect.ValueOf(publishingOptionsProp)) && (ok || !reflect.DeepEqual(v, publishingOptionsProp)) {
 		obj["publishingOptions"] = publishingOptionsProp
 	}
+	encryptionSpecProp, err := expandPrivatecaCaPoolEncryptionSpec(d.Get("encryption_spec"), d, config)
+	if err != nil {
+		return err
+	} else if v, ok := d.GetOkExists("encryption_spec"); !tpgresource.IsEmptyValue(reflect.ValueOf(encryptionSpecProp)) && (ok || !reflect.DeepEqual(v, encryptionSpecProp)) {
+		obj["encryptionSpec"] = encryptionSpecProp
+	}
 	effectiveLabelsProp, err := expandPrivatecaCaPoolEffectiveLabels(d.Get("effective_labels"), d, config)
 	if err != nil {
 		return err
@@ -776,6 +802,9 @@ func resourcePrivatecaCaPoolRead(d *schema.ResourceData, meta interface{}) error
 	if err := d.Set("labels", flattenPrivatecaCaPoolLabels(res["labels"], d, config)); err != nil {
 		return fmt.Errorf("Error reading CaPool: %s", err)
 	}
+	if err := d.Set("encryption_spec", flattenPrivatecaCaPoolEncryptionSpec(res["encryptionSpec"], d, config)); err != nil {
+		return fmt.Errorf("Error reading CaPool: %s", err)
+	}
 	if err := d.Set("terraform_labels", flattenPrivatecaCaPoolTerraformLabels(res["labels"], d, config)); err != nil {
 		return fmt.Errorf("Error reading CaPool: %s", err)
 	}
@@ -1201,6 +1230,23 @@ func flattenPrivatecaCaPoolLabels(v interface{}, d *schema.ResourceData, config
 	return transformed
 }
 
+func flattenPrivatecaCaPoolEncryptionSpec(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
+	if v == nil {
+		return nil
+	}
+	original := v.(map[string]interface{})
+	if len(original) == 0 {
+		return nil
+	}
+	transformed := make(map[string]interface{})
+	transformed["cloud_kms_key"] =
+		flattenPrivatecaCaPoolEncryptionSpecCloudKmsKey(original["cloudKmsKey"], d, config)
+	return []interface{}{transformed}
+}
+func flattenPrivatecaCaPoolEncryptionSpecCloudKmsKey(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
+	return v
+}
+
 func flattenPrivatecaCaPoolTerraformLabels(v interface{}, d *schema.ResourceData, config *transport_tpg.Config) interface{} {
 	if v == nil {
 		return v
@@ -1601,6 +1647,29 @@ func expandPrivatecaCaPoolPublishingOptionsEncodingFormat(v interface{}, d tpgre
 	return v, nil
 }
 
+func expandPrivatecaCaPoolEncryptionSpec(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
+	l := v.([]interface{})
+	if len(l) == 0 || l[0] == nil {
+		return nil, nil
+	}
+	raw := l[0]
+	original := raw.(map[string]interface{})
+	transformed := make(map[string]interface{})
+
+	transformedCloudKmsKey, err := expandPrivatecaCaPoolEncryptionSpecCloudKmsKey(original["cloud_kms_key"], d, config)
+	if err != nil {
+		return nil, err
+	} else if val := reflect.ValueOf(transformedCloudKmsKey); val.IsValid() && !tpgresource.IsEmptyValue(val) {
+		transformed["cloudKmsKey"] = transformedCloudKmsKey
+	}
+
+	return transformed, nil
+}
+
+func expandPrivatecaCaPoolEncryptionSpecCloudKmsKey(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (interface{}, error) {
+	return v, nil
+}
+
 func expandPrivatecaCaPoolEffectiveLabels(v interface{}, d tpgresource.TerraformResourceData, config *transport_tpg.Config) (map[string]string, error) {
 	if v == nil {
 		return map[string]string{}, nil

google/services/privateca/resource_privateca_ca_pool_generated_meta.yaml

@@ -7,6 +7,7 @@ api_resource_type_kind: 'CaPool'
 fields:
   - field: 'effective_labels'
     provider_only: true
+  - field: 'encryption_spec.cloud_kms_key'
   - field: 'issuance_policy.allowed_issuance_modes.allow_config_based_issuance'
   - field: 'issuance_policy.allowed_issuance_modes.allow_csr_based_issuance'
   - field: 'issuance_policy.allowed_key_types.elliptic_curve.signature_algorithm'

google/services/privateca/resource_privateca_ca_pool_generated_test.go

@@ -76,6 +76,8 @@ func TestAccPrivatecaCaPool_privatecaCapoolAllFieldsExample(t *testing.T) {
 	t.Parallel()
 
 	context := map[string]interface{}{
+		"cloud_kms_key": acctest.BootstrapKMSKeyWithPurposeInLocation(t, "ENCRYPT_DECRYPT", "asia-east1").CryptoKey.Name,
+		"pool_location": "asia-east1",
 		"random_suffix": acctest.RandString(t, 10),
 	}
 
@@ -99,9 +101,19 @@ func TestAccPrivatecaCaPool_privatecaCapoolAllFieldsExample(t *testing.T) {
 
 func testAccPrivatecaCaPool_privatecaCapoolAllFieldsExample(context map[string]interface{}) string {
 	return acctest.Nprintf(`
+resource "google_project_service_identity" "privateca_sa" {
+  service = "privateca.googleapis.com"
+}
+
+resource "google_kms_crypto_key_iam_member" "privateca_sa_keyuser_encrypterdecrypter" {
+  crypto_key_id = "%{cloud_kms_key}"
+  role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
+  member = google_project_service_identity.privateca_sa.member
+}
+
 resource "google_privateca_ca_pool" "default" {
   name = "tf-test-my-pool%{random_suffix}"
-  location = "us-central1"
+  location = "%{pool_location}"
   tier = "ENTERPRISE"
   publishing_options {
     publish_ca_cert = false
@@ -111,6 +123,9 @@ resource "google_privateca_ca_pool" "default" {
   labels = {
     foo = "bar"
   }
+  encryption_spec {
+    cloud_kms_key = "%{cloud_kms_key}"
+  }
   issuance_policy {
     allowed_key_types {
       elliptic_curve {
@@ -188,6 +203,10 @@ resource "google_privateca_ca_pool" "default" {
       }
     }
   }
+
+  depends_on = [
+    google_kms_crypto_key_iam_member.privateca_sa_keyuser_encrypterdecrypter,
+  ]
 }
 `, context)
 }

website/docs/r/privateca_ca_pool.html.markdown

@@ -63,9 +63,19 @@ resource "google_privateca_ca_pool" "default" {
 
 
 ```hcl
+resource "google_project_service_identity" "privateca_sa" {
+  service = "privateca.googleapis.com"
+}
+
+resource "google_kms_crypto_key_iam_member" "privateca_sa_keyuser_encrypterdecrypter" {
+  crypto_key_id = "projects/keys-project/locations/asia-east1/keyRings/key-ring/cryptoKeys/crypto-key"
+  role          = "roles/cloudkms.cryptoKeyEncrypterDecrypter"
+  member = google_project_service_identity.privateca_sa.member
+}
+
 resource "google_privateca_ca_pool" "default" {
   name = "my-pool"
-  location = "us-central1"
+  location = "asia-east1"
   tier = "ENTERPRISE"
   publishing_options {
     publish_ca_cert = false
@@ -75,6 +85,9 @@ resource "google_privateca_ca_pool" "default" {
   labels = {
     foo = "bar"
   }
+  encryption_spec {
+    cloud_kms_key = "projects/keys-project/locations/asia-east1/keyRings/key-ring/cryptoKeys/crypto-key"
+  }
   issuance_policy {
     allowed_key_types {
       elliptic_curve {
@@ -152,6 +165,10 @@ resource "google_privateca_ca_pool" "default" {
       }
     }
   }
+
+  depends_on = [
+    google_kms_crypto_key_iam_member.privateca_sa_keyuser_encrypterdecrypter,
+  ]
 }
 ```
 
@@ -194,6 +211,13 @@ The following arguments are supported:
   **Note**: This field is non-authoritative, and will only manage the labels present in your configuration.
   Please refer to the field `effective_labels` for all of the labels present on the resource.
 
+* `encryption_spec` -
+  (Optional)
+  Used when customer would like to encrypt data at rest. The customer-provided key will be used
+  to encrypt the Subject, SubjectAltNames and PEM-encoded certificate fields. When unspecified,
+  customer data will remain unencrypted.
+  Structure is [documented below](#nested_encryption_spec).
+
 * `project` - (Optional) The ID of the project in which the resource belongs.
     If it is not provided, the provider project is used.
 
@@ -576,6 +600,13 @@ The following arguments are supported:
   will be published in PEM.
   Possible values are: `PEM`, `DER`.
 
+<a name="nested_encryption_spec"></a>The `encryption_spec` block supports:
+
+* `cloud_kms_key` -
+  (Optional)
+  The resource name for an existing Cloud KMS key in the format
+  `projects/*/locations/*/keyRings/*/cryptoKeys/*`.
+
 ## Attributes Reference
 
 In addition to the arguments listed above, the following computed attributes are exported: