Skip to content

Commit 0c1759d

Browse files
anshukairaanshukaira
committed
chore: Making kms module adc compliant
1 parent a03c8c7 commit 0c1759d

File tree

7 files changed

+499
-1
lines changed

7 files changed

+499
-1
lines changed

‎Makefile‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,9 +76,10 @@ docker_test_lint:
7676
.PHONY: docker_generate_docs
7777
docker_generate_docs:
7878
docker run --rm -it \
79+
-e ENABLE_BPMETADATA=1 \
7980
-v "$(CURDIR)":/workspace \
8081
$(REGISTRY_URL)/${DOCKER_IMAGE_DEVELOPER_TOOLS}:${DOCKER_TAG_VERSION_DEVELOPER_TOOLS} \
81-
/bin/bash -c 'source /usr/local/bin/task_helper_functions.sh && generate_docs'
82+
/bin/bash -c 'source /usr/local/bin/task_helper_functions.sh && generate_docs display'
8283

8384
# Alias for backwards compatibility
8485
.PHONY: generate_docs

‎README.md‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -69,6 +69,7 @@ Functional examples are included in the
6969

7070
| Name | Description |
7171
|------|-------------|
72+
| key\_id\_list | The list of the crypto key IDs. |
7273
| keyring | Self link of the keyring. |
7374
| keyring\_name | Name of the keyring. |
7475
| keyring\_resource | Keyring resource. |

‎metadata.display.yaml‎

Lines changed: 208 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,208 @@
1+
# Copyright 2025 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
apiVersion: blueprints.cloud.google.com/v1alpha1
16+
kind: BlueprintMetadata
17+
metadata:
18+
name: terraform-google-kms-display
19+
annotations:
20+
config.kubernetes.io/local-config: "true"
21+
spec:
22+
info:
23+
title: Google KMS Terraform Module
24+
source:
25+
repo: https://github.com/anshukaira/terraform-google-kms.git
26+
sourceType: git
27+
ui:
28+
input:
29+
variables:
30+
crypto_key_backend:
31+
name: crypto_key_backend
32+
title: Crypto Key Backend
33+
decrypters:
34+
name: decrypters
35+
title: Decrypters
36+
encrypters:
37+
name: encrypters
38+
title: Encrypters
39+
import_only:
40+
name: import_only
41+
title: Import Only
42+
level: 1
43+
key_algorithm:
44+
name: key_algorithm
45+
title: Key Algorithm
46+
enumValueLabels:
47+
- label: CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED
48+
value: CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED
49+
- label: GOOGLE_SYMMETRIC_ENCRYPTION
50+
value: GOOGLE_SYMMETRIC_ENCRYPTION
51+
- label: AES_128_GCM
52+
value: AES_128_GCM
53+
- label: AES_256_GCM
54+
value: AES_256_GCM
55+
- label: AES_128_CBC
56+
value: AES_128_CBC
57+
- label: AES_256_CBC
58+
value: AES_256_CBC
59+
- label: AES_128_CTR
60+
value: AES_128_CTR
61+
- label: AES_256_CTR
62+
value: AES_256_CTR
63+
- label: RSA_SIGN_PSS_2048_SHA256
64+
value: RSA_SIGN_PSS_2048_SHA256
65+
- label: RSA_SIGN_PSS_3072_SHA256
66+
value: RSA_SIGN_PSS_3072_SHA256
67+
- label: RSA_SIGN_PSS_4096_SHA256
68+
value: RSA_SIGN_PSS_4096_SHA256
69+
- label: RSA_SIGN_PSS_4096_SHA512
70+
value: RSA_SIGN_PSS_4096_SHA512
71+
- label: RSA_SIGN_PKCS1_2048_SHA256
72+
value: RSA_SIGN_PKCS1_2048_SHA256
73+
- label: RSA_SIGN_PKCS1_3072_SHA256
74+
value: RSA_SIGN_PKCS1_3072_SHA256
75+
- label: RSA_SIGN_PKCS1_4096_SHA256
76+
value: RSA_SIGN_PKCS1_4096_SHA256
77+
- label: RSA_SIGN_PKCS1_4096_SHA512
78+
value: RSA_SIGN_PKCS1_4096_SHA512
79+
- label: RSA_SIGN_RAW_PKCS1_2048
80+
value: RSA_SIGN_RAW_PKCS1_2048
81+
- label: RSA_SIGN_RAW_PKCS1_3072
82+
value: RSA_SIGN_RAW_PKCS1_3072
83+
- label: RSA_SIGN_RAW_PKCS1_4096
84+
value: RSA_SIGN_RAW_PKCS1_4096
85+
- label: RSA_DECRYPT_OAEP_2048_SHA256
86+
value: RSA_DECRYPT_OAEP_2048_SHA256
87+
- label: RSA_DECRYPT_OAEP_3072_SHA256
88+
value: RSA_DECRYPT_OAEP_3072_SHA256
89+
- label: RSA_DECRYPT_OAEP_4096_SHA256
90+
value: RSA_DECRYPT_OAEP_4096_SHA256
91+
- label: RSA_DECRYPT_OAEP_4096_SHA512
92+
value: RSA_DECRYPT_OAEP_4096_SHA512
93+
- label: RSA_DECRYPT_OAEP_2048_SHA1
94+
value: RSA_DECRYPT_OAEP_2048_SHA1
95+
- label: RSA_DECRYPT_OAEP_3072_SHA1
96+
value: RSA_DECRYPT_OAEP_3072_SHA1
97+
- label: RSA_DECRYPT_OAEP_4096_SHA1
98+
value: RSA_DECRYPT_OAEP_4096_SHA1
99+
- label: EC_SIGN_P256_SHA256
100+
value: EC_SIGN_P256_SHA256
101+
- label: EC_SIGN_P384_SHA384
102+
value: EC_SIGN_P384_SHA384
103+
- label: EC_SIGN_SECP256K1_SHA256
104+
value: EC_SIGN_SECP256K1_SHA256
105+
- label: EC_SIGN_ED25519
106+
value: EC_SIGN_ED25519
107+
- label: HMAC_SHA256
108+
value: HMAC_SHA256
109+
- label: HMAC_SHA1
110+
value: HMAC_SHA1
111+
- label: HMAC_SHA384
112+
value: HMAC_SHA384
113+
- label: HMAC_SHA512
114+
value: HMAC_SHA512
115+
- label: HMAC_SHA224
116+
value: HMAC_SHA224
117+
- label: EXTERNAL_SYMMETRIC_ENCRYPTION
118+
value: EXTERNAL_SYMMETRIC_ENCRYPTION
119+
- label: ML_KEM_768
120+
value: ML_KEM_768
121+
- label: ML_KEM_1024
122+
value: ML_KEM_1024
123+
- label: KEM_XWING
124+
value: KEM_XWING
125+
- label: PQ_SIGN_ML_DSA_65
126+
value: PQ_SIGN_ML_DSA_65
127+
- label: PQ_SIGN_SLH_DSA_SHA2_128S
128+
value: PQ_SIGN_SLH_DSA_SHA2_128S
129+
- label: PQ_SIGN_HASH_SLH_DSA_SHA2_128S_SHA256
130+
value: PQ_SIGN_HASH_SLH_DSA_SHA2_128S_SHA256
131+
level: 1
132+
key_destroy_scheduled_duration:
133+
name: key_destroy_scheduled_duration
134+
title: Key Destroy Scheduled Duration
135+
level: 1
136+
key_protection_level:
137+
name: key_protection_level
138+
title: Key Protection Level
139+
enumValueLabels:
140+
- label: SOFTWARE
141+
value: SOFTWARE
142+
- label: HSM
143+
value: HSM
144+
- label: EXTERNAL
145+
value: EXTERNAL
146+
- label: EXTERNAL_VPC
147+
value: EXTERNAL_VPC
148+
key_rotation_period:
149+
name: key_rotation_period
150+
title: Key Rotation Period
151+
keyring:
152+
name: keyring
153+
title: Keyring
154+
level: 1
155+
keys:
156+
name: keys
157+
title: Keys
158+
regexValidation: ^[a-zA-Z0-9_-]{1,63}$
159+
validation: Keyring name must be 1-63 characters and can only contain letters, numbers, underscores, and hyphens.
160+
level: 1
161+
labels:
162+
name: labels
163+
title: Labels
164+
location:
165+
name: location
166+
title: Location
167+
owners:
168+
name: owners
169+
title: Owners
170+
prevent_destroy:
171+
name: prevent_destroy
172+
title: Prevent Destroy
173+
level: 1
174+
project_id:
175+
name: project_id
176+
title: Project Id
177+
level: 1
178+
purpose:
179+
name: purpose
180+
title: Purpose
181+
enumValueLabels:
182+
- label: CRYPTO_KEY_PURPOSE_UNSPECIFIED
183+
value: CRYPTO_KEY_PURPOSE_UNSPECIFIED
184+
- label: ENCRYPT_DECRYPT
185+
value: ENCRYPT_DECRYPT
186+
- label: ASYMMETRIC_SIGN
187+
value: ASYMMETRIC_SIGN
188+
- label: ASYMMETRIC_DECRYPT
189+
value: ASYMMETRIC_DECRYPT
190+
- label: RAW_ENCRYPT_DECRYPT
191+
value: RAW_ENCRYPT_DECRYPT
192+
- label: MAC
193+
value: MAC
194+
- label: KEY_ENCAPSULATION
195+
value: KEY_ENCAPSULATION
196+
set_decrypters_for:
197+
name: set_decrypters_for
198+
title: Set Decrypters For
199+
level: 1
200+
set_encrypters_for:
201+
name: set_encrypters_for
202+
title: Set Encrypters For
203+
set_owners_for:
204+
name: set_owners_for
205+
title: Set Owners For
206+
skip_initial_version_creation:
207+
name: skip_initial_version_creation
208+
title: Skip Initial Version Creation

‎metadata.yaml‎

Lines changed: 168 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,168 @@
1+
# Copyright 2025 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
apiVersion: blueprints.cloud.google.com/v1alpha1
16+
kind: BlueprintMetadata
17+
metadata:
18+
name: terraform-google-kms
19+
annotations:
20+
config.kubernetes.io/local-config: "true"
21+
spec:
22+
info:
23+
title: Google KMS Terraform Module
24+
source:
25+
repo: https://github.com/anshukaira/terraform-google-kms.git
26+
sourceType: git
27+
version: 4.1.0
28+
actuationTool:
29+
flavor: Terraform
30+
version: ">= 1.3"
31+
description: {}
32+
content:
33+
subBlueprints:
34+
- name: autokey
35+
location: modules/autokey
36+
examples:
37+
- name: autokey_setup
38+
location: examples/autokey_setup
39+
- name: bucket_setup_using_autokey
40+
location: examples/bucket_setup_using_autokey
41+
- name: import_only_example
42+
location: examples/import_only_example
43+
- name: monitoring_alerts
44+
location: examples/monitoring_alerts
45+
- name: simple_example
46+
location: examples/simple_example
47+
interfaces:
48+
variables:
49+
- name: project_id
50+
description: Project id where the keyring will be created.
51+
varType: string
52+
required: true
53+
- name: location
54+
description: Location for the keyring.
55+
varType: string
56+
required: true
57+
- name: keyring
58+
description: Keyring name.
59+
varType: string
60+
required: true
61+
- name: keys
62+
description: Key names.
63+
varType: list(string)
64+
defaultValue: []
65+
- name: prevent_destroy
66+
description: Set the prevent_destroy lifecycle attribute on keys.
67+
varType: bool
68+
defaultValue: true
69+
- name: key_destroy_scheduled_duration
70+
description: Set the period of time that versions of keys spend in the DESTROY_SCHEDULED state before transitioning to DESTROYED.
71+
varType: string
72+
- name: purpose
73+
description: The immutable purpose of the CryptoKey. Default value is ENCRYPT_DECRYPT. See purpose reference (https://cloud.google.com/kms/docs/reference/rest/v1/projects.locations.keyRings.cryptoKeys#CryptoKeyPurpose) for possible inputs.
74+
varType: string
75+
defaultValue: ENCRYPT_DECRYPT
76+
- name: set_owners_for
77+
description: Name of keys for which owners will be set.
78+
varType: list(string)
79+
defaultValue: []
80+
- name: owners
81+
description: List of comma-separated owners for each key declared in set_owners_for.
82+
varType: list(string)
83+
defaultValue: []
84+
- name: set_encrypters_for
85+
description: Name of keys for which encrypters will be set.
86+
varType: list(string)
87+
defaultValue: []
88+
- name: encrypters
89+
description: List of comma-separated owners for each key declared in set_encrypters_for.
90+
varType: list(string)
91+
defaultValue: []
92+
- name: set_decrypters_for
93+
description: Name of keys for which decrypters will be set.
94+
varType: list(string)
95+
defaultValue: []
96+
- name: decrypters
97+
description: List of comma-separated owners for each key declared in set_decrypters_for.
98+
varType: list(string)
99+
defaultValue: []
100+
- name: key_rotation_period
101+
description: Generate a new key every time this period passes.
102+
varType: string
103+
defaultValue: 7776000s
104+
- name: key_algorithm
105+
description: The algorithm to use when creating a version based on this template. See the https://cloud.google.com/kms/docs/reference/rest/v1/CryptoKeyVersionAlgorithm for possible inputs.
106+
varType: string
107+
defaultValue: GOOGLE_SYMMETRIC_ENCRYPTION
108+
- name: key_protection_level
109+
description: "The protection level to use when creating a version based on this template. Default value: \"SOFTWARE\" Possible values: [\"SOFTWARE\", \"HSM\", \"EXTERNAL\", \"EXTERNAL_VPC\"]"
110+
varType: string
111+
defaultValue: SOFTWARE
112+
- name: labels
113+
description: Labels, provided as a map
114+
varType: map(string)
115+
defaultValue: {}
116+
- name: import_only
117+
description: Whether these keys may contain imported versions only.
118+
varType: bool
119+
defaultValue: false
120+
- name: skip_initial_version_creation
121+
description: If set to true, the request will create CryptoKeys without any CryptoKeyVersions.
122+
varType: bool
123+
defaultValue: false
124+
- name: crypto_key_backend
125+
description: (Optional) The resource name of the backend environment associated with all CryptoKeyVersions within this CryptoKey. The resource name is in the format 'projects//locations//ekmConnections/*' and only applies to 'EXTERNAL_VPC' keys.
126+
varType: string
127+
outputs:
128+
- name: key_id_list
129+
description: The list of the crypto key IDs.
130+
type: list(string)
131+
- name: keyring
132+
description: Self link of the keyring.
133+
type: string
134+
- name: keyring_name
135+
description: Name of the keyring.
136+
type: string
137+
- name: keyring_resource
138+
description: Keyring resource.
139+
type:
140+
- object
141+
- id: string
142+
location: string
143+
name: string
144+
project: string
145+
timeouts:
146+
- object
147+
- create: string
148+
delete: string
149+
- name: keys
150+
description: Map of key name => key self link.
151+
type:
152+
- map
153+
- string
154+
requirements:
155+
roles:
156+
- level: Project
157+
roles:
158+
- roles/cloudkms.admin
159+
- roles/owner
160+
services:
161+
- cloudkms.googleapis.com
162+
- serviceusage.googleapis.com
163+
- cloudresourcemanager.googleapis.com
164+
- monitoring.googleapis.com
165+
- logging.googleapis.com
166+
providerVersions:
167+
- source: hashicorp/google
168+
version: ">= 5.31.0, < 8"

0 commit comments

Comments
 (0)