Skip to content

Commit 374054b

Browse files
anshukairaanshukaira
committed
chore: Making kms module adc compliant
1 parent a03c8c7 commit 374054b

File tree

5 files changed

+482
-1
lines changed

5 files changed

+482
-1
lines changed

‎Makefile‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,9 +76,10 @@ docker_test_lint:
7676
.PHONY: docker_generate_docs
7777
docker_generate_docs:
7878
docker run --rm -it \
79+
-e ENABLE_BPMETADATA=1 \
7980
-v "$(CURDIR)":/workspace \
8081
$(REGISTRY_URL)/${DOCKER_IMAGE_DEVELOPER_TOOLS}:${DOCKER_TAG_VERSION_DEVELOPER_TOOLS} \
81-
/bin/bash -c 'source /usr/local/bin/task_helper_functions.sh && generate_docs'
82+
/bin/bash -c 'source /usr/local/bin/task_helper_functions.sh && generate_docs display'
8283

8384
# Alias for backwards compatibility
8485
.PHONY: generate_docs

‎metadata.display.yaml‎

Lines changed: 214 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,214 @@
1+
# Copyright 2025 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
apiVersion: blueprints.cloud.google.com/v1alpha1
16+
kind: BlueprintMetadata
17+
metadata:
18+
name: terraform-google-kms-display
19+
annotations:
20+
config.kubernetes.io/local-config: "true"
21+
spec:
22+
info:
23+
title: Google KMS Terraform Module
24+
source:
25+
repo: https://github.com/anshukaira/terraform-google-kms.git
26+
sourceType: git
27+
ui:
28+
input:
29+
variables:
30+
crypto_key_backend:
31+
name: crypto_key_backend
32+
title: Crypto Key Backend
33+
level: 1
34+
decrypters:
35+
name: decrypters
36+
title: Decrypters
37+
level: 1
38+
encrypters:
39+
name: encrypters
40+
title: Encrypters
41+
level: 1
42+
import_only:
43+
name: import_only
44+
title: Import Only
45+
level: 1
46+
key_algorithm:
47+
name: key_algorithm
48+
title: Key Algorithm
49+
level: 1
50+
enumValueLabels:
51+
- label: CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED
52+
value: CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED
53+
- label: GOOGLE_SYMMETRIC_ENCRYPTION
54+
value: GOOGLE_SYMMETRIC_ENCRYPTION
55+
- label: AES_128_GCM
56+
value: AES_128_GCM
57+
- label: AES_256_GCM
58+
value: AES_256_GCM
59+
- label: AES_128_CBC
60+
value: AES_128_CBC
61+
- label: AES_256_CBC
62+
value: AES_256_CBC
63+
- label: AES_128_CTR
64+
value: AES_128_CTR
65+
- label: AES_256_CTR
66+
value: AES_256_CTR
67+
- label: RSA_SIGN_PSS_2048_SHA256
68+
value: RSA_SIGN_PSS_2048_SHA256
69+
- label: RSA_SIGN_PSS_3072_SHA256
70+
value: RSA_SIGN_PSS_3072_SHA256
71+
- label: RSA_SIGN_PSS_4096_SHA256
72+
value: RSA_SIGN_PSS_4096_SHA256
73+
- label: RSA_SIGN_PSS_4096_SHA512
74+
value: RSA_SIGN_PSS_4096_SHA512
75+
- label: RSA_SIGN_PKCS1_2048_SHA256
76+
value: RSA_SIGN_PKCS1_2048_SHA256
77+
- label: RSA_SIGN_PKCS1_3072_SHA256
78+
value: RSA_SIGN_PKCS1_3072_SHA256
79+
- label: RSA_SIGN_PKCS1_4096_SHA256
80+
value: RSA_SIGN_PKCS1_4096_SHA256
81+
- label: RSA_SIGN_PKCS1_4096_SHA512
82+
value: RSA_SIGN_PKCS1_4096_SHA512
83+
- label: RSA_SIGN_RAW_PKCS1_2048
84+
value: RSA_SIGN_RAW_PKCS1_2048
85+
- label: RSA_SIGN_RAW_PKCS1_3072
86+
value: RSA_SIGN_RAW_PKCS1_3072
87+
- label: RSA_SIGN_RAW_PKCS1_4096
88+
value: RSA_SIGN_RAW_PKCS1_4096
89+
- label: RSA_DECRYPT_OAEP_2048_SHA256
90+
value: RSA_DECRYPT_OAEP_2048_SHA256
91+
- label: RSA_DECRYPT_OAEP_3072_SHA256
92+
value: RSA_DECRYPT_OAEP_3072_SHA256
93+
- label: RSA_DECRYPT_OAEP_4096_SHA256
94+
value: RSA_DECRYPT_OAEP_4096_SHA256
95+
- label: RSA_DECRYPT_OAEP_4096_SHA512
96+
value: RSA_DECRYPT_OAEP_4096_SHA512
97+
- label: RSA_DECRYPT_OAEP_2048_SHA1
98+
value: RSA_DECRYPT_OAEP_2048_SHA1
99+
- label: RSA_DECRYPT_OAEP_3072_SHA1
100+
value: RSA_DECRYPT_OAEP_3072_SHA1
101+
- label: RSA_DECRYPT_OAEP_4096_SHA1
102+
value: RSA_DECRYPT_OAEP_4096_SHA1
103+
- label: EC_SIGN_P256_SHA256
104+
value: EC_SIGN_P256_SHA256
105+
- label: EC_SIGN_P384_SHA384
106+
value: EC_SIGN_P384_SHA384
107+
- label: EC_SIGN_SECP256K1_SHA256
108+
value: EC_SIGN_SECP256K1_SHA256
109+
- label: EC_SIGN_ED25519
110+
value: EC_SIGN_ED25519
111+
- label: HMAC_SHA256
112+
value: HMAC_SHA256
113+
- label: HMAC_SHA1
114+
value: HMAC_SHA1
115+
- label: HMAC_SHA384
116+
value: HMAC_SHA384
117+
- label: HMAC_SHA512
118+
value: HMAC_SHA512
119+
- label: HMAC_SHA224
120+
value: HMAC_SHA224
121+
- label: EXTERNAL_SYMMETRIC_ENCRYPTION
122+
value: EXTERNAL_SYMMETRIC_ENCRYPTION
123+
- label: ML_KEM_768
124+
value: ML_KEM_768
125+
- label: ML_KEM_1024
126+
value: ML_KEM_1024
127+
- label: KEM_XWING
128+
value: KEM_XWING
129+
- label: PQ_SIGN_ML_DSA_65
130+
value: PQ_SIGN_ML_DSA_65
131+
- label: PQ_SIGN_SLH_DSA_SHA2_128S
132+
value: PQ_SIGN_SLH_DSA_SHA2_128S
133+
- label: PQ_SIGN_HASH_SLH_DSA_SHA2_128S_SHA256
134+
value: PQ_SIGN_HASH_SLH_DSA_SHA2_128S_SHA256
135+
key_destroy_scheduled_duration:
136+
name: key_destroy_scheduled_duration
137+
title: Key Destroy Scheduled Duration
138+
level: 1
139+
key_protection_level:
140+
name: key_protection_level
141+
title: Key Protection Level
142+
enumValueLabels:
143+
- label: SOFTWARE
144+
value: SOFTWARE
145+
- label: HSM
146+
value: HSM
147+
- label: EXTERNAL
148+
value: EXTERNAL
149+
- label: EXTERNAL_VPC
150+
value: EXTERNAL_VPC
151+
level: 1
152+
key_rotation_period:
153+
name: key_rotation_period
154+
title: Key Rotation Period
155+
level: 1
156+
keyring:
157+
name: keyring
158+
title: Keyring
159+
keys:
160+
name: keys
161+
title: Keys
162+
regexValidation: ^[a-zA-Z0-9_-]{1,63}$
163+
validation: Keyring name must be 1-63 characters and can only contain letters, numbers, underscores, and hyphens.
164+
labels:
165+
name: labels
166+
title: Labels
167+
location:
168+
name: location
169+
title: Location
170+
owners:
171+
name: owners
172+
title: Owners
173+
level: 1
174+
prevent_destroy:
175+
name: prevent_destroy
176+
title: Prevent Destroy
177+
level: 1
178+
project_id:
179+
name: project_id
180+
title: Project Id
181+
purpose:
182+
name: purpose
183+
title: Purpose
184+
enumValueLabels:
185+
- label: CRYPTO_KEY_PURPOSE_UNSPECIFIED
186+
value: CRYPTO_KEY_PURPOSE_UNSPECIFIED
187+
- label: ENCRYPT_DECRYPT
188+
value: ENCRYPT_DECRYPT
189+
- label: ASYMMETRIC_SIGN
190+
value: ASYMMETRIC_SIGN
191+
- label: ASYMMETRIC_DECRYPT
192+
value: ASYMMETRIC_DECRYPT
193+
- label: RAW_ENCRYPT_DECRYPT
194+
value: RAW_ENCRYPT_DECRYPT
195+
- label: MAC
196+
value: MAC
197+
- label: KEY_ENCAPSULATION
198+
value: KEY_ENCAPSULATION
199+
set_decrypters_for:
200+
name: set_decrypters_for
201+
title: Set Decrypters For
202+
level: 1
203+
set_encrypters_for:
204+
name: set_encrypters_for
205+
title: Set Encrypters For
206+
level: 1
207+
set_owners_for:
208+
name: set_owners_for
209+
title: Set Owners For
210+
level: 1
211+
skip_initial_version_creation:
212+
name: skip_initial_version_creation
213+
title: Skip Initial Version Creation
214+
level: 1

‎metadata.yaml‎

Lines changed: 151 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,151 @@
1+
apiVersion: blueprints.cloud.google.com/v1alpha1
2+
kind: BlueprintMetadata
3+
metadata:
4+
name: terraform-google-kms
5+
annotations:
6+
config.kubernetes.io/local-config: "true"
7+
spec:
8+
info:
9+
title: Google KMS Terraform Module
10+
source:
11+
repo: https://github.com/anshukaira/terraform-google-kms.git
12+
sourceType: git
13+
version: 4.1.0
14+
actuationTool:
15+
flavor: Terraform
16+
version: ">= 1.3"
17+
description: {}
18+
content:
19+
subBlueprints:
20+
- name: autokey
21+
location: modules/autokey
22+
examples:
23+
- name: autokey_setup
24+
location: examples/autokey_setup
25+
- name: bucket_setup_using_autokey
26+
location: examples/bucket_setup_using_autokey
27+
- name: import_only_example
28+
location: examples/import_only_example
29+
- name: monitoring_alerts
30+
location: examples/monitoring_alerts
31+
- name: simple_example
32+
location: examples/simple_example
33+
interfaces:
34+
variables:
35+
- name: project_id
36+
description: Project id where the keyring will be created.
37+
varType: string
38+
required: true
39+
- name: location
40+
description: Location for the keyring.
41+
varType: string
42+
required: true
43+
- name: keyring
44+
description: Keyring name.
45+
varType: string
46+
required: true
47+
- name: keys
48+
description: Key names.
49+
varType: list(string)
50+
defaultValue: []
51+
- name: prevent_destroy
52+
description: Set the prevent_destroy lifecycle attribute on keys.
53+
varType: bool
54+
defaultValue: true
55+
- name: key_destroy_scheduled_duration
56+
description: Set the period of time that versions of keys spend in the DESTROY_SCHEDULED state before transitioning to DESTROYED.
57+
varType: string
58+
- name: purpose
59+
description: The immutable purpose of the CryptoKey. Default value is ENCRYPT_DECRYPT. See purpose reference (https://cloud.google.com/kms/docs/reference/rest/v1/projects.locations.keyRings.cryptoKeys#CryptoKeyPurpose) for possible inputs.
60+
varType: string
61+
defaultValue: ENCRYPT_DECRYPT
62+
- name: set_owners_for
63+
description: Name of keys for which owners will be set.
64+
varType: list(string)
65+
defaultValue: []
66+
- name: owners
67+
description: List of comma-separated owners for each key declared in set_owners_for.
68+
varType: list(string)
69+
defaultValue: []
70+
- name: set_encrypters_for
71+
description: Name of keys for which encrypters will be set.
72+
varType: list(string)
73+
defaultValue: []
74+
- name: encrypters
75+
description: List of comma-separated owners for each key declared in set_encrypters_for.
76+
varType: list(string)
77+
defaultValue: []
78+
- name: set_decrypters_for
79+
description: Name of keys for which decrypters will be set.
80+
varType: list(string)
81+
defaultValue: []
82+
- name: decrypters
83+
description: List of comma-separated owners for each key declared in set_decrypters_for.
84+
varType: list(string)
85+
defaultValue: []
86+
- name: key_rotation_period
87+
description: Generate a new key every time this period passes.
88+
varType: string
89+
defaultValue: 7776000s
90+
- name: key_algorithm
91+
description: The algorithm to use when creating a version based on this template. See the https://cloud.google.com/kms/docs/reference/rest/v1/CryptoKeyVersionAlgorithm for possible inputs.
92+
varType: string
93+
defaultValue: GOOGLE_SYMMETRIC_ENCRYPTION
94+
- name: key_protection_level
95+
description: "The protection level to use when creating a version based on this template. Default value: \"SOFTWARE\" Possible values: [\"SOFTWARE\", \"HSM\", \"EXTERNAL\", \"EXTERNAL_VPC\"]"
96+
varType: string
97+
defaultValue: SOFTWARE
98+
- name: labels
99+
description: Labels, provided as a map
100+
varType: map(string)
101+
defaultValue: {}
102+
- name: import_only
103+
description: Whether these keys may contain imported versions only.
104+
varType: bool
105+
defaultValue: false
106+
- name: skip_initial_version_creation
107+
description: If set to true, the request will create CryptoKeys without any CryptoKeyVersions.
108+
varType: bool
109+
defaultValue: false
110+
- name: crypto_key_backend
111+
description: (Optional) The resource name of the backend environment associated with all CryptoKeyVersions within this CryptoKey. The resource name is in the format 'projects//locations//ekmConnections/*' and only applies to 'EXTERNAL_VPC' keys.
112+
varType: string
113+
outputs:
114+
- name: keyring
115+
description: Self link of the keyring.
116+
type: string
117+
- name: keyring_name
118+
description: Name of the keyring.
119+
type: string
120+
- name: keyring_resource
121+
description: Keyring resource.
122+
type:
123+
- object
124+
- id: string
125+
location: string
126+
name: string
127+
project: string
128+
timeouts:
129+
- object
130+
- create: string
131+
delete: string
132+
- name: keys
133+
description: Map of key name => key self link.
134+
type:
135+
- map
136+
- string
137+
requirements:
138+
roles:
139+
- level: Project
140+
roles:
141+
- roles/cloudkms.admin
142+
- roles/owner
143+
services:
144+
- cloudkms.googleapis.com
145+
- serviceusage.googleapis.com
146+
- cloudresourcemanager.googleapis.com
147+
- monitoring.googleapis.com
148+
- logging.googleapis.com
149+
providerVersions:
150+
- source: hashicorp/google
151+
version: ">= 5.31.0, < 8"

0 commit comments

Comments
 (0)