Skip to content

Commit f909e0f

Browse files
anshukairaanshukaira
committed
chore: Making kms module adc compliant
1 parent a03c8c7 commit f909e0f

File tree

5 files changed

+496
-1
lines changed

5 files changed

+496
-1
lines changed

‎Makefile‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -76,9 +76,10 @@ docker_test_lint:
7676
.PHONY: docker_generate_docs
7777
docker_generate_docs:
7878
docker run --rm -it \
79+
-e ENABLE_BPMETADATA=1 \
7980
-v "$(CURDIR)":/workspace \
8081
$(REGISTRY_URL)/${DOCKER_IMAGE_DEVELOPER_TOOLS}:${DOCKER_TAG_VERSION_DEVELOPER_TOOLS} \
81-
/bin/bash -c 'source /usr/local/bin/task_helper_functions.sh && generate_docs'
82+
/bin/bash -c 'source /usr/local/bin/task_helper_functions.sh && generate_docs display'
8283

8384
# Alias for backwards compatibility
8485
.PHONY: generate_docs

‎metadata.display.yaml‎

Lines changed: 214 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,214 @@
1+
# Copyright 2025 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
apiVersion: blueprints.cloud.google.com/v1alpha1
16+
kind: BlueprintMetadata
17+
metadata:
18+
name: terraform-google-kms-display
19+
annotations:
20+
config.kubernetes.io/local-config: "true"
21+
spec:
22+
info:
23+
title: Google KMS Terraform Module
24+
source:
25+
repo: https://github.com/anshukaira/terraform-google-kms.git
26+
sourceType: git
27+
ui:
28+
input:
29+
variables:
30+
crypto_key_backend:
31+
name: crypto_key_backend
32+
title: Crypto Key Backend
33+
level: 1
34+
decrypters:
35+
name: decrypters
36+
title: Decrypters
37+
level: 1
38+
encrypters:
39+
name: encrypters
40+
title: Encrypters
41+
level: 1
42+
import_only:
43+
name: import_only
44+
title: Import Only
45+
level: 1
46+
key_algorithm:
47+
name: key_algorithm
48+
title: Key Algorithm
49+
level: 1
50+
enumValueLabels:
51+
- label: CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED
52+
value: CRYPTO_KEY_VERSION_ALGORITHM_UNSPECIFIED
53+
- label: GOOGLE_SYMMETRIC_ENCRYPTION
54+
value: GOOGLE_SYMMETRIC_ENCRYPTION
55+
- label: AES_128_GCM
56+
value: AES_128_GCM
57+
- label: AES_256_GCM
58+
value: AES_256_GCM
59+
- label: AES_128_CBC
60+
value: AES_128_CBC
61+
- label: AES_256_CBC
62+
value: AES_256_CBC
63+
- label: AES_128_CTR
64+
value: AES_128_CTR
65+
- label: AES_256_CTR
66+
value: AES_256_CTR
67+
- label: RSA_SIGN_PSS_2048_SHA256
68+
value: RSA_SIGN_PSS_2048_SHA256
69+
- label: RSA_SIGN_PSS_3072_SHA256
70+
value: RSA_SIGN_PSS_3072_SHA256
71+
- label: RSA_SIGN_PSS_4096_SHA256
72+
value: RSA_SIGN_PSS_4096_SHA256
73+
- label: RSA_SIGN_PSS_4096_SHA512
74+
value: RSA_SIGN_PSS_4096_SHA512
75+
- label: RSA_SIGN_PKCS1_2048_SHA256
76+
value: RSA_SIGN_PKCS1_2048_SHA256
77+
- label: RSA_SIGN_PKCS1_3072_SHA256
78+
value: RSA_SIGN_PKCS1_3072_SHA256
79+
- label: RSA_SIGN_PKCS1_4096_SHA256
80+
value: RSA_SIGN_PKCS1_4096_SHA256
81+
- label: RSA_SIGN_PKCS1_4096_SHA512
82+
value: RSA_SIGN_PKCS1_4096_SHA512
83+
- label: RSA_SIGN_RAW_PKCS1_2048
84+
value: RSA_SIGN_RAW_PKCS1_2048
85+
- label: RSA_SIGN_RAW_PKCS1_3072
86+
value: RSA_SIGN_RAW_PKCS1_3072
87+
- label: RSA_SIGN_RAW_PKCS1_4096
88+
value: RSA_SIGN_RAW_PKCS1_4096
89+
- label: RSA_DECRYPT_OAEP_2048_SHA256
90+
value: RSA_DECRYPT_OAEP_2048_SHA256
91+
- label: RSA_DECRYPT_OAEP_3072_SHA256
92+
value: RSA_DECRYPT_OAEP_3072_SHA256
93+
- label: RSA_DECRYPT_OAEP_4096_SHA256
94+
value: RSA_DECRYPT_OAEP_4096_SHA256
95+
- label: RSA_DECRYPT_OAEP_4096_SHA512
96+
value: RSA_DECRYPT_OAEP_4096_SHA512
97+
- label: RSA_DECRYPT_OAEP_2048_SHA1
98+
value: RSA_DECRYPT_OAEP_2048_SHA1
99+
- label: RSA_DECRYPT_OAEP_3072_SHA1
100+
value: RSA_DECRYPT_OAEP_3072_SHA1
101+
- label: RSA_DECRYPT_OAEP_4096_SHA1
102+
value: RSA_DECRYPT_OAEP_4096_SHA1
103+
- label: EC_SIGN_P256_SHA256
104+
value: EC_SIGN_P256_SHA256
105+
- label: EC_SIGN_P384_SHA384
106+
value: EC_SIGN_P384_SHA384
107+
- label: EC_SIGN_SECP256K1_SHA256
108+
value: EC_SIGN_SECP256K1_SHA256
109+
- label: EC_SIGN_ED25519
110+
value: EC_SIGN_ED25519
111+
- label: HMAC_SHA256
112+
value: HMAC_SHA256
113+
- label: HMAC_SHA1
114+
value: HMAC_SHA1
115+
- label: HMAC_SHA384
116+
value: HMAC_SHA384
117+
- label: HMAC_SHA512
118+
value: HMAC_SHA512
119+
- label: HMAC_SHA224
120+
value: HMAC_SHA224
121+
- label: EXTERNAL_SYMMETRIC_ENCRYPTION
122+
value: EXTERNAL_SYMMETRIC_ENCRYPTION
123+
- label: ML_KEM_768
124+
value: ML_KEM_768
125+
- label: ML_KEM_1024
126+
value: ML_KEM_1024
127+
- label: KEM_XWING
128+
value: KEM_XWING
129+
- label: PQ_SIGN_ML_DSA_65
130+
value: PQ_SIGN_ML_DSA_65
131+
- label: PQ_SIGN_SLH_DSA_SHA2_128S
132+
value: PQ_SIGN_SLH_DSA_SHA2_128S
133+
- label: PQ_SIGN_HASH_SLH_DSA_SHA2_128S_SHA256
134+
value: PQ_SIGN_HASH_SLH_DSA_SHA2_128S_SHA256
135+
key_destroy_scheduled_duration:
136+
name: key_destroy_scheduled_duration
137+
title: Key Destroy Scheduled Duration
138+
level: 1
139+
key_protection_level:
140+
name: key_protection_level
141+
title: Key Protection Level
142+
enumValueLabels:
143+
- label: SOFTWARE
144+
value: SOFTWARE
145+
- label: HSM
146+
value: HSM
147+
- label: EXTERNAL
148+
value: EXTERNAL
149+
- label: EXTERNAL_VPC
150+
value: EXTERNAL_VPC
151+
level: 1
152+
key_rotation_period:
153+
name: key_rotation_period
154+
title: Key Rotation Period
155+
level: 1
156+
keyring:
157+
name: keyring
158+
title: Keyring
159+
keys:
160+
name: keys
161+
title: Keys
162+
regexValidation: ^[a-zA-Z0-9_-]{1,63}$
163+
validation: Keyring name must be 1-63 characters and can only contain letters, numbers, underscores, and hyphens.
164+
labels:
165+
name: labels
166+
title: Labels
167+
location:
168+
name: location
169+
title: Location
170+
owners:
171+
name: owners
172+
title: Owners
173+
level: 1
174+
prevent_destroy:
175+
name: prevent_destroy
176+
title: Prevent Destroy
177+
level: 1
178+
project_id:
179+
name: project_id
180+
title: Project Id
181+
purpose:
182+
name: purpose
183+
title: Purpose
184+
enumValueLabels:
185+
- label: CRYPTO_KEY_PURPOSE_UNSPECIFIED
186+
value: CRYPTO_KEY_PURPOSE_UNSPECIFIED
187+
- label: ENCRYPT_DECRYPT
188+
value: ENCRYPT_DECRYPT
189+
- label: ASYMMETRIC_SIGN
190+
value: ASYMMETRIC_SIGN
191+
- label: ASYMMETRIC_DECRYPT
192+
value: ASYMMETRIC_DECRYPT
193+
- label: RAW_ENCRYPT_DECRYPT
194+
value: RAW_ENCRYPT_DECRYPT
195+
- label: MAC
196+
value: MAC
197+
- label: KEY_ENCAPSULATION
198+
value: KEY_ENCAPSULATION
199+
set_decrypters_for:
200+
name: set_decrypters_for
201+
title: Set Decrypters For
202+
level: 1
203+
set_encrypters_for:
204+
name: set_encrypters_for
205+
title: Set Encrypters For
206+
level: 1
207+
set_owners_for:
208+
name: set_owners_for
209+
title: Set Owners For
210+
level: 1
211+
skip_initial_version_creation:
212+
name: skip_initial_version_creation
213+
title: Skip Initial Version Creation
214+
level: 1

‎metadata.yaml‎

Lines changed: 165 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,165 @@
1+
# Copyright 2025 Google LLC
2+
#
3+
# Licensed under the Apache License, Version 2.0 (the "License");
4+
# you may not use this file except in compliance with the License.
5+
# You may obtain a copy of the License at
6+
#
7+
# http://www.apache.org/licenses/LICENSE-2.0
8+
#
9+
# Unless required by applicable law or agreed to in writing, software
10+
# distributed under the License is distributed on an "AS IS" BASIS,
11+
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
12+
# See the License for the specific language governing permissions and
13+
# limitations under the License.
14+
15+
apiVersion: blueprints.cloud.google.com/v1alpha1
16+
kind: BlueprintMetadata
17+
metadata:
18+
name: terraform-google-kms
19+
annotations:
20+
config.kubernetes.io/local-config: "true"
21+
spec:
22+
info:
23+
title: Google KMS Terraform Module
24+
source:
25+
repo: https://github.com/anshukaira/terraform-google-kms.git
26+
sourceType: git
27+
version: 4.1.0
28+
actuationTool:
29+
flavor: Terraform
30+
version: ">= 1.3"
31+
description: {}
32+
content:
33+
subBlueprints:
34+
- name: autokey
35+
location: modules/autokey
36+
examples:
37+
- name: autokey_setup
38+
location: examples/autokey_setup
39+
- name: bucket_setup_using_autokey
40+
location: examples/bucket_setup_using_autokey
41+
- name: import_only_example
42+
location: examples/import_only_example
43+
- name: monitoring_alerts
44+
location: examples/monitoring_alerts
45+
- name: simple_example
46+
location: examples/simple_example
47+
interfaces:
48+
variables:
49+
- name: project_id
50+
description: Project id where the keyring will be created.
51+
varType: string
52+
required: true
53+
- name: location
54+
description: Location for the keyring.
55+
varType: string
56+
required: true
57+
- name: keyring
58+
description: Keyring name.
59+
varType: string
60+
required: true
61+
- name: keys
62+
description: Key names.
63+
varType: list(string)
64+
defaultValue: []
65+
- name: prevent_destroy
66+
description: Set the prevent_destroy lifecycle attribute on keys.
67+
varType: bool
68+
defaultValue: true
69+
- name: key_destroy_scheduled_duration
70+
description: Set the period of time that versions of keys spend in the DESTROY_SCHEDULED state before transitioning to DESTROYED.
71+
varType: string
72+
- name: purpose
73+
description: The immutable purpose of the CryptoKey. Default value is ENCRYPT_DECRYPT. See purpose reference (https://cloud.google.com/kms/docs/reference/rest/v1/projects.locations.keyRings.cryptoKeys#CryptoKeyPurpose) for possible inputs.
74+
varType: string
75+
defaultValue: ENCRYPT_DECRYPT
76+
- name: set_owners_for
77+
description: Name of keys for which owners will be set.
78+
varType: list(string)
79+
defaultValue: []
80+
- name: owners
81+
description: List of comma-separated owners for each key declared in set_owners_for.
82+
varType: list(string)
83+
defaultValue: []
84+
- name: set_encrypters_for
85+
description: Name of keys for which encrypters will be set.
86+
varType: list(string)
87+
defaultValue: []
88+
- name: encrypters
89+
description: List of comma-separated owners for each key declared in set_encrypters_for.
90+
varType: list(string)
91+
defaultValue: []
92+
- name: set_decrypters_for
93+
description: Name of keys for which decrypters will be set.
94+
varType: list(string)
95+
defaultValue: []
96+
- name: decrypters
97+
description: List of comma-separated owners for each key declared in set_decrypters_for.
98+
varType: list(string)
99+
defaultValue: []
100+
- name: key_rotation_period
101+
description: Generate a new key every time this period passes.
102+
varType: string
103+
defaultValue: 7776000s
104+
- name: key_algorithm
105+
description: The algorithm to use when creating a version based on this template. See the https://cloud.google.com/kms/docs/reference/rest/v1/CryptoKeyVersionAlgorithm for possible inputs.
106+
varType: string
107+
defaultValue: GOOGLE_SYMMETRIC_ENCRYPTION
108+
- name: key_protection_level
109+
description: "The protection level to use when creating a version based on this template. Default value: \"SOFTWARE\" Possible values: [\"SOFTWARE\", \"HSM\", \"EXTERNAL\", \"EXTERNAL_VPC\"]"
110+
varType: string
111+
defaultValue: SOFTWARE
112+
- name: labels
113+
description: Labels, provided as a map
114+
varType: map(string)
115+
defaultValue: {}
116+
- name: import_only
117+
description: Whether these keys may contain imported versions only.
118+
varType: bool
119+
defaultValue: false
120+
- name: skip_initial_version_creation
121+
description: If set to true, the request will create CryptoKeys without any CryptoKeyVersions.
122+
varType: bool
123+
defaultValue: false
124+
- name: crypto_key_backend
125+
description: (Optional) The resource name of the backend environment associated with all CryptoKeyVersions within this CryptoKey. The resource name is in the format 'projects//locations//ekmConnections/*' and only applies to 'EXTERNAL_VPC' keys.
126+
varType: string
127+
outputs:
128+
- name: keyring
129+
description: Self link of the keyring.
130+
type: string
131+
- name: keyring_name
132+
description: Name of the keyring.
133+
type: string
134+
- name: keyring_resource
135+
description: Keyring resource.
136+
type:
137+
- object
138+
- id: string
139+
location: string
140+
name: string
141+
project: string
142+
timeouts:
143+
- object
144+
- create: string
145+
delete: string
146+
- name: keys
147+
description: Map of key name => key self link.
148+
type:
149+
- map
150+
- string
151+
requirements:
152+
roles:
153+
- level: Project
154+
roles:
155+
- roles/cloudkms.admin
156+
- roles/owner
157+
services:
158+
- cloudkms.googleapis.com
159+
- serviceusage.googleapis.com
160+
- cloudresourcemanager.googleapis.com
161+
- monitoring.googleapis.com
162+
- logging.googleapis.com
163+
providerVersions:
164+
- source: hashicorp/google
165+
version: ">= 5.31.0, < 8"

0 commit comments

Comments
 (0)