Add example

GoogleCloudPlatform · Dec 18, 2024 · 137f548 · 137f548
1 parent 9c1d31c
commit 137f548
Show file tree

Hide file tree

Showing 2 changed files with 162 additions and 0 deletions.
diff --git a/...esourcemanager/securesourcemanagerinstance/securesourcemanagerinstanceprivate/create.yaml b/...esourcemanager/securesourcemanagerinstance/securesourcemanagerinstanceprivate/create.yaml
@@ -0,0 +1,26 @@
+# Copyright 2024 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: securesourcemanager.cnrm.cloud.google.com/v1alpha1
+kind: SecureSourceManagerInstance
+metadata:
+  name: ssminstance-${uniqueId}
+spec:
+  location: us-central1
+  projectRef:
+    external: ${projectId}
+  privateConfig:
+    isPrivate: true
+    caPoolRef:
+      name: privatecacapool-${uniqueId}
diff --git a/...emanager/securesourcemanagerinstance/securesourcemanagerinstanceprivate/dependencies.yaml b/...emanager/securesourcemanagerinstance/securesourcemanagerinstanceprivate/dependencies.yaml
@@ -0,0 +1,136 @@
+# Copyright 2024 Google LLC
+#
+# Licensed under the Apache License, Version 2.0 (the "License");
+# you may not use this file except in compliance with the License.
+# You may obtain a copy of the License at
+#
+#      http://www.apache.org/licenses/LICENSE-2.0
+#
+# Unless required by applicable law or agreed to in writing, software
+# distributed under the License is distributed on an "AS IS" BASIS,
+# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+apiVersion: privateca.cnrm.cloud.google.com/v1beta1
+kind: PrivateCACAPool
+metadata:
+  labels:
+    label-two: "value-two"
+  name: privatecacapool-${uniqueId}
+spec:
+  projectRef:
+    external: projects/${projectId}
+  location: "us-central1"
+  tier: ENTERPRISE
+  issuancePolicy:
+    allowedKeyTypes:
+    - rsa:
+        minModulusSize: 64
+        maxModulusSize: 128
+    - ellipticCurve:
+        signatureAlgorithm: ECDSA_P384
+    maximumLifetime: 43200s
+    allowedIssuanceModes:
+      allowCsrBasedIssuance: true
+      allowConfigBasedIssuance: false
+    baselineValues:
+      keyUsage:
+        baseKeyUsage:
+          digitalSignature: false
+          contentCommitment: false
+          keyEncipherment: false
+          dataEncipherment: false
+          keyAgreement: false
+          certSign: false
+          crlSign: false
+          encipherOnly: false
+          decipherOnly: false
+        extendedKeyUsage:
+          serverAuth: false
+          clientAuth: false
+          codeSigning: false
+          emailProtection: false
+          timeStamping: false
+          ocspSigning: false
+        unknownExtendedKeyUsages:
+        - objectIdPath:
+          - 1
+          - 7
+      caOptions:
+        isCa: false
+        maxIssuerPathLength: 7
+      policyIds:
+      - objectIdPath:
+        - 1
+        - 7
+      aiaOcspServers:
+      - string
+      additionalExtensions:
+      - objectId:
+          objectIdPath:
+          - 1
+          - 7
+        critical: false
+        value: c3RyaW5nCg==
+    identityConstraints:
+      celExpression:
+        title: Sample expression
+        description: Always false
+        expression: 'false'
+        location: devops.ca_pool.json
+      allowSubjectPassthrough: false
+      allowSubjectAltNamesPassthrough: false
+    passthroughExtensions:
+      knownExtensions:
+      - BASE_KEY_USAGE
+      additionalExtensions:
+      - objectIdPath:
+        - 1
+        - 7
+---
+apiVersion: privateca.cnrm.cloud.google.com/v1beta1
+kind: PrivateCACertificateAuthority
+metadata:
+  labels:
+    label-two: "value-two"
+  name: privatecacertificateauthority-${uniqueId}
+spec:
+  projectRef:
+    external: projects/${projectId}
+  location: "us-central1"
+  type: SELF_SIGNED
+  caPoolRef:
+    name: privatecacapool-${uniqueId}
+  lifetime: 86400s
+  config:
+    subjectConfig:
+      subject:
+        organization: Example
+        commonName: my-certificate-authority
+      subjectAltName:
+        dnsNames:
+        - example.com
+    x509Config:
+      caOptions:
+        isCa: true
+      keyUsage:
+        baseKeyUsage:
+          certSign: true
+          crlSign: true
+        extendedKeyUsage:
+          serverAuth: true
+  keySpec:
+    algorithm: RSA_PKCS1_4096_SHA256
+---
+apiVersion: iam.cnrm.cloud.google.com/v1beta1
+kind: IAMPolicyMember
+metadata:
+  name: iampolicymember-${uniqueId}
+spec:
+  member: serviceAccount:service-${projectNumber}@gcp-sa-sourcemanager.iam.gserviceaccount.com
+  role: roles/privateca.certificateRequester
+  resourceRef:
+    apiVersion: privateca.cnrm.cloud.google.com/v1beta1
+    kind: PrivateCACAPool
+    name: privatecacapool-${uniqueId}