Add gcs SSE-KMS support

service.toml

@@ -15,12 +15,16 @@ optional = ["list_mode"]
 optional = ["offset", "io_callback", "size", "encryption_key"]
 
 [namespace.storage.op.write]
-optional = ["content_md5", "content_type", "io_callback", "storage_class", "encryption_key"]
+optional = ["content_md5", "content_type", "io_callback", "storage_class", "encryption_key", "kms_key_name"]
 
 [pairs.encryption_key]
 type = "byte_array"
 description = "is the customer's 32-byte AES-256 key"
 
+[pairs.kms_key_name]
+type = "string"
+description = "is the Cloud KMS key resource. For example, `projects/my-pet-project/locations/us-east1/keyRings/my-key-ring/cryptoKeys/my-key`.\n\nRefer to https://cloud.google.com/storage/docs/encryption/using-customer-managed-keys#add-object-key for more details."
+
 [pairs.default_service_pairs]
 type = "DefaultServicePairs"
 description = "set default pairs for service actions"

storage.go

@@ -193,6 +193,9 @@ func (s *Storage) write(ctx context.Context, path string, r io.Reader, size int6
 	if opt.HasStorageClass {
 		w.StorageClass = opt.StorageClass
 	}
+	if opt.HasKmsKeyName {
+		w.KMSKeyName = opt.KmsKeyName
+	}
 	if opt.HasIoCallback {
 		r = iowrap.CallbackReader(r, opt.IoCallback)
 	}