Skip to content

Commit

Permalink
feat: add CMEK fields (googleapis#845)
Browse files Browse the repository at this point in the history 
* feat: migrate bigtable retry/timeout settings to gRPC's service configs

Committer: @miraleung
PiperOrigin-RevId: 346894665

Source-Author: Google APIs <[email protected]>
Source-Date: Thu Dec 10 16:55:31 2020 -0800
Source-Repo: googleapis/googleapis
Source-Sha: cbbd3170bcf217e36ae72f4ac522449bf861346f
Source-Link: googleapis/googleapis@cbbd317

* fix: add retryableStatusCodes back to bigtable

Committer: @miraleung
PiperOrigin-RevId: 351852297

Source-Author: Google APIs <[email protected]>
Source-Date: Thu Jan 14 12:19:44 2021 -0800
Source-Repo: googleapis/googleapis
Source-Sha: df49bfe877fff8c37f60855a7e754b7a4369709e
Source-Link: googleapis/googleapis@df49bfe

* feat: Publish new fields to support Customer Managed Encryption Keys (CMEK) on the existing Cloud Bigtable service methods.

PiperOrigin-RevId: 359130387

Source-Author: Google APIs <[email protected]>
Source-Date: Tue Feb 23 14:08:20 2021 -0800
Source-Repo: googleapis/googleapis
Source-Sha: eabec5a21219401bad79e1cc7d900c1658aee5fd
Source-Link: googleapis/googleapis@eabec5a
  • Loading branch information
@yoshi-automation
yoshi-automation authored Feb 25, 2021
1 parent 278c4dd commit 0381fb7
Show file tree
Hide file tree
Showing 9 changed files with 976 additions and 24 deletions.
29 changes: 26 additions & 3 deletions protos/google/bigtable/admin/v2/instance.proto
View file
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
// Copyright 2019 Google LLC.
// Copyright 2021 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
Expand All @@ -11,7 +11,6 @@
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
//

syntax = "proto3";

Expand All @@ -28,6 +27,10 @@ option java_outer_classname = "InstanceProto";
option java_package = "com.google.bigtable.admin.v2";
option php_namespace = "Google\\Cloud\\Bigtable\\Admin\\V2";
option ruby_package = "Google::Cloud::Bigtable::Admin::V2";
option (google.api.resource_definition) = {
type: "cloudkms.googleapis.com/CryptoKey"
pattern: "projects/{project}/locations/{location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}"
};

// A collection of Bigtable [Tables][google.bigtable.admin.v2.Table] and
// the resources that serve them.
Expand Down Expand Up @@ -113,6 +116,22 @@ message Cluster {
pattern: "projects/{project}/instances/{instance}/clusters/{cluster}"
};

// Cloud Key Management Service (Cloud KMS) settings for a CMEK-protected
// cluster.
message EncryptionConfig {
// Describes the Cloud KMS encryption key that will be used to protect the
// destination Bigtable cluster. The requirements for this key are:
// 1) The Cloud Bigtable service account associated with the project that
// contains this cluster must be granted the
// `cloudkms.cryptoKeyEncrypterDecrypter` role on the CMEK key.
// 2) Only regional keys can be used and the region of the CMEK key must
// match the region of the cluster.
// 3) All clusters within an instance must use the same CMEK key.
string kms_key_name = 1 [(google.api.resource_reference) = {
type: "cloudkms.googleapis.com/CryptoKey"
}];
}

// Possible states of a cluster.
enum State {
// The state of the cluster could not be determined.
Expand Down Expand Up @@ -162,6 +181,10 @@ message Cluster {
// The type of storage used by this cluster to serve its
// parent instance's tables, unless explicitly overridden.
StorageType default_storage_type = 5;

// Immutable. The encryption configuration for CMEK-protected clusters.
EncryptionConfig encryption_config = 6
[(google.api.field_behavior) = IMMUTABLE];
}

// A configuration object describing how Cloud Bigtable should treat traffic
Expand Down Expand Up @@ -194,7 +217,7 @@ message AppProfile {

// (`OutputOnly`)
// The unique name of the app profile. Values are of the form
// `projects/<project>/instances/<instance>/appProfiles/[_a-zA-Z0-9][-_.a-zA-Z0-9]*`.
// `projects/{project}/instances/{instance}/appProfiles/[_a-zA-Z0-9][-_.a-zA-Z0-9]*`.
string name = 1;

// Strongly validated etag for optimistic concurrency control. Preserve the
Expand Down
75 changes: 70 additions & 5 deletions protos/google/bigtable/admin/v2/table.proto
View file
Original file line number Diff line number Diff line change
@@ -1,4 +1,4 @@
// Copyright 2020 Google LLC
// Copyright 2021 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
Expand All @@ -20,6 +20,7 @@ import "google/api/field_behavior.proto";
import "google/api/resource.proto";
import "google/protobuf/duration.proto";
import "google/protobuf/timestamp.proto";
import "google/rpc/status.proto";

option csharp_namespace = "Google.Cloud.Bigtable.Admin.V2";
option go_package = "google.golang.org/genproto/googleapis/bigtable/admin/v2;admin";
Expand All @@ -28,6 +29,10 @@ option java_outer_classname = "TableProto";
option java_package = "com.google.bigtable.admin.v2";
option php_namespace = "Google\\Cloud\\Bigtable\\Admin\\V2";
option ruby_package = "Google::Cloud::Bigtable::Admin::V2";
option (google.api.resource_definition) = {
type: "cloudkms.googleapis.com/CryptoKeyVersion"
pattern: "projects/{project}/locations/{location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}/cryptoKeyVersions/{crypto_key_version}"
};

// Indicates the type of the restore source.
enum RestoreSourceType {
Expand Down Expand Up @@ -92,6 +97,14 @@ message Table {

// Output only. The state of replication for the table in this cluster.
ReplicationState replication_state = 1;

// Output only. The encryption information for the table in this cluster.
// If the encryption key protecting this resource is customer managed, then
// its version can be rotated in Cloud Key Management Service (Cloud KMS).
// The primary version of the key and its status will be reflected here when
// changes propagate from Cloud KMS.
repeated EncryptionInfo encryption_info = 2
[(google.api.field_behavior) = OUTPUT_ONLY];
}

// Possible timestamp granularities to use when keeping multiple versions
Expand Down Expand Up @@ -120,20 +133,23 @@ message Table {
// state.
REPLICATION_VIEW = 3;

// Only populates 'name' and fields related to the table's encryption state.
ENCRYPTION_VIEW = 5;

// Populates all fields.
FULL = 4;
}

// Output only. The unique name of the table. Values are of the form
// `projects/<project>/instances/<instance>/tables/[_a-zA-Z0-9][-_.a-zA-Z0-9]*`.
// The unique name of the table. Values are of the form
// `projects/{project}/instances/{instance}/tables/[_a-zA-Z0-9][-_.a-zA-Z0-9]*`.
// Views: `NAME_ONLY`, `SCHEMA_VIEW`, `REPLICATION_VIEW`, `FULL`
string name = 1;

// Output only. Map from cluster ID to per-cluster table state.
// If it could not be determined whether or not the table has data in a
// particular cluster (for example, if its zone is unavailable), then
// there will be an entry for the cluster with UNKNOWN `replication_status`.
// Views: `REPLICATION_VIEW`, `FULL`
// Views: `REPLICATION_VIEW`, `ENCRYPTION_VIEW`, `FULL`
map<string, ClusterState> cluster_states = 2;

// (`CreationOnly`)
Expand Down Expand Up @@ -196,6 +212,51 @@ message GcRule {
}
}

// Encryption information for a given resource.
// If this resource is protected with customer managed encryption, the in-use
// Cloud Key Management Service (Cloud KMS) key version is specified along with
// its status.
message EncryptionInfo {
// Possible encryption types for a resource.
enum EncryptionType {
// Encryption type was not specified, though data at rest remains encrypted.
ENCRYPTION_TYPE_UNSPECIFIED = 0;

// The data backing this resource is encrypted at rest with a key that is
// fully managed by Google. No key version or status will be populated.
// This is the default state.
GOOGLE_DEFAULT_ENCRYPTION = 1;

// The data backing this resource is encrypted at rest with a key that is
// managed by the customer.
// The in-use version of the key and its status are populated for
// CMEK-protected tables.
// CMEK-protected backups are pinned to the key version that was in use at
// the time the backup was taken. This key version is populated but its
// status is not tracked and is reported as `UNKNOWN`.
CUSTOMER_MANAGED_ENCRYPTION = 2;
}

// Output only. The type of encryption used to protect this resource.
EncryptionType encryption_type = 3
[(google.api.field_behavior) = OUTPUT_ONLY];

// Output only. The status of encrypt/decrypt calls on underlying data for
// this resource. Regardless of status, the existing data is always encrypted
// at rest.
google.rpc.Status encryption_status = 4
[(google.api.field_behavior) = OUTPUT_ONLY];

// Output only. The version of the Cloud KMS key specified in the parent
// cluster that is in use for the data underlying this table.
string kms_key_version = 2 [
(google.api.field_behavior) = OUTPUT_ONLY,
(google.api.resource_reference) = {
type: "cloudkms.googleapis.com/CryptoKeyVersion"
}
];
}

// A snapshot of a table at a particular time. A snapshot can be used as a
// checkpoint for data restoration or a data source for a new table.
//
Expand Down Expand Up @@ -225,7 +286,7 @@ message Snapshot {

// Output only. The unique name of the snapshot.
// Values are of the form
// `projects/<project>/instances/<instance>/clusters/<cluster>/snapshots/<snapshot>`.
// `projects/{project}/instances/{instance}/clusters/{cluster}/snapshots/{snapshot}`.
string name = 1;

// Output only. The source table at the time the snapshot was taken.
Expand Down Expand Up @@ -318,6 +379,10 @@ message Backup {

// Output only. The current state of the backup.
State state = 7 [(google.api.field_behavior) = OUTPUT_ONLY];

// Output only. The encryption information for the backup.
EncryptionInfo encryption_info = 9
[(google.api.field_behavior) = OUTPUT_ONLY];
}

// Information about a backup.
Expand Down
Loading

0 comments on commit 0381fb7

Please sign in to comment.