GCP: support specifying Cloud KMS key name for backup storage locations

Gopkg.toml

@@ -72,11 +72,11 @@
 
 [[constraint]]
   name = "cloud.google.com/go"
-  version = "0.11.0"
+  version = "0.46.0"
 
 [[constraint]]
   name = "google.golang.org/api"
-  version = "~v0.3.2"
+  version = "~v0.9.0"
 
 [[constraint]]
   name = "golang.org/x/oauth2"

changelogs/unreleased/1879-skriss

@@ -0,0 +1 @@
+GCP: add support for specifying a Cloud KMS key name to use for encrypting backups in a storage location.

pkg/cloudprovider/gcp/object_store.go

@@ -33,7 +33,10 @@ import (
 	"github.com/heptio/velero/pkg/cloudprovider"
 )
 
-const credentialsEnvVar = "GOOGLE_APPLICATION_CREDENTIALS"
+const (
+	credentialsEnvVar   = "GOOGLE_APPLICATION_CREDENTIALS"
+	kmsKeyNameConfigKey = "kmsKeyName"
+)
 
 // bucketWriter wraps the GCP SDK functions for accessing object store so they can be faked for testing.
 type bucketWriter interface {
@@ -43,11 +46,15 @@ type bucketWriter interface {
 }
 
 type writer struct {
-	client *storage.Client
+	client     *storage.Client
+	kmsKeyName string
 }
 
 func (w *writer) getWriteCloser(bucket, key string) io.WriteCloser {
-	return w.client.Bucket(bucket).Object(key).NewWriter(context.Background())
+	writer := w.client.Bucket(bucket).Object(key).NewWriter(context.Background())
+	writer.KMSKeyName = w.kmsKeyName
+
+	return writer
 }
 
 func (w *writer) getAttrs(bucket, key string) (*storage.ObjectAttrs, error) {
@@ -67,7 +74,7 @@ func NewObjectStore(logger logrus.FieldLogger) *ObjectStore {
 }
 
 func (o *ObjectStore) Init(config map[string]string) error {
-	if err := cloudprovider.ValidateObjectStoreConfigKeys(config); err != nil {
+	if err := cloudprovider.ValidateObjectStoreConfigKeys(config, kmsKeyNameConfigKey); err != nil {
 		return err
 	}
 
@@ -101,7 +108,10 @@ func (o *ObjectStore) Init(config map[string]string) error {
 	}
 	o.client = client
 
-	o.bucketWriter = &writer{client: o.client}
+	o.bucketWriter = &writer{
+		client:     o.client,
+		kmsKeyName: config[kmsKeyNameConfigKey],
+	}
 
 	return nil
 }

site/docs/master/api-types/backupstoragelocation.md

@@ -67,7 +67,9 @@ The configurable parameters are as follows:
 
 #### GCP
 
-No parameters required.
+| Key | Type | Default | Meaning |
+| --- | --- | --- | --- |
+| `kmsKeyName` | string | Empty | Name of the Cloud KMS key to use to encrypt backups stored in this location, in the form `projects/P/locations/L/keyRings/R/cryptoKeys/K`. See [customer-managed Cloud KMS keys](https://cloud.google.com/storage/docs/encryption/using-customer-managed-keys) for details.  |
 
 [0]: #aws
 [1]: #gcp