Skip to content
This repository was archived by the owner on Sep 5, 2023. It is now read-only.

feat: added support for CMEK #188

Merged
merged 2 commits into from
Jun 6, 2022
Merged

feat: added support for CMEK #188

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
f30600a
feat: added support for CMEK
gcf-owl-bot[bot] Jun 6, 2022
75cb3ba
🦉 Updates from OwlBot post-processor
gcf-owl-bot[bot] Jun 6, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 2 additions & 3 deletions google/cloud/functions_v1/services/cloud_functions_service/async_client.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -375,7 +375,6 @@ async def sample_get_function():
contains user computation executed in
response to an event. It encapsulate
function and triggers configurations.
Next tag: 36

"""
# Create or coerce a protobuf request object.
Expand Down Expand Up @@ -500,7 +499,7 @@ async def sample_create_function():

The result type for the operation will be :class:`google.cloud.functions_v1.types.CloudFunction` Describes a Cloud Function that contains user computation executed in
response to an event. It encapsulate function and
triggers configurations. Next tag: 36
triggers configurations.

"""
# Create or coerce a protobuf request object.
Expand Down Expand Up @@ -615,7 +614,7 @@ async def sample_update_function():

The result type for the operation will be :class:`google.cloud.functions_v1.types.CloudFunction` Describes a Cloud Function that contains user computation executed in
response to an event. It encapsulate function and
triggers configurations. Next tag: 36
triggers configurations.

"""
# Create or coerce a protobuf request object.
Expand Down
5 changes: 2 additions & 3 deletions google/cloud/functions_v1/services/cloud_functions_service/client.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -625,7 +625,6 @@ def sample_get_function():
contains user computation executed in
response to an event. It encapsulate
function and triggers configurations.
Next tag: 36

"""
# Create or coerce a protobuf request object.
Expand Down Expand Up @@ -740,7 +739,7 @@ def sample_create_function():

The result type for the operation will be :class:`google.cloud.functions_v1.types.CloudFunction` Describes a Cloud Function that contains user computation executed in
response to an event. It encapsulate function and
triggers configurations. Next tag: 36
triggers configurations.

"""
# Create or coerce a protobuf request object.
Expand Down Expand Up @@ -855,7 +854,7 @@ def sample_update_function():

The result type for the operation will be :class:`google.cloud.functions_v1.types.CloudFunction` Describes a Cloud Function that contains user computation executed in
response to an event. It encapsulate function and
triggers configurations. Next tag: 36
triggers configurations.

"""
# Create or coerce a protobuf request object.
Expand Down
62 changes: 53 additions & 9 deletions google/cloud/functions_v1/types/functions.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -58,7 +58,7 @@ class CloudFunctionStatus(proto.Enum):
class CloudFunction(proto.Message):
r"""Describes a Cloud Function that contains user computation
executed in response to an event. It encapsulate function and
triggers configurations. Next tag: 36
triggers configurations.

This message has `oneof`_ fields (mutually exclusive fields).
For each oneof, at most one member field can be set at the same time.
Expand Down Expand Up @@ -212,8 +212,10 @@ class CloudFunction(proto.Message):
repository using the ``docker_repository`` field that was
created with the same KMS crypto key.

The following service accounts need to be granted Cloud KMS
crypto key encrypter/decrypter roles on the key.
The following service accounts need to be granted the role
'Cloud KMS CryptoKey Encrypter/Decrypter
(roles/cloudkms.cryptoKeyEncrypterDecrypter)' on the
Key/KeyRing/Project/Organization (least access preferred).

1. Google Cloud Functions service account
(service-{project_number}@gcf-admin-robot.iam.gserviceaccount.com)
Expand Down Expand Up @@ -275,6 +277,14 @@ class CloudFunction(proto.Message):
Cross-project repositories are not supported. Cross-location
repositories are not supported. Repository format must be
'DOCKER'.
docker_registry (google.cloud.functions_v1.types.CloudFunction.DockerRegistry):
Docker Registry to use for this deployment.

If ``docker_repository`` field is specified, this field will
be automatically set as ``ARTIFACT_REGISTRY``. If
unspecified, it currently defaults to
``CONTAINER_REGISTRY``. This field may be overridden by the
backend for eligible deployments.
"""

class VpcConnectorEgressSettings(proto.Enum):
Expand All @@ -299,6 +309,12 @@ class IngressSettings(proto.Enum):
ALLOW_INTERNAL_ONLY = 2
ALLOW_INTERNAL_AND_GCLB = 3

class DockerRegistry(proto.Enum):
r"""Docker Registry to use for storing function Docker images."""
DOCKER_REGISTRY_UNSPECIFIED = 0
CONTAINER_REGISTRY = 1
ARTIFACT_REGISTRY = 2

name = proto.Field(
proto.STRING,
number=1,
Expand Down Expand Up @@ -445,6 +461,11 @@ class IngressSettings(proto.Enum):
proto.STRING,
number=34,
)
docker_registry = proto.Field(
proto.ENUM,
number=35,
enum=DockerRegistry,
)


class SourceRepository(proto.Message):
Expand Down Expand Up @@ -626,9 +647,7 @@ class Retry(proto.Message):
class SecretEnvVar(proto.Message):
r"""Configuration for a secret environment variable. It has the
information necessary to fetch the secret value from secret
manager and expose it as an environment variable. Secret value
is not a part of the configuration. Secret values are only
fetched when a new clone starts.
manager and expose it as an environment variable.

Attributes:
key (str):
Expand All @@ -648,7 +667,7 @@ class SecretEnvVar(proto.Message):
string 'latest'). It is recommended to use a
numeric version for secret environment variables
as any updates to the secret value is not
reflected until new clones start.
reflected until new instances start.
"""

key = proto.Field(
Expand Down Expand Up @@ -779,8 +798,8 @@ class UpdateFunctionRequest(proto.Message):
function (google.cloud.functions_v1.types.CloudFunction):
Required. New version of the function.
update_mask (google.protobuf.field_mask_pb2.FieldMask):
Required list of fields to be updated in this
request.
Required. The list of fields in ``CloudFunction`` that have
to be updated.
"""

function = proto.Field(
Expand Down Expand Up @@ -956,12 +975,37 @@ class GenerateUploadUrlRequest(proto.Message):
The project and location in which the Google Cloud Storage
signed URL should be generated, specified in the format
``projects/*/locations/*``.
kms_key_name (str):
Resource name of a KMS crypto key (managed by the user) used
to encrypt/decrypt function source code objects in staging
Cloud Storage buckets. When you generate an upload url and
upload your source code, it gets copied to a staging Cloud
Storage bucket in an internal regional project. The source
code is then copied to a versioned directory in the sources
bucket in the consumer project during the function
deployment.

It must match the pattern
``projects/{project}/locations/{location}/keyRings/{key_ring}/cryptoKeys/{crypto_key}``.

The Google Cloud Functions service account
(service-{project_number}@gcf-admin-robot.iam.gserviceaccount.com)
must be granted the role 'Cloud KMS CryptoKey
Encrypter/Decrypter
(roles/cloudkms.cryptoKeyEncrypterDecrypter)' on the
Key/KeyRing/Project/Organization (least access preferred).
GCF will delegate access to the Google Storage service
account in the internal project.
"""

parent = proto.Field(
proto.STRING,
number=1,
)
kms_key_name = proto.Field(
proto.STRING,
number=2,
)


class GenerateUploadUrlResponse(proto.Message):
Expand Down
2 changes: 1 addition & 1 deletion scripts/fixup_functions_v1_keywords.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -43,7 +43,7 @@ class functionsCallTransformer(cst.CSTTransformer):
'create_function': ('location', 'function', ),
'delete_function': ('name', ),
'generate_download_url': ('name', 'version_id', ),
'generate_upload_url': ('parent', ),
'generate_upload_url': ('parent', 'kms_key_name', ),
'get_function': ('name', ),
'get_iam_policy': ('resource', 'options', ),
'list_functions': ('parent', 'page_size', 'page_token', ),
Expand Down
10 changes: 10 additions & 0 deletions tests/unit/gapic/functions_v1/test_cloud_functions_service.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1073,6 +1073,7 @@ def test_get_function(request_type, transport: str = "grpc"):
build_name="build_name_value",
source_token="source_token_value",
docker_repository="docker_repository_value",
docker_registry=functions.CloudFunction.DockerRegistry.CONTAINER_REGISTRY,
source_archive_url="source_archive_url_value",
https_trigger=functions.HttpsTrigger(url="url_value"),
)
Expand Down Expand Up @@ -1110,6 +1111,10 @@ def test_get_function(request_type, transport: str = "grpc"):
assert response.build_name == "build_name_value"
assert response.source_token == "source_token_value"
assert response.docker_repository == "docker_repository_value"
assert (
response.docker_registry
== functions.CloudFunction.DockerRegistry.CONTAINER_REGISTRY
)


def test_get_function_empty_call():
Expand Down Expand Up @@ -1166,6 +1171,7 @@ async def test_get_function_async(
build_name="build_name_value",
source_token="source_token_value",
docker_repository="docker_repository_value",
docker_registry=functions.CloudFunction.DockerRegistry.CONTAINER_REGISTRY,
)
)
response = await client.get_function(request)
Expand Down Expand Up @@ -1202,6 +1208,10 @@ async def test_get_function_async(
assert response.build_name == "build_name_value"
assert response.source_token == "source_token_value"
assert response.docker_repository == "docker_repository_value"
assert (
response.docker_registry
== functions.CloudFunction.DockerRegistry.CONTAINER_REGISTRY
)


@pytest.mark.asyncio
Expand Down