Skip to content

feat(secretmanager): add support for Managed Rotation #34754

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
gcf-owl-bot wants to merge 2 commits into
base: main
Choose a base branch
from
Open

feat(secretmanager): add support for Managed Rotation #34754

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
34dd0e1
feat(secretmanager): add support for Managed Rotation
gcf-owl-bot[bot] Jul 13, 2026
e918e95
🦉 Updates from OwlBot post-processor
gcf-owl-bot[bot] Jul 13, 2026
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
5 changes: 5 additions & 0 deletions google-cloud-secret_manager-v1/.owlbot-manifest.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,10 +38,13 @@
"proto_docs/google/iam/v1/iam_policy.rb",
"proto_docs/google/iam/v1/options.rb",
"proto_docs/google/iam/v1/policy.rb",
"proto_docs/google/iam/v1/resource_policy_member.rb",
"proto_docs/google/protobuf/any.rb",
"proto_docs/google/protobuf/duration.rb",
"proto_docs/google/protobuf/empty.rb",
"proto_docs/google/protobuf/field_mask.rb",
"proto_docs/google/protobuf/timestamp.rb",
"proto_docs/google/rpc/status.rb",
"proto_docs/google/type/expr.rb",
"snippets/Gemfile",
"snippets/secret_manager_service/access_secret_version.rb",
Expand All @@ -50,12 +53,14 @@
"snippets/secret_manager_service/delete_secret.rb",
"snippets/secret_manager_service/destroy_secret_version.rb",
"snippets/secret_manager_service/disable_secret_version.rb",
"snippets/secret_manager_service/enable_managed_rotation.rb",
"snippets/secret_manager_service/enable_secret_version.rb",
"snippets/secret_manager_service/get_iam_policy.rb",
"snippets/secret_manager_service/get_secret.rb",
"snippets/secret_manager_service/get_secret_version.rb",
"snippets/secret_manager_service/list_secret_versions.rb",
"snippets/secret_manager_service/list_secrets.rb",
"snippets/secret_manager_service/rotate_secret.rb",
"snippets/secret_manager_service/set_iam_policy.rb",
"snippets/secret_manager_service/test_iam_permissions.rb",
"snippets/secret_manager_service/update_secret.rb",
Expand Down
10 changes: 10 additions & 0 deletions google-cloud-secret_manager-v1/gapic_metadata.json
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -84,6 +84,16 @@
"methods": [
"test_iam_permissions"
]
},
"EnableManagedRotation": {
"methods": [
"enable_managed_rotation"
]
},
"RotateSecret": {
"methods": [
"rotate_secret"
]
}
}
}
Expand Down
198 changes: 198 additions & 0 deletions ...oud-secret_manager-v1/lib/google/cloud/secret_manager/v1/secret_manager_service/client.rb
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1685,6 +1685,190 @@ def test_iam_permissions request, options = nil
raise ::Google::Cloud::Error.from_error(e)
end

##
# Enables the managed rotation feature for a
# {::Google::Cloud::SecretManager::V1::Secret Secret}. This method can only be
# triggered once for a secret. In order to do further rotations, RotateSecret
# should be used. This method will add a secret version and update the
# password in Cloud SQL.
#
# @overload enable_managed_rotation(request, options = nil)
# Pass arguments to `enable_managed_rotation` via a request object, either of type
# {::Google::Cloud::SecretManager::V1::EnableManagedRotationRequest} or an equivalent Hash.
#
# @param request [::Google::Cloud::SecretManager::V1::EnableManagedRotationRequest, ::Hash]
# A request object representing the call parameters. Required. To specify no
# parameters, or to keep all the default parameter values, pass an empty Hash.
# @param options [::Gapic::CallOptions, ::Hash]
# Overrides the default settings for this call, e.g, timeout, retries, etc. Optional.
#
# @overload enable_managed_rotation(parent: nil, cloud_sql_single_user_credentials: nil)
# Pass arguments to `enable_managed_rotation` via keyword arguments. Note that at
# least one keyword argument is required. To specify no parameters, or to keep all
# the default parameter values, pass an empty Hash as a request object (see above).
#
# @param parent [::String]
# Required. The resource name of the
# {::Google::Cloud::SecretManager::V1::Secret Secret} to associate with the
# {::Google::Cloud::SecretManager::V1::SecretVersion SecretVersion} in the format
# `projects/*/secrets/*` or `projects/*/locations/*/secrets/*`.
# @param cloud_sql_single_user_credentials [::Google::Cloud::SecretManager::V1::EnableManagedRotationRequest::CloudSQLSingleUserCredentials, ::Hash]
# Credentials required for Cloud SQL DB for Single user Managed Rotation.
#
# @yield [response, operation] Access the result along with the RPC operation
# @yieldparam response [::Google::Cloud::SecretManager::V1::SecretVersion]
# @yieldparam operation [::GRPC::ActiveCall::Operation]
#
# @return [::Google::Cloud::SecretManager::V1::SecretVersion]
#
# @raise [::Google::Cloud::Error] if the RPC is aborted.
#
# @example Basic example
# require "google/cloud/secret_manager/v1"
#
# # Create a client object. The client can be reused for multiple calls.
# client = Google::Cloud::SecretManager::V1::SecretManagerService::Client.new
#
# # Create a request. To set request fields, pass in keyword arguments.
# request = Google::Cloud::SecretManager::V1::EnableManagedRotationRequest.new
#
# # Call the enable_managed_rotation method.
# result = client.enable_managed_rotation request
#
# # The returned object is of type Google::Cloud::SecretManager::V1::SecretVersion.
# p result
#
def enable_managed_rotation request, options = nil
raise ::ArgumentError, "request must be provided" if request.nil?

request = ::Gapic::Protobuf.coerce request, to: ::Google::Cloud::SecretManager::V1::EnableManagedRotationRequest

# Converts hash and nil to an options object
options = ::Gapic::CallOptions.new(**options.to_h) if options.respond_to? :to_h

# Customize the options with defaults
metadata = @config.rpcs.enable_managed_rotation.metadata.to_h

# Set x-goog-api-client, x-goog-user-project and x-goog-api-version headers
metadata[:"x-goog-api-client"] ||= ::Gapic::Headers.x_goog_api_client \
lib_name: @config.lib_name, lib_version: @config.lib_version,
gapic_version: ::Google::Cloud::SecretManager::V1::VERSION
metadata[:"x-goog-api-version"] = API_VERSION unless API_VERSION.empty?
metadata[:"x-goog-user-project"] = @quota_project_id if @quota_project_id

header_params = {}
if request.parent
header_params["parent"] = request.parent
end

request_params_header = header_params.map { |k, v| "#{k}=#{v}" }.join("&")
metadata[:"x-goog-request-params"] ||= request_params_header

options.apply_defaults timeout: @config.rpcs.enable_managed_rotation.timeout,
metadata: metadata,
retry_policy: @config.rpcs.enable_managed_rotation.retry_policy

options.apply_defaults timeout: @config.timeout,
metadata: @config.metadata,
retry_policy: @config.retry_policy

@secret_manager_service_stub.call_rpc :enable_managed_rotation, request, options: options do |response, operation|
yield response, operation if block_given?
end
rescue ::GRPC::BadStatus => e
raise ::Google::Cloud::Error.from_error(e)
end

##
# Do a managed rotation for a {::Google::Cloud::SecretManager::V1::Secret Secret}.
# This can only be triggered after Managed rotation has been enabled.
# This method will add a secret version and update the password in Cloud SQL.
#
# @overload rotate_secret(request, options = nil)
# Pass arguments to `rotate_secret` via a request object, either of type
# {::Google::Cloud::SecretManager::V1::RotateSecretRequest} or an equivalent Hash.
#
# @param request [::Google::Cloud::SecretManager::V1::RotateSecretRequest, ::Hash]
# A request object representing the call parameters. Required. To specify no
# parameters, or to keep all the default parameter values, pass an empty Hash.
# @param options [::Gapic::CallOptions, ::Hash]
# Overrides the default settings for this call, e.g, timeout, retries, etc. Optional.
#
# @overload rotate_secret(parent: nil)
# Pass arguments to `rotate_secret` via keyword arguments. Note that at
# least one keyword argument is required. To specify no parameters, or to keep all
# the default parameter values, pass an empty Hash as a request object (see above).
#
# @param parent [::String]
# Required. The resource name of the
# {::Google::Cloud::SecretManager::V1::Secret Secret} to associate with the
# {::Google::Cloud::SecretManager::V1::SecretVersion SecretVersion} in the format
# `projects/*/secrets/*` or `projects/*/locations/*/secrets/*`.
#
# @yield [response, operation] Access the result along with the RPC operation
# @yieldparam response [::Google::Cloud::SecretManager::V1::SecretVersion]
# @yieldparam operation [::GRPC::ActiveCall::Operation]
#
# @return [::Google::Cloud::SecretManager::V1::SecretVersion]
#
# @raise [::Google::Cloud::Error] if the RPC is aborted.
#
# @example Basic example
# require "google/cloud/secret_manager/v1"
#
# # Create a client object. The client can be reused for multiple calls.
# client = Google::Cloud::SecretManager::V1::SecretManagerService::Client.new
#
# # Create a request. To set request fields, pass in keyword arguments.
# request = Google::Cloud::SecretManager::V1::RotateSecretRequest.new
#
# # Call the rotate_secret method.
# result = client.rotate_secret request
#
# # The returned object is of type Google::Cloud::SecretManager::V1::SecretVersion.
# p result
#
def rotate_secret request, options = nil
raise ::ArgumentError, "request must be provided" if request.nil?

request = ::Gapic::Protobuf.coerce request, to: ::Google::Cloud::SecretManager::V1::RotateSecretRequest

# Converts hash and nil to an options object
options = ::Gapic::CallOptions.new(**options.to_h) if options.respond_to? :to_h

# Customize the options with defaults
metadata = @config.rpcs.rotate_secret.metadata.to_h

# Set x-goog-api-client, x-goog-user-project and x-goog-api-version headers
metadata[:"x-goog-api-client"] ||= ::Gapic::Headers.x_goog_api_client \
lib_name: @config.lib_name, lib_version: @config.lib_version,
gapic_version: ::Google::Cloud::SecretManager::V1::VERSION
metadata[:"x-goog-api-version"] = API_VERSION unless API_VERSION.empty?
metadata[:"x-goog-user-project"] = @quota_project_id if @quota_project_id

header_params = {}
if request.parent
header_params["parent"] = request.parent
end

request_params_header = header_params.map { |k, v| "#{k}=#{v}" }.join("&")
metadata[:"x-goog-request-params"] ||= request_params_header

options.apply_defaults timeout: @config.rpcs.rotate_secret.timeout,
metadata: metadata,
retry_policy: @config.rpcs.rotate_secret.retry_policy

options.apply_defaults timeout: @config.timeout,
metadata: @config.metadata,
retry_policy: @config.retry_policy

@secret_manager_service_stub.call_rpc :rotate_secret, request, options: options do |response, operation|
yield response, operation if block_given?
end
rescue ::GRPC::BadStatus => e
raise ::Google::Cloud::Error.from_error(e)
end

##
# Configuration class for the SecretManagerService API.
#
Expand Down Expand Up @@ -1945,6 +2129,16 @@ class Rpcs
# @return [::Gapic::Config::Method]
#
attr_reader :test_iam_permissions
##
# RPC-specific configuration for `enable_managed_rotation`
# @return [::Gapic::Config::Method]
#
attr_reader :enable_managed_rotation
##
# RPC-specific configuration for `rotate_secret`
# @return [::Gapic::Config::Method]
#
attr_reader :rotate_secret

# @private
def initialize parent_rpcs = nil
Expand Down Expand Up @@ -1978,6 +2172,10 @@ def initialize parent_rpcs = nil
@get_iam_policy = ::Gapic::Config::Method.new get_iam_policy_config
test_iam_permissions_config = parent_rpcs.test_iam_permissions if parent_rpcs.respond_to? :test_iam_permissions
@test_iam_permissions = ::Gapic::Config::Method.new test_iam_permissions_config
enable_managed_rotation_config = parent_rpcs.enable_managed_rotation if parent_rpcs.respond_to? :enable_managed_rotation
@enable_managed_rotation = ::Gapic::Config::Method.new enable_managed_rotation_config
rotate_secret_config = parent_rpcs.rotate_secret if parent_rpcs.respond_to? :rotate_secret
@rotate_secret = ::Gapic::Config::Method.new rotate_secret_config

yield self if block_given?
end
Expand Down
Loading
Loading