1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
|
// Copyright 2020 Google LLC
//
// Licensed under the Apache License, Version 2.0 (the "License");
// you may not use this file except in compliance with the License.
// You may obtain a copy of the License at
//
// http://www.apache.org/licenses/LICENSE-2.0
//
// Unless required by applicable law or agreed to in writing, software
// distributed under the License is distributed on an "AS IS" BASIS,
// WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
// See the License for the specific language governing permissions and
// limitations under the License.
syntax = "proto3";
package google.cloud.secrets.v1beta1;
import "google/api/field_behavior.proto";
import "google/api/resource.proto";
import "google/protobuf/timestamp.proto";
option cc_enable_arenas = true;
option csharp_namespace = "Google.Cloud.SecretManager.V1Beta1";
option go_package = "google.golang.org/genproto/googleapis/cloud/secretmanager/v1beta1;secretmanager";
option java_multiple_files = true;
option java_outer_classname = "ResourcesProto";
option java_package = "com.google.cloud.secretmanager.v1beta1";
option objc_class_prefix = "GSM";
option php_namespace = "Google\\Cloud\\SecretManager\\V1beta1";
option ruby_package = "Google::Cloud::SecretManager::V1beta1";
// A [Secret][google.cloud.secrets.v1beta1.Secret] is a logical secret whose value and versions can
// be accessed.
//
// A [Secret][google.cloud.secrets.v1beta1.Secret] is made up of zero or more [SecretVersions][google.cloud.secrets.v1beta1.SecretVersion] that
// represent the secret data.
message Secret {
option (google.api.resource) = {
type: "secretmanager.googleapis.com/Secret"
pattern: "projects/{project}/secrets/{secret}"
};
// Output only. The resource name of the [Secret][google.cloud.secrets.v1beta1.Secret] in the format `projects/*/secrets/*`.
string name = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
// Required. Immutable. The replication policy of the secret data attached to the [Secret][google.cloud.secrets.v1beta1.Secret].
//
// The replication policy cannot be changed after the Secret has been created.
Replication replication = 2 [
(google.api.field_behavior) = IMMUTABLE,
(google.api.field_behavior) = REQUIRED
];
// Output only. The time at which the [Secret][google.cloud.secrets.v1beta1.Secret] was created.
google.protobuf.Timestamp create_time = 3 [(google.api.field_behavior) = OUTPUT_ONLY];
// The labels assigned to this Secret.
//
// Label keys must be between 1 and 63 characters long, have a UTF-8 encoding
// of maximum 128 bytes, and must conform to the following PCRE regular
// expression: `[\p{Ll}\p{Lo}][\p{Ll}\p{Lo}\p{N}_-]{0,62}`
//
// Label values must be between 0 and 63 characters long, have a UTF-8
// encoding of maximum 128 bytes, and must conform to the following PCRE
// regular expression: `[\p{Ll}\p{Lo}\p{N}_-]{0,63}`
//
// No more than 64 labels can be assigned to a given resource.
map<string, string> labels = 4;
}
// A secret version resource in the Secret Manager API.
message SecretVersion {
option (google.api.resource) = {
type: "secretmanager.googleapis.com/SecretVersion"
pattern: "projects/{project}/secrets/{secret}/versions/{secret_version}"
};
// The state of a [SecretVersion][google.cloud.secrets.v1beta1.SecretVersion], indicating if it can be accessed.
enum State {
// Not specified. This value is unused and invalid.
STATE_UNSPECIFIED = 0;
// The [SecretVersion][google.cloud.secrets.v1beta1.SecretVersion] may be accessed.
ENABLED = 1;
// The [SecretVersion][google.cloud.secrets.v1beta1.SecretVersion] may not be accessed, but the secret data
// is still available and can be placed back into the [ENABLED][google.cloud.secrets.v1beta1.SecretVersion.State.ENABLED]
// state.
DISABLED = 2;
// The [SecretVersion][google.cloud.secrets.v1beta1.SecretVersion] is destroyed and the secret data is no longer
// stored. A version may not leave this state once entered.
DESTROYED = 3;
}
// Output only. The resource name of the [SecretVersion][google.cloud.secrets.v1beta1.SecretVersion] in the
// format `projects/*/secrets/*/versions/*`.
//
// [SecretVersion][google.cloud.secrets.v1beta1.SecretVersion] IDs in a [Secret][google.cloud.secrets.v1beta1.Secret] start at 1 and
// are incremented for each subsequent version of the secret.
string name = 1 [(google.api.field_behavior) = OUTPUT_ONLY];
// Output only. The time at which the [SecretVersion][google.cloud.secrets.v1beta1.SecretVersion] was created.
google.protobuf.Timestamp create_time = 2 [(google.api.field_behavior) = OUTPUT_ONLY];
// Output only. The time this [SecretVersion][google.cloud.secrets.v1beta1.SecretVersion] was destroyed.
// Only present if [state][google.cloud.secrets.v1beta1.SecretVersion.state] is
// [DESTROYED][google.cloud.secrets.v1beta1.SecretVersion.State.DESTROYED].
google.protobuf.Timestamp destroy_time = 3 [(google.api.field_behavior) = OUTPUT_ONLY];
// Output only. The current state of the [SecretVersion][google.cloud.secrets.v1beta1.SecretVersion].
State state = 4 [(google.api.field_behavior) = OUTPUT_ONLY];
}
// A policy that defines the replication configuration of data.
message Replication {
// A replication policy that replicates the [Secret][google.cloud.secrets.v1beta1.Secret] payload without any
// restrictions.
message Automatic {
}
// A replication policy that replicates the [Secret][google.cloud.secrets.v1beta1.Secret] payload into the
// locations specified in [Secret.replication.user_managed.replicas][]
message UserManaged {
// Represents a Replica for this [Secret][google.cloud.secrets.v1beta1.Secret].
message Replica {
// The canonical IDs of the location to replicate data.
// For example: `"us-east1"`.
string location = 1;
}
// Required. The list of Replicas for this [Secret][google.cloud.secrets.v1beta1.Secret].
//
// Cannot be empty.
repeated Replica replicas = 1 [(google.api.field_behavior) = REQUIRED];
}
// The replication policy for this secret.
oneof replication {
// The [Secret][google.cloud.secrets.v1beta1.Secret] will automatically be replicated without any restrictions.
Automatic automatic = 1;
// The [Secret][google.cloud.secrets.v1beta1.Secret] will only be replicated into the locations specified.
UserManaged user_managed = 2;
}
}
// A secret payload resource in the Secret Manager API. This contains the
// sensitive secret data that is associated with a [SecretVersion][google.cloud.secrets.v1beta1.SecretVersion].
message SecretPayload {
// The secret data. Must be no larger than 64KiB.
bytes data = 1;
}
|
