Skip to content

Commit 9344d74

Browse files
Sita04gcf-owl-bot[bot]
Sita04
and
gcf-owl-bot[bot]
committed
docs(samples): added samples and tests for updating and monitoring CA (#274)
* docs(samples): added samples and tests for updating and monitoring CA * 🦉 Updates from OwlBot See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md * docs(samples): added review comments * 🦉 Updates from OwlBot See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md * 🦉 Updates from OwlBot See https://github.com/googleapis/repo-automation-bots/blob/main/packages/owl-bot/README.md Co-authored-by: Owl Bot <gcf-owl-bot[bot]@users.noreply.github.com>
1 parent ff2799e commit 9344d74

File tree

4 files changed

+207
-0
lines changed

4 files changed

+207
-0
lines changed

‎privateca/cloud-client/src/main/java/privateca/MonitorCertificateAuthority.java

+91
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,91 @@
1+
/*
2+
* Copyright 2021 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
package privateca;
17+
18+
// [START privateca_monitor_ca_expiry]
19+
20+
import com.google.cloud.monitoring.v3.AlertPolicyServiceClient;
21+
import com.google.cloud.monitoring.v3.NotificationChannelServiceClient;
22+
import com.google.monitoring.v3.AlertPolicy;
23+
import com.google.monitoring.v3.AlertPolicy.Condition;
24+
import com.google.monitoring.v3.AlertPolicy.Condition.MonitoringQueryLanguageCondition;
25+
import com.google.monitoring.v3.AlertPolicy.ConditionCombinerType;
26+
import com.google.monitoring.v3.NotificationChannel;
27+
import com.google.monitoring.v3.ProjectName;
28+
import java.io.IOException;
29+
30+
public class MonitorCertificateAuthority {
31+
32+
public static void main(String[] args) throws IOException {
33+
// TODO(developer): Replace these variables before running the sample.
34+
String project = "your-project-id";
35+
createCaMonitoringPolicy(project);
36+
}
37+
38+
// Creates a monitoring policy that notifies you 30 days before a managed CA expires.
39+
public static void createCaMonitoringPolicy(String project) throws IOException {
40+
/* Initialize client that will be used to send requests. This client only needs to be created
41+
once, and can be reused for multiple requests. After completing all of your requests, call
42+
the `client.close()` method on the client to safely
43+
clean up any remaining background resources. */
44+
try (AlertPolicyServiceClient client = AlertPolicyServiceClient.create();
45+
NotificationChannelServiceClient notificationClient =
46+
NotificationChannelServiceClient.create()) {
47+
48+
String policyName = "policy-name";
49+
50+
/* Query which indicates the resource to monitor and the constraints.
51+
Here, the alert policy notifies you 30 days before a managed CA expires.
52+
For more info on creating queries, see: https://cloud.google.com/monitoring/mql/alerts */
53+
String query =
54+
"fetch privateca.googleapis.com/CertificateAuthority"
55+
+ "| metric 'privateca.googleapis.com/ca/cert_chain_expiration'"
56+
+ "| group_by 5m,"
57+
+ "[value_cert_chain_expiration_mean: mean(value.cert_chain_expiration)]"
58+
+ "| every 5m"
59+
+ "| condition val() < 2.592e+06 's'";
60+
61+
// Create a notification channel.
62+
NotificationChannel notificationChannel =
63+
NotificationChannel.newBuilder()
64+
.setType("email")
65+
.putLabels("email_address", "[email protected]")
66+
.build();
67+
NotificationChannel channel =
68+
notificationClient.createNotificationChannel(
69+
ProjectName.of(project), notificationChannel);
70+
71+
// Set the query and notification channel.
72+
AlertPolicy alertPolicy =
73+
AlertPolicy.newBuilder()
74+
.setDisplayName(policyName)
75+
.addConditions(
76+
Condition.newBuilder()
77+
.setDisplayName("ca-cert-chain-expiration")
78+
.setConditionMonitoringQueryLanguage(
79+
MonitoringQueryLanguageCondition.newBuilder().setQuery(query).build())
80+
.build())
81+
.setCombiner(ConditionCombinerType.AND)
82+
.addNotificationChannels(channel.getName())
83+
.build();
84+
85+
AlertPolicy policy = client.createAlertPolicy(ProjectName.of(project), alertPolicy);
86+
87+
System.out.println("Monitoring policy successfully created !" + policy.getName());
88+
}
89+
}
90+
}
91+
// [END privateca_monitor_ca_expiry]

‎privateca/cloud-client/src/main/java/privateca/UpdateCertificateAuthority.java

+99
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,99 @@
1+
/*
2+
* Copyright 2021 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* https://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
package privateca;
17+
18+
// [START privateca_update_ca_label]
19+
20+
import com.google.api.core.ApiFuture;
21+
import com.google.cloud.security.privateca.v1.CertificateAuthority;
22+
import com.google.cloud.security.privateca.v1.CertificateAuthorityName;
23+
import com.google.cloud.security.privateca.v1.CertificateAuthorityServiceClient;
24+
import com.google.cloud.security.privateca.v1.UpdateCertificateAuthorityRequest;
25+
import com.google.longrunning.Operation;
26+
import com.google.protobuf.FieldMask;
27+
import java.io.IOException;
28+
import java.util.concurrent.ExecutionException;
29+
import java.util.concurrent.TimeUnit;
30+
import java.util.concurrent.TimeoutException;
31+
32+
public class UpdateCertificateAuthority {
33+
34+
public static void main(String[] args)
35+
throws IOException, ExecutionException, InterruptedException, TimeoutException {
36+
// TODO(developer): Replace these variables before running the sample.
37+
// location: For a list of locations, see:
38+
// https://cloud.google.com/certificate-authority-service/docs/locations
39+
// pool_Id: Set it to the CA Pool under which the CA should be created.
40+
// certificateAuthorityName: Unique name for the CA.
41+
String project = "your-project-id";
42+
String location = "ca-location";
43+
String pool_Id = "ca-pool-id";
44+
String certificateAuthorityName = "certificate-authority-name";
45+
46+
updateCaLabel(project, location, pool_Id, certificateAuthorityName);
47+
}
48+
49+
// Updates the labels in a certificate authority.
50+
public static void updateCaLabel(
51+
String project, String location, String pool_Id, String certificateAuthorityName)
52+
throws IOException, ExecutionException, InterruptedException, TimeoutException {
53+
/* Initialize client that will be used to send requests. This client only needs to be created
54+
once, and can be reused for multiple requests. After completing all of your requests, call
55+
the `certificateAuthorityServiceClient.close()` method on the client to safely
56+
clean up any remaining background resources. */
57+
try (CertificateAuthorityServiceClient certificateAuthorityServiceClient =
58+
CertificateAuthorityServiceClient.create()) {
59+
60+
// Set the parent path and the new labels.
61+
String certificateAuthorityParent =
62+
CertificateAuthorityName.of(project, location, pool_Id, certificateAuthorityName)
63+
.toString();
64+
CertificateAuthority certificateAuthority =
65+
CertificateAuthority.newBuilder()
66+
.setName(certificateAuthorityParent)
67+
.putLabels("env", "test")
68+
.build();
69+
70+
// Create a request to update the CA.
71+
UpdateCertificateAuthorityRequest request =
72+
UpdateCertificateAuthorityRequest.newBuilder()
73+
.setCertificateAuthority(certificateAuthority)
74+
.setUpdateMask(FieldMask.newBuilder().addPaths("labels").build())
75+
.build();
76+
77+
// Update the CA and wait for the operation to complete.
78+
ApiFuture<Operation> futureCall =
79+
certificateAuthorityServiceClient
80+
.updateCertificateAuthorityCallable()
81+
.futureCall(request);
82+
Operation operation = futureCall.get(60, TimeUnit.SECONDS);
83+
84+
// Check for errors.
85+
if (operation.hasError()) {
86+
System.out.println("Error in updating labels ! " + operation.getError());
87+
}
88+
89+
// Get the updated CA and check if it contains the new label.
90+
CertificateAuthority response =
91+
certificateAuthorityServiceClient.getCertificateAuthority(certificateAuthorityParent);
92+
if (response.getLabelsMap().containsKey("env")
93+
&& response.getLabelsMap().get("env").equalsIgnoreCase("test")) {
94+
System.out.println("Successfully updated the labels ! ");
95+
}
96+
}
97+
}
98+
}
99+
// [END privateca_update_ca_label]

‎privateca/cloud-client/src/test/java/privateca/SnippetsIT.java

+13
Original file line numberDiff line numberDiff line change
@@ -320,6 +320,19 @@ public void testListCertificateAuthorities() throws IOException {
320320
assertThat(stdOut.toString()).contains(CA_NAME);
321321
}
322322

323+
@Test
324+
public void testUpdateCertificateAuthority()
325+
throws IOException, ExecutionException, InterruptedException, TimeoutException {
326+
privateca.UpdateCertificateAuthority.updateCaLabel(PROJECT_ID, LOCATION, CA_POOL_ID, CA_NAME);
327+
assertThat(stdOut.toString()).contains("Successfully updated the labels ! ");
328+
}
329+
330+
@Test
331+
public void testMonitorCertificateAuthority() throws IOException, InterruptedException {
332+
privateca.MonitorCertificateAuthority.createCaMonitoringPolicy(PROJECT_ID);
333+
assertThat(stdOut.toString()).contains("Monitoring policy successfully created !");
334+
}
335+
323336
@Test
324337
public void testEnableDisableCertificateAuthority()
325338
throws InterruptedException, ExecutionException, IOException {

‎privateca/pom.xml

+4
Original file line numberDiff line numberDiff line change
@@ -63,6 +63,10 @@
6363
<groupId>com.google.cloud</groupId>
6464
<artifactId>google-cloud-kms</artifactId>
6565
</dependency>
66+
<dependency>
67+
<groupId>com.google.cloud</groupId>
68+
<artifactId>google-cloud-monitoring</artifactId>
69+
</dependency>
6670

6771
<dependency>
6872
<groupId>junit</groupId>

0 commit comments

Comments
 (0)