Skip to content

Commit 58f0c89

Browse files
frankynfrankyn
authored
Merge pull request #3196 from GoogleCloudPlatform/kms-integration
[Storage] KMS integration
2 parents 03e1869 + e7e4911 commit 58f0c89

File tree

14 files changed

+479
-26
lines changed

14 files changed

+479
-26
lines changed

‎google-cloud-clients/google-cloud-storage/src/main/java/com/google/cloud/storage/Blob.java

+7-1
Original file line numberDiff line numberDiff line change
@@ -184,7 +184,6 @@ public static BlobSourceOption decryptionKey(String key) {
184184
* Returns an option for blob's billing user project. This option is used only if the blob's
185185
* bucket has requester_pays flag enabled.
186186
*/
187-
@GcpLaunchStage.Alpha
188187
public static BlobSourceOption userProject(String userProject) {
189188
return new BlobSourceOption(StorageRpc.Option.USER_PROJECT, userProject);
190189
}
@@ -403,6 +402,13 @@ Builder setCustomerEncryption(CustomerEncryption customerEncryption) {
403402
return this;
404403
}
405404

405+
@GcpLaunchStage.Beta
406+
@Override
407+
Builder setKmsKeyName(String kmsKeyName) {
408+
infoBuilder.setKmsKeyName(kmsKeyName);
409+
return this;
410+
}
411+
406412
@Override
407413
public Blob build() {
408414
return new Blob(storage, infoBuilder);

‎google-cloud-clients/google-cloud-storage/src/main/java/com/google/cloud/storage/BlobInfo.java

+32
Original file line numberDiff line numberDiff line change
@@ -24,6 +24,7 @@
2424
import com.google.api.services.storage.model.ObjectAccessControl;
2525
import com.google.api.services.storage.model.StorageObject;
2626
import com.google.api.services.storage.model.StorageObject.Owner;
27+
import com.google.cloud.GcpLaunchStage;
2728
import com.google.cloud.storage.Blob.Builder;
2829
import com.google.common.base.Function;
2930
import com.google.common.base.MoreObjects;
@@ -83,6 +84,7 @@ public StorageObject apply(BlobInfo blobInfo) {
8384
private final Integer componentCount;
8485
private final boolean isDirectory;
8586
private final CustomerEncryption customerEncryption;
87+
private final String kmsKeyName;
8688

8789
/**
8890
* This class is meant for internal use only. Users are discouraged from using this class.
@@ -266,6 +268,13 @@ public abstract static class Builder {
266268

267269
abstract Builder setCustomerEncryption(CustomerEncryption customerEncryption);
268270

271+
/**
272+
*
273+
* Sets the blob's kmsKeyName.
274+
*/
275+
@GcpLaunchStage.Beta
276+
abstract Builder setKmsKeyName(String kmsKeyName);
277+
269278
/**
270279
* Creates a {@code BlobInfo} object.
271280
*/
@@ -298,6 +307,7 @@ static final class BuilderImpl extends Builder {
298307
private Boolean isDirectory;
299308
private CustomerEncryption customerEncryption;
300309
private StorageClass storageClass;
310+
private String kmsKeyName;
301311

302312
BuilderImpl(BlobId blobId) {
303313
this.blobId = blobId;
@@ -328,6 +338,7 @@ static final class BuilderImpl extends Builder {
328338
createTime = blobInfo.createTime;
329339
isDirectory = blobInfo.isDirectory;
330340
storageClass = blobInfo.storageClass;
341+
kmsKeyName = blobInfo.kmsKeyName;
331342
}
332343

333344
@Override
@@ -475,6 +486,13 @@ Builder setCustomerEncryption(CustomerEncryption customerEncryption) {
475486
return this;
476487
}
477488

489+
@GcpLaunchStage.Beta
490+
@Override
491+
Builder setKmsKeyName(String kmsKeyName) {
492+
this.kmsKeyName = kmsKeyName;
493+
return this;
494+
}
495+
478496
@Override
479497
public BlobInfo build() {
480498
checkNotNull(blobId);
@@ -507,6 +525,7 @@ public BlobInfo build() {
507525
createTime = builder.createTime;
508526
isDirectory = firstNonNull(builder.isDirectory, Boolean.FALSE);
509527
storageClass = builder.storageClass;
528+
kmsKeyName = builder.kmsKeyName;
510529
}
511530

512531
/**
@@ -737,6 +756,14 @@ public StorageClass getStorageClass() {
737756
return storageClass;
738757
}
739758

759+
/**
760+
* Returns the Cloud KMS key used to encrypt the blob, if any.
761+
*/
762+
@GcpLaunchStage.Beta
763+
public String getKmsKeyName() {
764+
return kmsKeyName;
765+
}
766+
740767
/**
741768
* Returns a builder for the current blob.
742769
*/
@@ -809,6 +836,8 @@ public ObjectAccessControl apply(Acl acl) {
809836
if (customerEncryption != null) {
810837
storageObject.setCustomerEncryption(customerEncryption.toPb());
811838
}
839+
840+
storageObject.setKmsKeyName(kmsKeyName);
812841
storageObject.setMetadata(pbMetadata);
813842
storageObject.setCacheControl(cacheControl);
814843
storageObject.setContentEncoding(contentEncoding);
@@ -939,6 +968,9 @@ public Acl apply(ObjectAccessControl objectAccessControl) {
939968
if (storageObject.getStorageClass() != null) {
940969
builder.setStorageClass(StorageClass.valueOf(storageObject.getStorageClass()));
941970
}
971+
if (storageObject.getKmsKeyName() != null) {
972+
builder.setKmsKeyName(storageObject.getKmsKeyName());
973+
}
942974
return builder.build();
943975
}
944976
}

‎google-cloud-clients/google-cloud-storage/src/main/java/com/google/cloud/storage/Bucket.java

+23-3
Original file line numberDiff line numberDiff line change
@@ -118,7 +118,6 @@ public static BucketSourceOption metagenerationNotMatch() {
118118
* Returns an option for blob's billing user project. This option is only used by the buckets with
119119
* 'requester_pays' flag.
120120
*/
121-
@GcpLaunchStage.Alpha
122121
public static BucketSourceOption userProject(String userProject) {
123122
return new BucketSourceOption(StorageRpc.Option.USER_PROJECT, userProject);
124123
}
@@ -188,6 +187,9 @@ private Tuple<BlobInfo, Storage.BlobTargetOption> toTargetOption(BlobInfo blobIn
188187
case CUSTOMER_SUPPLIED_KEY:
189188
return Tuple.of(blobInfo,
190189
Storage.BlobTargetOption.encryptionKey((String) getValue()));
190+
case KMS_KEY_NAME:
191+
return Tuple.of(blobInfo,
192+
Storage.BlobTargetOption.kmsKeyName((String) getValue()));
191193
case USER_PROJECT:
192194
return Tuple.of(blobInfo,
193195
Storage.BlobTargetOption.userProject((String) getValue()));
@@ -267,11 +269,20 @@ public static BlobTargetOption encryptionKey(String key) {
267269
return new BlobTargetOption(StorageRpc.Option.CUSTOMER_SUPPLIED_KEY, key);
268270
}
269271

272+
/**
273+
* Returns an option to set a customer-managed KMS key for server-side encryption of the
274+
* blob.
275+
*
276+
* @param kmsKeyName the KMS key resource id
277+
*/
278+
public static BlobTargetOption kmsKeyName(String kmsKeyName) {
279+
return new BlobTargetOption(StorageRpc.Option.KMS_KEY_NAME, kmsKeyName);
280+
}
281+
270282
/**
271283
* Returns an option for blob's billing user project. This option is only used by the buckets with
272284
* 'requester_pays' flag.
273285
*/
274-
@GcpLaunchStage.Alpha
275286
public static BlobTargetOption userProject(String userProject) {
276287
return new BlobTargetOption(StorageRpc.Option.USER_PROJECT, userProject);
277288
}
@@ -345,6 +356,9 @@ private Tuple<BlobInfo, Storage.BlobWriteOption> toWriteOption(BlobInfo blobInfo
345356
case CUSTOMER_SUPPLIED_KEY:
346357
return Tuple.of(blobInfo,
347358
Storage.BlobWriteOption.encryptionKey((String) value));
359+
case KMS_KEY_NAME:
360+
return Tuple.of(blobInfo,
361+
Storage.BlobWriteOption.kmsKeyName((String) value));
348362
case USER_PROJECT:
349363
return Tuple.of(blobInfo, Storage.BlobWriteOption.userProject((String) value));
350364
default:
@@ -468,7 +482,6 @@ public static BlobWriteOption encryptionKey(String key) {
468482
* Returns an option for blob's billing user project. This option is only used by the buckets with
469483
* 'requester_pays' flag.
470484
*/
471-
@GcpLaunchStage.Alpha
472485
public static BlobWriteOption userProject(String userProject) {
473486
return new BlobWriteOption(Storage.BlobWriteOption.Option.USER_PROJECT, userProject);
474487
}
@@ -615,6 +628,13 @@ public Builder setLabels(Map<String, String> labels) {
615628
return this;
616629
}
617630

631+
@GcpLaunchStage.Beta
632+
@Override
633+
public Builder setDefaultKmsKeyName(String defaultKmsKeyName) {
634+
infoBuilder.setDefaultKmsKeyName(defaultKmsKeyName);
635+
return this;
636+
}
637+
618638
@Override
619639
public Bucket build() {
620640
return new Bucket(storage, infoBuilder);

‎google-cloud-clients/google-cloud-storage/src/main/java/com/google/cloud/storage/BucketInfo.java

+35-1
Original file line numberDiff line numberDiff line change
@@ -25,11 +25,13 @@
2525
import com.google.api.client.util.DateTime;
2626
import com.google.api.services.storage.model.*;
2727
import com.google.api.services.storage.model.Bucket;
28+
import com.google.api.services.storage.model.Bucket.Encryption;
2829
import com.google.api.services.storage.model.Bucket.Lifecycle;
2930
import com.google.api.services.storage.model.Bucket.Lifecycle.Rule;
3031
import com.google.api.services.storage.model.Bucket.Owner;
3132
import com.google.api.services.storage.model.Bucket.Versioning;
3233
import com.google.api.services.storage.model.Bucket.Website;
34+
import com.google.cloud.GcpLaunchStage;
3335
import com.google.cloud.storage.Acl.Entity;
3436
import com.google.common.base.Function;
3537
import com.google.common.base.MoreObjects;
@@ -85,6 +87,7 @@ public com.google.api.services.storage.model.Bucket apply(BucketInfo bucketInfo)
8587
private final String location;
8688
private final StorageClass storageClass;
8789
private final Map<String, String> labels;
90+
private final String defaultKmsKeyName;
8891

8992
/**
9093
* Base class for bucket's delete rules. Allows to configure automatic deletion of blobs and blobs
@@ -423,6 +426,12 @@ public abstract static class Builder {
423426
*/
424427
public abstract Builder setLabels(Map<String, String> labels);
425428

429+
/**
430+
* Sets the default Cloud KMS key name for this bucket.
431+
*/
432+
@GcpLaunchStage.Beta
433+
public abstract Builder setDefaultKmsKeyName(String defaultKmsKeyName);
434+
426435
/**
427436
* Creates a {@code BucketInfo} object.
428437
*/
@@ -449,6 +458,7 @@ static final class BuilderImpl extends Builder {
449458
private List<Acl> acl;
450459
private List<Acl> defaultAcl;
451460
private Map<String, String> labels;
461+
private String defaultKmsKeyName;
452462

453463
BuilderImpl(String name) {
454464
this.name = name;
@@ -473,6 +483,7 @@ static final class BuilderImpl extends Builder {
473483
deleteRules = bucketInfo.deleteRules;
474484
labels = bucketInfo.labels;
475485
requesterPays = bucketInfo.requesterPays;
486+
defaultKmsKeyName = bucketInfo.defaultKmsKeyName;
476487
}
477488

478489
@Override
@@ -584,6 +595,14 @@ public Builder setLabels(Map<String, String> labels) {
584595
return this;
585596
}
586597

598+
@GcpLaunchStage.Beta
599+
@Override
600+
public Builder setDefaultKmsKeyName(String defaultKmsKeyName) {
601+
this.defaultKmsKeyName = defaultKmsKeyName != null
602+
? defaultKmsKeyName : Data.<String>nullOf(String.class);
603+
return this;
604+
}
605+
587606
@Override
588607
public BucketInfo build() {
589608
checkNotNull(name);
@@ -610,6 +629,7 @@ public BucketInfo build() {
610629
deleteRules = builder.deleteRules;
611630
labels = builder.labels;
612631
requesterPays = builder.requesterPays;
632+
defaultKmsKeyName = builder.defaultKmsKeyName;
613633
}
614634

615635
/**
@@ -762,6 +782,14 @@ public Map<String, String> getLabels() {
762782
return labels;
763783
}
764784

785+
/**
786+
* Returns the default Cloud KMS key to be applied to newly inserted objects in this bucket.
787+
*/
788+
@GcpLaunchStage.Beta
789+
public String getDefaultKmsKeyName() {
790+
return defaultKmsKeyName;
791+
}
792+
765793
/**
766794
* Returns a builder for the current bucket.
767795
*/
@@ -857,7 +885,9 @@ public Rule apply(DeleteRule deleteRule) {
857885
if (labels != null) {
858886
bucketPb.setLabels(labels);
859887
}
860-
888+
if (defaultKmsKeyName != null) {
889+
bucketPb.setEncryption(new Encryption().setDefaultKmsKeyName(defaultKmsKeyName));
890+
}
861891
return bucketPb;
862892
}
863893

@@ -945,6 +975,10 @@ public DeleteRule apply(Rule rule) {
945975
if (billing != null) {
946976
builder.setRequesterPays(billing.getRequesterPays());
947977
}
978+
Encryption encryption = bucketPb.getEncryption();
979+
if (encryption != null && encryption.getDefaultKmsKeyName() != null && !encryption.getDefaultKmsKeyName().isEmpty()) {
980+
builder.setDefaultKmsKeyName(encryption.getDefaultKmsKeyName());
981+
}
948982
return builder.build();
949983
}
950984
}

0 commit comments

Comments
 (0)