-
Notifications
You must be signed in to change notification settings - Fork 2.9k
Add samples for secret expiration - create, update, and delete #10225
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
Open
dhavalbhensdadiya-crest
wants to merge
11
commits into
GoogleCloudPlatform:main
Choose a base branch
from
dhavalbhensdadiya-crest:feature/expiration-create-update-delete
base: main
Could not load branches
Branch not found: {{ refName }}
Loading
Could not load tags
Nothing to show
Loading
Are you sure you want to change the base?
Some commits from the old base branch may be removed from the timeline,
and old review comments may become outdated.
Open
Changes from all commits
Commits
Show all changes
11 commits
Select commit
Hold shift + click to select a range
e337c21
Adding code samples for creating secret with customer managed encrypt…
dhavalbhensdadiya-crest 36203bb
Improved readme and created new secret specific for deleting annotations
dhavalbhensdadiya-crest 0acae16
Applied suggestions from code review
dhavalbhensdadiya-crest 9d6e4ee
Added args to main function
dhavalbhensdadiya-crest 710bb85
Moved KMS key validation check to BeforeClass setup
dhavalbhensdadiya-crest bfbc85c
feat(secretmanager): add examples for listing, binding and removing t…
dhavalbhensdadiya-crest c335901
Renamed files related to delete tags to match existing files
dhavalbhensdadiya-crest 15b8d11
feat(secretmanager): add examples for creating, updating and deleting…
dhavalbhensdadiya-crest dc120be
Apply suggestions from code review
dhavalbhensdadiya-crest 0805ba2
Resolving Gemini code review comments
dhavalbhensdadiya-crest 4860b50
Resolving issues generated by auto suggestions from Gemini related to…
dhavalbhensdadiya-crest File filter
Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
Some comments aren't visible on the classic Files Changed page.
There are no files selected for viewing
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
64 changes: 64 additions & 0 deletions
64
secretmanager/src/main/java/secretmanager/BindSecretTag.java
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,64 @@ | ||
| /* | ||
| * Copyright 2026 Google LLC | ||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
|
|
||
| package secretmanager; | ||
|
|
||
| // [START secretmanager_bind_secret_tag] | ||
| import com.google.cloud.resourcemanager.v3.CreateTagBindingRequest; | ||
| import com.google.cloud.resourcemanager.v3.TagBinding; | ||
| import com.google.cloud.resourcemanager.v3.TagBindingsClient; | ||
| import java.io.IOException; | ||
| import java.util.concurrent.ExecutionException; | ||
|
|
||
| public class BindSecretTag { | ||
|
|
||
| public static void main(String[] args) throws Exception { | ||
| // TODO(developer): replace these variables before running the sample. | ||
|
|
||
| // This is the id of the GCP project | ||
| String projectId = "your-project-id"; | ||
| // This is the id of the secret to act on | ||
| String secretId = "your-secret-id"; | ||
| // Tag value to bind, e.g. "tagValues/123" | ||
| String tagValueName = "your-tag-value"; | ||
|
|
||
| bindSecretTag(projectId, secretId, tagValueName); | ||
| } | ||
|
|
||
| // Bind a TagValue to a Secret by creating a TagBinding. | ||
| public static TagBinding bindSecretTag(String projectId, String secretId, String tagValueName) | ||
| throws IOException, InterruptedException, ExecutionException { | ||
|
|
||
| String parent = String.format("//secretmanager.googleapis.com/projects/%s/secrets/%s", | ||
| projectId, secretId); | ||
|
|
||
| try (TagBindingsClient tagBindingsClient = TagBindingsClient.create()) { | ||
| TagBinding tagBinding = TagBinding.newBuilder() | ||
| .setTagValue(tagValueName) | ||
| .setParent(parent) | ||
| .build(); | ||
|
|
||
| CreateTagBindingRequest request = CreateTagBindingRequest.newBuilder() | ||
| .setTagBinding(tagBinding) | ||
| .build(); | ||
|
|
||
| TagBinding created = tagBindingsClient.createTagBindingAsync(request).get(); | ||
| System.out.printf("Created TagBinding: %s\n", created.getName()); | ||
| return created; | ||
| } | ||
| } | ||
| } | ||
| // [END secretmanager_bind_secret_tag] | ||
75 changes: 75 additions & 0 deletions
75
secretmanager/src/main/java/secretmanager/CreateSecretWithCmek.java
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,75 @@ | ||
| /* | ||
| * Copyright 2026 Google LLC | ||
dhavalbhensdadiya-crest marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
|
|
||
| package secretmanager; | ||
|
|
||
| // [START secretmanager_create_secret_with_cmek] | ||
| import com.google.cloud.secretmanager.v1.CustomerManagedEncryption; | ||
| import com.google.cloud.secretmanager.v1.ProjectName; | ||
| import com.google.cloud.secretmanager.v1.Replication; | ||
| import com.google.cloud.secretmanager.v1.Secret; | ||
| import com.google.cloud.secretmanager.v1.SecretManagerServiceClient; | ||
| import java.io.IOException; | ||
|
|
||
| public class CreateSecretWithCmek { | ||
|
|
||
| public static void main(String[] args) throws IOException { | ||
| // TODO(developer): Replace these variables before running the sample. | ||
|
|
||
| // This is the id of the GCP project | ||
| String projectId = "your-project-id"; | ||
| // This is the id of the secret to act on | ||
| String secretId = "your-secret-id"; | ||
| // This is the Full kms key name to be used for Cmek. | ||
| String kmsKeyName = "your-kms-key-name"; | ||
| createSecretWithCmek(projectId, secretId, kmsKeyName); | ||
| } | ||
|
|
||
| // Create a secret with a customer-managed encryption key (CMEK). | ||
| public static Secret createSecretWithCmek(String projectId, String secretId, String kmsKeyName) | ||
| throws IOException { | ||
|
|
||
| // Initialize client that will be used to send requests. This client only needs to be created | ||
| // once, and can be reused for multiple requests. | ||
| try (SecretManagerServiceClient client = SecretManagerServiceClient.create()) { | ||
|
|
||
| // Build the secret name. | ||
| ProjectName projectName = ProjectName.of(projectId); | ||
|
|
||
| // Build the Cmek configuration. | ||
| CustomerManagedEncryption customerManagedEncryption = | ||
| CustomerManagedEncryption.newBuilder().setKmsKeyName(kmsKeyName).build(); | ||
|
|
||
| // Build the replication using Cmek. | ||
| Replication secretReplication = | ||
| Replication.newBuilder() | ||
| .setAutomatic( | ||
| Replication.Automatic.newBuilder() | ||
| .setCustomerManagedEncryption(customerManagedEncryption) | ||
| .build()) | ||
| .build(); | ||
|
|
||
| // Build the secret to create with the replication policy. | ||
| Secret secret = Secret.newBuilder().setReplication(secretReplication).build(); | ||
|
|
||
| // Create the secret. | ||
| Secret createdSecret = client.createSecret(projectName, secretId, secret); | ||
| System.out.printf("Created secret %s\n", createdSecret.getName()); | ||
| return createdSecret; | ||
| } | ||
| } | ||
| } | ||
| // [END secretmanager_create_secret_with_cmek] | ||
77 changes: 77 additions & 0 deletions
77
secretmanager/src/main/java/secretmanager/CreateSecretWithExpiration.java
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,77 @@ | ||
| /* | ||
| * Copyright 2026 Google LLC | ||
dhavalbhensdadiya-crest marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
|
|
||
| package secretmanager; | ||
|
|
||
| // [START secretmanager_create_secret_with_expiration] | ||
| import com.google.cloud.secretmanager.v1.ProjectName; | ||
| import com.google.cloud.secretmanager.v1.Replication; | ||
| import com.google.cloud.secretmanager.v1.Secret; | ||
| import com.google.cloud.secretmanager.v1.SecretManagerServiceClient; | ||
| import com.google.protobuf.Timestamp; | ||
| import java.io.IOException; | ||
| import java.time.Instant; | ||
|
|
||
| public class CreateSecretWithExpiration { | ||
|
|
||
| public static void main(String[] args) throws IOException { | ||
| // TODO(developer): Replace these variables before running the sample. | ||
|
|
||
| // This is the id of the GCP project | ||
| String projectId = "your-project-id"; | ||
| // This is the id of the secret to create | ||
| String secretId = "your-secret-id"; | ||
| // This is the time in seconds from now when the secret will expire | ||
| long expireTimeSeconds = 86400; // 24 hours | ||
| createSecretWithExpiration(projectId, secretId, expireTimeSeconds); | ||
| } | ||
|
|
||
| // Create a new secret with an expiration time. | ||
| public static Secret createSecretWithExpiration( | ||
| String projectId, String secretId, long expireTimeSeconds) throws IOException { | ||
| // Initialize client that will be used to send requests. This client only needs to be created | ||
| // once, and can be reused for multiple requests. After completing all of your requests, call | ||
| // the "close" method on the client to safely clean up any remaining background resources. | ||
| try (SecretManagerServiceClient client = SecretManagerServiceClient.create()) { | ||
| // Build the parent name from the project. | ||
| ProjectName projectName = ProjectName.of(projectId); | ||
|
|
||
| // Calculate the expiration time. | ||
| Instant expireTime = Instant.now().plusSeconds(expireTimeSeconds); | ||
| Timestamp expireTimestamp = Timestamp.newBuilder() | ||
| .setSeconds(expireTime.getEpochSecond()) | ||
| .setNanos(expireTime.getNano()) | ||
| .build(); | ||
|
|
||
| // Build the secret to create with expiration time. | ||
| Secret secret = | ||
| Secret.newBuilder() | ||
| .setReplication( | ||
| Replication.newBuilder() | ||
| .setAutomatic(Replication.Automatic.newBuilder().build()) | ||
| .build()) | ||
| .setExpireTime(expireTimestamp) | ||
| .build(); | ||
|
|
||
| // Create the secret. | ||
| Secret createdSecret = client.createSecret(projectName, secretId, secret); | ||
| System.out.printf("Created secret %s with expire time\n", createdSecret.getName()); | ||
|
|
||
| return createdSecret; | ||
| } | ||
| } | ||
| } | ||
| // [END secretmanager_create_secret_with_expiration] | ||
69 changes: 69 additions & 0 deletions
69
secretmanager/src/main/java/secretmanager/DeleteSecretAnnotations.java
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,69 @@ | ||
| /* | ||
| * Copyright 2026 Google LLC | ||
dhavalbhensdadiya-crest marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
|
|
||
| package secretmanager; | ||
|
|
||
| // [START secretmanager_delete_secret_annotations] | ||
| import com.google.cloud.secretmanager.v1.Secret; | ||
| import com.google.cloud.secretmanager.v1.SecretManagerServiceClient; | ||
| import com.google.cloud.secretmanager.v1.SecretName; | ||
| import com.google.protobuf.FieldMask; | ||
| import com.google.protobuf.util.FieldMaskUtil; | ||
| import java.io.IOException; | ||
| import java.util.HashMap; | ||
|
|
||
| public class DeleteSecretAnnotations { | ||
|
|
||
|
|
||
| public static void main(String[] args) throws IOException { | ||
| // TODO(developer): Replace these variables before running the sample. | ||
|
|
||
| // This is the id of the GCP project | ||
| String projectId = "your-project-id"; | ||
| // This is the id of the secret to act on | ||
| String secretId = "your-secret-id"; | ||
| deleteSecretAnnotations(projectId, secretId); | ||
| } | ||
|
|
||
| // Delete annotations from an existing secret. | ||
| public static Secret deleteSecretAnnotations(String projectId, String secretId) | ||
| throws IOException { | ||
| // Initialize client that will be used to send requests. This client only needs | ||
| // to be created | ||
| // once, and can be reused for multiple requests. | ||
| try (SecretManagerServiceClient client = SecretManagerServiceClient.create()) { | ||
dhavalbhensdadiya-crest marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| // Build the name of the secret. | ||
| SecretName secretName = SecretName.of(projectId, secretId); | ||
|
|
||
| // Build the updated secret with an empty annotations map. | ||
| Secret secret = | ||
| Secret.newBuilder() | ||
| .setName(secretName.toString()) | ||
| .putAllAnnotations(new HashMap<>()) | ||
| .build(); | ||
|
|
||
| // Create the field mask for updating only the annotations | ||
| FieldMask fieldMask = FieldMaskUtil.fromString("annotations"); | ||
|
|
||
| // Update the secret. | ||
| Secret updatedSecret = client.updateSecret(secret, fieldMask); | ||
| System.out.printf("Deleted annotations from %s\n", updatedSecret.getName()); | ||
|
|
||
| return updatedSecret; | ||
| } | ||
| } | ||
| } | ||
| // [END secretmanager_delete_secret_annotations] | ||
66 changes: 66 additions & 0 deletions
66
secretmanager/src/main/java/secretmanager/DeleteSecretExpiration.java
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,66 @@ | ||
| /* | ||
| * Copyright 2026 Google LLC | ||
dhavalbhensdadiya-crest marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| * | ||
| * Licensed under the Apache License, Version 2.0 (the "License"); | ||
| * you may not use this file except in compliance with the License. | ||
| * You may obtain a copy of the License at | ||
| * | ||
| * http://www.apache.org/licenses/LICENSE-2.0 | ||
| * | ||
| * Unless required by applicable law or agreed to in writing, software | ||
| * distributed under the License is distributed on an "AS IS" BASIS, | ||
| * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. | ||
| * See the License for the specific language governing permissions and | ||
| * limitations under the License. | ||
| */ | ||
|
|
||
| package secretmanager; | ||
|
|
||
| // [START secretmanager_delete_secret_expiration] | ||
| import com.google.cloud.secretmanager.v1.Secret; | ||
| import com.google.cloud.secretmanager.v1.SecretManagerServiceClient; | ||
| import com.google.cloud.secretmanager.v1.SecretName; | ||
| import com.google.protobuf.FieldMask; | ||
| import com.google.protobuf.util.FieldMaskUtil; | ||
| import java.io.IOException; | ||
|
|
||
| public class DeleteSecretExpiration { | ||
|
|
||
| public static void main(String[] args) throws IOException { | ||
| // TODO(developer): Replace these variables before running the sample. | ||
|
|
||
| // This is the id of the GCP project | ||
| String projectId = "your-project-id"; | ||
| // This is the id of the secret to update | ||
| String secretId = "your-secret-id"; | ||
| deleteSecretExpiration(projectId, secretId); | ||
| } | ||
|
|
||
| // Delete the expiration time from an existing secret. | ||
| public static Secret deleteSecretExpiration(String projectId, String secretId) | ||
| throws IOException { | ||
| // Initialize client that will be used to send requests. This client only needs to be created | ||
| // once, and can be reused for multiple requests. After completing all of your requests, call | ||
| // the "close" method on the client to safely clean up any remaining background resources. | ||
| try (SecretManagerServiceClient client = SecretManagerServiceClient.create()) { | ||
dhavalbhensdadiya-crest marked this conversation as resolved.
Show resolved
Hide resolved
|
||
| // Build the secret name. | ||
| SecretName secretName = SecretName.of(projectId, secretId); | ||
|
|
||
| // Build the updated secret without expiration time. | ||
| Secret secret = | ||
| Secret.newBuilder() | ||
| .setName(secretName.toString()) | ||
| .build(); | ||
|
|
||
| // Build the field mask to clear the expiration time. | ||
| FieldMask fieldMask = FieldMaskUtil.fromString("expire_time"); | ||
|
|
||
| // Update the secret to remove expiration. | ||
| Secret updatedSecret = client.updateSecret(secret, fieldMask); | ||
| System.out.printf("Deleted expiration from secret %s\n", updatedSecret.getName()); | ||
|
|
||
| return updatedSecret; | ||
| } | ||
| } | ||
| } | ||
| // [END secretmanager_delete_secret_expiration] | ||
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Uh oh!
There was an error while loading. Please reload this page.