Skip to content

Commit e337c21

Browse files
dhavalbhensdadiya-crestdhavalbhensdadiya-crest
committed
Adding code samples for creating secret with customer managed encryption key and deleting annotations from the secret
1 parent 9c4da91 commit e337c21

7 files changed

Lines changed: 375 additions & 2 deletions

File tree

‎secretmanager/README.md‎

Lines changed: 3 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -16,10 +16,12 @@ You must [enable the Secret Manager API](https://console.cloud.google.com/flows/
1616

1717
### Set Environment Variables
1818

19-
You must set your project ID in order to run the tests
19+
You must set your project ID, KMS Keys (Global and Regional) in order to run the tests
2020

2121
```text
2222
$ export GOOGLE_CLOUD_PROJECT=<your-project-id-here>
23+
$ export GOOGLE_CLOUD_REGIONAL_KMS_KEY=<full-name-of-regional-kms-key> (region same as location)
24+
$ export GOOGLE_CLOUD_KMS_KEY=<full-name-of-global-kms-key>
2325
```
2426

2527
### Grant Permissions

‎secretmanager/src/main/java/secretmanager/CreateSecretWithCmek.java‎

Lines changed: 76 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,76 @@
1+
/*
2+
* Copyright 2026 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package secretmanager;
18+
19+
// [START secretmanager_create_secret_with_annotations]
20+
import com.google.cloud.secretmanager.v1.CustomerManagedEncryption;
21+
import com.google.cloud.secretmanager.v1.ProjectName;
22+
import com.google.cloud.secretmanager.v1.Replication;
23+
import com.google.cloud.secretmanager.v1.Secret;
24+
import com.google.cloud.secretmanager.v1.SecretManagerServiceClient;
25+
import java.io.IOException;
26+
27+
public class CreateSecretWithCmek {
28+
29+
public static void main() throws IOException {
30+
// TODO(developer): Replace these variables before running the sample.
31+
32+
// This is the id of the GCP project
33+
String projectId = "your-project-id";
34+
// This is the id of the secret to act on
35+
String secretId = "your-secret-id";
36+
// This is the Full kms key name to be used for Cmek.
37+
String kmsKeyName = "your-kms-key-name";
38+
createSecretWithCmek(projectId, secretId, kmsKeyName);
39+
}
40+
41+
// Create a secret with annotations.
42+
public static Secret createSecretWithCmek(String projectId, String secretId, String kmsKeyName)
43+
throws IOException {
44+
45+
// Initialize client that will be used to send requests. This client only needs
46+
// to be created
47+
// once, and can be reused for multiple requests.
48+
try (SecretManagerServiceClient client = SecretManagerServiceClient.create()) {
49+
50+
// Build the secret name.
51+
ProjectName projectName = ProjectName.of(projectId);
52+
53+
// Build the Cmek configuration.
54+
CustomerManagedEncryption customerManagedEncryption =
55+
CustomerManagedEncryption.newBuilder().setKmsKeyName(kmsKeyName).build();
56+
57+
// Build the replication using Cmek.
58+
Replication secretReplication =
59+
Replication.newBuilder()
60+
.setAutomatic(
61+
Replication.Automatic.newBuilder()
62+
.setCustomerManagedEncryption(customerManagedEncryption)
63+
.build())
64+
.build();
65+
66+
// Build the secret to create with labels.
67+
Secret secret = Secret.newBuilder().setReplication(secretReplication).build();
68+
69+
// Create the secret.
70+
Secret createdSecret = client.createSecret(projectName, secretId, secret);
71+
System.out.printf("Created secret %s\n", createdSecret.getName());
72+
return createdSecret;
73+
}
74+
}
75+
}
76+
// [END secretmanager_create_secret_with_annotations]

‎secretmanager/src/main/java/secretmanager/DeleteSecretAnnotations.java‎

Lines changed: 77 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,77 @@
1+
/*
2+
* Copyright 2026 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package secretmanager;
18+
19+
// [START secretmanager_delete_secret_annotations]
20+
import com.google.cloud.secretmanager.v1.Secret;
21+
import com.google.cloud.secretmanager.v1.SecretManagerServiceClient;
22+
import com.google.cloud.secretmanager.v1.SecretName;
23+
import com.google.protobuf.FieldMask;
24+
import com.google.protobuf.util.FieldMaskUtil;
25+
import java.io.IOException;
26+
import java.util.HashMap;
27+
import java.util.Map;
28+
29+
public class DeleteSecretAnnotations {
30+
31+
public static void main() throws IOException {
32+
// TODO(developer): Replace these variables before running the sample.
33+
34+
// This is the id of the GCP project
35+
String projectId = "your-project-id";
36+
// This is the id of the secret to act on
37+
String secretId = "your-secret-id";
38+
deleteSecretAnnotations(projectId, secretId);
39+
}
40+
41+
// Delete annotations from an existing secret.
42+
public static Secret deleteSecretAnnotations(String projectId, String secretId)
43+
throws IOException {
44+
// Initialize client that will be used to send requests. This client only needs
45+
// to be created
46+
// once, and can be reused for multiple requests.
47+
try (SecretManagerServiceClient client = SecretManagerServiceClient.create()) {
48+
// Build the name of the secret.
49+
SecretName secretName = SecretName.of(projectId, secretId);
50+
51+
// Get the current secret
52+
Secret existingSecret = client.getSecret(secretName);
53+
54+
// Remove all annotations
55+
Map<String, String> existingAnnotationsMap =
56+
new HashMap<String, String>(existingSecret.getAnnotationsMap());
57+
existingAnnotationsMap.clear();
58+
59+
// Build the updated secret.
60+
Secret secret =
61+
Secret.newBuilder()
62+
.setName(secretName.toString())
63+
.putAllAnnotations(existingAnnotationsMap)
64+
.build();
65+
66+
// Create the field mask for updating only the annotations
67+
FieldMask fieldMask = FieldMaskUtil.fromString("annotations");
68+
69+
// Update the secret.
70+
Secret updatedSecret = client.updateSecret(secret, fieldMask);
71+
System.out.printf("Deleted annotations from %s\n", updatedSecret.getName());
72+
73+
return updatedSecret;
74+
}
75+
}
76+
}
77+
// [END secretmanager_delete_secret_annotations]

‎secretmanager/src/main/java/secretmanager/regionalsamples/CreateRegionalSecretWithCmek.java‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
/*
2+
* Copyright 2026 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package secretmanager.regionalsamples;
18+
19+
// [START secretmanager_create_regional_secret_with_cmek]
20+
import com.google.cloud.secretmanager.v1.CustomerManagedEncryption;
21+
import com.google.cloud.secretmanager.v1.LocationName;
22+
import com.google.cloud.secretmanager.v1.Secret;
23+
import com.google.cloud.secretmanager.v1.SecretManagerServiceClient;
24+
import com.google.cloud.secretmanager.v1.SecretManagerServiceSettings;
25+
import java.io.IOException;
26+
27+
public class CreateRegionalSecretWithCmek {
28+
29+
public static void main() throws IOException {
30+
// TODO(developer): Replace these variables before running the sample.
31+
32+
// This is the id of the GCP project
33+
String projectId = "your-project-id";
34+
// Location of the secret.
35+
String locationId = "your-location-id";
36+
// This is the id of the secret to act on
37+
String secretId = "your-secret-id";
38+
// This is the Full kms key name to be used for Cmek.
39+
String kmsKeyName = "your-kms-key-name";
40+
createRegionalSecretWithCmek(projectId, locationId, secretId, kmsKeyName);
41+
}
42+
43+
// Create a new regional secret with customer-managed encryption key.
44+
public static Secret createRegionalSecretWithCmek(
45+
String projectId, String locationId, String secretId, String kmsKeyName) throws IOException {
46+
47+
// Endpoint to call the regional secret manager server
48+
String apiEndpoint = String.format("secretmanager.%s.rep.googleapis.com:443", locationId);
49+
SecretManagerServiceSettings secretManagerServiceSettings =
50+
SecretManagerServiceSettings.newBuilder().setEndpoint(apiEndpoint).build();
51+
52+
// Initialize client that will be used to send requests. This client only needs
53+
// to be created
54+
// once, and can be reused for multiple requests.
55+
try (SecretManagerServiceClient client =
56+
SecretManagerServiceClient.create(secretManagerServiceSettings)) {
57+
// Build the parent name from the project and location.
58+
LocationName locationName = LocationName.of(projectId, locationId);
59+
60+
// Build the customer-managed encryption configuration.
61+
CustomerManagedEncryption customerManagedEncryption =
62+
CustomerManagedEncryption.newBuilder().setKmsKeyName(kmsKeyName).build();
63+
64+
// Build the secret with customer-managed encryption key.
65+
Secret secret =
66+
Secret.newBuilder().setCustomerManagedEncryption(customerManagedEncryption).build();
67+
68+
// Create the secret.
69+
Secret createdSecret = client.createSecret(locationName.toString(), secretId, secret);
70+
System.out.printf("Created secret %s\n", createdSecret.getName());
71+
return createdSecret;
72+
}
73+
}
74+
}
75+
// [END secretmanager_create_regional_secret_with_cmek]

‎secretmanager/src/main/java/secretmanager/regionalsamples/DeleteRegionalSecretAnnotations.java‎

Lines changed: 88 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,88 @@
1+
/*
2+
* Copyright 2026 Google LLC
3+
*
4+
* Licensed under the Apache License, Version 2.0 (the "License");
5+
* you may not use this file except in compliance with the License.
6+
* You may obtain a copy of the License at
7+
*
8+
* http://www.apache.org/licenses/LICENSE-2.0
9+
*
10+
* Unless required by applicable law or agreed to in writing, software
11+
* distributed under the License is distributed on an "AS IS" BASIS,
12+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
13+
* See the License for the specific language governing permissions and
14+
* limitations under the License.
15+
*/
16+
17+
package secretmanager.regionalsamples;
18+
19+
// [START secretmanager_delete_regional_secret_annotations]
20+
import com.google.cloud.secretmanager.v1.Secret;
21+
import com.google.cloud.secretmanager.v1.SecretManagerServiceClient;
22+
import com.google.cloud.secretmanager.v1.SecretManagerServiceSettings;
23+
import com.google.cloud.secretmanager.v1.SecretName;
24+
import com.google.protobuf.FieldMask;
25+
import com.google.protobuf.util.FieldMaskUtil;
26+
import java.io.IOException;
27+
import java.util.HashMap;
28+
import java.util.Map;
29+
30+
public class DeleteRegionalSecretAnnotations {
31+
32+
public static void main() throws IOException {
33+
// TODO(developer): Replace these variables before running the sample.
34+
35+
// This is the id of the GCP project
36+
String projectId = "your-project-id";
37+
// Location of the secret.
38+
String locationId = "your-location-id";
39+
// This is the id of the secret to act on
40+
String secretId = "your-secret-id";
41+
deleteRegionalSecretAnnotations(projectId, locationId, secretId);
42+
}
43+
44+
// Delete annotations from an existing regional secret.
45+
public static Secret deleteRegionalSecretAnnotations(
46+
String projectId, String locationId, String secretId) throws IOException {
47+
48+
// Endpoint to call the regional secret manager server
49+
String apiEndpoint = String.format("secretmanager.%s.rep.googleapis.com:443", locationId);
50+
SecretManagerServiceSettings secretManagerServiceSettings =
51+
SecretManagerServiceSettings.newBuilder().setEndpoint(apiEndpoint).build();
52+
53+
// Initialize client that will be used to send requests. This client only needs
54+
// to be created
55+
// once, and can be reused for multiple requests.
56+
try (SecretManagerServiceClient client =
57+
SecretManagerServiceClient.create(secretManagerServiceSettings)) {
58+
// Build the name of the secret.
59+
SecretName secretName =
60+
SecretName.ofProjectLocationSecretName(projectId, locationId, secretId);
61+
62+
// Get the current secret
63+
Secret existingSecret = client.getSecret(secretName);
64+
65+
// Remove all annotations
66+
Map<String, String> existingAnnotationsMap =
67+
new HashMap<String, String>(existingSecret.getAnnotationsMap());
68+
existingAnnotationsMap.clear();
69+
70+
// Build the updated secret.
71+
Secret secret =
72+
Secret.newBuilder()
73+
.setName(secretName.toString())
74+
.putAllAnnotations(existingAnnotationsMap)
75+
.build();
76+
77+
// Create the field mask for updating only the annotations
78+
FieldMask fieldMask = FieldMaskUtil.fromString("annotations");
79+
80+
// Update the secret.
81+
Secret updatedSecret = client.updateSecret(secret, fieldMask);
82+
System.out.printf("Deleted annotations from %s\n", updatedSecret.getName());
83+
84+
return updatedSecret;
85+
}
86+
}
87+
}
88+
// [END secretmanager_delete_regional_secret_annotations]

0 commit comments

Comments
 (0)