New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
feat(bigtable): Customer Managed Encryption (CMEK) #3899
Merged
Merged
Changes from 21 commits
Commits
Show all changes
33 commits
Select commit
Hold shift + click to select a range
98ccaff
feat(bigtable): add EncryptionInfo method to admin surface
crwilcox 2c97163
feat(bigtable: add EncryptionInfo to backups
crwilcox 84206e6
test(bigtable): add bit of testing for new encryption info
crwilcox 42a9437
chore(): add some notes for self
crwilcox b7008bf
test: add additional tests for methods
crwilcox 9d89cdc
test: bring back some test bits
crwilcox 366a695
test: wait for cmek to become 'ready', before evaluating other fields
crwilcox e9cebaa
chore: cleanup
crwilcox 2aa4d06
chore: some pr feedback cleanup
crwilcox 095d606
cleanup
crwilcox c9f9abf
tritone feedback, move backup info to have pointer to encryption info…
crwilcox 1b45af1
create custom type instead of map
crwilcox 71dcf18
iota
crwilcox 4818177
cleanup
crwilcox bf94324
Comment improvements
crwilcox 843d988
use same key specified in contributing
crwilcox 8117c7e
Merge branch 'master' into bigtable-cmek
crwilcox b5a7efd
Code cleanup
crwilcox ee8f42a
Merge branch 'master' into bigtable-cmek
crwilcox 09a4ef0
Merge branch 'master' into bigtable-cmek
crwilcox f413fc8
gofmt
crwilcox 4f400f2
Address nits from codyoss
crwilcox 749ae3a
Merge branch 'master' into bigtable-cmek
crwilcox 4a0010b
Merge branch 'master' into bigtable-cmek
crwilcox 20c839d
docs
crwilcox 533fe8c
Merge branch 'master' into bigtable-cmek
crwilcox bdb52a7
fix: address kolea2 comments
crwilcox 60e210e
Merge branch 'bigtable-cmek' of github.com:crwilcox/google-cloud-go i…
crwilcox 22957b5
fix: narrow view for getting tables
crwilcox 19a5bb1
Merge branch 'master' into bigtable-cmek
crwilcox 6c492a6
refactor: remove repeated Encryption keyword
crwilcox b699e1a
Merge branch 'master' into bigtable-cmek
crwilcox 891e52f
fix: infer service account email for contributing guide
crwilcox File filter
Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Oops, something went wrong.
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
is this true? Wouldn't you want this to point to a service account?
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
I figured that, as this encryption key isn't really a secret, opening it up to all authn'd users was fine. I could be mistaken but I also think adding a service account here would be another dependency/setup step to being a contributor.
@tritone do you know what
gsutil kms
is doing behind the scenes?There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Hmm not exactly sure what the question is here but here's the code: https://github.com/GoogleCloudPlatform/gsutil/blob/7845859b924004d16db0408335fd434424f6c8d7/gslib/commands/kms.py
Looks like it requests a service account and creates one if it doesn't exist.
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Could you re-use the service account used elsewhere in the setup?
GCLOUD_TESTS_GOLANG_KEY
should already point to a service account json; is there a gcloud command to grab the email from that? I see https://cloud.google.com/sdk/gcloud/reference/iam/service-accounts/list . I just don't know enough about IAM to be confident that adding this binding isn't some kind of security risk.There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
So, the complication here is we store the path to the key, but the email you need (the member id) for the service account is within the json.
I could infer this as it generally follows that form, but it may not. I was avoiding adding another EnvVar.