Skip to content

Add support for blob-level KMS encryption keys#5221

Merged
tseaver merged 9 commits into
storage-support_kms_keys-wipfrom
storage-support_kms_keys-blob_kms_encryption_key
Apr 26, 2018
Merged

Add support for blob-level KMS encryption keys#5221
tseaver merged 9 commits into
storage-support_kms_keys-wipfrom
storage-support_kms_keys-blob_kms_encryption_key

Conversation

@tseaver

@tseaver tseaver commented Apr 23, 2018 •
edited by dpebot
Loading

Copy link
Copy Markdown
Contributor

No description provided.

@tseaver tseaver added type: feature request ‘Nice-to-have’ improvement, new feature or different behavior or design. api: storage Issues related to the Cloud Storage API. labels Apr 23, 2018
@tseaver tseaver requested review from frankyn and theacodes April 23, 2018 19:54
@tseaver tseaver requested a review from lukesneeringer as a code owner April 23, 2018 19:54
@googlebot googlebot added the cla: yes This human has signed the Contributor License Agreement. label Apr 23, 2018
theacodes
theacodes approved these changes Apr 23, 2018
View reviewed changes
Comment thread storage/google/cloud/storage/blob.py Outdated

:type kms_encryption_key: bytes
:param kms_encryption_key:
Optional esource name of Cloud KMS key used to encrypt the blob's

This comment was marked as spam.

Sign in to view

frankyn
frankyn suggested changes Apr 24, 2018
View reviewed changes

@frankyn frankyn left a comment

Copy link
Copy Markdown
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Similar to default_kms_key_name: Could you add tests which exercise the client library with GCS?

Additional tests to add:

  • After rotating from CSEK to CMEK, verify the contents of the object are readable on a download.

Comment thread storage/google/cloud/storage/blob.py Outdated
See https://cloud.google.com/storage/docs/encryption#customer-supplied.

:type kms_encryption_key: bytes
:param kms_encryption_key:

This comment was marked as spam.

Sign in to view

This comment was marked as spam.

Sign in to view

Comment thread storage/tests/unit/test_blob.py Outdated
download_url = blob._get_download_url()
expected_url = (
'https://www.googleapis.com/download/storage/v1/b/'
'buhkit/o/bzzz-fly.txt?alt=media&{}'.format(kms_encoded))

This comment was marked as spam.

Sign in to view

This comment was marked as spam.

Sign in to view

frankyn
frankyn reviewed Apr 26, 2018
View reviewed changes
Comment thread storage/tests/unit/test_blob.py
download_url = blob._get_download_url()
expected_url = (
'https://www.googleapis.com/download/storage/v1/b/'
'buhkit/o/bzzz-fly.txt?alt=media') # kmsKeyName *not* expected

This comment was marked as spam.

Sign in to view

@tseaver

tseaver commented Apr 26, 2018

Copy link
Copy Markdown
Contributor Author

@dpebot please merge when green.

@dpebot

dpebot commented Apr 26, 2018

Copy link
Copy Markdown
Contributor

Okay! I'll merge when all statuses are green and all reviewers approve.

@dpebot dpebot added the automerge Merge the pull request once unit tests and other checks pass. label Apr 26, 2018
@dpebot dpebot self-assigned this Apr 26, 2018
@theacodes

theacodes commented Apr 26, 2018

Copy link
Copy Markdown
Contributor

She's been having some trouble with automerge lately, so let's see if it actually works.

@tseaver

tseaver commented Apr 26, 2018

Copy link
Copy Markdown
Contributor Author

Merging in spite of unrelated logging systest failures.

@tseaver tseaver merged commit 833b049 into storage-support_kms_keys-wip Apr 26, 2018
@tseaver tseaver deleted the storage-support_kms_keys-blob_kms_encryption_key branch April 26, 2018 20:52
tseaver added a commit that referenced this pull request May 9, 2018
@tseaver
Add support for blob-level KMS encryption keys (#5221)
c7c87f5
tseaver added a commit that referenced this pull request May 9, 2018
@tseaver
Storage: add support for KMS keys (#5259)
38c3e9a 
* Add support for blob-level KMS encryption keys (#5221)

* Add 'Bucket.default_kms_key_name' property. (#5222)

* Expose 'Blob.kms_key_name' as read-only property (#5249)

* Add system tests for GCS-KMS integration (#5257)
parthea pushed a commit that referenced this pull request Mar 9, 2026
@tseaver
Storage: add support for KMS keys (#5259)
592ca82 
* Add support for blob-level KMS encryption keys (#5221)

* Add 'Bucket.default_kms_key_name' property. (#5222)

* Expose 'Blob.kms_key_name' as read-only property (#5249)

* Add system tests for GCS-KMS integration (#5257)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Reviewers

@lukesneeringer lukesneeringer Awaiting requested review from lukesneeringer
2 more reviewers
@theacodes theacodes theacodes approved these changes
@frankyn frankyn frankyn approved these changes
Reviewers whose approvals may not affect merge requirements

Assignees

@dpebot dpebot

Labels

api: storage Issues related to the Cloud Storage API. automerge Merge the pull request once unit tests and other checks pass. cla: yes This human has signed the Contributor License Agreement. type: feature request ‘Nice-to-have’ improvement, new feature or different behavior or design.

Projects

None yet

Milestone

No milestone

Development

Successfully merging this pull request may close these issues.

5 participants

@tseaver @dpebot @theacodes @frankyn @googlebot