Skip to content

Commit c742bfa

Browse files
dhavalbhensdadiya-crestdhavalbhensdadiya-crest
authored
feat(secretmanager): Added samples related to Tags on secret (#2187)
1 parent 86e0cd9 commit c742bfa

33 files changed

Lines changed: 2594 additions & 5 deletions

‎secretmanager/README.md‎

Lines changed: 7 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -14,7 +14,13 @@ This simple command-line application demonstrates how to invoke
1414

1515
1. **Enable APIs** - [Enable the Secret Manager
1616
API](https://console.cloud.google.com/flows/enableapi?apiid=secretmanager.googleapis.com)
17-
and create a new project or select an existing project.
17+
and create a new project or select an existing project. To run the rotation tests, you will need to [Create a Pub/Sub topic](https://cloud.google.com/pubsub/docs/create-topic). CMEK related test cases need separate [KMS key](https://cloud.google.com/kms/docs/create-key) for global and regional tests.
18+
19+
Set the following environment variables:
20+
21+
- GOOGLE_CLOUD_PUBSUB_TOPIC - Full name of topic (projects/{project}/topics/{topic}).
22+
- GOOGLE_CLOUD_KMS_KEY - Full name of global KMS key (projects/{project}/locations/global/keyRings/{keyring}/cryptoKeys/{key}).
23+
- GOOGLE_CLOUD_REGIONAL_KMS_KEY - Full name of regional KMS key (projects/{project}/locations/{location}/keyRings/{keyring}/cryptoKeys/{key}).
1824

1925
1. **Download The Credentials** - Click "Go to credentials" after enabling the
2026
APIs. Click "New Credentials" and select "Service Account Key". Create a new

‎secretmanager/src/create_regional_secret_with_cmek.php‎

Lines changed: 67 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,67 @@
1+
<?php
2+
/*
3+
* Copyright 2026 Google LLC.
4+
*
5+
* Licensed under the Apache License, Version 2.0 (the "License");
6+
* you may not use this file except in compliance with the License.
7+
* You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
18+
/*
19+
* For instructions on how to run the full sample:
20+
*
21+
* @see https://github.com/GoogleCloudPlatform/php-docs-samples/tree/main/secretmanager/README.md
22+
*/
23+
24+
declare(strict_types=1);
25+
26+
namespace Google\Cloud\Samples\SecretManager;
27+
28+
// [START secretmanager_create_regional_secret_with_cmek]
29+
use Google\Cloud\SecretManager\V1\CreateSecretRequest;
30+
use Google\Cloud\SecretManager\V1\CustomerManagedEncryption;
31+
use Google\Cloud\SecretManager\V1\Secret;
32+
use Google\Cloud\SecretManager\V1\Client\SecretManagerServiceClient;
33+
34+
/**
35+
* Create a regional secret that uses a customer-managed encryption key (CMEK).
36+
*
37+
* @param string $projectId Google Cloud project id (e.g. 'my-project-id')
38+
* @param string $locationId Secret location (e.g. 'us-central1')
39+
* @param string $secretId Id for the new secret (e.g. 'my-secret-id')
40+
* @param string $kmsKeyName Full KMS key resource name (e.g. 'projects/my-project/locations/us-central1/keyRings/my-kr/cryptoKeys/my-key')
41+
*/
42+
function create_regional_secret_with_cmek(string $projectId, string $locationId, string $secretId, string $kmsKeyName): void
43+
{
44+
$options = ['apiEndpoint' => "secretmanager.$locationId.rep.googleapis.com"];
45+
$client = new SecretManagerServiceClient($options);
46+
47+
$parent = $client->locationName($projectId, $locationId);
48+
49+
$cmek = new CustomerManagedEncryption([
50+
'kms_key_name' => $kmsKeyName,
51+
]);
52+
53+
$secret = new Secret([
54+
'customer_managed_encryption' => $cmek
55+
]);
56+
57+
$request = CreateSecretRequest::build($parent, $secretId, $secret);
58+
59+
$created = $client->createSecret($request);
60+
61+
printf('Created secret %s with CMEK %s%s', $created->getName(), $kmsKeyName, PHP_EOL);
62+
}
63+
// [END secretmanager_create_regional_secret_with_cmek]
64+
65+
// The following 2 lines are only needed to execute the samples on the CLI
66+
require_once __DIR__ . '/../../testing/sample_helpers.php';
67+
\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);

‎secretmanager/src/create_regional_secret_with_expiration.php‎

Lines changed: 69 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,69 @@
1+
<?php
2+
/*
3+
* Copyright 2026 Google LLC.
4+
*
5+
* Licensed under the Apache License, Version 2.0 (the "License");
6+
* you may not use this file except in compliance with the License.
7+
* You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
18+
/*
19+
* For instructions on how to run the full sample:
20+
*
21+
* @see https://github.com/GoogleCloudPlatform/php-docs-samples/tree/main/secretmanager/README.md
22+
*/
23+
24+
declare(strict_types=1);
25+
26+
namespace Google\Cloud\Samples\SecretManager;
27+
28+
// [START secretmanager_create_regional_secret_with_expiration]
29+
use Google\Cloud\SecretManager\V1\CreateSecretRequest;
30+
use Google\Cloud\SecretManager\V1\Secret;
31+
use Google\Cloud\SecretManager\V1\Client\SecretManagerServiceClient;
32+
use Google\Protobuf\Duration;
33+
34+
/**
35+
* Create a regional secret with expiration TTL.
36+
*
37+
* @param string $projectId Google Cloud project id (e.g. 'my-project')
38+
* @param string $locationId Secret location (e.g. 'us-central1')
39+
* @param string $secretId Id for the new secret (e.g. 'my-secret')
40+
*/
41+
function create_regional_secret_with_expiration(string $projectId, string $locationId, string $secretId): void
42+
{
43+
// Create the Secret Manager Regional client.
44+
$options = ['apiEndpoint' => "secretmanager.$locationId.rep.googleapis.com"];
45+
$client = new SecretManagerServiceClient($options);
46+
47+
// Build the resource name of the parent project.
48+
$parent = $client->locationName($projectId, $locationId);
49+
50+
$duration = new Duration();
51+
$duration->setSeconds(3600); // 1 hour TTL in seconds
52+
53+
$secret = new Secret();
54+
$secret->setTtl($duration);
55+
56+
// Build the request.
57+
$request = CreateSecretRequest::build($parent, $secretId, $secret);
58+
59+
// Create the secret.
60+
$newSecret = $client->createSecret($request);
61+
62+
// Print the new secret name.
63+
printf('Created secret: %s%s', $newSecret->getName(), PHP_EOL);
64+
}
65+
// [END secretmanager_create_regional_secret_with_expiration]
66+
67+
// The following 2 lines are only needed to execute the samples on the CLI
68+
require_once __DIR__ . '/../../testing/sample_helpers.php';
69+
\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);

‎secretmanager/src/create_regional_secret_with_rotation.php‎

Lines changed: 75 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,75 @@
1+
<?php
2+
/*
3+
* Copyright 2026 Google LLC.
4+
*
5+
* Licensed under the Apache License, Version 2.0 (the "License");
6+
* you may not use this file except in compliance with the License.
7+
* You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
18+
/*
19+
* For instructions on how to run the full sample:
20+
*
21+
* @see https://github.com/GoogleCloudPlatform/php-docs-samples/tree/main/secretmanager/README.md
22+
*/
23+
24+
declare(strict_types=1);
25+
26+
namespace Google\Cloud\Samples\SecretManager;
27+
28+
// [START secretmanager_create_regional_secret_with_rotation]
29+
use Google\Cloud\SecretManager\V1\CreateSecretRequest;
30+
use Google\Cloud\SecretManager\V1\Secret;
31+
use Google\Cloud\SecretManager\V1\Rotation;
32+
use Google\Cloud\SecretManager\V1\Topic;
33+
use Google\Cloud\SecretManager\V1\Client\SecretManagerServiceClient;
34+
use Google\Protobuf\Timestamp;
35+
use Google\Protobuf\Duration;
36+
37+
/**
38+
* Create a regional secret with a rotation policy.
39+
*
40+
* @param string $projectId Your Google Cloud Project ID (e.g. 'my-project')
41+
* @param string $locationId Secret location (e.g. 'us-central1')
42+
* @param string $secretId Your secret ID (e.g. 'my-secret')
43+
* @param string $topicName Full Pub/Sub topic name (projects/{project}/topics/{topic})
44+
*/
45+
function create_regional_secret_with_rotation(string $projectId, string $locationId, string $secretId, string $topicName): void
46+
{
47+
$options = ['apiEndpoint' => "secretmanager.$locationId.rep.googleapis.com"];
48+
$client = new SecretManagerServiceClient($options);
49+
50+
$parent = $client->locationName($projectId, $locationId);
51+
52+
$nextRotationTimeSeconds = time() + 7200; // 2 hours
53+
$rotationPeriodSeconds = 3600; // 1 hour
54+
55+
$rotation = new Rotation([
56+
'next_rotation_time' => new Timestamp(['seconds' => $nextRotationTimeSeconds]),
57+
'rotation_period' => new Duration(['seconds' => $rotationPeriodSeconds]),
58+
]);
59+
60+
$secret = new Secret([
61+
'rotation' => $rotation,
62+
'topics' => [new Topic(['name' => $topicName])],
63+
]);
64+
65+
$request = CreateSecretRequest::build($parent, $secretId, $secret);
66+
67+
$newSecret = $client->createSecret($request);
68+
69+
printf('Created secret %s with rotation%s', $newSecret->getName(), PHP_EOL);
70+
}
71+
// [END secretmanager_create_regional_secret_with_rotation]
72+
73+
// The following 2 lines are only needed to execute the samples on the CLI
74+
require_once __DIR__ . '/../../testing/sample_helpers.php';
75+
\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);

‎secretmanager/src/create_regional_secret_with_topic.php‎

Lines changed: 65 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,65 @@
1+
<?php
2+
/*
3+
* Copyright 2026 Google LLC.
4+
*
5+
* Licensed under the Apache License, Version 2.0 (the "License");
6+
* you may not use this file except in compliance with the License.
7+
* You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
18+
/*
19+
* For instructions on how to run the full sample:
20+
*
21+
* @see https://github.com/GoogleCloudPlatform/php-docs-samples/tree/main/secretmanager/README.md
22+
*/
23+
24+
declare(strict_types=1);
25+
26+
namespace Google\Cloud\Samples\SecretManager;
27+
28+
// [START secretmanager_create_regional_secret_with_topic]
29+
use Google\Cloud\SecretManager\V1\CreateSecretRequest;
30+
use Google\Cloud\SecretManager\V1\Secret;
31+
use Google\Cloud\SecretManager\V1\Topic;
32+
use Google\Cloud\SecretManager\V1\Client\SecretManagerServiceClient;
33+
34+
/**
35+
* Create a regional secret and associate it with a Pub/Sub topic.
36+
*
37+
* @param string $projectId Google Cloud project id (e.g. 'my-project')
38+
* @param string $locationId Secret location (e.g. 'us-central1')
39+
* @param string $secretId Id for the new secret (e.g. 'my-secret')
40+
* @param string $topicName Full topic resource name (projects/{project}/topics/{topic})
41+
*/
42+
function create_regional_secret_with_topic(string $projectId, string $locationId, string $secretId, string $topicName): void
43+
{
44+
$options = ['apiEndpoint' => "secretmanager.$locationId.rep.googleapis.com"];
45+
$client = new SecretManagerServiceClient($options);
46+
47+
$parent = $client->locationName($projectId, $locationId);
48+
49+
$secret = new Secret([
50+
'topics' => [new Topic(['name' => $topicName])],
51+
]);
52+
53+
// Build the request.
54+
$request = CreateSecretRequest::build($parent, $secretId, $secret);
55+
56+
// Create the secret.
57+
$created = $client->createSecret($request);
58+
59+
printf('Created secret %s with topic %s%s', $created->getName(), $topicName, PHP_EOL);
60+
}
61+
// [END secretmanager_create_regional_secret_with_topic]
62+
63+
// The following 2 lines are only needed to execute the samples on the CLI
64+
require_once __DIR__ . '/../../testing/sample_helpers.php';
65+
\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);

‎secretmanager/src/create_secret_with_cmek.php‎

Lines changed: 71 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,71 @@
1+
<?php
2+
/*
3+
* Copyright 2026 Google LLC.
4+
*
5+
* Licensed under the Apache License, Version 2.0 (the "License");
6+
* you may not use this file except in compliance with the License.
7+
* You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
18+
/*
19+
* For instructions on how to run the full sample:
20+
*
21+
* @see https://github.com/GoogleCloudPlatform/php-docs-samples/tree/main/secretmanager/README.md
22+
*/
23+
24+
declare(strict_types=1);
25+
26+
namespace Google\Cloud\Samples\SecretManager;
27+
28+
// [START secretmanager_create_secret_with_cmek]
29+
use Google\Cloud\SecretManager\V1\CreateSecretRequest;
30+
use Google\Cloud\SecretManager\V1\Replication;
31+
use Google\Cloud\SecretManager\V1\Replication\Automatic;
32+
use Google\Cloud\SecretManager\V1\CustomerManagedEncryption;
33+
use Google\Cloud\SecretManager\V1\Secret;
34+
use Google\Cloud\SecretManager\V1\Client\SecretManagerServiceClient;
35+
36+
/**
37+
* Create a secret that uses a customer-managed encryption key (CMEK).
38+
*
39+
* @param string $projectId Google Cloud project id (e.g. 'my-project-id')
40+
* @param string $secretId Id for the new secret (e.g. 'my-secret-id')
41+
* @param string $kmsKeyName Full KMS key resource name (e.g. 'projects/my-project/locations/global/keyRings/my-kr/cryptoKeys/my-key')
42+
*/
43+
function create_secret_with_cmek(string $projectId, string $secretId, string $kmsKeyName): void
44+
{
45+
$client = new SecretManagerServiceClient();
46+
47+
$parent = $client->projectName($projectId);
48+
49+
$cmek = new CustomerManagedEncryption([
50+
'kms_key_name' => $kmsKeyName,
51+
]);
52+
53+
$secret = new Secret([
54+
'replication' => new Replication([
55+
'automatic' => new Automatic([
56+
'customer_managed_encryption' => $cmek,
57+
]),
58+
]),
59+
]);
60+
61+
$request = CreateSecretRequest::build($parent, $secretId, $secret);
62+
63+
$created = $client->createSecret($request);
64+
65+
printf('Created secret %s with CMEK %s%s', $created->getName(), $kmsKeyName, PHP_EOL);
66+
}
67+
// [END secretmanager_create_secret_with_cmek]
68+
69+
// The following 2 lines are only needed to execute the samples on the CLI
70+
require_once __DIR__ . '/../../testing/sample_helpers.php';
71+
\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);

0 commit comments

Comments
 (0)