Help us shape the future of Go! Take the 2026 Go Developer Survey

gcpkms

package
v1.9.0 Latest Latest
Warning

This package is not in the latest version of its module.

 Go to latest Published: Oct 27, 2026 License: MIT Imports: 54 Imported by: 0

README

Google Cloud KMS

Parity grade: B · SDK cloud.google.com/go/kms@v1.35.0 · last audited 2026-10-19 (d0dad7f73)

Coverage

Metric Value
PARITY entries audited 35 (35 ok)
Feature families 5 (2 ok, 3 partial)
Known gaps 4
Deferred items 0
Resource leaks clean
Known gaps
  • ImportTrustedKeyWrappedCryptoKeyVersion, ExportTrustedKeyWrappedCryptoKeyVersion and Decapsulate are UNIMPLEMENTED.
  • EkmService, Autokey, AutokeyAdmin and HsmManagement services are not served; EKM connections and crypto_key_backend are rejected.
  • EC_SIGN_SECP256K1_SHA256 (no stdlib curve), post-quantum and KEM algorithms, AES_256_KWP (AES_WRAPPING purpose has no RPC that uses it) and EXTERNAL_SYMMETRIC_ENCRYPTION are rejected as unsupported.
  • Attestation, key_access_justifications_policy and the version view parameter are not populated.

More

Documentation

Index

Constants

View Source 
const DefaultPort = 8087

DefaultPort is the dedicated gRPC listener's default TCP port.

Variables

View Source 
var ErrNilAppContext = errors.New("gcpkms: nil app context")

ErrNilAppContext is returned when Init is called with a nil AppContext.

Functions

This section is empty.

Types

type ConfigProvider 

type ConfigProvider interface {
	GetGCPKMSSettings() Settings
}

ConfigProvider extracts Cloud KMS configuration from the AppContext Config.

type Handler 

type Handler struct {
	Backend *InMemoryBackend

	Port int
	// contains filtered or unexported fields
}

Handler serves the Cloud KMS gRPC API on a dedicated listener.

func NewHandler 

func NewHandler(backend *InMemoryBackend) *Handler

NewHandler creates a Handler; callers override Port from Settings.

func (*Handler) API 

func (h *Handler) API() kmspb.KeyManagementServiceServer

API exposes the KeyManagementService for in-process callers (dashboard proxy).

func (*Handler) Addr 

func (h *Handler) Addr() string

Addr returns the bound listener address, or "" before StartWorker.

func (*Handler) ExtractOperation 

func (h *Handler) ExtractOperation(*echo.Context) string

ExtractOperation is unused: requests never reach the shared router.

func (*Handler) ExtractResource 

func (h *Handler) ExtractResource(*echo.Context) string

ExtractResource is unused: requests never reach the shared router.

func (*Handler) GetSupportedOperations 

func (h *Handler) GetSupportedOperations() []string

GetSupportedOperations lists the supported gRPC methods.

func (*Handler) Handler 

func (h *Handler) Handler() echo.HandlerFunc

Handler returns a 404 handler; the real API is gRPC on the dedicated port.

func (*Handler) MatchPriority 

func (h *Handler) MatchPriority() int

MatchPriority is irrelevant because RouteMatcher never matches.

func (*Handler) Name 

func (h *Handler) Name() string

Name returns the service name.

func (*Handler) Reset 

func (h *Handler) Reset()

Reset clears all in-memory state.

func (*Handler) Restore 

func (h *Handler) Restore(ctx context.Context, data []byte) error

Restore implements persistence.Persistable by delegating to the backend.

func (*Handler) RouteMatcher 

func (h *Handler) RouteMatcher() service.Matcher

RouteMatcher never matches: Cloud KMS runs on its own gRPC listener.

func (*Handler) Shutdown 

func (h *Handler) Shutdown(ctx context.Context)

Shutdown stops the gRPC server and the janitor, forcing a close after a short grace period.

func (*Handler) Snapshot 

func (h *Handler) Snapshot(ctx context.Context) []byte

Snapshot implements persistence.Persistable by delegating to the backend.

func (*Handler) StartWorker 

func (h *Handler) StartWorker(ctx context.Context) error

StartWorker binds the dedicated listener synchronously so a port conflict is returned to the caller.

type InMemoryBackend 

type InMemoryBackend struct {
	// contains filtered or unexported fields
}

InMemoryBackend holds all key rings, keys, versions, import jobs and IAM policies under one lock.

func NewInMemoryBackend 

func NewInMemoryBackend() *InMemoryBackend

NewInMemoryBackend creates an empty backend.

func (*InMemoryBackend) AsymmetricDecrypt 

func (b *InMemoryBackend) AsymmetricDecrypt(
	req *kmspb.AsymmetricDecryptRequest,
) (*kmspb.AsymmetricDecryptResponse, error)

AsymmetricDecrypt decrypts RSA-OAEP ciphertext with an ASYMMETRIC_DECRYPT version.

func (*InMemoryBackend) AsymmetricSign 

func (b *InMemoryBackend) AsymmetricSign(req *kmspb.AsymmetricSignRequest) (*kmspb.AsymmetricSignResponse, error)

AsymmetricSign signs a digest (or data) with an ASYMMETRIC_SIGN version.

func (*InMemoryBackend) CreateCryptoKey 

func (b *InMemoryBackend) CreateCryptoKey(req *kmspb.CreateCryptoKeyRequest) (*kmspb.CryptoKey, error)

CreateCryptoKey creates a key and, unless skipped or import-only, its first version.

func (*InMemoryBackend) CreateCryptoKeyVersion 

func (b *InMemoryBackend) CreateCryptoKeyVersion(
	req *kmspb.CreateCryptoKeyVersionRequest,
) (*kmspb.CryptoKeyVersion, error)

CreateCryptoKeyVersion generates a new ENABLED version from the key's template.

func (*InMemoryBackend) CreateImportJob 

func (b *InMemoryBackend) CreateImportJob(req *kmspb.CreateImportJobRequest) (*kmspb.ImportJob, error)

CreateImportJob creates an ACTIVE import job with a fresh RSA wrapping key.

func (*InMemoryBackend) CreateKeyRing 

func (b *InMemoryBackend) CreateKeyRing(req *kmspb.CreateKeyRingRequest) (*kmspb.KeyRing, error)

CreateKeyRing creates a key ring under a project location.

func (*InMemoryBackend) Decrypt 

func (b *InMemoryBackend) Decrypt(req *kmspb.DecryptRequest) (*kmspb.DecryptResponse, error)

Decrypt decrypts a ciphertext produced by Encrypt, using the version embedded in it.

func (*InMemoryBackend) DeleteCryptoKey 

func (b *InMemoryBackend) DeleteCryptoKey(req *kmspb.DeleteCryptoKeyRequest) (*longrunningpb.Operation, error)

DeleteCryptoKey permanently deletes a key whose versions have all been deleted and records a retired resource.

func (*InMemoryBackend) DeleteCryptoKeyVersion 

func (b *InMemoryBackend) DeleteCryptoKeyVersion(
	req *kmspb.DeleteCryptoKeyVersionRequest,
) (*longrunningpb.Operation, error)

DeleteCryptoKeyVersion permanently deletes a DESTROYED version; its id is never reused.

func (*InMemoryBackend) DestroyCryptoKeyVersion 

func (b *InMemoryBackend) DestroyCryptoKeyVersion(
	req *kmspb.DestroyCryptoKeyVersionRequest,
) (*kmspb.CryptoKeyVersion, error)

DestroyCryptoKeyVersion schedules a version's destruction after the key's destroy_scheduled_duration.

func (*InMemoryBackend) Encrypt 

func (b *InMemoryBackend) Encrypt(req *kmspb.EncryptRequest) (*kmspb.EncryptResponse, error)

Encrypt encrypts with the primary version (or the named version) of an ENCRYPT_DECRYPT key.

func (*InMemoryBackend) GenerateRandomBytes 

func (b *InMemoryBackend) GenerateRandomBytes(
	req *kmspb.GenerateRandomBytesRequest,
) (*kmspb.GenerateRandomBytesResponse, error)

GenerateRandomBytes returns cryptographically secure random bytes for a location.

func (*InMemoryBackend) GetCryptoKey 

func (b *InMemoryBackend) GetCryptoKey(name string) (*kmspb.CryptoKey, error)

GetCryptoKey returns a key with its primary version.

func (*InMemoryBackend) GetCryptoKeyVersion 

func (b *InMemoryBackend) GetCryptoKeyVersion(name string) (*kmspb.CryptoKeyVersion, error)

GetCryptoKeyVersion returns a version's metadata.

func (*InMemoryBackend) GetIamPolicy 

func (b *InMemoryBackend) GetIamPolicy(resource string, version int32) (*iampb.Policy, error)

GetIamPolicy returns a resource's IAM policy at the requested version, or an empty policy when none is set.

func (*InMemoryBackend) GetImportJob 

func (b *InMemoryBackend) GetImportJob(name string) (*kmspb.ImportJob, error)

GetImportJob returns an import job.

func (*InMemoryBackend) GetKeyRing 

func (b *InMemoryBackend) GetKeyRing(name string) (*kmspb.KeyRing, error)

GetKeyRing returns a key ring.

func (*InMemoryBackend) GetPublicKey 

func (b *InMemoryBackend) GetPublicKey(req *kmspb.GetPublicKeyRequest) (*kmspb.PublicKey, error)

GetPublicKey returns the public half of an asymmetric version.

func (*InMemoryBackend) GetRetiredResource 

func (b *InMemoryBackend) GetRetiredResource(name string) (*kmspb.RetiredResource, error)

GetRetiredResource returns a retired-resource record.

func (*InMemoryBackend) ImportCryptoKeyVersion 

func (b *InMemoryBackend) ImportCryptoKeyVersion(
	req *kmspb.ImportCryptoKeyVersionRequest,
) (*kmspb.CryptoKeyVersion, error)

ImportCryptoKeyVersion imports wrapped key material as a new ENABLED version, or re-imports into a DESTROYED reimport-eligible version.

func (*InMemoryBackend) ListCryptoKeyVersions 

func (b *InMemoryBackend) ListCryptoKeyVersions(
	req *kmspb.ListCryptoKeyVersionsRequest,
) ([]*kmspb.CryptoKeyVersion, string, int, error)

ListCryptoKeyVersions lists a key's versions in ascending version order.

func (*InMemoryBackend) ListCryptoKeys 

func (b *InMemoryBackend) ListCryptoKeys(req *kmspb.ListCryptoKeysRequest) ([]*kmspb.CryptoKey, string, int, error)

ListCryptoKeys lists a key ring's keys sorted by name.

func (*InMemoryBackend) ListImportJobs 

func (b *InMemoryBackend) ListImportJobs(req *kmspb.ListImportJobsRequest) ([]*kmspb.ImportJob, string, int, error)

ListImportJobs lists a key ring's import jobs sorted by name.

func (*InMemoryBackend) ListKeyRings 

func (b *InMemoryBackend) ListKeyRings(req *kmspb.ListKeyRingsRequest) ([]*kmspb.KeyRing, string, int, error)

ListKeyRings lists a location's key rings sorted by name.

func (*InMemoryBackend) ListRetiredResources 

func (b *InMemoryBackend) ListRetiredResources(
	req *kmspb.ListRetiredResourcesRequest,
) ([]*kmspb.RetiredResource, string, int, error)

ListRetiredResources lists a location's retired resources sorted by name.

func (*InMemoryBackend) MacSign 

func (b *InMemoryBackend) MacSign(req *kmspb.MacSignRequest) (*kmspb.MacSignResponse, error)

MacSign computes an HMAC with a MAC version.

func (*InMemoryBackend) MacVerify 

func (b *InMemoryBackend) MacVerify(req *kmspb.MacVerifyRequest) (*kmspb.MacVerifyResponse, error)

MacVerify checks an HMAC in constant time.

func (*InMemoryBackend) RawDecrypt 

func (b *InMemoryBackend) RawDecrypt(req *kmspb.RawDecryptRequest) (*kmspb.RawDecryptResponse, error)

RawDecrypt reverses RawEncrypt.

func (*InMemoryBackend) RawEncrypt 

func (b *InMemoryBackend) RawEncrypt(req *kmspb.RawEncryptRequest) (*kmspb.RawEncryptResponse, error)

RawEncrypt encrypts with a RAW_ENCRYPT_DECRYPT version using the version's AES mode.

func (*InMemoryBackend) Reset 

func (b *InMemoryBackend) Reset()

Reset clears all state.

func (*InMemoryBackend) Restore 

func (b *InMemoryBackend) Restore(ctx context.Context, data []byte) error

Restore loads backend state from a snapshot.

func (*InMemoryBackend) RestoreCryptoKeyVersion 

func (b *InMemoryBackend) RestoreCryptoKeyVersion(
	req *kmspb.RestoreCryptoKeyVersionRequest,
) (*kmspb.CryptoKeyVersion, error)

RestoreCryptoKeyVersion cancels a scheduled destruction, leaving the version DISABLED.

func (*InMemoryBackend) RunJanitor 

func (b *InMemoryBackend) RunJanitor(ctx context.Context, every time.Duration)

RunJanitor sweeps due rotations, destructions and import-job expiry until ctx ends.

func (*InMemoryBackend) SetIamPolicy 

func (b *InMemoryBackend) SetIamPolicy(req *iampb.SetIamPolicyRequest) (*iampb.Policy, error)

SetIamPolicy replaces a resource's IAM policy; a non-empty etag must match the stored policy.

func (*InMemoryBackend) Snapshot 

func (b *InMemoryBackend) Snapshot(ctx context.Context) []byte

Snapshot serialises all key rings, keys, versions (with key material), import jobs and policies.

func (*InMemoryBackend) Sweep 

func (b *InMemoryBackend) Sweep()

Sweep applies due automatic rotations, scheduled destructions and import-job expiry.

func (*InMemoryBackend) TestIamPermissions 

func (b *InMemoryBackend) TestIamPermissions(
	req *iampb.TestIamPermissionsRequest,
) (*iampb.TestIamPermissionsResponse, error)

TestIamPermissions reports the requested Cloud KMS permissions as granted: the emulator performs no authorization.

func (*InMemoryBackend) UpdateCryptoKey 

func (b *InMemoryBackend) UpdateCryptoKey(req *kmspb.UpdateCryptoKeyRequest) (*kmspb.CryptoKey, error)

UpdateCryptoKey updates labels, rotation settings and the version template per update_mask.

func (*InMemoryBackend) UpdateCryptoKeyPrimaryVersion 

func (b *InMemoryBackend) UpdateCryptoKeyPrimaryVersion(
	req *kmspb.UpdateCryptoKeyPrimaryVersionRequest,
) (*kmspb.CryptoKey, error)

UpdateCryptoKeyPrimaryVersion promotes an ENABLED version of an ENCRYPT_DECRYPT key.

func (*InMemoryBackend) UpdateCryptoKeyVersion 

func (b *InMemoryBackend) UpdateCryptoKeyVersion(
	req *kmspb.UpdateCryptoKeyVersionRequest,
) (*kmspb.CryptoKeyVersion, error)

UpdateCryptoKeyVersion toggles a version between ENABLED and DISABLED (update_mask "state").

type Provider 

type Provider struct{}

Provider implements service.Provider for Google Cloud KMS. It serves gRPC on its own listener (see Handler.StartWorker) and never matches on the shared AWS router.

func (*Provider) Init 

func (p *Provider) Init(ctx *service.AppContext) (service.Registerable, error)

Init creates the backend and handler; the port is bound in StartWorker.

func (*Provider) Name 

func (p *Provider) Name() string

Name returns the service provider name.

type Settings 

type Settings struct {
	Port int `` //nolint:lll // config struct tags are intentionally verbose
	/* 165-byte string literal not displayed */
}

Settings holds service-level configuration, embedded in the root CLI command as CLI.GCPKMS.

func DefaultSettings 

func DefaultSettings() Settings

DefaultSettings returns the settings used when no ConfigProvider is available.

Source Files

View all Source files

Jump to

Keyboard shortcuts

? : This menu
/ : Search site
f or F : Jump to
y or Y : Canonical URL
go.dev uses cookies from Google to deliver and enhance the quality of its services and to analyze traffic. Learn more.