Skip to content

Commit bec2c2d

Browse files
yasharelyasharel
committed
feat(cloudkms): add samples for CryptoKey/CryptoKeyVersion deletion and get/lists RetiredResources
1 parent 57f7e42 commit bec2c2d

5 files changed

Lines changed: 313 additions & 0 deletions

File tree

‎kms/src/delete_crypto_key.php‎

Lines changed: 48 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,48 @@
1+
<?php
2+
/*
3+
* Copyright 2026 Google LLC.
4+
*
5+
* Licensed under the Apache License, Version 2.0 (the "License");
6+
* you may not use this file except in compliance with the License.
7+
* You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
18+
declare(strict_types=1);
19+
20+
namespace Google\Cloud\Samples\Kms;
21+
22+
// [START kms_delete_crypto_key]
23+
use Google\Cloud\Kms\V1\Client\KeyManagementServiceClient;
24+
use Google\Cloud\Kms\V1\DeleteCryptoKeyRequest;
25+
26+
function delete_crypto_key(
27+
string $projectId = 'my-project',
28+
string $locationId = 'us-east1',
29+
string $keyRingId = 'my-key-ring',
30+
string $keyId = 'my-key'
31+
): void {
32+
// Create the Cloud KMS client.
33+
$client = new KeyManagementServiceClient();
34+
35+
// Build the resource name of the crypto key.
36+
$name = $client->cryptoKeyName($projectId, $locationId, $keyRingId, $keyId);
37+
38+
// Call the API.
39+
$request = (new DeleteCryptoKeyRequest())
40+
->setName($name);
41+
$client->deleteCryptoKey($request);
42+
printf('Deleted crypto key: %s' . PHP_EOL, $name);
43+
}
44+
// [END kms_delete_crypto_key]
45+
46+
// The following 2 lines are only needed to run the samples
47+
require_once __DIR__ . '/../../testing/sample_helpers.php';
48+
return \Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);

‎kms/src/delete_crypto_key_version.php‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
<?php
2+
/*
3+
* Copyright 2026 Google LLC.
4+
*
5+
* Licensed under the Apache License, Version 2.0 (the "License");
6+
* you may not use this file except in compliance with the License.
7+
* You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
18+
declare(strict_types=1);
19+
20+
namespace Google\Cloud\Samples\Kms;
21+
22+
// [START kms_delete_crypto_key_version]
23+
use Google\Cloud\Kms\V1\Client\KeyManagementServiceClient;
24+
use Google\Cloud\Kms\V1\DeleteCryptoKeyVersionRequest;
25+
26+
function delete_crypto_key_version(
27+
string $projectId = 'my-project',
28+
string $locationId = 'us-east1',
29+
string $keyRingId = 'my-key-ring',
30+
string $keyId = 'my-key',
31+
string $versionId = '123'
32+
): void {
33+
// Create the Cloud KMS client.
34+
$client = new KeyManagementServiceClient();
35+
36+
// Build the resource name of the crypto key version.
37+
$name = $client->cryptoKeyVersionName($projectId, $locationId, $keyRingId, $keyId, $versionId);
38+
39+
// Call the API.
40+
$request = (new DeleteCryptoKeyVersionRequest())
41+
->setName($name);
42+
$client->deleteCryptoKeyVersion($request);
43+
printf('Deleted crypto key version: %s' . PHP_EOL, $name);
44+
}
45+
// [END kms_delete_crypto_key_version]
46+
47+
// The following 2 lines are only needed to run the samples
48+
require_once __DIR__ . '/../../testing/sample_helpers.php';
49+
return \Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);

‎kms/src/get_retired_resource.php‎

Lines changed: 49 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,49 @@
1+
<?php
2+
/*
3+
* Copyright 2026 Google LLC.
4+
*
5+
* Licensed under the Apache License, Version 2.0 (the "License");
6+
* you may not use this file except in compliance with the License.
7+
* You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
18+
declare(strict_types=1);
19+
20+
namespace Google\Cloud\Samples\Kms;
21+
22+
// [START kms_get_retired_resource]
23+
use Google\Cloud\Kms\V1\Client\KeyManagementServiceClient;
24+
use Google\Cloud\Kms\V1\GetRetiredResourceRequest;
25+
26+
function get_retired_resource(
27+
string $projectId = 'my-project',
28+
string $locationId = 'us-east1',
29+
string $retiredResourceId = 'my-retired-resource'
30+
): void {
31+
// Create the Cloud KMS client.
32+
$client = new KeyManagementServiceClient();
33+
34+
// Build the resource name of the retired resource.
35+
$name = $client->retiredResourceName($projectId, $locationId, $retiredResourceId);
36+
37+
// Call the API.
38+
$request = (new GetRetiredResourceRequest())
39+
->setName($name);
40+
$response = $client->getRetiredResource($request);
41+
42+
printf('Retired Resource Name: %s' . PHP_EOL, $response->getName());
43+
printf('Original Resource: %s' . PHP_EOL, $response->getOriginalResource());
44+
}
45+
// [END kms_get_retired_resource]
46+
47+
// The following 2 lines are only needed to run the samples
48+
require_once __DIR__ . '/../../testing/sample_helpers.php';
49+
return \Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);

‎kms/src/list_retired_resources.php‎

Lines changed: 51 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,51 @@
1+
<?php
2+
/*
3+
* Copyright 2026 Google LLC.
4+
*
5+
* Licensed under the Apache License, Version 2.0 (the "License");
6+
* you may not use this file except in compliance with the License.
7+
* You may obtain a copy of the License at
8+
*
9+
* http://www.apache.org/licenses/LICENSE-2.0
10+
*
11+
* Unless required by applicable law or agreed to in writing, software
12+
* distributed under the License is distributed on an "AS IS" BASIS,
13+
* WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
14+
* See the License for the specific language governing permissions and
15+
* limitations under the License.
16+
*/
17+
18+
declare(strict_types=1);
19+
20+
namespace Google\Cloud\Samples\Kms;
21+
22+
// [START kms_list_retired_resources]
23+
use Google\Cloud\Kms\V1\Client\KeyManagementServiceClient;
24+
use Google\Cloud\Kms\V1\ListRetiredResourcesRequest;
25+
26+
function list_retired_resources(
27+
string $projectId = 'my-project',
28+
string $locationId = 'us-east1'
29+
): void {
30+
// Create the Cloud KMS client.
31+
$client = new KeyManagementServiceClient();
32+
33+
// Build the parent location name.
34+
$parent = $client->locationName($projectId, $locationId);
35+
36+
// Call the API.
37+
$request = (new ListRetiredResourcesRequest())
38+
->setParent($parent);
39+
$response = $client->listRetiredResources($request);
40+
41+
foreach ($response as $retiredResource) {
42+
printf('Retired Resource Name: %s' . PHP_EOL, $retiredResource->getName());
43+
printf('Original Resource: %s' . PHP_EOL, $retiredResource->getOriginalResource());
44+
printf('Delete Time: %s' . PHP_EOL, $retiredResource->getDeleteTime()->getSeconds());
45+
}
46+
}
47+
// [END kms_list_retired_resources]
48+
49+
// The following 2 lines are only needed to run the samples
50+
require_once __DIR__ . '/../../testing/sample_helpers.php';
51+
return \Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);

‎kms/test/kmsTest.php‎

Lines changed: 116 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -815,6 +815,122 @@ public function testVerifyAsymmetricSignatureRsa()
815815
$this->assertTrue(true);
816816
}
817817

818+
public function testDeleteCryptoKey()
819+
{
820+
$client = new KeyManagementServiceClient();
821+
$keyRingName = $client->keyRingName(self::$projectId, self::$locationId, self::$keyRingId);
822+
$keyId = self::randomId();
823+
824+
// Create an ASYMMETRIC_SIGN key (no initial version created by default for this purpose).
825+
$key = (new CryptoKey())
826+
->setPurpose(CryptoKeyPurpose::ASYMMETRIC_SIGN)
827+
->setVersionTemplate((new CryptoKeyVersionTemplate)
828+
->setAlgorithm(CryptoKeyVersionAlgorithm::EC_SIGN_P256_SHA256));
829+
830+
$request = (new CreateCryptoKeyRequest())
831+
->setParent($keyRingName)
832+
->setCryptoKeyId($keyId)
833+
->setCryptoKey($key)
834+
->setSkipInitialVersionCreation(true);
835+
836+
$client->createCryptoKey($request);
837+
838+
// Delete it.
839+
list(, $output) = $this->runFunctionSnippet('delete_crypto_key', [
840+
self::$projectId,
841+
self::$locationId,
842+
self::$keyRingId,
843+
$keyId
844+
]);
845+
846+
$this->assertStringContainsString('Deleted crypto key', $output);
847+
848+
$keyName = $client->cryptoKeyName(self::$projectId, self::$locationId, self::$keyRingId, $keyId);
849+
try {
850+
$getKeyRequest = (new \Google\Cloud\Kms\V1\GetCryptoKeyRequest())->setName($keyName);
851+
$deletedKey = $client->getCryptoKey($getKeyRequest);
852+
$this->assertEquals(CryptoKey\State::DELETED, $deletedKey->getState());
853+
} catch (\Google\ApiCore\ApiException $e) {
854+
// If the key is not found, it might be due to eventual consistency or it's effectively deleted.
855+
// However, typically it SHOULD exist in DELETED state.
856+
// If it returns NOT_FOUND, that is also a valid "deleted" state for some configurations or consistency windows.
857+
// Let's accept NOT_FOUND as valid for this test.
858+
$this->assertEquals(\Google\Rpc\Code::NOT_FOUND, $e->getCode());
859+
}
860+
861+
return $keyId;
862+
}
863+
864+
/**
865+
* @depends testDeleteCryptoKey
866+
*/
867+
public function testListRetiredResources($deletedKeyId)
868+
{
869+
// Add retry logic for eventual consistency
870+
$attempts = 0;
871+
$found = false;
872+
873+
while ($attempts < 10 && !$found) {
874+
// runFunctionSnippet captures output already.
875+
list(, $output) = $this->runFunctionSnippet('list_retired_resources', [
876+
self::$projectId,
877+
self::$locationId
878+
]);
879+
880+
if (strpos($output, $deletedKeyId) !== false) {
881+
$found = true;
882+
$this->assertStringContainsString('Retired Resource Name', $output);
883+
} else {
884+
sleep(1);
885+
$attempts++;
886+
}
887+
}
888+
889+
if (!$found) {
890+
$this->fail("Did not find deleted key $deletedKeyId in retired resources list.");
891+
}
892+
}
893+
894+
/**
895+
* @depends testDeleteCryptoKey
896+
*/
897+
public function testGetRetiredResource($deletedKeyId)
898+
{
899+
$client = new KeyManagementServiceClient();
900+
$parent = $client->locationName(self::$projectId, self::$locationId);
901+
$listRequest = (new \Google\Cloud\Kms\V1\ListRetiredResourcesRequest())->setParent($parent);
902+
903+
$retiredResource = null;
904+
foreach ($client->listRetiredResources($listRequest) as $res) {
905+
if (strpos($res->getOriginalResource(), $deletedKeyId) !== false) {
906+
$retiredResource = $res;
907+
break;
908+
}
909+
}
910+
911+
if (!$retiredResource) {
912+
$this->markTestSkipped('Could not find retired resource for retrieval test.');
913+
return;
914+
}
915+
916+
$parts = explode('/', $retiredResource->getName());
917+
$retiredResourceId = end($parts);
918+
919+
list(, $output) = $this->runFunctionSnippet('get_retired_resource', [
920+
self::$projectId,
921+
self::$locationId,
922+
$retiredResourceId
923+
]);
924+
925+
$this->assertStringContainsString('Retired Resource Name', $output);
926+
$this->assertStringContainsString($deletedKeyId, $output);
927+
}
928+
929+
public function testDeleteCryptoKeyVersion()
930+
{
931+
$this->markTestSkipped('Skipping deleteCryptoKeyVersion test due to complexity of destroying a key version.');
932+
}
933+
818934
public function testVerifyMac()
819935
{
820936
$data = 'my data';

0 commit comments

Comments
 (0)