17
17
18
18
import pytest
19
19
20
+ from google .api_core import exceptions
21
+ from google .cloud import kms
20
22
from google .cloud .storage ._helpers import _base64_md5hash
21
23
from . import _helpers
22
24
@@ -235,12 +237,12 @@ def file_data():
235
237
return _file_data
236
238
237
239
238
- @pytest .fixture (scope = "session " )
240
+ @pytest .fixture (scope = "function " )
239
241
def kms_bucket_name ():
240
242
return _helpers .unique_name ("gcp-systest-kms" )
241
243
242
244
243
- @pytest .fixture (scope = "session " )
245
+ @pytest .fixture (scope = "function " )
244
246
def kms_bucket (storage_client , kms_bucket_name , no_mtls ):
245
247
bucket = _helpers .retry_429_503 (storage_client .create_bucket )(kms_bucket_name )
246
248
@@ -249,11 +251,61 @@ def kms_bucket(storage_client, kms_bucket_name, no_mtls):
249
251
_helpers .delete_bucket (bucket )
250
252
251
253
252
- @pytest .fixture (scope = "session " )
254
+ @pytest .fixture (scope = "function " )
253
255
def kms_key_name (storage_client , kms_bucket ):
254
256
return _kms_key_name (storage_client , kms_bucket , default_key_name )
255
257
256
258
257
- @pytest .fixture (scope = "session " )
259
+ @pytest .fixture (scope = "function " )
258
260
def alt_kms_key_name (storage_client , kms_bucket ):
259
261
return _kms_key_name (storage_client , kms_bucket , alt_key_name )
262
+
263
+
264
+ @pytest .fixture (scope = "session" )
265
+ def kms_client ():
266
+ return kms .KeyManagementServiceClient ()
267
+
268
+
269
+ @pytest .fixture (scope = "function" )
270
+ def keyring (storage_client , kms_bucket , kms_client ):
271
+ project = storage_client .project
272
+ location = kms_bucket .location .lower ()
273
+ purpose = kms .enums .CryptoKey .CryptoKeyPurpose .ENCRYPT_DECRYPT
274
+
275
+ # If the keyring doesn't exist create it.
276
+ keyring_path = kms_client .key_ring_path (project , location , keyring_name )
277
+
278
+ try :
279
+ kms_client .get_key_ring (keyring_path )
280
+ except exceptions .NotFound :
281
+ parent = kms_client .location_path (project , location )
282
+ kms_client .create_key_ring (parent , keyring_name , {})
283
+
284
+ # Mark this service account as an owner of the new keyring
285
+ service_account_email = storage_client .get_service_account_email ()
286
+ policy = {
287
+ "bindings" : [
288
+ {
289
+ "role" : "roles/cloudkms.cryptoKeyEncrypterDecrypter" ,
290
+ "members" : ["serviceAccount:" + service_account_email ],
291
+ }
292
+ ]
293
+ }
294
+ kms_client .set_iam_policy (keyring_path , policy )
295
+
296
+ # Populate the keyring with the keys we use in the tests
297
+ key_names = [
298
+ "gcs-test" ,
299
+ "gcs-test-alternate" ,
300
+ "explicit-kms-key-name" ,
301
+ "default-kms-key-name" ,
302
+ "override-default-kms-key-name" ,
303
+ "alt-default-kms-key-name" ,
304
+ ]
305
+ for key_name in key_names :
306
+ key_path = kms_client .crypto_key_path (project , location , keyring_name , key_name )
307
+ try :
308
+ kms_client .get_crypto_key (key_path )
309
+ except exceptions .NotFound :
310
+ key = {"purpose" : purpose }
311
+ kms_client .create_crypto_key (keyring_path , key_name , key )
0 commit comments