From 5184d1a9f96212bb6204058447691629495958ce Mon Sep 17 00:00:00 2001 From: Johannes Rothe Date: Fri, 6 Dec 2024 15:53:31 +0100 Subject: [PATCH] fix(gcpkms): Set quota project to API project Like described in the linked issue, if the GCP KMS key is stored in project foo, but the service account is created in project bar, sops complains that KMS API is not enabled in project bar. The quota project used by default is the one encoded in the service account key. With this commit, the behavior changes, so the project where the KMS key and API reside, is read from the key ID and set via the quota project option. Fixes #1142 Signed-off-by: Johannes Rothe --- gcpkms/keysource.go | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/gcpkms/keysource.go b/gcpkms/keysource.go index d9cc55089..75820d430 100644 --- a/gcpkms/keysource.go +++ b/gcpkms/keysource.go @@ -280,13 +280,14 @@ func (key *MasterKey) TypeToIdentifier() string { // It returns an error if the ResourceID is invalid, or if the setup of the // client fails. func (key *MasterKey) newKMSClient(ctx context.Context) (*kms.KeyManagementClient, error) { - re := regexp.MustCompile(`^projects/[^/]+/locations/[^/]+/keyRings/[^/]+/cryptoKeys/[^/]+$`) + re := regexp.MustCompile(`^projects/(?P[^/]+)/locations/[^/]+/keyRings/[^/]+/cryptoKeys/[^/]+$`) matches := re.FindStringSubmatch(key.ResourceID) if matches == nil { return nil, fmt.Errorf("no valid resource ID found in %q", key.ResourceID) } var opts []option.ClientOption + opts = append(opts, option.WithQuotaProject(matches[1])) switch { case key.tokenSource != nil: opts = append(opts, option.WithTokenSource(key.tokenSource))