Added data source google kms secret asymmetric

[melinath]

Upstreams hashicorp/terraform-provider-google-beta#3126, which is a fixed version of hashicorp/terraform-provider-google-beta#3052 (previously upstreamed as #4609). Note that although the original PR was against tpg-beta, it seems to be a GA API.

Related to hashicorp/terraform-provider-google#6462.

If this PR is for Terraform, I acknowledge that I have:

• Searched through the issue tracker for an open issue that this either resolves or contributes to, commented on it to claim it, and written "fixes {url}" or "part of {url}" in this PR description. If there were no relevant open issues, I opened one and commented that I would like to work on it (not necessary for very small changes).
• Generated Terraform, and ran make test and make lint to ensure it passes unit and linter tests.
• Ensured that all new fields I added that can be set by a user appear in at least one example (for generated resources) or third_party test (for handwritten resources or update tests).
• Ran relevant acceptance tests (If the acceptance tests do not yet pass or you are unable to run them, please let your reviewer know).
• Read the Release Notes Guide before writing my release note below.

Release Note Template for Downstream PRs (will be copied)

`google_kms_secret_asymmetric`

[google-cla]

All (the pull request submitter and all commit authors) CLAs are signed, but one or more commits were authored or co-authored by someone other than the pull request submitter.

We need to confirm that all authors are ok with their commits being contributed to this project. Please have them confirm that by leaving a comment that contains only @googlebot I consent. in this pull request.

Note to project maintainer: There may be cases where the author cannot leave a comment, or the comment is not properly detected as consent. In those cases, you can manually confirm consent of the commit author(s), and set the cla label to yes (if enabled on your project).

ℹ️ Googlers: Go here for more info.

[modular-magician]

Hi! I'm the modular magician. Your PR generated some diffs in downstreams - here they are.

Diff report:

Terraform GA: Diff ( 6 files changed, 461 insertions(+), 2 deletions(-))
Terraform Beta: Diff ( 7 files changed, 462 insertions(+), 3 deletions(-))
TF Conversion: Diff ( 1 file changed, 6 insertions(+), 2 deletions(-))

[modular-magician]

I have triggered VCR tests based on this PR's diffs. See the results here: "https://ci-oss.hashicorp.engineering/viewQueued.html?itemId=181054"

[melinath]

non-VCR run of the new test: https://ci-oss.hashicorp.engineering/buildConfiguration/GoogleCloudBeta_ProviderGoogleCloudBetaMmUpstream/181056?buildTab=overview

[modular-magician]

I have triggered VCR tests in RECORDING mode for the following tests that failed during VCR: TestAccCloudRunDomainMapping_foregroundDeletion|TestAccDataprocCluster_withConfigOverrides You can view the result here: "https://ci-oss.hashicorp.engineering/viewQueued.html?itemId=181066"

[slevenick]

Note that the API looks GA, but the description of the ciphertext checksum says:

NOTE: This field is in Beta.

So we may not want to include this at GA

[melinath]

Hah, yeah, thanks for catching that!

[google-cla]

All (the pull request submitter and all commit authors) CLAs are signed, but one or more commits were authored or co-authored by someone other than the pull request submitter.

We need to confirm that all authors are ok with their commits being contributed to this project. Please have them confirm that by leaving a comment that contains only @googlebot I consent. in this pull request.

Note to project maintainer: There may be cases where the author cannot leave a comment, or the comment is not properly detected as consent. In those cases, you can manually confirm consent of the commit author(s), and set the cla label to yes (if enabled on your project).

ℹ️ Googlers: Go here for more info.

[modular-magician]

Hi! I'm the modular magician. Your PR generated some diffs in downstreams - here they are.

Diff report:

Terraform GA: Diff ( 5 files changed, 164 insertions(+), 2 deletions(-))
Terraform Beta: Diff ( 6 files changed, 465 insertions(+), 2 deletions(-))
TF Conversion: Diff ( 1 file changed, 6 insertions(+), 2 deletions(-))

[modular-magician]

I have triggered VCR tests based on this PR's diffs. See the results here: "https://ci-oss.hashicorp.engineering/viewQueued.html?itemId=181247"

[modular-magician]

I have triggered VCR tests in RECORDING mode for the following tests that failed during VCR: TestAccCloudRunDomainMapping_foregroundDeletion|TestAccComputeRouterPeer_advertiseMode|TestAccDataprocCluster_withConfigOverrides You can view the result here: "https://ci-oss.hashicorp.engineering/viewQueued.html?itemId=181253"

[modular-magician]

Tests failed during RECORDING mode: TestAccDataprocCluster_withConfigOverrides|TestAccCloudRunDomainMapping_foregroundDeletion Please fix these to complete your PR

[slevenick]

The goal of this resource is to allow users to use encrypted values for sensitive fields to allow not specifying them in their configs? But the value ends up in state files and plans/logs anyways, so is the goal just an incremental improvement in this area?

[slevenick]

If we can calculate the checksum from the ciphertext, why would a user input a checksum? I'm not super familiar with this, but it feels strange

[melinath]

It looks like this feature is for data integrity purposes.

[melinath]

Oh, you mean why would we allow them to input it rather than just always calculating it? good question!

[melinath]

@mvanholsteijn what would you think about always calculating the ciphertext, instead of letting users optionally set it?

[mvanholsteijn]

If the user passes in the checksum, s/he is absolutely sure that the ciphertext being decrypted is the one s/he generated. If this feels unnecessary, then the checksum can be calculated for them.

For ease of use and simplicity, I am fine with ditching the crc32 as a parameter.

[melinath]

I think it would be fine to take it out or leave it in - but if it stays in, the docs should clarify that we will still calculate & send it if they don't supply a value.

[mvanholsteijn]

Hi @melinath, I created the following PR on the PR. Is this sufficient?

melinath#1

[melinath]

works for me - thanks!

[melinath]

The plaintext value is marked as sensitive, which I think should keep it out of logs and plan output? It will still be in state, which is plaintext locally, but could be encrypted if using remote storage.

I think the improvement here over google_kms_secret is that the encryption is asymmetric.

[google-cla]

All (the pull request submitter and all commit authors) CLAs are signed, but one or more commits were authored or co-authored by someone other than the pull request submitter.

We need to confirm that all authors are ok with their commits being contributed to this project. Please have them confirm that by leaving a comment that contains only @googlebot I consent. in this pull request.

Note to project maintainer: There may be cases where the author cannot leave a comment, or the comment is not properly detected as consent. In those cases, you can manually confirm consent of the commit author(s), and set the cla label to yes (if enabled on your project).

ℹ️ Googlers: Go here for more info.