failed to create KMS crypto key berglas-key about berglas

[sethvargo]

Hi @chris-rock

Thanks for opening an issue. I just created a brand new project.

$ GO111MODULE=on go run main.go bootstrap --project sethvargo-berglas-test12 --bucket sethvargo-berglas-test12-secrets

failed to create KMS key ring berglas: rpc error: code = FailedPrecondition desc = Google Cloud KMS API has not been used in this project before, or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/cloudkms.googleapis.com/overview?project=858857677202 then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.

(expected because it's brand new). Enable the service:

$ gcloud services enable --project sethvargo-berglas-test12 cloudkms.googleapis.com storage-api.googleapis.com storage-component.googleapis.com
Operation "operations/acf.8d8bc371-5323-45dc-a1d5-0a388bbfe413" finished successfully.

Wait a few seconds and try again:

$ GO111MODULE=on go run main.go bootstrap --project sethvargo-berglas-test12 --bucket sethvargo-berglas-test12-secrets
Successfully created berglas environment:

  Bucket: sethvargo-berglas-test12-secrets
  KMS key: projects/sethvargo-berglas-test12/locations/global/keyRings/berglas/cryptoKeys/berglas-key

To create a secret:

  berglas create sethvargo-berglas-test12-secrets/my-secret abcd1234 \
    --key projects/sethvargo-berglas-test12/locations/global/keyRings/berglas/cryptoKeys/berglas-key

To grant access to that secret:

  berglas grant sethvargo-berglas-test12-secrets/my-secret \
    --member user:[email protected]

For more help and examples, please run "berglas -h".

Can you share more information about your setup please?

[chris-rock]

I just created a new project to see (as you've done) if it works with a brand new gcp project

$ GO111MODULE=on go run main.go bootstrap --project "berglass-test" --bucket "chris-rock-berglass-secrets-test"
failed to create KMS key ring berglas: rpc error: code = FailedPrecondition desc = Google Cloud KMS API has not been used in this project before, or it is disabled. Enable it by visiting https://console.developers.google.com/apis/api/cloudkms.googleapis.com/overview?project=517494289035 then retry. If you enabled this API recently, wait a few minutes for the action to propagate to our systems and retry.
exit status 1
$ gcloud services enable --project "berglass-test" cloudkms.googleapis.com storage-api.googleapis.com storage-component.googleapis.com
Operation "operations/acf.fe8ee95b-c169-45b9-b6dc-20dcd1623c29" finished successfully.
$ GO111MODULE=on go run main.go bootstrap --project "berglass-test" --bucket "chris-rock-berglass-secrets-test"                       
failed to create KMS crypto key berglas-key: rpc error: code = InvalidArgument desc = Invalid rotation period.
exit status 1

Based on the error, it must happen in

berglas/pkg/berglas/bootstrap.go

Lines 114 to 139 in 533bf49

	rotationPeriod := 30 * 24 * time.Hour
	if _, err := c.kmsClient.CreateCryptoKey(ctx, &kmspb.CreateCryptoKeyRequest{
	Parent: fmt.Sprintf("projects/%s/locations/%s/keyRings/%s",
	projectID, kmsLocation, kmsKeyRing),
	CryptoKeyId: kmsCryptoKey,
	CryptoKey: &kmspb.CryptoKey{
	Purpose: kmspb.CryptoKey_ENCRYPT_DECRYPT,
	RotationSchedule: &kmspb.CryptoKey_RotationPeriod{
	RotationPeriod: &duration.Duration{
	Seconds: int64(rotationPeriod),
	},
	},
	NextRotationTime: &timestamp.Timestamp{
	Seconds: time.Now().Add(time.Duration(rotationPeriod)).Unix(),
	},
	VersionTemplate: &kmspb.CryptoKeyVersionTemplate{
	Algorithm: kmspb.CryptoKeyVersion_GOOGLE_SYMMETRIC_ENCRYPTION,
	ProtectionLevel: kmspb.ProtectionLevel_SOFTWARE,
	},
	},
	}); err != nil {
	terr, ok := grpcstatus.FromError(err)
	if !ok || terr.Code() != grpccodes.AlreadyExists {
	return errors.Wrapf(err, "failed to create KMS crypto key %s", kmsCryptoKey)
	}
	}

but the arguments seem right...

$ go version
go version go1.12.5 darwin/amd64

[sethvargo]

Hey @chris-rock

Hmm that's definitely odd. Can you tell me more about your setup? Are you creating projects inside an organization? Are there any policies or restrictions on that organization?

Are you able to create a key with a rotation period in the UI?

[chris-rock]

@sethvargo Awesome. #31 did the trick!

GO111MODULE=on go run main.go bootstrap --project "berglass-test" --bucket "chris-rock-berglass-secrets-test"
Successfully created berglas environment:

  Bucket: chris-rock-berglass-secrets-test
  KMS key: projects/berglass-test/locations/global/keyRings/berglas/cryptoKeys/berglas-key

To create a secret:

  berglas create chris-rock-berglass-secrets-test/my-secret abcd1234 \
    --key projects/berglass-test/locations/global/keyRings/berglas/cryptoKeys/berglas-key

To grant access to that secret:

  berglas grant chris-rock-berglass-secrets-test/my-secret \
    --member user:[email protected]

For more help and examples, please run "berglas -h".