GoogleSecrets Class
Properties Methods Events Configuration Settings Errors
The GoogleSecrets class offers a simple interface for Google Secret Manager.
Syntax
class cloudkeys.GoogleSecrets
Remarks
The GoogleSecrets class provides an easy-to-use interface for the Google Cloud Secret Manager service. Google Secret Manager allows you to securely store secrets (e.g., passwords, symmetric keys, etc.) in the cloud so that they aren't persisted locally. This class helps you to create, manage, and access these secrets.
To begin, register for a Google Cloud account. Set the google_project_id property to your full Google Cloud project Id.
This class supports authentication via OAuth 2.0. First, perform OAuth authentication using the OAuth class or a separate process. Once complete you should have an authorization string which looks like:
Bearer ya29.AHES6ZSZEJzATdZYjeihDn5W-VrXSsxEZu5p0pclxGdKKQAssign this value to the authorization property before attempting any operations. Consult the documentation for the service for more information about supported scope values and more details on OAuth authentication.
Using the Class
In Google Secret Manager, a secret is a container for one or more secret versions, which is where secret data is actually stored. The create_secret method will create a new secret and then add an initial secret version to it with the specified secret data. To change a secret's data, simply create a new version of it using the create_version method. Each version of the secret receives a sequentially-assigned version Id, and the first version's Id is always 1.
To retrieve a secret's data, call the get_secret method, and specify the specific version whose data should be retrieved (if no version is specified, the latest version's data is retrieved).
Secret versions that will no longer be used can have their data destroyed using the destroy_version method; the version itself will still exist, but its data will not. The delete_secret method can be used to completely delete a secret and all of its versions.
// Create a secret.
googlesecrets.SecretData = "Test123";
googlesecrets.CreateSecret("MySecret");
// Create a new version of the secret.
googlesecrets.SecretData = "Cats456";
googlesecrets.CreateVersion("MySecret");
// Download the latest secret version's data to a local file.
googlesecrets.LocalFile = "C:\temp\secret.txt";
googlesecrets.GetSecret("MySecret", "");
// Download a previous version's data to a local file.
googlesecrets.LocalFile = "C:\temp\oldsecret.txt";
googlesecrets.GetSecret("MySecret", "1");
// Destroy an old secret version's data.
googlesecrets.DestroyVersion("MySecret", "1");
// Completely delete a secret, and all of its versions.
googlesecrets.DeleteSecret("MySecret");
To list secrets, use the list_secrets method. To list a secret's versions, use the list_versions method.
// If there are many secrets to list, there may be multiple pages of results. This will
// cause all pages of results to be accumulated into the Secrets collection property.
do {
googlesecrets.ListSecrets();
} while (!string.IsNullOrEmpty(googlesecrets.SecretMarker));
// A similar thing applies to secret versions as well.
do {
googlesecrets.ListVersions("MySecret");
} while (!string.IsNullOrEmpty(googlesecrets.VersionMarker));
The class also supports other functionality, including:
- Enabling and disabling secret versions with set_version_enabled
- Retrieval of information for a single secret or secret version with get_secret_info and get_version_info.
- Label support using add_label, update_secret_labels, and the Label* properties.
- And more!
Property List
The following is the full list of the properties of the class with short descriptions. Click on the links for further details.
| authorization | OAuth 2.0 Authorization Token. |
| firewall_auto_detect | This property tells the class whether or not to automatically detect and use firewall system settings, if available. |
| firewall_type | This property determines the type of firewall to connect through. |
| firewall_host | This property contains the name or IP address of firewall (optional). |
| firewall_password | This property contains a password if authentication is to be used when connecting through the firewall. |
| firewall_port | This property contains the TCP port for the firewall Host . |
| firewall_user | This property contains a user name if authentication is to be used connecting through a firewall. |
| google_project_id | The Id of the Google Cloud project to make requests against. |
| idle | The current status of the class. |
| label_count | The number of records in the Label arrays. |
| label_name | The name of the label. |
| label_value | The value of the label. |
| local_file | The local file to write data to, or whose data should be sent. |
| local_host | The name of the local host or user-assigned IP interface through which connections are initiated or accepted. |
| other_headers | Other headers as determined by the user (optional). |
| overwrite | Whether the local file should be overwritten if necessary. |
| parsed_header_count | The number of records in the ParsedHeader arrays. |
| parsed_header_field | This property contains the name of the HTTP header (same case as it is delivered). |
| parsed_header_value | This property contains the header contents. |
| proxy_auth_scheme | This property is used to tell the class which type of authorization to perform when connecting to the proxy. |
| proxy_auto_detect | This property tells the class whether or not to automatically detect and use proxy system settings, if available. |
| proxy_password | This property contains a password if authentication is to be used for the proxy. |
| proxy_port | This property contains the TCP port for the proxy Server (default 80). |
| proxy_server | If a proxy Server is given, then the HTTP request is sent to the proxy instead of the server otherwise specified. |
| proxy_ssl | This property determines when to use SSL for the connection to the proxy. |
| proxy_user | This property contains a user name, if authentication is to be used for the proxy. |
| query_param_count | The number of records in the QueryParam arrays. |
| query_param_name | The name of the query parameter. |
| query_param_value | The value of the query parameter. |
| secret_data | The secret data that was retrieved, or that should be sent. |
| secret_marker | A marker indicating what page of secrets to return next. |
| secret_count | The number of records in the Secret arrays. |
| secret_creation_date | The secret's creation date. |
| secret_destruction_date | The secret version's destruction date. |
| secret_name | The name of the secret. |
| secret_state | The state of the secret version. |
| secret_version_id | The Id of the secret version. |
| ssl_accept_server_cert_encoded | The certificate (PEM/base64 encoded). |
| ssl_cert_encoded | The certificate (PEM/base64 encoded). |
| ssl_cert_store | The name of the certificate store for the client certificate. |
| ssl_cert_store_password | If the certificate store is of a type that requires a password, this property is used to specify that password in order to open the certificate store. |
| ssl_cert_store_type | The type of certificate store for this certificate. |
| ssl_cert_subject | The subject of the certificate used for client authentication. |
| ssl_server_cert_encoded | The certificate (PEM/base64 encoded). |
| timeout | A timeout for the class. |
| version_marker | A marker indicating what page of secret versions to return next. |
Method List
The following is the full list of the methods of the class with short descriptions. Click on the links for further details.
| add_label | Adds an item to the Labels properties. |
| add_query_param | Adds a query parameter to the QueryParams properties. |
| config | Sets or retrieves a configuration setting. |
| create_secret | Creates a new secret. |
| create_version | Creates a new secret version. |
| delete_secret | Deletes a secret. |
| destroy_version | Destroys a secret version's data. |
| do_events | Processes events from the internal message queue. |
| get_secret | Retrieves a secret version's data. |
| get_secret_info | Gets information about a secret. |
| get_version_info | Gets information about a secret version. |
| list_secrets | Lists the secrets in the project. |
| list_versions | Lists the secret versions for the specified secret. |
| reset | Resets the class to its initial state. |
| send_custom_request | Sends a custom request to the server. |
| set_version_enabled | Enables or disables a secret version. |
| update_secret_labels | Updates a secret's labels. |
Event List
The following is the full list of the events fired by the class with short descriptions. Click on the links for further details.
| on_end_transfer | Fired when a document finishes transferring. |
| on_error | Information about errors during data delivery. |
| on_header | Fired every time a header line comes in. |
| on_label_list | Fires once for each label returned when a secret's information is retrieved. |
| on_log | Fires once for each log message. |
| on_secret_list | Fires once for each secret when listing secrets. |
| on_ssl_server_authentication | Fired after the server presents its certificate to the client. |
| on_ssl_status | Shows the progress of the secure connection. |
| on_start_transfer | Fired when a document starts transferring (after the headers). |
| on_transfer | Fired while a document transfers (delivers document). |
Configuration Settings
The following is a list of configuration settings for the class with short descriptions. Click on the links for further details.
| AccumulatePages | Whether the class should accumulate subsequent pages of results when listing them. |
| CustomReplication | A custom replication configuration to send when creating a new secret. |
| MaxSecrets | The maximum number of results to return when listing secrets. |
| RawRequest | Returns the data that was sent to the server. |
| RawResponse | Returns the data that was received from the server. |
| XChildCount | The number of child elements of the current element. |
| XChildName[i] | The name of the child element. |
| XChildXText[i] | The inner text of the child element. |
| XElement | The name of the current element. |
| XParent | The parent of the current element. |
| XPath | Provides a way to point to a specific element in the returned XML or JSON response. |
| XSubTree | A snapshot of the current element in the document. |
| XText | The text of the current element. |
| AcceptEncoding | Used to tell the server which types of content encodings the client supports. |
| AllowHTTPCompression | This property enables HTTP compression for receiving data. |
| AllowHTTPFallback | Whether HTTP/2 connections are permitted to fallback to HTTP/1.1. |
| Append | Whether to append data to LocalFile. |
| Authorization | The Authorization string to be sent to the server. |
| BytesTransferred | Contains the number of bytes transferred in the response data. |
| ChunkSize | Specifies the chunk size in bytes when using chunked encoding. |
| CompressHTTPRequest | Set to true to compress the body of a PUT or POST request. |
| EncodeURL | If set to true the URL will be encoded by the class. |
| FollowRedirects | Determines what happens when the server issues a redirect. |
| GetOn302Redirect | If set to true the class will perform a GET on the new location. |
| HTTP2HeadersWithoutIndexing | HTTP2 headers that should not update the dynamic header table with incremental indexing. |
| HTTPVersion | The version of HTTP used by the class. |
| IfModifiedSince | A date determining the maximum age of the desired document. |
| KeepAlive | Determines whether the HTTP connection is closed after completion of the request. |
| KerberosSPN | The Service Principal Name for the Kerberos Domain Controller. |
| LogLevel | The level of detail that is logged. |
| MaxRedirectAttempts | Limits the number of redirects that are followed in a request. |
| NegotiatedHTTPVersion | The negotiated HTTP version. |
| OtherHeaders | Other headers as determined by the user (optional). |
| ProxyAuthorization | The authorization string to be sent to the proxy server. |
| ProxyAuthScheme | The authorization scheme to be used for the proxy. |
| ProxyPassword | A password if authentication is to be used for the proxy. |
| ProxyPort | Port for the proxy server (default 80). |
| ProxyServer | Name or IP address of a proxy server (optional). |
| ProxyUser | A user name if authentication is to be used for the proxy. |
| SentHeaders | The full set of headers as sent by the client. |
| StatusLine | The first line of the last response from the server. |
| TransferredData | The contents of the last response from the server. |
| TransferredDataLimit | The maximum number of incoming bytes to be stored by the class. |
| TransferredHeaders | The full set of headers as received from the server. |
| TransferredRequest | The full request as sent by the client. |
| UseChunkedEncoding | Enables or Disables HTTP chunked encoding for transfers. |
| UseIDNs | Whether to encode hostnames to internationalized domain names. |
| UsePlatformHTTPClient | Whether or not to use the platform HTTP client. |
| UserAgent | Information about the user agent (browser). |
| ConnectionTimeout | Sets a separate timeout value for establishing a connection. |
| FirewallAutoDetect | Tells the class whether or not to automatically detect and use firewall system settings, if available. |
| FirewallHost | Name or IP address of firewall (optional). |
| FirewallPassword | Password to be used if authentication is to be used when connecting through the firewall. |
| FirewallPort | The TCP port for the FirewallHost;. |
| FirewallType | Determines the type of firewall to connect through. |
| FirewallUser | A user name if authentication is to be used connecting through a firewall. |
| KeepAliveInterval | The retry interval, in milliseconds, to be used when a TCP keep-alive packet is sent and no response is received. |
| KeepAliveTime | The inactivity time in milliseconds before a TCP keep-alive packet is sent. |
| Linger | When set to True, connections are terminated gracefully. |
| LingerTime | Time in seconds to have the connection linger. |
| LocalHost | The name of the local host through which connections are initiated or accepted. |
| LocalPort | The port in the local host where the class binds. |
| MaxLineLength | The maximum amount of data to accumulate when no EOL is found. |
| MaxTransferRate | The transfer rate limit in bytes per second. |
| ProxyExceptionsList | A semicolon separated list of hosts and IPs to bypass when using a proxy. |
| TCPKeepAlive | Determines whether or not the keep alive socket option is enabled. |
| TcpNoDelay | Whether or not to delay when sending packets. |
| UseIPv6 | Whether to use IPv6. |
| LogSSLPackets | Controls whether SSL packets are logged when using the internal security API. |
| OpenSSLCADir | The path to a directory containing CA certificates. |
| OpenSSLCAFile | Name of the file containing the list of CA's trusted by your application. |
| OpenSSLCipherList | A string that controls the ciphers to be used by SSL. |
| OpenSSLPrngSeedData | The data to seed the pseudo random number generator (PRNG). |
| ReuseSSLSession | Determines if the SSL session is reused. |
| SSLCACertFilePaths | The paths to CA certificate files on Unix/Linux. |
| SSLCACerts | A newline separated list of CA certificate to use during SSL client authentication. |
| SSLCheckCRL | Whether to check the Certificate Revocation List for the server certificate. |
| SSLCipherStrength | The minimum cipher strength used for bulk encryption. |
| SSLEnabledCipherSuites | The cipher suite to be used in an SSL negotiation. |
| SSLEnabledProtocols | Used to enable/disable the supported security protocols. |
| SSLEnableRenegotiation | Whether the renegotiation_info SSL extension is supported. |
| SSLIncludeCertChain | Whether the entire certificate chain is included in the SSLServerAuthentication event. |
| SSLNegotiatedCipher | Returns the negotiated ciphersuite. |
| SSLNegotiatedCipherStrength | Returns the negotiated ciphersuite strength. |
| SSLNegotiatedCipherSuite | Returns the negotiated ciphersuite. |
| SSLNegotiatedKeyExchange | Returns the negotiated key exchange algorithm. |
| SSLNegotiatedKeyExchangeStrength | Returns the negotiated key exchange algorithm strength. |
| SSLNegotiatedProtocol | Returns the negotiated protocol version. |
| SSLProvider | The name of the security provider to use. |
| SSLSecurityFlags | Flags that control certificate verification. |
| SSLServerCACerts | A newline separated list of CA certificate to use during SSL server certificate validation. |
| TLS12SignatureAlgorithms | Defines the allowed TLS 1.2 signature algorithms when UseInternalSecurityAPI is True. |
| TLS12SupportedGroups | The supported groups for ECC. |
| TLS13KeyShareGroups | The groups for which to pregenerate key shares. |
| TLS13SignatureAlgorithms | The allowed certificate signature algorithms. |
| TLS13SupportedGroups | The supported groups for (EC)DHE key exchange. |
| AbsoluteTimeout | Determines whether timeouts are inactivity timeouts or absolute timeouts. |
| FirewallData | Used to send extra data to the firewall. |
| InBufferSize | The size in bytes of the incoming queue of the socket. |
| OutBufferSize | The size in bytes of the outgoing queue of the socket. |
| BuildInfo | Information about the product's build. |
| CodePage | The system code page used for Unicode to Multibyte translations. |
| LicenseInfo | Information about the current license. |
| ProcessIdleEvents | Whether the class uses its internal event loop to process events when the main thread is idle. |
| SelectWaitMillis | The length of time in milliseconds the class will wait when DoEvents is called if there are no events to process. |
| UseInternalSecurityAPI | Tells the class whether or not to use the system security libraries or an internal implementation. |