google-storage.yml

# Copyright 2020 Pivotal Software, Inc.
#
# Licensed under the Apache License, Version 2.0 (the "License");
# you may not use this file except in compliance with the License.
# You may obtain a copy of the License at
#
#      http:#www.apache.org/licenses/LICENSE-2.0
#
# Unless required by applicable law or agreed to in writing, software
# distributed under the License is distributed on an "AS IS" BASIS,
# WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
# See the License for the specific language governing permissions and
# limitations under the License.
---
version: 1
name: csb-google-storage-bucket
id: b247fcde-8a63-11ea-b945-cb26f061f70f
description: Google Cloud Storage that grants service accounts IAM permissions directly on the bucket.
display_name: Google Cloud Storage
image_url: file://service-images/csb.png
documentation_url: https://docs.vmware.com/en/Cloud-Service-Broker-for-VMware-Tanzu/index.html
provider_display_name: VMware
support_url: https://cloud.google.com/support/
tags: [gcp, storage, google-storage]
plan_updateable: true
plans: []
provision:
  plan_inputs: []
  user_inputs:
  - field_name: name
    type: string
    details: |
      Name of bucket.
      To see the requirements the name must meet, see https://cloud.google.com/storage/docs/buckets#naming.
      Names containing dots require verification, see https://cloud.google.com/storage/docs/domain-name-verification.
    default: csb-${request.instance_id}
    prohibit_update: true
    constraints:
      examples:
        - my-bucket
        - 0f75d593-8e7b-4418-a5ba-cb2970f0b91e
        - test.example.com
      pattern: ^[a-z0-9][a-z0-9_.-]{1,220}[a-z0-9]$
  - field_name: storage_class
    type: string
    details: |
      The Storage Class of the new bucket.
    default: MULTI_REGIONAL
    enum:
      STANDARD: STANDARD
      MULTI_REGIONAL: MULTI_REGIONAL
      REGIONAL: REGIONAL
      NEARLINE: NEARLINE
      COLDLINE: COLDLINE
      ARCHIVE: ARCHIVE
  - field_name: region
    type: string
    details: |
      The region where the buckets are created.
      For more information about regions, see https://cloud.google.com/storage/docs/locations or https://cloud.google.com/about/locations
    default: us
    constraints:
      examples:
        - us
        - us-central1
        - asia-northeast1
      pattern: ^[a-z][a-z0-9-]+$
    prohibit_update: true
  - field_name: placement_dual_region_data_locations
    type: array
    details: |
      The list of individual regions that comprise a dual-region bucket.
      Set the `storage_class` property with a valid storage class for the dual-region configuration.
      The `MULTI_REGIONAL` and `REGIONAL` storage classes are not accepted to configure the bucket in dual-region.
      Check the list of valid storage classes for dual-region: https://cloud.google.com/storage/docs/storage-classes. 
      For more information about valid regions, see https://cloud.google.com/storage/docs/locations.
    default: []
    constraints:
      examples:
        - ["us-east1", "us-east4"]
    prohibit_update: true
  - field_name: versioning
    type: boolean
    details: |
      Whether the versioning configuration is enabled.
      For more information about versioning, see https://cloud.google.com/storage/docs/object-versioning
    default: false
  - field_name: public_access_prevention
    type: string
    details: Prevents public access to a bucket. Acceptable values are "inherited" or "enforced". Default is "enforced".
    default: "enforced"
    enum:
      enforced: enforced
      inherited: inherited
  - field_name: uniform_bucket_level_access
    type: boolean
    details: |
      Enables Uniform bucket-level access to a bucket. When enabled, the option becomes permanent after 90 days.
      Disables ACLs.
      For more information about uniform bucket-level access, see https://cloud.google.com/storage/docs/uniform-bucket-level-access
    default: false
  - field_name: predefined_acl
    type: string
    details: |
      The predefined ACL to apply to the bucket, for example `private`, `publicRead`.
      For more information about predefined ACLs, see https://cloud.google.com/storage/docs/access-control/lists#predefined-acl
      Cannot be specified with `uniform_bucket_level_access`.
    default: ""
  - field_name: default_kms_key_name
    type: string
    details: |
      The `id` of a Cloud KMS key that will be used to encrypt objects inserted into this bucket.
      Its default value is `""` so a Google-managed encryption key will be used instead.
      For more information about encryption keys, see https://cloud.google.com/storage/docs/encryption/using-customer-managed-keys
      Note: The key ring must be in the same location as the data you intend to encrypt, in other words, the same location as the `region` property,
      but it can be in a different project.
      For available Cloud KMS locations, see Cloud KMS [locations](https://cloud.google.com/kms/docs/locations)
    default: ""
  - field_name: autoclass
    type: boolean
    details: |
      Automatically transitions each object to hotter or colder storage based on object-level activity, to optimise for cost and latency.
      Caution: Only the `STANDARD` storage class will be accepted when enabling the Autoclass feature.
      Any attempt to set it using a storage class other than `STANDARD` will result in an error.
      For more information about autoclass feature, see https://cloud.google.com/storage/docs/autoclass
    default: false
    prohibit_update: true
  - field_name: retention_policy_retention_period
    type: number
    details: |
      This configures the data retention policy for the bucket, which is the period of time in seconds
      that objects in the bucket must be retained and cannot be deleted, overwritten, or archived.
      The maximum value is `2147483647` (2,147,483,647 seconds).
      For more information about retention policy feature, see https://cloud.google.com/storage/docs/bucket-lock
    default: 0
    constraints:
      minimum: 0
  - field_name: retention_policy_is_locked
    type: boolean
    details: |
      The `retention_policy_is_locked` property locks a retention policy to permanently set it on the bucket.

      Caution: Locking a retention policy is an irreversible action.
      After you set it to true, any attempt to set it to false causes an error.

      A locked retention policy means:
      * It is not possible to remove the retention policy.
      * It is not possible to delete a bucket unless every object in the bucket has met the retention period.
      * It is not possible to reduce or increase the retention period of a locked retention policy.
      * It is not possible to increase the retention period.

      In order for this property to take effect, the property `retention_policy_retention_period` has to be set with a value greater than `0`.
      For more information about policy locks, see https://cloud.google.com/storage/docs/bucket-lock.
    default: false
  - field_name: credentials
    type: string
    details: GCP credentials
    default: ${config("gcp.credentials")}
  - field_name: project
    type: string
    details: GCP project
    default: ${config("gcp.project")}
  computed_inputs:
  - name: labels
    default: ${json.marshal(request.default_labels)}
    overwrite: true
    type: object
  template_refs:
    provider: terraform/storage/provision/provider.tf
    versions: terraform/storage/provision/versions.tf
    main: terraform/storage/provision/main.tf
    variables: terraform/storage/provision/variables.tf
    outputs: terraform/storage/provision/outputs.tf
  outputs:
  - required: true
    field_name: bucket_name
    type: string
    details: Name of the bucket this binding is for.
  - required: true
    field_name: id
    type: string
    details: The GCP ID of this bucket.

bind:
  plan_inputs: []
  user_inputs:
  - required: true
    field_name: role
    type: string
    default: "  "
    details: "The role for the account without the \"roles/\" prefix.\n\t\tSee: https://cloud.google.com/iam/docs/understanding-roles
      for more details.\n\t\tNote: The default enumeration may be overridden by your
      operator."
    enum:
      storage.objectAdmin: roles/storage.objectAdmin
      storage.objectCreator: roles/storage.objectCreator
      storage.objectViewer: roles/storage.objectViewer
  - field_name: credentials
    type: string
    details: GCP credentials
    default: ${config("gcp.credentials")}
  - field_name: project
    type: string
    details: GCP project
    default: ${config("gcp.project")}
  computed_inputs:
  - name: service_account_name
    default: ${str.truncate(20, "pcf-binding-${request.binding_id}")}
    overwrite: true
  - name: service_account_display_name
    default: ""
    overwrite: true
  - name: bucket
    default: ${instance.details["bucket_name"]}
    overwrite: true
  template_refs:
    main: terraform/storage/bind/main.tf
    variables: terraform/storage/bind/variables.tf
    provider: terraform/storage/bind/provider.tf
    versions: terraform/storage/bind/versions.tf
    outputs: terraform/storage/bind/outputs.tf
  outputs:
  - required: true
    field_name: email
    type: string
    details: Email address of the service account.
    constraints:
      examples:
      - pcf-binding-ex312029@my-project.iam.gserviceaccount.com
      pattern: ^pcf-binding-[a-z0-9-]+@.+\.gserviceaccount\.com$
  - required: true
    field_name: name
    type: string
    details: The name of the service account.
    constraints:
      examples:
      - pcf-binding-ex312029
  - required: true
    field_name: PrivateKeyData
    type: string
    details: Service account private key data. Base64 encoded JSON.
    constraints:
      minLength: 512
      pattern: ^[A-Za-z0-9+/]*=*$
  - required: true
    field_name: ProjectId
    type: string
    details: ID of the project that owns the service account.
    constraints:
      examples:
      - my-project
      maxLength: 30
      minLength: 6
      pattern: ^[a-z0-9-]+$
  - required: true
    field_name: private_key_data
    type: string
    details: Deprecated - Service account private key data. Base64 encoded JSON.
    constraints:
      minLength: 512
      pattern: ^[A-Za-z0-9+/]*=*$
  - required: true
    field_name: project_id
    type: string
    details: Deprecated - ID of the project that owns the service account.
    constraints:
      examples:
        - my-project
      maxLength: 30
      minLength: 6
      pattern: ^[a-z0-9-]+$
  - required: true
    field_name: unique_id
    type: string
    details: Unique and stable ID of the service account.
    constraints:
      examples:
      - "112447814736626230844"
  - required: true
    field_name: credentials
    type: string
    details: Credentials of the service account.