Class GcpKmsMasterKey

Namespace

Nops.Core.Keys

Assembly

Nops.Core.GcpKms.dll

Master key provider for Google Cloud KMS keys used by SOPS. Uses Google.Cloud.Kms.V1 to decrypt the encrypted data key share.

public class GcpKmsMasterKey : IMasterKeyProvider

Inheritance

object

GcpKmsMasterKey

Implements

IMasterKeyProvider

Inherited Members

object.Equals(object)

object.Equals(object, object)

object.GetHashCode()

object.GetType()

object.MemberwiseClone()

object.ReferenceEquals(object, object)

object.ToString()

Constructors

GcpKmsMasterKey(string, string, KeyManagementServiceClient?)

Creates a new GCP KMS master key provider.

public GcpKmsMasterKey(string resourceName, string encryptedShare = "", KeyManagementServiceClient? client = null)

Parameters

resourceName string

encryptedShare string

client KeyManagementServiceClient

Properties

Client

The CloudKMS client used for decryption. If null, uses Application Default Credentials.

public KeyManagementServiceClient? Client { get; }

Property Value

KeyManagementServiceClient

EncryptedShare

Informational only: decryption uses the encrypted share read from the SOPS file metadata, so this can be left empty.

public string EncryptedShare { get; }

Property Value

string

KeyType

The key type identifier ("gcp_kms").

public string KeyType { get; }

Property Value

string

ResourceName

The full resource name of the KMS key (e.g., projects/my-project/locations/global/keyRings/my-kr/cryptoKeys/my-key).

public string ResourceName { get; }

Property Value

string

Methods

DecryptShareAsync(string, CancellationToken)

Decrypt the encrypted data key share using Google Cloud KMS. Returns null if this key cannot decrypt (resource name mismatch handled by caller).

public Task<byte[]?> DecryptShareAsync(string enc, CancellationToken ct = default)

Parameters

enc string

ct CancellationToken

Returns

Task<byte[]>