Method newKMSClient

gcpkms/keysource.go:290–352

newKMSClient returns a GCP KMS client configured with the tokenSource or credentialJSON, and/or grpcConn, falling back to environmental defaults. It returns an error if the ResourceID is invalid, or if the setup of the client fails.

(ctx context.Context)

// It returns an error if the ResourceID is invalid, or if the setup of the
// client fails.
func (key *MasterKey) newKMSClient(ctx context.Context) (*kms.KeyManagementClient, error) {
	re := regexp.MustCompile(`^projects/[^/]+/locations/[^/]+/keyRings/[^/]+/cryptoKeys/[^/]+$`)
	matches := re.FindStringSubmatch(key.ResourceID)
	if matches == nil {
		return nil, fmt.Errorf("no valid resource ID found in %q", key.ResourceID)
	}

	var opts []option.ClientOption
	switch {
	case key.tokenSource != nil:
		opts = append(opts, option.WithTokenSource(key.tokenSource))
	case key.credentialJSON != nil:
		opts = append(opts, option.WithCredentialsJSON(key.credentialJSON))
	default:
		credentials, err := getGoogleCredentials()
		if err != nil {
			return nil, fmt.Errorf("credentials: failed to obtain credentials from %q: %w", SopsGoogleCredentialsEnv, err)
		}
		if credentials != nil {
			opts = append(opts, option.WithCredentialsJSON(credentials))
			break
		}

		if atCredentials := getGoogleOAuthTokenFromEnv(); atCredentials != nil {
			opts = append(opts, option.WithTokenSource(atCredentials))
			break
		}
	}

	switch {
	case key.grpcConn != nil:
		opts = append(opts, option.WithGRPCConn(key.grpcConn))
	case len(key.grpcDialOpts) > 0:
		for _, opt := range key.grpcDialOpts {
			opts = append(opts, option.WithGRPCDialOption(opt))
		}
	}

	// Add extra options.
	opts = append(opts, key.clientOpts...)

	if endpoint := os.Getenv(SopsGCPKMSEndpointEnv); endpoint != "" {
		opts = append(opts, option.WithEndpoint(endpoint))
	} else if ud := os.Getenv(SopsGCPKMSUniverseDomainEnv); ud != "" {
		opts = append(opts, option.WithUniverseDomain(ud))
	}

	// Select client type based on inputs.
	clientType := strings.ToLower(os.Getenv(SopsGCPKMSClientTypeEnv))
	var client *kms.KeyManagementClient
	var err error
	switch {
	case clientType == "rest", key.useRESTClient:
		client, err = kms.NewKeyManagementRESTClient(ctx, opts...)
	default:
		client, err = kms.NewKeyManagementClient(ctx, opts...)
	}
	if err != nil {