feat(secretmanager): Add Cloud SQL managed-rotation samples by suvidha-malaviya · Pull Request #10348 · GoogleCloudPlatform/java-docs-samples

suvidha-malaviya · 2026-09-25T11:37:39Z

Description

Adds samples for Secret Manager's Cloud SQL managed-rotation feature (regional secrets only — this feature isn't available for global secrets):

Create a regional secret with Cloud SQL DB credentials
Enable managed rotation on a regional Cloud SQL DB credentials secret
Trigger an on-demand rotation
Reconfigure the recurring rotation schedule on a secret that already has managed rotation enabled

Also added two global scenario with secret-type:

Create a secret restricted to a given secret type (global)
Get a secret's type (global and regional)

Sample List (global & regional):

CreateSecretWithType.java (secret-type restriction is global-only — no regional counterpart)
GetSecretType.java / GetRegionalSecretType.java
CreateRegionalSecretWithCloudSqlCredentials.java
EnableRegionalSecretManagedRotation.java
RotateRegionalSecret.java
UpdateRegionalSecretWithManagedRotationSchedule.java

Added required tests for all of the above in SnippetsIT.java (regional and global).

Also bumps google-cloud-secretmanager/proto-google-cloud-secretmanager-v1 from 2.66.0 → 2.98.0 (and the google-cloud-bom import from 26.62.0 → 26.89.0) — minimum version with Cloud SQL managed-rotation support.

Checklist

Testing

I have tested this change on a live environment and verified it works as intended.
Tests pass: mvn clean verify required
Lint passes: mvn -P lint checkstyle:check required
Static Analysis: mvn -P lint clean compile pmd:cpd-check spotbugs:check advisory only

Compliance & Style

I have followed Sample Format Guide
pom.xml parent set to latest shared-configuration
Appropriate changes to README are included in PR
These samples need a new API enabled in testing projects to pass (let us know which ones) — Cloud SQL Admin API (sqladmin.googleapis.com)
These samples need a new/updated env vars in testing projects set to pass (let us know which ones):
- CLOUD_SQL_INSTANCE / CLOUD_SQL_USER — a pre-provisioned, long-lived Cloud SQL instance + DB user for managed-rotation tests to point at
- The identity running these tests additionally needs resourcemanager.projects.getIamPolicy/setIamPolicy on the test project (e.g. roles/resourcemanager.projectIamAdmin)
This sample adds a new sample directory, and I updated the CODEOWNERS file with the codeowners for this sample
This sample adds a new Product API, and I updated the Blunderbuss issue/PR auto-assigner with the codeowners for this sample

Post-Approval Actions

Please merge this PR for me once it is approved

Not part of the automated test suite; dropping it from the sample directory.

gemini-code-assist

Code Review

This pull request introduces new Java samples and integration tests for Google Cloud Secret Manager, specifically focusing on creating secrets with type restrictions and managing regional secrets with Cloud SQL managed rotation. The feedback suggests improving code maintainability by using standard protobuf utility classes (Timestamps and Durations) to build timestamp and duration objects, and enhancing test reliability by adding a backoff sleep when retrying on AbortedException during IAM policy updates.

gemini-code-assist · 2026-09-25T11:39:59Z

+      Timestamp nextRotationTime =
+          Timestamp.newBuilder()
+              .setSeconds(nextRotationInstant.getEpochSecond())
+              .setNanos(nextRotationInstant.getNano())
+              .build();
+      Duration rotationPeriod = Duration.newBuilder().setSeconds(rotationPeriodSeconds).build();


Instead of manually building the Timestamp and Duration objects, you can use the standard utility classes com.google.protobuf.util.Timestamps and com.google.protobuf.util.Durations to make the code cleaner and more maintainable.

Timestamp nextRotationTime = com.google.protobuf.util.Timestamps.fromMillis(nextRotationInstant.toEpochMilli()); Duration rotationPeriod = com.google.protobuf.util.Durations.fromSeconds(rotationPeriodSeconds);

gemini-code-assist · 2026-09-25T11:39:59Z

+        try {
+          projectsClient.setIamPolicy(resource, policyBuilder.build());
+          return;
+        } catch (AbortedException e) {
+          if (attempt >= 5) {
+            throw e;
+          }
+        }


When retrying on AbortedException (which indicates concurrent modification of the IAM policy), retrying immediately in a tight loop can cause high CPU usage and increased contention. Adding a short backoff sleep (e.g., exponential backoff or a simple incremental sleep) between retry attempts is a best practice to reduce contention and improve test reliability.

try { projectsClient.setIamPolicy(resource, policyBuilder.build()); return; } catch (AbortedException e) { if (attempt >= 5) { throw e; } try { Thread.sleep(100 * (attempt + 1)); } catch (InterruptedException ie) { Thread.currentThread().interrupt(); throw new IOException("Interrupted during retry backoff", ie); } }

gemini-code-assist · 2026-09-25T11:39:59Z

+        try {
+          projectsClient.setIamPolicy(resource, policyBuilder.build());
+          return;
+        } catch (AbortedException e) {
+          if (attempt >= 5) {
+            throw e;
+          }
+        }


When retrying on AbortedException (which indicates concurrent modification of the IAM policy), retrying immediately in a tight loop can cause high CPU usage and increased contention. Adding a short backoff sleep (e.g., exponential backoff or a simple incremental sleep) between retry attempts is a best practice to reduce contention and improve test reliability.

try { projectsClient.setIamPolicy(resource, policyBuilder.build()); return; } catch (AbortedException e) { if (attempt >= 5) { throw e; } try { Thread.sleep(100 * (attempt + 1)); } catch (InterruptedException ie) { Thread.currentThread().interrupt(); throw new IOException("Interrupted during retry backoff", ie); } }

…latform#10348 - UpdateRegionalSecretWithManagedRotationSchedule.java: build the Timestamp/Duration via com.google.protobuf.util.Timestamps/Durations instead of manual builders. - SnippetsIT.java: add backoff between AbortedException retries in grantCloudSqlRole and revokeCloudSqlRole to reduce contention.

- UpdateRegionalSecretWithManagedRotationSchedule.java: build the Timestamp/Duration via com.google.protobuf.util.Timestamps/Durations instead of manual builders. - SnippetsIT.java: add backoff between AbortedException retries in grantCloudSqlRole and revokeCloudSqlRole to reduce contention.

snippet-bot · 2026-09-25T12:13:09Z

Here is the summary of changes.

You are about to add 7 region tags.

secretmanager/src/main/java/secretmanager/CreateSecretWithType.java:19, tag secretmanager_create_secret_with_type
secretmanager/src/main/java/secretmanager/GetSecretType.java:19, tag secretmanager_get_secret_type
secretmanager/src/main/java/secretmanager/regionalsamples/CreateRegionalSecretWithCloudSqlCredentials.java:19, tag secretmanager_create_regional_secret_with_cloud_sql_credentials
secretmanager/src/main/java/secretmanager/regionalsamples/EnableRegionalSecretManagedRotation.java:19, tag secretmanager_enable_regional_secret_managed_rotation
secretmanager/src/main/java/secretmanager/regionalsamples/GetRegionalSecretType.java:19, tag secretmanager_get_regional_secret_type
secretmanager/src/main/java/secretmanager/regionalsamples/RotateRegionalSecret.java:19, tag secretmanager_rotate_regional_secret
secretmanager/src/main/java/secretmanager/regionalsamples/UpdateRegionalSecretWithManagedRotationSchedule.java:19, tag secretmanager_update_regional_secret_with_managed_rotation_schedule

This comment is generated by snippet-bot.
If you find problems with this result, please file an issue at:
https://github.com/googleapis/repo-automation-bots/issues.
To update this comment, add snippet-bot:force-run label or use the checkbox below:

Refresh this comment

YashSaraf11 · 2026-10-09T08:49:56Z

+  public static void main(String[] args) throws IOException {
+    // TODO(developer): Replace these variables before running the sample.
+
+    // Your GCP project ID.


Lets not use this and please format this accordingly done in the other files

…ation samples Align Javadoc with other samples, simplify comments, clarify rotation schedule behavior and mask placeholder project ids.

YashSaraf11

Reviewed the Cloud SQL Managed Rotation and Secret Type Java samples. Left inline comments categorized into [Must], [Warning], and [Nit].

YashSaraf11 · 2026-11-02T08:09:59Z

  private static final String UPDATED_LABEL_KEY = "updatedlabelkey";
  private static final String UPDATED_LABEL_VALUE = "updatedlabelvalue";
-  private static final String LOCATION_ID = "us-central1";
+  private static final String LOCATION_ID = "us-east1";


[Must] Changing LOCATION_ID from "us-central1" to a hardcoded "us-east1" changes the region for all regional tests in SnippetsIT (and makes the missing GOOGLE_CLOUD_PROJECT_LOCATION assertion below a no-op). Please read GOOGLE_CLOUD_PROJECT_LOCATION from System.getenv (with "us-central1" as fallback) or use a separate location constant if the test Cloud SQL instance is in us-east1.

YashSaraf11 · 2026-11-02T08:09:59Z

+          Secret.newBuilder().setSecretType(SecretType.CLOUD_SQL_DB_CREDENTIALS).build();
+
+      // Create the regional secret.
+      Secret createdSecret = client.createSecret(location.toString(), secretId, secret);


[Warning] Pass location (LocationName) directly to client.createSecret(location, secretId, secret) instead of location.toString(), matching CreateRegionalSecret.java and CreateSecretWithType.java.

YashSaraf11 · 2026-11-02T08:09:59Z

+          "Grant the Cloud SQL User rotate IAM permissions to enable managed rotation: %s\n",
+          createdSecret.getPolicyMember().getIamPolicyUidPrincipal());


[Warning] Align the output message with the other language samples: "Grant the Cloud SQL User rotate IAM permissions to enable managed rotation to: %s\n".

YashSaraf11 · 2026-11-02T08:09:59Z

+  public static Secret createRegionalSecretWithCloudSqlCredentials(
+      String projectId, String locationId, String secretId) throws IOException {
+
+    // Endpoint to call the regional secret manager sever


[Nit] Fix typo in comment ("sever" -> "server") across the 5 regional sample files.

YashSaraf11 · 2026-11-02T08:09:59Z

+  // Enables managed rotation of a CLOUD_SQL_DB_CREDENTIALS typed secret. It validates and
+  // enables the rotation, adding a version and sets the passed password (optional).


[Nit] Since this sample doesn't pass a password on CloudSQLSingleUserCredentials, consider clarifying in the comment that Secret Manager generates a new random password when password is omitted.

suvidha-malaviya added 2 commits September 24, 2026 17:46

feat(secretmanager): add Cloud SQL managed-rotation samples

360618f

chore(secretmanager): remove Testing.md manual walkthrough

8243fe7

Not part of the automated test suite; dropping it from the sample directory.

product-auto-label Bot added samples Issues that are directly related to samples. api: secretmanager Issues related to the Secret Manager API. labels Sep 25, 2026

gemini-code-assist Bot reviewed Sep 25, 2026

View reviewed changes

suvidha-malaviya force-pushed the cloudsql-managed-rotation branch from 22c4ce4 to 8370800 Compare September 25, 2026 12:09

suvidha-malaviya marked this pull request as ready for review September 25, 2026 12:13

suvidha-malaviya requested review from a team and yoshi-approver as code owners September 25, 2026 12:13

suvidha-malaviya changed the title ~~Cloudsql managed rotation~~ feat(secretmanager): Add Cloud SQL managed-rotation samples Sep 25, 2026

YashSaraf11 reviewed Oct 9, 2026

View reviewed changes

docs(secretmanager): address review feedback on Cloud SQL managed-rot…

bd758a2

…ation samples Align Javadoc with other samples, simplify comments, clarify rotation schedule behavior and mask placeholder project ids.

YashSaraf11 reviewed Nov 2, 2026

View reviewed changes

Navigation Menu

Repository navigation

feat(secretmanager): Add Cloud SQL managed-rotation samples - #10348

feat(secretmanager): Add Cloud SQL managed-rotation samples#10348
suvidha-malaviya wants to merge 4 commits into
GoogleCloudPlatform:mainfrom
suvidha-malaviya:cloudsql-managed-rotation

suvidha-malaviya commented Sep 25, 2026 •

edited

Loading

Uh oh!

gemini-code-assist Bot left a comment

Uh oh!

gemini-code-assist Bot Sep 25, 2026

Uh oh!

gemini-code-assist Bot Sep 25, 2026

Uh oh!

gemini-code-assist Bot Sep 25, 2026

Uh oh!

snippet-bot Bot commented Sep 25, 2026 •

edited

Loading

Uh oh!

YashSaraf11 Oct 9, 2026

Uh oh!

YashSaraf11 left a comment

Uh oh!

YashSaraf11 Nov 2, 2026

Uh oh!

YashSaraf11 Nov 2, 2026

Uh oh!

YashSaraf11 Nov 2, 2026

Uh oh!

YashSaraf11 Nov 2, 2026

Uh oh!

YashSaraf11 Nov 2, 2026

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

		"Grant the Cloud SQL User rotate IAM permissions to enable managed rotation: %s\n",
		createdSecret.getPolicyMember().getIamPolicyUidPrincipal());

		// Enables managed rotation of a CLOUD_SQL_DB_CREDENTIALS typed secret. It validates and
		// enables the rotation, adding a version and sets the passed password (optional).

Conversation

suvidha-malaviya commented Sep 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Description

Checklist

Testing

Compliance & Style

Post-Approval Actions

Uh oh!

gemini-code-assist Bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist Bot Sep 25, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Sep 25, 2026

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist Bot Sep 25, 2026

Choose a reason for hiding this comment

Uh oh!

snippet-bot Bot commented Sep 25, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

YashSaraf11 Oct 9, 2026

Choose a reason for hiding this comment

Uh oh!

YashSaraf11 left a comment

Choose a reason for hiding this comment

Uh oh!

YashSaraf11 Nov 2, 2026

Choose a reason for hiding this comment

Uh oh!

YashSaraf11 Nov 2, 2026

Choose a reason for hiding this comment

Uh oh!

YashSaraf11 Nov 2, 2026

Choose a reason for hiding this comment

Uh oh!

YashSaraf11 Nov 2, 2026

Choose a reason for hiding this comment

Uh oh!

YashSaraf11 Nov 2, 2026

Choose a reason for hiding this comment

Uh oh!

Reviewers

Uh oh!

Assignees

Labels

Projects

Milestone

Development

Uh oh!

2 participants

suvidha-malaviya commented Sep 25, 2026 •

edited

Loading

snippet-bot Bot commented Sep 25, 2026 •

edited

Loading