feat(secretmanager): Adding secret rotation samples #13748

khilan-crest · 2026-01-16T04:55:46Z

Adding secret rotation samples

Fixes #

Note: Before submitting a pull request, please open an issue for discussion if you are not associated with Google.

Checklist

I have followed Sample Guidelines from AUTHORING_GUIDE.MD
README is updated to include all relevant information
Tests pass: nox -s py-3.9 (see Test Environment Setup)
Lint pass: nox -s lint (see Test Environment Setup)
These samples need a new API enabled in testing projects to pass (let us know which ones)
These samples need a new/updated env vars in testing projects set to pass (let us know which ones)
This sample adds a new sample directory, and I updated the CODEOWNERS file with the codeowners for this sample
This sample adds a new Product API, and I updated the Blunderbuss issue/PR auto-assigner with the codeowners for this sample
Please merge this PR for me once it is approved

…python-docs-samples into python_expiretime_samples

gemini-code-assist · 2026-01-16T04:56:09Z

Summary of Changes

Hello @khilan-crest, I'm Gemini Code Assist¹! I'm currently reviewing this pull request and will post my feedback shortly. In the meantime, here's a summary to help you and other reviewers quickly get up to speed!

This pull request significantly enhances the Google Cloud Secret Manager Python samples by introducing a suite of new functionalities. It provides developers with clear, executable examples for advanced secret lifecycle management, including setting and updating expiration times, configuring and modifying secret rotation policies, and integrating with Pub/Sub for notifications. Furthermore, it adds robust examples for managing resource tags on secrets, covering creation, listing, and detachment, for both global and regional secret instances.

Highlights

Secret Lifecycle Management: Introduced new samples for creating secrets with expiration times and configuring automatic secret rotation, along with corresponding samples to update and remove these settings.
Pub/Sub Integration: Added samples demonstrating how to create secrets with Pub/Sub topics for notification, which is crucial for automated secret rotation workflows.
Tag Management for Secrets: Provided new samples for listing and detaching tag bindings from secrets, enhancing metadata management capabilities.
Regional Resource Support: Extended all new lifecycle and tag management functionalities to regional Secret Manager resources, ensuring comprehensive coverage for geographically distributed deployments.

Using Gemini Code Assist

The full guide for Gemini Code Assist can be found on our documentation page, here are some quick tips.

Invoking Gemini

You can request assistance from Gemini at any point by creating a comment using either /gemini <command> or @gemini-code-assist <command>. Below is a summary of the supported commands on the current page.

Feature	Command	Description
Code Review	`/gemini review`	Performs a code review for the current pull request in its current state.
Pull Request Summary	`/gemini summary`	Provides a summary of the current pull request in its current state.
Comment	@gemini-code-assist	Responds in comments when explicitly tagged, both in pull request comments and review comments.
Help	`/gemini help`	Displays a list of available commands.

Customization

To customize Gemini Code Assist for GitHub experience, repository maintainers can create a configuration file and/or provide a custom code review style guide (such as PEP-8 for Python) by creating and adding files to a .gemini/ folder in the base of the repository. Detailed instructions can be found here.

Limitations & Feedback

Gemini Code Assist may make mistakes. Please leave feedback on any instances where its feedback is incorrect or counter productive. You can react with 👍 and 👎 on @gemini-code-assist comments. If you're interested in giving your feedback about your experience with Gemini Code Assist for Github and other Google products, sign up here.

You can also get AI-powered code generation, chat, as well as code reviews directly in the IDE at no cost with the Gemini Code Assist IDE Extension.

Review the Privacy Notices, Generative AI Prohibited Use Policy, Terms of Service, and learn how to configure Gemini Code Assist in GitHub here. Gemini can make mistakes, so double check it and use code with caution. ↩

gemini-code-assist

Code Review

This pull request adds a comprehensive set of new samples for Secret Manager, covering secret rotation, expiration, and tagging for both global and regional secrets. The changes are well-structured and the accompanying tests are thorough. I've provided a few suggestions to improve the correctness of the documentation, ensure consistency across the new samples, and address minor issues like timezone handling and typos. Overall, this is a great addition to the repository.

gemini-code-assist · 2026-01-16T04:59:02Z

secretmanager/snippets/update_secret_rotation.py

+    Args:
+        project_id (str): ID of the Google Cloud project
+        secret_id (str): ID of the secret to update
+        rotation_period_hours (int): New rotation period in hours


This rotation_period_hours parameter is documented but is not present in the function signature. Since the value is hardcoded within the function, this line should be removed from the docstring to avoid confusion.

gemini-code-assist · 2026-01-16T04:59:02Z

secretmanager/snippets/update_secret_rotation.py

+        # Update the rotation period of a secret to 60 days
+        update_secret_rotation(
+            "my-project",
+            "my-secret-with-rotation",
+            "projects/my-project/topics/my-rotation-topic"
+        )


The example usage is incorrect and will raise an error. It passes a topic_name which is not a parameter of the function. Additionally, the comment mentions '60 days' while the code hardcodes the rotation to 48 hours. The example should be corrected to reflect the actual implementation.

Suggested change

# Update the rotation period of a secret to 60 days

update_secret_rotation(

"my-project",

"my-secret-with-rotation",

"projects/my-project/topics/my-rotation-topic"

)

# Update the rotation period of a secret to 48 hours

update_secret_rotation(

"my-project",

"my-secret-with-rotation"

)

gemini-code-assist · 2026-01-16T04:59:02Z

secretmanager/snippets/regional_samples/create_regional_secret_with_rotation.py

+# limitations under the License.
+
+# [START secretmanager_create_regional_secret_with_rotation]
+from datetime import datetime, timedelta


To create timezone-aware datetime objects, timezone should be imported from the datetime module. This is important for consistency and to prevent potential timezone-related bugs.

Suggested change

from datetime import datetime, timedelta

from datetime import datetime, timedelta, timezone

gemini-code-assist · 2026-01-16T04:59:02Z

secretmanager/snippets/list_tag_bindings.py

+    count = 0
+
+    print(f"Tag bindings for {secret_name}:")
+    for binding in bindings:
+        print(f"- Tag Value: {binding.tag_value}")
+        count += 1
+
+    if count == 0:
+        print(f"No tag bindings found for {secret_name}.")


Using a counter variable count to check if any items were processed is a bit verbose. A more Pythonic approach is to use a boolean flag to track if any bindings were found. This can improve readability.

For example:

found_bindings = False print(f"Tag bindings for {secret_name}:") for binding in bindings: print(f"- Tag Value: {binding.tag_value}") found_bindings = True if not found_bindings: print(f"No tag bindings found for {secret_name}.")

gemini-code-assist · 2026-01-16T04:59:02Z

secretmanager/snippets/create_secret_with_rotation.py

+
+    # Set next rotation time to 24 hours from now
+    next_rotation_time = timestamp_pb2.Timestamp()
+    next_rotation_time.FromDatetime(datetime.now() + timedelta(hours=24))


Using datetime.now() without a timezone creates a naive datetime object, which can lead to inconsistencies. It's best practice to use timezone-aware objects, especially for APIs. Please use datetime.now(timezone.utc) for consistency and to avoid potential bugs.

Suggested change

next_rotation_time.FromDatetime(datetime.now() + timedelta(hours=24))

next_rotation_time.FromDatetime(datetime.now(timezone.utc) + timedelta(hours=24))

gemini-code-assist · 2026-01-16T04:59:03Z

secretmanager/snippets/regional_samples/delete_regional_secret_rotation.py

+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import argparse


For consistency with other sample files in this repository, argparse should be imported inside the if __name__ == "__main__": block. Please move this import statement accordingly.

gemini-code-assist · 2026-01-16T04:59:03Z

secretmanager/snippets/regional_samples/list_regional_secret_tag_bindings.py

+    count = 0
+
+    # Use the list_tag_bindings method to get all tag bindings
+    request = resourcemanager_v3.ListTagBindingsRequest(parent=parent)
+    tag_bindings = tag_bindings_client.list_tag_bindings(request=request)
+
+    # Iterate through the results
+    for binding in tag_bindings:
+        print(f"- Tag Value: {binding.tag_value}")
+        count += 1
+
+    if count == 0:
+        print(f"No tag bindings found for {name}.")


Using a counter variable count to check if any items were processed is a bit verbose. A more Pythonic approach is to use a boolean flag to track if any bindings were found. This can improve readability.

For example:

found_bindings = False for binding in tag_bindings: print(f"- Tag Value: {binding.tag_value}") found_bindings = True if not found_bindings: print(f"No tag bindings found for {name}.")

gemini-code-assist · 2026-01-16T04:59:03Z

secretmanager/snippets/regional_samples/snippets_test.py

+    retrived_secret = get_regional_secret.get_regional_secret(
+        project_id, location_id, secret_id
+    )
+
+    assert (
+        len(retrived_secret.topics) == 1
+    ), f"Expected 1 topic, got {len(retrived_secret.topics)}"
+    assert (
+        retrived_secret.topics[0].name == topic_name
+    ), f"Topic mismatch: got {retrived_secret.topics[0].name}, want {topic_name}"


There's a typo in the variable name retrived_secret. It should be retrieved_secret for correctness and readability.

Suggested change

retrived_secret = get_regional_secret.get_regional_secret(

project_id, location_id, secret_id

)

assert (

len(retrived_secret.topics) == 1

), f"Expected 1 topic, got {len(retrived_secret.topics)}"

assert (

retrived_secret.topics[0].name == topic_name

), f"Topic mismatch: got {retrived_secret.topics[0].name}, want {topic_name}"

retrieved_secret = get_regional_secret.get_regional_secret(

project_id, location_id, secret_id

)

assert (

len(retrieved_secret.topics) == 1

), f"Expected 1 topic, got {len(retrieved_secret.topics)}"

assert (

retrieved_secret.topics[0].name == topic_name

), f"Topic mismatch: got {retrieved_secret.topics[0].name}, want {topic_name}"

gemini-code-assist · 2026-01-16T04:59:03Z

secretmanager/snippets/regional_samples/update_regional_secret_rotation.py

+# See the License for the specific language governing permissions and
+# limitations under the License.
+
+import argparse


For consistency with other sample files in this repository, argparse should be imported inside the if __name__ == "__main__": block. Please move this import statement.

gemini-code-assist · 2026-01-16T04:59:03Z

secretmanager/snippets/snippets_test.py

+    retrived_secret = get_secret(project_id, secret_id)
+
+    assert (
+        len(retrived_secret.topics) == 1
+    ), f"Expected 1 topic, got {len(retrived_secret.topics)}"
+    assert (
+        retrived_secret.topics[0].name == topic_name
+    ), f"Topic mismatch: got {retrived_secret.topics[0].name}, want {topic_name}"


There's a typo in the variable name retrived_secret. It should be retrieved_secret for correctness and readability.

Suggested change

retrived_secret = get_secret(project_id, secret_id)

assert (

len(retrived_secret.topics) == 1

), f"Expected 1 topic, got {len(retrived_secret.topics)}"

assert (

retrived_secret.topics[0].name == topic_name

), f"Topic mismatch: got {retrived_secret.topics[0].name}, want {topic_name}"

retrieved_secret = get_secret(project_id, secret_id)

assert (

len(retrieved_secret.topics) == 1

), f"Expected 1 topic, got {len(retrieved_secret.topics)}"

assert (

retrieved_secret.topics[0].name == topic_name

), f"Topic mismatch: got {retrieved_secret.topics[0].name}, want {topic_name}"

…python-docs-samples into python_expiretime_samples

…-crest/python-docs-samples into python_rotation_samples

…python-docs-samples into python_expiretime_samples

…-crest/python-docs-samples into python_rotation_samples

…python-docs-samples into python_expiretime_samples

…-crest/python-docs-samples into python_rotation_samples

…python-docs-samples into python_expiretime_samples

…-crest/python-docs-samples into python_rotation_samples

khilan-crest added 11 commits January 15, 2026 18:32

feat(secretmanager): Adding tags samples

2b37e84

feat(secretmanager): Update formatting

7531482

feat(secretmanager): Update formatting

fb569b7

feat(secretmanager): Add expiration samples

4645d31

feat(secretmanager): Update formatting

d415d07

Merge branch 'python_tag_samples' of https://github.com/khilan-crest/…

b1db99e

…python-docs-samples into python_expiretime_samples

feat(secretmanager): Update formatting

8c78e1a

feat(secretmanager): Update formatting

989d4ed

feat(secretmanager): Update formatting

a79c77c

Merge branch 'python_tag_samples' of https://github.com/khilan-crest/…

737ba51

…python-docs-samples into python_expiretime_samples

feat(secretmanager): Adding secret rotation samples

0a36786

product-auto-label bot added api: secretmanager Issues related to the Secret Manager API. samples Issues that are directly related to samples. labels Jan 16, 2026

gemini-code-assist bot reviewed Jan 16, 2026

View reviewed changes

khilan-crest added 15 commits January 16, 2026 10:49

feat(secretmanager): Update formatting

b4b8db9

feat(secretmanager): Use flags instead of count

fd227b1

Merge branch 'python_tag_samples' of https://github.com/khilan-crest/…

9268aed

…python-docs-samples into python_expiretime_samples

Merge branch 'python_expiretime_samples' of https://github.com/khilan…

54e2b00

…-crest/python-docs-samples into python_rotation_samples

feat(secretmanager): Use v1 lib

6c19a86

feat(secretmanager): Use v1 lib

31e04a7

Merge branch 'python_tag_samples' of https://github.com/khilan-crest/…

5a5fc9c

…python-docs-samples into python_expiretime_samples

Merge branch 'python_expiretime_samples' of https://github.com/khilan…

6041cbb

…-crest/python-docs-samples into python_rotation_samples

feat(secretmanager): Use v1 lib

ccfa951

feat(secretmanager): Use path

9ba1e1a

feat(secretmanager): Use path

857c9fa

feat(secretmanager): Use path

ecc1bd5

feat(secretmanager): Use path

e3db20a

Merge branch 'python_tag_samples' of https://github.com/khilan-crest/…

0134233

…python-docs-samples into python_expiretime_samples

Merge branch 'python_expiretime_samples' of https://github.com/khilan…

8d6172e

…-crest/python-docs-samples into python_rotation_samples

khilan-crest added 4 commits January 16, 2026 17:23

feat(secretmanager): Use rotation for comparison

f93756a

feat(secretmanager): Update formatting

308099d

Merge branch 'python_tag_samples' of https://github.com/khilan-crest/…

6720c0b

…python-docs-samples into python_expiretime_samples

Merge branch 'python_expiretime_samples' of https://github.com/khilan…

8aa40a3

…-crest/python-docs-samples into python_rotation_samples

	from datetime import datetime, timedelta
	from datetime import datetime, timedelta, timezone

	next_rotation_time.FromDatetime(datetime.now() + timedelta(hours=24))
	next_rotation_time.FromDatetime(datetime.now(timezone.utc) + timedelta(hours=24))

feat(secretmanager): Adding secret rotation samples #13748

Are you sure you want to change the base?

feat(secretmanager): Adding secret rotation samples #13748

Uh oh!

Conversation

khilan-crest commented Jan 16, 2026

Checklist

Uh oh!

gemini-code-assist bot commented Jan 16, 2026

Summary of Changes

Highlights

Footnotes

Uh oh!

gemini-code-assist bot left a comment

Choose a reason for hiding this comment

Code Review

Uh oh!

gemini-code-assist bot Jan 16, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Jan 16, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Jan 16, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Jan 16, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Jan 16, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Jan 16, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Jan 16, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Jan 16, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Jan 16, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

gemini-code-assist bot Jan 16, 2026

Choose a reason for hiding this comment

Uh oh!

Choose a reason for hiding this comment

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

1 participant