feat(secretmanager): Add Cloud SQL managed-rotation samples

secretmanager/README.md

@@ -21,6 +21,7 @@ This simple command-line application demonstrates how to invoke
     - GOOGLE_CLOUD_PUBSUB_TOPIC - Full name of topic (projects/{project}/topics/{topic}).
     - GOOGLE_CLOUD_KMS_KEY - Full name of global KMS key (projects/{project}/locations/global/keyRings/{keyring}/cryptoKeys/{key}).
     - GOOGLE_CLOUD_REGIONAL_KMS_KEY - Full name of regional KMS key (projects/{project}/locations/{location}/keyRings/{keyring}/cryptoKeys/{key}).
+    - CLOUD_SQL_INSTANCE / CLOUD_SQL_USER - Bare Cloud SQL instance ID and database username, required by the Cloud SQL managed-rotation tests.
 
 1.  **Download The Credentials** - Click "Go to credentials" after enabling the
     APIs. Click "New Credentials" and select "Service Account Key". Create a new

secretmanager/composer.json

@@ -1,6 +1,6 @@
 {
     "require": {
-        "google/cloud-secret-manager": "^2.1.0",
+        "google/cloud-secret-manager": "^2.4.0",
         "google/cloud-resource-manager": "^1.0"
     }
 }

secretmanager/src/create_regional_secret_with_cloud_sql_credentials.php

@@ -0,0 +1,74 @@
+<?php
+/*
+ * Copyright 2026 Google LLC.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+ * For instructions on how to run the full sample:
+ *
+ * @see https://github.com/GoogleCloudPlatform/php-docs-samples/tree/main/secretmanager/README.md
+ */
+
+declare(strict_types=1);
+
+namespace Google\Cloud\Samples\SecretManager;
+
+// [START secretmanager_create_regional_secret_with_cloud_sql_credentials]
+// Import the Secret Manager client library.
+use Google\Cloud\SecretManager\V1\CreateSecretRequest;
+use Google\Cloud\SecretManager\V1\Secret;
+use Google\Cloud\SecretManager\V1\Secret\SecretType;
+use Google\Cloud\SecretManager\V1\Client\SecretManagerServiceClient;
+
+/**
+ * Creates a new regional secret with type CLOUD_SQL_DB_CREDENTIALS.
+ *
+ * @param string $projectId Your Google Cloud Project ID (e.g. 'my-project')
+ * @param string $locationId Your secret Location (e.g. 'us-central1')
+ * @param string $secretId  Your secret ID (e.g. 'my-secret')
+ */
+function create_regional_secret_with_cloud_sql_credentials(string $projectId, string $locationId, string $secretId): void
+{
+    // Specify regional endpoint.
+    $options = ['apiEndpoint' => "secretmanager.$locationId.rep.googleapis.com"];
+
+    // Create the Secret Manager client.
+    $client = new SecretManagerServiceClient($options);
+
+    // Build the resource name of the parent project.
+    $parent = $client->locationName($projectId, $locationId);
+
+    $secret = new Secret([
+        'secret_type' => SecretType::CLOUD_SQL_DB_CREDENTIALS,
+    ]);
+
+    $request = CreateSecretRequest::build($parent, $secretId, $secret);
+
+    // Create the secret.
+    $newSecret = $client->createSecret($request);
+
+    printf('Created secret: %s%s', $newSecret->getName(), PHP_EOL);
+
+    printf(
+        'Grant the Cloud SQL User rotate IAM permissions to enable managed rotation to: %s%s',
+        $newSecret->getPolicyMember()->getIamPolicyUidPrincipal(),
+        PHP_EOL
+    );
+}
+// [END secretmanager_create_regional_secret_with_cloud_sql_credentials]
+
+// The following 2 lines are only needed to execute the samples on the CLI
+require_once __DIR__ . '/../../testing/sample_helpers.php';
+\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);

secretmanager/src/create_secret_with_type.php

@@ -0,0 +1,73 @@
+<?php
+/*
+ * Copyright 2026 Google LLC.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+ * For instructions on how to run the full sample:
+ *
+ * @see https://github.com/GoogleCloudPlatform/php-docs-samples/tree/main/secretmanager/README.md
+ */
+
+declare(strict_types=1);
+
+namespace Google\Cloud\Samples\SecretManager;
+
+// [START secretmanager_create_secret_with_type]
+// Import the Secret Manager client library.
+use Google\Cloud\SecretManager\V1\CreateSecretRequest;
+use Google\Cloud\SecretManager\V1\Replication;
+use Google\Cloud\SecretManager\V1\Replication\Automatic;
+use Google\Cloud\SecretManager\V1\Secret;
+use Google\Cloud\SecretManager\V1\Secret\SecretType;
+use Google\Cloud\SecretManager\V1\Client\SecretManagerServiceClient;
+
+/**
+ * Creates a new secret with the given secret type.
+ * Note: CLOUD_SQL_DB_CREDENTIALS is only supported in the regional secret.
+ *
+ * @param string $projectId Your Google Cloud Project ID (e.g. 'my-project')
+ * @param string $secretId  Your secret ID (e.g. 'my-secret')
+ * @param string $secretType Your secret type (e.g. 'ACCESS_KEY')
+ */
+function create_secret_with_type(string $projectId, string $secretId, string $secretType): void
+{
+    // Create the Secret Manager client.
+    $client = new SecretManagerServiceClient();
+
+    // Build the resource name of the parent project.
+    $parent = $client->projectName($projectId);
+
+    $secret = new Secret([
+        'replication' => new Replication([
+            'automatic' => new Automatic(),
+        ]),
+        'secret_type' => SecretType::value($secretType),
+    ]);
+
+    // Build the request.
+    $request = CreateSecretRequest::build($parent, $secretId, $secret);
+
+    // Create the secret.
+    $newSecret = $client->createSecret($request);
+
+    // Print the new secret name.
+    printf('Created secret with secret type: %s%s', $newSecret->getName(), PHP_EOL);
+}
+// [END secretmanager_create_secret_with_type]
+
+// The following 2 lines are only needed to execute the samples on the CLI
+require_once __DIR__ . '/../../testing/sample_helpers.php';
+\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);

secretmanager/src/enable_regional_secret_managed_rotation.php

@@ -0,0 +1,77 @@
+<?php
+/*
+ * Copyright 2026 Google LLC.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+ * For instructions on how to run the full sample:
+ *
+ * @see https://github.com/GoogleCloudPlatform/php-docs-samples/tree/main/secretmanager/README.md
+ */
+
+declare(strict_types=1);
+
+namespace Google\Cloud\Samples\SecretManager;
+
+// [START secretmanager_enable_regional_secret_managed_rotation]
+// Import the Secret Manager client library.
+use Google\Cloud\SecretManager\V1\EnableManagedRotationRequest;
+use Google\Cloud\SecretManager\V1\EnableManagedRotationRequest\CloudSQLSingleUserCredentials;
+use Google\Cloud\SecretManager\V1\Client\SecretManagerServiceClient;
+
+/**
+ * Enables managed rotation of a CLOUD_SQL_DB_CREDENTIALS typed secret.
+ * It validates and enables the rotation, adding a version and sets the
+ * passed password (optional).
+ * Note: AddSecretVersion is disabled on the CLOUD_SQL_DB_CREDENTIALS
+ * currently and for any necessary manual rotations please trigger
+ * rotate_secret.
+ *
+ * @param string $projectId Your Google Cloud Project ID (e.g. 'my-project')
+ * @param string $locationId Your secret Location (e.g. 'us-central1')
+ * @param string $secretId  Your secret ID (e.g. 'my-secret')
+ * @param string $instanceId Your Cloud SQL instance ID
+ * @param string $username Your Cloud SQL database username
+ */
+function enable_regional_secret_managed_rotation(string $projectId, string $locationId, string $secretId, string $instanceId, string $username): void
+{
+    // Specify regional endpoint.
+    $options = ['apiEndpoint' => "secretmanager.$locationId.rep.googleapis.com"];
+
+    // Create the Secret Manager client.
+    $client = new SecretManagerServiceClient($options);
+
+    // Build the resource name of the secret.
+    $parent = $client->projectLocationSecretName($projectId, $locationId, $secretId);
+
+    $credentials = new CloudSQLSingleUserCredentials([
+        'instance_id' => $instanceId,
+        'username' => $username,
+    ]);
+
+    $request = (new EnableManagedRotationRequest())
+        ->setParent($parent)
+        ->setCloudSqlSingleUserCredentials($credentials);
+
+    // Enable managed rotation.
+    $version = $client->enableManagedRotation($request);
+
+    printf('Enabled managed rotation, created secret version: %s%s', $version->getName(), PHP_EOL);
+}
+// [END secretmanager_enable_regional_secret_managed_rotation]
+
+// The following 2 lines are only needed to execute the samples on the CLI
+require_once __DIR__ . '/../../testing/sample_helpers.php';
+\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);

secretmanager/src/get_regional_secret_type.php

@@ -0,0 +1,69 @@
+<?php
+/*
+ * Copyright 2026 Google LLC.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+ * For instructions on how to run the full sample:
+ *
+ * @see https://github.com/GoogleCloudPlatform/php-docs-samples/tree/main/secretmanager/README.md
+ */
+
+declare(strict_types=1);
+
+namespace Google\Cloud\Samples\SecretManager;
+
+// [START secretmanager_get_regional_secret_type]
+// Import the Secret Manager client library.
+use Google\Cloud\SecretManager\V1\Client\SecretManagerServiceClient;
+use Google\Cloud\SecretManager\V1\GetSecretRequest;
+use Google\Cloud\SecretManager\V1\Secret\SecretType;
+
+/**
+ * Gets the secret type of the given regional secret.
+ *
+ * @param string $projectId Your Google Cloud Project ID (e.g. 'my-project')
+ * @param string $locationId Location of the secret (e.g. 'us-central1')
+ * @param string $secretId  Your secret ID (e.g. 'my-secret')
+ */
+function get_regional_secret_type(string $projectId, string $locationId, string $secretId): void
+{
+    // Specify regional endpoint.
+    $options = ['apiEndpoint' => "secretmanager.$locationId.rep.googleapis.com"];
+
+    // Create the Secret Manager client.
+    $client = new SecretManagerServiceClient($options);
+
+    // Build the resource name of the secret.
+    $name = $client->projectLocationSecretName($projectId, $locationId, $secretId);
+
+    // Build the request.
+    $request = GetSecretRequest::build($name);
+
+    // Get the secret.
+    $secret = $client->getSecret($request);
+
+    printf(
+        'Found regional secret %s with secret type %s%s',
+        $secret->getName(),
+        SecretType::name($secret->getSecretType()),
+        PHP_EOL
+    );
+}
+// [END secretmanager_get_regional_secret_type]
+
+// The following 2 lines are only needed to execute the samples on the CLI
+require_once __DIR__ . '/../../testing/sample_helpers.php';
+\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);

secretmanager/src/get_secret_type.php

@@ -0,0 +1,65 @@
+<?php
+/*
+ * Copyright 2026 Google LLC.
+ *
+ * Licensed under the Apache License, Version 2.0 (the "License");
+ * you may not use this file except in compliance with the License.
+ * You may obtain a copy of the License at
+ *
+ *     http://www.apache.org/licenses/LICENSE-2.0
+ *
+ * Unless required by applicable law or agreed to in writing, software
+ * distributed under the License is distributed on an "AS IS" BASIS,
+ * WITHOUT WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied.
+ * See the License for the specific language governing permissions and
+ * limitations under the License.
+ */
+
+/*
+ * For instructions on how to run the full sample:
+ *
+ * @see https://github.com/GoogleCloudPlatform/php-docs-samples/tree/main/secretmanager/README.md
+ */
+
+declare(strict_types=1);
+
+namespace Google\Cloud\Samples\SecretManager;
+
+// [START secretmanager_get_secret_type]
+// Import the Secret Manager client library.
+use Google\Cloud\SecretManager\V1\Client\SecretManagerServiceClient;
+use Google\Cloud\SecretManager\V1\GetSecretRequest;
+use Google\Cloud\SecretManager\V1\Secret\SecretType;
+
+/**
+ * Gets the secret type of the given secret.
+ *
+ * @param string $projectId Your Google Cloud Project ID (e.g. 'my-project')
+ * @param string $secretId  Your secret ID (e.g. 'my-secret')
+ */
+function get_secret_type(string $projectId, string $secretId): void
+{
+    // Create the Secret Manager client.
+    $client = new SecretManagerServiceClient();
+
+    // Build the resource name of the secret.
+    $name = $client->secretName($projectId, $secretId);
+
+    // Build the request.
+    $request = GetSecretRequest::build($name);
+
+    // Get the secret.
+    $secret = $client->getSecret($request);
+
+    printf(
+        'Found secret %s with secret type %s%s',
+        $secret->getName(),
+        SecretType::name($secret->getSecretType()),
+        PHP_EOL
+    );
+}
+// [END secretmanager_get_secret_type]
+
+// The following 2 lines are only needed to execute the samples on the CLI
+require_once __DIR__ . '/../../testing/sample_helpers.php';
+\Google\Cloud\Samples\execute_sample(__FILE__, __NAMESPACE__, $argv);