feat(compute-envs): add --secrets-kms-key for AWS compute environments [COMP-2270]

VERSION-API

@@ -1,4 +1,4 @@
-1.189.0
+1.198.0
 // Only first line of this file is read
 // This version should be bumped to the minimum version where dependent API changes were introduced
 // But never higher then the current Platform API Version deployed in Cloud Production: https://cloud.seqera.io/api/service-info

gradle/libs.versions.toml

@@ -13,7 +13,7 @@ mockserverVersion = "5.15.0"
 picocliVersion = "4.6.3"
 shadowVersion = "9.4.1"
 slf4jVersion = "2.0.17"
-towerJavaSdkVersion = "1.190.0"
+towerJavaSdkVersion = "1.200.0"
 xzVersion = "1.10"
 
 [libraries]

src/main/java/io/seqera/tower/cli/commands/computeenvs/platforms/AwsBatchForgePlatform.java

@@ -126,7 +126,8 @@ public AwsBatchConfig computeConfig() throws ApiException, IOException {
                 .computeJobRole(adv().computeJobRole)
                 .headJobCpus(adv().headJobCpus)
                 .headJobMemoryMb(adv().headJobMemoryMb)
-                .headJobRole(adv().headJobRole);
+                .headJobRole(adv().headJobRole)
+                .secretsKmsKeyId(adv().secretsKmsKeyId);
 
                 // Common
                 config.workDir(workDir)
@@ -274,6 +275,9 @@ public static class AdvancedOptions {
         @Option(names = {"--cli-path"}, description = "AWS CLI installation path on EC2 instances. Specify custom path if AWS CLI is installed in non-standard location.")
         public String cliPath;
 
+        @Option(names = {"--secrets-kms-key"}, description = "Customer-managed KMS key used to encrypt the temporary Secrets Manager secrets created for runs that use pipeline secrets. Accepts a key ARN or a key id. When omitted, the AWS-managed default Secrets Manager key is used.")
+        public String secretsKmsKeyId;
+
     }
 
 }

src/main/java/io/seqera/tower/cli/commands/computeenvs/platforms/AwsBatchManualPlatform.java

@@ -90,7 +90,8 @@ public AwsBatchConfig computeConfig() throws IOException, ApiException {
                 .computeJobRole(adv().computeJobRole)
                 .headJobCpus(adv().headJobCpus)
                 .headJobMemoryMb(adv().headJobMemoryMb)
-                .headJobRole(adv().headJobRole);
+                .headJobRole(adv().headJobRole)
+                .secretsKmsKeyId(adv().secretsKmsKeyId);
 
                 // Common
                 config.workDir(workDir)
@@ -133,5 +134,8 @@ public static class AdvancedOptions {
 
         @Option(names = {"--cli-path"}, description = "Nextflow requires the AWS CLI installed in the Ec2 instances. Use this field to specify the path.")
         public String cliPath;
+
+        @Option(names = {"--secrets-kms-key"}, description = "Customer-managed KMS key used to encrypt the temporary Secrets Manager secrets created for runs that use pipeline secrets. Accepts a key ARN or a key id. When omitted, the AWS-managed default Secrets Manager key is used.")
+        public String secretsKmsKeyId;
     }
 }

src/main/java/io/seqera/tower/cli/commands/computeenvs/platforms/AwsCloudPlatform.java

@@ -98,6 +98,7 @@ public AwsCloudConfig computeConfig() throws ApiException, IOException {
                     .ebsBootSize(adv.ebsBootSize)
                     .ebsEncrypted(adv.ebsEncrypted)
                     .ebsKmsKeyId(adv.ebsKmsKeyId)
+                    .secretsKmsKeyId(adv.secretsKmsKeyId)
                     .instanceProfileArn(adv.instanceProfileArn)
                     .vpcId(adv.vpcId)
                     .subnetId(adv.subnetId)
@@ -139,6 +140,9 @@ public static class AdvancedOptions {
         @Option(names = {"--ebs-kms-key"}, description = "KMS key ARN used to encrypt the boot EBS volume. Only applied when EBS encryption is enabled (--ebs-encryption). When omitted, the account/region default EBS encryption key is used.")
         public String ebsKmsKeyId;
 
+        @Option(names = {"--secrets-kms-key"}, description = "Customer-managed KMS key used to encrypt the temporary Secrets Manager secrets created for runs that use pipeline secrets. Accepts a key ARN or a key id. When omitted, the AWS-managed default Secrets Manager key is used.")
+        public String secretsKmsKeyId;
+
         @Option(names = {"--ec2-key-pair"}, description = "EC2 key pair name for SSH access to running instances. The key pair must already exist in the specified region.")
         public String ec2KeyPair;
 

src/test/java/io/seqera/tower/cli/InfoCmdTest.java

@@ -56,7 +56,7 @@ void testInfo(OutputType format, MockServerClient mock) throws IOException {
         Map<String, String> opts = new HashMap<>();
         opts.put("cliVersion", getCliVersion() );
         opts.put("cliApiVersion", getCliApiVersion());
-        opts.put("towerApiVersion", "1.189.0");
+        opts.put("towerApiVersion", "1.198.0");
         opts.put("towerVersion", "22.3.0-torricelli");
         opts.put("towerApiEndpoint", "http://localhost:"+mock.getPort());
         opts.put("userName", "jordi");
@@ -86,7 +86,7 @@ void testInfoStatusTokenFail(MockServerClient mock) throws IOException {
         Map<String, String> opts = new HashMap<>();
         opts.put("cliVersion", getCliVersion() );
         opts.put("cliApiVersion", getCliApiVersion());
-        opts.put("towerApiVersion", "1.189.0");
+        opts.put("towerApiVersion", "1.198.0");
         opts.put("towerVersion", "22.3.0-torricelli");
         opts.put("towerApiEndpoint", "http://localhost:"+mock.getPort());
         opts.put("userName", null);

src/test/java/io/seqera/tower/cli/computeenvs/platforms/AwsCloudPlatformTest.java

@@ -331,6 +331,67 @@ void testAddWithEbsEncryption(MockServerClient mock) throws IOException {
         assertEquals(expected.toString(), out.stdOut);
     }
 
+    @Test
+    void testAddWithSecretsKmsKey(MockServerClient mock) throws IOException {
+        mock.reset();
+
+        // given
+        mock.when(
+                request()
+                        .withMethod("GET")
+                        .withPath("/credentials")
+                        .withQueryStringParameter("platformId", "aws-cloud"),
+                exactly(1)
+        ).respond(
+                response()
+                        .withStatusCode(200)
+                        .withContentType(MediaType.APPLICATION_JSON)
+                        .withBody("{\"credentials\":[{\"id\":\"6XfOhoztUq6de3Dw3X9LSb\",\"name\":\"aws\",\"description\":null,\"discriminator\":\"aws\",\"baseUrl\":null,\"category\":null,\"deleted\":null,\"lastUsed\":\"2021-09-08T18:20:46Z\",\"dateCreated\":\"2021-09-08T12:57:04Z\",\"lastUpdated\":\"2021-09-08T12:57:04Z\"}]}")
+        );
+
+        mock.when(
+                request()
+                        .withMethod("POST")
+                        .withPath("/compute-envs")
+                        .withBody(json("""
+                                {
+                                    "computeEnv": {
+                                        "name": "my-aws-cloud-secrets-kms",
+                                        "platform": "aws-cloud",
+                                        "config": {
+                                            "workDir": "s3://my-bucket",
+                                            "region": "us-east-1",
+                                            "fusion2Enabled": true,
+                                            "waveEnabled": true,
+                                            "schedEnabled": false,
+                                            "secretsKmsKeyId": "arn:aws:kms:us-east-1:123456789012:key/abcd-1234"
+                                        },
+                                        "credentialsId": "6XfOhoztUq6de3Dw3X9LSb"
+                                    }
+                                }""")),
+                exactly(1)
+        ).respond(
+                response()
+                        .withStatusCode(200)
+                        .withContentType(MediaType.APPLICATION_JSON)
+                        .withBody("{\"computeEnvId\":\"isnEDBLvHDAIteOEF44ow\"}")
+        );
+
+        // when
+        ExecOut out = exec(mock, "compute-envs", "add", "aws-cloud",
+                "-n", "my-aws-cloud-secrets-kms",
+                "--work-dir", "s3://my-bucket",
+                "-r", "us-east-1",
+                "--secrets-kms-key", "arn:aws:kms:us-east-1:123456789012:key/abcd-1234"
+        );
+
+        // then
+        var expected = new ComputeEnvAdded("aws-cloud", "isnEDBLvHDAIteOEF44ow", "my-aws-cloud-secrets-kms", null, USER_WORKSPACE_NAME);
+        assertEquals("", out.stdErr);
+        assertEquals(0, out.exitCode);
+        assertEquals(expected.toString(), out.stdOut);
+    }
+
     @Test
     void testAddWithEbsKmsKeyWithoutEncryptionFails(MockServerClient mock) throws IOException {
         mock.reset();

src/test/resources/runcmd/info/service-info.json

@@ -1,7 +1,7 @@
 {
   "serviceInfo": {
     "version": "22.3.0-torricelli",
-    "apiVersion": "1.189.0",
+    "apiVersion": "1.198.0",
     "commitId": "3f04bfd4",
     "authTypes": [
       "github",