scullery.kms

Key Management Service v1.0 API client

Provides a Python wrapper around the Open Telekom Cloud KMS REST API (v1.0).

Module Contents

Classes

Kms

KMS (Key Management Service) client using the v1.0 REST API.

Data

STATE_PENDING_CREATION

STATE_ENABLED

STATE_DISABLED

STATE_PENDING_DELETION

STATE_PENDING_IMPORT

STATE_NAMES

STATE_BY_NAME

API

scullery.kms.STATE_PENDING_CREATION

1

scullery.kms.STATE_ENABLED

2

scullery.kms.STATE_DISABLED

3

scullery.kms.STATE_PENDING_DELETION

4

scullery.kms.STATE_PENDING_IMPORT

5

scullery.kms.STATE_NAMES

None

scullery.kms.STATE_BY_NAME

None

class scullery.kms.Kms(session)

KMS (Key Management Service) client using the v1.0 REST API.

All operations require a project-scoped session. If no project is provided at session creation, the current region is used as the project scope (see :meth:scullery.api.ApiSession.project_id).

Initialization

Constructor.

Parameters:

session – An authenticated :class:scullery.api.ApiSession.

API_HOST

‘kms.{region}.otc.t-systems.com’

API endpoint template.

api_path(path: str = '') → str

Build a full KMS API URL for path.

property project_id: str

Lazily resolve and cache the project / region ID.

_keys_base(action: str = '') → str

Base URL for v1.0 key actions: /v1.0/{project_id}/kms/{action}.

resolve_key(name: str) → str

Resolve a key alias or key ID to a key ID.

Tries the following strategies in order:

  1. If name looks like a UUID, try :meth:describe directly.

  2. List all keys and match by key_alias.

  3. Try :meth:describe one more time as a fallback.

Parameters:

name – Key alias or key ID.

Returns:

The canonical key ID.

Raises:

  • KeyError – If no key matches.

  • RuntimeError – If multiple keys share the same alias.

keys(key_state: int | None = None, limit: int = 2000, marker: str | None = None) → list

List Customer Master Keys via the v1.0 list-keys endpoint.

Parameters:

  • key_state – Optional numeric state filter (see :data:STATE_NAMES).

  • limit – Maximum number of keys to return (default 2000).

  • marker – Pagination marker for the next page.

Returns:

List of key info dicts.

Raises:

RuntimeError – On API error.

describe(key_id: str) → dict

Get full metadata for a key via the v1.0 describe-key endpoint.

Parameters:

key_id – Key ID.

Returns:

Key info dict.

Raises:

RuntimeError – On API error.

create(alias: str, description: str | None = None, key_spec: str = 'AES_256', key_usage: str = 'ENCRYPT_DECRYPT') → dict

Create a new Customer Master Key via the v1.0 create-key endpoint.

Parameters:

  • alias – Key alias (display name).

  • description – Optional description.

  • key_spec – Key spec ('AES_256', 'AES_128', etc.).

  • key_usage – Key usage ('ENCRYPT_DECRYPT', 'SIGN_VERIFY').

Returns:

Created key info dict.

Raises:

RuntimeError – On API error.

schedule_deletion(key_id: str, pending_days: int = 7) → dict

Schedule a key for deletion via the v1.0 schedule-key-deletion endpoint.

Parameters:

  • key_id – Key ID.

  • pending_days – Days before permanent deletion (7–1096, default 7).

Returns:

Updated key info dict (includes deletion date).

Raises:

RuntimeError – On API error.

cancel_deletion(key_id: str) → dict

Cancel a scheduled key deletion via the v1.0 cancel-key-deletion endpoint.

Parameters:

key_id – Key ID.

Returns:

Key info dict (may be empty on some API versions).

Raises:

RuntimeError – On API error.

enable(key_id: str) → dict

Enable a disabled key via the v1.0 enable-key endpoint.

Parameters:

key_id – Key ID.

Returns:

Key info dict (may be empty on some API versions).

Raises:

RuntimeError – On API error.

disable(key_id: str) → dict

Disable an enabled key via the v1.0 disable-key endpoint.

Parameters:

key_id – Key ID.

Returns:

Key info dict (may be empty on some API versions).

Raises:

RuntimeError – On API error.

get_rotation_status(key_id: str) → dict

Query key rotation status via the v1.0 get-key-rotation-status endpoint.

Parameters:

key_id – Key ID.

Returns:

Dict with key_rotation_enabled and rotation_interval.

Raises:

RuntimeError – On API error.

rotate(key_id: str, period: int | None = None) → dict

Enable or disable automatic key rotation via the v1.0 endpoints.

  • period > 0: enable rotation, then set interval.

  • period == 0: disable rotation.

  • period is None: return current status (no change).

Enabling is a two-step process: first enable-key-rotation, then update-key-rotation-interval. Disabling is a single call to disable-key-rotation.

Parameters:

  • key_id – Key ID.

  • period – Rotation interval in days (30–365); 0 to disable; None to just query current status.

Returns:

Dict with key_rotation_enabled and rotation_interval.

Raises:

RuntimeError – On API error.