feat(secretmanager): Add Cloud SQL managed-rotation samples

[suvidha-malaviya]

Added samples for Secret Manager's Cloud SQL managed-rotation feature (regional secrets only — this feature isn't available for global secrets)

• create_regional_secret_with_cloud_sql_credentials
• enable_regional_secret_managed_rotation
• rotate_regional_secret

Added a test case for creating the Cloud SQL DB credentials secret type.

Note: requires google-cloud-secret-manager>=2.30.0, which itself requires Python>=3.10 — this feature does not exist in 2.29.0 or earlier.

##Checklist

• I have followed Sample Guidelines from AUTHORING_GUIDE.MD
• README is updated to include all relevant information
• Tests pass: nox -s py-3.9 (see Test Environment Setup)
• Lint pass: nox -s lint (see Test Environment Setup)
• These samples need a new API enabled in testing projects to pass (Cloud SQL Admin API — sqladmin.googleapis.com)
• These samples need a new/updated env vars in testing projects set to pass (let us know which ones)
  - CLOUD_SQL_INSTANCE / CLOUD_SQL_USER — a pre-provisioned, long-lived Cloud SQL instance + DB user for managed-rotation tests to point at (same pattern as this repo's other Cloud SQL-backed sample tests)
  - The identity running these tests additionally needs resourcemanager.projects.getIamPolicy/setIamPolicy on the test project (e.g. roles/resourcemanager.projectIamAdmin)
• This sample adds a new sample directory, and I updated the CODEOWNERS file with the codeowners for this sample
• This sample adds a new Product API, and I updated the Blunderbuss issue/PR auto-assigner with the codeowners for this sample
• Please merge this PR for me once it is approved

[gemini-code-assist]

Code Review

This pull request introduces new regional samples and corresponding tests for Google Cloud Secret Manager, specifically covering creating secrets with Cloud SQL credentials, enabling managed rotation, and triggering rotation. Additionally, the google-cloud-secret-manager dependency is updated to version 2.30.0 in requirements.txt. However, there are critical runtime issues in both enable_regional_secret_managed_rotation.py and rotate_regional_secret.py where the API request payloads incorrectly use the key parent instead of name for the secret's resource name, which will result in a ValueError at runtime.

[gemini-code-assist]

In EnableManagedRotationRequest, the field to specify the secret's resource name is name, not parent. Using parent as the key in the request dictionary will cause a ValueError at runtime because the field does not exist on the request message.

Please update the request dictionary key to name (and consider renaming the local variable parent to name for clarity).

Suggested change

	# Build the resource name of the secret.
	parent = f"projects/{project_id}/locations/{location_id}/secrets/{secret_id}"
	# Enable managed rotation. Leaving password unset lets Secret Manager
	# generate a secure password itself.
	response = client.enable_managed_rotation(
	request={
	"parent": parent,
	"cloud_sql_single_user_credentials": {
	"instance_id": instance_id,
	"username": username,
	},
	}
	)
	# Build the resource name of the secret.
	name = f"projects/{project_id}/locations/{location_id}/secrets/{secret_id}"
	# Enable managed rotation. Leaving password unset lets Secret Manager
	# generate a secure password itself.
	response = client.enable_managed_rotation(
	request={
	"name": name,
	"cloud_sql_single_user_credentials": {
	"instance_id": instance_id,
	"username": username,
	},
	}
	)

[suvidha-malaviya]

Verified against the installed SDK — both enable_managed_rotation and rotate_secret only define a parent field (no name), so parent is correct here.

[gemini-code-assist]

In RotateSecretRequest, the field to specify the secret's resource name is name, not parent. Using parent as the key in the request dictionary will cause a ValueError at runtime because the field does not exist on the request message.

Please update the request dictionary key to name (and consider renaming the local variable parent to name for clarity).

Suggested change

	# Build the resource name of the secret.
	parent = f"projects/{project_id}/locations/{location_id}/secrets/{secret_id}"
	# Rotate the secret.
	response = client.rotate_secret(request={"parent": parent})
	# Build the resource name of the secret.
	name = f"projects/{project_id}/locations/{location_id}/secrets/{secret_id}"
	# Rotate the secret.
	response = client.rotate_secret(request={"name": name})

[snippet-bot]

Here is the summary of changes.

You are about to add 3 region tags.

• secretmanager/snippets/regional_samples/create_regional_secret_with_cloud_sql_credentials.py:20, tag secretmanager_create_regional_secret_with_cloud_sql_credentials
• secretmanager/snippets/regional_samples/enable_regional_secret_managed_rotation.py:20, tag secretmanager_enable_regional_secret_managed_rotation
• secretmanager/snippets/regional_samples/rotate_regional_secret.py:20, tag secretmanager_rotate_regional_secret

---

This comment is generated by snippet-bot.
If you find problems with this result, please file an issue at:
https://github.com/googleapis/repo-automation-bots/issues.
To update this comment, add snippet-bot:force-run label or use the checkbox below:

• Refresh this comment