google_public_ca_external_account_key returns base64 encoded mac key, should be base64url encoded

[brokenjacobs]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request.
• Please do not leave +1 or me too comments, they generate extra noise for issue followers and do not help prioritize the request.
• If you are interested in working on this issue or have submitted a pull request, please leave a comment.
• If an issue is assigned to a user, that user is claiming responsibility for the issue.
• Customers working with a Google Technical Account Manager or Customer Engineer can ask them to reach out internally to expedite investigation and resolution of this issue.

Description

google_public_ca_external_account_key returns the created hmac key from the google api in a base64 encoded format. However to actually USE this key it must be base64URL encoded, not base64 encoded.
See here:
https://datatracker.ietf.org/doc/html/rfc4648#section-5
https://cert-manager.io/docs/configuration/acme/#external-account-bindings

I'm able to approximate the logic mentioned in the cert-manager documentation to use a key in terraform like this:

eab_hmac = replace(trim(google_public_ca_external_account_key.***.b64_mac_key, "="),"+","-")

But this isn't ideal. It would be better to return an additional attribute:

b64url_mac_key

with a base64url encoded version of the key, since that's what the ACME spec requires, and that is the only use for this key. These keys are ONLY used with the acme key protocol so it makes sense to return a key in the format used by that protocol.

New or Affected Resource(s)

• google_public_ca_external_account_key

Potential Terraform Configuration

Previously:

resource "kubernetes_secret" "mysecret" {
  metadata {
    name      = "gcp-public-ca-acme"
    namespace = "cert-manager"
  }
  data = {
    eab_kid = google_public_ca_external_account_key.mykey.key_id
    # Approximate base64url encoding
    eab_hmac = replace(trim(google_public_ca_external_account_key.mykey.b64_mac_key, "="),"+","-")
  }
}

Desired:

resource "kubernetes_secret" "mysecret" {
  metadata {
    name      = "gcp-public-ca-acme"
    namespace = "cert-manager"
  }
  data = {
    eab_kid = google_public_ca_external_account_key.mykey.key_id
    eab_hmac = google_public_ca_external_account_key.mykey.b64url_mac_key
  }
}

References

No response

b/386817001