Error in Gcloud Certificate Manager CLI & GCP API with Regionality and Certificate Map Entries

[leoezhil]

What are the regional capabilities of Gcloud commands for managing Certificate Maps while certificates themselves can reside in specific regions, it seems certificate maps are currently limited to a global scope. Trying to create a certificate map and certificate map entry for a certificate in specific region (ex:us-east1) but getting an error 

gcloud.certificate-manager.maps.entries.create) INVALID_ARGUMENT: Malformed name: 'projects/xzzz-zzz-zzz-zzz/locations/us-east1/certificateMaps/map-test/certificateMapEntries/entry2'
- '@type': type.googleapis.com/google.rpc.BadRequest
  fieldViolations:
  - description: Invalid location in resource URL path
    field: projects/venafi-gcp-driver-integrations/locations/us-east1/certificateMaps/test-map/certificateMapEntries/entry2

 Current Behavior:

• gcloud certificate-manager maps commands operate on a global level.
• The --location flag, while present in the CLI, doesn't seem to function for regional management of certificate maps.

Desired Functionality:

We'd like to understand the intended behavior of the --location flag and if future plans exist to introduce regional support for certificate maps. Ideally, we'd like to:

• Create certificate maps associated with a specific region (e.g., us-east1).
• Create certificate map entries that reference certificates residing in a specific region.

Request:

1. Please clarify the intended functionality of the --location flag for certificate maps.
2. If regional support for certificate maps is not currently available, is there a planned timeline for its implementation?

Additional Information:

• We understand that certificates themselves can have a regional scope.
• We've verified we have the necessary permissions (e.g., Certificate Manager Owner role) for global management.

[stanwise_goog · Accepted solution]

Certificate Maps are only available in global location currently. Regional Certificates should be specified directly on TargetHttpsProxy as a list.

Please refer to this tutorial for more details: https://cloud.google.com/certificate-manager/docs/deploy-self-managed-regional

[leoezhil]

Hi @stanwise_goog - Thanks for the response.