Set firebase functions config with secret environment variable

user_728045 0
Viewed 1159

What is the recommended way to set an environment variable for a firebase function that originates from the google kms?

In my cloudbuild.yaml I have following step:

  # Set env
  - name: 'gcr.io/$_PROJECT_ID/firebase'    
    args: ['functions:config:set', 'env.environment=$_ENV', 'env.build=$BUILD_ID','api_key=$API_KEY', '--project', '$_PROJECT_ID']
    dir: 'functions'    
    secretEnv: ['API_KEY','FIREBASE_TOKEN']

For the custom google cloud builder I followed the instructions from Follow instructions from https://github.com/GoogleCloudPlatform/cloud-builders-community/

The cloudbuild.yaml is either being invalidated or the substitution does not work.

Edit:

Error message

ERROR: (gcloud.builds.submit) INVALID_ARGUMENT: invalid build: key in the template "API_KEY" is not a valid built-in substitution

If I retrieve the firebase environment through firebase functions:config:get I see $API_KEY or $$API_KEY or API_KEY depending on the substitution strategy chosen. If I add the unencrypted API_KEY to the environment variables in the Google Cloud Build Trigger, the substitution works as expected.

google-cloud-build google-cloud-functions firebase
1 Answers

I have been following the github instructions link as you did:

https://github.com/GoogleCloudPlatform/cloud-builders-community/

It worked fine for me. Just to confirm that you did not miss any step, did you repeat the same steps needed to create the firebase-token and applied them to the API_KEY? 

#### create a key for the api token
gcloud kms keys create api-token --location global --keyring cloudbuilder --purpose encryption

#### create the encrypted token
echo -n $API_TOKEN | gcloud kms encrypt \
  --plaintext-file=- \
  --ciphertext-file=- \
  --location=global \
  --keyring=cloudbuilder \
  --key=api-token | base64

Also I had to add another secret to the cloudbuild.yaml:

Secrets:
- kmsKeyName: 'projects/[PROJECT_ID]/locations/global/keyRings/cloudbuilder/cryptoKeys/firebase-token'
  secretEnv:
    FIREBASE_TOKEN: '<YOUR_ENCRYPTED_TOKEN>'

- kmsKeyName: 'projects/[PROJECT_ID]/locations/global/keyRings/cloudbuilder/cryptoKeys/api-token'
  secretEnv:
    API_TOKEN: '<YOUR_ENCRYPTED_TOKEN>'

Hope that helps!

user_116410730
Related