How to deploy Cloud Functions with secrets from Secret Manager using Cloud Build?

user_4289140 0
Viewed 1756

I have a Cloud Function that I want deployed in my CD pipeline using Cloud Build. The function needs a couple of secrets stored in Secret Manager that I want to pull in as environment variables using the --set-secrets flag.

When I deploy manually with the CLI I have no issue:

gcloud beta functions deploy myfunction \
  --source src \
  --trigger-topic mytopic \
  --region europe-west1 \
  --runtime python39 \
  --set-secrets 'env_1=secret_1:latest','env_2=secret_2:latest'

However, when I try to deploy using Cloud Build with this configuration:

steps:
- name: 'gcr.io/cloud-builders/gcloud'
  args:
  - beta
  - functions
  - deploy
  - myfunction
  - --source=src
  - --trigger-topic=mytopic
  - --region=europe-west1
  - --runtime=python39
  - --set-secrets='env_1=secret_1:latest','env_2=secret_2:latest'

I get an error that the --set-secrets argument must match the pattern 'SECRET:VERSION' or 'projects/{PROJECT}/secrets/{SECRET}:{VERSION}' or 'projects/{PROJECT}/secrets/{SECRET}/versions/{VERSION}' where VERSION is a number or the label 'latest'. I don't understand why I get this error as I think my argument comforms to said pattern.

Is there something I am missing?

google-cloud-build google-cloud-functions google-cloud-platform
3 Answers

First, follow Guillaume's suggestion to remove the quotation marks around each pair. Afterwards, it should look like this:

--set-secrets=env_1=secret_1:latest,env_2=secret_2:latest

Or alternatively, my suggestion is to enclose all your arguments as a list like the example below. I tested the config below and it worked on my end.

steps:
- name: 'gcr.io/google.com/cloudsdktool/cloud-sdk'
  args: ['gcloud', 'beta','functions', 'deploy', 'myfunction', '--region=europe-west1', '--source=src', '--trigger-topic=mytopic', '--runtime=python39', '--set-secrets=env_1=secret_1:latest,env_2=secret_2:latest']

Note: Do not put spaces in --set-secrets value if you have multiple secrets

To learn more, check out this documentation.

user_165314410
user_137638580

In addition to Cadet's answer as this was what I needed, and I believe is best practice. https://cloud.google.com/build/docs/securing-builds/use-secrets For those looking to utilise secrets manager, this is how to write your script

--set-secrets=app_user=projects/369177123123/secrets/app_user:1,app_pass=projects/369177123123/secrets/app_pass:1

Make sure that the secret names "app_user" and "app_pass" correspond with what you have named in your secrets manager.

Also, take note of the project number "369177123123" as it must match your own project number. You can get your project number by visiting your dashboard. or see this link https://cloud.google.com/resource-manager/docs/creating-managing-projects#identifying_projects

Lastly, make sure you give the service account access to the secrets. See https://cloud.google.com/build/docs/securing-builds/use-secrets#grant_permissions

user_71929830
Related