从 Google Cloud Build 访问存储在 Google Secret Manager 中的环境变量

Question

如何从我的 Google Cloud Build Pipeline 访问我在Google Secret Manager 中定义的变量？

Answer 1

You can access to secret from Cloud Build by using the standard Cloud Builder gcloud

But, there is 2 issues:

1. If you want to use the secret value in another Cloud Build step, you have to store your secret in a file, the only way to reuse a previous value from one step to another one
2. The current Cloud Builder gcloud isn't up to date (today, 03 feb 2020). You have to add a gcloud component update for using the correct version. I opened an issue for this.

steps:
    - name: gcr.io/cloud-builders/gcloud
      entrypoint: "bash"
      args:
          - "-c"
          - |
              gcloud components update
              # Store the secret is a temporary file
              gcloud beta secrets versions access --secret=MySecretName latest > my-secret-file.txt
    - name: AnotherCloudBuildStepImage
      entrypoint: "bash"
      args:
          - "-c"
          - |
              # For getting the secret and pass it to a command/script
              ./my-script.sh $(cat my-secret-file.txt)

Think to grant the role Secret Manager Secret Accessor roles/secretmanager.secretAccessor to the Cloud Build default service account <PROJECT_ID>@cloudbuild.gserviceaccount.com

EDIT

You can access to the secret from anywhere, either with the gcloud CLI installed (and initialized with a service account authorized to access secrets) or via API call

curl -H "Authorization: Bearer $(gcloud auth print-access-token)" \
https://secretmanager.googleapis.com/v1beta1/projects/PROJECT_ID/secrets/MySecretName/versions/latest:access

Note: You recieve the secret in the data field, in base64 encoded format. Don't forget to decode it before using it!

You have to generate an access token on a service account with the correct role granted. Here I use again gcloud, because it's easier. But according with your platform, use the most appropriate method. A python script can also do the job.

---

EDIT 2

A new way to get secrets exists now in Cloud Build. Less boiler plate, safer. Have a look and use this way now.