使用 Secret Manager 中存储的秘密初始化 Firebase Admin SDK

Question

I am trying to initialize the Firebase Admin SDK within a Cloud Run application, using a separate service account (ie not the default service account).

The documentation suggests:

import firebase_admin
from firebase_admin import credentials

cred = credentials.Certificate("path/to/serviceAccountKey.json")
firebase_admin.initialize_app(cred)

However, I would like to avoid packaging secrets into the Cloud Run container, so I am retrieving the json file from Secret Manager, and trying to create the credentials, and pass it into: firebase_admin.initialize_app(cred)

import firebase_admin
from google.cloud import secretmanager
from google.oauth2 import service_account

# Create credentials object then initialize the firebase admin client
sec_client = secretmanager.SecretManagerServiceClient()
name = sec_client.secret_version_path(GOOGLE_CLOUD_PROJECT_NUMBER, FIREBASE_SA_SECRET_NAME, "latest")
response = sec_client.access_secret_version(name)
service_account_info = json.loads(response.payload.data.decode('UTF-8'))
creds = service_account.Credentials.from_service_account_info(service_account_info)
firebase_admin.initialize_app(creds)

Error received:

ValueError: Illegal Firebase credential provided. App must be initialized with a valid credential instance.

Any tips are appreciated.

Answer 1

import firebase_admin
from google.cloud import secretmanager
from google.oauth2 import service_account

# Create credentials object then initialize the firebase admin client
sec_client = secretmanager.SecretManagerServiceClient()
name = sec_client.secret_version_path(GOOGLE_CLOUD_PROJECT_NUMBER, FIREBASE_SA_SECRET_NAME, "latest")
response = sec_client.access_secret_version(name)
service_account_info = json.loads(response.payload.data.decode('utf-8'))

# build credentials with the service account dict
creds = firebase_admin.credentials.Certificate(service_account_info)

# initialize firebase admin
firebase_app = firebase_admin.initialize_app(creds)

Answer 2

I am trying to initialize the Firebase Admin SDK within a Cloud Run application, using a separate service account (ie not the default service account).

The documentation suggests:

import firebase_admin
from firebase_admin import credentials

cred = credentials.Certificate("path/to/serviceAccountKey.json")
firebase_admin.initialize_app(cred)

However, I would like to avoid packaging secrets into the Cloud Run container, so I am retrieving the json file from Secret Manager, and trying to create the credentials, and pass it into: firebase_admin.initialize_app(cred)

import firebase_admin
from google.cloud import secretmanager
from google.oauth2 import service_account

# Create credentials object then initialize the firebase admin client
sec_client = secretmanager.SecretManagerServiceClient()
name = sec_client.secret_version_path(GOOGLE_CLOUD_PROJECT_NUMBER, FIREBASE_SA_SECRET_NAME, "latest")
response = sec_client.access_secret_version(name)
service_account_info = json.loads(response.payload.data.decode('UTF-8'))
creds = service_account.Credentials.from_service_account_info(service_account_info)
firebase_admin.initialize_app(creds)

Error received:

ValueError: Illegal Firebase credential provided. App must be initialized with a valid credential instance.

Any tips are appreciated.