Inserting secrets into GCP VM instance from secrets manager

Question

Using github actions I'm building a container and pushing it to an existing VM instance. I would like to include secrets as environmental variables after authenticating the secret manager so the container can utilize them during runtime. The following command updates the container to the VM but it does not accept any secrets as parameters.

 - name: Deploy to google compute instance
    run: |-
      gcloud compute instances update-container ${{ env.GCE_INSTANCE }} \
        --zone "$GCE_INSTANCE_ZONE" \
        --container-image ${{ env.REGION}}-docker.pkg.dev/${{ secrets.PROJECT_ID}}/${{ env.ARTIFACT_REPO}}/${{ env.DOCKER_IMAGE }} \

In the past, I have deployed a docker container to google run and included secrets as environmental variables successfully with the following command. Is there a way to mimic this behavior from google run with a VM instance?

 - name: deploy
    id: 'deploy'
    uses: 'google-github-actions/deploy-cloudrun@v0'
    with:
      service: ${{ env.IMAGE_NAME}}
      image: ${{ env.REGION}}-docker.pkg.dev/${{ secrets.PROJECT_ID}}/${{ env.ARTIFACT_REPO}}/${{ env.DOCKER_IMAGE }}
      region: ${{ env.REGION }}
      secrets: |-
        SQL_SERVER_CA=SQL_SERVER_CA:latest, SQL_CLIENT_CERT=SQL_CLIENT_CERT:latest

Try combing **google-github-actions/get-secretmanager-secrets@v0** with **--container-env** https://github.com/google-github-actions/get-secretmanager-secrets and https://cloud.google.com/sdk/gcloud/reference/compute/instances/update-container#--container-env — John Hanley, Mar 31 '22 at 18:19
@JohnHanley it's nearly working but the command --container-env with secrets that are multiline like SSL keys error out. Is there a way to flatten the multiline secrets? — Matt Nann, Mar 31 '22 at 21:11
Base64 encode before storing the secret. Then in your application base64 decode. That is the standard technique. — John Hanley, Mar 31 '22 at 21:19

score 1 · Accepted Answer · answered Apr 01 '22 at 18:33

Following the advice of @JohnHanley 's comment, I was able to access secrets within my container that is running on a VM instance. Using --container-env flag on the "gcloud compute instances update-container" worked. The service account token for accessing secret manager is stored in github action secrets and it is base64 encoded. It is passed into the container with the --container-env flag along with two other variables. Once the container has started the service account token is decoded and used to retrieve the rest of the many secrets stored in google secrets manager. This likely is not the best way but it required the least amount of rework to get working.

- name: Deploy to google compute instance
    run: |-
        gcloud compute instances update-container ${{ env.GCE_INSTANCE }} \
        --zone ${{ env.ZONE}} \
        --container-image ${{ env.REGION}}-docker.pkg.dev/${{ secrets.PROJECT_ID}}/${{ env.ARTIFACT_REPO}}/${{ env.DOCKER_IMAGE }} \
        --container-env GCP_SECRET_ACCESSOR_SERVICE_TOKEN=${{ secrets.GCP_SECRET_ACCESSOR_SERVICE_TOKEN}} \
        --container-env PROJECT_ID=${{ secrets.PROJECT_ID}} \
        --container-env RUNNING_LOCATION=cloudbt

Nestor Daniel Ortega Perez · Answer 2 · 2022-04-01T15:42:34.057

You can use Cloud Build to inject the secrets. For that, you need to:

1.Enable the Cloud Build and Secret Manager APIs.

2.Set up the required IAM permissions.

3.Configure builds to access UTF-8 secrets from Secret Manager. As an example, the following build YAML shows how to login to Docker using the Docker username and password stored in Secret Manager:

steps:
- name: 'gcr.io/cloud-builders/docker'
  entrypoint: 'bash'
  args: ['-c', 'docker login --username=$$USERNAME --password=$$PASSWORD']
  secretEnv: ['USERNAME', 'PASSWORD']
availableSecrets:
  secretManager:
  - versionName: projects/PROJECT_ID/secrets/DOCKER_PASSWORD_SECRET_NAME/versions/DOCKER_PASSWORD_SECRET_VERSION
    env: 'PASSWORD'
  - versionName: projects/PROJECT_ID/secrets/DOCKER_USERNAME_SECRET_NAME/versions/DOCKER_USERNAME_SECRET_VERSION
    env: 'USERNAME'

Use this Official GCP's Documentation as a more detailed reference for that; it has Docker and GitHub examples.

Plus, there is another 3rd-party option useful for you: SecretHub. Here, you have the required steps that you need to follow using SecretHub.

Use this last thread Can I run a Cloud build on my own VM intances as another Cloud Build reference on GCP's VMs.

And finally, on this Official GCP’s Documentation you are going to find the information and steps to implement Caching in Cloud Build, to speed up your build as you need to do it.

I am using the github action: uses: docker/build-push-action@v2 to enable caching to speed up my super long docker build time, would I be able to also use caching with this method? — Matt Nann, Mar 31 '22 at 21:14
Based on this documentation [docker / build-push-action](https://github.com/docker/build-push-action/blob/master/docs/advanced/secrets.md) and [Build and push a Docker image with Cloud Build](https://cloud.google.com/build/docs/build-push-docker-image), yes, you will be able to. — Nestor Daniel Ortega Perez, Mar 31 '22 at 22:10
@MattNann I just edited the answer, adding the information and steps to implement caching in Cloud Build, to speed up your build as you need to do it. — Nestor Daniel Ortega Perez, Apr 01 '22 at 15:03

Inserting secrets into GCP VM instance from secrets manager

2 Answers2