CODEWITHSUNDEEP
terraformterraform-provider-gcp
SebastianG
SebastianG

Reputation: 9574

gcp cloud run, how to define multiple secret volumes via terraform, currently only 1 secret seems supported in documentation

Currently the terraform documentation for cloud run here shows you an example on how to mount 1 single secret volume to the cloud run service.

  template {
    spec {
      containers {
        image = "gcr.io/cloudrun/hello"
        volume_mounts {
          name = "a-volume"
          mount_path = "/secrets"
        }
      }
      volumes {
        name = "a-volume"
        secret {
          secret_name = google_secret_manager_secret.secret.secret_id
          default_mode = 292 # 0444
          items {
            key = "1"
            path = "my-secret"
            mode = 256 # 0400
          }
        }
      }
    }
  }

I've tried to add multiple volumes and secret blocks but this will error out saying only 1 is allowed.

I've also tried to look through the documentation for a general example of multiple volumes but no such example exists.

Upvotes: 2

Views: 1864

Answers (2)

janpjens
janpjens

Reputation: 96

For those wondering per 2022, since the documentation is still somewhat unclear: Multiple secrets can be mounted under multiple mount points for Cloud Run by repeating the entries (assuming a secondary secret entry as well):

spec {
  containers {
    image = "gcr.io/cloudrun/hello"
    volume_mounts {
      name = "a-volume"
      mount_path = "/secrets"
    }
    volume_mounts {
      name = "secondary-volume"
      mount_path = "/somewhere-else"
    }
  }
  volumes {
    name = "a-volume"
    secret {
      secret_name = google_secret_manager_secret.secret.secret_id
      default_mode = 292 # 0444
      items {
        key = "1"
        path = "my-secret"
        mode = 256 # 0400
      }
    }
  }
  volumes {
    name = "secondary-volume"
    secret {
      secret_name = google_secret_manager_secret.secondary_secret.secret_id
      default_mode = 292 # 0444
      items {
        key = "1"
        path = "my-secondary-secret"
        mode = 256 # 0400
      }
    }
  }
}

Upvotes: 5

Quaresma
Quaresma

Reputation: 21

In terraform documentation you can see : "The spec block supports: ...... volumes - (Optional) Volume represents a named volume in a container. Structure is"

You need to use the volume tag in spec context. like this

spec {
  containers {
    volume_mounts {
      mount_path = "/secrets"
      name = "secret"
    }        
  }

    **volumes {
    name = "secret"
    secret {
      secret_name = "secret name"
    }
  }**
}

Upvotes: 0

Related Questions