CODEWITHSUNDEEP
google-cloud-platformgoogle-cloud-runterraform-provider-gcp
Jordan LE NUFF
Jordan LE NUFF

Reputation: 93

Update Cloud Run instance on secret update

On GCP, I'm using Cloud Run with secrets with environment variables from Secret Manager.

How to efficiently update Cloud Run instance when I'm updating a secret ?

I tried with this Terraform code, no success :

// run.tf
module "cloud-run-app" {
  source  = "GoogleCloudPlatform/cloud-run/google"
  version = "~> 0.0"

  service_name          = "${local.main_project}-cloudrun"
  location              = local.region
  image                 = local.cloudrun_image
  project_id            = local.main_project
  env_vars              = local.envvars_injection
  env_secret_vars       = local.secrets_injection
  service_account_email = google_service_account.app.email
  ports                 = local.cloudrun_port
  service_annotations = {
    "run.googleapis.com/ingress" : "internal-and-cloud-load-balancing"
  }
  service_labels = {
    "env_type" = var.env_name
  }
  template_annotations = {
    "autoscaling.knative.dev/maxScale" : local.cloudrun_app_max_scale,
    "autoscaling.knative.dev/minScale" : local.cloudrun_app_min_scale,
    "generated-by" : "terraform",
    "run.googleapis.com/client-name" : "terraform"
  }
  depends_on = [
    google_project_iam_member.run_gcr,
    google_project_iam_member.app_secretmanager,
    google_secret_manager_secret_version.secrets
  ]
}

// secrets.tf
resource "google_secret_manager_secret" "secrets" {
  for_each  = local.secrets_definition
  secret_id = each.key
  replication {
    automatic = true
  }
}

resource "google_secret_manager_secret_version" "secrets" {
  for_each    = local.secrets_definition
  secret      = google_secret_manager_secret.secrets["${each.key}"].name
  secret_data = each.value
}

Upvotes: 4

Views: 1190

Answers (1)

guillaume blaquiere
guillaume blaquiere

Reputation: 76073

The trick here is to mount the secret as a volume (a file) and not as an environment variable.

If you do that, point your secret version to the latest version, and read the file every time you need the secret content, you will read the latest version. Without reloading the Cloud Run instance or redeploying a version.

Upvotes: 10

Related Questions