Support loading secrets directly into services

Managed Cloud Run now has support for loading secrets into environment variables and files.

Extend this module to support loading secrets.

changed milestone to %DevOps Sprint 122

added 1 deleted label

added priority2 Medium label

added Operations label

added to epic uis/devops&25

changed time estimate to 1d 4h

added workflowSprint Ready label and removed 1 deleted label

set weight to 2

changed milestone to %DevOps Sprint 124

changed milestone to %DevOps Sprint 122

assigned to @ap2261

The Terraform module google_cloud_run_service now supports direct reference to the secrets in SM as env vars or files. Determine what needs to be mounted where.

From https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/cloud_run_service#example-usage---cloud-run-service-secret-environment-variables

---

Supports volumes

      volumes {
        name = "a-volume"
    secret {
      secret_name = google_secret_manager_secret.secret.secret_id
      items {
            key = "1"
        path = "my-secret"
      }
    }
      }

        env {
          name = "SECRET_ENV_VAR"
      value_from {
            secret_key_ref {
              name = google_secret_manager_secret.secret.secret_id
              key = "1"
            }

Yes, indeed. In my case, I'm configuring Cloud Run service via the module "gcp-cloud-run-app" which doesn't yet support this extension.

added workflowIn Progress label and removed workflowSprint Ready label

I ran into an "obfuscated" error message:

Details:
[
  {
    "@type": "type.googleapis.com/google.rpc.BadRequest",
    "fieldViolations": [
      {
        "description": "spec.template.spec.containers[0].volumeMounts should be empty",
        "field": "spec.template.spec.containers[0].volumeMounts"
      }
    ]
  }
]

Which turned out to be a bug in the docs (from the links above):

  metadata {
    annotations = {
      generated-by = "magic-modules"
      "run.googleapis.com/launch-stage" = "ALPHA"
    }
  }

Should be BETA. And if you have already applied ALPHA, remove any lifecyle rule, probably rm -rf .terraform/ and re-apply.

There is an issue here

Annoying. OTOH, our crib code does set it to "BETA" so I assume @amc203 was inspired by the Google Gods :).

mentioned in merge request !25 (merged)