GoogleCloudPlatform / GoogleCloudPlatform/spring-cloud-gcp

JSON based Secret Manager values single property support

Open
#2,650 4 comments 0 reactions 0 assignees View on GitHub
priority: p3 secret-manager type: enhancement
Dominant language
Java
Stars
551
Forks
349
Avg merge
1d 13h
Merged PRs (30d)
14

Description

**Is your feature request related to a problem? Please describe.**
No, it is more of a limitation I would say (or maybe more like missing a little bit of sugar :) ).

**Describe the solution you'd like**
Not sure if I am the only one trying to inject a single key from a JSON based secret value with spring-cloud-gcp-secret-manager, but it would be great!

Let's say for example a new form that looks like this is added:

`sm:///json/`

This could allow someone to pick a single value from let's say this JSON:

Content of `my-database`'s secret within Secret Manager:
```json
{
"username": "user",
"password": "very-secret"
}
```

Usage within Spring's application.yaml:

```
spring:
datasource:
username: ${sm://my-database/json/username}
password: ${sm://my-database/json/password}
```

**Describe alternatives you've considered**
The example I gave above is really simplified and can be avoided by creating two secrets within the Secret Manager, but when you are dealing with many services you end up with a ton of secrets holding single values that, in the end, relates to only one service. Plus, if multiple values must be changed at the same time, new versions must be added to a lot of secrets instead of just one. Here's an example with a Kafka service:

- a single JSON based secret (my-kafka):
```json
{
"bootstrap-servers": "server-a:1234,server-b:1234",
"trust-store-certificates": "MY CERT 1",
"key-store-certificate-chain": "MY CERT 2",
"key-store-key": "MY KEY",
"schema-registry-url": "http://schema:1234",
"schema-registry-username": "user",
"schema-registry-password": "very-secret"
}
```

- a bunch of secrets:
```
my-kafka-bootstrap-servers: server-a:1234,server-b:1234
my-kafka-trust-store-certificates: MY CERT 1
my-kafka-key-store-certificate-chain: MY CERT 2
my-kafka-key-store-key: MY KEY
my-kafka-schema-registry-url: http://schema:1234
my-kafka-schema-registry-username: user
my-kafka-schema-registry-password: very-secret
```

**Additional context**
This feature request came to me since I am using the ExternalSecrets operator (https://external-secrets.io/latest/) for Kubernetes clusters, and it supports it that kind of stuff with the Secret Manager:

```yaml
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: my-kafka
spec:
refreshInterval: 1h
secretStoreRef:
kind: ClusterSecretStore
name: my-secret-store
target:
name: my-kafka-secret
creationPolicy: Owner
data:
- secretKey: MY_KAFKA_SCHEMA_REGISTRY_USERNAME
remoteRef:
key: my-kafka
property: schema-registry-username
version: latest
```

**If this feature might be considered, I could maybe lend a hand**

Contributor guide

Open the contributing guide

Research direction

Start by locating the spring-cloud-gcp-secret-manager value-resolution entry point used by application.yaml and compare it with the proposed sm:///json/ form. Done means a documented, tested way to resolve a single property from a JSON Secret Manager value, including the examples described in the issue.

Written by the indexing model from the issue text.

Assessment

Tech stack
google-cloud, java, spring
Domain
backend, cloud, security
Issue type
Feature
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
30/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.