GoogleCloudPlatform / GoogleCloudPlatform/spring-cloud-gcp
JSON based Secret Manager values single property support
- Dominant language
- Java
- Stars
- 551
- Forks
- 349
- Avg merge
- 1d 13h
- Merged PRs (30d)
- 14
Description
**Is your feature request related to a problem? Please describe.**
No, it is more of a limitation I would say (or maybe more like missing a little bit of sugar :) ).
**Describe the solution you'd like**
Not sure if I am the only one trying to inject a single key from a JSON based secret value with spring-cloud-gcp-secret-manager, but it would be great!
Let's say for example a new form that looks like this is added:
`sm:///json/`
This could allow someone to pick a single value from let's say this JSON:
Content of `my-database`'s secret within Secret Manager:
```json
{
"username": "user",
"password": "very-secret"
}
```
Usage within Spring's application.yaml:
```
spring:
datasource:
username: ${sm://my-database/json/username}
password: ${sm://my-database/json/password}
```
**Describe alternatives you've considered**
The example I gave above is really simplified and can be avoided by creating two secrets within the Secret Manager, but when you are dealing with many services you end up with a ton of secrets holding single values that, in the end, relates to only one service. Plus, if multiple values must be changed at the same time, new versions must be added to a lot of secrets instead of just one. Here's an example with a Kafka service:
- a single JSON based secret (my-kafka):
```json
{
"bootstrap-servers": "server-a:1234,server-b:1234",
"trust-store-certificates": "MY CERT 1",
"key-store-certificate-chain": "MY CERT 2",
"key-store-key": "MY KEY",
"schema-registry-url": "http://schema:1234",
"schema-registry-username": "user",
"schema-registry-password": "very-secret"
}
```
- a bunch of secrets:
```
my-kafka-bootstrap-servers: server-a:1234,server-b:1234
my-kafka-trust-store-certificates: MY CERT 1
my-kafka-key-store-certificate-chain: MY CERT 2
my-kafka-key-store-key: MY KEY
my-kafka-schema-registry-url: http://schema:1234
my-kafka-schema-registry-username: user
my-kafka-schema-registry-password: very-secret
```
**Additional context**
This feature request came to me since I am using the ExternalSecrets operator (https://external-secrets.io/latest/) for Kubernetes clusters, and it supports it that kind of stuff with the Secret Manager:
```yaml
apiVersion: external-secrets.io/v1beta1
kind: ExternalSecret
metadata:
name: my-kafka
spec:
refreshInterval: 1h
secretStoreRef:
kind: ClusterSecretStore
name: my-secret-store
target:
name: my-kafka-secret
creationPolicy: Owner
data:
- secretKey: MY_KAFKA_SCHEMA_REGISTRY_USERNAME
remoteRef:
key: my-kafka
property: schema-registry-username
version: latest
```
**If this feature might be considered, I could maybe lend a hand**
Contributor guide
Research direction
Start by locating the spring-cloud-gcp-secret-manager value-resolution entry point used by application.yaml and compare it with the proposed sm:///json/ form. Done means a documented, tested way to resolve a single property from a JSON Secret Manager value, including the examples described in the issue.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- google-cloud, java, spring
- Domain
- backend, cloud, security
- Issue type
- Feature
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 30/100