K8s-config-connector: Support for Secret Manager

[orifito]

Secret Manager is now in beta. Is there any plan to support it? Thanks!

[maqiuyujoyce]

Hi @orifito, thank you for your suggestion. We'll look into supporting it and will let you know when we have more information.

[derekperkins]

Following up to see if there are plans to support Secret Manager in the near future

[jcanseco]

Hi @derekperkins, yes, support for SecretManager resources have been included in our plans, and we are looking to prioritize it soon. I will update this thread once we have a clearer timeline.

In the meantime, can you please confirm that the resources being requested are projects.secrets and projects.secrets.versions? Thank you.

[derekperkins]

Yes, those are the resources that we're looking at with some caveats. What we actually want is to be able to set IAMPolicy for secrets. Unlike most other CC objects, I don't think we would ever actually want to create secrets or secret versions via CRD. If we trusted Kubernetes with secrets, we wouldn't need to use SecretManager. :)

[jcanseco]

What we actually want is to be able to set IAMPolicy for secrets.

Gotcha, sounds good, we'll keep that in mind :+1:

[Scorpiion]

Hi, we are also waiting for this, hope it comes soon! :+1:

[stekole]

same use case for us, being able to create bindings would be very helpful!

thanks 👍

[maqiuyujoyce]

projects.secrets is now supported in v1.14.0.

[maqiuyujoyce]

Reopening the issue since projects.secrets.versions is not yet supported.

[kozejonaz]

I see that versions seems to be supported now, which is very cool. However, and this should probably be a separate issue/question, but do you have plans on making it possible to get secrets directly from Secret Manager to avoid having the secret as a k8s-object at all? Use-case: when creating a SQLUser you could fetch from Secret Manager directly to avoid creating a k8s Secret. I know you have projects like https://github.com/GoogleCloudPlatform/berglas that you could use as a sidecar etc., but it would be interesting to hear if you've considered this (if it's feasible/makes sense that is).

[maqiuyujoyce]

Hi @kozejonaz , thank you for your comment. Yes, SecretManagerSecretVersion is already supported. For your enhancement suggestions, I created #272 to track it.