GCP Secrets Manager
Relevant source files
The following files were used as context for generating this wiki page:
The GCP Secrets Manager module, provided by the @nx-extend/gcp-secrets package, allows you to manage and deploy secrets to Google Cloud Secret Manager. It integrates directly with the Nx workspace to provide local encryption and decryption capabilities, ensuring sensitive data remains secure within the repository.
You can use this plugin to manage secret lifecycles, including label assignments and update behaviors such as destroying, deleting, or disabling old secret versions. The module relies on the GCP_SECRETS_ENCRYPTION_KEY environment variable for local cryptographic operations.
Sources: packages/gcp-secrets/README.md:1-25, packages/gcp-secrets/package.json:1-15
Core Features and Executors
The module provides three primary executors to handle the secret workflow within an Nx project: encrypt, decrypt, and deploy.
Workflow Diagram
The following diagram illustrates the standard workflow for managing secrets from local development to cloud deployment.
Key Executors
| Executor | Description | Primary Options |
|---|---|---|
encrypt | Encrypts local secret files using a local key. | secret (target specific secret) |
decrypt | Decrypts files for local development. | secret (target specific secret) |
deploy | Pushes secrets to Google Cloud Secret Manager. | project, secret |
Sources: packages/gcp-secrets/README.md:27-56, packages/gcp-secrets/src/generators/init/init.impl.ts:74-85
Setup and Initialization
To integrate GCP Secrets into your workspace, you must install the package and run the initialization generator.
- Install the package:
npm install -D @nx-extend/gcp-secrets - Run the generator:
nx g @nx-extend/gcp-secrets:init - Set the environment variable:
export GCP_SECRETS_ENCRYPTION_KEY="your-key"
Sources: packages/gcp-secrets/README.md:17-25, packages/gcp-secrets/generators.json:5-10
Initialization Logic
The init generator performs the following actions:
- Normalizes project names and roots based on the provided directory.
- Adds project configuration to
workspace.jsonorproject.json. - Configures default targets for
deploy,encrypt, anddecrypt. - Generates initial template files in the project root.
Sources: packages/gcp-secrets/src/generators/init/init.impl.ts:54-93
Metadata and Configuration
Secrets are managed using metadata attributes that define their state and behavior during deployment.
| Attribute | Default | Description |
|---|---|---|
status | - | The current state: encrypted or decrypted. |
labels | [] | Array of labels applied to the secret in GCP. |
onUpdateBehavior | destroy | Action for old versions: destroy, delete, or disable. |
Sources: packages/gcp-secrets/README.md:58-66
Deployment Features
The deployment process includes specific behaviors to handle complex secret structures:
keysAreSecrets: When enabled, the deployer treats each key in a JSON file as an individual secret.- Service Account Permissions: The module can manage service account permissions for secrets, allowing for granular access control.
- Safety Checks: The system avoids attempts to destroy or disable secret versions that do not exist.
Sources: packages/gcp-secrets/CHANGELOG.md:175-180, packages/gcp-secrets/CHANGELOG.md:200-215
Summary
GCP Secrets Manager provides a secure bridge between local Nx development and Google Cloud infrastructure. By utilizing local encryption and automated deployment executors, it ensures that sensitive credentials are never stored in plain text within version control while remaining easily deployable to Google Cloud Secret Manager.