使用GCP秘密经理的秘密GCP Cloud Builder的秘密

发布于 2025-02-05 08:20:07 字数 2199 浏览 3 评论 0原文

我有cloudbuild.yaml文件，我正在尝试使用helm
在我的步骤中，我想可以从GCP Secret Manager中访问秘密，但我无法以常规方式使用silimary到此情况。
是否可以使用GCP SM的秘密使用“ Helm Step”？
这样的东西：

- name: gcr.io/$PROJECT_ID/helm
  entrypoint: 'bash'
  args:
  - -c
  - |
      helm upgrade $_NAME ./deployment/charts/$_NAME --namespace $_NAMESPACE --set secret.var3="$$VAR3"

[编辑]
更确切地说是我的CloudBuild的外观以及它应该如何
当我以经典方式使用“ helm step”时：

steps:
  - name: gcr.io/$PROJECT_ID/helm
    args:
      - upgrade
      - "$_NAME"
      - "./deployment/charts/$_NAME"
      - "--namespace"
      - "$_NAMESPACE"
      - "--set"
      - "secret.var3=$$VAR3"
    env:
      - "CLOUDSDK_COMPUTE_ZONE=$_GKE_LOCATION"
      - "CLOUDSDK_CONTAINER_CLUSTER=$_GKE_CLUSTER"
    secretEnv: ['VAR3']
    id: Apply deploy
substitutions:
  _GKE_LOCATION: europe-west3-b
  _GKE_CLUSTER: cluster-name
  _NAME: "test"
  _NAMESPACE: "test"
availableSecrets:
  secretManager:
    - versionName: projects/$PROJECT_ID/secrets/test-var-3/versions/latest
      env: 'VAR3'
options:
  substitution_option: 'ALLOW_LOOSE'

步骤工作正常，但是我的变量var3等于“ $ var3”不重视背后隐藏的东西，因此根据文档，我尝试使用这样的东西：

steps:
  - name: gcr.io/$PROJECT_ID/helm
    entrypoint: 'helm'
    args:
      - |
        upgrade $_NAME ./deployment/charts/$_NAME --namespace $_NAMESPACE --set secret.var3="$$VAR3"
    env:
      - "CLOUDSDK_COMPUTE_ZONE=$_GKE_LOCATION"
      - "CLOUDSDK_CONTAINER_CLUSTER=$_GKE_CLUSTER"
    secretEnv: ['VAR3']
    id: Apply deploy
substitutions:
  _GKE_LOCATION: europe-west3-b
  _GKE_CLUSTER: cluster-name
  _NAME: "test"
  _NAMESPACE: "test"
availableSecrets:
  secretManager:
    - versionName: projects/$PROJECT_ID/secrets/test-var-3/versions/latest
      env: 'VAR3'
options:
  substitution_option: 'ALLOW_LOOSE'

但是我遇到了一个错误：

升级失败：kubernetes群集无法到达：获取 “ http：// localhost：8080/版本？timeout = 32S”：拨号TCP 127.0.0.1：8080：连接：连接拒绝

原文

I have cloudbuild.yaml file where I'm trying use helm image
Inside my step I want to have access to secrets from GCP Secret Manager but I cannot use it in regular way silimary to this case.
Is it possible to use "helm step" with secrets from GCP SM?
Something like this:

- name: gcr.io/$PROJECT_ID/helm
  entrypoint: 'bash'
  args:
  - -c
  - |
      helm upgrade $_NAME ./deployment/charts/$_NAME --namespace $_NAMESPACE --set secret.var3="$VAR3"

[EDIT]
to be more precise how my cloudbuild looks like and how it should
when I use "helm step" in classic way:

steps:
  - name: gcr.io/$PROJECT_ID/helm
    args:
      - upgrade
      - "$_NAME"
      - "./deployment/charts/$_NAME"
      - "--namespace"
      - "$_NAMESPACE"
      - "--set"
      - "secret.var3=$VAR3"
    env:
      - "CLOUDSDK_COMPUTE_ZONE=$_GKE_LOCATION"
      - "CLOUDSDK_CONTAINER_CLUSTER=$_GKE_CLUSTER"
    secretEnv: ['VAR3']
    id: Apply deploy
substitutions:
  _GKE_LOCATION: europe-west3-b
  _GKE_CLUSTER: cluster-name
  _NAME: "test"
  _NAMESPACE: "test"
availableSecrets:
  secretManager:
    - versionName: projects/$PROJECT_ID/secrets/test-var-3/versions/latest
      env: 'VAR3'
options:
  substitution_option: 'ALLOW_LOOSE'

step works fine but my variable VAR3 is equal to "$VAR3" not to value what hide behind, so according to documentation I try use something like this:

steps:
  - name: gcr.io/$PROJECT_ID/helm
    entrypoint: 'helm'
    args:
      - |
        upgrade $_NAME ./deployment/charts/$_NAME --namespace $_NAMESPACE --set secret.var3="$VAR3"
    env:
      - "CLOUDSDK_COMPUTE_ZONE=$_GKE_LOCATION"
      - "CLOUDSDK_CONTAINER_CLUSTER=$_GKE_CLUSTER"
    secretEnv: ['VAR3']
    id: Apply deploy
substitutions:
  _GKE_LOCATION: europe-west3-b
  _GKE_CLUSTER: cluster-name
  _NAME: "test"
  _NAMESPACE: "test"
availableSecrets:
  secretManager:
    - versionName: projects/$PROJECT_ID/secrets/test-var-3/versions/latest
      env: 'VAR3'
options:
  substitution_option: 'ALLOW_LOOSE'

but then I got an error:

UPGRADE FAILED: Kubernetes cluster unreachable: Get
"http://localhost:8080/version?timeout=32s": dial tcp 127.0.0.1:8080:
connect: connection refused

分享到QQ

分享到微博

如果你对这篇内容有疑问，欢迎到本站社区发帖提问参与讨论，获取更多帮助，或者扫码二维码加入 Web 技术交流群。

发布评论

需要登录才能够评论，你可以免费注册一个本站的账号。

十六岁半 2025-02-12 08:20:07

您会忘记使用 secretenv ，如示例所示

：

steps:
- name: 'gcr.io/cloud-builders/docker'
  entrypoint: 'bash'
  args: ['-c', 'docker login --username=$USERNAME --password=$PASSWORD']
  secretEnv: ['USERNAME', 'PASSWORD']

You forget to use the secretEnv as shown in the example

Example :

steps:
- name: 'gcr.io/cloud-builders/docker'
  entrypoint: 'bash'
  args: ['-c', 'docker login --username=$USERNAME --password=$PASSWORD']
  secretEnv: ['USERNAME', 'PASSWORD']

回复收藏 0 原文

~没有更多了~