https://github.com/gordalina/hush_gcp_secret_manager

A Google Secret Manager Provider for Hush
https://github.com/gordalina/hush_gcp_secret_manager

elixir gcp hush secrets-management

Last synced: about 1 month ago
JSON representation

A Google Secret Manager Provider for Hush

• Host: GitHub
• URL: https://github.com/gordalina/hush_gcp_secret_manager
• Owner: gordalina
• License: other
• Created: 2020-07-18T09:16:11.000Z (over 4 years ago)
• Default Branch: main
• Last Pushed: 2024-06-12T21:53:05.000Z (6 months ago)
• Last Synced: 2024-10-16T07:46:41.687Z (about 2 months ago)
• Topics: elixir, gcp, hush, secrets-management
• Language: Elixir
• Homepage:
• Size: 83 KB
• Stars: 18
• Watchers: 3
• Forks: 1
• Open Issues: 1
• Metadata Files:
  • Readme: README.md
  • Changelog: CHANGELOG.md
  • Funding: .github/FUNDING.yml
  • License: LICENSE

Awesome Lists containing this project

• fucking-awesome-elixir - hush_gcp_secret_manager - Google Secret Manager provider for hush. (Configuration)
• awesome-elixir - hush_gcp_secret_manager - Google Secret Manager provider for hush. (Configuration)

README

        
# GCP Secret Manager Hush Provider

[![Build Status](https://img.shields.io/github/actions/workflow/status/gordalina/hush_gcp_secret_manager/ci.yml?branch=main&style=flat-square)](https://github.com/gordalina/hush_gcp_secret_manager/actions?query=workflow%3A%22ci%22)

[![Coverage Status](https://img.shields.io/codecov/c/github/gordalina/hush_gcp_secret_manager?style=flat-square)](https://app.codecov.io/gh/gordalina/hush_gcp_secret_manager)

[![hex.pm version](https://img.shields.io/hexpm/v/hush_gcp_secret_manager?style=flat-square)](https://hex.pm/packages/hush_gcp_secret_manager)

[![hex.pm downloads](https://img.shields.io/hexpm/dt/hush_gcp_secret_manager?style=flat-square)]([LICENSE](https://hex.pm/packages/hush_gcp_secret_manager))

This package provides a [Hush](https://github.com/gordalina/hush) Provider to resolve Google Cloud Platform's [Secret Manager](https://cloud.google.com/secret-manager) secrets.

Documentation can be found at [https://hexdocs.pm/hush_gcp_secret_manager](https://hexdocs.pm/hush_gcp_secret_manager).

## Installation

The package can be installed by adding `hush_gcp_secret_manager` to your list

of dependencies in `mix.exs`:

```elixir

def deps do

  [

    {:hush, "~> 1.0"},

    {:hush_gcp_secret_manager, "~> 1.1"}

  ]

end

```

This module relies on `goth` to fetch secrets from the Google Cloud Platform API. As such you need to configure goth which is used in `hush_gcp_secret_manager`, the configuration is the same as if you were to configure a child_spec as per [their documentation](https://github.com/peburrows/goth).

As the provider needs to start both applications, it needs to registered as a provider in `hush`, so that it gets loaded during startup.

```elixir

# config/config.exs

alias Hush.Provider.GcpSecretManager

# ensure hush loads GcpSecretManager during startup

config :hush,

  providers: [GcpSecretManager]

config :hush_gcp_secret_manager,

  project_id: "my_project_id",

  goth: [name: MyApp.Goth, source: ...],

  goth_timeout: 5_000 # milliseconds

```

### GCP Authorization

In order to retrieve secrets from GCP, ensure the service account you use has the Secret Manager Secret Accessor role (`roles/secretmanager.secretAccessor`).

## Usage

The following example reads the password and the pool size for CloudSQL from secret manager into the ecto repo configuration.

```elixir

# config/prod.exs

alias Hush.Provider.GcpSecretManager

config :app, App.Repo,

  password: {:hush, GcpSecretManager, "CLOUDSQL_PASSWORD"},

  pool_size: {:hush, GcpSecretManager, "ECTO_POOL_SIZE", cast: :integer, default: 10}

```

## License

Hush is released under the Apache License 2.0 - see the [LICENSE](LICENSE) file.