feat: Added feature to base64 decode the value in GSM

[aminsaedi]

This PR adds a new decodeBase64 field to the Secret configuration that allows automatic base64 decoding of secret values retrieved from GSM and Parameter Manager before mounting them to pods.

Motivation

We use a third-party service that stores secrets in GSM in base64-encoded format. Currently, when these secrets are mounted to pods, they remain base64-encoded, requiring additional decoding steps within the application. This feature removes that extra step by decoding the values directly in the CSI driver.

[google-cla]

Thanks for your pull request! It looks like this may be your first contribution to a Google open source project. Before we can look at your pull request, you'll need to sign a Contributor License Agreement (CLA).

View this failed invocation of the CLA check for more information.

For the most up to date status, view the checks section at the bottom of the pull request.

[dargudear-google]

Thanks for the PR, I'll review it by next EOW.

[aminsaedi]

@dargudear-google Could you please review again?

[dargudear-google]

Please also update the e2e test test/e2e/.

[aminsaedi]

@dargudear-google I think the E2E tests are failing due to authentication issues with forked PRs, not due to my code changes. Could you please help me how to resolve it?

[dargudear-google]

@dargudear-google I think the E2E tests are failing due to authentication issues with forked PRs, not due to my code changes. Could you please help me how to resolve it?

Yes it is known limitation but we can run it after merge and resolve any issues afterwords.

[aminsaedi]

@dargudear-google Could you please check this PR?

[dargudear-google]

@dargudear-google I think the E2E tests are failing due to authentication issues with forked PRs, not due to my code changes. Could you please help me how to resolve it?

key was expired which I fixed it now

[aminsaedi]

So could you please run the CI jobs again? Thanks.

[dargudear-google]

I can not see any changes in test/e2e/ ?
Please make the changes and I can run it on my side, right now it is not possible to run e2e tests from forked repo branches.

[pragya644]

@aminsaedi Any update on this?

[aminsaedi]

@dargudear-google @pragya644 thanks for the patience — I've now pushed e2e tests in test/e2e/ (commit a1b85e4) covering the new decodeBase64 field on both fetchers:

Secret Manager — TestMountDecodeBase64Secret

• New template test/e2e/templates/test-decode-base64-sm.yaml.tmpl mounts a base64-encoded GSM secret at three paths in one pod:
  • /var/gcp-test-secrets/decoded — global, decodeBase64: true → expects plaintext
  • /var/gcp-test-secrets/decoded-regional — regional, decodeBase64: true → expects plaintext
  • /var/gcp-test-secrets/encoded — global, without the flag → expects the original base64 string (negative control to prove the flag is opt-in)
• setupSmTestSuite/teardownSmTestSuite create and clean up the global+regional *-decode-base64 secrets with base64-encoded payloads.

Parameter Manager — TestMountDecodeBase64ParameterVersion

• New template test/e2e/templates/test-decode-base64-pm.yaml.tmpl, same shape: decoded global, decoded regional, and a non-decoded sibling for the negative control.
• setupPmTestSuite/teardownPmTestSuite create and clean up UNFORMATTED parameters + versions with base64 payloads (no __REF__, so the rendered payload equals the stored bytes — keeps the test focused on the decode path only).

Wiring:

• Added testDecodeBase64SecretID, decodeBase64ParameterId/-VersionId, and the regional pair to testFixture in mount_test.go.
• Added $TEST_DECODE_BASE64_SECRET_ID, $TEST_DECODE_BASE64_PARAMETER_ID, $TEST_DECODE_BASE64_VERSION_ID, and the $TEST_REGIONAL_* variants to replaceTemplate.

Local verification: go vet -tags=all_e2e ./test/e2e/..., go vet -tags=secretmanager_e2e ./test/e2e/..., go vet -tags=parametermanager_e2e ./test/e2e/..., go build ./..., and existing unit tests all pass. Of course, the actual e2e run still has to happen on your side because of the forked-PR auth limitation — let me know if anything fails or if you'd like me to adjust the test shape.