Regional secrets are not loading

[sandcomputas]

I have a project in which I am trying to use regional secrets due to company policy. However, when I try to refer to a regional secret I get errors.

Example:

        val projectId = "my_project"
        val secretName = "my_secret"
        val svn = SecretVersionName.ofProjectLocationSecretSecretVersionName(projectId, "europe-west1", secretName, "latest")
        val response = secretManagerServiceClient.accessSecretVersion(svn)

Results in:

Caused by: io.grpc.StatusRuntimeException: INVALID_ARGUMENT: The provided Secret ID [projects/my_project/locations/europe-west1/secrets/my_secret/versions/latest] does not match the expected format [projects/*/secrets/*/versions/*]

When running the equivalent code for a global secret (SecretVersionName.of(projectId, "my_secret", "latest")) everything works just fine.

Also when using the property file syntax in an application.properties file the secret cannot be retrieved, even when referring to the absolute path.

Am I missing something here or is support for regional secrets not implemented yet?

[loicmathieu]

Hi,
Can you provide a reproducer project with the commands to create the necessary secrets inside Google Cloud?

[sandcomputas]

Here is a reproducer project: https://github.com/sandcomputas/quarkus-secret-manager-demo

It simply loads two secrets, one regional and one global. The application fails when I try to load the regional secret but works for the global secret.

It fails with:

Suppressed: java.lang.IllegalArgumentException: Unrecognized format for specifying a GCP Secret Manager secret: sm//projects/xxxx/locations/europe-west1/secrets/test-secret

This stems from SecretManagerConfigUtils.getSecretVersionName. It looks like the format containing < location > is not among the patterns recognized by the if-statement in this function. The length of my resource path is 6, but the third token is not "secrets" which the code expects, it is "locations".

The test secrets have been created using Terraform, and when inspecting permissions in the console everything looks fine:

## Test secret
resource "google_secret_manager_regional_secret" "test-secret-regional" {
  secret_id = "test-secret"
  project = var.project_id
  location = var.location
}

resource "google_secret_manager_regional_secret_iam_member" "test-secret-regional" {
  project = var.project_id
  location = var.location
  secret_id = google_secret_manager_regional_secret.test-secret-regional.secret_id
  role = "roles/secretmanager.secretAccessor"
  member = "serviceAccount:${google_service_account.cloudrun-hubspot-sync.email}"
  depends_on = [google_secret_manager_regional_secret.test-secret-regional]
}

[sandcomputas]

I did not have much time to work on this now but I have made a draft for a fix: #921

However I think it lacks support for short-hand secrets for regional secrets... Might have time later this week, not sure.

[sandcomputas]

It also seems like there is a need to support changing the api endpoint to be able to use the regional one:

secretmanager.<region>.rep.googleapis.com:443