Get secret for the Helm Chart from GCP Secret Manager

Question

Is there any way to retrieve secrets for the Helm Chart from the GCP Secret Manager during the chart deployment CI/CD pipeline? Or is better to use CI/CD secret manager and then there pull credentials for the chart deployment?

Answer 1

There are some information regarding using Google Secret Manager in GKE and best practices in this doc.
You should be able to use it like mentioned here or you can also try plugin like helm-secrets.
There's similar questions with answers that could be helpful 1, 2.

Answer 2

Follow the following steps to read secrets from GCP secrets.

1. Install helm secrets Plugin by running the following command.

   helm plugin install https://github.com/jkroepke/helm-secrets --version v4.4.1

2. Install vals

3. Make sure the user on your workstation or CI/CD automation (service Account) tool has access to read google secrets from the project.

4. Update your parameters in value.yaml as for following example.

   mysqlpassword: ref+gcpsecrets://my-gcp-project/mysql-password

5. Run the following command to apply the changes.

   helm secrets --evaluate-templates upgrade --install chart-name . --namespace=custom-namespace -f values.yaml