GCP Secret Manager

Store and manage secrets securely in Google Cloud Platform.

When to Use This Skill

Use this skill when:

• Managing secrets in GCP

• Integrating with GKE workloads

• Storing API keys and credentials

• Implementing secret rotation

Prerequisites

• GCP project

• gcloud CLI configured

• Secret Manager API enabled

Basic Operations

Create secret

echo -n "secret123" | gcloud secrets create db-password --data-file=-

Access secret

gcloud secrets versions access latest --secret=db-password

Add new version

echo -n "newsecret" | gcloud secrets versions add db-password --data-file=-

List secrets

gcloud secrets list

Application Integration

from google.cloud import secretmanager

client = secretmanager.SecretManagerServiceClient() name = f"projects/my-project/secrets/db-password/versions/latest" response = client.access_secret_version(request={"name": name}) secret = response.payload.data.decode("UTF-8")

GKE Integration

apiVersion: secrets-store.csi.x-k8s.io/v1 kind: SecretProviderClass metadata: name: gcp-secrets spec: provider: gcp parameters: secrets: | - resourceName: "projects/my-project/secrets/db-password/versions/latest" path: "db-password"

Best Practices

• Use Workload Identity for GKE

• Implement IAM least-privilege

• Enable audit logging

• Use secret versions for rollback

• Integrate with Cloud KMS for encryption

Related Skills

• hashicorp-vault - Multi-cloud secrets

• gcp-gke - GKE integration