Skip to content

Commit 5c81b7a

Browse files
Add support for secrets manager environment variables
Closes #286
1 parent 24e62d8 commit 5c81b7a

File tree

3 files changed

+114
-0
lines changed

3 files changed

+114
-0
lines changed

package/lib/compileFunctions.js

Lines changed: 5 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -49,6 +49,8 @@ module.exports = {
4949
_.get(funcObject, 'timeout') || _.get(this, 'serverless.service.provider.timeout') || '60s';
5050
funcTemplate.properties.environmentVariables =
5151
this.provider.getConfiguredEnvironment(funcObject);
52+
funcTemplate.properties.secretEnvironmentVariables =
53+
this.provider.getConfiguredSecrets(funcObject);
5254

5355
if (!funcTemplate.properties.serviceAccountEmail) {
5456
delete funcTemplate.properties.serviceAccountEmail;
@@ -80,6 +82,9 @@ module.exports = {
8082
if (!_.size(funcTemplate.properties.environmentVariables)) {
8183
delete funcTemplate.properties.environmentVariables;
8284
}
85+
if (!_.size(funcTemplate.properties.secretEnvironmentVariables)) {
86+
delete funcTemplate.properties.secretEnvironmentVariables;
87+
}
8388

8489
funcTemplate.properties.labels = _.assign(
8590
{},

package/lib/compileFunctions.test.js

Lines changed: 93 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -507,6 +507,99 @@ describe('CompileFunctions', () => {
507507
});
508508
});
509509

510+
it('should set the secret environment variables based on the function configuration', () => {
511+
googlePackage.serverless.service.functions = {
512+
func1: {
513+
handler: 'func1',
514+
secrets: {
515+
TEST_SECRET: 'secret:latest',
516+
},
517+
events: [{ http: 'foo' }],
518+
},
519+
};
520+
521+
const compiledResources = [
522+
{
523+
type: 'gcp-types/cloudfunctions-v1:projects.locations.functions',
524+
name: 'my-service-dev-func1',
525+
properties: {
526+
parent: 'projects/myProject/locations/us-central1',
527+
runtime: 'nodejs10',
528+
function: 'my-service-dev-func1',
529+
entryPoint: 'func1',
530+
availableMemoryMb: 256,
531+
secretEnvironmentVariables: ['TEST_SECRET=secret:latest'],
532+
timeout: '60s',
533+
sourceArchiveUrl: 'gs://sls-my-service-dev-12345678/some-path/artifact.zip',
534+
httpsTrigger: {
535+
url: 'foo',
536+
},
537+
labels: {},
538+
},
539+
},
540+
];
541+
542+
return googlePackage.compileFunctions().then(() => {
543+
expect(consoleLogStub.calledOnce).toEqual(true);
544+
expect(
545+
googlePackage.serverless.service.provider.compiledConfigurationTemplate.resources
546+
).toEqual(compiledResources);
547+
});
548+
});
549+
550+
it('should merge the secret environment variables on the provider configuration and function definition', () => {
551+
googlePackage.serverless.service.functions = {
552+
func1: {
553+
handler: 'func1',
554+
secrets: {
555+
TEST_SECRET: 'secret1:latest',
556+
TEST_SECRET2: 'secret2:latest',
557+
},
558+
events: [{ http: 'foo' }],
559+
},
560+
};
561+
googlePackage.serverless.service.provider.secrets = {
562+
TEST_SECRET: 'secretbase:latest',
563+
TEST_SECRET_PROVIDER: 'secretprovider:latest',
564+
};
565+
566+
const compiledResources = [
567+
{
568+
type: 'gcp-types/cloudfunctions-v1:projects.locations.functions',
569+
name: 'my-service-dev-func1',
570+
properties: {
571+
parent: 'projects/myProject/locations/us-central1',
572+
runtime: 'nodejs10',
573+
function: 'my-service-dev-func1',
574+
entryPoint: 'func1',
575+
availableMemoryMb: 256,
576+
secretEnvironmentVariables: [
577+
'TEST_SECRET=secret1:latest',
578+
'TEST_SECRET_PROVIDER=secretprovider:latest',
579+
'TEST_SECRET2=secret2:latest',
580+
],
581+
timeout: '60s',
582+
sourceArchiveUrl: 'gs://sls-my-service-dev-12345678/some-path/artifact.zip',
583+
httpsTrigger: {
584+
url: 'foo',
585+
},
586+
labels: {},
587+
},
588+
},
589+
];
590+
591+
return googlePackage.compileFunctions().then(() => {
592+
expect(consoleLogStub.calledOnce).toEqual(true);
593+
expect(
594+
googlePackage.serverless.service.provider.compiledConfigurationTemplate.resources
595+
).toEqual(compiledResources);
596+
expect(googlePackage.serverless.service.provider.secrets).toEqual({
597+
TEST_SECRET: 'secretbase:latest',
598+
TEST_SECRET_PROVIDER: 'secretprovider:latest',
599+
});
600+
});
601+
});
602+
510603
it('should compile "http" events properly', () => {
511604
googlePackage.serverless.service.functions = {
512605
func1: {

provider/googleProvider.js

Lines changed: 16 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -92,6 +92,9 @@ class GoogleProvider {
9292
},
9393
additionalProperties: false,
9494
},
95+
cloudFunctionSecretEnvironmentVariables: {
96+
type: 'object',
97+
},
9598
cloudFunctionVpcEgress: {
9699
enum: ['ALL', 'ALL_TRAFFIC', 'PRIVATE', 'PRIVATE_RANGES_ONLY'],
97100
},
@@ -119,6 +122,7 @@ class GoogleProvider {
119122
memorySize: { $ref: '#/definitions/cloudFunctionMemory' }, // Can be overridden by function configuration
120123
timeout: { type: 'string' }, // Can be overridden by function configuration
121124
environment: { $ref: '#/definitions/cloudFunctionEnvironmentVariables' }, // Can be overridden by function configuration
125+
secrets: { $ref: '#/definitions/cloudFunctionSecretEnvironmentVariables' }, // Can be overridden by function configuration
122126
vpc: { type: 'string' }, // Can be overridden by function configuration
123127
vpcEgress: { $ref: '#/definitions/cloudFunctionVpcEgress' }, // Can be overridden by function configuration
124128
labels: { $ref: '#/definitions/resourceManagerLabels' }, // Can be overridden by function configuration
@@ -133,6 +137,7 @@ class GoogleProvider {
133137
timeout: { type: 'string' }, // Override provider configuration
134138
minInstances: { type: 'number' },
135139
environment: { $ref: '#/definitions/cloudFunctionEnvironmentVariables' }, // Override provider configuration
140+
secrets: { $ref: '#/definitions/cloudFunctionSecretEnvironmentVariables' }, // Can be overridden by function configuration
136141
vpc: { type: 'string' }, // Override provider configuration
137142
vpcEgress: { $ref: '#/definitions/cloudFunctionVpcEgress' }, // Can be overridden by function configuration
138143
labels: { $ref: '#/definitions/resourceManagerLabels' }, // Override provider configuration
@@ -279,6 +284,17 @@ class GoogleProvider {
279284
);
280285
}
281286

287+
getConfiguredSecrets(funcObject) {
288+
const secrets = _.merge(
289+
{},
290+
_.get(this, 'serverless.service.provider.secrets'),
291+
funcObject.secrets
292+
);
293+
return Object.keys(secrets).map((key) => {
294+
return `${key}=${secrets[key]}`;
295+
});
296+
}
297+
282298
getConfiguredEnvironment(funcObject) {
283299
return _.merge(
284300
{},

0 commit comments

Comments
 (0)