How do I use Google Secrets Manager to create a docker ARG in Google Cloud Build?

问题

I'm doing a build on GCB in which I need to install private dependencies, so am using Google Secrets Manager. My cloudbuild.yaml looks like this:

steps:
- name: gcr.io/cloud-builders/gcloud
  entrypoint: 'bash'
  args: [ '-c', "gcloud secrets versions access latest --secret=PERSONAL_ACCESS_TOKEN_GITHUB --format='get(payload.data)' | tr '_-' '/+' | base64 -d > decrypted-pat.txt" ]
- name: 'gcr.io/cloud-builders/docker'
  args:
    - build
    - '--build-arg'
    - PERSONAL_ACCESS_TOKEN_GITHUB=$(cat decrypted-pat.txt)
    - '-t'
    - 'gcr.io/$PROJECT_ID/$REPO_NAME:$TAG_NAME'
    - .
images: [ gcr.io/$PROJECT_ID/$REPO_NAME:$TAG_NAME ]

But, the $(cat decrypted-pat.txt) doesn't get evaluated. Inserting: RUN echo https://${PERSONAL_ACCESS_TOKEN_GITHUB}@github.com into my dockerfile simply echoes the literal: of course, https://$(cat decrypted-pat.txt)@github.com is not the command I'm looking for (and yes, if I get the thing to actually echo successfully, I'll rotate the token).

There's a note in the gcb / secrets docs

To use the secret in an environment variable, you need to prefix the variable name with an underscore "_" and escape the value using '('. For example: _VARIABLE_NAME=$(cat password.txt) && echo -n )_VARIABLE_NAME.

But this doesn't make a lot of sense to me for use in the build args.

How can I get the actual value of this secret into the container as a build arg?

回答1:

I figured out that I could circumvent the default entrypoint on the docker build step, then use a bash command straightforwardly to invoke docker.

steps:
- name: gcr.io/cloud-builders/gcloud
  entrypoint: 'bash'
  args: [ '-c', "gcloud secrets versions access latest --secret=PERSONAL_ACCESS_TOKEN_GITHUB --format='get(payload.data)' | tr '_-' '/+' | base64 -d > decrypted-pat.txt" ]

- name: 'gcr.io/cloud-builders/docker'
  entrypoint: 'bash'
  args:
    - "-c"
    - |
      # For getting the secret and pass it to a command/script
      docker build --build-arg PERSONAL_ACCESS_TOKEN_GITHUB=$(cat decrypted-pat.txt) -t gcr.io/$PROJECT_ID/$REPO_NAME:$TAG_NAME .

(fix inspired by this post)

来源：https://stackoverflow.com/questions/65302542/how-do-i-use-google-secrets-manager-to-create-a-docker-arg-in-google-cloud-build