Repository navigation
Add gcp secret manager as a credential provider in its own go module - #1991
Merged
Lior Lieberman (LiorLieberman) merged 3 commits intoSep 30, 2026
Conversation
Yufan Su (yufan-su)
force-pushed
the
gcp-secret-manager-provider
branch
4 times, most recently
from
September 30, 2026 04:32
e04a74a to
da8a262
Compare
Bowei Du (bowei)
added
area/dev-infra
area/network
area/security
Yufan Su (yufan-su)
force-pushed
the
gcp-secret-manager-provider
branch
3 times, most recently
from
September 30, 2026 20:42
a59a6e9 to
214154e
Compare
Yufan Su (yufan-su)
marked this pull request as ready for review
September 30, 2026 20:45
Yufan Su (yufan-su)
changed the title
Lior Lieberman (LiorLieberman)
left a comment
Lior Lieberman (LiorLieberman)
left a comment
Collaborator
There was a problem hiding this comment.
Thanks Yufan Su (@yufan-su)
Collaborator
There was a problem hiding this comment.
nit: I think its a bit odd its a special module for mtls handshake.. but we probably should leave the comment open for more opinions.
Yufan Su (yufan-su)
force-pushed
the
gcp-secret-manager-provider
branch
from
September 30, 2026 21:41
214154e to
b417e0d
Compare
Lior Lieberman (LiorLieberman)
approved these changes
Sep 30, 2026
Lior Lieberman (LiorLieberman)
left a comment
Lior Lieberman (LiorLieberman)
left a comment
Collaborator
There was a problem hiding this comment.
lgtm, is anything install it by default or something?
Collaborator
Author
|
no, I will have a followup change to update ate-setup to install it, maybe like
|
github-merge-queue
Bot
removed this pull request from the merge queue due to failed status checks
Sep 30, 2026
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Adds a credential provider for egress credential injection backed by Google Cloud Secret Manager.
It lives in its own Go module under
plugins/gcp-secret-manager, temporally hosted here until it moves to a repository of its own.What it does
credproviderpb.CredentialProviderover mTLS and admits only the egress gateway's identity (--injector-identity).ate-secret://secretmanager.googleapis.com/projects/<project>[/locations/<location>]/secrets/<secret>/versions/<version>[/keys/<key>]--project-policy-file), the counterpart of the Kubernetes provider's namespace policy.--fetch-timeout(default 3s).Repository changes
New top-level
plugins/directory for self-contained plugins, documented indocs/dev/code-layout.mdandAGENTS.md. The module imports only substrate's publicpkg/packages; a test enforces this.CI runs the module's tests,
make verifyand golangci-lint. govulncheck scans the module too, with the action pinned by SHA.docs/egress-credential-injection.mddescribes each provider's credential URI format. The plugin's README covers installing and using it.Tests pass
Appropriate changes to documentation are included in the PR