feat(secrets): add GCP Secret Manager provider by markphelps · Pull Request #5404 · flipt-io/flipt

markphelps · 2026-02-18T22:01:44Z

Summary

Adds Google Cloud Secret Manager as a new secrets provider, following the same factory registration pattern as Vault
Supports Application Default Credentials (ADC) or explicit service account JSON credentials file
Configurable via secrets.providers.gcp with project (required) and credentials (optional) fields

Changes

internal/coss/secrets/gcp/provider.go: New provider with GetSecret, ListSecrets, and Close. Supports connecting to a GCP Secret Manager emulator via SECRET_MANAGER_EMULATOR_HOST env var for testing.
internal/coss/secrets/gcp/provider_test.go: Factory registration, interface compliance, and resource name tests
internal/config/secrets.go: Added GCPProviderConfig, validation, defaults, and EnabledProviders() support
internal/config/secrets_test.go: Config validation and enabled providers tests for GCP
internal/secrets/manager.go: GCP provider initialization block
cmd/flipt/main.go: Blank import for GCP provider registration
config/flipt.schema.cue / config/flipt.schema.json: Added gcp provider to both CUE and JSON schemas
go.mod / go.sum: Updated cloud.google.com/go/secretmanager dependency

Testing

Unit Tests

Config loader tests (internal/config/config_test.go): GCP provider YAML loading, GCP without credentials (ADC), missing project validation error, all three providers together. Each test runs against both YAML and ENV config sources.
Config validation tests (internal/config/secrets_test.go): GCP validate, all providers enabled, GCP disabled skips validation.
Manager tests (internal/secrets/manager_test.go): Manager creation with GCP provider, manager with all providers (file + vault + gcp), GCP factory not registered error, disabled GCP provider skipped.
Schema tests (config/): CUE and JSON schema validation against default config with GCP fields.

Integration Tests

signing/gcp (build/testing/integration.go): End-to-end Dagger integration test using blackwell-systems/gcp-secret-manager-emulator as an in-memory gRPC service. Generates a GPG signing key, stores it in the emulator via the real GCP SDK, then runs the signing test suite against Flipt configured with the GCP secrets provider.

CI Updates

Updated Dagger version from 0.18.19 to 0.19.11
Added DAGGER_NO_NAG=1 to suppress Dagger Cloud nag messages

Example Configuration

secrets:
  providers:
    gcp:
      enabled: true
      project: my-gcp-project
      credentials: /path/to/service-account.json  # optional, defaults to ADC

Secret references: ${secret:gcp:my-secret/value}

Add support for Google Cloud Secret Manager as a secrets provider, following the same factory registration pattern as the existing Vault provider. - Add GCPProviderConfig to config with project and credentials fields - Implement Provider with GetSecret, ListSecrets, and Close - Register provider factory via init() blank import - Add config validation and tests Signed-off-by: Mark Phelps <[email protected]>

codecov · 2026-02-18T22:43:06Z

Codecov Report

❌ Patch coverage is 24.00000% with 76 lines in your changes missing coverage. Please review.
✅ Project coverage is 60.39%. Comparing base (97186d0) to head (f81390f).
⚠️ Report is 1 commits behind head on v2.

Files with missing lines	Patch %	Lines
internal/coss/secrets/gcp/provider.go	14.45%	71 Missing ⚠️
internal/secrets/manager.go	63.63%	2 Missing and 2 partials ⚠️
internal/config/secrets.go	83.33%	1 Missing ⚠️

Additional details and impacted files

@@            Coverage Diff             @@
##               v2    #5404      +/-   ##
==========================================
+ Coverage   52.12%   60.39%   +8.26%     
==========================================
  Files         138      139       +1     
  Lines       13720    13820     +100     
==========================================
+ Hits         7152     8347    +1195     
+ Misses       5969     4763    -1206     
- Partials      599      710     +111

Flag	Coverage Δ
integrationtests	`34.11% <1.00%> (?)`
unittests	`51.96% <24.00%> (-0.17%)`	⬇️

Flags with carried forward coverage won't be shown. Click here to find out more.

☔ View full report in Codecov by Sentry.
📢 Have feedback on the report? Share it here.

🚀 New features to boost your workflow:

❄️ Test Analytics: Detect flaky tests, report on failures, and find test suite problems.
📦 JS Bundle Analysis: Save yourself from yourself by tracking and limiting bundle sizes in JS merges.

Add gcp secret provider configuration (enabled, project, credentials) to both schema files to fix schema validation tests. Signed-off-by: Mark Phelps <[email protected]>

- Add unit tests for GCP config loading, validation, and manager initialization - Add GCP Secret Manager integration test using blackwell-systems emulator - Add emulator support to GCP provider via SECRET_MANAGER_EMULATOR_HOST env var - Update Dagger version to 0.19.11 and suppress nag messages in CI Signed-off-by: Mark Phelps <[email protected]>

- Add tests for ${secret:gcp:key} reference resolution in walkConfigForSecrets - Add test for mixed providers (vault + file + gcp) in same config - Add GCP reference to secret_references.yml testdata - Add GCP secret reference case to env var expansion tests Signed-off-by: Mark Phelps <[email protected]>

…build folder Signed-off-by: Mark Phelps <[email protected]>

dosubot · 2026-02-19T12:57:39Z

Related Documentation

Checked 4 published document(s) in 1 knowledge base(s). No updates required.

^{How did I do? Any feedback?}

Copilot

Pull request overview

Adds Google Cloud Secret Manager as a new secrets provider (registered via factory pattern), including configuration/schema updates and test/integration coverage.

Changes:

Introduces a new gcp secrets provider implementation + factory registration.
Extends config structs, validation, enabled-provider tracking, and schemas to support secrets.providers.gcp.
Adds unit tests and a Dagger-based integration test path using a GCP Secret Manager emulator.

Reviewed changes

Copilot reviewed 27 out of 29 changed files in this pull request and generated 5 comments.

Show a summary per file

File	Description
internal/server/analytics/prometheus/prometheus_mock.go	Fixes import aliasing for Prometheus v1 API mock.
internal/secrets/manager_test.go	Adds manager tests for GCP provider enablement/registration behavior.
internal/secrets/manager.go	Initializes/registers GCP provider when enabled.
internal/coss/storage/environments/git/gitlab/gitlab_mock.go	Fixes import aliasing for GitLab client mock.
internal/coss/secrets/gcp/provider_test.go	Adds tests for GCP factory registration and basic behaviors.
internal/coss/secrets/gcp/provider.go	Implements GCP Secret Manager provider and registers factory.
internal/config/testdata/secrets/gcp_provider_no_credentials.yml	Adds config fixture for GCP provider using ADC (no credentials file).
internal/config/testdata/secrets/gcp_provider_missing_project.yml	Adds config fixture validating missing required `project`.
internal/config/testdata/secrets/gcp_provider.yml	Adds config fixture validating explicit credentials file.
internal/config/testdata/secrets/all_providers.yml	Adds config fixture enabling file+vault+gcp simultaneously.
internal/config/testdata/secret_references.yml	Updates secret reference example to explicitly use `gcp` provider.
internal/config/secrets_test.go	Adds validation and enabled-provider tests for GCP.
internal/config/secrets.go	Adds `GCPProviderConfig`, defaults, validation and EnabledProviders support.
internal/config/config_test.go	Adds config load tests covering GCP provider configs and references.
go.mod	Adds Secret Manager dependency and updates related Google deps.
go.sum	Updates checksums for new/updated dependencies.
dagger.json	Bumps Dagger engine version and adds caching configuration flag.
config/flipt.schema.json	Adds `secrets.providers.gcp` JSON schema.
config/flipt.schema.cue	Adds `secrets.providers.gcp` CUE schema and formatting adjustments.
cmd/flipt/main_test.go	Adds secret-walking tests for GCP provider references.
cmd/flipt/main.go	Adds blank import to register GCP provider factory.
build/testing/integration.go	Adds `signing/gcp` integration test using Secret Manager emulator.
build/go.mod	Updates build module deps (Dagger/grpc/gqlgen and related indirects).
build/go.sum	Updates build module sums (incl. Dagger/grpc/gqlgen).
build/CLAUDE.md	Renames doc title/content to be “AI Agents” guidance.
build/AGENTS.md	Adds a stub file pointing to `build/CLAUDE.md`.
AGENTS.md	Adds references to build/integration test structure.
.github/workflows/test.yml	Bumps Dagger version and sets `DAGGER_NO_NAG`.
.github/workflows/integration-test.yml	Bumps Dagger version and sets `DAGGER_NO_NAG`.

Comments suppressed due to low confidence (1)

build/AGENTS.md:1

build/AGENTS.md currently just contains a path string, which won’t behave like a redirect or symlink in most renderers and is confusing for readers. Either duplicate/move the actual content into build/AGENTS.md (and remove/replace build/CLAUDE.md), or make this a real symlink if the repo/tooling supports it.

💡 Add Copilot custom instructions for smarter, more guided reviews. Learn how to get started.

- Use WithEndpoint/WithoutAuthentication instead of WithGRPCConn for emulator connections to avoid connection ownership issues - Extract secretVersionName/secretParent helpers and test them directly - Add require.True check for factory existence in TestFactory_MissingConfig - Pin GCP Secret Manager emulator to v1.3.0 for reproducible builds Signed-off-by: Mark Phelps <[email protected]>

Add optional `location` config field to the GCP provider. When set, the provider uses the regional endpoint and location-scoped resource names (projects/{project}/locations/{location}/secrets/...). Also includes .gitignore update for docs/plans. Signed-off-by: Mark Phelps <[email protected]>

- Use pre-built emulator Docker image instead of building from source - Replace deprecated WithCredentialsFile with WithAuthCredentialsFile Signed-off-by: Mark Phelps <[email protected]>

erka

nice

markphelps added the v2 Flipt v2 label Feb 18, 2026

github-project-automation Bot added this to Flipt V2 Feb 18, 2026

markphelps added 4 commits February 18, 2026 18:33

feat(secrets): add GCP provider to CUE and JSON schemas

82406e7

Add gcp secret provider configuration (enabled, project, credentials) to both schema files to fix schema validation tests. Signed-off-by: Mark Phelps <[email protected]>

chore: fix lint issue; update claude instructions, symlink AGENTS in …

dee250e

…build folder Signed-off-by: Mark Phelps <[email protected]>

markphelps marked this pull request as ready for review February 19, 2026 12:54

markphelps requested a review from a team as a code owner February 19, 2026 12:54

dosubot Bot added the size:XL This PR changes 500-999 lines, ignoring generated files. label Feb 19, 2026

markphelps requested review from Copilot and removed request for a team February 19, 2026 12:55

Copilot AI reviewed Feb 19, 2026

View reviewed changes

Comment thread internal/coss/secrets/gcp/provider.go Outdated

Comment thread build/testing/integration.go

Comment thread internal/coss/secrets/gcp/provider_test.go

Comment thread internal/coss/secrets/gcp/provider_test.go

Comment thread build/testing/integration.go Outdated

markphelps added 2 commits February 19, 2026 08:14

markphelps requested a review from erka February 19, 2026 14:34

erka reviewed Feb 19, 2026

View reviewed changes

Comment thread build/testing/integration.go Outdated

erka reviewed Feb 19, 2026

View reviewed changes

Comment thread internal/coss/secrets/gcp/provider.go Outdated

fix(secrets): address Erka's review feedback on GCP provider

f81390f

- Use pre-built emulator Docker image instead of building from source - Replace deprecated WithCredentialsFile with WithAuthCredentialsFile Signed-off-by: Mark Phelps <[email protected]>

markphelps requested a review from erka February 19, 2026 15:49

erka approved these changes Feb 19, 2026

View reviewed changes

markphelps added the needs docs Requires documentation updates label Feb 19, 2026

flipt-release-bot Bot mentioned this pull request Feb 19, 2026

Document: feat(secrets): add GCP Secret Manager provider flipt-io/docs#390

Closed

markphelps merged commit 0b24646 into v2 Feb 19, 2026
30 of 31 checks passed

markphelps deleted the feat/gcp-secret-manager branch February 19, 2026 16:16

github-project-automation Bot moved this to Done in Flipt V2 Feb 19, 2026

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Uh oh!

Uh oh!

feat(secrets): add GCP Secret Manager provider#5404

feat(secrets): add GCP Secret Manager provider#5404
markphelps merged 8 commits into
v2from
feat/gcp-secret-manager

markphelps commented Feb 18, 2026 •

edited

Loading

Uh oh!

codecov Bot commented Feb 18, 2026 •

edited

Loading

Uh oh!

dosubot Bot commented Feb 19, 2026 •

edited

Loading

Uh oh!

Copilot AI left a comment

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

erka left a comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

Uh oh!

Uh oh!

Conversation

markphelps commented Feb 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Summary

Changes

Testing

Unit Tests

Integration Tests

CI Updates

Example Configuration

Uh oh!

codecov Bot commented Feb 18, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Codecov Report

Uh oh!

dosubot Bot commented Feb 19, 2026 • edited Loading Uh oh! There was an error while loading. Please reload this page.

Uh oh!

Uh oh!

Copilot AI left a comment

Choose a reason for hiding this comment

Pull request overview

Reviewed changes

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

Uh oh!

erka left a comment

Choose a reason for hiding this comment

Uh oh!

Uh oh!

Reviewers

Assignees

Labels

Projects

Milestone

Development

Uh oh!

3 participants

markphelps commented Feb 18, 2026 •

edited

Loading

codecov Bot commented Feb 18, 2026 •

edited

Loading

dosubot Bot commented Feb 19, 2026 •

edited

Loading