Google Cloud Secrets Manager

How to store secrets in GCP

This is an older version of the ZenML documentation. To read and view the latest version please visit this up-to-date URL.

The GCP secrets manager is a secrets manager flavor provided with the ZenML gcp integration that uses GCP to store secrets.

We are deprecating secrets managers in favor of the centralized ZenML secrets store. Going forward, we recommend using the secrets store instead of secrets managers to configure and store secrets.

If you already use secrets managers to manage your secrets, please use the provided zenml secrets-manager secrets migrate CLI command to migrate your secrets to the centralized secrets store.

To replace GCP Secrets Manager as the service of choice for managing your secrets in the cloud, configure your ZenML server to connect to and use the GCP Secrets Manager service directly as a back-end for the centralized secrets store and then use zenml secret CLI commands to manage your secrets instead of zenml secrets-manager secret CLI commands. You no longer need to register the GCP secrets manager stack component or add it to your active stack.

Alternatively, you may use any of the other secrets store back-ends that the ZenML server supports, such as AWS Secret Manager, Azure Key Vault, HashiCorp Vault, or even the ZenML SQL database.

When to use it

You should use the GCP secrets manager if:

• a component of your stack requires a secret for authentication, or you want to use secrets inside your steps.

• you're already using GCP, especially if your orchestrator is running in GCP. If you're using a different cloud provider, take a look at the other secrets manager flavors.

How to deploy it

In order to use the GCP secrets manager, you need to enable it here.

How to use it

To use the GCP secrets manager, we need:

• The ZenML gcp integration installed. If you haven't done so, run

  zenml integration install gcp

• The GCP CLI installed and authenticated.

• The ID of the project in which you want to store secrets. Follow this guide to find your project ID.

We can then register the secrets manager and use it in our active stack:

zenml secrets-manager register <NAME> \
    --flavor=gcp \
    --project_id=<PROJECT_ID>

# Add the secrets manager to the active stack
zenml stack update -x <NAME>

You can now register, update or delete secrets using the CLI or fetch secret values inside your steps.

You can use secret scoping with the GCP Secrets Manager to emulate multiple Secrets Manager namespaces on top of a single GCP project.

A concrete example of using the GCP secrets manager can be found here.

For more information and a full list of configurable attributes of the GCP secrets manager, check out the API Docs.