GCP kms encrypt env var and passing encrypted key through cloudbuild.yaml to google app engine

问题

I'm trying to encrypt env vars for database in Cloud SQL in my RoR app deploying to Google App Engine. Following this doc https://cloud.google.com/cloud-build/docs/securing-builds/use-encrypted-secrets-credentials

However, I have an error when running both gcloud builds submit and gcloud app deploy. Both are error out with:

Failure status: UNKNOWN: Error Response: [4] DEADLINE_EXCEEDED / build step 0 "gcr.io/cloud-builders/gcloud" failed: exit status 1.

I then check the gcloud builds described shows that the app failed to deploy, however, DATABASE_PASS shows working/queued. I have increase the Cloud Build component in gcloud sdk to 1000 and testing timeout: in cloudbuild.yaml; both options didn't improve anything.

Before using Cloud Build my app was working but I'm erasing the need of credentials and using encrypted credentials for CI/CD pipeline. Also, would like to encrypt more than one env var in my app.yaml.

 <cloudbuild.yaml>
steps:
- name: 'gcr.io/cloud-builders/gcloud'
  args: ['app','deploy','app-beta.yaml']

- name: 'us.gcr.io/project_ID/image_name'
  #args: [ 'app', 'deploy', 'app-beta.yaml' ]
  secretEnv: [ "DATABASE_PASS" ]


secrets:
- kmsKeyName: projects/Project_id/locations/global/keyRings/Misc/cryptoKeys/Random
  secretEnv: 
      DATABASE_PASS:< base64 encoded encryption> 

<app.yaml> 
runtime: custom

env: flex

service: authentication

resources:
  cpu: 2
  memory_gb: 2.5
  disk_size_gb: 10

beta_settings:
  cloud_sql_instances: '/cloudsql/project_id:us-central1:sqlname'

network:
  name: default

skip_files:
  - .ruby-gemset
  - .env
  - .bundle
  - .byebug_history
  - .vscode/
  - .idea/
  - storage/
  - vendor/
  - log/
  - tmp/

#liveness_check:
#path: '/liveness-check'
#   initial_delay_sec: 300
#   check_interval_sec: 30
#   timeout_sec: 4
#   failure_threshold: 2
#   success_threshold: 2
#
# readiness_check:
#   path: '/readiness-check'
#   check_interval_sec: 5
#   timeout_sec: 4
#   failure_threshold: 2
#   success_threshold: 2
#   app_start_timeout_sec: 300

env_variables:
  SECRET_KEY_BASE: 'SECRET_KEY'
  RAILS_ENV: 'redacted'
  RACK_ENV: 'redacted'
  SERVICE_NAME: 'redacted'
  REDIS_HOST: '10.0.0.3'
  REDIS_PORT: 6379
  TOTP_SECRET: 'TOTP_SECRET'
  DATABASE_USER: 'postgres'
  DATABASE_PASS: 'DATABASE_PASS'
  DATABASE_NAME: 'postgres'
  DATABASE_HOST: '/cloudsql/project_id:us-central1:sqlname'
  RAILS_LOG_TO_STDOUT: enabled
  RAILS_SERVE_STATIC_FILES: enabled
  LANG: en_US.UTF-8

回答1:

I found the problem, one was that when I used the gcloud kms encryption. I wasn't encrypting anything. So was passing in an empty value. I'll throw up my solution on a blog and hyperlink to it.

来源：https://stackoverflow.com/questions/54698445/gcp-kms-encrypt-env-var-and-passing-encrypted-key-through-cloudbuild-yaml-to-goo

标签

google-app-engine

google-cloud-platform

google-cloud-build

google-cloud-kms