google_cloud_env_secrets 0.1.1 → 1.0.2

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 90ac38d180204dec944c36ba57e7072e36e87dadbafee415fb864a25b0b24fcf
-  data.tar.gz: 8373386dd3089abdad83128d2bff2ca5ac2d8ff954389a1f6810d67f6aee883f
+  metadata.gz: 0f6fb0a3005e03c0be10f2e423f049ec2c103f44696f43eb47f62bdfc5d4a109
+  data.tar.gz: c2111c2c4a8819321a1875c46651a16d847b1f6fb9e20d6ea821ae136571a38c
 SHA512:
-  metadata.gz: 0c9f4cfb80145fc506d78949ec3053e3a16994443a8245176d120f2c4597619eef889f62dd8997a79cd9979610c0a43dddfc158b54be2e9d0aa298427fde58e4
-  data.tar.gz: 96d34802b6c79246c8252f96cd6635de3c1ee3d8ef55ccc993264f350488fa5449d6f57a3a272d14360b48f88e6d88b9e159c716f45319bd7ea000ad8c809f53
+  metadata.gz: 4a1a64482d17981bc421768820d5b07b40a5c6dd0a64c93b80f01bed0ae61b425a7938a2faf1b961b4401e25840d286dbd84ec191cb158d30a1902043a2b5722
+  data.tar.gz: 44d02eb848d40f9314d4d7fa4a16c2f57e1aa020b130d6843810b74245b11d5d96c6b2cc8c13651fd51b701c49068994ffc008a21b81dab6242c07733265853d

data/README.md

@@ -23,12 +23,20 @@ $ gem install google_cloud_env_secrets
 
 Configure this gem with environment vars:
 
-| Variable                         | Description                                                                                                                                                                                                                                          |
-|----------------------------------|--------------------------------------------------------------------|
-| `GOOGLE_APPLICATION_CREDENTIALS` | Manually set path to Google Application Credentials.               |
-| `GOOGLE_PROJECT`                 | Manually set the Google project. Automatically detected otherwise. |
-| `GOOGLE_SECRETS_PREFIX`          | Only load secrets that start with prefix.                          |
+| Variable                              | Description                                                                                                                                                                                                                                          |
+|---------------------------------------|--------------------------------------------------------------------|
+| `GOOGLE_APPLICATION_CREDENTIALS`      | Google Application Credentials, path or data (not base64 encoded). |
+| `GOOGLE_PROJECT`                      | Google project                                                     |
+| `GOOGLE_SECRETS_PREFIX`               | Only load secrets that start with given prefix.                    |
+| `GOOGLE_SECRETS_OVERLOAD`             | Replace existing ENV vars with secret's value. Default `true`.     |
 
+The `GOOGLE_APPLICATION_CREDENTIALS` and `GOOGLE_PROJECT` variables are both optional. If not given,
+we will detect them automatically, if run on Google Cloud.
+
+Google Secrets are available after the [before_configuration hook](https://guides.rubyonrails.org/configuring.html#initialization-events).
+You can call `GoogleCloudEnvSecrets.load` if you need the ENV secrets sooner than that.
+
+See [docs](https://www.rubydoc.info/github/mattes/rails_google_cloud_env_secrets/main), too.
 
 ## Required IAM Roles
 
@@ -36,3 +44,4 @@ Configure this gem with environment vars:
 Secret Manager Secret Accessor
 Secret Manager Viewer
 ```
+

data/lib/google_cloud_env_secrets/config.rb

@@ -1,12 +1,16 @@
+require "json"
+
 module GoogleCloudEnvSecrets
   class Configuration
     attr_accessor :project
     attr_accessor :credentials
     attr_accessor :cache_secrets
     attr_accessor :prefix
+    attr_accessor :overload
 
     def initialize
       @cache_secrets = true
+      @overload = true
     end
   end
 
@@ -18,4 +22,16 @@ module GoogleCloudEnvSecrets
     self.configuration ||= Configuration.new
     yield(configuration)
   end
+
+  def self.parse_project_from_credentials(credentials)
+    if File.exist?(credentials)
+      j = JSON.parse(File.read(credentials))
+      return j["project_id"]
+    else
+      j = JSON.parse(credentials)
+      return j["project_id"]
+    end
+  rescue
+    nil
+  end
 end

data/lib/google_cloud_env_secrets/railtie.rb

@@ -1,14 +1,29 @@
 module GoogleCloudEnvSecrets
   class Railtie < ::Rails::Railtie
-    initializer "google_cloud_env_secrets.initialize", after: :bootstrap_hook do |app|
-      GoogleCloudEnvSecrets.configure do |config|
-        config.credentials = ENV["GOOGLE_APPLICATION_CREDENTIALS"] || nil
-        config.project = ENV["GOOGLE_PROJECT"] || Google::Cloud.env.project_id
-        config.prefix = ENV["GOOGLE_SECRETS_PREFIX"] || nil
-      end
 
-      secrets = GoogleCloudEnvSecrets.all
-      GoogleCloudEnvSecrets.inject_env!(secrets)
+    # load Google Secrets during Rails `before_configuration` hook
+    config.before_configuration do
+      GoogleCloudEnvSecrets.load
+    end
+
+    rake_tasks do
+      load "tasks/google_cloud_env_secrets_tasks.rake"
     end
   end
+
+  # load Google Secrets into ENV
+  def self.load
+    GoogleCloudEnvSecrets.configure do |config|
+      config.credentials = ENV["GOOGLE_APPLICATION_CREDENTIALS"] || nil
+      config.project = ENV["GOOGLE_PROJECT"] || GoogleCloudEnvSecrets.parse_project_from_credentials(config.credentials) || Google::Cloud.env.project_id
+      config.prefix = ENV["GOOGLE_SECRETS_PREFIX"] || nil
+
+      if ENV.has_key?("GOOGLE_SECRETS_OVERLOAD")
+        config.overload = ENV["GOOGLE_SECRETS_OVERLOAD"]&.to_s&.downcase == "true"
+      end
+    end
+
+    secrets = GoogleCloudEnvSecrets.all
+    GoogleCloudEnvSecrets.inject_env!(secrets, GoogleCloudEnvSecrets.configuration.overload)
+  end
 end

data/lib/google_cloud_env_secrets/secrets.rb

@@ -2,10 +2,21 @@ module GoogleCloudEnvSecrets
   def self.all
     @secrets = nil unless self.configuration.cache_secrets
     @secrets ||= begin
+        # Skip if not running on Google Cloud and credentials are not set explicitly
+        if self.configuration.credentials.nil? && Google::Cloud.env.project_id.nil?
+          return {}
+        end
+
         # Configure and initialize
         # https://googleapis.dev/ruby/google-cloud-secret_manager/latest/Google/Cloud/SecretManager.html
         Google::Cloud::SecretManager.configure do |config|
-          config.credentials = self.configuration.credentials
+          if self.configuration.credentials
+            if File.exist?(self.configuration.credentials)
+              config.credentials = self.configuration.credentials # load by file
+            else
+              config.credentials = JSON.parse(self.configuration.credentials) # load data
+            end
+          end
         end
 
         client = Google::Cloud::SecretManager.secret_manager_service
@@ -38,17 +49,26 @@ module GoogleCloudEnvSecrets
 
         secrets
       end
-    @secrets
+
+    @secrets || {}
   end
 
   def self.find(name)
-    self.all # make sure we have the secrets loaded
-    @secrets[name.to_s]
+    self.all[name.to_s]
+  end
+
+  def self.exist?(name)
+    self.all.has_key?(name.to_s)
   end
 
-  def self.inject_env!(secrets = {})
+  def self.inject_env!(secrets = {}, overload = true, env = ENV)
     secrets.each do |name, value|
-      ENV[name.to_s] = value
+      name = name.to_s
+      if overload
+        env[name] = value
+      else
+        env[name] ||= value
+      end
     end
   end
 end

data/lib/google_cloud_env_secrets/version.rb

@@ -1,3 +1,3 @@
 module GoogleCloudEnvSecrets
-  VERSION = "0.1.1"
+  VERSION = "1.0.2"
 end

data/lib/tasks/google_cloud_env_secrets_tasks.rake

@@ -1,5 +1,9 @@
 desc "Fetch Google Cloud Secret"
 task :google_cloud_secret do
-  name = ARGV[1]
-  puts GoogleCloudEnvSecrets.find(name)
+  name = ENV["NAME"].strip
+
+  fail "#{name} not found" unless GoogleCloudEnvSecrets.exist?(name)
+
+  $stdout.sync = true
+  print GoogleCloudEnvSecrets.find(name)
 end

metadata

@@ -1,14 +1,14 @@
 --- !ruby/object:Gem::Specification
 name: google_cloud_env_secrets
 version: !ruby/object:Gem::Version
-  version: 0.1.1
+  version: 1.0.2
 platform: ruby
 authors:
 - Matthias Kadenbach
 autorequire: 
 bindir: bin
 cert_chain: []
-date: 2020-10-09 00:00:00.000000000 Z
+date: 2020-10-11 00:00:00.000000000 Z
 dependencies:
 - !ruby/object:Gem::Dependency
   name: rails