google_cloudfunctions_function -> support secrets

[lwsanty]

Community Note

• Please vote on this issue by adding a 👍 reaction to the original issue to help the community and maintainers prioritize this request
• Please do not leave "+1" or "me too" comments, they generate extra noise for issue followers and do not help prioritize the request
• If you are interested in working on this issue or have submitted a pull request, please leave a comment. If the issue is assigned to the "modular-magician" user, it is either in the process of being autogenerated, or is planned to be autogenerated soon. If the issue is assigned to a user, that user is claiming responsibility for the issue. If the issue is assigned to "hashibot", a community member has claimed the issue already.

Description

I see that provider supports Cloud Run creation with secret environment variables, see example.

I see that Cloud Functions natively support secrets, see documentation.

But, according to providers documentation cloudfunctions_function does not have a secrets support.

New or Affected Resource(s)

• cloudfunctions_function

Potential Terraform Configuration

# Propose what you think the configuration to take advantage of this feature should look like.
# We may not use it verbatim, but it's helpful in understanding your intent.

data "google_project" "project" {
  provider = google-beta
}

resource "google_secret_manager_secret" "secret" {
  provider = google-beta

  secret_id = "secret"
  replication {
    automatic = true
  }
}

resource "google_secret_manager_secret_version" "secret-version-data" {
  provider = google-beta

  secret = google_secret_manager_secret.secret.name
  secret_data = "secret-data"
}

resource "google_secret_manager_secret_iam_member" "secret-access" {
  provider = google-beta

  secret_id = google_secret_manager_secret.secret.id
  role      = "roles/secretmanager.secretAccessor"
  member    = "serviceAccount:${data.google_project.project.number}[email protected]"
  depends_on = [google_secret_manager_secret.secret]
}

resource "google_cloudfunctions_function" "function" {
  provider = google-beta

  name        = "function"
  entry_point = "TheFunc"
  event_trigger {
    event_type = "google.pubsub.topic.publish"
    resource   = "projects/${var.google_project}/topics/${var.topic}"
    failure_policy {
      retry = false
    }
  }
  runtime               = var.runtime
  service_account_email = var.google_service_account
  region                = var.google_region_global
  source_archive_bucket = var.sources_bucket
  source_archive_object = var.source
  vpc_connector         = var.vpc_connector
  labels = {
    environment = var.namespace
  }

  env {
    name = "SECRET_ENV_VAR"
    value_from {
      secret_key_ref {
        name = google_secret_manager_secret.secret.secret_id
        key = "1"
      }
    }
  }
}

References

• https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/cloud_run_service#example-usage---cloud-run-service-secret-environment-variables
• https://registry.terraform.io/providers/hashicorp/google/latest/docs/resources/cloudfunctions_function
• https://cloud.google.com/functions/docs/configuring/secrets

[slevenick]

Closing as duplicate of #9946

[github-actions]

I'm going to lock this issue because it has been closed for 30 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.