Repository navigation
Move non-sensitive runtime configuration out of Secret Manager - #3
Merged
Merged
Conversation
|
Important
This repository does not receive automatic reviews because it has fewer than 10 stars. ⚙️ Run configuration
Thanks for using CodeRabbit! It's free for OSS, and your support helps us grow. If you like it, consider giving us a shout-out. Comment |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Ordinary application configuration is currently stored as billable Secret Manager versions. This changes NOTE_GOOGLE_CLIENT_ID and NOTE_GOOGLE_CALLBACK_URI to ordinary Cloud Run environment values while preserving passwords, connection strings, session keys, and other existing runtime settings.
The deployment reads the current service configuration, resolves only the allowlisted legacy configuration references, and replaces them atomically alongside the new image. Values are neither committed nor printed. Later deployments preserve the ordinary values without accessing the retired secrets. The workflow verifies revision readiness, 100% traffic, and the deployed environment.
Validation: seven migration tests pass locally; workflow YAML and git diff checks pass. Pull requests run the migration tests without deploying.
Rollout: the existing service must exist and the deployment identity needs access to the selected configuration versions for the initial migration. Access failure stops before deployment. Only after this PR is merged, the deployment succeeds, and other live consumers are checked should the corresponding GCP secrets be deleted. Previous revisions referencing the retired secrets are not safe rollback targets after deletion.