Gunakan Cloud Shell Editor sebagai lingkungan Anda untuk membuat layanan dan secret Cloud Run. Editor telah dilengkapi dengan alat yang diperlukan untuk pengembangan
cloud.
Untuk membuat layanan Anda:
Di status bar Cloud Code, klik nama project aktif.
Di menu Pilih Cepat yang muncul, pilih Aplikasi Baru, lalu klik Aplikasi Cloud Run.
Dari daftar sampel Cloud Run, pilih Python (Flask): Cloud Run.
Pilih folder untuk sampel Anda, lalu klik Create New Application.
Setelah Cloud Shell Editor memuat layanan Anda di ruang kerja baru, lihat file-nya di
tampilan
explorer.
Membuat secret
Secret Manager memungkinkan Anda menyimpan, mengelola, dan mengakses secret dengan aman sebagai blob biner atau string teks.
Selain itu, layanan ini mengelola rahasia Anda, yang berarti Anda tidak perlu berurusan dengan mesin virtual atau layanan operasi.
Untuk membuat secret dengan integrasi Secret Manager Cloud Code:
Klik
Secret
Manager dan tunggu sebentar hingga dimuat.
Jika diminta untuk memberikan otorisasi pada Cloud Shell agar dapat melakukan panggilan Google Cloud API, klik Authorize.
Klik addCreate
Secret.
Jika diminta, pilih project Google Cloud Anda dari pemilih dropdown.
Jika diminta, aktifkan Secret Manager API.
Di tab Secret Manager - Create Secret yang muncul, masukkan
berikut di kolom Name:
my-secret
Di kolom Secret Value, masukkan:
Hello secret!
Klik Buat Secret dan pesan yang menyatakan bahwa secret Anda berhasil dibuat akan muncul.
Menambahkan secret ke kode Anda
Secret sangat cocok untuk menyimpan informasi konfigurasi seperti sandi database, kunci API, atau sertifikat TLS yang diperlukan oleh aplikasi saat runtime.
Untuk menambahkan rahasia ke kode Anda:
Buka tampilan
Cloud
API, lalu pilih
Secret Manager API.
Tindakan ini akan membuka tab Detail Google Cloud API dengan Secret Manager API sebagai
judul.
Di bagian Install Client Library, klik tab Python dan
klik play_arrowRun in terminal.
Perintah ini akan menginstal library klien google-cloud-secret-manager.
Buka
requirements.txt
dan tambahkan baris berikut ke bagian bawah file:
google-cloud-secret-manager==VERSION_NUMBER
Anda dapat menemukan nomor versi di konsol setelah menjalankan penginstalan pada langkah sebelumnya. Misalnya, konsol dapat menampilkan:
Successfully installed google-cloud-secret-manager-2.23.1
Perubahan yang Anda buat akan disimpan secara otomatis.
Untuk mendapatkan nilai terbaru secret Anda, buka
app.py
dan salin lalu tempel fungsi berikut:
setelah fungsi hello:
defaccess_secret_version(secret_version_id):"""Return the value of a secret's version"""fromgoogle.cloudimportsecretmanager# Create the Secret Manager client.client=secretmanager.SecretManagerServiceClient()# Access the secret version.response=client.access_secret_version(name=secret_version_id)# Return the decoded payload.returnresponse.payload.data.decode('UTF-8')
Untuk memanggil fungsi access_secret_version, ganti
variabel pesan
dengan yang berikut:
Jika Anda masih membuka tab Secret Manager - Create Secret,
file_copySalin ID.
Untuk mendapatkan ID versi rahasia kapan saja, buka
Secret
Manager > [SECRET_NAME] > Versions, arahkan
kursor ke versi Anda, lalu klik
Copy resource ID.
Untuk menambahkan ID versi, ganti placeholder
<SECRET_VERSION_ID>
dengan ID versi yang Anda salin.
Menjalankan di emulator Cloud Run
Untuk menguji secret baru, jalankan layanan Cloud Run Anda secara lokal di emulator Cloud Run.
Luncurkan menu
Cloud
Code dari status bar.
Untuk membangun dan men-deploy layanan Anda ke emulator, pilih
Run
on Cloud Run Emulator.
Di tab Run/Debug on Cloud Run Emulator yang muncul, klik
Run.
Saat menjalankan konfigurasi untuk pertama kalinya, proses ini dapat memerlukan waktu hingga 5 menit. Panel
Output
menampilkan progres saat aplikasi Anda di-build dan di-deploy.
Setelah aplikasi Anda di-build, luncurkan aplikasi dengan mengklik link localhost yang muncul di panel
Output. Nilai rahasia Anda ditampilkan di bawah grafik keberhasilan.
Melihat dan membuat versi secret baru
Tampilan Secret Manager Cloud Code memberi Anda gambaran sekilas tentang secret project Anda, dengan tindakan untuk mengelolanya.
Melihat nilai versi secret
Klik tampilan
Secret
Manager.
Luaskan rahasia Anda dengan mengkliknya.
Di folder Versions, klik kanan versi bernomor yang ingin Anda lihat nilainya, lalu pilih Show Version Value.
Perhatikan bahwa Anda tidak dapat mengedit versi rahasia. Untuk memperbarui nilai secret, Anda harus membuat versi baru.
Buat versi secret baru
Nilai rahasia disimpan dalam versi rahasia. Rahasia dapat memiliki banyak
versi. Hal ini berguna dalam situasi saat secret berubah. Memperbarui rahasia dengan versi baru berarti Anda tidak perlu memperbarui kode.
Klik tampilan
Secret
Manager.
Klik kanan nama secret Anda, lalu pilih Create Secret Version.
Di tab Secret Manager - Create Version yang muncul, masukkan nilai
baru, lalu klik Create Version.
Setelah tab Secret Manager - Create Secret terbuka, klik
file_copyCopy di bagian atas untuk menyalin ID.
Untuk menambahkan ID versi yang lebih baru, ganti versi saat ini yang muncul di variabel
pesan di
app.py
dengan ID versi yang lebih baru yang Anda salin.
Jika Anda selalu ingin kode Anda menggunakan versi terbaru, ganti nomor versi di akhir ID versi Anda dengan latest.
Melihat dan mengelola secret
Menonaktifkan versi secret
Versi secret diaktifkan secara default setelah dibuat, yang berarti versi secret dapat diakses. Secret yang dinonaktifkan tidak dapat diakses, tetapi Anda dapat memulihkan akses ke secret tersebut kapan saja.
Untuk menonaktifkan versi secret:
Klik Cloud Code, lalu luaskan bagian Secret Manager.
Luaskan rahasia Anda dengan mengkliknya.
Di folder Versi, klik kanan versi bernomor yang ingin Anda nonaktifkan.
Pilih Nonaktifkan Versi.
Menghancurkan versi secret
Saat Anda menghancurkan versi rahasia, versi tersebut tidak dapat diakses. Menghancurkan versi rahasia bersifat permanen.
Klik Cloud Code, lalu luaskan bagian Secret Manager.
Luaskan rahasia Anda dengan mengkliknya.
Di folder Versi, klik kanan versi yang ingin Anda hapus.
Pilih Hancurkan Versi.
Pembersihan
Untuk menghapus hanya cluster yang Anda buat untuk panduan memulai ini:
Klik Cloud Code, lalu luaskan bagian Kubernetes.
Arahkan kursor ke nama cluster Anda, lalu klik
open_in_newOpen in Google Cloud console.
Klik Delete, lalu klik Delete.
Untuk menghapus project Anda (dan resource terkait, termasuk cluster apa pun):
[[["Mudah dipahami","easyToUnderstand","thumb-up"],["Memecahkan masalah saya","solvedMyProblem","thumb-up"],["Lainnya","otherUp","thumb-up"]],[["Sulit dipahami","hardToUnderstand","thumb-down"],["Informasi atau kode contoh salah","incorrectInformationOrSampleCode","thumb-down"],["Informasi/contoh yang saya butuhkan tidak ada","missingTheInformationSamplesINeed","thumb-down"],["Masalah terjemahan","translationIssue","thumb-down"],["Lainnya","otherDown","thumb-down"]],["Terakhir diperbarui pada 2025-09-04 UTC."],[[["\u003cp\u003eThis guide explains how to use Cloud Code's Secret Manager integration to create, store, and manage secrets within your Google Cloud project.\u003c/p\u003e\n"],["\u003cp\u003eYou will learn how to create a secret, add it to your application code, and access its value at runtime using the Secret Manager API.\u003c/p\u003e\n"],["\u003cp\u003eThe guide demonstrates how to use the Cloud Run emulator to test your application locally after adding the secret, ensuring your secret is accessed correctly.\u003c/p\u003e\n"],["\u003cp\u003eYou can manage different versions of a secret, view their values, and disable or destroy specific secret versions as needed, allowing you to update your secrets without changing your code.\u003c/p\u003e\n"],["\u003cp\u003eInstructions are included on how to clean up resources by deleting either the cluster or the entire project created for this process, once you are done with the tutorial.\u003c/p\u003e\n"]]],[],null,["Learn how to create and manage secrets using Cloud Code's Secret Manager\nintegration.\n\n*** ** * ** ***\n\nTo follow step-by-step guidance for this task directly in the\nCloud Shell Editor, click **Guide me**:\n\n[Guide me](https://console.cloud.google.com/?walkthrough_id=shell--secret_manager_cloud_code_create_secret)\n\n*** ** * ** ***\n\nBefore you begin\n\n1. In the Google Cloud console, go to the project selector page.\n\n [Go to project selector](https://console.cloud.google.com/projectselector2/home/dashboard)\n2. Select or create a Google Cloud project.\n\n | **Note**: If you don't plan to keep the resources that you create in this procedure, create a project instead of selecting an existing project. After you finish these steps, you can delete the project, removing all resources associated with the project.\n\nCreate your Cloud Run service\n3. Use Cloud Shell Editor as your environment for creating your Cloud Run service and secret. The editor comes preloaded with the tools needed for cloud development.\n4. To create your service:\n 1. In the Cloud Code status bar, click the active project name.\n\n 2. In the Quick Pick menu that appears, select click **New Application** , and\n then click **Cloud Run Application**.\n\n 3. From the list of Cloud Run samples, select **Python (Flask): Cloud Run**.\n\n 4. Select a folder for your sample and then click **Create New Application**.\n\n5. After Cloud Shell Editor loads your service in a new workspace, view its files in the explorer view.\n\nCreate a secret\n6. [Secret Manager](https://cloud.google.com/secret-manager/) allows you to securely store, manage, and access secrets as binary blobs or text strings. Additionally, it manages your secrets, meaning you don't have to deal with virtual machines or operating services.\n7. To create a secret with Cloud Code's Secret Manager integration:\n 1. Click Secret Manager and give it a moment to load.\n 2. If prompted to authorize Cloud Shell to make Google Cloud API calls, click **Authorize**.\n 3. Click add Create Secret.\n 4. If prompted, select your Google Cloud project from the dropdown selector.\n 5. If prompted, enable the Secret Manager API.\n 6. In the **Secret Manager - Create Secret** tab that appears, enter the\n following in the **Name** field:\n\n my-secret\n\n 7. In the **Secret Value** field, enter:\n\n Hello secret!\n\n 8. Click **Create Secret** and a message that your secret was successfully\n created appears.\n\nAdd a secret to your code\n8. Secrets are great for storing configuration information such as database passwords, API keys, or TLS certificates needed by an application at runtime.\n9. To add a secret to your code:\n 1. Open the\n Cloud API view and select the\n Secret Manager API.\n\n This opens a Google Cloud API Detail tab with **Secret Manager API** as the\n heading.\n 2. In the **Install Client Library** section, click the **Python** tab and\n click play_arrow **Run in terminal** .\n This installs the `google-cloud-secret-manager` client library.\n\n 3. Open\n requirements.txt\n and add the following line to the bottom of the file:\n\n google-cloud-secret-manager==\u003cvar translate=\"no\"\u003eVERSION_NUMBER\u003c/var\u003e\n\n You can find the version number in the console after you run the\n installation in the previous step. For example, the console might show:\n `Successfully installed google-cloud-secret-manager-2.23.1`\n\n Your changes are automatically saved.\n 4. To get the latest value of your secret, open\n app.py\n and copy and paste the following function:\n after the hello function:\n\n def access_secret_version(secret_version_id):\n \"\"\"Return the value of a secret's version\"\"\"\n from google.cloud import secretmanager\n\n # Create the Secret Manager client.\n client = secretmanager.https://cloud.google.com/python/docs/reference/secretmanager/latest/google.cloud.secretmanager_v1.services.secret_manager_service.SecretManagerServiceClient.html()\n\n # Access the secret version.\n response = client.https://cloud.google.com/python/docs/reference/secretmanager/latest/google.cloud.secretmanager_v1.services.secret_manager_service.SecretManagerServiceClient.html#google_cloud_secretmanager_v1_services_secret_manager_service_SecretManagerServiceClient_access_secret_version(name=secret_version_id)\n\n # Return the decoded payload.\n return response.payload.data.decode('UTF-8')\n\n 5. To call the `access_secret_version` function, replace the\n message variable\n with the following:\n\n message = access_secret_version(\"\u003cSECRET_VERSION_ID\u003e\")\n\n 6. If you still have the **Secret Manager - Create Secret** tab open,\n file_copy **Copy** the ID.\n\n To get the ID of a secret version at any time, navigate to\n Secret Manager \\\u003e \\[SECRET_NAME\\] \\\u003e Versions, hold the\n pointer over over your version, and click\n\n **Copy resource ID**.\n 7. To add the version ID, replace the placeholder\n `\u003cSECRET_VERSION_ID\u003e`\n with your copied version ID.\n\nRun on Cloud Run emulator\n10. To test your new secret, run your Cloud Run service locally on the Cloud Run emulator.\n 1. Launch the Cloud Code menu from the status bar.\n 2. To build and deploy your service to the emulator, select **Run\n on Cloud Run Emulator**.\n 3. In the Run/Debug on Cloud Run Emulator tab that appears, click **Run**.\n 4. When running the configuration for the first time, this process can take up\n to 5 minutes. The\n **Output**\n panel displays the progress as your app is built and deployed.\n\n 5. After your app is built, launch your app by clicking the localhost link that\n appears in your\n **Output**\n panel. Your secret's value is displayed under the success graphic.\n\nView and create a new secret version\n11. Cloud Code's Secret Manager view gives you a quick look at your project's secrets, with actions for managing them.\n\nViewing the value of a secret version\n 1. Click the Secret Manager view.\n 2. Expand your secret by clicking on it.\n 3. In the **Versions** folder, right-click the numbered version that you want to view the value of and select **Show Version Value**.\n12. Note that you can't edit a secret version. To update a secret's value, you must create a new *version*.\n\nCreate a new secret version\n13. The value of a secret is stored in a secret version. A secret can have many versions. This is helpful in situations where a secret changes. Updating a secret with a new version means you don't have to update your code.\n 1. Click the Secret Manager view.\n 2. Right-click your secret's name and select **Create Secret Version**.\n 3. In the **Secret Manager - Create Version** tab that appears, enter a new value and click **Create Version**.\n 4. After the **Secret Manager - Create Secret** tab opens, click file_copy **Copy** top copy the ID.\n 5. To add the newer version ID, replace the current version that appears the message variable in app.py with the newer version ID that you copied.\n14. If you always want your code to use the latest version, replace the version number at the end of your version ID with `latest`.\n\nView and manage secrets\n\nDisable a secret version\n15. Secret versions are enabled by default after creation, meaning they can be accessed. A disabled secret is inaccessible, but you can always restore access to it at any time.\n16. To disable a secret version:\n 1. Click **Cloud Code** and then expand the **Secret Manager** section.\n 2. Expand your secret by clicking on it.\n 3. Under the **Versions** folder, right-click the numbered version you want to disable.\n 4. Select **Disable Version**.\n\nDestroy a secret version\n17. When you destroy a secret version, it can't be accessed. Destroying a secret version is permanent.\n 1. Click **Cloud Code** and then expand the **Secret Manager** section.\n 2. Expand your secret by clicking on it.\n 3. Under the **Versions** folder, right-click the version you want to destroy.\n 4. Select **Destroy Version**.\n\nCleaning up\n18. To delete just the cluster you created for this quickstart:\n 1. Click **Cloud Code** and then expand the **Kubernetes** section.\n 2. Hold the pointer over your cluster name and then click open_in_new **Open in Google Cloud console**.\n 3. Click **Delete** and then click **Delete**.\n19. To delete your project (and associated resources, including any clusters):\n 1. Go to the Projects page in the Google Cloud console:\n\n [Go to the Projects page](https://console.cloud.google.com/project)\n 2. Select the project that you created for this quickstart and then click\n **Delete**.\n\n 3. Type the project ID to confirm and then click **Shut down**.\n\n This shuts down the project and schedules it for deletion."]]
Cloud Code, lalu luaskan bagian Secret Manager.