Use Secret Manager with other products

This topic provides resources for using Secret Manager with other Google Cloud services.

Cloud Build

Access Secret Manager secrets via environment variables in build steps on Cloud Build. See using Secret Manager secrets with Cloud Build for more information.

Cloud Code

Create, view, update, and use secrets within VS Code, IntelliJ, or Cloud Shell with Cloud Code's Secret Manager integration.

Cloud Functions

Access Secret Manager secrets and expose them as environment variables or via the filesystem from Cloud Functions. See using Secret Manager secrets with Cloud Functions for more information.

You can also use Secret Manager with Cloud Functions by using a Secret Manager client library or by accessing the Secret Manager API directly.

Cloud Run

Access Secret Manager secrets and expose them as environment variables or via the filesystem from Cloud Run services. See using Secret Manager secrets with Cloud Run for more information.

You can also use Secret Manager with Cloud Run services by using a Secret Manager client library or by accessing the Secret Manager API directly.

Compute Engine

Important: To use Secret Manager with workloads running on Compute Engine or Google Kubernetes Engine, the underlying instance or node must have the cloud-platform OAuth scope. See accessing the Secret Manager API for more information.

Use Secret Manager with workloads running on Compute Engine by using a Secret Manager client library or by accessing the Secret Manager API directly.

Google Kubernetes Engine

Important: To use Secret Manager with workloads running on Compute Engine or Google Kubernetes Engine, the underlying instance or node must have the cloud-platform OAuth scope. See accessing the Secret Manager API for more information.

Use Secret Manager with workloads running on Google Kubernetes Engine (GKE) with one of the following options.

• Workload Identity & client libraries - The recommended way to access Secret Manager secrets from workloads running on Google Kubernetes Engine is to use a Secret Manager client library authenticated via Workload Identity. See Secret Manager Best Practices for more information.

• Secrets Store CSI driver - Access Secret Manager secrets as files mounted in Kubernetes pods using the Google Cloud provider for the Secrets Store CSI driver project.

  Caution: The Secrets Store CSI Driver is a Kubernetes project developed and maintained as part of the #sig-auth Special Interest Group and is not officially supported by Google. Provide feedback and report issues related to the provider on the issue tracker.

Config Connector

Create and manage Secret Manager secrets with Config Connector using a declarative syntax. See the Secret Manager Config Connector resource documentation for more information.