Google Cloud Secret Manager

GCP Secret Manager provides centralized secret management for Google Cloud workloads.

Quick start

# Enable Secret Manager API
gcloud services enable secretmanager.googleapis.com

Add these definitions to fnox.toml. Merge them into any existing tables with the same names:

[providers]
gcp = { type = "gcp-sm", project = "my-project-id", prefix = "myapp-" }

# Create secret
echo -n "postgresql://..." | gcloud secrets create myapp-database-url --data-file=-

Add these definitions to fnox.toml. Merge them into any existing tables with the same names:

[secrets]
DATABASE_URL = { provider = "gcp", value = "database-url" }

# Get secret
fnox get DATABASE_URL

Authentication

Choose one:

# gcloud CLI (development)
gcloud auth application-default login

# Service Account (CI/CD)
export GOOGLE_APPLICATION_CREDENTIALS="/path/to/key.json"

# Workload Identity (automatic on GKE)
# No configuration needed!

Permissions

Grant IAM permissions:

gcloud projects add-iam-policy-binding PROJECT-ID \
  --member="user:your-email@example.com" \
  --role="roles/secretmanager.secretAccessor"

Configuration

[providers]
gcp = { type = "gcp-sm", project = "my-project-id", prefix = "myapp-" }  # prefix is optional

Usage notes

The config stores a secret name in the selected project. The provider prefix is part of that name. Authentication uses Application Default Credentials; a separate gcloud CLI login is not always sufficient.

Next steps

• Google Cloud KMS - Encryption alternative
• AWS Secrets Manager - AWS equivalent