@secret-kernel/provider-gcp-secret-manager

GCP Secret Manager provider for Secret Kernel.

npm install @secret-kernel/contracts @secret-kernel/provider-gcp-secret-manager

Usage

import { createGcpSecretManagerClient } from '@secret-kernel/provider-gcp-secret-manager';

const client = createGcpSecretManagerClient(
  {
    env: 'prod',
    prefix: 'app',
  },
  {
    projectId: 'my-project',
  },
);

const secret = await client.getSecret('database/password');

The provider reads the latest secret version from GCP Secret Manager through the shared Secret Kernel client contract.

Options

• projectId: GCP project ID.
• credentials: explicit Google credentials. When omitted, the Google SDK default authentication flow is used.
• client: custom Secret Manager-compatible client.
• clientOptions: extra options passed to the Google SDK client.
• physicalNameSeparator: separator used when mapping logical / path segments to the GCP secret ID. Supported values are _ and -. Default: _.
• resolveName: custom logical-to-physical name resolver.

By default, the provider maps the logical Secret Kernel name to a GCP secret ID by removing leading / characters and replacing remaining / separators with _.

Example: /dev/app/database becomes dev_app_database.

With physicalNameSeparator: '-', /dev/app/database becomes dev-app-database.