TT-17624: Add GCP provider

[vladzabolotnyi]

Description

Ticket: https://tyktech.atlassian.net/browse/TT-17624

The change introduces a provider for GCP secret manager. The provider supports multiple auth options, SA impersonation and external account.

Related Issue

Motivation and Context

Test Coverage For This Change

DEMOS

1. Showing the GCP is working only with ee build tag and value is resolved with authorized_user creds type.

Screen.Recording.2026-07-22.at.11.59.57.mov

2. Showing the GCP is working with ADC, Service Accounts with providing JSON or File

Screen.Recording.2026-07-22.at.12.11.20.mov

3. The SA Impersonation is working

Screen.Recording.2026-07-22.at.12.21.59.mov

4. Field extraction is working if stored secret has JSON format

Screen.Recording.2026-07-22.at.12.27.03.mov

5. Provider resolves value with different versions

Screen.Recording.2026-07-22.at.12.29.06.mov

6. Set is creating a new secret if key not exist or add the new version with value otherwise

GCP.Set.method.mov

7. Workload Identity Federation with External account. The gateway wasn't deployed on AWS but we used real AWS credentials to setup WIF on GCP. The resolution and api communication between cloud providers will be the same as when gateway is deployed on AWS. This test wasn't mandatory because its handled by SDK and KV library is only responsible for creds validation but its always better to be sure.

Screen.Recording.2026-07-22.at.15.51.59.mov

Types of changes

• Bug fix (non-breaking change which fixes an issue)
• New feature (non-breaking change which adds functionality)
• Breaking change (fix or feature that would cause existing functionality to change)
• Refactoring or add test (improvements in base code or adds test coverage to functionality)
• Documentation updates or improvements.

Checklist

• I have reviewed the guidelines for contributing to this repository.
• Make sure you are requesting to pull a topic/feature/bugfix branch (right side). If PRing from your fork, don't come from your master!
• Make sure you are making a pull request against our master branch (left side). Also, it would be best if you started your change off our latest master.
• My change requires a change to the documentation.
  • I have manually updated the README(s)/documentation accordingly.
  • If you've changed APIs, describe what needs to be updated in the documentation.
• I have updated the documentation accordingly.
• Modules and vendor dependencies have been updated; run go mod tidy && go mod vendor
• When updating library version must provide reason/explanation for this update.
• I have added tests to cover my changes.
• All new and existing tests passed.
• Check your code additions will not fail linting checks:
  • gofmt -s -w .
  • go vet ./...

Ticket Details

TT-17624

Status	Merge
Summary	Implement GCP KV provider

Generated at: 2026-08-05 09:34:50

[github-actions]

CLA Assistant Lite bot:
Thank you for your submission, we really appreciate it. Like many open-source projects, we ask that you all sign our Contributor License Agreement before we can accept your contribution. You can sign the CLA by just posting a Pull Request Comment same as the below format.

---

I have read the CLA Document and I hereby sign the CLA

---

1 out of 2 committers have signed the CLA.
✅ @imogenkraak
❌ @vladzabolotnyi
_{You can retrigger this bot by commenting recheck in this Pull Request}

[probelabs]

This PR introduces a provider for Google Cloud Platform (GCP) Secret Manager, enabling its use as a key-value (KV) store backend. The implementation supports a wide range of authentication methods, including Application Default Credentials (ADC), service account keys, Workload Identity Federation, and service account impersonation. The provider implements Get for retrieving secrets and Set for creating or updating them, with logic to automatically create the secret container on the first write. A notable addition is a fake in-memory gRPC server for robust, isolated testing of the provider's logic.

Files Changed Analysis

• go.mod, go.sum: Adds new dependencies for the official GCP client libraries (cloud.google.com/go/secretmanager, cloud.google.com/go/auth).
• kv/providers/gcp/ (new package): This new package encapsulates all logic for the GCP provider.
  • config.go: Defines the Config struct and the NewFactory function. It is responsible for parsing and performing exhaustive validation of the provider's configuration, including security checks for Workload Identity Federation (external_account) credentials to prevent SSRF and RCE vectors.
  • gcp.go: Contains the core implementation of the gcpProvider, which implements the kv.Setter, kv.Initializer, kv.Timeouter, and kv.Closer interfaces. It handles interaction with the GCP Secret Manager API, including data integrity checks via CRC32C checksums and mapping gRPC status codes to kv error types.
  • doc.go: Provides package-level documentation.
  • fake_test.go: Implements a fake in-memory gRPC server that simulates the Secret Manager API, enabling fast and reliable hermetic testing.
  • gcp_internal_test.go, gcp_test.go: A comprehensive suite of new tests covering configuration parsing, client lifecycle, Get/Set functionality, and internal logic, all leveraging the fake gRPC server.

Architecture & Impact Assessment

• What this PR accomplishes: It integrates GCP Secret Manager as a new, fully-featured backend for the kv storage abstraction, providing users with another option for secure secret management within GCP environments.
• Key technical changes introduced:
  • A new gcpProvider that supports reading and writing secrets, adhering to the existing provider interfaces.
  • The Set method correctly handles the two-step process of creating a secret container if it doesn't exist and then adding a new version. It is also resilient to race conditions where another process creates the secret simultaneously.
  • A fake in-memory gRPC server (fake_test.go) is introduced for hermetic testing, which is a significant improvement for test reliability.
• Affected system components: This is an additive change encapsulated within the kv/providers/gcp package. It expands the capabilities of any system component that relies on the kv.Provider interface by making a new storage backend available. Existing providers are unaffected.

graph TD
    subgraph Application
        Service["Service using KV Store"]
    end

    subgraph "KV Abstraction"
        ProviderFactory["kv.ProviderFactory"]
        ProviderInterface["kv.Provider"]
    end

    subgraph "KV Providers"
        style GCPProvider fill:#d2e5ff,stroke:#333,stroke-width:2px
        GCPProvider["gcp.gcpProvider (New)"]
        ExistingProviders["... (Existing Providers)"]
    end

    subgraph "External Services"
        GCPSecretManager["GCP Secret Manager API"]
    end

    Service --> ProviderFactory
    ProviderFactory -- Creates --> ProviderInterface
    ProviderInterface -- Implemented by --> GCPProvider
    ProviderInterface -- Implemented by --> ExistingProviders
    GCPProvider -- Interacts with --> GCPSecretManager

Loading

Scope Discovery & Context Expansion

• The scope of this PR is to deliver a complete, production-ready GCP Secret Manager provider. The implementation is self-contained within the new kv/providers/gcp package.
• The provider is designed with a strong focus on security and robustness, evident from the detailed configuration validation in config.go (especially for external_account), support for multiple authentication patterns, and data integrity checks.
• To utilize this new provider, consumers of the kv abstraction will need to update their configurations to specify gcp as the provider type and supply the necessary project ID and authentication details. The immediate next steps would involve updating user documentation and potentially deployment configurations to support this new backend.

Metadata

• Review Effort: 4 / 5
• Primary Label: feature

---

Powered by Visor from Probelabs

Last updated: 2026-08-05T09:36:20.853Z | Triggered by: pr_updated | Commit: af09c0a

💡 TIP: You can chat with Visor using /visor ask <your question>

[probelabs]

✅ Security Check Passed

No security issues found – changes LGTM.

✅ Security Check Passed

No security issues found – changes LGTM.

\n\n

✅ Architecture Check Passed

No architecture issues found – changes LGTM.

✅ Performance Check Passed

No performance issues found – changes LGTM.

Quality Issues (1)

Severity	Location	Issue
🟡 Warning	kv/providers/gcp/gcp.go:342	The `classify` function maps `PermissionDenied` and `Unauthenticated` gRPC status codes to `kv.StoreUnavailableError` via the default case. This error type implies a transient failure suitable for retries. However, authentication and authorization errors often stem from persistent misconfigurations (e.g., incorrect IAM roles) rather than temporary service unavailability. Classifying them as transient may lead to unnecessary retries, potentially delaying the surfacing of a clear configuration error to the user. 💡 Suggestion Consider mapping `PermissionDenied` and `Unauthenticated` to a distinct, non-transient error type, similar to how `FailedPrecondition` and `InvalidArgument` are handled. This would provide a more accurate and immediate signal for configuration issues, improving debuggability. func (gp *gcpProvider) classify(key string, err error) error { switch status.Code(err) { case codes.NotFound: return &kv.KeyNotFoundError{KeyPath: key} case codes.FailedPrecondition: return fmt.Errorf("gcp: secret version disabled or destroyed for %q: %w", key, err) case codes.InvalidArgument: return fmt.Errorf("gcp: invalid secret request for %q: %w", key, err) case codes.PermissionDenied: return fmt.Errorf("gcp: permission denied for %q: %w", key, err) case codes.Unauthenticated: return fmt.Errorf("gcp: unauthenticated for %q: %w", key, err) default: return &kv.StoreUnavailableError{KeyPath: key, Err: err} } }

---

Powered by Visor from Probelabs

Last updated: 2026-08-05T09:35:49.311Z | Triggered by: pr_updated | Commit: af09c0a

💡 TIP: You can chat with Visor using /visor ask <your question>

[vladzabolotnyi]

/visor

The CredentialsFile configuration field is used to read a file from the filesystem (e.g., in helpers.go's validateExternalAccount) without prior validation. If an attacker can control this configuration value, they could specify a path with traversal sequences (e.g., ../..) to read arbitrary files from the server's filesystem, limited by the application's permissions. This could lead to sensitive information disclosure.

Its false positive because the person who controls the value of credentials_file controls the whole machine where app is running.

[probelabs]

---

Powered by Visor from Probelabs

Last updated: 2026-07-21T12:43:56.391Z | Triggered by: vladzabolotnyi | Commit: 4aafcfc

💡 TIP: You can chat with Visor using /visor ask <your question>

[vladzabolotnyi]

⚠️ PR doesn't introduce new sonarqube issues but inherits them from parent. They're going to be fixed in one parent PR.

[mativm02]

LGTM

[vladzabolotnyi]

recheck

[sonarqubecloud]

Quality Gate passed

Issues
0 New issues
0 Accepted issues

Measures
0 Security Hotspots
93.8% Coverage on New Code
0.0% Duplication on New Code

See analysis details on SonarQube Cloud