CAS: Add support for GCP Secret Manager

[gr0]

Right now CAS provides support for AWS secret manager and Hashicorp Vault. It would be awesome to have support for GCP Secret Manager.

[migmartri]

hi @gr0 thanks for filling the issue.

I agree, this could be a great addition specially for those running Chainloop in GKE.

In case it helps. There is some sort of encapsulation already defined to achieve the addition of alternative backends, which long story short should be implementing this interface

chainloop/internal/credentials/credentials.go

Lines 32 to 44 in 90c6765

	type ReaderWriter interface {
	Reader
	Writer
	}
	type Writer interface {
	SaveCredentials(ctx context.Context, org string, credentials any) (string, error)
	DeleteCredentials(ctx context.Context, credID string) error
	}
	type Reader interface {
	ReadCredentials(ctx context.Context, secretName string, credentials any) error
	}

In addition to adding the backend to the credentials package, you'll need to a) add support to configuring (providing GCP auth) both at the ControlPlane and CAS i.e

chainloop/app/controlplane/internal/conf/conf.proto

Lines 94 to 98 in 90c6765

	message Credentials {
	oneof backend {
	AWSSecretManager aws_secret_manager = 1;
	Vault vault = 2;
	}

and b) bootstrap the new backend if needed as seen here

chainloop/app/controlplane/cmd/main.go

Line 160 in 90c6765

func newCredentialsWriter(conf *conf.Bootstrap, l log.Logger) (credentials.ReaderWriter, error) {

Let me know if this is smth you'd like to work on and I'll be happy to assign the issue to you :)

Thank you!

[migmartri]

I am reopening this issue to tackle the deployment part, that way the feature can be used end to end.

#134