GCP Secret Manager

# This should match the prefix you entered in Doppler
SECRET_PREFIX="doppler-";

# Get current project
PROJECT_ID="$(gcloud config get-value project --quiet)";

# The IAM principal shown under "Federation Identity" on the Doppler connection page
PRINCIPAL="principal://iam.googleapis.com/projects/.../subject/workplace:...:connection:...";

# Attach SecretManagerAdmin policy to the Doppler principal, scoped to the prefix
gcloud projects add-iam-policy-binding $PROJECT_ID \
  --member="$PRINCIPAL" \
  --role="roles/secretmanager.admin" \
  --condition="expression=resource.name.extract(\"secrets/{rest}\").startsWith(\"$SECRET_PREFIX\"),title=\"$SECRET_PREFIX*\"";

# To narrow permission scope use this prefix for Doppler accessible secrets, adjust as desired
# This should match the prefix you enter in Doppler when setting up your integration
SECRET_PREFIX="doppler-";

# Get current project
PROJECT_ID="$(gcloud config get-value project --quiet)";

# Create a new Service Account
gcloud iam service-accounts create doppler-secret-manager \
  --description="Service account for Doppler to sync secrets to Secret Manager" \
  --display-name="Doppler Secret Manager";

# Attach SecretManagerAdmin policy to the new service account
gcloud projects add-iam-policy-binding $PROJECT_ID \
  --member="serviceAccount:doppler-secret-manager@$PROJECT_ID.iam.gserviceaccount.com" \
  --role="roles/secretmanager.admin" \
  --condition="expression=resource.name.extract(\"secrets/{rest}\").startsWith(\"$SECRET_PREFIX\"),title=\"$SECRET_PREFIX*\"";

# Generate a key for your new service account
gcloud iam service-accounts keys create iam-key.json \
  --iam-account="doppler-secret-manager@$PROJECT_ID.iam.gserviceaccount.com";

# Print (and then remove) the JSON credentials
cat iam-key.json && rm iam-key.json;

#!/bin/bash

# Check if jq is installed
if ! command -v jq &> /dev/null; then
    echo "jq could not be found, please install jq to process JSON data."
    exit 1
fi

# Check if gcloud is installed
if ! command -v gcloud &> /dev/null; then
    echo "gcloud could not be found, please install the Google Cloud CLI."
    exit 1
fi

# Check if doppler is installed
if ! command -v doppler &> /dev/null; then
    echo "doppler could not be found, please install the doppler CLI."
    exit 1
fi

# Configuration variables
gcp_project="${GCP_PROJECT}"
gcp_prefix="${GCP_PREFIX}"
doppler_project="${DOPPLER_PROJECT}"
doppler_config="${DOPPLER_CONFIG}"

date
echo "========================================"
echo "Initiating import from GCP to Doppler..."
echo "========================================"
echo "-------------- SOURCE ------------------"
echo "        GCP Project: $gcp_project"
echo "  GCP Secret Prefix: $gcp_prefix"
echo "------------ DESTINATION ---------------"
echo "  Doppler Project: $doppler_project"
echo "   Doppler Config: $doppler_config"
echo "----------------------------------------"
echo

# We're going to store all secrets in this variable in .env format. Note that we're not
# really doing any special character escaping with values, so be mindful of that if you
# have secrets that contain special characters or double-quotes.
secrets_to_import=""

# Iterate through all secrets in the specified GCP project that have the specified prefix in their name.
# Note that this filter is just looking for the prefix ANYWHERE in the name, it's not specifically limited
# to actually being a prefix.
for secret in $(gcloud secrets list --project $gcp_project --filter $gcp_prefix --format=json | jq -r '.[] | .name'); do
  # Extract the secret name from the last portion of the fully specified secret name
  secret_name=$(echo $secret | rev | cut -d'/' -f1 | rev)

  # Remove the prefix from the secret name
  secret_name=${secret_name//"$gcp_prefix"/}

  echo "fetching ${secret_name}..."
  # Fetch the secret value
  secret_value=$(gcloud secrets versions access --project $gcp_project "${secret}/versions/latest")

  # Append the secret to the result
  secrets_to_import="${secrets_to_import}\\n${secret_name}=\"${secret_value}\""
done

# Upload the secrets to the specified Doppler project and config
doppler secrets upload -p $doppler_project -c $doppler_config --silent <(echo -e "$secrets_to_import")

echo
date
echo "Import complete."