Berglas App Engine (Standard) Example - Go

This guide assumes you have followed the setup instructions in the README. Specifically, it is assumed that you have created a project, Cloud Storage bucket, and Cloud KMS key.

1. Make sure you are in the examples/appengine/go folder before continuing!

2. Export the environment variables for your configuration:

   Using Secret Manager storage:

   export PROJECT_ID=my-project
   

   Using Cloud Storage storage:

   export PROJECT_ID=my-project
   export BUCKET_ID=my-bucket
   export KMS_KEY=projects/${PROJECT_ID}/locations/global/keyRings/berglas/cryptoKeys/berglas-key
   

3. Enable the required services:

   gcloud services enable --project ${PROJECT_ID} \
     appengine.googleapis.com
   

4. Create two secrets using the berglas CLI (see README for installation instructions):

   Using Secret Manager storage:

   berglas create sm://${PROJECT_ID}/api-key "xxx-yyy-zzz"
   

   berglas create sm://${PROJECT_ID}/tls-key "=== BEGIN RSA PRIVATE KEY..."
   

   Using Cloud Storage storage:

   berglas create ${BUCKET_ID}/api-key "xxx-yyy-zzz" \
     --key ${KMS_KEY}
   

   berglas create ${BUCKET_ID}/tls-key "=== BEGIN RSA PRIVATE KEY..." \
     --key ${KMS_KEY}
   

5. Get the App Engine service account email:

   export SA_EMAIL=${PROJECT_ID}@appspot.gserviceaccount.com
   

6. Grant the service account access to the secrets:

   Using Secret Manager storage:

   berglas grant sm://${PROJECT_ID}/api-key --member serviceAccount:${SA_EMAIL}
   berglas grant sm://${PROJECT_ID}/tls-key --member serviceAccount:${SA_EMAIL}
   

   Using Google Cloud storage:

   berglas grant ${BUCKET_ID}/api-key --member serviceAccount:${SA_EMAIL}
   berglas grant ${BUCKET_ID}/tls-key --member serviceAccount:${SA_EMAIL}
   

7. Create environment:

   cat > env.yaml <<EOF
   env_variables:
     GO111MODULE: on
     API_KEY: berglas://${BUCKET_ID}/api-key
     TLS_KEY: berglas://${BUCKET_ID}/tls-key?destination=tempfile
   EOF
   

8. Deploy the app on GAE:

   gcloud app deploy \
     --project ${PROJECT_ID} \
     --quiet
   

9. Access the service:

   curl $(gcloud app services browse berglas-example-go --no-launch-browser --project ${PROJECT_ID} --format 'value(url)')
   

10. (Optional) Cleanup the deployment:

    gcloud app services delete berglas-example-go \
      --quiet \
      --project ${PROJECT_ID}
    

11. (Optional) Revoke access to the secrets:

    Using Secret Manager storage:

    berglas revoke sm://${PROJECT_ID}/api-key --member serviceAccount:${SA_EMAIL}
    berglas revoke sm://${PROJECT_ID}/tls-key --member serviceAccount:${SA_EMAIL}
    

    Using Cloud Storage storage:

    berglas revoke ${BUCKET_ID}/api-key --member serviceAccount:${SA_EMAIL}
    berglas revoke ${BUCKET_ID}/tls-key --member serviceAccount:${SA_EMAIL}