Add runtime option to associate secrets to functions

[taeold]

Google Cloud Functions (GCF) now have support for loading secrets stored in Secret Manager to securely access application secrets (e.g. Third party API keys) on function executions. See the [documentations(https://cloud.google.com/functions/docs/configuring/secrets) for more details.

We propose extending the function runtime option to associate secrets. Then, the secrets can be access as an environment once deployed to GCF:

import * as functions from "firebase-functions";

const helloSecret = functions
  .runWith({ 
    // Loads secret
    //   projects/{PROJECT}/secrets/MY_SECRET/versions/{current latest secret version}
    secrets: ['MY_SECRET']
  })
  .https
  .onRequest((res, req) => {
    req.send(`Shhhhh. Our secret: ${process.env.MY_SECRET}`);
  });

const helloSecretVersion = functions
  .runWith({ 
    // Loads secret
    //   projects/{PROJECT}/secrets/MY_SECRET/versions/3
    secrets: ['MY_SECRET@3']
  })
  .https
  .onRequest((res, req) => {
    req.send(`Shhhhh. Our secret: ${process.env.MY_SECRET}`);
  });


// Optionally provide the full resource name.
const helloSecretFullName = functions
  .runWith({ 
    secrets: [
      'projects/my-project/secrets/MY_SECRET', // as secret resource name
      'projects/my-project/secrets/ANOTHER_SECRET/versions/3', // or secret version resource name
    ] 
  })
  .onRequest((res, req) => {
    // Environment variable name is still the secret id.
    req.send(`Shhhhh. Our secret: ${process.env.MY_SECRET}`);
  });

[inlined]

This is where the fully qualified names/versions gets weird because we agreed elsewhere that we'd be setting key and not secret so that we could bind later. I guess we can, in this case, bind both and not bind secret in the params case?

[taeold]

Ah that's good point.

I've been thinking the opposite - that v1 Functions SDK will receive secret and the CLI will bind the env key using the secret name. With params context, having the option to later bind the secret makes sense.

Being restrictive here - to set both key and secret to the secret input is good and letting params be the one that only binds the secret makes more sense to me.