Tooark.Secrets.Gcp 4.7.0

.NET 8.0 This package targets .NET 8.0. The package is compatible with this framework or higher. 
dotnet add package Tooark.Secrets.Gcp --version 4.7.0
                    


                    

                
NuGet\Install-Package Tooark.Secrets.Gcp -Version 4.7.0
This command is intended to be used within the Package Manager Console in Visual Studio, as it uses the NuGet module's version of Install-Package. 
<PackageReference Include="Tooark.Secrets.Gcp" Version="4.7.0" />
For projects that support PackageReference, copy this XML node into the project file to reference the package. 
<PackageVersion Include="Tooark.Secrets.Gcp" Version="4.7.0" />
                    


                            Directory.Packages.props
                        

                    

                
<PackageReference Include="Tooark.Secrets.Gcp" />
                    


                            Project file
For projects that support Central Package Management (CPM), copy this XML node into the solution Directory.Packages.props file to version the package. 
paket add Tooark.Secrets.Gcp --version 4.7.0
                    


                    

                
#r "nuget: Tooark.Secrets.Gcp, 4.7.0"
#r directive can be used in F# Interactive and Polyglot Notebooks. Copy this into the interactive tool or source code of the script to reference the package. 
#:package Tooark.Secrets.Gcp@4.7.0
#:package directive can be used in C# file-based apps starting in .NET 10 preview 4. Copy this into a .cs file before any lines of code to reference the package. 
#addin nuget:?package=Tooark.Secrets.Gcp&version=4.7.0
                    


                            Install as a Cake Addin
                        

                    

                
#tool nuget:?package=Tooark.Secrets.Gcp&version=4.7.0
                    


                            Install as a Cake Tool

Tooark.Secrets.Gcp

Tooark.Secrets provider on Google Cloud: it loads Secret Manager secrets and Parameter Manager parameters into IConfiguration, and implements ISecretService on Secret Manager.

The model, the common options and the conversion of names into keys are in the Tooark.Secrets README. This README covers what is specific to Google Cloud.

🌍 Languages: πŸ‡ΊπŸ‡Έ English (this file) Β· πŸ‡§πŸ‡· PortuguΓͺs

πŸ“‘ Contents

πŸ”§ Installation

dotnet add package Tooark.Secrets.Gcp

βš™οΈ Configuration

appsettings.json

{
  "Secrets": {
    "ProjectId": "arkuest",
    "SecretsPrefix": "arkuest-prod",
    "ParametersPrefix": "arkuest-prod"
  }
}

Program.cs

using Tooark.Secrets.Gcp.Injections;

// Secrets and parameters in the configuration, on top of appsettings.json
builder.Configuration.AddTooarkSecretsGcp();

// Runtime secret reads, with cache
builder.Services.AddTooarkSecretsGcp(builder.Configuration);

The IConfigurationBuilder AddTooarkSecretsGcp requires SecretsPrefix, ParametersPrefix or both. The IServiceCollection one registers ISecretService; the Secret Manager client is created on first use, and a SecretManagerServiceClient already registered by the application is used instead.

GcpSecretsOptions properties

Besides the common options:

Property Type Default Description
ProjectId string? β€” Google Cloud project holding the secrets and parameters. Required
SecretsPrefix string? β€” Name prefix of the Secret Manager secrets that become configuration
ParametersPrefix string? β€” Name prefix of the Parameter Manager parameters (global location) that become configuration

The credential always comes from Application Default Credentials: the Cloud Run, GKE or Compute Engine service account, the GOOGLE_APPLICATION_CREDENTIALS variable, or gcloud auth application-default login in development. There is no key in the options: the store credential cannot come from the store.

Names with a double underscore

Google only accepts letters, digits, _ and - in names, so levels use __:

Secret or parameter Key
arkuest-prod__Jwt__Secret Jwt:Secret
arkuest-prod__Storage__CredentialsJson Storage:CredentialsJson
arkuest-prod__OpenId__Entra__ClientSecret OpenId:Entra:ClientSecret
arkuest-prod, with ExpandJson the keys of the JSON document

πŸ”‘ Permissions

The application's identity needs:

Role or permission For
roles/secretmanager.viewer on the project Listing the prefix's secrets
roles/secretmanager.secretAccessor on the secrets Reading the secrets and ISecretService
Listing parameters, listing and rendering versions Loading the Parameter Manager parameters

A parameter that references Secret Manager secrets is rendered with the parameter's own identity, which needs to read those secrets.

🟦 Behavior on Google Cloud

  • Secret Manager β€” the latest version of each secret applies. A secret without an enabled version is skipped.
  • Parameter Manager β€” the most recently created enabled version applies, because Parameter Manager has no latest alias. The version is rendered: references to Secret Manager secrets arrive resolved. Only the global location is read.
  • JSON parameter β€” with ExpandJson, a parameter in JSON format becomes several keys. YAML parameters arrive as text.
  • Same name β€” with the same name in a secret and a parameter, the secret wins.
  • ISecretService β€” the name is the secret's identifier in the options' project; a missing secret returns null.

πŸ“‹ Dependencies

Package Version Description
Tooark.Secrets 4.x Model and configuration source
Google.Cloud.SecretManager.V1 2.x Secret Manager client
Google.Cloud.ParameterManager.V1 1.x Parameter Manager client
Microsoft.Extensions.DependencyInjection.Abstractions 8.x/10.x Container registration

⚠️ Error Codes and Solutions

The common errors are in the Tooark.Secrets README. A failure to load the source arrives as Secrets.LoadFailed;Google Cloud, with the Google error in InnerException.

Message Description Solution
Options.Secrets.Gcp.ProjectIdNotConfigured Missing ProjectId Configure Secrets:ProjectId
Options.Secrets.Gcp.CredentialsUnavailable No Application Default Credentials in the environment Run with a service account or configure local ADC

🀝 Contributing

Contributions are welcome! Start with CONTRIBUTING.md β€” it covers the development workflow, the coding and commit conventions and the pull request checklist. Bugs and feature requests go through the issue templates of the Tooark repository.

By participating you agree to the Code of Conduct.

πŸ†˜ Help & Security

  • ❓ Questions, bugs, feature ideas β€” see SUPPORT.md for the right channel
  • πŸ”’ Security vulnerabilities β€” do not open a public issue; follow SECURITY.md

πŸ’– Support

If Tooark helps your projects, consider supporting its development:

Every contribution helps keep the project maintained and improving. Thank you! πŸ™

πŸ“„ License

This project is licensed under the BSD 3-Clause License.

Product Compatible and additional computed target framework versions.
.NET net8.0 is compatible.  net8.0-android was computed.  net8.0-browser was computed.  net8.0-ios was computed.  net8.0-maccatalyst was computed.  net8.0-macos was computed.  net8.0-tvos was computed.  net8.0-windows was computed.  net9.0 was computed.  net9.0-android was computed.  net9.0-browser was computed.  net9.0-ios was computed.  net9.0-maccatalyst was computed.  net9.0-macos was computed.  net9.0-tvos was computed.  net9.0-windows was computed.  net10.0 is compatible.  net10.0-android was computed.  net10.0-browser was computed.  net10.0-ios was computed.  net10.0-maccatalyst was computed.  net10.0-macos was computed.  net10.0-tvos was computed.  net10.0-windows was computed. 
Compatible target framework(s)
Included target framework(s) (in package)
Learn more about Target Frameworks and .NET Standard.

NuGet packages

This package is not used by any NuGet packages.

GitHub repositories

This package is not used by any popular GitHub repositories.

Version Downloads Last Updated
4.7.0 87 9/30/2026

https://github.com/Tooark/nuget-tooark/blob/main/Notes/v4.7.0.md