<p>For the life of Bryan, how do I do this?</p>
<p><code>Terraform</code> is used to create an SQL Server instance in GCP.
Root password and user passwords are randomly generated, then put into the Google Secret Manager.
The DB's IP is exposed via private DNS zone.</p>
<p>How can I now get the username and password to access the DB into my K8s cluster? Running a Spring Boot app here.</p>
<p>This was one option I thought of:</p>
<p>In my deployment I add an <code>initContainer</code>:</p>
<pre><code>- name: secrets
  image: gcr.io/google.com/cloudsdktool/cloud-sdk
  args: 
  - echo &quot;DB_PASSWORD=$(gcloud secrets versions access latest --secret=\&quot;$NAME_OF_SECRET\&quot;)&quot; &gt;&gt; super_secret.env
</code></pre>
<p>Okay, what now? How do I get it into my application container from here?</p>
<p>There are also options like <code>bitnami/sealed-secrets</code>, which I don't like since the setup is using <code>Terraform</code> already and saving the secrets in GCP. When using <code>sealed-secrets</code> I could skip using the secrets manager. Same with <code>Vault</code> IMO.</p>

Moritz Schmitz v. Hülst
<p>On top of the other answers and suggestion in the comments I would like to suggest two tools that you might find interesting.</p>
<p>First one is <a href="https://github.com/doitintl/secrets-init#secrets-init" rel="noreferrer">secret-init</a>:</p>
<blockquote>
<p><code>secrets-init</code> is a minimalistic init system designed to run as PID 1
inside container environments and it`s integrated with
multiple secrets manager services, e.x. <a href="https://cloud.google.com/secret-manager/docs/" rel="noreferrer">Google Secret Manager</a></p>
</blockquote>
<p>Second one is <a href="https://github.com/doitintl/kube-secrets-init#kube-secrets-init" rel="noreferrer">kube-secrets-init</a>:</p>
<blockquote>
<p>The <code>kube-secrets-init</code> is a Kubernetes mutating admission webhook,
that mutates any K8s Pod that is using specially prefixed environment
variables, directly or from Kubernetes as Secret or ConfigMap.</p>
</blockquote>
<p>It`s also support integration with Google Secret Manager:</p>
<p>User can put Google secret name (prefixed with  <code>gcp:secretmanager:</code>) as environment variable value. The  <code>secrets-init</code>  will resolve any environment value, using specified name, to referenced secret value.</p>
<p>Here`s a good <a href="https://blog.doit-intl.com/kubernetes-and-secrets-management-in-cloud-part-2-6c37c1238a87" rel="noreferrer">article</a> about how it works.</p>
