Create a build step for decrypting files via KMS

Create a build step to decrypt files using CryptoKey from Cloud Key Management Service. Usually you will prefer to use cr_buildstep_secret

cr_buildstep_decrypt(cipher, plain, keyring, key, location = "global", ...)

Arguments

cipher	The file that has been encrypted
plain	The file location to decrypt to
keyring	The KMS keyring to use
key	The KMS key to use
location	The KMS location
...	Further arguments passed in to cr_buildstep

Details

Key Management Store can encrypt secret files for use within your later buildsteps.

Setup

You will need to set up the encrypted key using gcloud following the link from Google

See also

Other Cloud Buildsteps: cr_buildstep_bash(), cr_buildstep_df(), cr_buildstep_docker(), cr_buildstep_edit(), cr_buildstep_extract(), cr_buildstep_gcloud(), cr_buildstep_gitsetup(), cr_buildstep_mailgun(), cr_buildstep_nginx_setup(), cr_buildstep_pkgdown(), cr_buildstep_run(), cr_buildstep_r(), cr_buildstep_secret(), cr_buildstep_slack(), cr_buildstep()

Examples

cr_project_set("my-project")
#> ℹ 2021-03-19 12:27:03 > ProjectId set to  my-project
#> [1] "my-project"
cr_bucket_set("my-bucket")
#> ℹ 2021-03-19 12:27:03 > Bucket set to  my-bucket
#> [1] "my-bucket"
cr_buildstep_decrypt("secret.json.enc",
                     plain = "secret.json",
                     keyring = "my_keyring",
                     key = "my_key")
#> [[1]]
#> ==cloudRunnerBuildStep==
#> name: gcr.io/google.com/cloudsdktool/cloud-sdk:alpine
#> args:
#> - gcloud
#> - kms
#> - decrypt
#> - --ciphertext-file
#> - secret.json.enc
#> - --plaintext-file
#> - secret.json
#> - --location
#> - global
#> - --keyring
#> - my_keyring
#> - --key
#> - my_key
#>