Cloud Secret Manager Laravel Package

Technical Evaluation

Architecture Fit

• Laravel Integration: The package is idiomatic PHP and integrates seamlessly with Laravel’s dependency injection (DI) container, configuration system, and environment variable handling. Secrets can be fetched dynamically and injected into Laravel’s service providers, facades, or config files (e.g., config/services.php).
• GCP-Native Fit: Designed for Google Cloud Secret Manager, it aligns with GCP’s IAM, audit logging, and service account models. Ideal for Laravel apps hosted on Cloud Run, GKE, App Engine, or Compute Engine.
• Microservices & Serverless: Supports runtime secret injection for serverless functions (Cloud Run, Cloud Functions) and containerized Laravel (Docker/Kubernetes) without rebuilding images.
• Multi-Environment Support: Leverages Secret Manager’s tags (e.g., env:production, tenant:acme) to dynamically fetch secrets for staging, production, or tenant-specific configs without redeploying.

Integration Feasibility

• Low-Coupling Design: The package provides a client interface (SecretManagerServiceClient) that can be injected into Laravel services or called statically in config files. No monolithic integration required.
• Environment Variable Proxy: Can replace .env files by fetching secrets at runtime and exposing them as Laravel config values (e.g., config('services.db.password')).
• Service Provider Integration: A custom Laravel service provider can bootstrap the client and bind it to the container, enabling dependency injection for secrets.
• Facade Pattern: Can create a Laravel facade (e.g., SecretManager::get('db_password')) for cleaner syntax in controllers and services.
• Event-Driven Rotation: Supports webhook-based rotation (via Cloud Pub/Sub) to trigger Laravel listeners or queued jobs when secrets are updated.

Technical Risk

Key Questions

1. Authentication:

   • How will service accounts be managed (e.g., Workload Identity Federation for CI/CD, static keys for local dev)?
   • Will IAM roles be scoped to least privilege (e.g., roles/secretmanager.secretAccessor only for specific secrets)?

2. Performance:

   • Should secrets be cached in Redis (Laravel Cache) with TTL-based invalidation to reduce API calls?
   • Will gRPC be enabled for high-throughput environments (e.g., microservices)?

3. Fallback Strategy:

   • Should non-critical secrets fall back to .env if Secret Manager fails (e.g., during GCP outages)?
   • How will secret rotation be tested (e.g., database password changes without downtime)?

4. Compliance:

   • Are audit logs required for GDPR/HIPAA? If so, how will Laravel’s logs integrate with GCP Audit Logs?
   • Should secret access be logged in Laravel’s activity logs (e.g., Spatie’s Laravel Activitylog)?

5. CI/CD Integration:

   • How will GitHub Actions/GitLab CI inject secrets at runtime (e.g., OIDC Workload Identity vs. static service account keys)?
   • Will Laravel Forge/Envoyer support runtime secret injection without rebuilding deployments?

6. Multi-Tenancy:

   • How will tenant-specific secrets be scoped (e.g., tags like tenant:{tenant_id})?
   • Should a Laravel middleware dynamically fetch secrets based on the current tenant?

7. Disaster Recovery:

   • Should Secret Manager’s version history be used for rollbacks (e.g., after a misconfiguration)?
   • Will delayed destruction be enabled for critical secrets (e.g., MAIL_PASSWORD)?

8. Monitoring:

   • Should secret access metrics (e.g., failed fetches, latency) be exposed to Laravel Horizon or Prometheus?
   • Will alerts be set up for unusual access patterns (e.g., brute-force attempts)?

Integration Approach

Stack Fit

Migration Path

1. Phase 1: Pilot Secrets

   • Migrate non-critical secrets (e.g., MAIL_FROM_ADDRESS, APP_DEBUG) first.
   • Use a custom config loader to fetch secrets on demand:

     // config/app.php
     'secret_manager' => [
         'enabled' => env('SECRET_MANAGER_ENABLED', false),
         'project_id' => env('GOOGLE_CLOUD_PROJECT'),
     ],
     

   • Create a service provider to bootstrap the client:

     // app/Providers/SecretManagerServiceProvider.php
     public function register()
     {
         $this->app->singleton(SecretManagerServiceClient::class, fn() => new SecretManagerServiceClient());
     }
     

2. Phase 2: Critical Secrets

   • Migrate database credentials, API keys, and OAuth tokens.
   • Implement fallback to .env for offline/dev environments:

     public function getSecret(string $secretName): string
     {
         try {
             return $this->client->accessSecretVersion($this->formatName($secretName))->getPayload()->getData();
         } catch (ApiException $e) {
             return env($secretName); // Fall