datolabs:gcp:secrets-manager:create action ignores user-managed replication and forces global location

[jonathan-arenas-edo]

We're trying to use the datolabs:gcp:secrets-manager:create scaffolder action to create secrets in Google Cloud Secret Manager within our allowed regions, as our organization policy restricts the use of the global location via the constraints/gcp.resourceLocations constraint.

We've tried passing the following inputs to the action:

yaml

replication: user-managed
locations:

• europe-west1

However, the action still attempts to create the secret in the global location (replication: automatic), resulting in this error:

error:
FAILED_PRECONDITION: Constraint constraints/gcp.resourceLocations violated for [orgpolicy:projects/PROJECT_ID] attempting to create a secret in [global]
This suggests that the action is either:

Ignoring the replication and locations parameters.
Or, defaulting to replication: automatic internally.

We kindly request clarification on whether the user-managed replication mode is currently supported, and if not, whether there are plans to add support for custom replication regions in the near future.

Expected behavior:

When passing replication: user-managed and a valid locations array, the secret should be created in the specified region instead of defaulting to global.

Example templating:

apiVersion: scaffolder.backstage.io/v1beta3
kind: Template
metadata:
name: create-gcp-secret
title: Create GCP Secret with custom region
description: Attempts to create a secret using user-managed replication
spec:
owner: team
type: service

parameters:
- title: Secret info
required:
- name
- value
- project
- region
properties:
name:
type: string
value:
type: string
ui:widget: password
project:
type: string
enum:
- edo-test-resources
region:
type: string
enum:
- europe-west1

steps:
- id: create-secret
name: Create secret in GCP
action: datolabs:gcp:secrets-manager:create
input:
name: ${{ parameters.name }}
project: ${{ parameters.project }}
value: ${{ parameters.value }}
replication: user-managed
locations:
- ${{ parameters.region }}

[jonathan-arenas-edo]

Hi! Another doubt:

Is it currently possible to set labels on the secret via this action? If not, would support for that be considered?
This would be very useful for organizing and classifying secrets (e.g., by environment or owner).

It's an incredible plugin that can be extremely helpful.

Thank you

[tdabasinskas]

Hi,

As you can see the README and the code, neither replication nor locations parameters are supported by the plugin. Same goes for the labels.

[jonathan-arenas-edo]

Hi @tdabasinskas,

Thank you for your time. Would it be possible to add this to the backlog, or is it perhaps not relevant for our current priorities?

Kind regards.

[tdabasinskas]

Will see what I can do. Labels should be easy, not sure about the replication. Will take a look into this sometime later next week.

[jonathan-arenas-edo]

Okay, thanks anyway. I'll keep an eye out for any updates you make.

Due to our needs, we especially require locations. We can't create global secrets; they need to be per location. Labels are more about organization and control of what's there. It would be very interesting to know what has been created from Backstage.

Thanks for all the support.