Skip to content

Read GCP Parameter Manager

Google Cloud Parameter Manager becomes a config layer through the sibling module config-gcp-parameter, taken only by consumers who need it.

go get gitlab.com/phpboyscout/go/config-gcp-parameter

You build and configure the Parameter Manager client — project, location and credentials stay yours. Parameter Manager parameters are heavyweight, versioned, document-shaped resources, so the adapter reads them two ways.

Single document (default)

One named parameter is one layer: its latest version's payload is the whole document. Pass a config.Codec to decode it into a tree:

import (
    parametermanager "cloud.google.com/go/parametermanager/apiv1"
    "gitlab.com/phpboyscout/go/config"
    configgcp "gitlab.com/phpboyscout/go/config-gcp-parameter"
    configjson "gitlab.com/phpboyscout/go/config-json"
)

client, _ := parametermanager.NewClient(ctx)

store, err := config.NewStore(ctx,
    config.WithFiles(fsys, "/etc/app.yaml"),
    config.WithBackend(configgcp.FromClient(client, "my-project", "global", "app-config",
        configgcp.WithValueCodec(configjson.Codec{}))),   // decode the JSON payload
)

Parameter Manager declares each parameter's format (JSON/YAML/UNFORMATTED), but that field is not used to pick a codec — decoding is always the one you inject, uniform with the rest of the family. Without a codec the payload is a single string.

Prefix (many parameters)

For a store organised as many small parameters, FromClientPrefix scans a name prefix and nests each parameter as a leaf, Consul-style:

config.WithBackend(configgcp.FromClientPrefix(client, "my-project", "global", "app-"))

Either way the layer takes part in precedence, per-key merge, provenance and hot-reload like a file. New/NewPrefix take the narrow PM interface directly for testing.

Read-only

Parameter Manager versions are immutable and it offers no compare-and-swap, so config-gcp-parameter is read-only: a write to a key it defines routes to the writable layer beneath, never to Parameter Manager. The adapter returns the raw payload (it does not resolve embedded Secret Manager references), so the layer is not sensitive. Write, and a secret-rendering variant, are tracked follow-ons.

Watching

The adapter joins hot-reload by polling for a new latest version or a changed parameter set (NativeWatch: false); WithPollInterval sets the cadence (60s default, since each poll is a billed call).

What it costs

The config graph plus the Google Cloud Parameter Manager client — the heaviest graph in the adapter family (the first-party gRPC/protobuf/auth stack), asserted honestly by an allowlist test.