如何通过Terraform为GCP Cloud Run定义多个Secret卷？

当尝试为Cloud Run服务添加多个Secret卷时，直接重复volumes块报错的原因是需要正确使用Terraform的重复块语法——在spec层级下多次定义独立的volumes块，每个块对应一个Secret卷，同时在容器配置中添加对应的volume_mounts。

以下是完整的多Secret卷配置示例：

resource "google_cloud_run_service" "example" {
  name     = "example-service"
  location = "us-central1"

  template {
    spec {
      containers {
        image = "gcr.io/cloudrun/hello"
        
        # 挂载第一个Secret卷
        volume_mounts {
          name      = "secret-volume-1"
          mount_path = "/secrets/secret1"
          read_only = true
        }
        
        # 挂载第二个Secret卷
        volume_mounts {
          name      = "secret-volume-2"
          mount_path = "/secrets/secret2"
          read_only = true
        }
      }

      # 定义第一个Secret卷
      volumes {
        name = "secret-volume-1"
        secret {
          secret_name = google_secret_manager_secret.secret1.secret_id
          default_mode = 292 # 0444
          items {
            key  = "latest"
            path = "my-secret-1"
            mode = 256 # 0400
          }
        }
      }

      # 定义第二个Secret卷
      volumes {
        name = "secret-volume-2"
        secret {
          secret_name = google_secret_manager_secret.secret2.secret_id
          default_mode = 292 # 0444
          items {
            key  = "latest"
            path = "my-secret-2"
            mode = 256 # 0400
          }
        }
      }
    }
  }

  traffic {
    percent         = 100
    latest_revision = true
  }
}

# 示例依赖的Secret资源
resource "google_secret_manager_secret" "secret1" {
  name = "my-secret-1"
}

resource "google_secret_manager_secret" "secret2" {
  name = "my-secret-2"
}

关键注意点： #

• 每个volumes块必须设置唯一的name，用于和volume_mounts关联
• 每个volume_mounts的mount_path需要不同，避免目录覆盖
• 可以为每个Secret卷单独配置default_mode和items中的权限、路径映射

内容的提问来源于stack exchange，提问作者SebastianG