Added support for fetching secrets based on labels

[abheda-crest]

The PR focuses on retrieving secrets based on specified labels.

• For each secret that matches the filter, the file name will correspond to the resource path of that secret (e.g., projects/<project_id>/secrets/<secret_id>).
• The system has successfully fetched up to 1,000 secrets, leading to the decision to set a cap at this limit.
• Limitation: Attempting to mount the value of larger secrets resulted in a resource exhaustion error due to a size exceeding 4 MB.

Related to: #384

We have tested this with the following scenarios:

• Attempting to mount more than 1,000 secrets results in a "Too many secrets" error.
• If there are no secrets which matches the filter, then returns "No secrets matched while filtering."
• Relevant logs messages are added at each stage.
• Global Secrets (All scenarios functioning as expected):
  • Secrets with no versions are not mounted.
  • Secrets with destroyed version is not mounted and are skipped.
  • Secrets with disabled version is not mounted and are skipped.
  • Secrets with enabled version is successfully mounted.
• Regional Secrets (All scenarios functioning as expected)
  (Location value provided in labels)
  • Secrets with no versions are not mounted.
  • Secrets with destroyed version is not mounted and are skipped.
  • Secrets with the disabled version is not mounted and are skipped.
  • Secrets with enabled version is successfully mounted.

[dargudear-google]

Please plan to add e2e test or add a load test at load-test.sh. May be this is a good opportunity to use labels in load test.

[abheda-crest]

Please plan to add e2e test or add a load test at load-test.sh. May be this is a good opportunity to use labels in load test.

We have added load test for fetching multiple secrets based on labels.

[dargudear-google]

@abheda-crest this will require additional permission to be configured on Secret Manager side, right?
It won't work with just secetAccessor I guess.

[abheda-crest]

@abheda-crest this will require additional permission to be configured on Secret Manager side, right? It won't work with just secetAccessor I guess.

Yes, we would require the secretmanager.viewer permission to list secrets from Secret Manager side.

Reference: https://cloud.google.com/secret-manager/docs/access-control#secretmanager.viewer

[dargudear-google]

@abheda-crest this will require additional permission to be configured on Secret Manager side, right? It won't work with just secetAccessor I guess.

Yes, we would require the secretmanager.viewer permission to list secrets from Secret Manager side.

Reference: https://cloud.google.com/secret-manager/docs/access-control#secretmanager.viewer

Can you please update the documentation?
cc: @jainsuyogj

[abheda-crest]

Can you please update the documentation? cc: @jainsuyogj

I have updated the documentation to include additional Secret Manager permission.

[dargudear-google]

If secrets will be fetched using the label Add this condition

[abheda-crest]

I have updated the condition.