 for secrets that have a name starting with zenml-This can be achieved by creating two custom IAM roles and attaching them to the principal (e.g. user or service account) that will be used to access the GCP Secrets Manager API with a condition configured when attaching the second role to limit access to secrets with a name prefix of zenml-. The following gcloud CLI command examples can be used as a starting point:

gcloud iam roles create ZenMLServerSecretsStoreCreator \

--project <your GCP project ID> \

--title "ZenML Server Secrets Store Creator" \

--description "Allow the ZenML Server to create new secrets" \

--stage GA \

--permissions "secretmanager.secrets.create"

gcloud iam roles create ZenMLServerSecretsStoreEditor \

--project <your GCP project ID> \

--title "ZenML Server Secrets Store Editor" \

--description "Allow the ZenML Server to manage its secrets" \

--stage GA \

--permissions "secretmanager.secrets.get,secretmanager.secrets.update,secretmanager.versions.access,secretmanager.versions.add,secretmanager.secrets.delete"

gcloud projects add-iam-policy-binding <your GCP project ID> \

--member serviceAccount:<your GCP service account email> \

--role projects/<your GCP project ID>/roles/ZenMLServerSecretsStoreCreator \

--condition None

# NOTE: use the GCP project NUMBER, not the project ID in the condition

gcloud projects add-iam-policy-binding <your GCP project ID> \

--member serviceAccount:<your GCP service account email> \

--role projects/<your GCP project ID>/roles/ZenMLServerSecretsStoreEditor \

--condition 'title=limit_access_zenml,description="Limit access to secrets with prefix zenml-",expression=resource.name.startsWith("projects/<your GCP project NUMBER>/secrets/zenml-")'

The following configuration options are supported:

ZENML_SECRETS_STORE_AUTH_METHOD: The GCP Service Connector authentication method to use (e.g. service-account).