Cloud Run requires run.viewer role for a custom service account about berglas

[sethvargo]

The default behavior for Berglas auto (and berglas exec) is to look up the environment as set by the deploying user. Berglas queries the GCP API for Cloud Run and gets the list of envvars set on the service deployment. This protects against a threat where an attacker injects berglas references into environment variables.

I don't quite understand your point about Cloud Functions. Cloud Functions also need viewer permissions on themselves. If the GCF SA has no permissions, neither auto nor exec will work.

If you want to accept the risk of the environment being modified, you can use berglas exec --local which will parse all local vars and won't need viewer permissions. However, even then, the GCF SA would still need permissions to talk to GCS and KMS.

[dinvlad]

I see, thanks - we’re using Berglas with a Python app in Cloud Run, so have to apply berglas exec -- form (in fact, the main reason for our jump from GCF to Run was so that we could use Berglas with Python). That being said, I’ve only tried Berglas in Go locally (which works great), not in a GCF.

The main reason I’m asking is I wanted to avoid granting project-wide Run Viewer to each Run SA. However, I understand that the risk of env injection is also not to be overlooked.

[sethvargo]

Yea if you run berglas exec --local -- CMD then you won't need those viewer permissions.