docs: GCP secrets resource locations - #1717
Open
christopher-hakkaart wants to merge 4 commits into
Open
Conversation
…policy (EDU-1307) Cloud: document regional user-managed replication shipped in v26.2.0-cycle67 (COMP-2186, platform#11954). Enterprise current + 26.1: known-limitation caution and troubleshooting entry for the FAILED_PRECONDITION error under constraints/gcp.resourceLocations. Includes review edits trimming forward-looking release statements. Co-Authored-By: Claude Fable 5 <noreply@anthropic.com>
✅ Deploy Preview for seqera-docs ready!
To edit notification comments on pull requests, go to your Netlify project configuration. |
justinegeffen
requested review from
stefanoboriero
and removed request for
jonmarti
August 11, 2026 09:37
Comment on lines
+235
to
+245
| ## Pipeline secret creation fails under a Google Cloud resource location policy | ||
|
|
||
| In Google Cloud projects that enforce a resource location policy, launching a pipeline with a pipeline secret attached fails before any task starts. This affects Google Batch and Google Cloud compute environments. The error is similar to: | ||
|
|
||
| ``` | ||
| Unable to store pipeline secret 'my_secret' - Reason: io.grpc.StatusRuntimeException: | ||
| FAILED_PRECONDITION: Constraint constraints/gcp.resourceLocations violated for | ||
| [orgpolicy:projects/123456789012] attempting to create a secret in [global]. | ||
| ``` | ||
|
|
||
| This issue occurs because Seqera Platform creates pipeline secrets in Google Secret Manager with automatic replication, which stores the secret in the `global` location. If the [`constraints/gcp.resourceLocations`](https://cloud.google.com/resource-manager/docs/organization-policy/defining-locations) organization policy does not permit the `global` location, Google rejects the secret and the run cannot launch. The compute environment's location setting has no effect on where the secret is stored. |
Contributor
There was a problem hiding this comment.
Should there be a mention of this behaviour being fixed in an upcoming version v26.2? Or say this was the behaviour until version v26.1, like in the above item was say a given behaviour was true until Nextflow version 24.10?
Contributor
There was a problem hiding this comment.
Yes I would alter this to say something like 'until Platform verison 26.1, this issue occurs...'. and finish the paragraph by saying 'This issue is resolved in Platform v26.2'
Member
Author
There was a problem hiding this comment.
Suggested change
| ## Pipeline secret creation fails under a Google Cloud resource location policy | |
| In Google Cloud projects that enforce a resource location policy, launching a pipeline with a pipeline secret attached fails before any task starts. This affects Google Batch and Google Cloud compute environments. The error is similar to: | |
| ``` | |
| Unable to store pipeline secret 'my_secret' - Reason: io.grpc.StatusRuntimeException: | |
| FAILED_PRECONDITION: Constraint constraints/gcp.resourceLocations violated for | |
| [orgpolicy:projects/123456789012] attempting to create a secret in [global]. | |
| ``` | |
| This issue occurs because Seqera Platform creates pipeline secrets in Google Secret Manager with automatic replication, which stores the secret in the `global` location. If the [`constraints/gcp.resourceLocations`](https://cloud.google.com/resource-manager/docs/organization-policy/defining-locations) organization policy does not permit the `global` location, Google rejects the secret and the run cannot launch. The compute environment's location setting has no effect on where the secret is stored. | |
| ## Pipeline secret creation fails under a Google Cloud resource location policy | |
| In Platform v26.1 and earlier, launching a pipeline with a pipeline secret attached fails before any task starts in Google Cloud projects that enforce a resource location policy. This affects Google Batch and Google Cloud compute environments. The error is similar to: | |
| ``` | |
| Unable to store pipeline secret 'my_secret' - Reason: io.grpc.StatusRuntimeException: | |
| FAILED_PRECONDITION: Constraint constraints/gcp.resourceLocations violated for | |
| [orgpolicy:projects/123456789012] attempting to create a secret in [global]. | |
| ``` | |
| This issue occurs because Platform v26.1 and earlier create pipeline secrets in Google Secret Manager with automatic replication, which stores the secret in the `global` location. If the [`constraints/gcp.resourceLocations`](https://cloud.google.com/resource-manager/docs/organization-policy/defining-locations) organization policy does not permit the `global` location, Google rejects the secret and the run cannot launch. The compute environment's location setting has no effect on where the secret is stored. | |
| This issue is resolved in Platform v26.2, which creates pipeline secrets with user-managed regional replication instead of automatic replication. |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
4 participants
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
EDU-1307