Create the Google Secret Manager client only when a mapping uses GSM

[nullzone]

Problem

main() builds a Google Secret Manager client unconditionally at startup (secretmanager.NewClient(ctx)), regardless of whether any mapping sources from GSM. The Google SDK resolves Application Default Credentials eagerly at construction, so GCP credentials become a hard startup requirement for every deployment — including pure-Vault ones that never touch GSM.

On a non-GCP cluster (e.g. Vault-only reflection on-prem) pentagon dies at startup with:

unable to get GSM client: credentials: could not find default credentials

(exit code 32), even though the GSM client is never used.

Fix

Build the GSM client lazily: only call secretmanager.NewClient when at least one mapping has SourceType == GSMSourceType. When no mapping uses GSM the client stays nil and is never dereferenced — Reflector.getGSMSecret is only reached for GSM-sourced mappings — so Vault-only deployments no longer need any GCP credential.

Behaviour

• Vault-only config, no GCP credentials: starts normally (previously exit 32).
• Config with a gsm mapping: unchanged — a missing/invalid credential still fails fast at startup.

Testing

• go test ./... passes.
• Verified manually: a Vault-only config now reaches the reflection step with no GCP credentials present; a config with a gsm mapping still requires the GSM client.

[cursor]

Cursor Bugbot has reviewed your changes using default effort and found 1 potential issue.

^{❌ Bugbot Autofix is OFF. To automatically fix reported issues with cloud agents, have a team admin enable autofix in the Cursor dashboard.}

Comment @cursor review or bugbot run to trigger another review on this PR

^{Reviewed by Cursor Bugbot for commit 8f49f34. Configure here.}

[cursor]

Typed nil pointer creates non-nil interface value

Low Severity

gsmClient is declared as *secretmanager.Client (a concrete type). When no GSM mappings exist, this typed nil pointer is passed to NewReflector, which expects the gsm.SecretAccessor interface. In Go, a typed nil pointer wrapped in an interface produces a non-nil interface value. So Reflector.gsmClient will not be nil — it will be a non-nil interface holding a nil pointer. Any future nil guard on r.gsmClient would incorrectly pass, and calling a method on it would panic. Declaring gsmClient as gsm.SecretAccessor instead would preserve a true nil interface when unused.

Additional Locations (1)

• pentagon/main.go#L97-L98

 

^{Reviewed by Cursor Bugbot for commit 8f49f34. Configure here.}