Skip to content

Commit 98513f5

Browse files
snesridh-ctrljoefernandez
snesridh-ctrl
and
joefernandez
authored
Add Google Cloud Parameter Manager integration (#1841)
* Create secret-manager.md initial draft * Update secret-manager.md Updated draft * Update secret-manager.md * Update secret-manager.md * Update secret-manager.md * Add files via upload * Update secret-manager.md * Update secret-manager.md * Update secret-manager.md * Update secret-manager.md * Create parameter-manager.md * Add files via upload * Update parameter-manager.md * Update parameter-manager.md Update parameter-manager.md based on review feedback * Update parameter-manager.md Update parameter-manager.md based on review feedback * Update parameter-manager.md * Update parameter-manager.md * Update parameter-manager.md --------- Co-authored-by: Joe Fernandez <931947+joefernandez@users.noreply.github.com>
1 parent e81c536 commit 98513f5

2 files changed

Lines changed: 166 additions & 0 deletions

File tree

‎docs/integrations/assets/parameter_manager.png‎

13.7 KB
Loading

‎docs/integrations/parameter-manager.md‎

Lines changed: 166 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,166 @@
1+
---
2+
catalog_title: Google Cloud Parameter Manager
3+
catalog_description: Manage and retrieve runtime configuration parameters and secrets securely for ADK agents.
4+
catalog_icon: /integrations/assets/parameter_manager.png
5+
catalog_tags: ["google"]
6+
---
7+
8+
# Parameter Manager for ADK
9+
10+
<div class="language-support-tag">
11+
<span class="lst-supported">Supported in ADK</span><span class="lst-python">Python v1.30.0</span>
12+
</div>
13+
14+
The [Google Cloud Parameter
15+
Manager](https://docs.cloud.google.com/secret-manager/parameter-manager/docs/overview)
16+
integration provides a standard interface for Agent Development Kit (ADK) agents to connect with the Google Cloud Parameter Manager service
17+
and retrieve rendered parameter values at runtime. This module lets you use the
18+
Google Cloud Parameter Manager service as the single source of truth for agent instructions and tool
19+
configurations.
20+
21+
## Use cases
22+
23+
The Parameter Manager integration supports several operations:
24+
25+
* **Dynamic instruction updates**: You can publish parameters instantly to
26+
defend against prompt injection attacks, update mandatory disclaimer
27+
resources, or automatically adjust the agent tone without a full code
28+
redeployment.
29+
* **Feature flag and parameter management**: You can store configurations as a
30+
JSON payload and retrieve them through the tool context to lower query rates
31+
or switch between experimental and production API endpoints.
32+
* **Accuracy improvement with input and output pairs**: You can store few-shot
33+
examples as YAML files and load them into the session state to improve agent
34+
performance over time.
35+
* **Just-in-time tool authorization**: You can load secrets into memory on
36+
demand rather than using insecure static API keys in initialization code.
37+
* **Secure multi-tenant workflows**: You can store Parameter Manager IDs that
38+
map to users and use callbacks to rehydrate the session state with resolved
39+
OAuth tokens.
40+
* **Encrypted system tasks**: You can prevent primary database passwords from
41+
entering the large language model (LLM) conversation history during
42+
background polling tasks.
43+
* **Multi-region deployments**: You can maintain shared logic across global
44+
deployments while using regional Parameter Manager overrides to apply local
45+
currency and contact information.
46+
47+
## Prerequisites
48+
49+
You must meet the following requirements before you configure the integration:
50+
51+
- **Required Software Versions**: ADK Python version v1.30.0 or higher
52+
- **Required Accounts / APIs**: A [Google Cloud Project](https://docs.cloud.google.com/resource-manager/docs/creating-managing-projects) with the [**Parameter Manager API**](https://docs.cloud.google.com/secret-manager/parameter-manager/docs/prepare-environment#enable_api), [**Secret Manager API**](https://docs.cloud.google.com/secret-manager/docs/configuring-secret-manager), and **Agent Development Kit API** enabled.
53+
54+
Complete the following setup steps:
55+
56+
1. [Set up an agent with ADK](/get-started/).
57+
1. [Create a parameter](https://docs.cloud.google.com/secret-manager/parameter-manager/docs/create-parameter).
58+
1. Grant the [Parameter Manager Parameter Accessor](https://docs.cloud.google.com/iam/docs/roles-permissions/parametermanager#parametermanager.parameterAccessor) role
59+
(`roles/parametermanager.parameterAccessor`)
60+
IAM role to your agent identity. This role allows your agent to render the parameter configuration at runtime.
61+
1. If your parameter contains embedded secrets, grant the [Secret Manager Secret Accessor](https://docs.cloud.google.com/iam/docs/roles-permissions/secretmanager#secretmanager.secretAccessor) role (`roles/secretmanager.secretAccessor`) to your parameter resource. This cross-service permission allows Parameter Manager to resolve the referenced secrets on behalf of the agent. For more information, [Grant the Secret Manager Secret Accessor role to the parameter](https://docs.cloud.google.com/secret-manager/parameter-manager/docs/reference-secrets-in-parameter#grant_the_secret_manager_secret_accessor_role_to_the_parameter).
62+
63+
## Installation
64+
65+
Install the ADK extensions package to enable the Parameter Manager integration:
66+
67+
```bash
68+
pip install "google-adk[extensions]"
69+
```
70+
71+
## Use with agent
72+
73+
The following examples show complete, working code to retrieve a parameter
74+
securely within an ADK agent using either global or regional endpoints.
75+
76+
### Global parameters
77+
78+
```python
79+
80+
import os
81+
82+
from google.adk import Agent
83+
from google.adk.integrations.parameter_manager.parameter_client import ParameterManagerClient
84+
85+
# Fetch parameter from global Parameter Manager
86+
project_id = os.environ.get("GOOGLE_CLOUD_PROJECT")
87+
parameter_id = os.environ.get("ADK_TEST_PARAMETER_ID")
88+
parameter_version = os.environ.get("ADK_TEST_PARAMETER_VERSION", "latest")
89+
90+
if not project_id or not parameter_id:
91+
raise ValueError("GOOGLE_CLOUD_PROJECT and ADK_TEST_PARAMETER_ID environment variables must be set.")
92+
93+
resource_name = f"projects/{project_id}/locations/global/parameters/{parameter_id}/versions/{parameter_version}"
94+
95+
print("Fetching parameter from global Parameter Manager...")
96+
# Initialize Parameter Manager Client
97+
client = ParameterManagerClient()
98+
99+
# Fetch parameter
100+
try:
101+
parameter_payload = client.get_parameter(resource_name)
102+
print("Successfully fetched parameter.")
103+
except Exception as e:
104+
print(f"Error fetching parameter: {e}")
105+
raise e
106+
107+
# Initialize Agent
108+
root_agent = Agent(
109+
model='gemini-2.5-flash',
110+
name='root_agent',
111+
description='A helpful assistant for user questions.',
112+
instruction='Answer user questions to the best of your knowledge',
113+
)
114+
115+
print("Agent initialized successfully.")
116+
```
117+
118+
### Regional parameters
119+
120+
```python
121+
122+
import os
123+
124+
from google.adk import Agent
125+
from google.adk.integrations.parameter_manager.parameter_client import ParameterManagerClient
126+
127+
# Fetch parameter from regional Parameter Manager
128+
project_id = os.environ.get("GOOGLE_CLOUD_PROJECT")
129+
location = os.environ.get("GOOGLE_CLOUD_PROJECT_LOCATION")
130+
parameter_id = os.environ.get("ADK_TEST_PARAMETER_ID")
131+
parameter_version = os.environ.get("ADK_TEST_PARAMETER_VERSION", "latest")
132+
133+
if not project_id or not location or not parameter_id:
134+
raise ValueError("GOOGLE_CLOUD_PROJECT, GOOGLE_CLOUD_PROJECT_LOCATION, and ADK_TEST_PARAMETER_ID environment variables must be set.")
135+
136+
resource_name = f"projects/{project_id}/locations/{location}/parameters/{parameter_id}/versions/{parameter_version}"
137+
138+
print(f"Fetching parameter from regional Parameter Manager ({location})...")
139+
# Initialize Parameter Manager Client (Regional)
140+
client = ParameterManagerClient(location=location)
141+
142+
# Fetch parameter
143+
try:
144+
parameter_payload = client.get_parameter(resource_name)
145+
print("Successfully fetched parameter.")
146+
except Exception as e:
147+
print(f"Error fetching parameter: {e}")
148+
raise e
149+
150+
# Initialize Agent
151+
root_agent = Agent(
152+
model='gemini-2.5-flash',
153+
name='root_agent',
154+
description='A helpful assistant for user questions.',
155+
instruction='Answer user questions to the best of your knowledge',
156+
)
157+
158+
print("Agent initialized successfully.")
159+
```
160+
161+
## Resources
162+
163+
- [Parameter Manager
164+
documentation](https://docs.cloud.google.com/secret-manager/parameter-manager/docs/overview)
165+
- [ADK GitHub repository](https://github.com/google/adk-python)
166+
- [Include few-shot examples](https://docs.cloud.google.com/gemini-enterprise-agent-platform/models/prompts/few-shot-examples)

0 commit comments

Comments
 (0)