From 6dc29abbe71e8fb75e2fa1e5a48d001285cabe40 Mon Sep 17 00:00:00 2001 From: Christopher Hakkaart Date: Fri, 7 Aug 2026 12:00:10 +1200 Subject: [PATCH 1/3] docs(secrets): GCP pipeline secret replication and resourceLocations policy (EDU-1307) Cloud: document regional user-managed replication shipped in v26.2.0-cycle67 (COMP-2186, platform#11954). Enterprise current + 26.1: known-limitation caution and troubleshooting entry for the FAILED_PRECONDITION error under constraints/gcp.resourceLocations. Includes review edits trimming forward-looking release statements. Co-Authored-By: Claude Fable 5 --- platform-cloud/docs/secrets/overview.md | 10 ++++++++++ platform-enterprise_docs/secrets/overview.md | 4 ++++ .../troubleshooting_and_faqs/nextflow.md | 12 ++++++++++++ .../version-26.1/secrets/overview.md | 4 ++++ .../troubleshooting_and_faqs/nextflow.md | 12 ++++++++++++ 5 files changed, 42 insertions(+) diff --git a/platform-cloud/docs/secrets/overview.md b/platform-cloud/docs/secrets/overview.md index 32e9aac1c0..ae98e3005c 100644 --- a/platform-cloud/docs/secrets/overview.md +++ b/platform-cloud/docs/secrets/overview.md @@ -176,3 +176,13 @@ You must [enable Google Secret Manager](https://cloud.google.com/secret-manager/ See the [Google documentation](https://cloud.google.com/secret-manager/docs/access-control) for permission configuration instructions to integrate with Google Secret Manager. Seqera Platform requires `roles/secretmanager.admin` permissions in the project where it will manage your secrets. Ensure that your compute environment contains credentials with this access role for the same `project_id` listed in the service account JSON file. + + + +### Secret replication + +Seqera Platform creates pipeline secrets in Google Secret Manager with user-managed replication, stored in the same region as the compute environment that runs the pipeline. For Google Batch compute environments, this is the compute environment's location (`us-central1` when no location is set). For Google Cloud compute environments, this is the compute environment's region. As secrets are not stored in the `global` location, secret creation succeeds in projects that enforce the [`constraints/gcp.resourceLocations`](https://cloud.google.com/resource-manager/docs/organization-policy/defining-locations) organization policy. + +:::note +Each secret is stored in a single region. If Google Secret Manager is unavailable in that region, secret creation fails and the run does not launch. +::: diff --git a/platform-enterprise_docs/secrets/overview.md b/platform-enterprise_docs/secrets/overview.md index 8cd5f1e656..e5f4f13d38 100644 --- a/platform-enterprise_docs/secrets/overview.md +++ b/platform-enterprise_docs/secrets/overview.md @@ -169,3 +169,7 @@ You must [enable Google Secret Manager](https://cloud.google.com/secret-manager/ See the [Google documentation](https://cloud.google.com/secret-manager/docs/access-control) for permission configuration instructions to integrate with Google Secret Manager. Seqera Platform requires `roles/secretmanager.admin` permissions in the project where it will manage your secrets. Ensure that your compute environment contains credentials with this access role for the same `project_id` listed in the service account JSON file. + +:::caution +Seqera Platform creates pipeline secrets in Google Secret Manager with automatic replication, which stores the secret in the `global` location. If your project enforces the [`constraints/gcp.resourceLocations`](https://cloud.google.com/resource-manager/docs/organization-policy/defining-locations) organization policy and does not permit the `global` location, secret creation fails and pipelines with a secret attached cannot launch. +::: diff --git a/platform-enterprise_docs/troubleshooting_and_faqs/nextflow.md b/platform-enterprise_docs/troubleshooting_and_faqs/nextflow.md index 30dcdec52d..dad685a598 100644 --- a/platform-enterprise_docs/troubleshooting_and_faqs/nextflow.md +++ b/platform-enterprise_docs/troubleshooting_and_faqs/nextflow.md @@ -232,6 +232,18 @@ If you rely on silent Spot retries (the previous default), you might now see mor Because the default for Spot retries is now zero, you must enable a retry strategy for Nextflow to handle reclaimed Spot instances automatically. For more information, see [manage Spot interruptions](../tutorials/retry-strategy). +## Pipeline secret creation fails under a Google Cloud resource location policy + +In Google Cloud projects that enforce a resource location policy, launching a pipeline with a pipeline secret attached fails before any task starts. This affects Google Batch and Google Cloud compute environments. The error is similar to: + +``` +Unable to store pipeline secret 'my_secret' - Reason: io.grpc.StatusRuntimeException: +FAILED_PRECONDITION: Constraint constraints/gcp.resourceLocations violated for +[orgpolicy:projects/123456789012] attempting to create a secret in [global]. +``` + +This issue occurs because Seqera Platform creates pipeline secrets in Google Secret Manager with automatic replication, which stores the secret in the `global` location. If the [`constraints/gcp.resourceLocations`](https://cloud.google.com/resource-manager/docs/organization-policy/defining-locations) organization policy does not permit the `global` location, Google rejects the secret and the run cannot launch. The compute environment's location setting has no effect on where the secret is stored. + ## Nextflow syntax parser Up to version 25.10, Nextflow uses the v1 syntax parser (also known as the legacy parser) by default. The v2 parser introduces stricter validation and is available as an opt-in through `NXF_SYNTAX_PARSER=v2`. diff --git a/platform-enterprise_versioned_docs/version-26.1/secrets/overview.md b/platform-enterprise_versioned_docs/version-26.1/secrets/overview.md index 8cd5f1e656..2054653d22 100644 --- a/platform-enterprise_versioned_docs/version-26.1/secrets/overview.md +++ b/platform-enterprise_versioned_docs/version-26.1/secrets/overview.md @@ -169,3 +169,7 @@ You must [enable Google Secret Manager](https://cloud.google.com/secret-manager/ See the [Google documentation](https://cloud.google.com/secret-manager/docs/access-control) for permission configuration instructions to integrate with Google Secret Manager. Seqera Platform requires `roles/secretmanager.admin` permissions in the project where it will manage your secrets. Ensure that your compute environment contains credentials with this access role for the same `project_id` listed in the service account JSON file. + +:::caution +Seqera Platform creates pipeline secrets in Google Secret Manager with automatic replication, which stores the secret in the `global` location. If your project enforces the [`constraints/gcp.resourceLocations`](https://cloud.google.com/resource-manager/docs/organization-policy/defining-locations) organization policy and does not permit the `global` location, secret creation fails and pipelines with a secret attached cannot launch. No workaround is available in Seqera Platform. +::: diff --git a/platform-enterprise_versioned_docs/version-26.1/troubleshooting_and_faqs/nextflow.md b/platform-enterprise_versioned_docs/version-26.1/troubleshooting_and_faqs/nextflow.md index 735c31ca3e..0623e00442 100644 --- a/platform-enterprise_versioned_docs/version-26.1/troubleshooting_and_faqs/nextflow.md +++ b/platform-enterprise_versioned_docs/version-26.1/troubleshooting_and_faqs/nextflow.md @@ -228,6 +228,18 @@ If you rely on silent Spot retries (the previous default behavior), you may now Since the default for Spot retries is now zero, you must actively enable a retry strategy if you want Nextflow to handle reclaimed Spot instances automatically. For more information, see [manage Spot interruptions](../tutorials/retry-strategy). +### Pipeline secret creation fails under a Google Cloud resource location policy + +In Google Cloud projects that enforce a resource location policy, launching a pipeline with a pipeline secret attached fails before any task starts. This affects Google Batch and Google Cloud compute environments. The error is similar to: + +``` +Unable to store pipeline secret 'my_secret' - Reason: io.grpc.StatusRuntimeException: +FAILED_PRECONDITION: Constraint constraints/gcp.resourceLocations violated for +[orgpolicy:projects/123456789012] attempting to create a secret in [global]. +``` + +This issue occurs because Seqera Platform creates pipeline secrets in Google Secret Manager with automatic replication, which stores the secret in the `global` location. If the [`constraints/gcp.resourceLocations`](https://cloud.google.com/resource-manager/docs/organization-policy/defining-locations) organization policy does not permit the `global` location, Google rejects the secret and the run cannot launch. The compute environment's location setting has no effect on where the secret is stored. + ### Nextflow syntax parser Up to version 25.10, Nextflow uses the v1 syntax parser (also known as the legacy parser) by default. The v2 parser introduces stricter validation and is available as an opt-in via `NXF_SYNTAX_PARSER=v2`. From d7fd8902e99519f0a87069c2c42c9c141729a541 Mon Sep 17 00:00:00 2001 From: Christopher Hakkaart Date: Fri, 7 Aug 2026 12:04:30 +1200 Subject: [PATCH 2/3] Remove marker --- platform-cloud/docs/secrets/overview.md | 2 -- 1 file changed, 2 deletions(-) diff --git a/platform-cloud/docs/secrets/overview.md b/platform-cloud/docs/secrets/overview.md index ae98e3005c..fa4774af9e 100644 --- a/platform-cloud/docs/secrets/overview.md +++ b/platform-cloud/docs/secrets/overview.md @@ -177,8 +177,6 @@ See the [Google documentation](https://cloud.google.com/secret-manager/docs/acce Seqera Platform requires `roles/secretmanager.admin` permissions in the project where it will manage your secrets. Ensure that your compute environment contains credentials with this access role for the same `project_id` listed in the service account JSON file. - - ### Secret replication Seqera Platform creates pipeline secrets in Google Secret Manager with user-managed replication, stored in the same region as the compute environment that runs the pipeline. For Google Batch compute environments, this is the compute environment's location (`us-central1` when no location is set). For Google Cloud compute environments, this is the compute environment's region. As secrets are not stored in the `global` location, secret creation succeeds in projects that enforce the [`constraints/gcp.resourceLocations`](https://cloud.google.com/resource-manager/docs/organization-policy/defining-locations) organization policy. From 4a55773f2d0e1083aae2e0478a95566fab4d29a8 Mon Sep 17 00:00:00 2001 From: Justine Geffen Date: Mon, 24 Aug 2026 15:16:37 +0200 Subject: [PATCH 3/3] Update platform-enterprise_docs/troubleshooting_and_faqs/nextflow.md Co-authored-by: Chris Hakkaart Signed-off-by: Justine Geffen --- .../troubleshooting_and_faqs/nextflow.md | 6 ++++-- 1 file changed, 4 insertions(+), 2 deletions(-) diff --git a/platform-enterprise_docs/troubleshooting_and_faqs/nextflow.md b/platform-enterprise_docs/troubleshooting_and_faqs/nextflow.md index dad685a598..37335defc6 100644 --- a/platform-enterprise_docs/troubleshooting_and_faqs/nextflow.md +++ b/platform-enterprise_docs/troubleshooting_and_faqs/nextflow.md @@ -234,7 +234,7 @@ Because the default for Spot retries is now zero, you must enable a retry strate ## Pipeline secret creation fails under a Google Cloud resource location policy -In Google Cloud projects that enforce a resource location policy, launching a pipeline with a pipeline secret attached fails before any task starts. This affects Google Batch and Google Cloud compute environments. The error is similar to: +In Platform v26.1 and earlier, launching a pipeline with a pipeline secret attached fails before any task starts in Google Cloud projects that enforce a resource location policy. This affects Google Batch and Google Cloud compute environments. The error is similar to: ``` Unable to store pipeline secret 'my_secret' - Reason: io.grpc.StatusRuntimeException: @@ -242,7 +242,9 @@ FAILED_PRECONDITION: Constraint constraints/gcp.resourceLocations violated for [orgpolicy:projects/123456789012] attempting to create a secret in [global]. ``` -This issue occurs because Seqera Platform creates pipeline secrets in Google Secret Manager with automatic replication, which stores the secret in the `global` location. If the [`constraints/gcp.resourceLocations`](https://cloud.google.com/resource-manager/docs/organization-policy/defining-locations) organization policy does not permit the `global` location, Google rejects the secret and the run cannot launch. The compute environment's location setting has no effect on where the secret is stored. +This issue occurs because Platform v26.1 and earlier create pipeline secrets in Google Secret Manager with automatic replication, which stores the secret in the `global` location. If the [`constraints/gcp.resourceLocations`](https://cloud.google.com/resource-manager/docs/organization-policy/defining-locations) organization policy does not permit the `global` location, Google rejects the secret and the run cannot launch. The compute environment's location setting has no effect on where the secret is stored. + +This issue is resolved in Platform v26.2, which creates pipeline secrets with user-managed regional replication instead of automatic replication. ## Nextflow syntax parser