docs: GCP secrets resource locations

platform-cloud/docs/secrets/overview.md

@@ -187,3 +187,11 @@ You must [enable Google Secret Manager](https://cloud.google.com/secret-manager/
 See the [Google documentation](https://cloud.google.com/secret-manager/docs/access-control) for permission configuration instructions to integrate with Google Secret Manager.
 
 Seqera Platform requires `roles/secretmanager.admin` permissions in the project where it will manage your secrets. Ensure that your compute environment contains credentials with this access role for the same `project_id` listed in the service account JSON file.
+
+### Secret replication
+
+Seqera Platform creates pipeline secrets in Google Secret Manager with user-managed replication, stored in the same region as the compute environment that runs the pipeline. For Google Batch compute environments, this is the compute environment's location (`us-central1` when no location is set). For Google Cloud compute environments, this is the compute environment's region. As secrets are not stored in the `global` location, secret creation succeeds in projects that enforce the [`constraints/gcp.resourceLocations`](https://cloud.google.com/resource-manager/docs/organization-policy/defining-locations) organization policy.
+
+:::note
+Each secret is stored in a single region. If Google Secret Manager is unavailable in that region, secret creation fails and the run does not launch.
+:::

platform-enterprise_docs/secrets/overview.md

@@ -180,3 +180,7 @@ You must [enable Google Secret Manager](https://cloud.google.com/secret-manager/
 See the [Google documentation](https://cloud.google.com/secret-manager/docs/access-control) for permission configuration instructions to integrate with Google Secret Manager.
 
 Seqera Platform requires `roles/secretmanager.admin` permissions in the project where it will manage your secrets. Ensure that your compute environment contains credentials with this access role for the same `project_id` listed in the service account JSON file.
+
+:::caution
+Seqera Platform creates pipeline secrets in Google Secret Manager with automatic replication, which stores the secret in the `global` location. If your project enforces the [`constraints/gcp.resourceLocations`](https://cloud.google.com/resource-manager/docs/organization-policy/defining-locations) organization policy and does not permit the `global` location, secret creation fails and pipelines with a secret attached cannot launch.
+:::

platform-enterprise_docs/troubleshooting_and_faqs/nextflow.md

@@ -232,6 +232,20 @@ If you rely on silent Spot retries (the previous default), you might now see mor
 
 Because the default for Spot retries is now zero, you must enable a retry strategy for Nextflow to handle reclaimed Spot instances automatically. For more information, see [manage Spot interruptions](../tutorials/retry-strategy).
 
+## Pipeline secret creation fails under a Google Cloud resource location policy
+
+In Platform v26.1 and earlier, launching a pipeline with a pipeline secret attached fails before any task starts in Google Cloud projects that enforce a resource location policy. This affects Google Batch and Google Cloud compute environments. The error is similar to:
+
+```
+Unable to store pipeline secret 'my_secret' - Reason: io.grpc.StatusRuntimeException:
+FAILED_PRECONDITION: Constraint constraints/gcp.resourceLocations violated for
+[orgpolicy:projects/123456789012] attempting to create a secret in [global].
+```
+
+This issue occurs because Platform v26.1 and earlier create pipeline secrets in Google Secret Manager with automatic replication, which stores the secret in the `global` location. If the [`constraints/gcp.resourceLocations`](https://cloud.google.com/resource-manager/docs/organization-policy/defining-locations) organization policy does not permit the `global` location, Google rejects the secret and the run cannot launch. The compute environment's location setting has no effect on where the secret is stored.
+
+This issue is resolved in Platform v26.2, which creates pipeline secrets with user-managed regional replication instead of automatic replication.
+
 ## Nextflow syntax parser
 
 Up to version 25.10, Nextflow uses the v1 syntax parser (also known as the legacy parser) by default. The v2 parser introduces stricter validation and is available as an opt-in through `NXF_SYNTAX_PARSER=v2`.

platform-enterprise_versioned_docs/version-26.1/secrets/overview.md

@@ -169,3 +169,7 @@ You must [enable Google Secret Manager](https://cloud.google.com/secret-manager/
 See the [Google documentation](https://cloud.google.com/secret-manager/docs/access-control) for permission configuration instructions to integrate with Google Secret Manager.
 
 Seqera Platform requires `roles/secretmanager.admin` permissions in the project where it will manage your secrets. Ensure that your compute environment contains credentials with this access role for the same `project_id` listed in the service account JSON file.
+
+:::caution
+Seqera Platform creates pipeline secrets in Google Secret Manager with automatic replication, which stores the secret in the `global` location. If your project enforces the [`constraints/gcp.resourceLocations`](https://cloud.google.com/resource-manager/docs/organization-policy/defining-locations) organization policy and does not permit the `global` location, secret creation fails and pipelines with a secret attached cannot launch. No workaround is available in Seqera Platform.
+:::

platform-enterprise_versioned_docs/version-26.1/troubleshooting_and_faqs/nextflow.md

@@ -228,6 +228,18 @@ If you rely on silent Spot retries (the previous default behavior), you may now
 
 Since the default for Spot retries is now zero, you must actively enable a retry strategy if you want Nextflow to handle reclaimed Spot instances automatically. For more information, see [manage Spot interruptions](../tutorials/retry-strategy).
 
+### Pipeline secret creation fails under a Google Cloud resource location policy
+
+In Google Cloud projects that enforce a resource location policy, launching a pipeline with a pipeline secret attached fails before any task starts. This affects Google Batch and Google Cloud compute environments. The error is similar to:
+
+```
+Unable to store pipeline secret 'my_secret' - Reason: io.grpc.StatusRuntimeException:
+FAILED_PRECONDITION: Constraint constraints/gcp.resourceLocations violated for
+[orgpolicy:projects/123456789012] attempting to create a secret in [global].
+```
+
+This issue occurs because Seqera Platform creates pipeline secrets in Google Secret Manager with automatic replication, which stores the secret in the `global` location. If the [`constraints/gcp.resourceLocations`](https://cloud.google.com/resource-manager/docs/organization-policy/defining-locations) organization policy does not permit the `global` location, Google rejects the secret and the run cannot launch. The compute environment's location setting has no effect on where the secret is stored.
+
 ### Nextflow syntax parser
 
 Up to version 25.10, Nextflow uses the v1 syntax parser (also known as the legacy parser) by default. The v2 parser introduces stricter validation and is available as an opt-in via `NXF_SYNTAX_PARSER=v2`.