Using GCP secrets as part of cloud build - google-cloud-platform

Question

I'm trying to pass in confidential info into a bash script that is part of our cloud build process
I've followed the CloudBuild docs to try set it all up.
After many many different tires copied the docker example as a test even that is not working.
Here is what I have at the moment
*gcloud secrets list*
NAME CREATED REPLICATION_POLICY LOCATIONS
SECRET1 2021-08-18T04:37:47 automatic -
SECRET2 2021-08-18T04:38:11 automatic -
*gcloud secrets versions access latest --secret="SECRET1"*
Secret2Value
*gcloud secrets versions access latest --secret="SECRET2"*
Secret2Value
**cloudbuild.yaml**
steps:
- name: 'gcr.io/cloud-builders/docker'
entrypoint: 'bash'
args: ['-c', 'docker login --username=$$USERNAME --password=$$PASSWORD']
secretEnv: ['USERNAME', 'PASSWORD']
availableSecrets:
secretManager:
- versionName: projects/$PROJECT_ID/secrets/SECRET1/versions/1
env: 'PASSWORD'
- versionName: projects/$PROJECT_ID/secrets/SECRET2/versions/latest
env: 'USERNAME'
My understanding was that it would substituite the value of SECRET1 and SECRET2 into the USERNAME and PASSWORD envs but I'm getting $USERNAME and $PASSWORD
Arguments
bash -c docker login --username=$USERNAME --password=$PASSWORD
Feels like I've missed something simple yet fundamental
== Update ==
Here is the full build log
FETCHSOURCE
hint: Using 'master' as the name for the initial branch. This default branch name
hint: is subject to change. To configure the initial branch name to use in all
hint: of your new repositories, which will suppress this warning, call:
hint:
hint: git config --global init.defaultBranch <name>
hint:
hint: Names commonly chosen instead of 'master' are 'main', 'trunk' and
hint: 'development'. The just-created branch can be renamed via this command:
hint:
hint: git branch -m <name>
Initialized empty Git repository in /workspace/.git/
From https://source.developers.google.com/p/amiti-plex-can- dev/r/bitbucket_noldortech_amiti-payments
* branch a72363459d9ff5bed31411e960cc3e021febc322 -> FETCH_HEAD
HEAD is now at a723634 Secrets test 1
BUILD
Already have image (with digest): gcr.io/cloud-builders/docker
WARNING! Using --password via the CLI is insecure. Use --password-stdin.
Error response from daemon: Get "https://registry-1.docker.io/v2/": unauthorized: incorrect username or password
ERROR
ERROR: build step 0 "gcr.io/cloud-builders/docker" failed: step exited with non-zero status: 1
== Update 2==
After testing the echo commands below, I switched over to using a script, which is what I actually need.
**Yaml File:**
steps:
- name: 'gcr.io/cloud-builders/docker'
entrypoint: 'bash'
args: ['-c', 'echo Username=$$USERNAME && echo Password=$$PASSWORD']
secretEnv: ['USERNAME', 'PASSWORD']
- name: 'gcr.io/cloud-builders/docker'
entrypoint: 'bash'
args: ['cloudbuilds/script.sh', '$$USERNAME', '$$PASSWORD']
secretEnv: ['USERNAME', 'PASSWORD']
availableSecrets:
secretManager:
- versionName: projects/$PROJECT_ID/secrets/SECRET1/versions/1
env: 'PASSWORD'
- versionName: projects/$PROJECT_ID/secrets/SECRET2/versions/latest
env: 'USERNAME'
**Script:**
#/bin/bash
secretVar1="$1"
secretVar2="$2"
printf "\n\nVARIABLES\nSecret1: $secretVar1\nSecret2: $secretVar2\n\n"
**Build Log:**
BUILD
Starting Step #0
Step #0: Already have image (with digest): gcr.io/cloud-builders/docker
Step #0: Username=Secret2Value
Step #0: Password=Secret1Value
Finished Step #0
Starting Step #1
Step #1: Already have image (with digest): gcr.io/cloud-builders/docker
Step #1:
Step #1:
Step #1: VARIABLES
Step #1: Secret1: $USERNAME
Step #1: Secret2: $PASSWORD
Step #1:
Finished Step #1
PUSH
DONE

Answer 1

Finally got the correct yaml syntax to execute my script as I need
steps:
- name: 'gcr.io/cloud-builders/docker'
entrypoint: 'bash'
args: ['-c', ". ./cloudbuilds/script.sh $$SOMEVAR1 $$SOMEVAR2"]
secretEnv: ['SOMEVAR1', 'SOMEVAR2']
availableSecrets:
secretManager:
- versionName: projects/$PROJECT_ID/secrets/SECRET1/versions/1
env: 'SOMEVAR2'
- versionName: projects/$PROJECT_ID/secrets/SECRET2/versions/latest
env: 'SOMEVAR1'
BUILD
Already have image (with digest): gcr.io/cloud-builders/docker
VARIABLES
Secret1: Secret2Value
Secret2: Secret1Value
PUSH
DONE

Answer 2

USERNAME & PASSWORD are environment variables, for them to be expanded on the command line, you need to run the command via the shell. (Note that doing so is considered bad practice from a security perspective.)
This is why only the first step works in your second update.