Set blobstore, key manager, and secret manager in migrate (#1818)

builders/migrate.yaml

@@ -29,7 +29,6 @@ substitutions:
   _DB_SSLMODE:
   _DB_USER:
   _DB_VERIFICATION_CODE_DATABASE_KEY:
-  _KEY_MANAGER:
   _LOG_LEVEL:
   _REPO: 'github.com/google/exposure-notifications-verification-server'
   _TAG:
@@ -38,17 +37,19 @@ steps:
 - id: 'migrate'
   name: 'gcr.io/${PROJECT_ID}/${_REPO}/migrate:${_TAG}'
   env:
+  - 'BLOBSTORE=GOOGLE_CLOUD_STORAGE'
   - 'DB_APIKEY_DATABASE_KEY=${_DB_APIKEY_DATABASE_KEY}'
   - 'DB_APIKEY_SIGNATURE_KEY=${_DB_APIKEY_SIGNATURE_KEY}'
+  - 'DB_CONN=${_DB_CONN}'
   - 'DB_DEBUG=${_DB_DEBUG}'
   - 'DB_ENCRYPTION_KEY=${_DB_ENCRYPTION_KEY}'
   - 'DB_HOST=${_DB_HOST}'
-  - 'DB_CONN=${_DB_CONN}'
   - 'DB_NAME=${_DB_NAME}'
   - 'DB_PASSWORD=${_DB_PASSWORD}'
   - 'DB_PORT=${_DB_PORT}'
   - 'DB_SSLMODE=${_DB_SSLMODE}'
   - 'DB_USER=${_DB_USER}'
   - 'DB_VERIFICATION_CODE_DATABASE_KEY=${_DB_VERIFICATION_CODE_DATABASE_KEY}'
-  - 'KEY_MANAGER=${_KEY_MANAGER}'
+  - 'KEY_MANAGER=GOOGLE_CLOUD_KMS'
   - 'LOG_LEVEL=${_LOG_LEVEL}'
+  - 'SECRET_MANAGER=GOOGLE_SECRET_MANAGER'

scripts/migrate

@@ -36,7 +36,6 @@ SUBS="${SUBS},_DB_PORT=${DB_PORT:-"5432"}"
 SUBS="${SUBS},_DB_SSLMODE=${DB_SSLMODE:-"disable"}"
 SUBS="${SUBS},_DB_USER=${DB_USER:-"verification"}"
 SUBS="${SUBS},_DB_VERIFICATION_CODE_DATABASE_KEY=${DB_VERIFICATION_CODE_DATABASE_KEY}"
-SUBS="${SUBS},_KEY_MANAGER=${KEY_MANAGER:-"GOOGLE_CLOUD_KMS"}"
 SUBS="${SUBS},_LOG_LEVEL=${LOG_LEVEL:-"true"}"
 
 gcloud builds submit --no-source \