Secrets & environment variables

Exam guide§2.1

Cloud Run passes configuration to your container in two ways: environment variables for non-sensitive settings, and secrets (backed by Secret Manager) for sensitive values like API keys and passwords.

Environment variables

Environment variables are key-value pairs injected into your application container and read by your code at runtime to control functionality. They are set when you create or update a service or job, or deploy a new revision - through the Google Cloud console, the gcloud CLI, a YAML file, or Terraform.

CommandsSet environment variables

# Service

gcloud run deploy my-service --image my-container-image-url \

--update-env-vars FOO=bar,BAZ=boo

 

# Job

gcloud run jobs create my-job --image my-container-image-url \

--update-env-vars FOO=bar,BAZ=boo

You read them with the standard library for your language:

Language	Access
Python	os.environ.get("key")
Node.js	process.env.key
Java	System.getenv("key")

⚠GotchaDockerfile ENV is overridden

You can set default environment variables in the image with the ENV statement in a Dockerfile. A variable set with the same name on the Cloud Run service or job overrides the Dockerfile default.

⚠GotchaReserved variables cannot be set

Some environment variables are reserved and cannot be set - they are listed in the container runtime contract.

Secrets

When your service needs sensitive configuration - API keys, passwords - store it in a secret in Secret Manager, the Google Cloud service for storing, managing, and accessing secrets.

≡FactsWhat a secret is

• A secret is an object holding a collection of metadata (replication locations, labels, permissions) plus one or more secret versions.
• A secret version stores the actual secret data - an API key or password - as a text string or binary blob.
• Secret Manager is the service that lets you store, manage, and access secrets.

Accessing a secret

Make the secret available to the service, then deploy or update with the specified secret. There are two ways to expose it:

CommandsExpose a secret to a service

# Secret mounted as a volume (a file)

gcloud run deploy my-service --image my-container-image \

--update-secrets SECRET_FILE_PATH=my_secret:VERSION

 

# Secret passed as an environment variable

gcloud run deploy my-service --image my-container-image \

--update-secrets ENV_VAR_NAME=my_secret:VERSION

?DECISIONMount as a volume, or pass as an env var?

• Volume: the secret appears to the container as a file. Reading the volume always fetches the value from Secret Manager, so it works well with the latest version.
• Environment variable: resolved once at instance startup, so pin the secret to a specific version rather than latest.

Pick this when: volume = need the latest value on every read; env var = pin to a fixed version

⚠GotchaUpdating a secret creates a new revision

Any configuration change, including updating secrets, creates a new service revision. Subsequent revisions automatically inherit the setting. You can do this in the console, with the gcloud CLI, or a YAML file.

Allowing access to secrets

A Cloud Run service runs as a service account - that is its identity. To let it read a secret, grant that service account the Secret Manager Secret Accessor role on the secret. The grant is a policy binding in the secret's IAM policy.

Cloud Run runs as a service account; granting that account the Secret Manager Secret Accessor role (a policy binding in the secret’s IAM policy) is what authorizes the service to read the secret.

CommandsGrant the Secret Accessor role

gcloud secrets add-iam-policy-binding my-secret-id \

--member="my-service-account-email" \

--role="roles/secretmanager.secretAccessor"

Recap

≡FactsSecrets & environment variables

• Environment variables are key-value pairs injected into the container and read by your code; set them on the service/job or a revision.
• A Dockerfile ENV default is overridden by a same-named variable set on the Cloud Run service or job.
• Use secrets (Secret Manager) to store and access sensitive information.
• Expose a secret by mounting it as a volume (fetches latest on read) or passing it as an environment variable (pin to a version).
• Grant the service account the Secret Manager Secret Accessor role to authorize access.