Environment variables and secrets in GCP - Practice Problems & Coding Challenges

Challenge - 5 Problems

❓ service_behavior

intermediate

How does Cloud Run handle environment variables set from Secret Manager?

You deploy a Cloud Run service and configure an environment variable to pull a secret from Secret Manager. What happens if the secret is updated after deployment?

A The Cloud Run service automatically fetches the updated secret without redeployment.

B The service crashes because the secret value changes dynamically.

C The environment variable keeps the old secret value until the service is redeployed.

D The secret value is updated only if the Cloud Run service is manually restarted.

💡 Hint

Think about how environment variables are loaded during service startup.

Cloud Run loads environment variables at startup. If a secret changes in Secret Manager, the running service does not see the update until redeployed or restarted.

❓ security

intermediate

Which IAM role is required to allow a Cloud Function to access secrets from Secret Manager?

You want a Cloud Function to read secrets from Secret Manager securely. Which IAM role should you assign to the Cloud Function's service account?

A roles/secretmanager.admin

B roles/secretmanager.secretAccessor

C roles/secretmanager.viewer

D roles/secretmanager.secretVersionAdder

💡 Hint

Consider the least privilege principle for reading secrets.

The role roles/secretmanager.secretAccessor allows reading secret payloads. Admin and viewer roles have broader or different permissions. secretVersionAdder is for adding versions, not reading.

❓ Configuration

advanced

What is the correct way to inject a secret as an environment variable in a Cloud Run service using gcloud CLI?

You want to deploy a Cloud Run service and inject a secret named API_KEY from Secret Manager as an environment variable API_KEY. Which gcloud command is correct?

A gcloud run deploy my-service --image=gcr.io/my-project/my-image --set-secret-env API_KEY=API_KEY:latest

B gcloud run deploy my-service --image=gcr.io/my-project/my-image --set-env-vars API_KEY=projects/my-project/secrets/API_KEY/versions/latest

C gcloud run deploy my-service --image=gcr.io/my-project/my-image --update-secrets API_KEY=API_KEY:latest

D gcloud run deploy my-service --image=gcr.io/my-project/my-image --set-secrets API_KEY=API_KEY:latest

💡 Hint

Check the gcloud flag that specifically injects secrets as environment variables.

The flag --set-secrets injects secrets from Secret Manager as environment variables. The syntax is ENV_VAR=SECRET_NAME:VERSION. Other flags are invalid or do not exist.

❓ Architecture

advanced

Which architecture best protects secrets used by multiple microservices in GCP?

You have multiple microservices running on GKE and Cloud Run that need access to the same secrets. What is the best architecture to manage and secure these secrets?

A Use Secret Manager to centrally store secrets and grant each service's identity access to read them.

B Store secrets in environment variables directly in each service deployment manifest.

C Embed secrets in container images so services can read them locally.

D Store secrets in a shared Cloud Storage bucket with public read access.

💡 Hint

Think about central management and least privilege access.

Secret Manager provides a secure, centralized way to store secrets. Granting each service's identity access follows best security practices. Environment variables and container images are less secure. Public buckets expose secrets to everyone.

✅ Best Practice

expert

What is the recommended practice for rotating secrets used by Cloud Run services without downtime?

You want to rotate secrets used as environment variables in Cloud Run services without causing downtime. Which approach follows best practices?

A Deploy a new Cloud Run revision referencing the new secret version, then gradually shift traffic to it.

B Update the secret in Secret Manager and redeploy the Cloud Run service with the new secret version.

C Change the secret in Secret Manager and rely on Cloud Run to automatically refresh environment variables.

D Update the secret in Secret Manager and restart the Cloud Run service manually to pick up the new secret.

💡 Hint

Consider how Cloud Run handles revisions and traffic splitting.

Cloud Run does not automatically refresh environment variables from secrets. Deploying a new revision with the updated secret and shifting traffic gradually avoids downtime and allows rollback if needed.