Environment variables and secrets in GCP - Mini Project: Build & Apply

Environment variables and secrets

📖 Scenario: You are deploying a simple web application on Google Cloud Platform (GCP). The app needs to use environment variables to store configuration values and secrets to keep sensitive data safe.Using environment variables and secrets helps keep your app secure and flexible, just like keeping your house keys safe and only sharing them with trusted people.

🎯 Goal: Set up environment variables and secrets for a GCP Cloud Run service. You will create environment variables for non-sensitive data and use Google Secret Manager to securely provide sensitive data to the service.

📋 What You'll Learn

Create a Cloud Run service configuration dictionary named cloud_run_service with a container named webapp.

Add an environment variable APP_MODE with value production to the container.

Create a secret environment variable DB_PASSWORD referencing the secret named db_password_secret from Google Secret Manager.

Add the secret environment variable to the container's environment variables.

💡 Why This Matters

🌍 Real World

Using environment variables and secrets is a common practice to keep configuration and sensitive data secure and separate from code in cloud deployments.

💼 Career

Cloud engineers and developers often configure environment variables and secrets to manage app settings and credentials securely in production environments.

1

Create initial Cloud Run service configuration

Create a dictionary called cloud_run_service with a key containers that holds a list with one dictionary. This dictionary should have a key name set to webapp and an empty list for env.

GCP

# Create cloud_run_service dictionary with containers list containing one container named 'webapp' and empty env list
# Your code here

Need a hint?

Think of cloud_run_service as a box holding your app's settings. Inside, you have a list of containers. Each container has a name and a list of environment variables.

2

Add a non-secret environment variable

Add an environment variable dictionary with name set to APP_MODE and value set to production to the env list of the container named webapp inside cloud_run_service.

GCP

cloud_run_service = {
    'containers': [
        {
            'name': 'webapp',
            'env': []
        }
    ]
}
# Add APP_MODE environment variable to the env list
# Your code here

Need a hint?

Environment variables are key-value pairs. Add one with key APP_MODE and value production inside the container's env list.

3

Create a secret environment variable reference

Create a dictionary called secret_env_var with name set to DB_PASSWORD and valueFrom set to a dictionary with key secretKeyRef. This secretKeyRef dictionary should have name set to db_password_secret and key set to latest.

GCP

cloud_run_service = {
    'containers': [
        {
            'name': 'webapp',
            'env': [
                {
                    'name': 'APP_MODE',
                    'value': 'production'
                }
            ]
        }
    ]
}
# Create secret_env_var dictionary referencing db_password_secret
# Your code here

Need a hint?

Secrets are referenced differently. Use valueFrom with secretKeyRef to point to the secret's name and key.

4

Add the secret environment variable to the container

Append the secret_env_var dictionary to the env list of the container named webapp inside cloud_run_service.

GCP

cloud_run_service = {
    'containers': [
        {
            'name': 'webapp',
            'env': [
                {
                    'name': 'APP_MODE',
                    'value': 'production'
                }
            ]
        }
    ]
}

secret_env_var = {
    'name': 'DB_PASSWORD',
    'valueFrom': {
        'secretKeyRef': {
            'name': 'db_password_secret',
            'key': 'latest'
        }
    }
}
# Add secret_env_var to the env list of the webapp container
# Your code here

Need a hint?

Use the append() method to add the secret environment variable to the container's env list.