Environment variables and secrets in GCP - Step-by-Step Execution

Process Flow - Environment variables and secrets

Start Deployment

↓

Load Environment Variables

↓

Check for Secrets

↓

No

↓

Use Vars

↓

Inject into App

↓

App Runs with Config

↓

End

This flow shows how environment variables and secrets are loaded and injected into a GCP app during deployment.

Execution Sample

GCP

export DB_PASSWORD="$(gcloud secrets versions access latest --secret=DB_PASSWORD)"
python app.py

This code fetches the latest secret value for DB_PASSWORD from GCP Secret Manager, sets it as an environment variable, then runs the app.

Process Table

Step	Action	Command/Check	Result/Value
1	Start deployment	N/A	Deployment begins
2	Load environment variables	Check local env vars	Found APP_PORT=8080
3	Check for secrets	Is DB_PASSWORD secret needed?	Yes
4	Fetch secret	gcloud secrets versions access latest --secret=DB_PASSWORD	Secret value retrieved
5	Set environment variable	export DB_PASSWORD=secret_value	DB_PASSWORD set in env
6	Run application	python app.py	App starts with env vars and secrets
7	App behavior	App connects to DB using DB_PASSWORD	Connection successful

💡 App runs successfully with environment variables and secrets injected

Status Tracker

Variable	Start	After Step 2	After Step 5	Final
APP_PORT	undefined	8080	8080	8080
DB_PASSWORD	undefined	undefined	secret_value	secret_value

Key Moments - 2 Insights

Why do we fetch secrets from Secret Manager instead of setting them directly as environment variables?

Secrets are sensitive data. Fetching them securely at runtime (see step 4 in execution_table) avoids exposing them in code or config files.

What happens if the secret is missing or access is denied?

The fetch command (step 4) will fail, causing deployment or app start to fail, preventing the app from running with missing credentials.

Visual Quiz - 3 Questions

Look at the execution_table, what is the value of DB_PASSWORD after step 2?

A undefined

B secret_value

C APP_PORT

D latest

💡 Hint

Check the variable_tracker row for DB_PASSWORD after Step 2

At which step does the app start running with environment variables and secrets?

A Step 5

B Step 6

C Step 4

D Step 7

💡 Hint

Look at the execution_table action column for when 'Run application' happens

If the secret fetch command fails, what will most likely happen?

A App runs with default password

B Secret is set to empty string

C Deployment or app start fails

D App ignores the missing secret

💡 Hint

Refer to key_moments about missing secret consequences

Concept Snapshot

Environment variables store config data for apps.
Secrets hold sensitive info securely.
In GCP, secrets are fetched from Secret Manager at runtime.
Set secrets as env vars before app start.
This keeps secrets safe and apps configurable.

Full Transcript

This visual execution shows how environment variables and secrets work in Google Cloud Platform. First, deployment starts and environment variables are loaded. Then the system checks if secrets like DB_PASSWORD are needed. If yes, it fetches the secret securely from Secret Manager. The secret value is set as an environment variable. Finally, the app runs using these variables and connects to services like databases. If secrets are missing or inaccessible, the app will not start, protecting sensitive data. This process keeps configuration flexible and secrets safe.