Environment variables and secrets in GCP - Step-by-Step Execution

Process Flow - Environment variables and secrets

Start Deployment

↓

Load Environment Variables

↓

Check for Secrets

↓

No

↓

Use Vars

↓

Inject into App

↓

App Runs with Config

↓

End

This flow shows how environment variables and secrets are loaded and injected into a GCP app during deployment.

Execution Sample

GCP

export DB_PASSWORD="$(gcloud secrets versions access latest --secret=DB_PASSWORD)"
python app.py

This code fetches the latest secret value for DB_PASSWORD from GCP Secret Manager, sets it as an environment variable, then runs the app.

Process Table

Step	Action	Command/Check	Result/Value
1	Start deployment	N/A	Deployment begins
2	Load environment variables	Check local env vars	Found APP_PORT=8080
3	Check for secrets	Is DB_PASSWORD secret needed?	Yes
4	Fetch secret	gcloud secrets versions access latest --secret=DB_PASSWORD	Secret value retrieved
5	Set environment variable	export DB_PASSWORD=secret_value	DB_PASSWORD set in env
6	Run application	python app.py	App starts with env vars and secrets
7	App behavior	App connects to DB using DB_PASSWORD	Connection successful

💡 App runs successfully with environment variables and secrets injected

Status Tracker

Variable	Start	After Step 2	After Step 5	Final
APP_PORT	undefined	8080	8080	8080
DB_PASSWORD	undefined	undefined	secret_value	secret_value

Key Moments - 2 Insights

Why do we fetch secrets from Secret Manager instead of setting them directly as environment variables?

Secrets are sensitive data. Fetching them securely at runtime (see step 4 in execution_table) avoids exposing them in code or config files.

What happens if the secret is missing or access is denied?

The fetch command (step 4) will fail, causing deployment or app start to fail, preventing the app from running with missing credentials.

Visual Quiz - 3 Questions

Look at the execution_table, what is the value of DB_PASSWORD after step 2?

A undefined

B secret_value

C APP_PORT

D latest

💡 Hint

Check the variable_tracker row for DB_PASSWORD after Step 2

At which step does the app start running with environment variables and secrets?

A Step 5

B Step 6

C Step 4

D Step 7

💡 Hint

Look at the execution_table action column for when 'Run application' happens

If the secret fetch command fails, what will most likely happen?

A App runs with default password

B Secret is set to empty string

C Deployment or app start fails

D App ignores the missing secret

💡 Hint

Refer to key_moments about missing secret consequences

Concept Snapshot

Environment variables store config data for apps.
Secrets hold sensitive info securely.
In GCP, secrets are fetched from Secret Manager at runtime.
Set secrets as env vars before app start.
This keeps secrets safe and apps configurable.

Full Transcript

This visual execution shows how environment variables and secrets work in Google Cloud Platform. First, deployment starts and environment variables are loaded. Then the system checks if secrets like DB_PASSWORD are needed. If yes, it fetches the secret securely from Secret Manager. The secret value is set as an environment variable. Finally, the app runs using these variables and connects to services like databases. If secrets are missing or inaccessible, the app will not start, protecting sensitive data. This process keeps configuration flexible and secrets safe.

Practice

1. What is the main purpose of environment variables in a Google Cloud application?

easy

A. To permanently save user data in the cloud

B. To create virtual machines automatically

C. To encrypt all data sent over the network

D. To store configuration values that the app can use at runtime

Solution

1. Step 1: Understand environment variables

   Environment variables hold configuration values like API URLs or feature flags that apps read when running.

2. Step 2: Eliminate distractor options

   Permanent data storage, network encryption, and VM creation are unrelated to environment variables.

3. Final Answer:

   To store configuration values that the app can use at runtime -> Option D

4. Quick Check:

   Environment variables = config values [OK]

Hint: Environment variables hold settings your app reads [OK]

Common Mistakes:

• Confusing environment variables with data storage
• Thinking environment variables encrypt data
• Mixing environment variables with cloud resource creation

2. Which of the following is the correct way to set an environment variable named API_KEY with value 12345 in a Google Cloud Run service YAML?

easy

A. env:
- name: API_KEY
value: '12345'

B. environment_variables:
API_KEY: 12345

C. variables:
API_KEY = '12345'

D. set_env:
API_KEY: '12345'

Solution

1. Step 1: Recall Cloud Run YAML env syntax

   Cloud Run uses the env list with name and value keys to set environment variables.

2. Step 2: Check options for correct YAML format

   env: - name: API_KEY value: '12345' matches the correct syntax. Other options use incorrect keys or formats not supported by Cloud Run.

3. Final Answer:

   env: - name: API_KEY value: '12345' -> Option A

4. Quick Check:

   Cloud Run env uses name and value keys [OK]

Hint: Look for 'env' with name and value keys in YAML [OK]

Common Mistakes:

• Using incorrect keys like environment_variables or variables
• Assigning values with '=' instead of colon
• Not using a list for env variables

3. Given this Python code snippet running in a Google Cloud Function:

import os
api_key = os.getenv('API_KEY')
print(f"Key: {api_key}")

If the environment variable API_KEY is not set, what will be printed?

medium

A. Key: API_KEY

B. Key:

C. Key: None

D. Error: Environment variable not found

Solution

1. Step 1: Understand os.getenv behavior

   When the environment variable is missing, os.getenv returns None by default.

2. Step 2: Analyze the print output

   The f-string converts None to the string 'None', so the output is 'Key: None'.

3. Final Answer:

   Key: None -> Option C

4. Quick Check:

   Missing env var returns None [OK]

Hint: os.getenv returns None if variable missing [OK]

Common Mistakes:

• Assuming empty string is returned
• Expecting an error to be raised
• Thinking variable name is printed

4. You deployed a Cloud Run service that uses a secret from Secret Manager, but the service fails to access the secret. Which is the most likely cause?

medium

A. The Cloud Run service account lacks permission to access the secret

B. The secret value is empty

C. The environment variable name is misspelled in the code

D. The secret was created in a different Google Cloud project

Solution

1. Step 1: Check permissions for Secret Manager access

   Cloud Run uses a service account that must have Secret Manager access roles to read secrets.

2. Step 2: Evaluate other options

   While empty secret values, misspelled variable names, or secrets in different projects can cause issues, the most common cause is missing permissions blocking secret access.

3. Final Answer:

   The Cloud Run service account lacks permission to access the secret -> Option A

4. Quick Check:

   Missing permissions block secret access [OK]

Hint: Check service account permissions first [OK]

Common Mistakes:

• Ignoring IAM roles for service accounts
• Assuming secret value is always the problem
• Not verifying project alignment for secrets

5. You want to securely provide a database password to a Google Cloud Run service without hardcoding it. Which approach follows best practices?

hard

A. Hardcode the password in the Cloud Run service YAML file

B. Store the password in Secret Manager and mount it as an environment variable in Cloud Run

C. Save the password in a public Google Cloud Storage bucket and read it at runtime

D. Send the password as a query parameter in API requests

Solution

1. Step 1: Identify secure secret storage

   Google Secret Manager is designed to store sensitive info like passwords securely.

2. Step 2: Use environment variables for app access

   Mounting secrets as environment variables in Cloud Run keeps secrets out of code and config files.

3. Step 3: Evaluate other options

   Hardcoding, public storage, or sending passwords in URLs expose secrets and are insecure.

4. Final Answer:

   Store the password in Secret Manager and mount it as an environment variable in Cloud Run -> Option B

5. Quick Check:

   Secret Manager + env vars = secure best practice [OK]

Hint: Use Secret Manager and env vars, never hardcode secrets [OK]

Common Mistakes:

• Hardcoding secrets in config files
• Using public storage for sensitive data
• Exposing secrets in URLs or logs