Why do Cloud Run instances see different values when an environment secret uses latest?

0 reputation · 26 Jun 2023, 20:17 UTC

109.5K views2

A fictional service exposes a secret through an environment variable using latest. After rotation, older instances keep working with the previous credential while newly started instances use the new one. The application team expected an immediate, simultaneous update. What deployment approach gives a more predictable result?

Environment

Editorial worked example. See the question for the scenario and assumptions.

Keep exploring this topic

A Cloud Run revision deploys, but new instances cannot retrieve an environment secret

A worked Cloud Run example references an enabled Secret Manager version as an environment variable. The deployer’s account can access the secret. The service uses a dedicated runtime service account, and new instances fail around startup. Which identity and permission should be checked?

Google IAM Policy Troubleshooter says allowed, but a storage request still fails

A service’s storage request is denied. In this illustrative case, Policy Troubleshooter reports that the named principal has the permission on the resource. The team has not checked whether the actual call crosses a VPC Service Controls boundary. Does the allowed result settle the whole access question?

A non-root Cloud Run container starts but cannot read its mounted secret file

An example container was changed to run as a non-root user. It starts, but reading a mounted Secret Manager file fails. The team verified that the runtime service account has secret access. What should be checked next, and why is this different from an environment-secret startup failure?

Cloud Run configuration shift for low‑traffic workloads cost reduction

How to cut Cloud Run costs for a low‑traffic workload by adjusting service settings while preserving responsiveness.

Environment-secret values are resolved at instance startup. Running instances do not automatically replace their environment when another version becomes latest. Pin a specific secret version for the revision and roll out the new configuration deliberately, as Google recommends for environment variables.

Plan the overlap with the downstream service so both credentials can be accepted during migration if supported. Verify a new revision before moving traffic, keep a rollback path and retire the old credential after the transition. Do not assume that autoscaling provides a coordinated secret rotation.

Why do Cloud Run instances see different values when an environment secret uses latest?

2 answers

Your perspective belongs here.

0 question comments