Why do Cloud Run instances see different values when an environment secret uses latest?

A fictional service exposes a secret through an environment variable using latest. After rotation, older instances keep working with the previous credential while newly started instances use the new one. The application team expected an immediate, simultaneous update. What deployment approach gives a more predictable result?

Environment-secret values are resolved at instance startup. Running instances do not automatically replace their environment when another version becomes latest. Pin a specific secret version for the revision and roll out the new configuration deliberately, as Google recommends for environment variables.

Plan the overlap with the downstream service so both credentials can be accepted during migration if supported. Verify a new revision before moving traffic, keep a rollback path and retire the old credential after the transition. Do not assume that autoscaling provides a coordinated secret rotation.

No. The mounted mechanism and the application’s read behavior are separate. If the process caches the file contents, it needs an explicit refresh strategy.

If the old credential was revoked immediately, failures may depend on which instances receive traffic. Check revision and instance timing before attributing the issue to random network errors.

Why do Cloud Run instances see different values when an environment secret uses latest?

2 answers

Your perspective belongs here.

0 question comments