A Cloud Run revision deploys, but new instances cannot retrieve an environment secret

0 reputation · 03 Feb 2026, 04:37 UTC

64.1K views2

A worked Cloud Run example references an enabled Secret Manager version as an environment variable. The deployer’s account can access the secret. The service uses a dedicated runtime service account, and new instances fail around startup. Which identity and permission should be checked?

Environment

Editorial worked example. See the question for the scenario and assumptions.

Keep exploring this topic

Why do Cloud Run instances see different values when an environment secret uses latest?

A fictional service exposes a secret through an environment variable using latest. After rotation, older instances keep working with the previous credential while newly started instances use the new one. The application team expected an immediate, simultaneous update. What deployment approach gives a more predictable result?

Google IAM Policy Troubleshooter says allowed, but a storage request still fails

A service’s storage request is denied. In this illustrative case, Policy Troubleshooter reports that the named principal has the permission on the resource. The team has not checked whether the actual call crosses a VPC Service Controls boundary. Does the allowed result settle the whole access question?

A non-root Cloud Run container starts but cannot read its mounted secret file

An example container was changed to run as a non-root user. It starts, but reading a mounted Secret Manager file fails. The team verified that the runtime service account has secret access. What should be checked next, and why is this different from an environment-secret startup failure?

Cloud Run configuration shift for low‑traffic workloads cost reduction

How to cut Cloud Run costs for a low‑traffic workload by adjusting service settings while preserving responsiveness.

Inspect the service account configured on the revision and its access to the specific secret. The deployer’s access is not the same as the runtime identity’s access. Verify the secret’s full resource name, version state and appropriate Secret Manager Secret Accessor assignment.

For environment variables, secret retrieval occurs before the instance starts, so a retrieval failure can prevent startup. Review the relevant deployment and startup evidence without printing the secret. After a scoped permission correction, test a new instance and a representative application operation.

A Cloud Run revision deploys, but new instances cannot retrieve an environment secret

2 answers

Your perspective belongs here.

0 question comments