A Cloud Run revision deploys, but new instances cannot retrieve an environment secret

A worked Cloud Run example references an enabled Secret Manager version as an environment variable. The deployer’s account can access the secret. The service uses a dedicated runtime service account, and new instances fail around startup. Which identity and permission should be checked?

Inspect the service account configured on the revision and its access to the specific secret. The deployer’s access is not the same as the runtime identity’s access. Verify the secret’s full resource name, version state and appropriate Secret Manager Secret Accessor assignment.

For environment variables, secret retrieval occurs before the instance starts, so a retrieval failure can prevent startup. Review the relevant deployment and startup evidence without printing the secret. After a scoped permission correction, test a new instance and a representative application operation.

The secret is in another project. Does a role in the service project automatically cover it?

No. Check access to the actual secret resource in its project and use the correct cross-project reference.

Also verify the container’s ordinary startup requirements. Once secret access succeeds, a separate entrypoint or listening-port failure can still prevent the service from becoming healthy.

A Cloud Run revision deploys, but new instances cannot retrieve an environment secret

Sources & further reading

2 answers

Your perspective belongs here.

0 question comments