How to deal with secrets in app.yaml and not putting it in GIT?

Question

Google Cloud Platform doesn't describe how to deal with environmental variables in your app.yaml.

Starting up with GCP and Google App Engine, I read about setting my config variables in app.yaml which makes sense in a way, but I don't want to put my password/secrets/keys/etc in my GIT repository.

Presuming that @Google's engineers are smart enough to not want this either, I'd guess that the best practise would be to put app.yaml in .gitignore.

Executing gcloud app deploy results in a perfectly working app. But it still it remains an unfinished issue to me and I strongly believe there should be a article somewhere that describes what the best practise is.

Can someone confirm that:

1. putting app.yaml in .gitignore, and then,
2. set my secrets in app.yaml, and then,
3. performing gcloud app deploy

is the way to go?

Answer 1

You should use rails environment variables.

Before Rails 5.2

You can use dotenv

With Rails 5.2

You can use both dotenv and rails credentials.

With rails credentials:

1. Add secret_key_base variable to the credentials file.

2. Use secret_key_base variable in the app.yaml file:

   env_variables:
   
     SECRET_KEY_BASE: <% = Rails.application.credentials[:secret_key_base] %>
   

Google's configuration document

Rails credentials

EDIT

Adding and updating environment variables for Google Cloud Platform

Answer 2

I would suggest you rather than put your config to app.yaml file to use something like config server spring boot example, that you'll easy setup to fetch you config parameters from git, or database or vault(for sensitive data). Also you could consider store you parameters in appengine memcache on in some storage like datastore.

For now in our project we're just appending app.yaml with env_variables section in one of our pipeline's steps before deploying. Using Teamcity for build, Vault for storing secrets. Teamcity has build in Vault integration. But I'd like to change it to use config server in nearest future.