Update Cloud Run instance on secret update

Question

On GCP, I'm using Cloud Run with secrets with environment variables from Secret Manager.

How to efficiently update Cloud Run instance when I'm updating a secret ?

I tried with this Terraform code, no success :

// run.tf
module "cloud-run-app" {
  source  = "GoogleCloudPlatform/cloud-run/google"
  version = "~> 0.0"

  service_name          = "${local.main_project}-cloudrun"
  location              = local.region
  image                 = local.cloudrun_image
  project_id            = local.main_project
  env_vars              = local.envvars_injection
  env_secret_vars       = local.secrets_injection
  service_account_email = google_service_account.app.email
  ports                 = local.cloudrun_port
  service_annotations = {
    "run.googleapis.com/ingress" : "internal-and-cloud-load-balancing"
  }
  service_labels = {
    "env_type" = var.env_name
  }
  template_annotations = {
    "autoscaling.knative.dev/maxScale" : local.cloudrun_app_max_scale,
    "autoscaling.knative.dev/minScale" : local.cloudrun_app_min_scale,
    "generated-by" : "terraform",
    "run.googleapis.com/client-name" : "terraform"
  }
  depends_on = [
    google_project_iam_member.run_gcr,
    google_project_iam_member.app_secretmanager,
    google_secret_manager_secret_version.secrets
  ]
}

// secrets.tf
resource "google_secret_manager_secret" "secrets" {
  for_each  = local.secrets_definition
  secret_id = each.key
  replication {
    automatic = true
  }
}

resource "google_secret_manager_secret_version" "secrets" {
  for_each    = local.secrets_definition
  secret      = google_secret_manager_secret.secrets["${each.key}"].name
  secret_data = each.value
}

Answer 1

The trick here is to mount the secret as a volume (a file) and not as an environment variable.

If you do that, point your secret version to the latest version, and read the file every time you need the secret content, you will read the latest version. Without reloading the Cloud Run instance or redeploying a version.