How to configure a different secret per instance in Cloud Run

Viewed 40

I have a service that is otherwise stateless except for one runtime configuration value, e.g. a flag like --secret-key. For each instance I want to provide a different value. Imagine I have a pool of secrets and when a new instance comes up, I'd like it to take a currently unused secret. Naturally this means there needs to be some kind of secrets lease management, heartbeating, etc.

Is this possible to configure with GCP Cloud Run? It is possible with k8s under the hood with StatefulSets, but I'm not sure if Cloud Run offers access to something like this.

1 Answers

It's not possible. All instances within the same Cloud Run Service are the same. Secrets configured on a Services are shared among all the instances during scale up. Unless you do some custom pluming you will not be able to achieve that out of the box

Related