Platforms
Envlet on Google Cloud
Cloud Run and Cloud Functions take ENVLET_TOKEN as one variable. Everything else comes from Envlet at boot.
ENVLET_TOKENset with gcloud
Set up
Three steps. The host keeps one secret and everything else arrives at boot.
- 01
Create a token
Add Google Cloud under Access and create a token for the environment it deploys.
ci/google-cloudciIts own token, separate from your login.- token
- envlet_•••••••• shown once
- opens
- one project, one environment
- expires
- always
- 02
Set one secret
Set ENVLET_TOKEN on the Cloud Run service or function.
Set the tokengcloud run services update api \ --update-env-vars ENVLET_TOKEN=envlet_... - 03
Start through Envlet
Inject at the top of your entrypoint before the framework reads settings.
Inject at bootfrom envlet import inject inject()
What the host keeps
One secret in Google Cloud. Rotate everything else in Envlet without touching the host.
Google Cloud / production / environment variables
| ENVLET_TOKEN | envlet_•••••••• | the only secret the host keeps |
| DATABASE_URL | •••••••• | moved to Envlet |
| STRIPE_KEY | •••••••• | moved to Envlet |
| SENTRY_DSN | •••••••• | moved to Envlet |
Questions
Will my app start if Envlet is down?
No. It retries for a few seconds, then fails so you notice. It never starts with half an environment.
Do I still need Google Cloud's own secret store?
Only for ENVLET_TOKEN. Everything else lives in Envlet, so you rotate in one place.