Cloud Run Secret Rotation with Secret Manager Volumes

The question requires managing a rotating password for a Cloud Run application. The key constraint is 'easy-to-manage' and 'rotated each week'.

Option A suggests baking the password into the Dockerfile as an environment variable. This is insecure because secrets are baked into the image layer, making them visible in container registries and difficult to rotate without rebuilding and redeploying the entire service every week. It violates security best practices.

Option B proposes using Secret Manager and injecting the secret as an environment variable at runtime. While Secret Manager is the correct service, Cloud Run injects secrets as environment variables only once at startup. If the application does not support dynamic reloading of environment variables from the OS level (which most do not natively handle via standard env vars), this approach fails for rotation without redeployment. More importantly, Cloud Run's documentation recommends mounting secrets as volumes for applications that need to read fresh credentials or rotate them frequently without restarts, or specifically notes that env var injection happens at start time.

Option C involves building a new container weekly with the secret embedded during build. This is operationally heavy and insecure for the same reasons as Option A: secrets are part of the image artifact. It is not an easy-to-manage solution.

Option D uses Secret Manager and mounts the secret as a volume. Cloud Run supports mounting Secrets Manager secrets as files in a container's filesystem. When the secret is updated in Secret Manager, the mounted file can be refreshed (depending on the mount configuration and application logic) or, more commonly, the application reads the file at runtime. For frequent rotations where the app needs to pick up new credentials without a full redeployment cycle (or if the app checks the file periodically), a mounted volume is the preferred mechanism over static environment variables. Even if the app requires a restart, using a volume is often cited in exam contexts as the 'correct' way to handle secrets that might change or need to be kept out of env vars. However, the primary distinction here is between baking secrets in images (A/C) vs using Secret Manager (B/D). Between B and D, mounting as a volume is often the recommended pattern for database passwords to avoid exposing them in process lists or logs, and allows the application to read the latest version if configured to poll or if the mount reflects updates. The comment provided by users also points to D, highlighting that A and C are incorrect due to security vulnerabilities.

Therefore, using Secret Manager and mounting the secret as a volume is the most secure and manageable approach among the choices.