Google Cloud Run

Sync secrets into a Cloud Run service's environment variables.

The connection

What	This provider
Vendor	Google Cloud
Key	`gcp-cloud-run-env`
Availability	`available`. You can connect it today.
Credential penv holds	`gcp-service-account`
Values read back	yes
Activation	`on-next-deploy`

Direction	What it does
`import`	Reads names and values out of the store into penv.
`export`	Writes names and values from penv into the store.

on-next-deploy. A new value waits there and arrives with your next deploy.

Direction	Policies you can pick
`import`	`skip_existing`, `new_version`, `fail`
`export`	`create_only`, `overwrite`, `overwrite_and_prune`

How syncs work says what each one does.

You paste a credential you already hold. penv seals it and never shows it again.

Field	Label	Kind	Required	What it is
`serviceAccountKey`	Service account key	secret, masked here and sealed	yes	The JSON key file for a service account that can update this service.

Fixed when you connect, and shared by every mapping on it.

Field	Label	Kind	Required	Advanced	What it is
`projectId`	Project	text	yes	no	The project holding the service. One connection covers one project.
`region`	Region	text	yes	no	The region this connection reaches. One connection covers one region.

Answered once per environment you map.

Field	Label	Kind	Required	Advanced	What it is
`serviceName`	Service	text	yes	no	The Cloud Run service whose variables this environment maps onto. Import needs literal values; a Secret Manager reference cannot be read back.

penv probes for these when it verifies the connection.

Permission	Directions	Blocking	Without it
`run.services.get`	every direction	yes	Preview cannot list the service's variables.
`run.services.list`	every direction	no	We cannot confirm the key reaches this project and region before a sync runs.
`run.services.update`	`export`	yes	Export cannot write anything.
`run.operations.get`	`export`	no	We cannot confirm the new revision went live.