在Terraform中为多个GCP Cloud Run服务配置差异化环境变量的最佳方案

核心思路是扩展服务定义变量结构+动态生成env配置块，无需拆分资源块即可实现每个服务的环境变量按需注入：

第一步：调整cloudrun_services变量结构 #

在variables.tf中修改该变量的类型定义，为每个服务新增普通环境变量、机密环境变量两个可选属性，同时增加CloudSQL依赖开关控制对应注解：

variable "cloudrun_services" {
  type = map(object({
    image                = string
    email                = string
    # 新增：普通环境变量，键为变量名，值为明文值
    env_vars             = optional(map(string), {})
    # 新增：机密环境变量，键为变量名，值为Secret Manager中的secret名称
    secret_env_vars      = optional(map(string), {})
    # 新增：是否需要挂载CloudSQL连接，控制对应注解和环境变量
    enable_cloudsql      = optional(bool, false)
    # 新增：是否需要VPC连接器，按需开关
    enable_vpc_connector = optional(bool, true)
  }))
  description = "Map of Cloud Run services and their configurations"
}

第二步：改造Cloud Run资源定义，使用dynamic块动态生成环境变量 #

替换原来硬编码的所有env块，以及按需渲染注解：

resource "google_cloud_run_service" "run_service" {
  project  = var.gcp_project_id
  provider = google-beta
  location = var.region

  for_each = var.cloudrun_services
  name     = each.key

  template {
    metadata {
      annotations = merge(
        {
          "autoscaling.knative.dev/maxScale" = 100
        },
        # 按需添加CloudSQL注解
        each.value.enable_cloudsql ? {
          "run.googleapis.com/cloudsql-instances" = var.postgres-conn-str
        } : {},
        # 按需添加VPC连接器注解
        each.value.enable_vpc_connector ? {
          "run.googleapis.com/vpc-access-connector" = "projects/${var.gcp_project_id}/locations/${var.region}/connectors/${var.vpc_connector_name}"
          "run.googleapis.com/vpc-access-egress"    = "private-ranges-only"
        } : {}
      )
    }
    spec {
      containers {
        image = "gcr.io/${var.gcp_project_id}/${each.value.image}"

        # 动态生成普通明文环境变量
        dynamic "env" {
          for_each = each.value.env_vars
          content {
            name  = env.key
            value = env.value
          }
        }

        # 动态生成机密环境变量
        dynamic "env" {
          for_each = each.value.secret_env_vars
          content {
            name = env.key
            value_from {
              secret_key_ref {
                name = env.value
                key  = "latest"
              }
            }
          }
        }

        # 按需添加CloudSQL相关固定环境变量
        dynamic "env" {
          for_each = each.value.enable_cloudsql ? [1] : []
          content {
            name  = "CLOUD_SQL_CONNECTION_NAME"
            value = var.postgres-conn-str
          }
        }
      }
    }
  }

  metadata {
    annotations = {
      generated-by                      = "magic-modules"
      "run.googleapis.com/launch-stage" = "ALPHA"
    }
  }

  traffic {
    percent         = 100
    latest_revision = true
  }
  autogenerate_revision_name = true

  lifecycle {
    ignore_changes = [
      metadata.0.annotations,
    ]
  }
}

第三步：编写terraform.tfvars时按需配置每个服务的环境变量 #

示例配置：

cloudrun_services = {
  # 需要存储桶、不需要数据库的服务
  file-processor = {
    image  = "file-process-image:v1"
    email  = "file-team@example.com"
    env_vars = {
      QUARANTINE_BUCKET = var.quarantine_bucket_name
      APP_URL           = var.app_url
    }
    enable_cloudsql = false
  }
  # 需要数据库、Redis的服务
  api-service = {
    image  = "api-service-image:v1"
    email  = "api-team@example.com"
    env_vars = {
      REDIS_HOST = var.memorystore-host
      APP_URL    = var.app_url
    }
    secret_env_vars = {
      DB_NAME = var.postgres-dbname
      DB_USER = var.postgres-username
      DB_PASS = var.postgres-username-pwd
    }
    enable_cloudsql = true
  }
}

• 无需为每个服务单独编写资源块，维护成本低
• 每个服务的环境变量完全独立，不会出现全局变量泄漏到无关服务的问题
• 通用配置可提取为变量默认值，重复配置无需多次编写

内容的提问来源于stack exchange，提问作者Python Beginner