Adding Variables

1. 1. Navigate to the desired level (Organization, Environment, Application, or Instance)
2. 2. Go to the Variables tab
3. 3. Click Add Variable
4. 4. Enter key and value
5. 5. Click Save

Variable Naming Conventions

✓ GOOD:
  DATABASE_URL          # Clear, descriptive
  MAX_RETRIES          # SCREAMING_SNAKE_CASE
  FEATURE_NEW_UI       # Boolean feature flag
  API_TIMEOUT_MS       # Include units in name

✗ BAD:
  db                   # Too short, unclear
  Database-URL         # Hyphens not standard
  max retries          # Spaces not allowed
  timeout              # Ambiguous (seconds? milliseconds?)

Updating Variables

Changes to variables require a deployment restart to take effect:

• • Running deployments: Stop and start, or redeploy
• • New deployments: Will automatically use updated values
• • Inheritance changes: Affect all child levels automatically

Deleting Variables

Click the trash icon next to the variable. Be careful - this affects all deployments using this variable.

Adding Secrets

1. 1. Navigate to the desired level
2. 2. Go to the Secrets tab
3. 3. Click Add Secret
4. 4. Enter key and value (value will be masked as you type)
5. 5. Click Save

⚠️ Once saved, you cannot view the secret value again. If you need to see it, you must delete and recreate it.

Updating Secrets

To update a secret value:

1. 1. Delete the existing secret
2. 2. Create a new secret with the same key and new value
3. 3. Restart or redeploy applications using this secret

Secret Storage

Node.js

// Read environment variable
const dbUrl = process.env.DATABASE_URL;
const apiKey = process.env.API_KEY;

// With default fallback
const port = process.env.PORT || 3000;

// Parse numbers
const maxRetries = parseInt(process.env.MAX_RETRIES || '3', 10);

// Parse booleans
const debugMode = process.env.DEBUG === 'true';

Python

import os

# Read environment variable
db_url = os.environ.get('DATABASE_URL')
api_key = os.environ['API_KEY']  # Raises KeyError if missing

# With default fallback
port = int(os.environ.get('PORT', 3000))

# Parse booleans
debug_mode = os.environ.get('DEBUG', 'false').lower() == 'true'

Go

import (
    "os"
    "strconv"
)

// Read environment variable
dbURL := os.Getenv("DATABASE_URL")

// With default fallback
port := os.Getenv("PORT")
if port == "" {
    port = "3000"
}

// Parse numbers
maxRetries, _ := strconv.Atoi(os.Getenv("MAX_RETRIES"))

// Parse booleans
debugMode := os.Getenv("DEBUG") == "true"

Java

// Read environment variable
String dbUrl = System.getenv("DATABASE_URL");

// With default fallback
String port = System.getenv().getOrDefault("PORT", "3000");

// Parse numbers
int maxRetries = Integer.parseInt(
    System.getenv().getOrDefault("MAX_RETRIES", "3")
);

// Parse booleans
boolean debugMode = "true".equals(System.getenv("DEBUG"));

Option 1: Base64 Encoding (Recommended)

# Encode file to base64
cat service-account.json | base64 > encoded.txt

# Add as secret:
# Key: GCP_SERVICE_ACCOUNT_BASE64
# Value: (paste encoded content)

# In application, decode:
# Node.js
const decoded = Buffer.from(
  process.env.GCP_SERVICE_ACCOUNT_BASE64, 
  'base64'
).toString('utf-8');
const config = JSON.parse(decoded);

# Python
import base64, json
decoded = base64.b64decode(os.environ['GCP_SERVICE_ACCOUNT_BASE64'])
config = json.loads(decoded)

Option 2: Use Kubernetes Secrets (Advanced)

For very large files or complex structures, create Kubernetes secrets directly and mount as files:

# Create Kubernetes secret
kubectl create secret generic app-config \
  --from-file=service-account.json \
  --namespace=production

# Mount in pod (configure in application YAML)
volumes:
  - name: config
    secret:
      secretName: app-config
volumeMounts:
  - name: config
    mountPath: /etc/config
    readOnly: true

# Access in code
const config = require('/etc/config/service-account.json');

List Variables

GET /api/v1/organizations/{org_id}/variables

Response:
{
  "variables": [
    {
      "key": "LOG_LEVEL",
      "value": "info",
      "level": "organization",
      "created_at": "2024-01-15T10:00:00Z"
    }
  ]
}

Create Variable

POST /api/v1/environments/{env_id}/variables

{
  "key": "DATABASE_HOST",
  "value": "db.production.local"
}

Response: 201 Created

Create Secret

POST /api/v1/applications/{app_id}/secrets

{
  "key": "API_KEY",
  "value": "sk-1234567890abcdef"
}

Response: 201 Created
Note: value is write-only, cannot be retrieved

Get Effective Configuration

Retrieve merged variables/secrets for a specific instance (with inheritance resolved):

GET /api/v1/instances/{instance_id}/config

Response:
{
  "variables": {
    "LOG_LEVEL": "error",        # From instance (override)
    "DATABASE_HOST": "db.local", # From environment
    "MAX_CONNECTIONS": "100",    # From organization
    "APP_NAME": "api-service"    # From application
  },
  "secrets": {
    "API_KEY": "****",           # Hidden
    "DATABASE_PASSWORD": "****"  # Hidden
  }
}