> there is no easy way to manage secrets with Cloud Run

See https://cloud.google.com/secret-manager/

I recommend this community-maintained FAQ on Cloud Run:

https://github.com/ahmetb/cloud-run-faq