How to configure environment variables for agents?

[markns]

Hi, I'm looking for some guidance on how to manage environment configuration when using agent-starter-pack.

I was previously using the -env-file option to app_utils.deploy, but that was removed in #652.

I had assumed that adding the env variables to the deployment/terraform/dev/service.tf would work, and indeed environment variables there appear to be set in the Agent Engine Service configuration deployment details, after running make setup-dev-env

However, these environment variables are NOT available to the application after running make deploy. My agent crashes on the startup with a Pydantic configuration error.

...
DEFAULT 2026-01-07T10:32:56.535263Z pydantic_core._pydantic_core.ValidationError: 6 validation errors for Config
DEFAULT 2026-01-07T10:32:56.535266Z FARMBETTER_ASSISTANT_USER_ID
DEFAULT 2026-01-07T10:32:56.535270Z Field required [type=missing, input_value={}, input_type=dict]
DEFAULT 2026-01-07T10:32:56.535274Z For further information visit https://errors.pydantic.dev/2.12/v/missing
...

I guess the env vars that were added in the terraform deploy are overwritten by the smaller default set in make deploy.

I can make the agent start by hacking the .env file into the app_utils.deploy command as follows

--set-env-vars=$(shell grep -v '^\#' .env | paste -sd "," -) 

but I'm pretty sure this is not what was intended by #652.

Any thoughts/guidance gratefully received. (cc @eliasecchig - apologies for the tag, but I'd love your thoughts on it 🙏 )

[ismaildasci]

the issue is that make deploy likely uses gcloud run deploy which has its own --set-env-vars flag that overrides terraform config.

few approaches:

1. use Secret Manager instead of env vars:
   for sensitive config, this is recommended anyway:

from google.cloud import secretmanager

client = secretmanager.SecretManagerServiceClient()
name = f"projects/{project}/secrets/{secret_id}/versions/latest"
response = client.access_secret_version(request={"name": name})
value = response.payload.data.decode("UTF-8")

2. modify Makefile deploy target:
   your hack is actually reasonable, but cleaner version:

ENV_VARS := $(shell cat .env | grep -v "^\#" | xargs | tr " " ",")

deploy:
	gcloud run deploy ... --set-env-vars="$(ENV_VARS)"

3. use terraform for full deployment:
   instead of make deploy, let terraform handle everything including env vars:

resource "google_cloud_run_service" "agent" {
  template {
    spec {
      containers {
        env {
          name  = "FARMBETTER_ASSISTANT_USER_ID"
          value = var.assistant_user_id
        }
      }
    }
  }
}

4. check if theres a config.yaml or cloudbuild.yaml:
   some projects use these for deployment config which might override terraform

the root cause is deployment pipeline not picking up terraform state. the gcloud deploy command needs to either read from terraform output or use same env vars.

[udjconcur]

Good