Description

Ensure background workers get their credentials, such as database URLs and API keys, from an environment group that is scoped to their project environment, instead of values copied by hand into each worker's environment variables.

Rationale

When secrets are copied into many services, they are hard to track and rotate, and old copies are often forgotten. An environment group keeps each secret in one place, so it can be updated once for every linked service, and scoping it to an environment stops other environments from using it.

Impact

  • Secrets are managed and rotated in one place

  • Fewer forgotten copies of credentials

  • Workers must be linked to the right group

Default Value

By default, environment variables are set per service, and environment groups are optional.

Pre-Requisites

  • Admin or Developer role (Admin for protected environments)

  • An environment group scoped to the worker's environment

Remediation

Test Plan

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. From your workspace home (or project), click the background worker to open it.

  3. Open the Environment page and review its variables and linked environment groups.

  4. If secrets are set directly on the worker instead of coming from a scoped environment group, follow the implementation steps.

Implementation Steps

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. Click Environment Groups in the left pane, click + New Environment Group (or open an existing one), add the secrets, and move it into the worker's project environment with Manage > Move group.

  3. From your workspace home (or project), click the background worker to open it.

  4. On the worker's Environment page, under Linked Environment Groups, select the group and click Link, then delete the copied secret variables from the worker.

  5. Save the changes and confirm the worker still starts correctly.

Backout Plan

  1. Sign in to the Render Dashboard at https://dashboard.render.com.

  2. From your workspace home (or project), click the background worker to open it.

  3. On the Environment page, add the variables back directly and unlink the environment group.

Reference