What is the common practice here? There seems to be no tools provided by gcloud. I\'m deploying functions from local machine for now, so I can hardcode secrets, but
You can use the Secret Manager for this. Follow the instructions on the link to add a secret.
The only GOTCHA I found is that by default the service account doesn't have read-access to the secrets, you've got to manually grant permissions, like so: