Up to now I added plain text environment variables in the first step of creating the Cloud Function, and in the second step I called for examples the db connection URL variables including the sensitive credentials with:

def my_cloud_function(request):
    from os import environ
    
    ...
    db_user = environ["DB_USER"]
    db_pass = environ["DB_PASS"]
    db_name = environ["DB_NAME"]
    db_host = environ["DB_HOST"]
    db_port = environ["DB_PORT"]
    ...

(or use os.getenv() instead of os.environ()).

But I do not want to expose these sensitive connection parameters in this variables menu, available to anyone with the rights who clicked on the "Variables" tab. It is awkward if I can click on the variables and see the login credentials of a colleague. But also the other parts of the db URL should just better be kept secret.

How can I use environment variables without exposing them to anyone, at best from an unreadable encrypted file that I can also push to git?

There are a couple of Q&A on Stack Overflow that go into this direction, but I could not find the answer: