airflow.providers.google.cloud.secrets.secret_manager

Objects relating to sourcing connections from Google Cloud Secrets Manager

Module Contents

Classes

CloudSecretManagerBackend

Retrieves Connection object from Google Cloud Secrets Manager

Attributes

log

SECRET_ID_PATTERN

airflow.providers.google.cloud.secrets.secret_manager.log[source]
airflow.providers.google.cloud.secrets.secret_manager.SECRET_ID_PATTERN = ^[a-zA-Z0-9-_]*$[source]
class airflow.providers.google.cloud.secrets.secret_manager.CloudSecretManagerBackend(connections_prefix='airflow-connections', variables_prefix='airflow-variables', config_prefix='airflow-config', gcp_keyfile_dict=None, gcp_key_path=None, gcp_scopes=None, project_id=None, sep='-', **kwargs)[source]

Bases: airflow.secrets.BaseSecretsBackend, airflow.utils.log.logging_mixin.LoggingMixin

Retrieves Connection object from Google Cloud Secrets Manager

Configurable via airflow.cfg as follows:

[secrets]
backend = airflow.providers.google.cloud.secrets.secret_manager.CloudSecretManagerBackend
backend_kwargs = {"connections_prefix": "airflow-connections", "sep": "-"}

For example, if the Secrets Manager secret id is airflow-connections-smtp_default, this would be accessible if you provide {"connections_prefix": "airflow-connections", "sep": "-"} and request conn_id smtp_default.

If the Secrets Manager secret id is airflow-variables-hello, this would be accessible if you provide {"variables_prefix": "airflow-variables", "sep": "-"} and request Variable Key hello.

The full secret id should follow the pattern "[a-zA-Z0-9-_]".

Parameters

  • connections_prefix (str) -- Specifies the prefix of the secret to read to get Connections. If set to None (null), requests for connections will not be sent to GCP Secrets Manager

  • variables_prefix (str) -- Specifies the prefix of the secret to read to get Variables. If set to None (null), requests for variables will not be sent to GCP Secrets Manager

  • config_prefix (str) -- Specifies the prefix of the secret to read to get Airflow Configurations containing secrets. If set to None (null), requests for configurations will not be sent to GCP Secrets Manager

  • gcp_key_path (Optional[str]) -- Path to Google Cloud Service Account key file (JSON). Mutually exclusive with gcp_keyfile_dict. use default credentials in the current environment if not provided.

  • gcp_keyfile_dict (Optional[dict]) -- Dictionary of keyfile parameters. Mutually exclusive with gcp_key_path.

  • gcp_scopes (Optional[str]) -- Comma-separated string containing OAuth2 scopes

  • project_id (Optional[str]) -- Project ID to read the secrets from. If not passed, the project ID from credentials will be used.

  • sep (str) -- Separator used to concatenate connections_prefix and conn_id. Default: "-"

property client(self)[source]

Property returning secret client.

Returns

Secrets client

Return type

airflow.providers.google.cloud._internal_client.secret_manager_client._SecretManagerClient

get_conn_value(self, conn_id)[source]

Get serialized representation of Connection

Parameters

conn_id (str) -- connection id

get_conn_uri(self, conn_id)[source]

Return URI representation of Connection conn_id.

As of Airflow version 2.3.0 this method is deprecated.

Parameters

conn_id (str) -- the connection id

Returns

deserialized Connection

Return type

Optional[str]

get_variable(self, key)[source]

Get Airflow Variable from Environment Variable

Parameters

key (str) -- Variable Key

Returns

Variable Value

Return type

Optional[str]

get_config(self, key)[source]

Get Airflow Configuration

Parameters

key (str) -- Configuration Option Key

Returns

Configuration Option Value

Return type

Optional[str]

Was this entry helpful?