Skip to content

Split AIRFLOW__SECRETS__BACKEND_KWARGS into a set of envs for a more grained config #62406

@smktpd

Description

@smktpd

Description

Split AIRFLOW__SECRETS__BACKEND_KWARGS into a set of envs with the similar prefix, to allow user to set just the specific options (instead of all at once), like
AIRFLOW__SECRETS__BACKEND_KWARG_ROLE_ID='{"role_id": "74036059-2b77-413a-9950-a21f1ab095a0"}' AIRFLOW__SECRETS__BACKEND_KWARG_SECRET_ID='{"secret_id": "8e93323e-36dd-4661-8928-2a67dafdd7bf"}'

The AIRFLOW__SECRETS__BACKEND_KWARGS env itself should probably remain at least for backwards compatibility and just as a simpler approach (not everyone needs what I request here).

Use case/motivation

This would basically solve a problem where administrators of k8s installs would like to keep values file publicly accessible, yet keep sensitive part (role_id and secret_id in case of Hashicorp Vault as secrets backend) secret.
Currently, it's not possible and one either exposes sensitive info or hides non-sensitive info that other users might be interested in.

Related issues

No response

Are you willing to submit a PR?

  • Yes I am willing to submit a PR!

Code of Conduct

Metadata

Metadata

Assignees

No one assigned

    Labels

    Type

    No type

    Projects

    No projects

    Milestone

    No milestone

    Relationships

    None yet

    Development

    No branches or pull requests

    Issue actions