airflow.providers.yandex.secrets.lockbox¶

Objects relating to sourcing secrets from Yandex Cloud Lockbox.

Classes¶

LockboxSecretBackend

Retrieves connections or variables or configs from Yandex Lockbox.

Module Contents¶

class airflow.providers.yandex.secrets.lockbox.LockboxSecretBackend(yc_oauth_token=None, yc_sa_key_json=None, yc_sa_key_json_path=None, yc_connection_id=None, folder_id='', connections_prefix='airflow/connections', variables_prefix='airflow/variables', config_prefix='airflow/config', sep='/', endpoint=None)[source]¶

Bases: airflow.secrets.BaseSecretsBackend, airflow.utils.log.logging_mixin.LoggingMixin

Retrieves connections or variables or configs from Yandex Lockbox.

Configurable via airflow.cfg like so:

[secrets]
backend = airflow.providers.yandex.secrets.lockbox.LockboxSecretBackend
backend_kwargs = {"connections_prefix": "airflow/connections"}

For example, when {"connections_prefix": "airflow/connections"} is set, if a secret is defined with the path airflow/connections/smtp_default, the connection with conn_id smtp_default would be accessible.

When {"variables_prefix": "airflow/variables"} is set, if a secret is defined with the path airflow/variables/hello, the variable with the name hello would be accessible.

When {"config_prefix": "airflow/config"} is set, if a secret is defined with the path airflow/config/sql_alchemy_conn, the config with key sql_alchemy_conn would be accessible.

If the prefix is empty, the requests will not be sent to Yandex Lockbox.

[secrets]
backend = airflow.providers.yandex.secrets.lockbox.LockboxSecretBackend
backend_kwargs = {"yc_connection_id": "<connection_ID>", "folder_id": "<folder_ID>"}

You need to specify credentials or the ID of the yandexcloud connection to connect to Yandex Lockbox. The credentials will be used with the following priority:

OAuth token
Service account key in JSON from file
Service account key in JSON
Yandex Cloud connection

If you do not specify any credentials, the system will use the default connection ID:yandexcloud_default.

Also, you need to specify the Yandex Cloud folder ID to search for Yandex Lockbox secrets in. If you do not specify folder ID, the requests will use the connection folder_id if specified.

Parameters:

yc_oauth_token (str | None) – Specifies the user account OAuth token to connect to Yandex Lockbox. The parameter value should look like y3_xx123.
yc_sa_key_json (dict | str | None) – Specifies the service account key in JSON. The parameter value should look like {"id": "...", "service_account_id": "...", "private_key": "..."}.
yc_sa_key_json_path (str | None) – Specifies the service account key in JSON file path. The parameter value should look like /home/airflow/authorized_key.json, while the file content should have the following format: {"id": "...", "service_account_id": "...", "private_key": "..."}.
yc_connection_id (str | None) – Specifies the connection ID to connect to Yandex Lockbox. The default value is yandexcloud_default.
folder_id (str) – Specifies the folder ID to search for Yandex Lockbox secrets in. If set to None (null in JSON), the requests will use the connection folder_id, if specified.
connections_prefix (str | None) – Specifies the prefix of the secret to read to get connections. If set to None (null in JSON), the requests for connections will not be sent to Yandex Lockbox. The default value is airflow/connections.
variables_prefix (str | None) – Specifies the prefix of the secret to read to get variables. If set to None (null in JSON), the requests for variables will not be sent to Yandex Lockbox. The default value is airflow/variables.
config_prefix (str | None) – Specifies the prefix of the secret to read to get configurations. If set to None (null in JSON), the requests for variables will not be sent to Yandex Lockbox. The default value is airflow/config.
sep (str) – Specifies the separator to concatenate secret_prefix and secret_id. The default value is /.
endpoint (str | None) – Specifies the API endpoint. If set to None (null in JSON), the requests will use the connection endpoint, if specified; otherwise, they will use the default endpoint.

yc_oauth_token = None[source]¶

yc_sa_key_json = None[source]¶

yc_sa_key_json_path = None[source]¶

yc_connection_id = None[source]¶

folder_id = ''[source]¶

connections_prefix = ''[source]¶

variables_prefix = ''[source]¶

config_prefix = ''[source]¶

sep = '/'[source]¶

endpoint = None[source]¶

get_conn_value(conn_id)[source]¶

Retrieve from Secrets Backend a string value representing the Connection object.

Parameters:: conn_id (str) – Connection ID
Returns:: Connection Value
Return type:: str | None

get_variable(key)[source]¶

Return value for Airflow Variable.

Parameters:: key (str) – Variable Key
Returns:: Variable Value
Return type:: str | None

get_config(key)[source]¶

Return value for Airflow Config Key.

Parameters:: key (str) – Config Key
Returns:: Config Value
Return type:: str | None