Hi Where do you store secrets such as database connections t

Question

Hi Where do you store secrets such as database connections trings that s usually stored in an env file I don t want to add them in cleartext when setting up a pool or a Process

redsquare · Answer

prefect has secret blocks else depends on the infra you are running on k8s aws secret manager etc etc

morten · Answer

You can take a look at this <https docs prefect io 2 11 3 concepts blocks > it might help

Stefan · Answer

Thanks But I get this error

morten · Answer

not sure what to do have not used secrets in the code only as a part of the prefect yaml file

Stefan · Answer

OK thanks anyway How do you do it in the yaml file I m assuming you don t store passwords there

morten · Answer

it depends on the secret I suggest reading the deployment section of the docs

Stefan · Answer

It s not really making it any clearer disappointed I see an example of pulling a secret when git cloning which ve used but for setting variables for the flow itself I don t see anything

redsquare · Answer

did you create a secret block called t when you ran the code above

Stefan · Answer

Yeah I got that working despite the error in PyCharm

Stefan · Answer

So I can do it like that but I m wondering if I can also specify the env variables in the prefect yaml deployment file and link to the secret there so that it s available at the flows runtime

Stefan · Answer

I may have found it

redsquare · Answer

cool we use k8s secrets that are injected using env vars

Stefan · Answer

Mind showing me how it looks like

redsquare · Answer

in terms of the job template it does this which asically pulls in all the secrets from the prefect flow secrets group in k8s ```customizations op add path spec template spec containers 0 envFrom value secretRef name prefect flow secrets```

redsquare · Answer

so it turns all of the secrets in that group into environment variables for the container

Christopher Boyd · Answer

I ve done this as well with managed identity for both ACI and AKS retrieving from azure keyvault but presumably doable with secrets manager for GCP and AWS as well

Christopher Boyd · Answer