Not sure if this is a silly question - sorry if it is - but if you store your secrets in a docker file, what's difference between using the EnvVarSecret task and using os.environ to pull in the secrets?

Hi Riley - not a dumb question at all; functionally there is no real difference. The main idea is if you want to visually see your task’s dependencies on the secret, then using an

EnvVarSecret

task ensures it shows up in your task graph (and that it’s output is handled securely). That task will also optionally “Fail” if the secret isn’t present, which can be nice from a code organization standpoint but definitely not required.

Ahh - makes complete sense now. Thanks @Chris White!

@Marvin archive “What’s the difference between using an EnvVarSecret task and calling os.environ myself?”