https://prefect.io
Join Slack
Hi! What’s the correct way to set the `PREFECT__CONTEXT__SECRETS__GITHUB_ACCESS_TOKEN` variable in ...
# ask-community
m
Hi! What’s the correct way to set the 
PREFECT__CONTEXT__SECRETS__GITHUB_ACCESS_TOKEN
variable in the k8s manifest created by 
prefect agent kubernetes install
? Do I have to use the 
--env
switch or can I provide the value by editing the generated deployment container’s 
env:
list directly?
k
I believe both will work. You can find more info here also to compare
m
I’m following the Orchestrating ELT on Kubernetes with Prefect, dbt & Snowflake article. The k8s object that 
kubernetes install
generates is a Deployment. There is no mention of a Job template. Is there a step I’m missing from the article where the GitHub token is provided?
a
this post was built for Prefect Cloud, so you need to adjust it to make it work with Prefect Server there is no Secrets backend on Server, that's why you need to set local secrets. When people use Kubernetes, they usually deploy Server with a helm chart and what Kevin shared, shows how you can set local secrets in various Server deployments incl. Helm chart
m
I’m using cloud
a
Awesome! So you don't need to use PREFECT__CONTEXT__SECRETS__GITHUB_ACCESS_TOKEN. You can add Secrets via Prefect Cloud UI
k
Oh yeah my Anna is right, just pull it from Cloud directly
m
alright, what about secrets that I want to stay on the agent, in our k8s environment?
a
why would you want to do that? you can always set Kubernetes secrets and retrieve those in your flow via environment variables
k
You can’t mix and match the 
PrefectSecret
task to pull from both local and Cloud. It’s configured to pull from one source
a
but then you don't take advantage of the Cloud Secrets backend in Prefect Cloud that works across environments and which will likely save you some headache because e.g. you can retrieve the same Secret in a local run on your laptop and in a production run on a Kubernetes cluster
m
I take it that Cloud Secrets are part of the Starter plan, and are not on the Free plan? I ask because my dashboard lefthand menu does not have all the entries I see in the Secrets docs 🙂
a
Secrets are available on all Cloud plans
perhaps you are doing it in Cloud 2.0? 🙂 Can you share the URL and some screenshots?
m
ah, my fault. I do have the option, it just isn’t where I expected it to be in the UI. I’ve been ignoring the Team menu because everything in the UI makes me think I’m on a single-user plan, or that “Teams is an enterprise feature”.
👍 1
a
Gotcha. Nice we figured that out 🙌
m
I think trying out the Prefect Server UI first confused things too. There are no Teams on Server so you learn to ignore the whole Team concept. When you move from Server to Cloud there is no “Cloud” menu that says there is a bunch of new functionality you should explore.
upvote 2
a
that's an interesting point, and one that will get easier as Cloud 2.0 builds on the OSS Orion UI in a (hopefully) less confusing way.
m
@Mars Would you mind to share how did you do to use secrets and pass this value to kubernetes agent?
I'm struggling to solve this because I need to set GOOGLE_APPLICATION_CREDENTIALS to allow agent get flows from Google Cloud Storage
I've tried using kubernetes secrets and load them as env variables or mounting a volume with this secrets but nothing seems to work
a
did you try using the Prefect option with storing it as Prefect Secret in the UI?
m
I'm trying to do it with Github now
I created a token in github and saved in Prefect Cloud as GITHUB_ACCESS_TOKEN. My storage is:
Copy code
STORAGE = GitHub(
    repo="mateo2181/my-repo",
    path=f"flows/{FLOW_NAME}.py",
    access_token_secret="GITHUB_ACCESS_TOKEN"
)
And my kubernetes config:
Copy code
RUN_CONFIG = KubernetesRun(labels=[AGENT_LABEL])
Should I pass GITHUB_ACCESS_TOKEN to KubernetesRun as env? Or should I do it in the yaml file that I use to run Kubernetes?
a
I see - no need to set any Kubernetes secrets or env variables when using Prefect Secrets, setting the secret with a name GITHUB_ACCESS_TOKEN and value of your token should be enough
what error do you get?
m
a
adding this env variable should fix it:
Copy code
export PREFECT__CLOUD__USE_LOCAL_SECRETS=false
m
That should be in Kubernetes agent?
I got same error
this env var PREFECT__BACKEND should be always sever? I'm using Prefect Cloud
a
nope, you can remove this variable entirely if you are on Cloud - Cloud is the default
m
Works now! I think the error was in line PREFECT__BACKEND. If I want to read files from GCS, I would need to set up a json credentials file, which is the recommended way to do that? using Secrets? Put the json content inside the Secret variable would work?
k
Yes that sounds right if you are using the Prefect tasks it will use the Secret to load. It will all back to json credentials on the execution environment though if the Secret is not there so you can use either
m
Thanks @Kevin Kho @Anna Geller!!
👍 1
17 Views
Open in Slack
PreviousNext
Powered by

Prefect Community

Bring your towel and join one of the fastest growing data communities. Welcome to our second-generation open source orchestration platform, a completely rethought approach to dataflow automation.

Powered by