Hello All Have Prefect Orion deployed version 2 6 4 python3

Question

Hello All Have Prefect Orion deployed version 2 6 4 python3 10 When looking at the Settings section I noticed the PREFECT ORION DATABASE CONNECTION URL was not obfuscated Is there any way to obfuscate that Or another way to handle the admin password other than passing it in via the connection string for Helm

Zanie · Answer

We template the setting `PREFECT ORION DATABASE PASSWORD` into the connection URL

Zanie · Answer

So you can use `$ PREFECT ORION DATABASE PASSWORD `in the connection URL and set the password separately and it ll be obfuscated

Mark Li · Answer

Thanks Zanie I ll give that a try

Mark Li · Answer

Do I set the password in the password setting within the values yaml file after specifying $ PREFECT ORION DATABASE PASSWORD Would that be enough to have Prefect aware of where to replace it

Mark Li · Answer

Reading the comments in values yaml file I don t know how I would set the password to pass to the connection string as it s using an existing secret connection string The password in the values yaml file seems t o be fore creating a custom user

Zanie · Answer

Ah I see you re using the Helm chart

Zanie · Answer

You d need to set the database password setting in the server environment variables I think I m not sure if the Helm chart supports this yet cc < Jamie Zieziula>

Jamie Zieziula · Answer

Hi Mark you will need to set the password <https github com PrefectHQ prefect helm blob main charts prefect server values yaml L230|here>

Jamie Zieziula · Answer

Alternatively you can create your own secret and pass it <https github com PrefectHQ prefect helm blob main charts prefect server values yaml L236|here>

Mark Li · Answer

< Jamie Zieziula> I have a secret created and passed to the existingsecrets The secret has the password inside the connection string My issue with going that route is that the connection string is not obfuscated and the password is exposed when accessing the settings in the Prefect Orion UI

Mark Li · Answer

Double checking Since I have no need to create the user and intend to authenticate through the connection string I m assuming I don t need to specify the password value in the helm chart since that s for creating a new user

Mark Li · Answer

< Jamie Zieziula> Bump for clarifying my question If unclear please let me know slightly smiling face Essentially I have an AKS secret that s my connection string with admin user password that s passed to the Helm Chart to connect Prefect to my external Postgres When going to the Prefect Orion UI The connection string and the password is exposed on the Settings section of the Prefect Orion UI What approach can I do via Helm to obfuscate the password on the UI side

Mark Li · Answer

Following up on this I ve tried passing in the PREFECT ORION DATABASE PASSWORD as an environment variable directly defined in the Helm Chart and using $ PREFECT ORION DATABASE PASSWORD inside our connection string to pass the password into the connection string The connection string is not obfuscated and still displays the credentials in the connection URL expected as much since it s just displaying the connection string that it used to connect with

Zanie · Answer

These are both obfuscated in my UI

Zanie · Answer

What version are you using

Mark Li · Answer

version 2 6 4 python3 10

Zanie · Answer

<https github com PrefectHQ prefect commit 902dfa4bd3b6e330e4374eb1e04de064148a2f32> was added in 2 6 7

Zanie · Answer

Please use a more recent version

Mark Li · Answer

Alright We ll migrate to a later version and get back to you on it

Mark Li · Answer

Updated to 2 8 3 obfuscation is working as expected

Zanie · Answer

Wonderful