| :mod:`airflow.providers.hashicorp.secrets.vault` |
| ================================================ |
| |
| .. py:module:: airflow.providers.hashicorp.secrets.vault |
| |
| .. autoapi-nested-parse:: |
| |
| Objects relating to sourcing connections & variables from Hashicorp Vault |
| |
| |
| |
| Module Contents |
| --------------- |
| |
| .. py:class:: VaultBackend(connections_path: str = 'connections', variables_path: str = 'variables', config_path: str = 'config', url: Optional[str] = None, auth_type: str = 'token', auth_mount_point: Optional[str] = None, mount_point: str = 'secret', kv_engine_version: int = 2, token: Optional[str] = None, token_path: Optional[str] = None, username: Optional[str] = None, password: Optional[str] = None, key_id: Optional[str] = None, secret_id: Optional[str] = None, role_id: Optional[str] = None, kubernetes_role: Optional[str] = None, kubernetes_jwt_path: str = '/var/run/secrets/kubernetes.io/serviceaccount/token', gcp_key_path: Optional[str] = None, gcp_keyfile_dict: Optional[dict] = None, gcp_scopes: Optional[str] = None, azure_tenant_id: Optional[str] = None, azure_resource: Optional[str] = None, radius_host: Optional[str] = None, radius_secret: Optional[str] = None, radius_port: Optional[int] = None, **kwargs) |
| |
| Bases: :class:`airflow.secrets.BaseSecretsBackend`, :class:`airflow.utils.log.logging_mixin.LoggingMixin` |
| |
| Retrieves Connections and Variables from Hashicorp Vault. |
| |
| Configurable via ``airflow.cfg`` as follows: |
| |
| .. code-block:: ini |
| |
| [secrets] |
| backend = airflow.providers.hashicorp.secrets.vault.VaultBackend |
| backend_kwargs = { |
| "connections_path": "connections", |
| "url": "http://127.0.0.1:8200", |
| "mount_point": "airflow" |
| } |
| |
| For example, if your keys are under ``connections`` path in ``airflow`` mount_point, this |
| would be accessible if you provide ``{"connections_path": "connections"}`` and request |
| conn_id ``smtp_default``. |
| |
| :param connections_path: Specifies the path of the secret to read to get Connections. |
| (default: 'connections'). If set to None (null), requests for connections will not be sent to Vault. |
| :type connections_path: str |
| :param variables_path: Specifies the path of the secret to read to get Variable. |
| (default: 'variables'). If set to None (null), requests for variables will not be sent to Vault. |
| :type variables_path: str |
| :param config_path: Specifies the path of the secret to read Airflow Configurations |
| (default: 'config'). If set to None (null), requests for configurations will not be sent to Vault. |
| :type config_path: str |
| :param url: Base URL for the Vault instance being addressed. |
| :type url: str |
| :param auth_type: Authentication Type for Vault. Default is ``token``. Available values are: |
| ('approle', 'aws_iam', 'azure', 'github', 'gcp', 'kubernetes', 'ldap', 'radius', 'token', 'userpass') |
| :type auth_type: str |
| :param auth_mount_point: It can be used to define mount_point for authentication chosen |
| Default depends on the authentication method used. |
| :type auth_mount_point: str |
| :param mount_point: The "path" the secret engine was mounted on. Default is "secret". Note that |
| this mount_point is not used for authentication if authentication is done via a |
| different engine. For authentication mount_points see, auth_mount_point. |
| :type mount_point: str |
| :param kv_engine_version: Select the version of the engine to run (``1`` or ``2``, default: ``2``). |
| :type kv_engine_version: int |
| :param token: Authentication token to include in requests sent to Vault. |
| (for ``token`` and ``github`` auth_type) |
| :type token: str |
| :param token_path: path to file containing authentication token to include in requests sent to Vault |
| (for ``token`` and ``github`` auth_type). |
| :type token_path: str |
| :param username: Username for Authentication (for ``ldap`` and ``userpass`` auth_type). |
| :type username: str |
| :param password: Password for Authentication (for ``ldap`` and ``userpass`` auth_type). |
| :type password: str |
| :param key_id: Key ID for Authentication (for ``aws_iam`` and ''azure`` auth_type). |
| :type key_id: str |
| :param secret_id: Secret ID for Authentication (for ``approle``, ``aws_iam`` and ``azure`` auth_types). |
| :type secret_id: str |
| :param role_id: Role ID for Authentication (for ``approle``, ``aws_iam`` auth_types). |
| :type role_id: str |
| :param kubernetes_role: Role for Authentication (for ``kubernetes`` auth_type). |
| :type kubernetes_role: str |
| :param kubernetes_jwt_path: Path for kubernetes jwt token (for ``kubernetes`` auth_type, default: |
| ``/var/run/secrets/kubernetes.io/serviceaccount/token``). |
| :type kubernetes_jwt_path: str |
| :param gcp_key_path: Path to Google Cloud Service Account key file (JSON) (for ``gcp`` auth_type). |
| Mutually exclusive with gcp_keyfile_dict. |
| :type gcp_key_path: str |
| :param gcp_keyfile_dict: Dictionary of keyfile parameters. (for ``gcp`` auth_type). |
| Mutually exclusive with gcp_key_path. |
| :type gcp_keyfile_dict: dict |
| :param gcp_scopes: Comma-separated string containing OAuth2 scopes (for ``gcp`` auth_type). |
| :type gcp_scopes: str |
| :param azure_tenant_id: The tenant id for the Azure Active Directory (for ``azure`` auth_type). |
| :type azure_tenant_id: str |
| :param azure_resource: The configured URL for the application registered in Azure Active Directory |
| (for ``azure`` auth_type). |
| :type azure_resource: str |
| :param radius_host: Host for radius (for ``radius`` auth_type). |
| :type radius_host: str |
| :param radius_secret: Secret for radius (for ``radius`` auth_type). |
| :type radius_secret: str |
| :param radius_port: Port for radius (for ``radius`` auth_type). |
| :type radius_port: str |
| |
| |
| .. method:: get_conn_uri(self, conn_id: str) |
| |
| Get secret value from Vault. Store the secret in the form of URI |
| |
| :param conn_id: The connection id |
| :type conn_id: str |
| :rtype: str |
| :return: The connection uri retrieved from the secret |
| |
| |
| |
| |
| .. method:: get_variable(self, key: str) |
| |
| Get Airflow Variable |
| |
| :param key: Variable Key |
| :type key: str |
| :rtype: str |
| :return: Variable Value retrieved from the vault |
| |
| |
| |
| |
| .. method:: get_config(self, key: str) |
| |
| Get Airflow Configuration |
| |
| :param key: Configuration Option Key |
| :type key: str |
| :rtype: str |
| :return: Configuration Option Value retrieved from the vault |
| |
| |
| |
| |
