Local and Global Secret Providers

Flyte provides a mechanism to manage secrets at the process level, which is particularly useful for local development or for providing global configuration secrets to all tasks. This is implemented through the FileEnvSecretManager and GlobalSecrets classes, which allow secrets to be sourced from the host environment (environment variables or local files) and injected into task Pods.

Sourcing Secrets from the Host

When running Flyte locally or in a simplified environment, you may want to avoid the complexity of a dedicated secret manager like HashiCorp Vault or AWS Secrets Manager. The FileEnvSecretManager allows you to use the host's own environment variables or local filesystem as a secret store.

Configuration

You configure the FileEnvSecretManager using the Config struct in flyteplugins/go/tasks/pluginmachinery/secretmanager/config.go.

{
  "type": "local",
  "secrets-prefix": "/etc/secrets",
  "env-prefix": "FLYTE_SECRET_"
}

• type: Set to local to enable this manager.
• secrets-prefix: The base directory where the manager looks for secret files.
• env-prefix: The prefix added to environment variables when looking up secrets.

Internal Lookup Logic

The FileEnvSecretManager implements the GlobalSecretProvider interface. When GetForSecret is called with a Secret object (containing a Group and a Key), it performs the following lookups in order:

1. Environment Variable: It constructs a variable name using the format %s%s_%s (defined as envVarLookupFormatter in flyteplugins/go/tasks/pluginmachinery/secretmanager/secrets.go).
   • Example: If env-prefix is FLYTE_SECRET_, Group is database, and Key is password, it looks for FLYTE_SECRET_DATABASE_PASSWORD.
2. Local File: If the environment variable is not found, it looks for a file at filepath.Join(secretPath, Group, Key).
   • Example: /etc/secrets/database/password.

// From flyteplugins/go/tasks/pluginmachinery/secretmanager/secrets.go
func (f FileEnvSecretManager) GetForSecret(ctx context.Context, secret *coreIdl.Secret) (string, error) {
    // ... validation ...
    envVar := fmt.Sprintf(envVarLookupFormatter, f.envPrefix, strings.ToUpper(secret.Group), strings.ToUpper(secret.Key))
    v, ok := os.LookupEnv(envVar)
    if ok {
        return v, nil
    }

    secretFile := filepath.Join(f.secretPath, filepath.Join(secret.Group, secret.Key))
    // ... reads from file ...
}

Injecting Secrets into Task Pods

The GlobalSecrets class acts as a bridge between the process-level secret provider and the Kubernetes Pods where Flyte tasks run. It is used by the Flyte Pod Webhook to mutate incoming Pod specifications.

Pod Mutation Process

When a task requires a secret, GlobalSecrets.Inject retrieves the secret value from its internal GlobalSecretProvider (e.g., the FileEnvSecretManager) and adds it to the Pod's environment variables.

For a secret with Group: "my_group" and Key: "my_key", the following happens:

1. Secret Value Retrieval: The value is fetched from the host environment.
2. Environment Variable Injection: An environment variable is added to all containers (including init containers) in the Pod. The name is constructed using the SecretEnvVarPrefix (default _UNION_).
   • Resulting Env Var: _UNION_MY_GROUP_MY_KEY=secret_value
3. Prefix Indicator: A special environment variable FLYTE_SECRETS_ENV_PREFIX is added to the Pod. This tells the Flyte task code which prefix to use when looking for secrets inside the container.

// From flyteplugins/go/tasks/pluginmachinery/secret/global_secrets.go
envVar := corev1.EnvVar{
    Name:  strings.ToUpper(g.cfg.SecretEnvVarPrefix + secret.Group + EnvVarGroupKeySeparator + secret.Key),
    Value: v,
}

prefixEnvVar := corev1.EnvVar{
    Name:  SecretEnvVarPrefix, // "FLYTE_SECRETS_ENV_PREFIX"
    Value: g.cfg.SecretEnvVarPrefix,
}

Constraints and Requirements

• Mount Requirements: GlobalSecrets only supports injecting secrets as environment variables. If a secret is requested with MountRequirement: FILE, the injection will fail with an error.
• Group and Key: Both the Group and Key must be provided in the secret request. GlobalSecrets does not support mounting entire secret groups as files.
• Case Sensitivity: While the lookup in FileEnvSecretManager converts the Group and Key to uppercase for environment variables, the file path lookup is case-sensitive based on the underlying filesystem.

Configuration Summary

The behavior of these providers is controlled by two sets of configurations:

Setting	Location	Default	Description
type	secretmanager.Config	local	Enables the FileEnvSecretManager.
secrets-prefix	secretmanager.Config	/etc/secrets	Base directory for file-based secrets.
env-prefix	secretmanager.Config	FLYTE_SECRET_	Prefix for host environment variables.
secretEnvVarPrefix	secret.config.Config	_UNION_	Prefix used for environment variables injected into task Pods.

These configurations ensure that Flyte can securely pass sensitive information from the control plane's environment down to the individual execution units.