Skip to main content

Using Kubernetes Secrets

To leverage native Kubernetes Secrets in Flyte tasks, you can use the K8sSecretInjector to automatically mount secret keys as files or inject them as environment variables into your task pods. This allows you to manage sensitive information using standard Kubernetes Secret objects while making them available to your Flyte workflows.

Injecting Secrets as Environment Variables​

You can inject a specific key from a Kubernetes Secret into your task's environment by setting the MountRequirement to ENV_VAR. By default, Flyte prefixes these environment variables with _UNION_.

import (
    coreIdl "github.com/flyteorg/flyte/v2/gen/go/flyteidl2/core"
    "github.com/flyteorg/flyte/v2/flyteplugins/go/tasks/pluginmachinery/secret"
    "github.com/flyteorg/flyte/v2/flyteplugins/go/tasks/pluginmachinery/secret/config"
)

// Define the secret requirement
secretReq := &coreIdl.Secret{
    Group:            "my-k8s-secret", // The name of the K8s Secret object
    Key:              "api-key",       // The key inside the K8s Secret
    MountRequirement: coreIdl.Secret_ENV_VAR,
}

// The K8sSecretInjector will mutate the pod to include:
// Env Var Name: _UNION_MY_K8S_SECRET_API_KEY
// ValueFrom: SecretKeyRef(Name: "my-k8s-secret", Key: "api-key")

If you need a specific environment variable name, you can provide it in the EnvVar field of the Secret message. The injector will still add the default prefixed variable in addition to your custom name.

Injecting Secrets as Files​

To mount a secret key as a file, set the MountRequirement to FILE. Flyte mounts these secrets under /etc/flyte/secrets/ by default.

secretReq := &coreIdl.Secret{
    Group:            "user-credentials",
    Key:              "password",
    MountRequirement: coreIdl.Secret_FILE,
}

// The K8sSecretInjector mounts the file at:
// /etc/flyte/secrets/user-credentials/password

When using file mounts, Flyte also injects two helper environment variables into the container:

  • FLYTE_SECRETS_DEFAULT_DIR: Set to /etc/flyte/secrets.
  • FLYTE_SECRETS_FILE_PREFIX: Used to help locate mounted secrets.

Programmatic Fetching with K8sSecretFetcher​

If you are developing a Flyte plugin or internal component that needs to read secrets directly from the Kubernetes API, use the K8sSecretFetcher. This class wraps the standard Kubernetes SecretInterface.

import (
    "context"
    "github.com/flyteorg/flyte/v2/flyteplugins/go/tasks/pluginmachinery/secret"
)

func GetSecretValue(ctx context.Context, fetcher secret.K8sSecretFetcher, namespace string) (string, error) {
    // Retrieves the value of 'my-key' from the secret 'my-secret' in the given namespace
    value, err := fetcher.Get(ctx, namespace, "my-secret", "my-key")
    if err != nil {
        return "", err
    }
    return value, nil
}

Configuring Kubernetes Secret Settings​

The behavior of the Kubernetes secret integration is controlled via K8sConfig. You can configure the namespace where Flyte looks for secrets and tune the Kubernetes client performance.

// flyteplugins/go/tasks/pluginmachinery/secret/config/config.go

type K8sConfig struct {
    // Namespace to be used for storing secrets
    Namespace        string           `json:"namespace"`
    // Configuration for the Kubernetes client (QPS, Burst, Timeout)
    KubeClientConfig KubeClientConfig `json:"kubeClientConfig"`
}

In your Flyte configuration file, you can adjust the environment variable prefix:

secrets:
  secretEnvVarPrefix: "_CUSTOM_PREFIX_"
  embeddedSecretManagerConfig:
    k8sConfig:
      namespace: "my-custom-namespace"

Limitations and Behavior​

When using Kubernetes secrets in Flyte, keep the following implementation details in mind:

  • Single Key Mounting: The K8sSecretInjector does not support mounting an entire Kubernetes Secret object (all keys). You must specify a single Key for each Secret requirement.
  • Group Fallback: If the Group (the Kubernetes Secret name) is not provided in the Secret message, Flyte generates a name by calculating the MD5 hash of the Key.
  • Case Sensitivity: Secret groups and keys are handled according to Kubernetes naming rules. The K8sSecretInjector converts the Group to lowercase when constructing the file mount path (e.g., a group MySecret becomes /etc/flyte/secrets/mysecret/).
  • Optional Secrets: Secrets injected by Flyte are marked as Optional: true in the Kubernetes Pod spec to prevent pods from failing to start if a secret is temporarily missing.