[GitHub] [airflow] uranusjr commented on a diff in pull request #23560: Add prioritization for secrets backend

[GitBox <gi...@apache.org>]

uranusjr commented on code in PR #23560:
URL: https://github.com/apache/airflow/pull/23560#discussion_r870415769


##########
airflow/configuration.py:
##########
@@ -1260,18 +1260,28 @@ def get_custom_secret_backend() -> Optional[BaseSecretsBackend]:
 def initialize_secrets_backends() -> List[BaseSecretsBackend]:
     """
     * import secrets backend classes
+    * sort by prioritisation
     * instantiate them and return them in a list
     """
     backend_list = []
 
+    for class_name in DEFAULT_SECRETS_SEARCH_PATH:
+        secrets_backend_cls = import_string(class_name)
+        backend_list.append(secrets_backend_cls())
+
     custom_secret_backend = get_custom_secret_backend()
 
     if custom_secret_backend is not None:
-        backend_list.append(custom_secret_backend)
+        backend_priority = conf.get('secrets', 'backend_priority', fallback='') or 'HIGH'
 
-    for class_name in DEFAULT_SECRETS_SEARCH_PATH:
-        secrets_backend_cls = import_string(class_name)
-        backend_list.append(secrets_backend_cls())
+        # Do enum validation here, because other enums checks run after initialise custom secrets backends
+        if backend_priority not in CustomSecretsBackendPriority.priorities():
+            raise AirflowConfigException(
+                f"`['secrets'] backend_priority` should not be {backend_priority!r}. "
+                f"Possible values: {', '.join(CustomSecretsBackendPriority.priorities())}."
+            )
+
+        backend_list.insert(CustomSecretsBackendPriority[backend_priority], custom_secret_backend)

Review Comment:
   I wonder if we should have a `conf.getenum` for this pattern. If not, an `upper` call here would save some unnecessary user frustration, at least.



-- 
This is an automated message from the Apache Git Service.
To respond to the message, please log on to GitHub and use the
URL above to go to the specific comment.

To unsubscribe, e-mail: commits-unsubscribe@airflow.apache.org

For queries about this service, please contact Infrastructure at:
users@infra.apache.org