I am trying to play with the Sensor agent. I wonder what's the best way to pass credentials (secrets) from a workflow to the sensor's

poke

method?

cc @glamorous-carpet-83516 / @damp-lion-88352

In flyte, we haven't support sensor with credential. https://docs.flyte.org/en/latest/flytesnacks/examples/sensor/file_sensor_example.html

we usually mount the secret to the agent pod. why do you want to pass a secret from a workflow to the sensor?

My use-case is to check whether a copy operation has completed on Azure Blob Storage. I can control the level of access that each "normal" task has (by choosing, which secrets it will use), but with the sensor agent it appears I would then need to give it access to practically everything, which isn't great. Right now I am probably going to stick to generating a delegation token for a specific blob that I want to check and pass it as a parameter to the sensor, but it sounds not particularly secure either because those keys will exposed to everyone in the Flyte UI.

I don't have much experience with credentials and Blob Storage, but let me try to give you some information about how Flyte add minio credential to the agent pod.

^ I think this is equivalent to giving the agent access to basically everything that any workflow may conceivably use.

I don't think we've supported this. But after this PR merged, use a config to store the secret will be a good alternative. https://github.com/flyteorg/flyte/pull/5126

Unless config is per-project, this doesn't change much.

looking, seems like it happens in 1.12

Unless config is per-project, this doesn't change much.

@hallowed-branch-43666 since Flyte does not really own the secrets this is manual. In the Union managed platform this is how it works. It binds at any arbitrary level