@ancient-wolf-19325 I have some env vars that I need in my container. How to ensure that the flyte pod that's running has it too? These are secrets. So I don't want to bake them into the images.

To inject secrets as environment variables into Flyte task containers, use Flyte's secret management feature. First, create the secret using the Flyte CLI (e.g.,

flyte create secret MY_SECRET_KEY my_secret_value

). Then, in your task, request the secret and specify the environment variable name it should be injected as. Access the secret in your code using

os.getenv("MY_SECRET_ENV_VAR")

. This avoids baking secrets into images and keeps them secure at runtime. Example:

import os
import flyte

env = flyte.TaskEnvironment(
    secrets=[flyte.Secret(key="MY_SECRET_KEY", as_env_var="MY_SECRET_ENV_VAR")]
)

@env.task
def secure_task():
    secret_value = os.getenv("MY_SECRET_ENV_VAR")
    # Use secret_value safely

According to Union.ai Docs, this method ensures secrets are securely injected as environment variables only at runtime. Would you like more detail on scoping, file-based secrets, or advanced secret management? Sources: - Union.ai Docs: Secrets 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.

For Flyte V1 @ancient-wolf-19325

In Flyte v1, you inject secrets as environment variables by defining them as Kubernetes secrets in the same namespace as your workflow, then requesting them in your task using the

Secret

class with

mount_requirement=Secret.MountType.ENV_VAR

. Access the secret in your task with

flytekit.current_context().secrets.get(<group>, <key>)

. Example:

from flytekit import Secret, task, workflow, current_context

@task(secret_requests=[Secret(group="user-info", key="user_secret", mount_requirement=Secret.MountType.ENV_VAR)])
def secret_task() -> str:
    secret_val = current_context().secrets.get("user-info", "user_secret")
    return secret_val

@workflow
def wf() -> str:
    return secret_task()

First, create the Kubernetes secret (e.g.,

kubectl create secret -n <namespace> generic user-info --from-literal=user_secret=mysecret

). This keeps secrets out of images and injects them securely at runtime as environment variables. See Flyte productionizing secrets example and Flyte documentation. Would you like more detail on mounting as files, grouping secrets, or using external secret managers? Sources: - Flyte productionizing secrets example - Flyte documentation: secrets 👍 0 button 👎 0 button 💡 Hint: Mention @runllm in the thread for followups.

ty