Hi wave is it possible to use secrets in Ray tasks I tried t Flyte #flyte-v1-support

Hi :wave: is it possible to use secrets in Ray tas...

shy-evening-51366

12/09/2025, 8:23 AM

Hi 👋 is it possible to use secrets in Ray tasks? I tried this but I’m not seeing the secret propagated.

Copy code

@task(
    container_image=<ray_image>,
    requests=Resources(mem="2Gi", cpu="1"),
    task_config=RayJobConfig(
        worker_node_config=[WorkerNodeConfig(group_name="ray-group", replicas=1)],
    )
    secret_requests=[
        Secret(
            group="super-secrets",
            key="foo",
            mount_requirement=Secret.MountType.ENV_VAR,
        )
    ],
)
def test_get_secret():
    # Would expect to see _FSEC_SUPER-SECRETS_FOO here, but does not exist.
    print(os.environ)

Also tried adding

runtime_env

to the

RayJobConfig

but that ends up being empty because I assume the secret is populated at runtime, not at registration time:

Copy code

runtime_env={
    "env_vars": {
        "FOO": os.environ.get("_FSEC_SUPER-SECRETS_FOO", "")
    }
},

echoing-account-76888

12/09/2025, 11:26 AM

You can follow this docs to use secret: https://www.union.ai/docs/v1/flyte/deployment/flyte-configuration/secrets/#creating-secrets-with-a-secrets-manager Need to create secret with secret manager first

shy-evening-51366

12/09/2025, 11:31 AM

Thanks @echoing-account-76888. The Secret exists in Kubernetes already. If I run the task as a regular Flyte Python task (non-Ray) I can see it.

👀 1

echoing-account-76888

12/09/2025, 11:34 AM

Oh so it's only not working on ray's plugin? Let me try it out when I got time with your example to see what's the issue

shy-evening-51366

12/09/2025, 11:37 AM

Yeah exactly, if you just remove the

task_config=RayJobConfig(…)

from the

@task

decorator it works fine. Appreciate it!

shy-evening-51366

12/09/2025, 1:23 PM

As a workaround I have added a rolebinding for the serviceaccount in our Flyte namespace to access the specific Kubernetes secret that we need, and fetch it via k8s Python SDK directly, but would be nice if they were simply available via

secret_requests

(or if someone can confirm this is simply not possible today 🙂)

freezing-airport-6809

12/09/2025, 2:58 PM

It might be the ray operator

shy-evening-51366

12/09/2025, 4:15 PM

So should just work then @freezing-airport-6809?

echoing-account-76888

12/10/2025, 2:15 AM

@shy-evening-51366 Could you send your

PodSpec

for us? The env var should be in the pod spec environment section

13 Views

Open in Slack

Previous Next