Secrets
thoth.shared.utils.secrets
¶
Google Cloud Secret Manager integration for secure credential management.
logger = setup_logger(__name__)
module-attribute
¶
SecretManagerClient
¶
Client for reading secrets from Google Cloud Secret Manager.
Provides lazy-initialization of the Secret Manager API client and fallback to environment variables when the API is unavailable or when running locally. Used for GitLab tokens, GCP credentials, etc.
project_id = project_id or os.getenv('GCP_PROJECT_ID')
instance-attribute
¶
__init__(project_id: str | None = None)
¶
Initialize the Secret Manager client (API not called until first use).
Parameters:
| Name | Type | Description | Default |
|---|---|---|---|
project_id
|
str | None
|
GCP project ID for Secret Manager. If None, uses the GCP_PROJECT_ID environment variable. |
None
|
Returns:
| Type | Description |
|---|---|
|
None. |
get_secret(secret_id: str, version: str = 'latest') -> str | None
cached
¶
Get a secret value from Secret Manager.
Parameters:
| Name | Type | Description | Default |
|---|---|---|---|
secret_id
|
str
|
The ID of the secret to retrieve |
required |
version
|
str
|
The version of the secret (default: "latest") |
'latest'
|
Returns:
| Type | Description |
|---|---|
str | None
|
The secret value as a string, or None if not found |
get_gitlab_token() -> str | None
¶
Get GitLab access token.
Returns:
| Type | Description |
|---|---|
str | None
|
GitLab token or None |
get_gitlab_url() -> str
¶
Get GitLab base URL.
Returns:
| Type | Description |
|---|---|
str
|
GitLab URL (defaults to https://gitlab.com) |
get_google_credentials() -> str | None
¶
Get Google application credentials JSON.
Returns:
| Type | Description |
|---|---|
str | None
|
Credentials JSON string or None |
get_secret_manager() -> SecretManagerClient
¶
Return the global SecretManagerClient singleton, creating it if needed.
Uses a module-level variable so that all callers share the same client and lazy-initialization happens only once.
Returns:
| Type | Description |
|---|---|
SecretManagerClient
|
The global SecretManagerClient instance. |