Secret collections¶

A secret collection defines one or more secrets used by your optimization model during execution. You can reference a secret collection either in an application instance configuration, or directly when starting a run. The platform then injects the secrets into the container during the optimization run as environment variables and files.

A secret collection can contain up to 20 secrets. Each secret has the following attributes:

• Type: determines how to inject the secret into the runtime.
  • env: the secret is injected as an environment variable.
  • file: the secret is injected as a file.
• Location: specifies where to put the secret.
  • For env type, it's the name of the environment variable to use, such as ACME_LICENSE_KEY.
  • For file type, it's the relative path to the execution directory for the file, for example licenses/acme.lic. Files are stored relative to the execution home directory. You cannot store a secret above the home directory (ie /mydir/myfile will be located at ./mydir/myfile from the perspective of your optimization code). The execution directory is considered to be where the app.yaml manifest file is located.
• Value: the actual value of the secret. This value must be text, and is limited to 1 KB.
  • For env type, the value is the value of the environment variable.
  • For file type, the value is the content of the file.

Secret values are write-only¶

Once set, a secret value cannot be retrieved through the Cloud API, the Python SDK, the CLI, or Console. When you get a secret collection, every secret value is replaced with the masked placeholder ***************. The type and location of each secret stay visible, so you can still inspect which secrets a collection contains. Runs that use the collection still receive the real secret values.

Because the masked placeholder is never a real value, any secret value equal to *************** is rejected with a 400 Bad Request error when creating or updating a secret collection.

Updating a secret collection¶

All updates to a secret collection go through the partial-update (PATCH) endpoint. In a single request, you can:

• Change the name and/or description of the collection.
• Create, update, or delete individual secrets, identified by their type and location.

You only send the changes you want to make, so you never need to resend the values of the secrets you are not changing. The request is applied completely or not at all. To change the location of a secret, delete it and create a new one, providing its value again.