eitan-shalev commented on issue #72377: URL: https://github.com/apache/airflow/issues/72377#issuecomment-5506342362
Hi @RehanAhmad25 , thanks for picking this up! 1. Regarding Rendered Templates - If I'm reading the [documentation](https://airflow.apache.org/docs/apache-airflow/stable/security/secrets/mask-sensitive-values.html) correctly, then calling `mask_secret ` on the param's value, should ensure that it's masked also in the rendered template. Correct me if I'm wrong! 2. I think the _right_ thing to do is to encrypt the secret at rest as well, no doubt about it. But for a phase 1 PR, I think this could wait. Would be worth hearing from other voices in the community about it though. 3. Regarding nested values - Edge case, but I think it should be relatively easy to parse, same as parsing the list of params as a whole. So long as we limit the `format="password"` to params of type String, we avoid complex scenarios where an entire object needs to be treated as a secret. -- This is an automated message from the Apache Git Service. To respond to the message, please log on to GitHub and use the URL above to go to the specific comment. To unsubscribe, e-mail: [email protected] For queries about this service, please contact Infrastructure at: [email protected]
