This is an automated email from the ASF dual-hosted git repository.
shahar1 pushed a commit to branch main
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/main by this push:
new fcc55294185 Document JSON connections in Google Secret Manager backend
(#76649)
fcc55294185 is described below
commit fcc552941853a68c1ed876b91ac96539861f2f2f
Author: Thélio Matheus <[email protected]>
AuthorDate: Sat Nov 7 03:03:35 2026 -0300
Document JSON connections in Google Secret Manager backend (#76649)
* Document JSON connections in Google Secret Manager backend
The guide said connections must be stored as URIs, even though the base
secrets backend already parses JSON. Users with many extras were left
hand-encoding URIs and asking for a feature that already exists.
* Include the JSON connection secret in Secret Manager guide clean-up
The guide now creates a second connection secret, and leaving it out of the
clean-up steps would keep billing readers who follow them.
---------
Co-authored-by: Shahar Epstein <[email protected]>
---
.../google-cloud-secret-manager-backend.rst | 23 +++++++++++++++++++++-
1 file changed, 22 insertions(+), 1 deletion(-)
diff --git
a/providers/google/docs/secrets-backends/google-cloud-secret-manager-backend.rst
b/providers/google/docs/secrets-backends/google-cloud-secret-manager-backend.rst
index 091fa90a5bf..bc65c049525 100644
---
a/providers/google/docs/secrets-backends/google-cloud-secret-manager-backend.rst
+++
b/providers/google/docs/secrets-backends/google-cloud-secret-manager-backend.rst
@@ -119,7 +119,9 @@ You can configure the credentials in three ways:
Managing secrets
""""""""""""""""
-If you want to configure a connection, you need to save it as a
:ref:`connection URI representation <generating_connection_uri>`.
+If you want to configure a connection, you can save it either as a
+:ref:`JSON representation <connection-serialization-json-example>` or as a
+:ref:`connection URI representation <generating_connection_uri>`.
Variables should be saved as plain text.
In order to manage secrets, you can use the ``gcloud`` tool or other supported
tools. For more information, take a look at:
@@ -152,6 +154,24 @@ You can do it with the gcloud tools as in the example
below.
--replication-policy=automatic
Created version [1] of the secret [airflow-connections-first-connection].
+A connection with many extras is easier to read and maintain as JSON, because
its values do not need
+to be URL-encoded. The ``extra`` field can be a nested JSON object:
+
+.. code-block:: bash
+
+ $ echo '{
+ "conn_type": "google_cloud_platform",
+ "extra": {
+ "project": "my-project",
+ "key_path": "/keys/sa.json",
+ "scope": "https://www.googleapis.com/auth/cloud-platform";
+ }
+ }' | gcloud beta secrets create \
+ airflow-connections-second-connection \
+ --data-file=- \
+ --replication-policy=automatic
+ Created version [1] of the secret [airflow-connections-second-connection].
+
If you have the default backend configuration and you want to create a
variable named ``first-variable``,
you should create a secret named ``airflow-variables-first-variable``. You can
do it with the gcloud
command as in the example below.
@@ -251,4 +271,5 @@ delete secrets by running ``gcloud beta secrets delete``:
.. code-block:: bash
gcloud beta secrets delete airflow-connections-first-connection
+ gcloud beta secrets delete airflow-connections-second-connection
gcloud beta secrets delete airflow-variables-first-variable
