Skip to main content

Secret Resolver

This module provides secure credential management by loading secrets from mounted volumes (Kubernetes-style) with fallback to environment variables. It supports type-safe configuration using dataclasses and follows Cloud patterns for secret resolution.

The Secret Resolver is designed to work seamlessly in both Kubernetes environments with mounted secrets and with environment variables.

Getting Started​

The Secret Resolver loads configuration into dataclass objects using a hierarchical approach:

  • First: Try to read from mounted volume paths (Kubernetes secrets)
  • Fallback: Use environment variables if mounted secrets are not available
from dataclasses import dataclass
from sap_cloud_sdk.secret_resolver import read_from_mount_and_fallback_to_env_var


@dataclass
class DatabaseConfig:
    host: str = ""
    port: str = ""
    username: str = ""
    password: str = ""


# Load configuration
config = DatabaseConfig()
read_from_mount_and_fallback_to_env_var(
    base_volume_mount="/etc/secrets",  # Base mount path
    base_var_name="DB",  # Environment variable prefix
    module="database",  # Module/service name
    instance="primary",  # Instance name
    target=config,  # Target dataclass instance
)

print(f"Database: {config.username}@{config.host}:{config.port}")

For the complete API reference and more examples, see the Secret Resolver user guide in the cloud-sdk-python repository.