-
Notifications
You must be signed in to change notification settings - Fork 16
Description
The Worker base already provides two wrapper methods to read values from the input config:
However sometimes it's required to read additional configuration from the environment, therefore I propose the introduction of a get_env method which could be implemented very similar to the __get_param method:
def get_env(self, key, default=None, message=None):
if key in os.environ:
return os.environ[key]
else:
if message is not None:
self.error(message)
return defaultThe reason behind this request is that cortex is pretty incomplete with secret handling, because it makes no difference between a generic configuraton value and a secret configuraton value. So whenever a worker configuration is requested it sends the secret values over the network and displays them in the UI as plain text too, e.g.:
In our case the security governance forces us to move away from the secret handling via worker configuration and to outsource secrets into the environment.
With the above proposed solution we could share our approach with other members of the cortex community and could avoid code repetition across all our custom analyzers/responders by just reusing the get_env method from the cortexutils library itself.
A possible usage example would be:
from cortexutils.analyzer import Analyzer
class MyAnalyzer(Analyzer):
def __init__(self):
super().__init__()
self.my_secret = self.get_env(key="MY_SECRET") # read the value of the `MY_SECRET` environment variable and store in `my_secret`