This is an automated email from the ASF dual-hosted git repository.
potiuk pushed a commit to branch v3-3-test
in repository https://gitbox.apache.org/repos/asf/airflow.git
The following commit(s) were added to refs/heads/v3-3-test by this push:
new e45fb5c990b [v3-3-test] Document jwt_secret _secret and
LocalFilesystemBackend config support (#67940) (#70730)
e45fb5c990b is described below
commit e45fb5c990b3eb615b4bd9bb7f42bf46d41d3c26
Author: Jarek Potiuk <[email protected]>
AuthorDate: Thu Jul 30 11:20:03 2026 +0200
[v3-3-test] Document jwt_secret _secret and LocalFilesystemBackend config
support (#67940) (#70730)
(cherry picked from commit 193b2e36b065451d2725a7fac04d959bfb60ab88)
Co-authored-by: Aakcht <[email protected]>
---
airflow-core/docs/howto/set-config.rst | 1 +
.../local-filesystem-secrets-backend.rst | 47 +++++++++++++++++++++-
.../src/airflow/secrets/local_filesystem.py | 1 +
3 files changed, 48 insertions(+), 1 deletion(-)
diff --git a/airflow-core/docs/howto/set-config.rst
b/airflow-core/docs/howto/set-config.rst
index c35df0f4c89..31c6b536251 100644
--- a/airflow-core/docs/howto/set-config.rst
+++ b/airflow-core/docs/howto/set-config.rst
@@ -106,6 +106,7 @@ The following config options support this ``_cmd`` and
``_secret`` version:
* ``password`` in ``[atlas]`` section
* ``smtp_password`` in ``[smtp]`` section
* ``secret_key`` in ``[api]`` section
+* ``jwt_secret`` in ``[api_auth]`` section
The ``_cmd`` config options can also be set using a corresponding environment
variable
the same way the usual config options can. For example:
diff --git
a/airflow-core/docs/security/secrets/secrets-backend/local-filesystem-secrets-backend.rst
b/airflow-core/docs/security/secrets/secrets-backend/local-filesystem-secrets-backend.rst
index aaa71daf20a..3b5228be88d 100644
---
a/airflow-core/docs/security/secrets/secrets-backend/local-filesystem-secrets-backend.rst
+++
b/airflow-core/docs/security/secrets/secrets-backend/local-filesystem-secrets-backend.rst
@@ -35,6 +35,7 @@ Available parameters to ``backend_kwargs``:
* ``variables_file_path``: File location with variables data.
* ``connections_file_path``: File location with connections data.
+* ``configs_file_path``: File location with configurations data.
Here is a sample configuration:
@@ -42,7 +43,7 @@ Here is a sample configuration:
[secrets]
backend = airflow.secrets.local_filesystem.LocalFilesystemBackend
- backend_kwargs = {"variables_file_path": "/files/var.json",
"connections_file_path": "/files/conn.json"}
+ backend_kwargs = {"variables_file_path": "/files/var.json",
"connections_file_path": "/files/conn.json", "configs_file_path":
"/files/config.json"}
``JSON``, ``YAML`` and ``.env`` files are supported. All parameters are
optional. If the file path is not passed,
the backend returns an empty collection.
@@ -143,3 +144,47 @@ describe the variable value. The following is a sample
file.
VAR_A=some_value
var_B=different_value
+
+Storing and Retrieving Configurations
+"""""""""""""""""""""""""""""""""""""
+
+If you have set ``configs_file_path`` as ``/files/my_config.json``, then the
backend will read the
+file ``/files/my_config.json`` when it retrieves config options that are
specified with appended ``_secret``.
+
+The file can be defined in ``JSON``, ``YAML`` or ``env`` format.
+
+The JSON file must contain an object where the key contains config option
``_secret`` version value and the value
+contains config option value. The following are sample config options and a
sample JSON file for these config options.
+Config options:
+
+ .. code-block:: ini
+
+ [database]
+ sql_alchemy_conn_secret =
value_specified_in_database_sql_alchemy_conn_secret
+ [core]
+ fernet_key_secret = value_specified_in_core_fernet_key_secret
+
+JSON file:
+
+ .. code-block:: json
+
+ {
+ "value_specified_in_database_sql_alchemy_conn_secret":
"sql_alchemy_conn_actual_value",
+ "value_specified_in_core_fernet_key_secret": "fernet_key_actual_value"
+ }
+
+The YAML file structure is similar to that of JSON, with key containing config
option ``_secret`` version value
+and the value containing config option value. The following is a sample YAML
file for the above config options example.
+
+ .. code-block:: yaml
+
+ value_specified_in_database_sql_alchemy_conn_secret:
sql_alchemy_conn_actual_value
+ value_specified_in_core_fernet_key_secret: fernet_key_actual_value
+
+You can also define config options using a ``.env`` file. Then the key is the
config option ``_secret`` version value,
+and the value should be the config option value. The following is a sample
file for the above config options example.
+
+ .. code-block:: text
+
+
value_specified_in_database_sql_alchemy_conn_secret=sql_alchemy_conn_actual_value
+ value_specified_in_core_fernet_key_secret=fernet_key_actual_value
diff --git a/airflow-core/src/airflow/secrets/local_filesystem.py
b/airflow-core/src/airflow/secrets/local_filesystem.py
index dc247d969be..8e4fe314ce1 100644
--- a/airflow-core/src/airflow/secrets/local_filesystem.py
+++ b/airflow-core/src/airflow/secrets/local_filesystem.py
@@ -316,6 +316,7 @@ class LocalFilesystemBackend(BaseSecretsBackend,
LoggingMixin):
:param variables_file_path: File location with variables data.
:param connections_file_path: File location with connection data.
+ :param configs_file_path: File location with configuration data.
"""
def __init__(
