Multiple secret backend sources

[Zingeryo]

Is it possible to use more than one secret backend at a time? Right now we are using Hashicorp Vault, which only admins can edit, for both connection and variable secrets. We want to keep that, but also to setup second Vault instance with additional access for developers. I.e. like this

[secrets]
backend = airflow.providers.hashicorp.secrets.vault.VaultBackend

backend_kwargs =
    {
      "connections_path": "airflow/connections",
      "variables_path": "airflow/variables",
      "mount_point": "project",
      "url": "https://vault.domain.com"
    },
    {
      "variables_path": "airflow/variables",
      "mount_point": "project",
      "url": "https://vault-dev.domain.com"
    }

[potiuk]

You can roll your own Secrets Backend that will use composition pattern and can combine any number of secret backend https://airflow.apache.org/docs/apache-airflow/stable/security/secrets/secrets-backend/index.html#roll-your-own-secrets-backend

The choice we made that this is not a declarative configuration but imperative Python code that you can write - because it gives you far bigger flexibility and way to handle edge cases, sequence or even custom way of routing your secret retrieval methods. That's the power of Python (that you already know if you write Dags and local settings that are also an imperative Python code).

[Zingeryo]

Thanks for response, i'll try that