Secrets

SecretUtils wires a RefreshableCacheRegistry into your bakebook and adds the bake secret commands for tracked keys.

SecretUtils is a Bakebook mixin from bakelib.utils that wires a RefreshableCacheRegistry into your bakebook and adds the bake secret commands. It reuses the same FetchFn you define for the refreshable cache. Override get_secret_fetch_fns to declare which keys are tracked:

from bakelib.utils import SecretUtils


class MyBakebook(SecretUtils[str]):
    def get_secret_fetch_fns(self):
        return (GcpSecretFetchFn(key="api_key", project_id="my-project", secret_id="api-key"),)

Only tracked keys can be set or read. The bake secret group:

• bake secret list - tracked keys with cached/not-cached status (shows the namespace)
• bake secret get KEY - print a cached value
• bake secret set KEY VALUE - store a value (plain, not prompted)
• bake secret del [KEY] - delete one key, or all if none given
• bake secret refresh [KEY] - re-run the fetch functions for one key, or all

The default backend chain is MemoryCache + KeyringCache under the namespace "bakebook". Override get_secret_namespace() to isolate secrets per project.

For more details, see the bakelib source.