Adds support for optionally encrypted secrets

Author: fabiob

README.md

@@ -22,6 +22,8 @@ pixi add pydantic-settings-sops
 To use pydantic-settings-sops, adjust your settings sources by defining a custom `settings_customise_sources`.
 For more information on `pydantic-settings`, please visit the [official documentation](https://docs.pydantic.dev/latest/concepts/pydantic_settings).
 
+If your settings are always encrypted with SOPS, you can use the following example:
+
 ```py
 from pydantic_settings import (
  BaseSettings,
@@ -31,22 +33,44 @@ from pydantic_settings import (
 from pydantic_settings_sops import SOPSConfigSettingsSource
 
 class SettingsExample(BaseSettings):
- model_config = SettingsConfigDict(
- yaml_file="secrets.yaml"
- )
+ model_config = SettingsConfigDict(yaml_file="secrets.yaml")
+
+ foobar: str
+
+ @classmethod
+ def settings_customise_sources(
+ cls,
+ settings_cls: type[BaseSettings],
+ init_settings: PydanticBaseSettingsSource,
+ **other_settings: PydanticBaseSettingsSource,
+ ) -> tuple[PydanticBaseSettingsSource, ...]:
+ return init_settings, SOPSConfigSettingsSource(settings_cls), *other_settings.values()
+```
+
+If you need to handle JSON or YAML files that might be encrypted or not (i.e., encrypted in development but decrypted in
+production), you must use the specific source classes, `SopsYamlSettingsSource` or `SopsJsonSettingsSource`:
+
+```py
+from pydantic_settings import (
+ BaseSettings,
+ PydanticBaseSettingsSource,
+ SettingsConfigDict,
+)
+from pydantic_settings_sops import SopsYamlSettingsSource
+
+class SettingsExample(BaseSettings):
+ model_config = SettingsConfigDict(yaml_file="secrets.yaml")
 
  foobar: str
 
  @classmethod
  def settings_customise_sources(
  cls,
- settings_cls: BaseSettings,
+ settings_cls: type[BaseSettings],
  init_settings: PydanticBaseSettingsSource,
- env_settings: PydanticBaseSettingsSource,
- dotenv_settings: PydanticBaseSettingsSource,
- file_secret_settings: PydanticBaseSettingsSource,
+ **other_settings: PydanticBaseSettingsSource,
  ) -> tuple[PydanticBaseSettingsSource, ...]:
- return (init_settings, SOPSConfigSettingsSource(settings_cls))
+ return init_settings, SopsYamlSettingsSource(settings_cls), *other_settings.values()
 ```
 
 ## Installation

pydantic_settings_sops/__init__.py

@@ -1,6 +1,10 @@
 import importlib.metadata
 import warnings
 
+from .json import SopsJsonSettingsSource
+from .mixin import SopsConfigFileSourceMixin
+from .yaml import SopsYamlSettingsSource
+
 try:
  __version__ = importlib.metadata.version(__name__)
 except importlib.metadata.PackageNotFoundError as e: # pragma: no cover
@@ -49,3 +53,11 @@ def _read_file(self, file_path: Path) -> dict[str, Any]:
  decrypted = sops.decrypt(to_dict=True)
  assert isinstance(decrypted, dict)
  return decrypted
+
+
+__all__ = [
+ "SOPSConfigSettingsSource",
+ "SopsJsonSettingsSource",
+ "SopsYamlSettingsSource",
+ "SopsConfigFileSourceMixin",
+]

pydantic_settings_sops/json.py

@@ -0,0 +1,21 @@
+from pydantic_settings import BaseSettings, JsonConfigSettingsSource
+from pydantic_settings.sources import DEFAULT_PATH, PathType
+
+from .mixin import SopsConfigFileSourceMixin
+
+
+class SopsJsonSettingsSource(SopsConfigFileSourceMixin, JsonConfigSettingsSource):
+ """
+ A source that contains variables on a optionally encrypted SOPS JSON file
+ """
+
+ def __init__(
+ self,
+ settings_cls: type[BaseSettings],
+ json_file: PathType | None = DEFAULT_PATH,
+ json_file_encoding: str | None = None,
+ *,
+ allow_unencrypted: bool = True,
+ ):
+ self.allow_unencrypted = allow_unencrypted
+ super().__init__(settings_cls, json_file, json_file_encoding)

pydantic_settings_sops/mixin.py

@@ -0,0 +1,25 @@
+from abc import ABC
+from pathlib import Path
+from typing import Any
+
+from pydantic_settings.sources import ConfigFileSourceMixin
+from sopsy import Sops, SopsyCommandFailedError
+
+
+class SopsConfigFileSourceMixin(ConfigFileSourceMixin, ABC):
+ """
+ Mixin for reading configuration files optionally encrypted with SOPS.
+ """
+
+ allow_unencrypted: bool = True
+
+ def _read_file(self, file_path: Path) -> dict[str, Any]:
+ try:
+ sops = Sops(file_path)
+ decrypted = sops.decrypt(to_dict=True)
+ assert isinstance(decrypted, dict)
+ return decrypted
+ except SopsyCommandFailedError as exc:
+ if self.allow_unencrypted and "sops metadata not found" in str(exc):
+ return super()._read_file(file_path) # type: ignore[safe-super]
+ raise

pydantic_settings_sops/yaml.py

@@ -0,0 +1,24 @@
+from pydantic_settings import BaseSettings, YamlConfigSettingsSource
+from pydantic_settings.sources import DEFAULT_PATH, PathType
+
+from .mixin import SopsConfigFileSourceMixin
+
+
+class SopsYamlSettingsSource(SopsConfigFileSourceMixin, YamlConfigSettingsSource):
+ """
+ A source that contains variables on a optionally encrypted SOPS YAML file
+ """
+
+ def __init__(
+ self,
+ settings_cls: type[BaseSettings],
+ yaml_file: PathType | None = DEFAULT_PATH,
+ yaml_file_encoding: str | None = None,
+ yaml_config_section: str | None = None,
+ *,
+ allow_unencrypted: bool = True,
+ ):
+ self.allow_unencrypted = allow_unencrypted
+ super().__init__(
+ settings_cls, yaml_file, yaml_file_encoding, yaml_config_section
+ )

tests/resources/unencrypted.json

@@ -0,0 +1 @@
+{"answer": 42}

tests/resources/unencrypted.yaml

@@ -0,0 +1 @@
+answer: 42

tests/test_optional_yaml.py

@@ -0,0 +1,70 @@
+import pytest
+from pydantic_settings import (
+ BaseSettings,
+ PydanticBaseSettingsSource,
+ SettingsConfigDict,
+)
+
+from pydantic_settings_sops import SopsJsonSettingsSource, SopsYamlSettingsSource
+
+
+class ExampleSettingsYaml(BaseSettings):
+ model_config = SettingsConfigDict(
+ yaml_file=[
+ "tests/resources/secrets.yaml",
+ "tests/resources/secrets2.yaml",
+ "tests/resources/unencrypted.yaml",
+ ]
+ )
+
+ foobar: str
+ foobar2: str
+ answer: int
+
+ @classmethod
+ def settings_customise_sources(
+ cls,
+ settings_cls: type[BaseSettings],
+ init_settings: PydanticBaseSettingsSource,
+ **rest: PydanticBaseSettingsSource,
+ ) -> tuple[PydanticBaseSettingsSource, ...]:
+ return init_settings, SopsYamlSettingsSource(settings_cls), *rest.values()
+
+
+class ExampleSettingsJson(BaseSettings):
+ model_config = SettingsConfigDict(
+ json_file=[
+ "tests/resources/secrets.json",
+ "tests/resources/secrets2.json",
+ "tests/resources/unencrypted.json",
+ ]
+ )
+
+ foobar: str
+ foobar2: str
+ answer: int
+
+ @classmethod
+ def settings_customise_sources(
+ cls,
+ settings_cls: type[BaseSettings],
+ init_settings: PydanticBaseSettingsSource,
+ **rest: PydanticBaseSettingsSource,
+ ) -> tuple[PydanticBaseSettingsSource, ...]:
+ return init_settings, SopsJsonSettingsSource(settings_cls), *rest.values()
+
+
+@pytest.mark.parametrize("settings_cls", [ExampleSettingsYaml, ExampleSettingsJson])
+def test_basic_settings(settings_cls):
+ settings = settings_cls()
+ assert settings.foobar == "foo"
+ assert settings.foobar2 == "foo"
+ assert settings.answer == 42
+
+
+@pytest.mark.parametrize("settings_cls", [ExampleSettingsYaml, ExampleSettingsJson])
+def test_settings_with_override(settings_cls):
+ settings2 = settings_cls(foobar="bar")
+ assert settings2.foobar == "bar"
+ assert settings2.foobar2 == "foo"
+ assert settings2.answer == 42