如何从Airflow Secrets中获取变量？配置HashiCorp Vault后变量无法正常用于Slack连接的问题咨询

Hey there! Let me break down what's going on here and how to get your Slack integration working properly.

First off, that "***" you're seeing isn't encryption—it's Airflow's built-in sensitive data masking at work. Airflow automatically masks values it recognizes as secrets (like variables pulled from a secret backend) when they're printed to logs or the UI. The actual value is still being retrieved correctly; you just can't see it in plaintext for security reasons.

Here's how to troubleshoot and resolve your Slack connection problem:

1. Verify Your Vault Setup & Variable Exists #

Double-check that your variable is actually stored correctly in Vault. Run this command inside your Vault container:

vault kv get airflow/variables/slack_token

You should see the value=SOMETHING entry you created. If not, re-run your vault kv put command to ensure the variable is saved properly.

2. Validate Airflow's Vault Configuration #

Make sure your backend config is set up correctly, especially the token (hardcoding tokens isn't ideal for production, by the way!).

• If you're using environment variables for the Vault token (recommended), update your BACKEND_KWARGS to pull from an env var instead:

  AIRFLOW__SECRETS__BACKEND_KWARGS: '{"url":"http://vault:8200","token":"${VAULT_TOKEN}","variables_path":"variables","mount_point":"airflow","connections_path":"connections"}'
  

  Then set VAULT_TOKEN=My_TOKEN_TO_VAULT as an environment variable in your Airflow deployment.

• Confirm the Vault token has the right permissions to read the airflow/variables path. Your Vault policy should include something like:

  path "airflow/variables/*" {
    capabilities = ["read"]
  }
  

  Attach this policy to your token if it isn't already.

3. Correctly Use the Variable in Your Slack Integration #

The key here is to pass the variable directly to your Slack operator/hook—don't waste time trying to print it (since it'll always be masked). Here's a working example with the Slack API Post Operator:

from airflow import DAG
from airflow.providers.slack.operators.slack_webhook import SlackWebhookOperator
from airflow.models import Variable
from datetime import datetime

default_args = {
    'owner': 'airflow',
    'start_date': datetime(2024, 1, 1)
}

with DAG('slack_notification_dag', 
         default_args=default_args, 
         schedule_interval='@daily') as dag:

    # Retrieve the token—no need to print it!
    slack_token = Variable.get('slack_token')

    send_slack_alert = SlackWebhookOperator(
        task_id='send_slack_alert',
        webhook_token=slack_token,
        channel='#your-slack-channel',
        text='✅ Airflow DAG completed successfully!'
    )

If you're using the SlackHook instead, the pattern is similar:

from airflow.providers.slack.hooks.slack import SlackHook

slack_hook = SlackHook(slack_token=Variable.get('slack_token'))
slack_hook.send_message(channel='#your-channel', text='Test message from Airflow')

4. Verify Variable Retrieval (Without Printing) #

If you want to confirm the variable is being fetched correctly without relying on the Slack integration, use Airflow's CLI:

airflow variables get slack_token

This should return your actual token value (unless your CLI is also masked, but in most cases, it'll show the plaintext for verification).

Wrap-Up #

The "***" is a red herring—it's just Airflow keeping your secrets safe. The real issues to check are:

• Vault variable path and permissions
• Correct Airflow backend configuration
• Properly passing the variable to your Slack operator/hook

Once those are sorted, your Slack connection should work as expected!

内容的提问来源于stack exchange，提问作者Yahoovsky