Secrets and Engine Configuration Variables

Chalk provides two distinct settings mechanisms that inject key-value pairs into your deployments that are designed for two distinct purposes, secrets and engine configuration variables:

• Secrets are designed to inject values into your resolver runtime - the runtime environment that is exposed to your Python and SQL resolvers when they run in Chalk’s system. These values are stored encrypted in your own cloud account’s Key Management Service. This is the correct tool for providing passwords, API keys, tokens, connection strings, and certificates to your resolvers.
• Engine configuration variables are designed to inject values into the Chalk execution engine runtime. These variables are an escape hatch designed for detailed and advanced tuning of the operation of the execution engine, including threadpool sizes, advanced query planner behavior, and other behavioral changes, and are not intended for the purpose of injecting values into your resolver runtime.

Secrets are injected into the resolver runtime and read the same way in your resolver or in a setup hook:

import os

value = os.getenv("MY_VARIABLE")

​

Secrets

Use a secret for any value you would not want to check into source control — SASL passwords, AWS/GCP keys, third-party API tokens, database connection strings, or SSL material. Secrets are stored in your cloud secret manager and injected into your deployment containers, where they are made available to resolvers via os.getenv (as Python environment variables).

​

Managing secrets in the dashboard

Under Integrations > Secrets, you can view, add, edit, and delete secrets. When creating or editing a secret, provide the name and value and select the environments it should apply to. This is the recommended way to set a secret whose value you do not want to type on the command line.

​

Managing secrets with the CLI

The chalk secret command lets you upsert, inspect, and delete secrets.

​

Setting a secret

chalk secret set upserts one or more secrets. There are three ways to provide values:

# Interactive mode
$ chalk secret set

# From stdin
$ cat key.pem | chalk secret set TLS_CERT
$ base64 -i chalk.p12 | chalk secret set PKCS12_CERT

# Key-value pairs
$ chalk secret set MY_SECRET_KEY=s3cr3t
$ chalk secret set MY_OTHER_SECRET_KEY=5ecret PORT=9000

​

Inspecting and deleting secrets

# List the secrets available in this environment
$ chalk secret list

# Get a single secret by name
$ chalk secret get --name CHALK_KAFKA_SASL_USERNAME

# Delete one or more secrets
$ chalk secret delete --name CHALK_KAFKA_SASL_PASSWORD

Changing a secret is the same operation as creating one — re-run chalk secret set (or edit it on the Secrets page) with the new value.

​

Engine Configuration Variables

Use engine configuration variables to inject configuration that adjusts how your services behave — feature flags, tuning knobs, and other runtime configuration. They can be applied at two scopes, plus the CLI.

Engine configuration variables are used to configure the Chalk engine’s own runtime. Any value you need to read from your resolvers — and especially anything sensitive — should be set as a Secret instead.

​

Environment-wide (Config variables page)

Under Integrations > Config variables, you can view and edit the global engine configuration variables for your environment. Values set here apply across the whole environment and map to the environment’s additional_env_vars.

​

Per-service (Resource page)

To scope an engine configuration variable to a specific service (for example, only the engine-grpc or streaming server in a particular resource group), set it on the Resource page for that service under Advanced > Engine Config Variable Overrides. These values apply only to the targeted service rather than the whole environment.

​

With the CLI

You can read more about programmatic management of Chalk configuration variables under Programmatic Management

​

Chalk environment variables

Chalk also injects some special environment variables into the resolver runtime for use in your resolvers: