SecretProvider

Base SecretProvider — default implementation raises NotImplementedError.

class scamander.secrets.provider.SecretProvider

Bases: object

Base class for platform secret providers.

The default implementation raises NotImplementedError for every call, acting as an explicit sentinel when no provider has been configured. Pass a concrete subclass to Platform to enable secret retrieval:

from scamander.secrets import HashiCorpVaultProvider

platform = Platform(secret_provider=HashiCorpVaultProvider())
password = platform.get_secret("database/pg-password")

The vault argument in get_secret() is interpreted differently per provider — see each concrete class for details. A default can also be set in the provider constructor, in which case passing vault per-call is optional.

get_secret(secret_name: str, vault: str | None = None) → str

Retrieve a secret by name.

Parameters:

  • secret_name – Name or path of the secret to retrieve.

  • vault – Provider-specific vault / scope / mount identifier. See the concrete provider for details.

Returns:

The secret value as a plain string.

Raises:

NotImplementedError – Always — no provider has been configured.