config
**Configuration and Secrets Management**
**Configuration Sources**
```
Priority (high to low):
1. Environment variables
2. Config files (yaml, json, toml)
3. Default values
```
**Pydantic Settings**
```python
from pydantic_settings import BaseSettings
class Settings(BaseSettings):
# API keys (from env or .env file)
openai_api_key: str
anthropic_api_key: str | None = None
# Model configuration
default_model: str = "gpt-4o"
temperature: float = 0.7
max_tokens: int = 4096
# Infrastructure
redis_url: str = "redis://localhost:6379"
database_url: str
class Config:
env_file = ".env"
env_prefix = "LLM_" # LLM_OPENAI_API_KEY
settings = Settings()
```
**Secrets Management**
**Environment Variables**
```bash
# .env file (never commit!)
OPENAI_API_KEY=sk-...
DATABASE_URL=postgresql://user:pass@host/db
```
**Secret Managers**
```python
# AWS Secrets Manager
import boto3
def get_secret(secret_name):
client = boto3.client("secretsmanager")
response = client.get_secret_value(SecretId=secret_name)
return json.loads(response["SecretString"])
# HashiCorp Vault
import hvac
client = hvac.Client(url="https://vault.example.com")
secret = client.secrets.kv.read_secret_version(path="llm/api-keys")
```
**Kubernetes Secrets**
```yaml
apiVersion: v1
kind: Secret
metadata:
name: llm-secrets
type: Opaque
data:
openai-api-key: c2stLi4u # base64 encoded
---
apiVersion: apps/v1
kind: Deployment
spec:
template:
spec:
containers:
- name: app
env:
- name: OPENAI_API_KEY
valueFrom:
secretKeyRef:
name: llm-secrets
key: openai-api-key
```
**Configuration Hierarchy**
| Level | Example | Use Case |
|-------|---------|----------|
| Defaults | In code | Reasonable defaults |
| Base config | config.yaml | Environment-agnostic |
| Environment | config.prod.yaml | Per-environment |
| Secrets | Vault/SM | Sensitive values |
| Overrides | Env vars | Runtime tweaks |
**Best Practices**
- Never commit secrets to git
- Use secret managers in production
- Validate configuration at startup
- Use typed configuration (Pydantic)
- Rotate secrets regularly
- Audit secret access