Configuration and Secrets Management

Configuration Sources

Priority (high to low):
1. Environment variables
2. Config files (yaml, json, toml)
3. Default values

Pydantic Settings

from pydantic_settings import BaseSettings

class Settings(BaseSettings):
    # API keys (from env or .env file)
    openai_api_key: str
    anthropic_api_key: str | None = None

    # Model configuration
    default_model: str = "gpt-4o"
    temperature: float = 0.7
    max_tokens: int = 4096

    # Infrastructure
    redis_url: str = "redis://localhost:6379"
    database_url: str

    class Config:
        env_file = ".env"
        env_prefix = "LLM_"  # LLM_OPENAI_API_KEY

settings = Settings()

Secrets Management

Environment Variables

# .env file (never commit!)
OPENAI_API_KEY=sk-...
DATABASE_URL=postgresql://user:pass@host/db

Secret Managers

# AWS Secrets Manager
import boto3

def get_secret(secret_name):
    client = boto3.client("secretsmanager")
    response = client.get_secret_value(SecretId=secret_name)
    return json.loads(response["SecretString"])

# HashiCorp Vault
import hvac

client = hvac.Client(url="https://vault.example.com")
secret = client.secrets.kv.read_secret_version(path="llm/api-keys")

Kubernetes Secrets

apiVersion: v1
kind: Secret
metadata:
  name: llm-secrets
type: Opaque
data:
  openai-api-key: c2stLi4u  # base64 encoded

---
apiVersion: apps/v1
kind: Deployment
spec:
  template:
    spec:
      containers:
      - name: app
        env:
        - name: OPENAI_API_KEY
          valueFrom:
            secretKeyRef:
              name: llm-secrets
              key: openai-api-key

Configuration Hierarchy

Best Practices

• Never commit secrets to git
• Use secret managers in production
• Validate configuration at startup
• Use typed configuration (Pydantic)
• Rotate secrets regularly
• Audit secret access