Skip to content

feat: support private key env. #327

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
wants to merge 2 commits into
base: master
Choose a base branch
from
Open

feat: support private key env. #327

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
0f9fc22
feat: support private key.
ya7010 Mar 14, 2025
cd20507
fix: use private_key_path.
ya7010 Apr 7, 2025
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 8 additions & 0 deletions schemachange/config/DeployConfig.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -9,6 +9,7 @@
from schemachange.config.utils import (
get_snowflake_identifier_string,
get_snowflake_password,
get_snowflake_private_key,
)


Expand Down Expand Up @@ -93,4 +94,11 @@ def get_session_kwargs(self) -> dict:
if snowflake_password is not None and snowflake_password:
session_kwargs["password"] = snowflake_password

private_key_path, private_key_passphrase = get_snowflake_private_key()
if private_key_path:
session_kwargs["private_key_path"] = private_key_path

if private_key_passphrase:
session_kwargs["private_key_passphrase"] = private_key_passphrase

return {k: v for k, v in session_kwargs.items() if v is not None}
6 changes: 6 additions & 0 deletions schemachange/config/utils.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -161,3 +161,9 @@ def get_snowflake_password() -> str | None:
return snowsql_pwd
else:
return None


def get_snowflake_private_key() -> tuple[str | None, str | None]:
private_key_path = os.getenv("SNOWFLAKE_PRIVATE_KEY_PATH")
private_key_passphrase = os.getenv("SNOWFLAKE_PRIVATE_KEY_PASSPHRASE")
return private_key_path, private_key_passphrase
7 changes: 5 additions & 2 deletions schemachange/session/SnowflakeSession.py
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -10,7 +10,7 @@

from schemachange.config.ChangeHistoryTable import ChangeHistoryTable
from schemachange.config.utils import get_snowflake_identifier_string
from schemachange.session.Script import VersionedScript, RepeatableScript, AlwaysScript
from schemachange.session.Script import AlwaysScript, RepeatableScript, VersionedScript


class SnowflakeSession:
Expand Down Expand Up @@ -64,7 +64,10 @@ def __init__(
"role": role, # TODO: Remove when connections.toml is enforced
"warehouse": warehouse, # TODO: Remove when connections.toml is enforced
"private_key_file": kwargs.get(
"private_key_path"
"private_key_file"
), # TODO: Remove when connections.toml is enforced
"private_key_file_pwd": kwargs.get(
"private_key_file_pwd"
), # TODO: Remove when connections.toml is enforced
Copy link

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

This statement should not be removed even after connections.toml is enforced. Since, we will not want to write the private key passphrase into a file even then.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

cd20507

Fixed to use private_key_path, and removed comments.

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@AttilaVM

My team is waiting for PASSPHRASE support to be released.

Is there anything else I can do?

Copy link

@mibelbahri mibelbahri Jul 4, 2025 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@ya7010 shouldn't we go all the way to just supporting SNOWFLAKE_PRIVATE_KEY as an env variable instead of SNOWFLAKE_PRIVATE_KEY_PATH (avoiding materializing the key all together)

Copy link
Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@mibelbahri
Are you referring to using SNOWFLAKE_PRIVATE_KEY instead of SNOWFLAKE_PRIVATE_KEY_PATH?

I think SNOWFLAKE_PRIVATE_KEY_PASSPHRASE should be retained.

"token": kwargs.get(
"oauth_token"
Expand Down