mirror of
https://github.com/hashicorp/vault-action.git
synced 2025-11-09 08:06:55 +00:00
+ added documentation on how to use the retrieved secrets
+ added an example of converting the vault-action outputs to json
This commit is contained in:
parent
256bfb9e6a
commit
270f8f6e36
1 changed files with 34 additions and 0 deletions
34
README.md
34
README.md
|
|
@ -44,6 +44,7 @@ jobs:
|
|||
steps:
|
||||
# ...
|
||||
- name: Import Secrets
|
||||
id: import-secrets
|
||||
uses: hashicorp/vault-action@v2
|
||||
with:
|
||||
url: https://vault.mycompany.com:8200
|
||||
|
|
@ -56,6 +57,39 @@ jobs:
|
|||
# ...
|
||||
```
|
||||
|
||||
Retrieved secrets are available as environment variables or outputs for subsequent steps:
|
||||
```yaml
|
||||
#...
|
||||
- name: Step following 'Import Secrets'
|
||||
run: |
|
||||
ACCESS_KEY_ID = "${{ env.AWS_ACCESS_KEY_ID }}"
|
||||
SECRET_ACCESS_KEY = "${{ steps.import-secrets.outputs.AWS_SECRET_ACCESS_KEY }}"
|
||||
# ...
|
||||
```
|
||||
|
||||
If your project needs a format other than env vars and step outputs, you can use additional steps to transform them into the desired format.
|
||||
For example, a common pattern is to save all the secrets in a JSON file:
|
||||
```yaml
|
||||
#...
|
||||
- name: Step following 'Import Secrets'
|
||||
run: |
|
||||
touch secrets.json
|
||||
echo "${{ toJson(steps.import-secrets.outputs) }}" >> secrets.json
|
||||
# ...
|
||||
```
|
||||
|
||||
Which with our example would yield a file containing:
|
||||
```json
|
||||
{
|
||||
"ACCESS_KEY_ID": "MY_KEY_ID",
|
||||
"SECRET_ACCESS_KEY": "MY_SECRET_KEY",
|
||||
"NPM_TOKEN": "MY_NPM_TOKEN"
|
||||
}
|
||||
```
|
||||
|
||||
Note that all secrets are masked so programs need to read the file themselves otherwise all values will be replaced with a `***` placeholder.
|
||||
|
||||
|
||||
## Authentication Methods
|
||||
|
||||
Consider using a [Vault authentication method](https://www.vaultproject.io/docs/auth) such as the JWT auth method with
|
||||
|
|
|
|||
Loading…
Reference in a new issue