mirror of
https://github.com/hashicorp/vault-action.git
synced 2025-11-09 08:06:55 +00:00
+ added documentation on how to use the retrieved secrets
+ added an example of converting the vault-action outputs to json
This commit is contained in:
parent
256bfb9e6a
commit
270f8f6e36
1 changed files with 34 additions and 0 deletions
34
README.md
34
README.md
|
|
@ -44,6 +44,7 @@ jobs:
|
||||||
steps:
|
steps:
|
||||||
# ...
|
# ...
|
||||||
- name: Import Secrets
|
- name: Import Secrets
|
||||||
|
id: import-secrets
|
||||||
uses: hashicorp/vault-action@v2
|
uses: hashicorp/vault-action@v2
|
||||||
with:
|
with:
|
||||||
url: https://vault.mycompany.com:8200
|
url: https://vault.mycompany.com:8200
|
||||||
|
|
@ -56,6 +57,39 @@ jobs:
|
||||||
# ...
|
# ...
|
||||||
```
|
```
|
||||||
|
|
||||||
|
Retrieved secrets are available as environment variables or outputs for subsequent steps:
|
||||||
|
```yaml
|
||||||
|
#...
|
||||||
|
- name: Step following 'Import Secrets'
|
||||||
|
run: |
|
||||||
|
ACCESS_KEY_ID = "${{ env.AWS_ACCESS_KEY_ID }}"
|
||||||
|
SECRET_ACCESS_KEY = "${{ steps.import-secrets.outputs.AWS_SECRET_ACCESS_KEY }}"
|
||||||
|
# ...
|
||||||
|
```
|
||||||
|
|
||||||
|
If your project needs a format other than env vars and step outputs, you can use additional steps to transform them into the desired format.
|
||||||
|
For example, a common pattern is to save all the secrets in a JSON file:
|
||||||
|
```yaml
|
||||||
|
#...
|
||||||
|
- name: Step following 'Import Secrets'
|
||||||
|
run: |
|
||||||
|
touch secrets.json
|
||||||
|
echo "${{ toJson(steps.import-secrets.outputs) }}" >> secrets.json
|
||||||
|
# ...
|
||||||
|
```
|
||||||
|
|
||||||
|
Which with our example would yield a file containing:
|
||||||
|
```json
|
||||||
|
{
|
||||||
|
"ACCESS_KEY_ID": "MY_KEY_ID",
|
||||||
|
"SECRET_ACCESS_KEY": "MY_SECRET_KEY",
|
||||||
|
"NPM_TOKEN": "MY_NPM_TOKEN"
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
Note that all secrets are masked so programs need to read the file themselves otherwise all values will be replaced with a `***` placeholder.
|
||||||
|
|
||||||
|
|
||||||
## Authentication Methods
|
## Authentication Methods
|
||||||
|
|
||||||
Consider using a [Vault authentication method](https://www.vaultproject.io/docs/auth) such as the JWT auth method with
|
Consider using a [Vault authentication method](https://www.vaultproject.io/docs/auth) such as the JWT auth method with
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue