mirror of
https://github.com/hashicorp/vault-action.git
synced 2025-11-07 15:16:56 +00:00
Enhanced "Example Usage" section (#435)
+added documentation on how to use the retrieved secrets + added an example of converting the vault-action outputs to json * fix e2e test setup
This commit is contained in:
parent
256bfb9e6a
commit
3a9100e7d5
2 changed files with 35 additions and 1 deletions
34
README.md
34
README.md
|
|
@ -44,6 +44,7 @@ jobs:
|
||||||
steps:
|
steps:
|
||||||
# ...
|
# ...
|
||||||
- name: Import Secrets
|
- name: Import Secrets
|
||||||
|
id: import-secrets
|
||||||
uses: hashicorp/vault-action@v2
|
uses: hashicorp/vault-action@v2
|
||||||
with:
|
with:
|
||||||
url: https://vault.mycompany.com:8200
|
url: https://vault.mycompany.com:8200
|
||||||
|
|
@ -56,6 +57,39 @@ jobs:
|
||||||
# ...
|
# ...
|
||||||
```
|
```
|
||||||
|
|
||||||
|
Retrieved secrets are available as environment variables or outputs for subsequent steps:
|
||||||
|
```yaml
|
||||||
|
#...
|
||||||
|
- name: Step following 'Import Secrets'
|
||||||
|
run: |
|
||||||
|
ACCESS_KEY_ID = "${{ env.AWS_ACCESS_KEY_ID }}"
|
||||||
|
SECRET_ACCESS_KEY = "${{ steps.import-secrets.outputs.AWS_SECRET_ACCESS_KEY }}"
|
||||||
|
# ...
|
||||||
|
```
|
||||||
|
|
||||||
|
If your project needs a format other than env vars and step outputs, you can use additional steps to transform them into the desired format.
|
||||||
|
For example, a common pattern is to save all the secrets in a JSON file:
|
||||||
|
```yaml
|
||||||
|
#...
|
||||||
|
- name: Step following 'Import Secrets'
|
||||||
|
run: |
|
||||||
|
touch secrets.json
|
||||||
|
echo "${{ toJson(steps.import-secrets.outputs) }}" >> secrets.json
|
||||||
|
# ...
|
||||||
|
```
|
||||||
|
|
||||||
|
Which with our example would yield a file containing:
|
||||||
|
```json
|
||||||
|
{
|
||||||
|
"ACCESS_KEY_ID": "MY_KEY_ID",
|
||||||
|
"SECRET_ACCESS_KEY": "MY_SECRET_KEY",
|
||||||
|
"NPM_TOKEN": "MY_NPM_TOKEN"
|
||||||
|
}
|
||||||
|
```
|
||||||
|
|
||||||
|
Note that all secrets are masked so programs need to read the file themselves otherwise all values will be replaced with a `***` placeholder.
|
||||||
|
|
||||||
|
|
||||||
## Authentication Methods
|
## Authentication Methods
|
||||||
|
|
||||||
Consider using a [Vault authentication method](https://www.vaultproject.io/docs/auth) such as the JWT auth method with
|
Consider using a [Vault authentication method](https://www.vaultproject.io/docs/auth) such as the JWT auth method with
|
||||||
|
|
|
||||||
|
|
@ -1,7 +1,7 @@
|
||||||
const got = require('got');
|
const got = require('got');
|
||||||
|
|
||||||
const vaultUrl = `${process.env.VAULT_HOST}:${process.env.VAULT_PORT}`;
|
const vaultUrl = `${process.env.VAULT_HOST}:${process.env.VAULT_PORT}`;
|
||||||
const vaultToken = `${process.env.VAULT_TOKEN || 'testtoken'}`
|
const vaultToken = `${process.env.VAULT_TOKEN}` === undefined ? `${process.env.VAULT_TOKEN}` : "testtoken";
|
||||||
|
|
||||||
(async () => {
|
(async () => {
|
||||||
try {
|
try {
|
||||||
|
|
|
||||||
Loading…
Reference in a new issue