mirror of
https://github.com/hashicorp/vault-action.git
synced 2025-11-07 07:06:56 +00:00
Enhanced "Example Usage" section (#435)
+added documentation on how to use the retrieved secrets + added an example of converting the vault-action outputs to json * fix e2e test setup
This commit is contained in:
parent
256bfb9e6a
commit
3a9100e7d5
2 changed files with 35 additions and 1 deletions
34
README.md
34
README.md
|
|
@ -44,6 +44,7 @@ jobs:
|
|||
steps:
|
||||
# ...
|
||||
- name: Import Secrets
|
||||
id: import-secrets
|
||||
uses: hashicorp/vault-action@v2
|
||||
with:
|
||||
url: https://vault.mycompany.com:8200
|
||||
|
|
@ -56,6 +57,39 @@ jobs:
|
|||
# ...
|
||||
```
|
||||
|
||||
Retrieved secrets are available as environment variables or outputs for subsequent steps:
|
||||
```yaml
|
||||
#...
|
||||
- name: Step following 'Import Secrets'
|
||||
run: |
|
||||
ACCESS_KEY_ID = "${{ env.AWS_ACCESS_KEY_ID }}"
|
||||
SECRET_ACCESS_KEY = "${{ steps.import-secrets.outputs.AWS_SECRET_ACCESS_KEY }}"
|
||||
# ...
|
||||
```
|
||||
|
||||
If your project needs a format other than env vars and step outputs, you can use additional steps to transform them into the desired format.
|
||||
For example, a common pattern is to save all the secrets in a JSON file:
|
||||
```yaml
|
||||
#...
|
||||
- name: Step following 'Import Secrets'
|
||||
run: |
|
||||
touch secrets.json
|
||||
echo "${{ toJson(steps.import-secrets.outputs) }}" >> secrets.json
|
||||
# ...
|
||||
```
|
||||
|
||||
Which with our example would yield a file containing:
|
||||
```json
|
||||
{
|
||||
"ACCESS_KEY_ID": "MY_KEY_ID",
|
||||
"SECRET_ACCESS_KEY": "MY_SECRET_KEY",
|
||||
"NPM_TOKEN": "MY_NPM_TOKEN"
|
||||
}
|
||||
```
|
||||
|
||||
Note that all secrets are masked so programs need to read the file themselves otherwise all values will be replaced with a `***` placeholder.
|
||||
|
||||
|
||||
## Authentication Methods
|
||||
|
||||
Consider using a [Vault authentication method](https://www.vaultproject.io/docs/auth) such as the JWT auth method with
|
||||
|
|
|
|||
|
|
@ -1,7 +1,7 @@
|
|||
const got = require('got');
|
||||
|
||||
const vaultUrl = `${process.env.VAULT_HOST}:${process.env.VAULT_PORT}`;
|
||||
const vaultToken = `${process.env.VAULT_TOKEN || 'testtoken'}`
|
||||
const vaultToken = `${process.env.VAULT_TOKEN}` === undefined ? `${process.env.VAULT_TOKEN}` : "testtoken";
|
||||
|
||||
(async () => {
|
||||
try {
|
||||
|
|
|
|||
Loading…
Reference in a new issue