使 Azure Keyvault 机密在整个管道中可用

Question

In order to access my secret from the keyvault, I run

        - task: AzureKeyVault@2
          inputs:
            azureSubscription: $(KEYVAULT_SC_DEV)
            KeyVaultName: $(KEYVAULT_NAME_DEV)
            SecretsFilter: APICREDENTIALS
            RunAsPreJob: true 

which works fine.

However, I have multiple jobs and am now facing the trouble of having to repeat these lines too many times.

So, is there a way to tell Azure Devops that this secret should be set globally for each job/stage/step.. etc?

Answer 1

If you want to make Azure Keyvault secrets available across multiple jobs or stages with AzureKeyVault@2 task, you can use outputs in a different stages.

For example, I've set secret password in my KeyVault.

Across multiple jobs:

 variables:
     # map the output variable from A into this job
     password-job-b: $[ dependencies.A.outputs['ouputvariable.mypassword'] ]

Across multiple stage:

variables:
      # map the output variable from A into this job
      password-stage-two: $[ stageDependencies.One.A.outputs['ouputvariable.mypassword'] ]

Across whole job:

 - task: AzureKeyVault@2
   RunAsPreJob: true ## Make the secret(s) available to the whole job

Full yaml sample:

trigger:
- none

pool:
  vmImage: ubuntu-latest

stages:
- stage: One
  jobs:
  - job: A
    steps:
    - task: AzureKeyVault@2
      inputs:
       azureSubscription: ‘your subscription‘
       KeyVaultName: ‘your keyvault name’
       SecretsFilter: '*'
       RunAsPreJob: true
    - task: Bash@3
      inputs:
        targetType: 'inline'
        script: 'echo "##vso[task.setvariable variable=mypassword;isOutput=true]$(password)"'
      name : ouputvariable
  - job: B
    dependsOn : A 
    variables:
     # map the output variable from A into this job
     password-job-b: $[ dependencies.A.outputs['ouputvariable.mypassword'] ]
    steps:
    - script: echo this is password :$(password-job-b) # this step uses the mapped-in variable
- stage: Two
  variables:
      # map the output variable from A into this job
      password-stage-two: $[ stageDependencies.One.A.outputs['ouputvariable.mypassword'] ]
  jobs:
  - job: C
    steps:
    - script: echo this is password :$(password-stage-two) # this step uses the mapped-in variable

Result across multiple jobs:

Result across multiple stages:

UPDATE

When issecret is set to true, the value of the variable will be saved as secret.

script: 'echo "##vso[task.setvariable variable=mypassword;isOutput=true;issecret=true]$(password)"'

Answer 2

If you want these secrets available to multiple pipelines one way would be to use the library variables

And reference these in your pipeline https://learn.microsoft.com/en-us/azure/devops/pipelines/library/variable-groups?view=azure-devops&tabs=yaml#use-a-variable-group

If you want these secrets available to multiple stages/jobs/steps within the same pipeline one way would be to create a pipeline variable

variables:
  secretValue: ''

jobs:
- job: RetrieveSecret
  steps:
  - task: AzureKeyVault@2
    inputs:
      azureSubscription: $(KEYVAULT_SC_DEV)
      KeyVaultName: $(KEYVAULT_NAME_DEV)
      SecretsFilter: APICREDENTIALS
      OutputVariable: secretValue

Here the RetrieveSecret job retrieves the secret from the Key Vault and stores it in the secretValue pipeline variable.Once the secret has been stored in the pipeline variable, you can reference it from any job or task in your pipeline by using the $(pipelineVariableName) syntax.

The caveat here is that pipeline variables are scoped to a specific job, if you wanted to use the same variable across different jobs then you need to pass this value to the next job sort of like below

jobs:
- job: Job1
  steps:
  - task: AzureKeyVault@2
    inputs:
      azureSubscription: $(KEYVAULT_SC_DEV)
      KeyVaultName: $(KEYVAULT_NAME_DEV)
      SecretsFilter: APICREDENTIALS
      OutputVariable: secretValue
- job: Job2
  inputs:
    secretInput: $(secretValue)
  steps:
  - task: SomeTask
    inputs:
      secret: $(secretInput)

Answer 3

We can use " variable groups " to pass the values into a YAML pipeline, which we can make available across all.

Steps1: Store Key vault key values into Variable Groups how to use keyvault

Step2: Use that Variable group into any pipelines Here is the reference: tutorial from Thomas Thornton