Repository navigation
Conversation
…ssed)
Key Store: a "Secrets in playbooks" section. Keys are consumed by
Semaphore itself (repository, inventory SSH/become, vault password) and
never become an Ansible variable or a task environment variable, so
lookup('env', ...) on a key name is empty; only the inventory SSH key is
usable indirectly through SSH_AUTH_SOCK. The way to hand a value to a
playbook is a Variable Group secret: Extra variables become Ansible
extra vars, Environment variables become process env vars. Includes a
playbook example for both, the no_log practice (task output is not
filtered), base64 or ansible-vault for files such as SSH private keys,
and a "Since v2.20" note: before 2.20 extra-var secrets go on the
command line as --extra-vars name=value and are cut at the first space.
Variable Groups: a short Secrets section with the two lists, linking to
the Key Store section. Same change in all 10 locales.
Refs semaphoreui/semaphore#2117
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Answers semaphoreui/semaphore#2117 ("How do I access Key Store keys in a playbook?").
Key Store keys are never passed to a playbook. Semaphore uses them itself (repository access, inventory SSH/become credentials, vault password prompt), so
lookup('env', ...)on a key name is empty. The docs didn't say this anywhere.SSH_AUTH_SOCK); use Variable Group secrets instead, with an example for both the extra-variable and the environment-variable type;no_log: truesince task output isn't filtered; base64 oransible-vaultfor files like private keys; a "Since v2.20" note: before 2.20 extra-variable secrets go on the command line as--extra-vars name=value, show up in the process list and are cut at the first space.Checked against the code on
developand the release tags (Variable Group var/env secrets exist since 2.12; the vault-encrypted extra-vars file is only in 2.20 pre-releases).The same two sections are added in all 10 locales to keep the structure check happy. I translated them myself, so a native speaker's review would be welcome.
Build:
npm run buildpasses for all locales.scripts/check-docs.mjsreports 10 problems inadmin-guide/authentication/local, which are there onmainas well.