vaultRotateSecretId¶
Rotate Vault AppRole Secret ID
Description¶
This step takes the given Vault secret ID and checks whether it needs to be renewed and if so it will update the secret ID in the configured secret store.
Usage¶
We recommend to define values of step parameters via .pipeline/config.yml file.
In this case, calling the step is essentially reduced to defining the step name.
Calling the step can be done either in an orchestrator specific way (e.g. via a Jenkins library step) or on the command line.
library('piper-lib-os')
vaultRotateSecretId script: this
piper vaultRotateSecretId
Prerequisites¶
Parameters¶
Overview - Step¶
Name | Mandatory | Additional information |
---|---|---|
adoPersonalAccessToken | (yes) | mandatory in case of: - secretStore =ado |
script | (yes) | |
vaultAppRoleSecretTokenCredentialsId | yes | |
vaultServerUrl | yes | |
adoOrganization | no | |
adoPipelineId | no | |
adoProject | no | |
daysBeforeExpiry | no | |
jenkinsCredentialDomain | no | |
jenkinsToken | no | |
jenkinsUrl | no | |
jenkinsUsername | no | |
secretStore | no | |
vaultNamespace | no | |
verbose | no | activates debug output |
Overview - Execution Environment¶
Orchestrator-specific only
These parameters are relevant for orchestrator usage and not considered when using the command line option.
Name | Mandatory | Additional information |
---|---|---|
Details¶
adoOrganization¶
The Azure DevOps organization name
Scope | Details |
---|---|
Aliases | - |
Type | string |
Mandatory | no |
Default | $PIPER_adoOrganization (if set) |
Secret | no |
Configuration scope |
|
Resource references | none |
adoPersonalAccessToken¶
The Azure DevOps personal access token
Scope | Details |
---|---|
Aliases | token |
Type | string |
Mandatory | mandatory in case of: - secretStore =ado |
Default | $PIPER_adoPersonalAccessToken (if set) |
Secret | yes |
Configuration scope |
|
Resource references | Vault paths:
|
adoPipelineId¶
The Azure DevOps pipeline ID. Also called as definition ID
Scope | Details |
---|---|
Aliases | - |
Type | int |
Mandatory | no |
Default | 0 |
Secret | no |
Configuration scope |
|
Resource references | none |
adoProject¶
The Azure DevOps project ID. Project name also can be used
Scope | Details |
---|---|
Aliases | - |
Type | string |
Mandatory | no |
Default | $PIPER_adoProject (if set) |
Secret | no |
Configuration scope |
|
Resource references | none |
daysBeforeExpiry¶
The amount of days before expiry until the secret ID gets rotated
Scope | Details |
---|---|
Aliases | - |
Type | int |
Mandatory | no |
Default | 15 |
Secret | no |
Configuration scope |
|
Resource references | none |
jenkinsCredentialDomain¶
The jenkins credential domain which should be used
Scope | Details |
---|---|
Aliases | - |
Type | string |
Mandatory | no |
Default | _ |
Secret | no |
Configuration scope |
|
Resource references | none |
jenkinsToken¶
The jenkins token
Scope | Details |
---|---|
Aliases | token |
Type | string |
Mandatory | no |
Default | $PIPER_jenkinsToken (if set) |
Secret | yes |
Configuration scope |
|
Resource references | Vault paths:
|
jenkinsUrl¶
The jenkins url
Scope | Details |
---|---|
Aliases | url |
Type | string |
Mandatory | no |
Default | $PIPER_jenkinsUrl (if set) |
Secret | yes |
Configuration scope |
|
Resource references | Vault paths:
|
jenkinsUsername¶
The jenkins username
Scope | Details |
---|---|
Aliases | userId |
Type | string |
Mandatory | no |
Default | $PIPER_jenkinsUsername (if set) |
Secret | yes |
Configuration scope |
|
Resource references | Vault paths:
|
script¶
Jenkins-specific: Used for proper environment setup.
The common script environment of the Jenkinsfile running. Typically the reference to the script calling the pipeline step is provided with the this
parameter, as in script: this
. This allows the function to access the commonPipelineEnvironment
for retrieving, e.g. configuration parameters.
Scope | Details |
---|---|
Aliases | - |
Type | Jenkins Script |
Mandatory | yes |
Default | |
Secret | no |
Configuration scope |
|
Resource references | none |
secretStore¶
The store to which the secret should be written back to
Scope | Details |
---|---|
Aliases | - |
Type | string |
Mandatory | no |
Default | jenkins |
Possible values | - jenkins - ado |
Secret | no |
Configuration scope |
|
Resource references | none |
vaultAppRoleSecretTokenCredentialsId¶
The Jenkins credential ID or Azure DevOps variable name for the Vault AppRole Secret ID credential
Scope | Details |
---|---|
Aliases | - |
Type | string |
Mandatory | yes |
Default | $PIPER_vaultAppRoleSecretTokenCredentialsId (if set) |
Secret | no |
Configuration scope |
|
Resource references | none |
vaultNamespace¶
The Vault namespace that should be used (optional)
Scope | Details |
---|---|
Aliases | - |
Type | string |
Mandatory | no |
Default | $PIPER_vaultNamespace (if set) |
Secret | no |
Configuration scope |
|
Resource references | none |
vaultServerUrl¶
The URL for the Vault server to use
Scope | Details |
---|---|
Aliases | - |
Type | string |
Mandatory | yes |
Default | $PIPER_vaultServerUrl (if set) |
Secret | no |
Configuration scope |
|
Resource references | none |
verbose¶
verbose output
Scope | Details |
---|---|
Aliases | - |
Type | bool |
Mandatory | no |
Default | false |
Possible values | - true - false |
Secret | no |
Configuration scope |
|
Resource references | none |
Exceptions¶
none