

Secrets YAML Reference#

This document is the reference for the YAML grammar used for creating Semaphore secrets.

A secret is a bucket that stores environment variables and files.

A secret (along with its contents) is created for the current organization and is available to this organization only, unless you add it to other organizations. Additionally, a secret is visible to all the users of an organization.

Properties#

apiVersion#

The apiVersion property defines the version of the YAML grammar that will be used in the current YAML file. Different versions might have different features.

The list of values for apiVersion can be obtained by entering: v1beta.

kind#

The kind property defines the purpose of the YAML file. For a YAML file that will be used for defining secrets, the value of the kind property should be Secret.

The list of values for kind can be obtained by entering: Secret.

metadata#

The metadata property defines the metadata of the Secrets YAML file. Currently, only the name property is allowed, but this might change in future versions.

name in metadata#

The value of the name property, which is a string, defines the name of the secret in the metadata context. This name value will be used in the Pipeline YAML file for importing a specific secret or as an argument for the sem delete secret command.

The value of each name property should be unique for all secrets that exist under the same organization and must only contain [a-z], [A-Z], or [0-9] characters, dashes, and underscores – spaces are not allowed.

data#

The data property, which is compulsory, holds a single env_vars property and/or a single files property.

env_vars#

The env_vars property is a list of name and value pairs that allows you to define the names and the values of the environment variables that will be inserted into a secret.

name in env_vars#

The value of the name property under the env_vars property defines the name of an environment variable.

The name of an environment variable should follow these guidelines.

value#

The value of the value property defines the value of an environment variable that was previously defined using the name property.

files#

The files property holds a list of items with path and content pairs and is used for storing files in secrets.

path#

The path property holds the name of the file that will be stored – this value defines the way the file is going to be referenced and restored in the future and should not exist in the GitHub repository.

content#

The content property holds the contents of the file that will be referenced by the value of the path property. The data of the content field is in -Base64 representation-.

Example#

apiVersion: v1beta
kind: Secret
metadata:
  name: a-secret-name
data:
  env_vars:
    - name: SECRET_ONE
      value: "This is the value of SECRET_ONE"
    - name: SECRET_TWO
      value: "This is the value of SECRET_TWO"

The previous example defines a secret named a-secrets-name, which contains two environment variables named SECRET_ONE and SECRET_TWO, which have the values This is the value of SECRET_ONE and This is the value of SECRET_TWO, respectively.

The following example is equivalent to the previous example:

apiVersion: v1beta
kind: Secret
metadata:
  name: a-secret-name
data:
  env_vars:
    - name: SECRET_ONE
      value: "This is the value of SECRET_ONE"
    - name: SECRET_TWO
      value: "This is the value of SECRET_TWO"
  files: []

Example with files#

apiVersion: v1beta
kind: Secret
metadata:
  name: my-secrets
data:
  env_vars:
  - name: SECRET_ONE
    value: This is a little secret
  files:
  - path: file.txt
    content: SGVsbG8gU2VtYXBob3JlIDIuMAo=

The data in the content field is the output of the base64 file.txt command, because the contents of the file are in Base64 representation.

Example with an empty secret#

If you want to create an empty secret, you can define the data block as follows:

apiVersion: v1beta
kind: Secret
metadata:
  name: empty-secret
data:
  env_vars: []
  files: []