Azure DevOps replace part of variable with value from KeyVault

Question

I have a Azure Devops pipeline that tries to replace part of a string variable value with a value from Azure KeyVault.

Given a KeyVault secret kvSecret with value this-is-my-secret, I want another variable foo with value this-is-your-secret.

jobs:
- job: WebApp
  pool:
    vmImage: 'windows-latest'
  variables:
    foo: $[replace(variables['kvSecret'], 'my', 'your')]

  steps:
  - task: AzureKeyVault@2
    inputs:
      azureSubscription: 'foo'
      KeyVaultName: 'myKeyVault'
      RunAsPreJob: true

Since logging is masked, I tested this by writing to a file:

  - task: PowerShell@2
    inputs:
      targetType: 'inline'
      script: |
        New-Item $(build.artifactstagingdirectory)\test.txt
        Set-Content $(build.artifactstagingdirectory)\test.txt '$(foo)'

  - task: PublishBuildArtifacts@1
    inputs:
      pathToPublish: '$(Build.ArtifactStagingDirectory)'

The output is this-is-my-secret though.

Kevin Lu · Accepted Answer · 2021-12-30 08:50:31Z

I have tested your YAML definition, the variable foo should be empty.

The reason for this issue is that the replace expression will be expanded at compile time.

And the variable in your Key Vault will be downloaded when the pipeline is running.

Therefore, when the replace operation is performed, the kvSecret variable is empty, and the foo variable is also empty.

In order to solve this issue, you need to add a script to the Agent Job to perform the replace operation.

Here is an example:

jobs:
- job: WebApp
  pool:
    vmImage: 'windows-latest'
    
  steps:
  - task: AzureKeyVault@2
    inputs:
      azureSubscription: 'xx'
      KeyVaultName: 'xx'
      SecretsFilter: '*'
      RunAsPreJob: true

  - task: PowerShell@2
    inputs:
      targetType: 'inline'
      script: |
        $newvalue = "$(kvSecret)" -replace "my", "your"
        echo $newvalue 
        echo "##vso[task.setvariable variable=foo]$newvalue"
        
  - task: PowerShell@2
    inputs:
      targetType: 'inline'
      script: |
        echo "$(foo)"
        New-Item $(build.artifactstagingdirectory)\test.txt
        Set-Content $(build.artifactstagingdirectory)\test.txt -value '$(foo)'
  - task: PublishBuildArtifacts@1
    inputs:
      pathToPublish: '$(Build.ArtifactStagingDirectory)'

Result:

Collectives™ on Stack Overflow

Azure DevOps replace part of variable with value from KeyVault

1 Answer 1

Comments

Your Answer

Hot Network Questions

Collectives™ on Stack Overflow

1 Answer 1

Comments

Your Answer

Sign up or log in

Post as a guest

Related