CODEWITHSUNDEEP
powershellazureenvironment-variablesazure-devopsazure-keyvault
Sergey
Sergey

Reputation: 391

Unable to read VSTS Online release variables

I'm working with VSTS environment variables and stuck with variables of a secret type.
I'm using POSH script (file) to generate a variable (in fact, to obtain the value from Azure Key Vault and the set this value to the variable):

# Add as a script parameter during the release step

-ResourceGroupNameArg "$(ResourceGroupName)" -KeyVaultNameArg "$(KeyVaultName)" -KeyVaultSecretNameArg "$(KeyVaultSecretName)"

# The script itself 

Param(
   [string]$ResourceGroupNameArg,
   [string]$KeyVaultNameArg,
   [string]$KeyVaultSecretNameArg
)
<...>
$secret = Get-AzureKeyVaultSecret -VaultName $KeyVaultNameArg -Name $KeyVaultSecretNameArg 
$secretValue = $secret.SecretValueText
Write-Host "##vso[task.setvariable variable=SQLAdministratorPassword;issecret=true]$secretValue"

Here I can pass to the script different KeyVault names (according to my needs) - by substituting the $KeyVaultNameArg and $KeyVaultSecretNameArg variables.

For any other variables configured using ##vso[task.setvariable variable= I am able to retrieve them using the construction $env:DatabaseName (for example in another POSH script) or $(DatabaseName) in agent phase step (using Hosted 2017 agent).

However, for the issecret=true variable or even for a manually created variable I'm unable to retrieve its values during the release deployment process.

variables script release-error step-release

According to this article,

The values of hidden (secret) variables are stored securely on the server and cannot be viewed by users after they are saved. During a deployment, the Release Management service decrypts these values when referenced by the tasks and passes them to the agent over a secure HTTPS channel.

So IMO the variables should be accessible for the script (or even agent phase step) despite they are secret.

Upvotes: 2

Views: 471

Answers (1)

starian chen-MSFT
starian chen-MSFT

Reputation: 33738

Refer to these steps to do it:

  1. Click Library tab
  2. Click + Variable group
  3. Specify variable group name
  4. Enable Link secrets for an Azure Key vault as variables and link Azure key vault
  5. Click +Add to add necessary secret(s)
  6. Edit release definition
  7. Choose Variables tab
  8. Select Variable groups
  9. Click Link variable group to link that variable group
  10. Using the related variable directly in release task ($(variable name))

Upvotes: 0

Related Questions