akeyless-community / akeyless-github-action Goto Github PK
View Code? Open in Web Editor NEWLicense: Mozilla Public License 2.0
License: Mozilla Public License 2.0
Hi Team,
First, love the work on expanding the functionality and pushing this out to the marketplace. Unfortunately, I have discovered an issue with this that is also present in my action... I am unable to get the values of the AAD dynamic secret.
Let me set you up properly.
This is what you get when using the Akeyless CLI when fetching an Azure AD dynamic secret.
{
"id": "{\"secret_name\":\"tmp.p-m9vvgiii6rip.kj36S\",\"secret_key_id\":\"0c46516c-076e-4e69-bcf3-7c2fcac265a7\"}",
"msg": "User has been added successfully to the following Group(s): [] Role(s): [] Expires on Thu Aug 10 14:38:59 UTC 2023",
"secret": {
"appId": "207ff3fc-f6e3-4467e-babf-66b62e047be7",
"displayName": "tmp.p-m9vvgiii6rip.kj36S",
"keyId": "0c46516c-3456-4e69-bcf3-7c2fcac265a7",
"secretText": "xrk8Q~qvnUbBHfXlCmaTdIakNyLc8xC.50gBqa0K",
"tenantId": "bd47e796-1234-4b8a-9101-1f4c0c7af31a"
},
"ttl_in_minutes": "60"
}
Notice how the important values we need to use are inside the secret
value:
In my Action, this never gets properly parsed by the SDK, and it also seems you might be experiencing the same problem. Here is what happens when I run this action and try to get the value for secret
key: "secret"
For PrecisionYou can reproduce this with the following YAML. Notice I am using key=secret to be able to ignore the rest of the top-level values.:
- name: Fetch AKeyless Secret
id: akeyless
uses: akeyless-community/[email protected]
with:
access-id: 'p-XXXXXXXX'
dynamic-secrets: |
- name: "/path/to/my/azure-ad-dynamic-secret/"
output-name: "aad"
key: "secret"
access-type: jwt
- name: Verify Outputs
run: |
echo "appId: ${{ steps.akeyless.outputs.appId }}"
echo "secretText: ${{ steps.akeyless.outputs.secretText }}"
echo "tenantId: ${{ steps.akeyless.outputs.tenantId }}"
echo "displayName: ${{ steps.akeyless.outputs.displayName }}"
echo "keyId: ${{ steps.akeyless.outputs.keyId }}"
If you want to avoid the error, you can run it like this (with out declaring key: "secret"
):
- name: Fetch AKeyless Secret
id: akeyless
uses: akeyless-community/[email protected]
with:
access-id: 'p-XXXXXXXX'
dynamic-secrets: |
- name: "/path/to/my/azure-ad-dynamic-secret/"
output-name: "aad"
access-type: jwt
- name: Verify Outputs
run: |
echo $aadSecret = '${{ steps.akeyless.outputs.aad }}' | jq '.secret'
echo '$aadSecret' | jq '.appId'
echo '$aadSecret' | jq '.secretText'
echo '$aadSecret' | jq '.tenantId'
echo '$aadSecret' | jq '.displayName'
echo '$aadSecret' | jq '.keyId'
This will output the rest of the dynamic secret's values.. but not secret.appId, secret.tenantId, etc. In fact, it still breaks when trying to read the value of secret
:
Either of these two outcomes would be considered a resolution.
key
, but is able to iterate over the sub-keys of secret
key: "secret"
and then be able access the values of appId
, tenantId
and secretText
Hi there ,
I have been trying to extract a satic secret which was made of an RSA private key but my git pipeline can't seem to read it properly
Run echo ***
echo ***
***
***
***
***
***
***
***
***
***
*** | base64 -d >> rsa.pem
echo '***' | jq -r 'to_entries|map("JWT_\(.key)=\(.value|tostring)")|.[]' >> $GITHUB_ENV
shell: /usr/bin/bash --noprofile --norc -e -o pipefail {0}
env:
MY_RSA: ***
MYSQL_DYNAMIC_SECRET: ***
token: ***
***
/home/runner/work/_temp/e58e94d7-f3f9-417c-a[2](https://github.com/brokedba/Akeyless_demo/actions/runs/9731884769/job/26856886071#step:5:2)2d-937e8b10a517.sh: line 2: ***: No such file or directory
Error: Process completed with exit code 12[7](https://github.com/brokedba/Akeyless_demo/actions/runs/9731884769/job/26856886071#step:5:7).
static-secrets: |
- name: "/MyVault/DBs/OCI_RSA"
output-name: "MY_RSA"
dynamic-secrets: |
- name: "/MyVault/DBs/MySQLDynamicSecret"
output-name: "MYSQL_DYNAMIC_SECRET"
# static-secrets: '{"/MyVault/DBs/OCI_RSA":"MY_RSA"}'
# dynamic-secrets:'{"/MyVault/DBs/MySQLDynamicSecret":"MYSQL_DYNAMIC_SECRET"}'
- name: Create PEM File & Export Dynamic Secret to Environment
run: |
echo ${{ steps.fetch-secrets.outputs.MY_RSA }} | base64 -d >> rsa.pem
echo '${{ steps.fetch-secrets.outputs.MYSQL_DYNAMIC_SECRET }}' | jq -r 'to_entries|map("JWT_\(.key)=\(.value|tostring)")|.[]' >> $GITHUB_ENV
A declarative, efficient, and flexible JavaScript library for building user interfaces.
๐ Vue.js is a progressive, incrementally-adoptable JavaScript framework for building UI on the web.
TypeScript is a superset of JavaScript that compiles to clean JavaScript output.
An Open Source Machine Learning Framework for Everyone
The Web framework for perfectionists with deadlines.
A PHP framework for web artisans
Bring data to life with SVG, Canvas and HTML. ๐๐๐
JavaScript (JS) is a lightweight interpreted programming language with first-class functions.
Some thing interesting about web. New door for the world.
A server is a program made to process requests and deliver data to clients.
Machine learning is a way of modeling and interpreting data that allows a piece of software to respond intelligently.
Some thing interesting about visualization, use data art
Some thing interesting about game, make everyone happy.
We are working to build community through open source technology. NB: members must have two-factor auth.
Open source projects and samples from Microsoft.
Google โค๏ธ Open Source for everyone.
Alibaba Open Source for everyone
Data-Driven Documents codes.
China tencent open source team.