CloudBees action: Fetch secrets from CyberArk Conjur

Use this action to fetch secrets from CyberArk Conjur, a tool that securely stores and retrieves sensitive information, such as passwords and API keys. Fetched secret output is masked in CloudBees platform and cannot be logged or accessed by background processes, so it can be used securely in a downstream step of the same job.

If you want to use the same secrets in another job, you must call the Conjur action again in that job.

All CloudBees action repositories are listed at CloudBees, Inc. on GitHub.

Inputs

Table 1. Input details
Input name	Data type	Required?	Description
`login`	String	Yes	The Conjur workload identity.
`api-key`	String	Yes	The API key for generating a short-lived access token for authentication.
`url`	String	Yes	The Conjur server URL.
`variables`	String	Yes	A comma-separated list of the full paths of each secret to be fetched.

Output

Table 2. Output details
Output name	Data type	Description
`conjur_output`	JSON string	The value of each fetched secret, in JSON format.

Any forward slashes (/) in the variables input are replaced with underscores (_) by CloudBees platform in the output, so to refer to full paths, you must replace / with _.

Usage examples: Basic usage

The following is a basic example of using this action:

    steps:
      - name: Fetch secrets from Conjur
        uses: cloudbees-io/cyberark-conjur-fetch-secrets@v1
        with:
          login: ${{ vars.YOUR_CONJUR_WORKLOAD_ID }}
          api-key: ${{ secrets.YOUR_CONJUR_API_KEY }}
          url: ${{ vars.YOUR_CONJUR_URL }}
          variables: full/path/to/secret-1,full/path/to/secret-2▼

Usage examples: Using the action output

Access the conjur_output values in downstream steps using the outputs context.

Use the conjur_output output for a single secret value as follows, where <action_step_ID> is the action step ID, and <full_path_no_slashes> is the full path of the secret, with any / replaced with _:

${{ fromJSON(steps.<action_step_ID>.outputs.conjur_output).<full_path_no_slashes> }}▼

In the following example, the action output is used in a downstream step of the same job.

Each echo command outputs *** in place of the secret, because the action masks all fetched secrets.

jobs:
  use-conjur-secrets:
    steps:
      - name: Fetch secrets from Conjur
        id: fetch-my-secrets
        uses: cloudbees-io/cyberark-conjur-fetch-secrets@v1
        with:
          login: ${{ vars.YOUR_CONJUR_WORKLOAD_ID }}
          api-key: ${{ secrets.YOUR_CONJUR_API_KEY }}
          url: ${{ vars.YOUR_CONJUR_URL }}
          variables: my-org/my-directory/secret1,my-org/my-directory/secret2

      - name: Use fetched secrets
        uses: docker://alpine:latest
        shell: sh
        run: |
          echo "Secret1 is fetched but masked: ${{ fromJSON(steps.fetch-my-secrets.outputs.conjur_output).my-org_my-directory_secret1 }}"
          echo "Secret2 is fetched but masked: ${{ fromJSON(steps.fetch-my-secrets.outputs.conjur_output).my-org_my-directory_secret2 }}"▼