Setting up integration with Yandex Lockbox in SourceCraft

In SourceCraft CI/CD, you can use secrets whose values are stored in Yandex Lockbox. SourceCraft gets access to them via a service connection.

With Yandex Lockbox integration, you can:

• Store secrets in Yandex Cloud without duplicating their values ​​in SourceCraft.
• Use full-blown secret management with versioning and granular access permissions.
• Use the same secrets in SourceCraft and other Yandex Cloud services.

To set up integration with Yandex Lockbox:

1. Get ready to work.
2. Create a Lockbox secret in SourceCraft.
3. Use the secret value in CI/CD.
4. Check CI/CD workflow execution.

Getting started

1. If you do not have a secret in Yandex Lockbox, create one. Save the names of the keys you have added to the secret to access them from CI/CD.
2. Create a service account or use an existing one. SourceCraft will access the Yandex Lockbox secret on its behalf.
3. Assign the service account the lockbox.payloadViewer role for the secret you created or folder containing that secret. This role enables you to read the secret version values.
4. If you do not have a service connection with access to Yandex Lockbox, create one. In the connection settings, specify the service account you assigned the lockbox.payloadViewer role.

Create a Lockbox secret in SourceCraft

1. Open the SourceCraft home page.
2. On the Home tab, under Your craftspace, navigate to Repositories.
3. Select a repository where you want to create a secret.
4. Under  Repository settings on the repository page, go to  Secrets.
5. On the page with secrets, click New secret.
6. In the window that opens:
   • In the Secret type field, select Lockbox.
   • In the Name field, enter a name for your secret. You will use this name to access the secret from CI/CD.
   • In the Service connection field, select the service connection you created previously.
   • In the Lockbox secret field, select the Yandex Lockbox secret you created.
7. Click Select keys.
8. Select the keys from the Yandex Lockbox secret that you want to use in CI/CD.
9. Click Create.

Use the secret value in CI/CD

1. Configure CI/CD in your repository.

2. In the .sourcecraft/ci.yaml configuration file, specify the key from the Yandex Lockbox secret in ${{ secrets.<Lockbox_secret_name>#<key>}} format. For example:

   workflows:
     test-lockbox-workflow:
       tasks:
         - name: test-lockbox-task
           cubes:
             - name: test-lockbox-task
               script:
                 - |
                   set -eou pipefail
                   echo "Testing lockbox"
                   echo ${{ secrets.lockbox-test#BOT_TOKEN }}
   

   In our example, we are using the value of the BOT_TOKEN key from the lockbox-test Yandex Lockbox secret.

Checking CI/CD workflow execution

1. Depending on the settings specified in .sourcecraft/ci.yaml, run a trigger event.

2. Check CI/CD workflow execution:

   1. Under Code on the repository page, go to CI/CD.
   2. Select a running workflow.
   3. The page that opens will display all workflow tasks, cubes (task steps), as well as statuses and execution results.

See also

• Secrets
• Managing secrets in a SourceCraft repository
• Configuring a service connection to Yandex Cloud in SourceCraft
• Continuous integration and continuous deployment in SourceCraft
• Yandex Lockbox guides