---
metadata:
  - name: generator
    content: Diplodoc Platform v5.57.3
alternate:
  - https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/lockbox-integration.md
  - https://sourcecraft.dev/portal/docs/ru/sourcecraft/operations/lockbox-integration.md
  - href: en/sourcecraft/operations/lockbox-integration.md
    type: text/markdown
    title: Markdown version
  - href: ../../llms.txt
    type: text/markdown
    title: llms.txt
title: Setting up integration with Yandex Lockbox
description: 'Learn how to integrate a SourceCraft repository with Yandex Lockbox: create a Lockbox secret and use it in CI/CD workflows.'
---
> **Documentation Index:** Fetch the complete configuration index at https://sourcecraft.dev/portal/docs/en/llms.txt


# Setting up integration with Yandex Lockbox in SourceCraft

In SourceCraft [CI/CD](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/ci-cd.md), you can use [secrets](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/index.md#secrets) whose values are stored in [Yandex Lockbox](https://yandex.cloud/en/docs/lockbox/). SourceCraft gets access to them via a [service connection](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/service-connections.md).

<!-- source: en/_includes/sourcecraft/lockbox-integration-note.md -->
With Yandex Lockbox integration, you can:
* Store secrets in Yandex Cloud without duplicating their values ​​in SourceCraft.
* Use full-blown secret management with versioning and granular access permissions.
* Use the same secrets in SourceCraft and other Yandex Cloud services.
<!-- endsource: en/_includes/sourcecraft/lockbox-integration-note.md -->

To set up integration with Yandex Lockbox:

1. [Get ready to work](#before-you-begin).
1. [Create a Lockbox secret in SourceCraft](#create-lockbox-secret).
1. [Use the secret value in CI/CD](#use-in-ci-cd).
1. [Check CI/CD workflow execution](#check-ci-cd).

## Getting started {#before-you-begin}

1. If you do not have a secret in Yandex Lockbox, [create one](https://yandex.cloud/en/docs/lockbox/operations/secret-create). Save the names of the keys you have added to the secret to access them from CI/CD.
1. [Create](https://yandex.cloud/en/docs/iam/operations/sa/create) a service account or use an existing one. SourceCraft will access the Yandex Lockbox secret on its behalf.
1. [Assign](https://yandex.cloud/en/docs/iam/operations/sa/assign-role-for-sa) the service account the `lockbox.payloadViewer` [role](https://yandex.cloud/en/docs/lockbox/security/#lockbox-payloadViewer) for the secret you created or folder containing that secret. This role enables you to read the secret version values.
1. If you do not have a [service connection](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/service-connections.md) with access to Yandex Lockbox, [create one](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/service-connections.md). In the connection settings, specify the service account you assigned the `lockbox.payloadViewer` role.

## Create a Lockbox secret in SourceCraft {#create-lockbox-secret}

1. Open the SourceCraft [home page](https://sourcecraft.dev).
1. On the ![image](../../_assets/console-icons/house.svg) **Home** tab, under ![image](../../_assets/console-icons/layout-tabs.svg) **Your craftspace**, navigate to ![image](../../_assets/console-icons/archive.svg) **Repositories**.
1. Select a repository where you want to create a secret.
1. Under ![image](../../_assets/console-icons/gear.svg) **Repository settings** on the repository page, go to ![image](../../_assets/console-icons/vault.svg) **Secrets**.
1. On the page with secrets, click ![image](../../_assets/console-icons/plus.svg) **New secret**.
1. In the window that opens:
    * In the **Secret type** field, select **Lockbox**.
    * In the **Name** field, enter a name for your secret. You will use this name to access the secret from CI/CD.
    * In the **Service connection** field, select the service connection you created previously.
    * In the **Lockbox secret** field, select the Yandex Lockbox secret you created.
1. Click **Select keys**.
1. Select the keys from the Yandex Lockbox secret that you want to use in CI/CD.
1. Click **Create**.

{% note info %}

SourceCraft accesses the latest [version](https://yandex.cloud/en/docs/lockbox/concepts/secret#version) of the secret stored in Yandex Lockbox.

{% endnote %}

## Use the secret value in CI/CD {#use-in-ci-cd}

1. [Configure](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/ci-cd.md) CI/CD in your repository.
1. In the `.sourcecraft/ci.yaml` configuration file, specify the key from the Yandex Lockbox secret in `${{ secrets.<Lockbox_secret_name>#<key>}}` format. For example:

    <!-- source: en/_includes/sourcecraft/lockbox-secret-example.md -->
    ```yaml
    workflows:
      test-lockbox-workflow:
        tasks:
          - name: test-lockbox-task
            cubes:
              - name: test-lockbox-task
                script:
                  - |
                    set -eou pipefail
                    echo "Testing lockbox"
                    echo ${{ secrets.lockbox-test#BOT_TOKEN }}
    ```

    In our example, we are using the value of the `BOT_TOKEN` key from the `lockbox-test` Yandex Lockbox secret.
    <!-- endsource: en/_includes/sourcecraft/lockbox-secret-example.md -->

## Checking CI/CD workflow execution {#check-ci-cd} 

1. Depending on the settings specified in `.sourcecraft/ci.yaml`, run a trigger event.
1. Check CI/CD workflow execution:

    <!-- source: en/_includes/sourcecraft/ci-cd/ui-overview.md -->
    1. Under ![image](../../_assets/console-icons/code.svg) **Code** on the repository page, go to ![image](../../_assets/console-icons/arrows-3-rotate-right.svg) **CI/CD**.
    1. Select a running workflow.
    1. The page that opens will display all workflow tasks, cubes (task steps), as well as statuses and execution results.
    <!-- endsource: en/_includes/sourcecraft/ci-cd/ui-overview.md -->

### See also {#see-also}

* [Secrets](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/index.md#secrets)
* [Managing secrets in a SourceCraft repository](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/secrets.md)
* [Configuring a service connection to Yandex Cloud in SourceCraft](https://sourcecraft.dev/portal/docs/en/sourcecraft/operations/service-connections.md)
* [Continuous integration and continuous deployment in SourceCraft](https://sourcecraft.dev/portal/docs/en/sourcecraft/concepts/ci-cd.md)
* [Yandex Lockbox guides](https://yandex.cloud/en/docs/lockbox/)