Skip to content

Commit 79f1ad6

Browse files
bentshermanpditommaso
authored andcommitted
Document secrets config variable (#6230) [ci fast]
Signed-off-by: Ben Sherman <[email protected]> Signed-off-by: Paolo Di Tommaso <[email protected]>
1 parent 3cbc2aa commit 79f1ad6

File tree

6 files changed

+146
-41
lines changed

6 files changed

+146
-41
lines changed

docs/config.md

Lines changed: 3 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -108,6 +108,9 @@ The following constants are globally available in a Nextflow configuration file:
108108
`projectDir: Path`
109109
: The directory where the main script is located.
110110

111+
`secrets: Map<String,String>`
112+
: Map of pipeline secrets. See {ref}`secrets-page` for more information.
113+
111114
## Functions
112115

113116
The following functions are globally available in a Nextflow configuration file:

docs/reference/cli.md

Lines changed: 57 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1282,6 +1282,63 @@ The `run` command is used to execute a local pipeline script or remote pipeline
12821282

12831283
See {ref}`cli-params` for more information about writing custom parameters files.
12841284

1285+
(cli-secrets)=
1286+
1287+
### `secrets`
1288+
1289+
Manage {ref}`pipeline secrets <secrets-page>`.
1290+
1291+
**Usage**
1292+
1293+
```console
1294+
$ nextflow secrets <SUBCOMMAND> [OPTIONS]
1295+
```
1296+
1297+
**Options**
1298+
1299+
`-h, -help`
1300+
: Print the command usage.
1301+
1302+
**Subcommands**
1303+
1304+
`list`
1305+
: List secrets available in the current store.
1306+
1307+
`get <secret>`
1308+
: Retrieve a secret value.
1309+
1310+
`set <secret> <value> `
1311+
: Create or update a secret.
1312+
1313+
`delete <secret>`
1314+
: Delete a secret.
1315+
1316+
**Examples**
1317+
1318+
- Set a secret:
1319+
1320+
```console
1321+
$ nextflow secrets set FOO "Hello world"
1322+
```
1323+
1324+
- List secrets:
1325+
1326+
```console
1327+
$ nextflow secrets list
1328+
```
1329+
1330+
- Get a secret:
1331+
1332+
```console
1333+
$ nextflow secrets get FOO
1334+
```
1335+
1336+
- Delete a secret:
1337+
1338+
```console
1339+
$ nextflow secrets delete FOO
1340+
```
1341+
12851342
### `self-update`
12861343

12871344
Update the nextflow runtime to the latest available version.

docs/reference/process.md

Lines changed: 30 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -1474,6 +1474,36 @@ The following values are supported:
14741474
`'ram-disk'`
14751475
: Create a scratch directory in the RAM disk `/dev/shm/`.
14761476

1477+
(process-secret)=
1478+
1479+
### secret
1480+
1481+
The `secret` directive allows a process to access secrets.
1482+
1483+
Secrets can be added to a process as follows:
1484+
1485+
```nextflow
1486+
process hello_secret {
1487+
secret 'MY_ACCESS_KEY'
1488+
secret 'MY_SECRET_KEY'
1489+
1490+
script:
1491+
"""
1492+
your_command --access \$MY_ACCESS_KEY --secret \$MY_SECRET_KEY
1493+
"""
1494+
}
1495+
```
1496+
1497+
See {ref}`secrets-page` for more information.
1498+
1499+
:::{warning}
1500+
Secrets are made available as environment variables in the process script. To prevent evaluation in the Nextflow script context, escape variable names with a backslash (e.g., `\$MY_ACCESS_KEY`) as shown above.
1501+
:::
1502+
1503+
:::{note}
1504+
Secrets can only be used with the local or grid executors (e.g., Slurm or Grid Engine). Secrets can be used with the AWS Batch executor when launched from Seqera Platform.
1505+
:::
1506+
14771507
(process-directive-shell)=
14781508

14791509
### shell

docs/secrets.md

Lines changed: 44 additions & 39 deletions
Original file line numberDiff line numberDiff line change
@@ -3,36 +3,37 @@
33
# Secrets
44

55
:::{versionadded} 22.10.0
6-
Previewed in `21.09.0-edge`.
76
:::
87

9-
Nextflow has built-in support for pipeline secrets to allow users to safely provide sensitive information to a pipeline execution.
8+
Nextflow has built-in support for pipeline secrets, allowing users to safely provide sensitive information to a pipeline run.
109

1110
## How it works
1211

13-
This feature allows decoupling the use secrets in your pipelines from the pipeline code and configuration files. Secrets are instead managed by Nextflow and store separately into a local store only accessible to the secrets owner.
12+
This feature allows you to decouple the use of secrets in your pipelines from the pipeline code and configuration files. Secrets are managed by Nextflow and stored separately into a local store only accessible to the secrets owner.
1413

15-
When the pipeline execution is launched Nextflow inject the secrets in pipeline jobs without leaking them into temporary execution files. The secrets are accessible into the job command via environment variables.
14+
When a pipeline is launched, Nextflow injects the secrets into the run without leaking them into temporary execution files. Secrets are provided to tasks as environment variables.
1615

1716
## Command line
1817

19-
Nextflow provides a command named `secrets`. This command allows four simple operations:
18+
The Nextflow {ref}`cli-secrets` sub-command can be used to manage secrets:
2019

21-
`list`
22-
: List secrets available in the current store e.g. `nextflow secrets list`.
20+
```bash
21+
# create a new secret
22+
nextflow secrets set FOO "Hello world"
2323

24-
`get`
25-
: Retrieve a secret value e.g. `nextflow secrets get FOO`.
24+
# list all secrets
25+
nextflow secrets list
2626

27-
`set`
28-
: Create or update a secret e.g. `nextflow secrets set FOO "Hello world"`
27+
# get the value of secret FOO
28+
nextflow secrets get FOO
2929

30-
`delete`
31-
: Delete a secret e.g. `nextflow secrets delete FOO`.
30+
# delete the secret FOO
31+
nextflow secrets delete FOO
32+
```
3233

3334
## Configuration file
3435

35-
Once create the secrets can be used in the pipeline configuration file as implicit variables using the `secrets` scope:
36+
Secrets can be used in configuration files using the built-in `secrets` variable. For example:
3637

3738
```groovy
3839
aws {
@@ -41,15 +42,38 @@ aws {
4142
}
4243
```
4344

44-
The above snippet access the secrets `MY_ACCESS_KEY` and `MY_SECRET_KEY` previously and assign them to the corresponding AWS credentials settings.
45+
The above snippet accesses the secrets `MY_ACCESS_KEY` and `MY_SECRET_KEY` and assigns them to the corresponding AWS config settings.
46+
47+
:::{warning}
48+
Secrets cannot be assigned to pipeline parameters.
49+
:::
50+
51+
(secrets-pipeline-script)=
52+
53+
## Pipeline script
54+
55+
:::{versionadded} 24.04.0
56+
:::
57+
58+
Secrets can be accessed in the pipeline script using the built-in `secrets` variable. For example:
59+
60+
```nextflow
61+
workflow {
62+
println "The secret is: ${secrets.MY_SECRET}"
63+
}
64+
```
4565

4666
:::{warning}
47-
Secrets **cannot** be assigned to pipeline parameters.
67+
The above example is only meant to demonstrate how to access a secret, not how to use it. In practice, sensitive information should not be printed to the console or output files.
68+
:::
69+
70+
:::{note}
71+
Secrets can only be used with the local or grid executors (e.g., Slurm or Grid Engine). Secrets can be used with the AWS Batch executor when launched from [Seqera Platform](https://seqera.io/blog/pipeline-secrets-secure-handling-of-sensitive-information-in-tower/).
4872
:::
4973

5074
## Process directive
5175

52-
Secrets can be access by pipeline processes by using the `secret` directive. For example:
76+
Secrets can be accesses by processes using the {ref}`process-secret` directive. For example:
5377

5478
```nextflow
5579
process someJob {
@@ -63,31 +87,12 @@ process someJob {
6387
}
6488
```
6589

66-
The above snippet runs a command in with the variables `MY_ACCESS_KEY` and `MY_SECRET_KEY` are injected in the process execution environment holding the values defines in the secret store.
90+
In the above example, the secrets `MY_ACCESS_KEY` and `MY_SECRET_KEY` are injected into the process script as environment variables.
6791

6892
:::{warning}
69-
The secrets are made available in the process context running the command script as environment variables. Therefore make sure to escape the variable name identifier with a backslash as shown in the example above, otherwise a variable with the same will be evaluated in the Nextflow script context instead of the command script.
70-
:::
71-
72-
:::{note}
73-
This feature is only available when using the local or grid executors (Slurm, Grid Engine, etc). The AWS Batch executor allows the use of secrets when deploying the pipeline execution via [Seqera Platform](https://seqera.io/blog/pipeline-secrets-secure-handling-of-sensitive-information-in-tower/).
74-
:::
75-
76-
(secrets-pipeline-script)=
77-
78-
## Pipeline script
79-
80-
:::{versionadded} 24.03.0-edge
93+
Secrets are made available as environment variables in the process script. To prevent evaluation in the Nextflow script context, escape variable names with a backslash (e.g., `\$MY_ACCESS_KEY`) as shown above.
8194
:::
8295

83-
Secrets can be accessed in the pipeline script using the `secrets` variable. For example:
84-
85-
```nextflow
86-
workflow.onComplete {
87-
println("The secret is: ${secrets.MY_SECRET}")
88-
}
89-
```
90-
9196
:::{note}
92-
This feature is only available when using the local or grid executors (Slurm, Grid Engine, etc). The AWS Batch executor allows the use of secrets when deploying the pipeline execution via [Seqera Platform](https://seqera.io/blog/pipeline-secrets-secure-handling-of-sensitive-information-in-tower/).
97+
Secrets can only be used with the local or grid executors (e.g., Slurm or Grid Engine). Secrets can be used with the AWS Batch executor when launched from [Seqera Platform](https://seqera.io/blog/pipeline-secrets-secure-handling-of-sensitive-information-in-tower/).
9398
:::

modules/nf-lang/src/main/java/nextflow/config/dsl/ConfigDsl.java

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -29,6 +29,8 @@
2929
*/
3030
public interface ConfigDsl extends DslScope {
3131

32+
// constants
33+
3234
@Deprecated
3335
@Constant("baseDir")
3436
@Description("""
@@ -54,6 +56,14 @@ public interface ConfigDsl extends DslScope {
5456
""")
5557
Path getProjectDir();
5658

59+
@Constant("secrets")
60+
@Description("""
61+
Map of pipeline secrets.
62+
""")
63+
Map<String,String> getSecrets();
64+
65+
// functions
66+
5767
@Description("""
5868
Get the value of an environment variable from the launch environment.
5969
""")

modules/nf-lang/src/main/java/nextflow/script/dsl/ScriptDsl.java

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -70,9 +70,9 @@ The directory where a module script is located (equivalent to `projectDir` if us
7070

7171
@Constant("secrets")
7272
@Description("""
73-
Map of user-defined pipeline secrets.
73+
Map of pipeline secrets.
7474
""")
75-
Map<String,?> getSecrets();
75+
Map<String,String> getSecrets();
7676

7777
@Constant("workDir")
7878
@Description("""

0 commit comments

Comments
 (0)