You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Secrets are made available as environment variables in the process script. To prevent evaluation in the Nextflow script context, escape variable names with a backslash (e.g., `\$MY_ACCESS_KEY`) as shown above.
1501
+
:::
1502
+
1503
+
:::{note}
1504
+
Secrets can only be used with the local or grid executors (e.g., Slurm or Grid Engine). Secrets can be used with the AWS Batch executor when launched from Seqera Platform.
Copy file name to clipboardExpand all lines: docs/secrets.md
+44-39Lines changed: 44 additions & 39 deletions
Original file line number
Diff line number
Diff line change
@@ -3,36 +3,37 @@
3
3
# Secrets
4
4
5
5
:::{versionadded} 22.10.0
6
-
Previewed in `21.09.0-edge`.
7
6
:::
8
7
9
-
Nextflow has built-in support for pipeline secrets to allow users to safely provide sensitive information to a pipeline execution.
8
+
Nextflow has built-in support for pipeline secrets, allowing users to safely provide sensitive information to a pipeline run.
10
9
11
10
## How it works
12
11
13
-
This feature allows decoupling the use secrets in your pipelines from the pipeline code and configuration files. Secrets are instead managed by Nextflow and store separately into a local store only accessible to the secrets owner.
12
+
This feature allows you to decouple the use of secrets in your pipelines from the pipeline code and configuration files. Secrets are managed by Nextflow and stored separately into a local store only accessible to the secrets owner.
14
13
15
-
When the pipeline execution is launched Nextflow inject the secrets in pipeline jobs without leaking them into temporary execution files. The secrets are accessible into the job command via environment variables.
14
+
When a pipeline is launched, Nextflow injects the secrets into the run without leaking them into temporary execution files. Secrets are provided to tasks as environment variables.
16
15
17
16
## Command line
18
17
19
-
Nextflow provides a command named `secrets`. This command allows four simple operations:
18
+
The Nextflow {ref}`cli-secrets` sub-command can be used to manage secrets:
20
19
21
-
`list`
22
-
: List secrets available in the current store e.g. `nextflow secrets list`.
20
+
```bash
21
+
# create a new secret
22
+
nextflow secrets set FOO "Hello world"
23
23
24
-
`get`
25
-
: Retrieve a secret value e.g. `nextflow secrets get FOO`.
24
+
# list all secrets
25
+
nextflow secrets list
26
26
27
-
`set`
28
-
: Create or update a secret e.g. `nextflow secrets set FOO "Hello world"`
27
+
# get the value of secret FOO
28
+
nextflow secrets get FOO
29
29
30
-
`delete`
31
-
: Delete a secret e.g. `nextflow secrets delete FOO`.
30
+
# delete the secret FOO
31
+
nextflow secrets delete FOO
32
+
```
32
33
33
34
## Configuration file
34
35
35
-
Once create the secrets can be used in the pipeline configuration file as implicit variables using the `secrets`scope:
36
+
Secrets can be used in configuration files using the built-in `secrets`variable. For example:
36
37
37
38
```groovy
38
39
aws {
@@ -41,15 +42,38 @@ aws {
41
42
}
42
43
```
43
44
44
-
The above snippet access the secrets `MY_ACCESS_KEY` and `MY_SECRET_KEY` previously and assign them to the corresponding AWS credentials settings.
45
+
The above snippet accesses the secrets `MY_ACCESS_KEY` and `MY_SECRET_KEY` and assigns them to the corresponding AWS config settings.
46
+
47
+
:::{warning}
48
+
Secrets cannot be assigned to pipeline parameters.
49
+
:::
50
+
51
+
(secrets-pipeline-script)=
52
+
53
+
## Pipeline script
54
+
55
+
:::{versionadded} 24.04.0
56
+
:::
57
+
58
+
Secrets can be accessed in the pipeline script using the built-in `secrets` variable. For example:
59
+
60
+
```nextflow
61
+
workflow {
62
+
println "The secret is: ${secrets.MY_SECRET}"
63
+
}
64
+
```
45
65
46
66
:::{warning}
47
-
Secrets **cannot** be assigned to pipeline parameters.
67
+
The above example is only meant to demonstrate how to access a secret, not how to use it. In practice, sensitive information should not be printed to the console or output files.
68
+
:::
69
+
70
+
:::{note}
71
+
Secrets can only be used with the local or grid executors (e.g., Slurm or Grid Engine). Secrets can be used with the AWS Batch executor when launched from [Seqera Platform](https://seqera.io/blog/pipeline-secrets-secure-handling-of-sensitive-information-in-tower/).
48
72
:::
49
73
50
74
## Process directive
51
75
52
-
Secrets can be access by pipeline processes by using the `secret` directive. For example:
76
+
Secrets can be accesses by processes using the {ref}`process-secret` directive. For example:
53
77
54
78
```nextflow
55
79
process someJob {
@@ -63,31 +87,12 @@ process someJob {
63
87
}
64
88
```
65
89
66
-
The above snippet runs a command in with the variables`MY_ACCESS_KEY` and `MY_SECRET_KEY` are injected in the process execution environment holding the values defines in the secret store.
90
+
In the above example, the secrets`MY_ACCESS_KEY` and `MY_SECRET_KEY` are injected into the process script as environment variables.
67
91
68
92
:::{warning}
69
-
The secrets are made available in the process context running the command script as environment variables. Therefore make sure to escape the variable name identifier with a backslash as shown in the example above, otherwise a variable with the same will be evaluated in the Nextflow script context instead of the command script.
70
-
:::
71
-
72
-
:::{note}
73
-
This feature is only available when using the local or grid executors (Slurm, Grid Engine, etc). The AWS Batch executor allows the use of secrets when deploying the pipeline execution via [Seqera Platform](https://seqera.io/blog/pipeline-secrets-secure-handling-of-sensitive-information-in-tower/).
74
-
:::
75
-
76
-
(secrets-pipeline-script)=
77
-
78
-
## Pipeline script
79
-
80
-
:::{versionadded} 24.03.0-edge
93
+
Secrets are made available as environment variables in the process script. To prevent evaluation in the Nextflow script context, escape variable names with a backslash (e.g., `\$MY_ACCESS_KEY`) as shown above.
81
94
:::
82
95
83
-
Secrets can be accessed in the pipeline script using the `secrets` variable. For example:
84
-
85
-
```nextflow
86
-
workflow.onComplete {
87
-
println("The secret is: ${secrets.MY_SECRET}")
88
-
}
89
-
```
90
-
91
96
:::{note}
92
-
This feature is only available when using the local or grid executors (Slurm, Grid Engine, etc). The AWS Batch executor allows the use of secrets when deploying the pipeline execution via[Seqera Platform](https://seqera.io/blog/pipeline-secrets-secure-handling-of-sensitive-information-in-tower/).
97
+
Secrets can only be used with the local or grid executors (e.g., Slurm or Grid Engine). Secrets can be used with the AWS Batch executor when launched from[Seqera Platform](https://seqera.io/blog/pipeline-secrets-secure-handling-of-sensitive-information-in-tower/).
0 commit comments