Environments and secrets
Environments​
An environment separates the settings of the same task: for example,
Production, with the systems' real tokens, and Sandbox, with the test
ones. Every execution runs in an environment, chosen in the console's top bar
or given in the run call through the API (environment_id).
Each environment has:
| Field | What it is |
|---|---|
| Name | The environment's label, unique within the organization. |
| Color | The color that identifies the environment in the console. |
| Branch | The branch used by executions in this environment. |
| Secrets | The credentials registered for it. |
| Schedules | The schedules of the tasks that run in it. |
An environment with secrets or schedules cannot be deleted: remove them first.
Environments can be declared in the Playbook, in the kadu.yaml file
(The kadu.yaml). In that case, the Playbook is
the source of truth: an edit made only in the console reverts to what was
declared on the next push.
Secrets​
A secret is a credential that a task uses: an API token, a password, an account id. It belongs to an environment and, optionally, to a workspace.
- The value is stored encrypted and is never shown again, neither in the console nor in the API. To change it, save a new value.
- An execution receives only the secrets the task declares in
required_secrets. It is an allowlist: a registered secret that is not declared does not reach the execution. - The secret reaches the skill as an environment variable named after the key
(
KOBANA_ACCESS_TOKEN,FINTERA_TOKEN…). - Before sending an event, a log or a pending item to the console, Kadu replaces the value of every secret of the execution with a mask.
Pending secrets​
Settings → Secrets marks as Pending every secret that a task in the
workspace requires and that has no value in the environment yet. A run from
the console checks this before starting and shows what is missing, with the
Configure secrets shortcut. On the run endpoint,
a required secret with no value rejects the call with 422 missing_secrets.
Order when adding a new secret to a task​
- Whoever maintains the Playbook adds the name to the skill's
required_secretsand publishes. - After the sync, register the value in the environment.
If the task has a schedule, register the value before the next run time. Without it, the execution receives the variable empty and fails midway, not at the start.