Discharge7443/fleet
1
0
Fork 0
Code Issues Pull Requests Actions 22 Packages Projects Releases Wiki Activity

Variables in scripts and profiles: Update language (#39253)

Browse Source 
Clean up and simplify language not that we're pointing to this section
of the guide from Fleet's best practice GitOps:
https://github.com/fleetdm/fleet-gitops/pull/91/files#diff-391be63d86ca0541cef3ee2c9302c75c391f294e4e8466af9c15d19137480fd1R13
This commit is contained in:
Noah Talerman
2026-02-24 09:12:00 -05:00
committed by GitHub
parent 8d5be2f877
commit 3d554a52de
1 changed files with 12 additions and 14 deletions
Download Patch File Download Diff File Expand all files Collapse all files
articles/secrets-in-scripts-and-configuration-profiles.md
+12 -14
View File
@@ -24,32 +24,30 @@ Variables are global, meaning they can be used in scripts and profiles across al
### GitOps
1. You must add the variable to your [GitHub](https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/use-secrets#creating-secrets-for-a-repository) or [GitLab](https://docs.gitlab.com/ci/variables/#define-a-cicd-variable-in-the-ui) repository's secrets to use them in GitOps.
1. Add the variable to your [GitHub](https://docs.github.com/en/actions/how-tos/write-workflows/choose-what-workflows-do/use-secrets#creating-secrets-for-a-repository) or [GitLab](https://docs.gitlab.com/ci/variables/#define-a-cicd-variable-in-the-ui) repository's secrets to use the variable in GitOps.
2. For the GitHub GitOps flow, they must also be added to the `env` section of your workflow file, as shown below:
2. Define the variable in the `env` section of in your `workflows.yml` file, as shown below:
```yaml
env:
### Variables used by the gitops workflow ###
### Variables used by the GitOps workflow ###
FLEET_URL: ${{ secrets.FLEET_URL }}
FLEET_API_TOKEN: ${{ secrets.FLEET_API_TOKEN }}
FLEET_WORKSTATIONS_ENROLL_SECRET: ${{ secrets.FLEET_WORKSTATIONS_ENROLL_SECRET }}
FLEET_WORKSTATIONS_CANARY_ENROLL_SECRET: ${{ secrets.FLEET_WORKSTATIONS_CANARY_ENROLL_SECRET }}
### Secrets uploaded to Fleet for use in profiles and scripts ###
FLEET_SECRET_CERT_PASSWORD: ${{ secrets.FLEET_SECRET_CERT_PASSWORD }}
FLEET_SECRET_CERT_BASE64: ${{ secrets.FLEET_SECRET_CERT_BASE64 }}
WORKSTATIONS_ENROLL_SECRET: ${{ secrets.WORKSTATIONS_ENROLL_SECRET }}
```
When GitOps syncs the configuration, it looks for variables in scripts and profiles, extracts the variable's values from the environment, and uploads them to Fleet.
### Scripts and configuration profiles
On subsequent GitOps syncs, if a variable is used by an updated configuration profile, the profile will be resent to the host device(s).
During a GitOps run, Fleet scans scripts and profiles for variables, pulls their values from GitHub or GitLab, and uploads them to Fleet.
Profiles with variables aren’t validated during a GitOps dry run because the variables may be missing or incorrect in Fleet. This means they’re more likely to fail during a real run. Best practice: test the script or profile by adding it to Fleet via the UI first.
Some variables trigger a profile resend when their value changes. See which variables support this in the [YAML reference docs](https://fleetdm.com/docs/configuration/yaml-files#variables).
If a variable is a secret (for example, an API token), prefix it with FLEET_SECRET_. This masks the value when viewed or downloaded from the Fleet UI or API. If a secret’s value changes, the profile is resent to hosts.
Variables aren't removed on GitOps runs. To remove a variable, delete it on the `Controls` > `Variables` page.
> Profiles with variables are not entirely validated during a GitOps dry run because the required variables may not exist or may be incorrect in the database. As a result, these profiles have a higher chance of failing during a non-dry run. Test them by uploading to a small team first.
## Using the secret on a configuration profile
Here's an example profile with `$FLEET_SECRET_CERT_PASSWORD` and `$FLEET_SECRET_CERT_BASE64` variables:
```xml
<?xml version="1.0" encoding="UTF-8"?>