Add & use variable groups
TFS 2018
Variable groups store values and secrets that you might want to be passed into a YAML pipeline or make available across multiple pipelines. You can share and use variable groups in multiple pipelines in the same project.
Secret variables in Variables groups are protected resources. You can add combinations of approvals, checks, and pipeline permissions to limit access to secret variables in a variable group. Access to non-secret variables is not limited by approvals, checks, and pipeline permissions.
Note
Microsoft Visual Studio Team Foundation Server 2018 and earlier versions have the following differences in naming:
- Pipelines for build and release are called definitions
- Runs are called builds
- Service connections are called service endpoints
- Stages are called environments
- Jobs are called phases
Create a variable group
You can't create variable groups in YAML, but they can be used as described in Use a variable group.
Use a variable group
YAML builds aren't available on TFS.
Access the variable values in a linked variable group the same way as variables you define within the pipeline itself.
For example, to access the value of a variable named customer in a variable group linked to the pipeline,
use $(customer)
in a task parameter or a script. But, you can't access secret variables (encrypted variables and key vault variables) directly in scripts - instead, they must be passed as arguments to a task. For more information, see secrets
Changes that you make to a variable group are automatically available to all the definitions or stages to which the variable group gets linked.
Link secrets from an Azure key vault
Note
Key Vaults using Azure role-based access control (Azure RBAC) are not supported.
Link an existing Azure key vault to a variable group and map selective vault secrets to the variable group.
In the Variable groups page, enable Link secrets from an Azure key vault as variables. You'll need an existing key vault containing your secrets. Create a key vault using the Azure portal.
Specify your Azure subscription end point and the name of the vault containing your secrets.
Ensure the Azure service connection has at least Get and List management permissions on the vault for secrets. Enable Azure Pipelines to set these permissions by choosing Authorize next to the vault name. Or, set the permissions manually in the Azure portal:
- Open Settings for the vault, and then choose Access policies > Add new.
- Select Select principal and then choose the service principal for your client account.
- Select Secret permissions and ensure that Get and List have check marks.
- Select OK to save the changes.
On the Variable groups page, select + Add to select specific secrets from your vault for mapping to this variable group.
Manage key vault secrets
See the following list of helpful tips for managing secrets.
Only the secret names get mapped to the variable group, not the secret values. The latest secret value, fetched from the vault, is used in the pipeline run that's linked to the variable group.
Any change made to existing secrets in the key vault is automatically available to all the pipelines the variable group's used in.
When new secrets get added to or deleted from the vault, the associated variable groups aren't automatically updated. The secrets included in the variable group must be explicitly updated so the pipelines that are using the variable group get executed correctly.
Azure Key Vault supports storing and managing cryptographic keys and secrets in Azure. Currently, Azure Pipelines variable group integration supports mapping only secrets from the Azure key vault. Cryptographic keys and certificates aren't supported.
Expand variables in a group
YAML isn't supported in TFS.