Compartilhar via

Add & use variable groups

  • Artigo

TFS 2017

Variable groups store values and secrets that you might want to be passed into a YAML pipeline or make available across multiple pipelines. You can share and use variables groups in multiple pipelines in the same project.

Variables groups are protected resources. You can add approvals and checks to these variables and set pipeline permissions.

Note

In Microsoft Team Foundation Server (TFS) 2018 and previous versions, build and release pipelines are called definitions, runs are called builds, service connections are called service endpoints, stages are called environments, and jobs are called phases.

Note

Variable groups can be used in a build pipeline only Azure DevOps and TFS 2018.

Create a variable group

You can't create variable groups in YAML, but they can be used as described in Use a variable group.

Use a variable group

YAML builds aren't available on TFS-2017.

Access the variable values in a linked variable group the same way as variables you define within the pipeline itself. For example, to access the value of a variable named customer in a variable group linked to the pipeline, use $(customer) in a task parameter or a script. But, you can't access secret variables (encrypted variables and key vault variables) directly in scripts - instead, they must be passed as arguments to a task. For more information, see secrets

Changes that you make to a variable group are automatically available to all the definitions or stages to which the variable group gets linked.

Link an existing Azure key vault to a variable group and map selective vault secrets to the variable group.

  1. In the Variable groups page, enable Link secrets from an Azure key vault as variables. You'll need an existing key vault containing your secrets. Create a key vault using the Azure portal.

    Variable group with Azure key vault integration

  2. Specify your Azure subscription end point and the name of the vault containing your secrets.

    Ensure the Azure service connection has at least Get and List management permissions on the vault for secrets. Enable Azure Pipelines to set these permissions by choosing Authorize next to the vault name. Or, set the permissions manually in the Azure portal:

    1. Open Settings for the vault, and then choose Access policies > Add new.
    2. Select Select principal and then choose the service principal for your client account.
    3. Select Secret permissions and ensure that Get and List have check marks.
    4. Select OK to save the changes.

  3. On the Variable groups page, select + Add to select specific secrets from your vault for mapping to this variable group.

Manage secrets

See the following list of helpful tips for managing secrets.

  • Only the secret names get mapped to the variable group, not the secret values. The latest secret value, fetched from the vault, is used in the pipeline run that's linked to the variable group.

  • Any change made to existing secrets in the key vault is automatically available to all the pipelines the variable group's used in.

  • When new secrets get added to or deleted from the vault, the associated variable groups aren't automatically updated. The secrets included in the variable group must be explicitly updated so the pipelines that are using the variable group get executed correctly.

  • Azure Key Vault supports storing and managing cryptographic keys and secrets in Azure. Currently, Azure Pipelines variable group integration supports mapping only secrets from the Azure key vault. Cryptographic keys and certificates aren't supported.

Expand variables in a group

YAML isn't supported in TFS 2017.