How can I set forge secrets from the forge CLI (or else)?

Forge Forge Platform and Tools
, ,
1

We have an app in Forge for which we want to use secrets (e.g. API tokens to an external API). Each secret is associated to a domain/installation.

I was thinking of using kvm and set secrets in there, so that the app can read them. But ideally we would like to create these secrets from the forge CLI (or a custom CLI) but there doesn’t seem to be a way to setSecret from outside a running forge app, and I don’t want to deploy an app with the secret.

This is what I want to do basically:

kvs.setSecret(
  'outcome-io.atlassian.net',
  '...some value...'
);

I don’t want to use an environment variable because I will have a different secret per installation (or some global lookup where each “token” is associated with the installation’s domain).

Looking for suggestions / ideas on how to do this. I have a hunch that I may need to set up some convoluted workflow that has a remote listening for app installs that then uses the provided app token to create a secret via the API… (I have something similar to that for a different forge app, so I am familiar with the details but don’t think I need that level of automation ATM).

Ideally a “forge storage set-secret” would be perfect for me.

Thanks

2

TBH I’m not clear as to whether the Key Value store is shared across installations or not. Leaning towards “it isn’t”

3

Hi Carles,

You are correct, KVS store data per installation. If the keys are unique per installation, then often apps have an Admin screen for the Customer Admin to update the required Secret and that is stored in KVS securely.

If this key is for your all app installations (not per customer/install) then you could store it via Environment Variables (https://developer.atlassian.com/platform/forge/cli-reference/variables-set/). Just make sure to use the encrypt flag.

Cheers
Ben

4

In this case it is a key we generate (in an external system), not the customer, so the customer admin is not an option.

5

Related question then… when are environment variable changes picked up by the application? There are some cloud environments where one needs to (manually) redeploy or restart the app after an env var changes, else the app never loads the new value. How does Forge handle that?

6

Environment Variables are paired with the deployment process for the App (not per installation).

7

Thanks Benny, but his doesn’t really answer my question, so let me rephrase.

In Atlassian Forge, when I add or update an environment variable, will all new invocations of my application automatically use the new value/variable? Or do I need to redeploy the application to ensure that is the case?

9

I know from experience (relearned several times :see_no_evil_monkey: ) that you have to manually redeploy. (That’s what Benny meant by “paired with the deployment process”.)

2 Likes
10

As Aaron mentioned, that is correct.

Order of operations:

  1. Set Forge environment variable via CLI for “production” environment
  2. Run Forge Deploy to “production” environment
  3. Then the environment variable is now available for that deployed Forge App

Hope that helps.

Cheers
Ben