Concourse can read values from "var sources" - typically credential managers like Vault - at runtime. This keeps them out of your configuration and prevents them from being stored in your database. Values will be read from the credential manager and optionally cached.
The following configurations can be parameterized through a
paramson a task step in a pipeline
Concourse will fetch values for
((vars)) as late as possible - i.e. when a step using them is about to execute. This allows the credentials to have limited lifetime and tight rotation policies.
Concourse can be configured with a single cluster-wide credential manager, which acts as a source for any
((vars)) which do not specify a source name.
See Credential Management for more information.
var_sources was introduced in Concourse v5.8.0. It is considered an experimental feature until its associated RFC is resolved.
((var)) sources are the successor to the cluster-wide credential manager.
Instead of a singleton, many sources can be configured, each with a name. This name is used to explicitly reference the source for vars, e.g.
((var)) syntax for a detailed explanation of this syntax.
((var)) sources can only be configured at the pipeline-level, through
var_sources. Soon we will introduce cluster-wide
((var)) sources and begin deprecating the cluster-wide credential manager.
((var)) source has the following configuration:
Required. The name of the
((var)) source. This should be short and simple. This name will be referenced
((vars)) throughout the config.
Required. The type of the
((var)) source. This corresponds to one of the supported credential managers.
Currently, only two types are supported:
dummy. This will expand in the future to include all supported credential managers.
Required. The configuration for the
Arbitrary configuration for the
((var)) source. The schema of this value is entirely dependent on the type. Each supported
((var)) source type, and their config schema, are documented below.
As the configuration for a
((var)) source is entirely dependent on its
type, each supported type documents its own schema below: