I'm wondering what would give me the best result in a test automation framework:

  1. CICD build pipeline retrieves secrets and passes them into the test automation framework as environment variables
  2. CICD build pipeline passes in keyvault(s) client ID and secret as environment variables and have the framework interface with the vaults to get the secrets it needs

Option 1 seems like the easiest way to go, but doesn't provide as much scalability. Option 2 has more scalability but less security (because we're passing in the KV client as an env variable)

  • 1
    why is first option not scalable ?
    – PDHide
    Jun 7, 2021 at 6:26
  • You didn't mention what you CI system is, some have built in secret management modules. I used them on Jenkins and Openshift/Tekton but I am sure others exist as well
    – Rsf
    Jul 7, 2021 at 7:09

1 Answer 1


Here is what I did at Microsoft, not saying it's right just what I know. We saved secrets to the Key Vault. For local host we had to install a PEM file and set our environment variable to the SHA of the signature. There was a Setup step that checked if the PEM env var was set to use that to retrieve and set the secrets. That allowed access to the Key Vault. For the build pipeline we could just call the key vault to set the env vars for the secrets.

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.