📣
TiDB Cloud Premium is now in public preview. Unlimited growth, instant elasticity, advanced security for enterprise workloads. Try it out →
​
Sign InStart for Free
AI
Developer
Best Practices
API
​
Sign InStart for Free

ti fs-vault run-with-secret

Runs a command with one secret injected into its environment. Arguments after -- are passed to the child command.

Each secret field name becomes an environment variable with the same name in the child process. Field names must match [A-Z_][A-Z0-9_]*, so create fields that you intend to inject with uppercase names. The command rejects the entire injection if any field name, including a name that contains lowercase letters, does not match this pattern or if a value contains an unsupported control character.

Syntax

ti fs-vault run-with-secret
  --secret-path <string>
  [--file-system-id <string>]
  [--fs-token <string>]
  [--help]
  [--vault-token <string>]
  [--version]
  -- <command> [args...]

Options

  • --secret-path <string>: Canonical Vault path in the form /n/vault/<secret-name>. For example, the secret created as db-prod has the path /n/vault/db-prod. [required]
  • --file-system-id <string>: Select the file system. You can also set TI_FS_FILE_SYSTEM_ID.
  • --fs-token <string>: Set the owner Filesystem token. If omitted, the command uses the TI_FS_TOKEN environment variable. If neither is provided, the command uses the local token stored for the selected Filesystem. For delegated authentication, use --vault-token or TI_VAULT_TOKEN instead.
  • --help: Display help information.
  • --vault-token <string>: Delegated ti fs-vault token; prefer TI_VAULT_TOKEN.
  • --version: Display version information.

For options shared by all commands, see Global options.

Examples

  • Run a process with secret fields:

    # Verify that the child process receives DB_URL without printing its value.
ti fs-vault run-with-secret --file-system-id <file-system-id> --secret-path /n/vault/db-prod -- sh -c 'test -n "$DB_URL" && printf "DB_URL is set\n"'

  • Run an application with injected fields:

    # Make all fields available only to the child process and its descendants.
ti fs-vault run-with-secret --file-system-id <file-system-id> --secret-path /n/vault/db-prod -- ./deploy.sh

Was this page helpful?