🔐 Comprehensive Secret Injection for All Service Types

Security isn’t an afterthought, it’s foundational. torero 1.5 transforms how you handle credentials across your entire automation stack. Taking care to not “hard-code” secrets is often still an afterthought for many practitioners either testing locally or writing quick and dirty scripts. One of our guiding principles behind this design is, making it easier on practitioners to not hard-code secrets and offering flexibility for runtime execution in scenarios where you are provisioning infrastructure via pipelines.

The magic happens through secure environment variable injection that works consistently across all service types:

bash

>_ torero create service python-script my-script \
   --secret name=my-api-key,type=env,target=API_KEY \
   --repository my-repo \
   --filename main.py

Your Python scripts can now access secrets via standard environment variables:

python

import os
api_key = os.getenv('API_KEY')

Ansible playbooks leverage the same approach:

yaml

- name: Use API key from secret store
  debug:
    msg: "API Key: {{ lookup('env', 'API_KEY') }}"

Even OpenTofu plans get first-class secret support:

hcl

variable "api_key" {
  type       = string
  description  = "API key from torero secret store"
}

🎯 Runtime Secret Flexibility

Need to inject different credentials for different environments? torero 1.5 introduces runtime secret specification through the –set-secret flag, giving you the flexibility to adapt on the fly:

bash

>_ torero run service python-script my-script \
   --set-secret name=prod-credentials,type=env,target=API_KEY

📋 Decorator Elegance

For teams using decorators, torero 1.5 introduces intelligent secret handling through custom JSON Schema annotations. Simply add x-itential-secret-type and x-itential-secret-target to your decorator properties, and torero automatically prompts for the secret name during service execution:

json

{
  "properties": {
    "password": {
      "type": "string",
      "x-itential-secret-type": "env",
      "x-itential-secret-target": "DATABASE_PASSWORD"
    }
  }
}