Octopus Deploy
Keeper Secrets Manager Step Template for accessing secrets in Octopus Deploy

Octopus Deploy Integration with Keeper Secrets Manager
- Retrieve secrets from the Keeper Vault to use in Octopus Deploy Library
- Inject credentials directly into Octopus Deploy projects
- Get files from the Keeper Vault
This page documents the Secrets Manager Octopus Deploy integration. In order to utilize this integration, you will need:
- Secrets Manager addon enabled for your Keeper account
- Membership in a Role with the Secrets Manager enforcement policy enabled
- The Octopus Deploy integration accepts Base 64 format configurations
The Keeper Octopus Deploy Step Template utilizes Keeper Secrets Manager to provide access to secret credentials saved in the Keeper Vault. The script allows for injecting secrets directly into Octopus Deploy projects securely using Keeper's zero-knowledge infrastructure.
To use the step template directly from Community Step Templates:
Navigate: Library > Step Templates > Community Step Templates > Browse Library
Search: "Keeper Secrets Manager - Retrieve Secrets" > Install > Save
To add as a Custom Step Template:
Navigate: Library > Step Templates > Custom Step Templates > Import
Paste the JSON obtained from community contributed templates library
Name: Keeper Secrets Manager - Retrieve Secrets
Description: This step retrieves one or more secrets from a Keeper Vault and creates sensitive output variables for each value retrieved. These values can be used in other steps in your deployment or runbook process.
You can retrieve secrets using Keeper Notation URIs, and you can choose a custom output variable name for each secret.
Required:
- The
SecretManagement.Keeper.Extension
PowerShell module installed on the target or worker. If the module can't be found, the step will fail. TheSecretManagement.Keeper
module(s) can be installed from the PowerShell gallery.
Keeper Secrets Manager Configuration (type: Sensitive)
Variable name:
#{Keeper.SecretsManager.RetrieveSecrets.Config}
Keeper Secrets Manager configuration for KSM Application with permissions to retrieve secrets from the Keeper Vault. To generate KSM Configuration in Web Vault: Secrets Manager - KSM Application Name - Edit - Add Device, and switch to Method: Configuration file, preferably in Base64 format.Vault Secrets to retrieve (type: Multi-line text box)
Variable name:
#{Keeper.SecretsManager.RetrieveSecrets.VaultSecrets}
Use Secrets Manager Notation URIs to specify the Secrets to be returned from Keeper Vault, in the format SecretsManagerNotation URI | OutputVariableName
where:OutputVariableName
is the optional Octopus output variable name to store the secret's value in. If this value isn't specified, an output name will be generated dynamically.
Multiple fields can be retrieved by entering each one on a new line. The line format is
Notation | variable
, where the variable name part is optional and if omitted auto generated variable names are used in the form of KsmSecret1, KsmSecret2, ...etc.V8lFbio0Bs0LuvaSD5DDHA/field/login | MyLogin
V8lFbio0Bs0LuvaSD5DDHA/field/password | MyPass
V8lFbio0Bs0LuvaSD5DDHA/custom_field/phone[1][number] | MyOtherPhoneNum
V8lFbio0Bs0LuvaSD5DDHA/file/IMG_0036.png | MyImageBase64
Print output variable names (type: Checkbox)
Variable name:
#{Keeper.SecretsManager.RetrieveSecrets.PrintVariableNames}
Write out the Octopus output variable names to the task log.
Default: False
Last modified 7mo ago