Associate Variable Sets to Projects
By default, a Variable Set should apply to all projects, but it would be nice to be able to associate it to a specific set of projects.
In our team, we have 13 projects that share a variable set. There's currently no way to restrict our users to only have access to those variables without having the same access to other variable sets for other parts of our organization. We don't want to have to duplicate those variables 13 times.
Jake Kerber
shared this idea
-
Paul Wilcox
commented
I disagree that by default a variable set should apply to all projects - I'd say it would be better to grant less permissions until needed/wanted (and that these have to be explicitly added... rather than added by default).
I DO agree with the idea that variable sets should be able to be linked with only specific/selected pipelines. For example...
At present, sensitive variables added to a variable set are immediately available to ALL pipelines/projects. That means that if you use a username and password (for example) within one variable set, then anyone else with access to the variable set (i.e. all pipelines, by default) is able to use that username and password to do what they want.
At present, in Octopus, you can limit access to the pipelines/projects (and related groups), but the variable sets are effectively global and there is no access control on these at present (other than maybe to amend/update them).
You'd also have to ensure that there were distinct roles/permissions available (for example):
- Users that could update variable sets (possibly specific to the variable set? and/or the environment within the variable set?)
- Users that could link the variable set to a project/pipeline or project groupThe same items may apply for 'Accounts' (under 'Infrastructure')... you can limit an account being used within an environment, but that account can be used in any project within Octopus (that scope/access is too wide (in my opinion).