Question

You are building a change-validation step in a CI pipeline using pyATS CLI tools. Before comparing pre- and post-change device state, you must connect pyATS to three IOS-XE routers. Your teammate hardcoded the enable and login passwords directly in the testbed.yaml committed to Git, and a security review flagged this. You need to keep the testbed usable by `pyats` CLI commands while removing plaintext secrets from source control. Which approach correctly resolves this?

Accepted Answer

Reference the credentials in the testbed using the `%ENV{...}` markup so pyATS resolves passwords from environment variables injected as masked CI secrets at runtime

Answer

Base64-encode the passwords in the testbed.yaml so they are no longer stored as readable plaintext in the repository

Answer

Move the passwords into a separate credentials.yaml file in the same repo and add it to .gitignore only on the developer's local machine

Answer

Set `verify=False` on the testbed connection block so pyATS skips credential checking entirely during the run