Six modules take their secrets from files; the rest say precisely why not
From the survey of every env-file secret (ADR 0086, issue 041): amqp-ping, minio, mongodb and grafana use the _FILE twin their software honours; mesh-catalog and model-usage read DATABASE_URL_FILE (a file the mesh templates, mounted where only the runtime reads it); grafana's secret files belong to its own account. Two dead deliveries removed: a line nothing read in amqp-email-forwarder, and mailu's secret.env on four containers that never read it. The 25 exceptions that remain carry the surveyed reason — convertible and awaiting a bed, convertible through a generated config file, the application's own code, or not convertible.
This commit is contained in:
@@ -36,7 +36,7 @@
|
||||
"type": "file",
|
||||
"path": "/var/lib/amqp-ping/amqp.env",
|
||||
"mode": "0600",
|
||||
"content": "MESH_AMQP_HOST=${bound:amqp:at}\nMESH_AMQP_PORT=${bound:amqp:port}\nMESH_AMQP_USER=${bound:amqp:as}\nMESH_AMQP_VHOST=${bound:amqp:as}\nMESH_AMQP_PASSWORD=${secret:amqp}\n"
|
||||
"content": "MESH_AMQP_HOST=${bound:amqp:at}\nMESH_AMQP_PORT=${bound:amqp:port}\nMESH_AMQP_USER=${bound:amqp:as}\nMESH_AMQP_VHOST=${bound:amqp:as}\n"
|
||||
},
|
||||
{
|
||||
"id": "net",
|
||||
@@ -49,10 +49,12 @@
|
||||
"name": "amqp-ping",
|
||||
"network": "amqp-ping",
|
||||
"volumes": [
|
||||
"/var/lib/mesh/amqp-ping/broker:/run/secrets/broker:ro"
|
||||
"/var/lib/mesh/amqp-ping/broker:/run/secrets/broker:ro",
|
||||
"/var/lib/amqp-ping/amqp.secret:/run/secrets/amqp:ro"
|
||||
],
|
||||
"env": {
|
||||
"MESH_BROKER_FILE": "/run/secrets/broker"
|
||||
"MESH_BROKER_FILE": "/run/secrets/broker",
|
||||
"MESH_AMQP_PASSWORD_FILE": "/run/secrets/amqp"
|
||||
},
|
||||
"env-file": [
|
||||
"/var/lib/amqp-ping/amqp.env"
|
||||
@@ -60,8 +62,7 @@
|
||||
"restart-on": [
|
||||
"amqp-env"
|
||||
],
|
||||
"artifact": "runtime",
|
||||
"secrets-in-environment": "the runtime reads MESH_AMQP_* from the environment; a file twin in the SDK is the per-module work of issue 041"
|
||||
"artifact": "runtime"
|
||||
}
|
||||
],
|
||||
"build": {
|
||||
|
||||
Reference in New Issue
Block a user