Six modules take their secrets from files; the rest say precisely why not
From the survey of every env-file secret (ADR 0086, issue 041): amqp-ping, minio, mongodb and grafana use the _FILE twin their software honours; mesh-catalog and model-usage read DATABASE_URL_FILE (a file the mesh templates, mounted where only the runtime reads it); grafana's secret files belong to its own account. Two dead deliveries removed: a line nothing read in amqp-email-forwarder, and mailu's secret.env on four containers that never read it. The 25 exceptions that remain carry the surveyed reason — convertible and awaiting a bed, convertible through a generated config file, the application's own code, or not convertible.
This commit is contained in:
@@ -75,7 +75,7 @@
|
||||
"ports": [
|
||||
"9000"
|
||||
],
|
||||
"secrets-in-environment": "the server reads its settings from the environment; converting is the per-module work of issue 041"
|
||||
"secrets-in-environment": "the application's own code reads MONGO_URL and MINIO_SECRET from the environment (photos server/src/config.js); converting is that repository's change"
|
||||
},
|
||||
{
|
||||
"id": "admin-client",
|
||||
|
||||
Reference in New Issue
Block a user