Templated secrets and configs #33702

aaronlehmann · 2017-06-15T19:22:31Z

This adds support for template expansion in secrets and configs, as added up stream in moby/swarmkit#2133.

SecretSpec and ConfigSpec have a new optional Templating field. Currently, the only supported value is golang for go-style templates, but I imagine supporting other templating engines in the future, as Go-style templating is not especially familiar to Docker's target audience.

When templating is enabled, it's possible to expand information about the task and service (examples: {{.Task.ID}}, {{env "VAR"}}), and other secrets and configs available to the service (example: {{secret "sometarget"}}).

A few areas where this can be useful:

Fill in information in a configuration file based on the task, service, or environment.
Insert a secret such as a password into a configuration file, so the configuration file template can be managed separatly from the actual credential.
Compose a secret from multiple secrets.

cc @diogomonica

cpuguy83 · 2017-06-20T21:51:58Z

Just so I understand, this is making it so you can template the actual secret/config data and effectively creates a dependencies between secrets/configs (assuming that the template is referencing a secret/config).

aaronlehmann · 2017-06-20T22:52:19Z

Just so I understand, this is making it so you can template the actual secret/config data and effectively creates a dependencies between secrets/configs (assuming that the template is referencing a secret/config).

I suppose you can say that, but you only secrets and configs already attached to the service may be referenced. So it effectively creates dependencies between services/configs, but cannot add new secret/config dependencies to a service.

cpuguy83 · 2017-06-22T04:17:46Z

integration-cli/docker_api_swarm_config_test.go

+			Name: "golang",
+		},
+		Data: []byte("SERVICE_NAME={{.Service.Name}}\n" +
+			"{{secret \"referencedsecrettarget\"}}\n" +


If configs can pull in secrets, doesn't this have security consequences since configs are not on tmpfs?

I brought that up here, but there didn't seem to be concerns about it: moby/swarmkit#2133 (comment)

I'd be fine with restricting the ability to insert secrets into configs if people think that's the right thing to do.

Yeah, I think it's a mistake to allow importing secrets into a config.
/cc @diogomonica

Aren't configs also tmpFS?

Nope. See moby/swarmkit#2133 (comment)

I vaguely remember the outcome of that discussion being that if configs are flagged having a dependency on a secret, it was going to be treated as a secret? It was left as an implementation detail for the future, though.

I started working on flagging configs that depend on a secret so they can be stored in tmpfs. moby/swarmkit#2286 is the swarmkit part of this. I will update this PR to make use of this.

Updated the PR with new commits to store configs in the tmpfs secrets directory when they have secrets inserted inside them. Marking WIP because this depends on moby/swarmkit#2286.

that seems really complicated, why don't we move all configs to tmpfs? They should be accounted for under the container's memory usage so I don't think thats an issue.

That would be fine with me. I don't have time to update the PR right now, but it's okay with me if someone wants to carry this.

aaronlehmann · 2017-06-23T22:40:15Z

Rebased

aaronlehmann · 2017-06-29T23:42:52Z

docker-py test failures are unrelated (#33863)

aaronlehmann · 2017-07-19T21:10:35Z

Swarmkit PR was merged. Rebased this one.

ping @diogomonica @cyli @cpuguy83

cyli · 2017-07-20T01:37:40Z

Not sure if the lack of network-create event failures are related to the vendoring... but the config changes LGTM.

aaronlehmann · 2017-07-20T16:56:25Z

I broke something in moby/swarmkit#2310. I messed up the lifecycle on the watch server - it's supposed to be available on non-leader nodes as well. I'll fix it.

vdemeester

With adding a way to ignore the templating if the API version is lower than the current one (don't remember the exact number), SGTM 👍

vdemeester · 2018-02-01T22:06:37Z

container/container_windows.go

+// TODO: Right now Windows doesn't really have a "secure" storage for secrets,
+// however some configs may contain secrets. Once secure storage is worked out,
+// configs and secret handling should be merged.
+func (container *Container) ConfigMounts() []Mount {


Won't this fail to validate (golint 😛)

Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>

This makes configs and secrets behavior identical. Signed-off-by: Brian Goff <cpuguy83@gmail.com>

On unix, merge secrets/configs handling. This is important because configs can contain secrets (via templating) and potentially a config could just simply have secret information "by accident" from the user. This just make sure that configs are as secure as secrets and de-dups a lot of code. Generally this makes everything simpler and configs more secure. Signed-off-by: Brian Goff <cpuguy83@gmail.com>

Makes sure if the user specifies an older API version that we don't pass through templating options for versions that templating was not supported. Signed-off-by: Brian Goff <cpuguy83@gmail.com>

vdemeester

LGTM 🦁

thaJeztah

LGTM

thaJeztah · 2018-02-21T10:51:07Z

api/server/router/swarm/cluster_routes.go

@@ -372,6 +372,10 @@ func (sr *swarmRouter) createSecret(ctx context.Context, w http.ResponseWriter,
 	if err := json.NewDecoder(r.Body).Decode(&secret); err != nil {
 		return err
 	}
+	version := httputils.VersionFromContext(ctx)
+	if secret.Templating != nil && versions.LessThan(version, "1.36") {
+		return errdefs.InvalidParameter(errors.Errorf("secret templating is not supported on the specified API version: %s", version))


Hm initially thought we'd ignore the property (as in: "old API doesn't know about this option, so just ignores it"), but I guess it's ok

thaJeztah · 2018-02-21T10:52:17Z

api/server/router/swarm/cluster_routes.go

@@ -372,6 +372,10 @@ func (sr *swarmRouter) createSecret(ctx context.Context, w http.ResponseWriter,
 	if err := json.NewDecoder(r.Body).Decode(&secret); err != nil {
 		return err
 	}
+	version := httputils.VersionFromContext(ctx)
+	if secret.Templating != nil && versions.LessThan(version, "1.36") {


oh, dang! this needs to be 1.37 now (#33922 was merged) - also needs a mention in the API version history, can do that in the same follow-up

I'm ok with fixing that in a follow-up

codecov · 2018-02-21T12:29:40Z

Codecov Report

Merging #33702 into master will decrease coverage by 0.17%.
The diff coverage is 0%.

@@            Coverage Diff             @@
##           master   #33702      +/-   ##
==========================================
- Coverage   34.22%   34.05%   -0.18%     
==========================================
  Files         609      609              
  Lines       45267    46075     +808     
==========================================
+ Hits        15493    15690     +197     
- Misses      27821    28371     +550     
- Partials     1953     2014      +61

thaJeztah · 2018-02-21T12:39:01Z

Ignoring codecode/patch;

Missing base report.
Unable to compare commits because the base of the compare did not upload a coverage report.

GordonTheTurtle added the status/0-triage label Jun 15, 2017

aaronlehmann force-pushed the templated-secrets-and-configs branch 2 times, most recently from 0ee21b0 to 5259d1a Compare June 15, 2017 23:37

cpuguy83 added status/1-design-review and removed status/0-triage labels Jun 16, 2017

aaronlehmann added the rebuild/experimental label Jun 20, 2017

GordonTheTurtle removed the rebuild/experimental label Jun 20, 2017

cpuguy83 reviewed Jun 22, 2017

View reviewed changes

aaronlehmann force-pushed the templated-secrets-and-configs branch from 5259d1a to 6715c7e Compare June 23, 2017 22:40

aaronlehmann force-pushed the templated-secrets-and-configs branch from 6715c7e to 82340f8 Compare June 27, 2017 02:03

aaronlehmann changed the title ~~Templated secrets and configs~~ [WIP] Templated secrets and configs Jun 27, 2017

aaronlehmann added the rebuild/janky label Jun 27, 2017

GordonTheTurtle removed the rebuild/janky label Jun 27, 2017

aaronlehmann force-pushed the templated-secrets-and-configs branch from 82340f8 to c0f58cf Compare June 27, 2017 18:59

GordonTheTurtle assigned runcom Jun 30, 2017

aaronlehmann added the rebuild/* label Jul 7, 2017

GordonTheTurtle removed the rebuild/* label Jul 7, 2017

aaronlehmann force-pushed the templated-secrets-and-configs branch from c0f58cf to 6c946d4 Compare July 11, 2017 22:38

aaronlehmann mentioned this pull request Jul 18, 2017

Fix API docs for GET /secrets/{id}, GET /secrets #34171

Merged

thaJeztah added the status/needs-attention Calls for a collective discussion during a review session label Jul 18, 2017

aaronlehmann mentioned this pull request Jul 18, 2017

api: Update swagger.yaml for configs #34172

Merged

aaronlehmann changed the title ~~[WIP] Templated secrets and configs~~ Templated secrets and configs Jul 19, 2017

aaronlehmann force-pushed the templated-secrets-and-configs branch from 6c946d4 to 3c61b4c Compare July 19, 2017 21:10

thaJeztah added the impact/changelog label Jan 23, 2018

thaJeztah mentioned this pull request Jan 29, 2018

Fix secret and config mode issue #36130

Merged

vdemeester reviewed Feb 1, 2018

View reviewed changes

cpuguy83 force-pushed the templated-secrets-and-configs branch from 48615bf to 4d3d211 Compare February 15, 2018 02:13

aaronlehmann and others added 8 commits February 16, 2018 11:25

executor: Use a TemplatedDependencyGetter to support template expansion

56da5fd

Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>

api: Add Templating parameter to SecretSpec and ConfigSpec

c5df723

Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>

integration-cli: Add secret/config templating tests

cdd2e6e

Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>

Store configs that contain secrets on tmpfs

cd3d048

Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>

daemon: Check return value of createSecretDir

426f4e4

Signed-off-by: Aaron Lehmann <aaron.lehmann@docker.com>

Always mount configs with tmpfs

8e8f5f4

This makes configs and secrets behavior identical. Signed-off-by: Brian Goff <cpuguy83@gmail.com>

Error out on secret/config templates for older API

a407761

Makes sure if the user specifies an older API version that we don't pass through templating options for versions that templating was not supported. Signed-off-by: Brian Goff <cpuguy83@gmail.com>

cpuguy83 force-pushed the templated-secrets-and-configs branch from 4d3d211 to a407761 Compare February 16, 2018 16:25

vdemeester approved these changes Feb 21, 2018

View reviewed changes

thaJeztah approved these changes Feb 21, 2018

View reviewed changes

thaJeztah added status/4-merge and removed status/2-code-review status/needs-attention Calls for a collective discussion during a review session labels Feb 21, 2018

thaJeztah merged commit 0076343 into moby:master Feb 21, 2018

This was referenced Feb 21, 2018

Adjust minimum API version for templated configs/secrets #36366

Merged

Bump moby to 0ede01237c9ab871f1b8db0364427407f3e46541 docker/cli#894

Merged

Add --template-driver option for secrets/configs docker/cli#896

Merged

gbarr01 mentioned this pull request Mar 12, 2018

To doc: Add support for templated secrets and configs docker/docs#6207

Open

albers mentioned this pull request Apr 14, 2018

Add bash completion for secret|config create --template-driver docker/cli#1004

Merged

thaJeztah mentioned this pull request May 22, 2018

Proposal: Support templates for application config #8446

Closed

vdemeester mentioned this pull request May 31, 2018

Add support for template_driver in composefiles docker/cli#1100

Closed

2 tasks

thaJeztah mentioned this pull request Jul 2, 2018

ENV variables in Configs/Secrets #37377

Closed

thaJeztah mentioned this pull request Apr 8, 2020

Add example for templated config docker/docs#10512

Merged

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

Templated secrets and configs #33702

Templated secrets and configs #33702

aaronlehmann commented Jun 15, 2017

cpuguy83 commented Jun 20, 2017

aaronlehmann commented Jun 20, 2017

cpuguy83 Jun 22, 2017

aaronlehmann Jun 22, 2017

cpuguy83 Jun 26, 2017

diogomonica Jun 26, 2017

aaronlehmann Jun 26, 2017

cyli Jun 26, 2017

aaronlehmann Jun 26, 2017

aaronlehmann Jun 27, 2017

justincormack Sep 21, 2017

aaronlehmann Sep 22, 2017

aaronlehmann commented Jun 23, 2017

aaronlehmann commented Jun 29, 2017

aaronlehmann commented Jul 19, 2017

cyli commented Jul 20, 2017

aaronlehmann commented Jul 20, 2017

vdemeester left a comment

vdemeester Feb 1, 2018

vdemeester left a comment

thaJeztah left a comment

thaJeztah Feb 21, 2018

thaJeztah Feb 21, 2018 •

edited

Loading

thaJeztah Feb 21, 2018

codecov bot commented Feb 21, 2018 •

edited

Loading

thaJeztah commented Feb 21, 2018

Templated secrets and configs #33702

Templated secrets and configs #33702

Conversation

aaronlehmann commented Jun 15, 2017

cpuguy83 commented Jun 20, 2017

aaronlehmann commented Jun 20, 2017

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

aaronlehmann commented Jun 23, 2017

aaronlehmann commented Jun 29, 2017

aaronlehmann commented Jul 19, 2017

cyli commented Jul 20, 2017

aaronlehmann commented Jul 20, 2017

vdemeester left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

vdemeester left a comment

Choose a reason for hiding this comment

thaJeztah left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

thaJeztah Feb 21, 2018 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

codecov bot commented Feb 21, 2018 • edited Loading

Codecov Report

thaJeztah commented Feb 21, 2018

thaJeztah Feb 21, 2018 •

edited

Loading

codecov bot commented Feb 21, 2018 •

edited

Loading