secret with external: true is no longer scoped with the stack name
Nobody has claimed this yet.
- Dominant language
- Go
- Stars
- 6.1k
- Forks
- 2.2k
- Avg merge
- 1d 15h
- Merged PRs (30d)
- 43
Description
Description
I'm trying to set up a docker-compose.yml for a mariadb database. I want to use secrets for things like the db_password. I think the docker documentation says, that a secret with a name: declaration is no longer scoped with the stack name. Instead it is no longer scoped when external is set to true.
Steps to reproduce the issue:
excerpt from the docker-compose.yml:
version: "3.5"
secrets:
db_password:
external: true
Describe the results you received:
gives me the following result:
docker stack deploy -c docker-compose.yml keycloak
service dbinit: secret not found: db_password
Describe the results you expected:
i expected, that the secret is scoped with the stack name. That behavior would be consistent with the behavior of:
secrets:
db_password:
file: ./secret.txt
Additional information you deem important (e.g. issue happens only occasionally):
what does work is for example:
secrets:
db_password:
name: ${STACK}-db_password
external: true
and successful deploying with
export STACK=keycloak
docker stack deploy -c docker-compose.yml ${STACK}
while templating doesn't seem to work inside the name field:
db_password:
name: '{{index .Service.Labels "com.docker.stack.namespace"}}-db_password'
external: true
and deploying gives an error:
docker stack deploy -c docker-compose.yml keycloak
service dbinit: secret not found: {{index .Service.Labels "com.docker.stack.namespace"}}-db_password
Output of docker version:
Client:
Version: 18.09.3
API version: 1.39
Go version: go1.10.8
Git commit: 774a1f4
Built: Thu Feb 28 06:40:58 2019
OS/Arch: linux/amd64
Experimental: false
Server: Docker Engine - Community
Engine:
Version: 18.09.3
API version: 1.39 (minimum version 1.12)
Go version: go1.10.8
Git commit: 774a1f4
Built: Thu Feb 28 05:59:55 2019
OS/Arch: linux/amd64
Experimental: false
Output of docker info:
Containers: 11
Running: 10
Paused: 0
Stopped: 1
Images: 16
Server Version: 18.09.3
Storage Driver: overlay2
Backing Filesystem: extfs
Supports d_type: true
Native Overlay Diff: true
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
Volume: local
Network: bridge host macvlan null overlay
Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
Swarm: active
NodeID: 1i44r9qn7k0bvl5ixzlt6v1v1
Is Manager: true
ClusterID: zacn0a5x5fs8sldvgtjm1v031
Managers: 1
Nodes: 3
Default Address Pool: 10.0.0.0/8
SubnetSize: 24
Orchestration:
Task History Retention Limit: 5
Raft:
Snapshot Interval: 10000
Number of Old Snapshots to Retain: 0
Heartbeat Tick: 1
Election Tick: 10
Dispatcher:
Heartbeat Period: 5 seconds
CA Configuration:
Expiry Duration: 3 months
Force Rotate: 0
Autolock Managers: false
Root Rotation In Progress: false
Node Address: 192.168.40.159
Manager Addresses:
192.168.40.159:2377
Runtimes: runc
Default Runtime: runc
Init Binary: docker-init
containerd version: e6b3f5632f50dbc4e9cb6288d911bf4f5e95b18e
runc version: 6635b4f0c6af3810594d2770f662f34ddc15b40d
init version: fec3683
Security Options:
apparmor
seccomp
Profile: default
Kernel Version: 4.4.0-142-generic
Operating System: Ubuntu 16.04.5 LTS
OSType: linux
Architecture: x86_64
CPUs: 4
Total Memory: 3.858GiB
Name: docker01
ID: RPZ2:JQBM:DTJX:6CMY:5LDR:37XL:GBSJ:GOFS:NCGD:JFEM:J37Y:AUHG
Docker Root Dir: /var/lib/docker
Debug Mode (client): false
Debug Mode (server): false
Registry: https://index.docker.io/v1/
Labels:
Experimental: false
Insecure Registries:
127.0.0.0/8
Additional environment details (AWS, VirtualBox, physical, etc.):
Contributor guide
First steps
- Read the whole issue, then the project's contributing guide.
- Comment on the issue to say you are picking it up — it saves two people doing the same work.
- Fork the repository and make your change on a branch.
- Open a pull request that references the issue number.
Research direction
Start with the supplied docker-compose.yml and the docker stack deploy reproduction. Trace how external secrets, file-backed secrets, explicitly named secrets, and the templated name are resolved during deployment. Done means the reported scoping behavior is corrected or its supported behavior is clearly established and the reproduction no longer contradicts it.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- docker, go
- Domain
- cli, devops
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100