docker / docker/cli

secret with external: true is no longer scoped with the stack name

Open
#1,706 0 comments 1 reaction 0 assignees View on GitHub

Nobody has claimed this yet.

area/stack area/swarm version/18.09
Dominant language
Go
Stars
6.1k
Forks
2.2k
Avg merge
1d 15h
Merged PRs (30d)
43

Description

Description
I'm trying to set up a docker-compose.yml for a mariadb database. I want to use secrets for things like the db_password. I think the docker documentation says, that a secret with a name: declaration is no longer scoped with the stack name. Instead it is no longer scoped when external is set to true.

Steps to reproduce the issue:

excerpt from the docker-compose.yml:

version: "3.5"

secrets:
  db_password:
    external: true

Describe the results you received:
gives me the following result:

docker stack deploy -c docker-compose.yml keycloak
service dbinit: secret not found: db_password

Describe the results you expected:
i expected, that the secret is scoped with the stack name. That behavior would be consistent with the behavior of:

secrets:
  db_password:
    file: ./secret.txt

Additional information you deem important (e.g. issue happens only occasionally):
what does work is for example:

secrets:
  db_password:
    name: ${STACK}-db_password
    external: true

and successful deploying with

export STACK=keycloak
docker stack deploy -c docker-compose.yml ${STACK}

while templating doesn't seem to work inside the name field:

  db_password:
    name: '{{index .Service.Labels "com.docker.stack.namespace"}}-db_password'
    external: true

and deploying gives an error:

docker stack deploy -c docker-compose.yml keycloak
service dbinit: secret not found: {{index .Service.Labels "com.docker.stack.namespace"}}-db_password

Output of docker version:

Client:
 Version:           18.09.3
 API version:       1.39
 Go version:        go1.10.8
 Git commit:        774a1f4
 Built:             Thu Feb 28 06:40:58 2019
 OS/Arch:           linux/amd64
 Experimental:      false

Server: Docker Engine - Community
 Engine:
  Version:          18.09.3
  API version:      1.39 (minimum version 1.12)
  Go version:       go1.10.8
  Git commit:       774a1f4
  Built:            Thu Feb 28 05:59:55 2019
  OS/Arch:          linux/amd64
  Experimental:     false

Output of docker info:

Containers: 11
 Running: 10
 Paused: 0
 Stopped: 1
Images: 16
Server Version: 18.09.3
Storage Driver: overlay2
 Backing Filesystem: extfs
 Supports d_type: true
 Native Overlay Diff: true
Logging Driver: json-file
Cgroup Driver: cgroupfs
Plugins:
 Volume: local
 Network: bridge host macvlan null overlay
 Log: awslogs fluentd gcplogs gelf journald json-file local logentries splunk syslog
Swarm: active
 NodeID: 1i44r9qn7k0bvl5ixzlt6v1v1
 Is Manager: true
 ClusterID: zacn0a5x5fs8sldvgtjm1v031
 Managers: 1
 Nodes: 3
 Default Address Pool: 10.0.0.0/8
 SubnetSize: 24
 Orchestration:
  Task History Retention Limit: 5
 Raft:
  Snapshot Interval: 10000
  Number of Old Snapshots to Retain: 0
  Heartbeat Tick: 1
  Election Tick: 10
 Dispatcher:
  Heartbeat Period: 5 seconds
 CA Configuration:
  Expiry Duration: 3 months
  Force Rotate: 0
 Autolock Managers: false
 Root Rotation In Progress: false
 Node Address: 192.168.40.159
 Manager Addresses:
  192.168.40.159:2377
Runtimes: runc
Default Runtime: runc
Init Binary: docker-init
containerd version: e6b3f5632f50dbc4e9cb6288d911bf4f5e95b18e
runc version: 6635b4f0c6af3810594d2770f662f34ddc15b40d
init version: fec3683
Security Options:
 apparmor
 seccomp
  Profile: default
Kernel Version: 4.4.0-142-generic
Operating System: Ubuntu 16.04.5 LTS
OSType: linux
Architecture: x86_64
CPUs: 4
Total Memory: 3.858GiB
Name: docker01
ID: RPZ2:JQBM:DTJX:6CMY:5LDR:37XL:GBSJ:GOFS:NCGD:JFEM:J37Y:AUHG
Docker Root Dir: /var/lib/docker
Debug Mode (client): false
Debug Mode (server): false
Registry: https://index.docker.io/v1/
Labels:
Experimental: false
Insecure Registries:
 127.0.0.0/8

Additional environment details (AWS, VirtualBox, physical, etc.):

Contributor guide

Open the contributing guide

First steps

  1. Read the whole issue, then the project's contributing guide.
  2. Comment on the issue to say you are picking it up — it saves two people doing the same work.
  3. Fork the repository and make your change on a branch.
  4. Open a pull request that references the issue number.

Research direction

Start with the supplied docker-compose.yml and the docker stack deploy reproduction. Trace how external secrets, file-backed secrets, explicitly named secrets, and the templated name are resolved during deployment. Done means the reported scoping behavior is corrected or its supported behavior is clearly established and the reproduction no longer contradicts it.

Written by the indexing model from the issue text.

Assessment

Tech stack
docker, go
Domain
cli, devops
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.