geonetwork / geonetwork/docker-geonetwork

Removal of Elasticsearch environment variables means secrets have to be stored in code

Open
#120 2 comments 0 reactions 0 assignees View on GitHub
Dominant language
Shell
Stars
40
Forks
43
PR merge metrics
No merged PRs in 30d

Description

Since v4.4 the individual environment variables for configuring Elasticsearch are obsolete. e.g. `ES_HOST`, `ES_PORT`, `ES_PASSWORD` etc.

This is a regression for us since we rely on passing secrets to individual environment variables from AWS secrets manager/parameter store using the "value_from" directive. See https://docs.aws.amazon.com/AmazonECS/latest/developerguide/secrets-envvar-ssm-paramstore.html#secrets-envvar-ssm-paramstore-update-container-definition

Since we now have to pass all Geonetwork settings in the one variable `GN_CONFIG_PROPERTIES` it makes it necessary to store the secret for `ES_PASSWORD` in plain-text in code, unless we store all the values for `GN_CONFIG_PROPERTIES` as a secret too. However this becomes annoying as we ideally want to be able to look at the code to see what a particular environment is using.

Is there a good reason why these variables were deprecated?

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reviewing the v4.4 Docker configuration and how ES_HOST, ES_PORT, ES_PASSWORD, and GN_CONFIG_PROPERTIES are processed. Compare that behavior with AWS ECS value_from secret injection. Done requires an agreed configuration approach that avoids putting ES_PASSWORD in source, or documentation explaining why the individual variables were removed.

Written by the indexing model from the issue text.

Assessment

Tech stack
aws, docker, elasticsearch
Domain
cloud, devops, security
Issue type
Bug
Difficulty
5/5
Estimated time
Over a week
Activity status
Stale
Clarity
Needs clarification
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.