geonetwork / geonetwork/docker-geonetwork
Removal of Elasticsearch environment variables means secrets have to be stored in code
- Dominant language
- Shell
- Stars
- 40
- Forks
- 43
- PR merge metrics
- No merged PRs in 30d
Description
Since v4.4 the individual environment variables for configuring Elasticsearch are obsolete. e.g. `ES_HOST`, `ES_PORT`, `ES_PASSWORD` etc.
This is a regression for us since we rely on passing secrets to individual environment variables from AWS secrets manager/parameter store using the "value_from" directive. See https://docs.aws.amazon.com/AmazonECS/latest/developerguide/secrets-envvar-ssm-paramstore.html#secrets-envvar-ssm-paramstore-update-container-definition
Since we now have to pass all Geonetwork settings in the one variable `GN_CONFIG_PROPERTIES` it makes it necessary to store the secret for `ES_PASSWORD` in plain-text in code, unless we store all the values for `GN_CONFIG_PROPERTIES` as a secret too. However this becomes annoying as we ideally want to be able to look at the code to see what a particular environment is using.
Is there a good reason why these variables were deprecated?
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by reviewing the v4.4 Docker configuration and how ES_HOST, ES_PORT, ES_PASSWORD, and GN_CONFIG_PROPERTIES are processed. Compare that behavior with AWS ECS value_from secret injection. Done requires an agreed configuration approach that avoids putting ES_PASSWORD in source, or documentation explaining why the individual variables were removed.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- aws, docker, elasticsearch
- Domain
- cloud, devops, security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100