hasura / hasura/graphql-engine

--admin-secret doesn't work with --endpoint (migrate + more)

Open
#7,780 11 comments 0 reactions 0 assignees View on GitHub
c/cli k/bug support/needs-more-info support/needs-triage t/product-platform
Dominant language
TypeScript
Stars
32.1k
Forks
3k
PR merge metrics
PR metrics pending

Description

### Version Information

Server Version: v1.3.3
CLI Version (for CLI related issue): v1.3.3

### Environment

macOS

### What is the expected behaviour?
Specifying an admin secret as a flag or environment would work, when applying migrations on a remote Hasura server (i.e. using `--endpoint`). I think this might only happen with remote servers, importantly.

I don't think this is related to non-alphanumeric characters but I could be wrong.

### Keywords

`cli` `migrate apply` `endpoint`

### What is the current behaviour?

It doesn't work. [You have to specify the admin-secret in `config.yaml` to get it to work.](https://github.com/hasura/graphql-engine/issues/3740#issuecomment-576799962) This isn't workable for my situation, since I want to migrate the production database and I won't commit the admin secret to the codebase.

### How to reproduce the issue?

1. Migrate with CLI flag
```
hasura migrate apply
--endpoint https://api.example.server.xyz/
--certificate-authority ca-chain.pem
--admin-secret long-and-random-string
```

2. Migrate with ENV
```
HASURA_GRAPHQL_ADMIN_SECRET=long-and-random-string hasura migrate apply
--endpoint https://api.example.server.xyz/
--certificate-authority ca-chain.pem
````

Both of these output:
`# FATA[0002] apply failed: cannot create migrate instance: [access-denied] invalid x-hasura-admin-secret/x-hasura-access-key ($)`

It doesn't seem like `--certificate-authority` vs `--insecure-skip-tls-verify` matters, but a `--endpoint` that's **not** `localhost` does.

### Screenshots or Screencast

n/a

### Please provide any traces or logs that could help here.

This issue, where it was first reported, could be useful: https://github.com/hasura/graphql-engine/issues/3740

I agree with @cltsang that this sould be fixed https://github.com/hasura/graphql-engine/issues/3740#issuecomment-780377239

This same issue happens with `hasura metadata`

This also happens with `hasura console` but the config.yaml workaround doesn't work: https://github.com/hasura/graphql-engine/issues/4926 I except they have a similar root cause.

### Any possible solutions?

n/a

### Can you identify the location in the source code where the problem exists?

No

### If the bug is confirmed, would you be willing to submit a PR?

No

Contributor guide

Open the contributing guide

Assessment

This issue has not been assessed yet.

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.