generated from greenbone/go-project-template
-
Notifications
You must be signed in to change notification settings - Fork 0
Commit
This commit does not belong to any branch on this repository, and may belong to a fork outside of the repository.
add: allow reading secrets from files (#47)
Pass the path to the file containing the secret to the service by appending `_FILE` to the env var name which normally would contain the secret directly. If both env vars `SECRET` and `SECRET_FILE` are set, `SECRET` takes precedence. As the original way of supplying secrets is still supported, this is a backwards compatible change. ## Why Using the docker secrets feature results in files containing the secret being placed into the container filesystem.
- Loading branch information
Showing
10 changed files
with
149 additions
and
36 deletions.
There are no files selected for viewing
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,22 @@ | ||
| // SPDX-FileCopyrightText: 2024 Greenbone AG <https://greenbone.net> | ||
| // | ||
| // SPDX-License-Identifier: AGPL-3.0-or-later | ||
|
|
||
| package secretfiles | ||
|
|
||
| import ( | ||
| "github.com/greenbone/opensight-golang-libraries/pkg/secretfiles" | ||
| "github.com/greenbone/opensight-notification-service/pkg/config" | ||
| ) | ||
|
|
||
| const ( | ||
| dbPasswordPathEnvVar = "DB_PASSWORD_FILE" | ||
| ) | ||
|
|
||
| // Read takes the filepaths from environment variables and parses the content | ||
| // into the respective secret inside the passed config. | ||
| // A failure can have side effects on the passed config, so error from this function | ||
| // should be treated as fatal. | ||
| func Read(cfg *config.Config) (err error) { | ||
| return secretfiles.ReadSecret(dbPasswordPathEnvVar, &cfg.Database.Password) | ||
| } |
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
| Original file line number | Diff line number | Diff line change |
|---|---|---|
| @@ -0,0 +1,65 @@ | ||
| // SPDX-FileCopyrightText: 2024 Greenbone AG <https://greenbone.net> | ||
| // | ||
| // SPDX-License-Identifier: AGPL-3.0-or-later | ||
|
|
||
| package secretfiles | ||
|
|
||
| import ( | ||
| "os" | ||
| "testing" | ||
|
|
||
| "github.com/greenbone/opensight-notification-service/pkg/config" | ||
| "github.com/stretchr/testify/require" | ||
| ) | ||
|
|
||
| func TestRead(t *testing.T) { | ||
| // create files containing secrets | ||
| tempDir := t.TempDir() | ||
| err := os.WriteFile(tempDir+"/db_password", []byte(" db_password \n\n\t"), 0644) | ||
| require.NoError(t, err) | ||
|
|
||
| tests := map[string]struct { | ||
| envVars map[string]string | ||
| inputConfig config.Config | ||
| wantConfig config.Config | ||
| wantErr bool | ||
| }{ | ||
| "read all secrets from files": { | ||
| inputConfig: config.Config{}, | ||
| envVars: map[string]string{ | ||
| "DB_PASSWORD_FILE": tempDir + "/db_password", | ||
| }, | ||
| wantConfig: config.Config{ | ||
| Database: config.Database{ | ||
| Password: `db_password`, | ||
| }, | ||
| }, | ||
| wantErr: false, | ||
| }, | ||
| "failure with invalid path": { | ||
| inputConfig: config.Config{}, | ||
| envVars: map[string]string{ | ||
| "DB_PASSWORD_FILE": "/invalid/path", | ||
| }, | ||
| wantErr: true, | ||
| }, | ||
| } | ||
|
|
||
| for name, tt := range tests { | ||
| t.Run(name, func(t *testing.T) { | ||
| // set the environment variables | ||
| for key, value := range tt.envVars { | ||
| err := os.Setenv(key, value) | ||
| require.NoError(t, err) | ||
| } | ||
|
|
||
| err := Read(&tt.inputConfig) | ||
| if tt.wantErr { | ||
| require.Error(t, err) | ||
| } else { | ||
| require.NoError(t, err) | ||
| require.Equal(t, tt.wantConfig, tt.inputConfig) | ||
| } | ||
| }) | ||
| } | ||
| } |