Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Add inline content support for secrets #573

Open
wants to merge 1 commit into
base: main
Choose a base branch
from

Conversation

yp05327
Copy link

@yp05327 yp05327 commented Feb 14, 2024

In #478, inlined content for config was supported.
secrets and configs are using the same struct FileObjectConfig, so it can be easily implemented.

When I want to manage all secrets in one compose file, I noticed that I need to manage both compose files and the secrets files, as secrets only support reading from a file or environment variables.

Signed-off-by: yp05327 <576951401@qq.com>
@yp05327 yp05327 force-pushed the add-inline-content-for-secrets branch from ea1f490 to d238779 Compare February 14, 2024 05:55
@ndeloof
Copy link
Collaborator

ndeloof commented Feb 14, 2024

The reason inlined content was introduced for configs and not for secrets is that in most scenario, a secret is local or dynamically generated and should not be committed with the main compose file. Also to be considered security risks for users misusing such a feature and actually pushing to github some real secrets (yes, this happens, and at large scale)
Other than such considerations, I don't see any blocker here

@yp05327
Copy link
Author

yp05327 commented Feb 15, 2024

I understand the security considerations. It depends on the user's knowledge. But warnings can be added in docs.
Actually, there's no warnings about it in docs now. So still some users are pushing secrets without recognition.
In another way, for users who know how to use this feature correctly, they have more choices and can do more things.
I'm doing some works on docker compose based 'helm chart' which uses go template to generate docker compose files.
But I notice that users can only create a secret file first, then link it in docker compose.
In k8s, they provide such feature, and have security warnings about using secrets in docs.
So if this feature can be supported, it will be awesome.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

Successfully merging this pull request may close these issues.

None yet

2 participants