-
Notifications
You must be signed in to change notification settings - Fork 0
/
Copy pathsecrets.html
34 lines (27 loc) · 8.26 KB
/
secrets.html
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
<html><head><title>Orkestra: Secrets</title><meta charset="utf-8" /><meta http-equiv="X-UA-Compatible" content="IE=edge,chrome=1" /><meta name="viewport" content="width=device-width, initial-scale=1.0" /><meta name="author" content="tech.orkestra" /><meta name="description" content="Functional DevOps with Scala and Kubernetes" /><meta name="og:image" content="/img/poster.png" /><meta name="og:title" content="Orkestra: Secrets" /><meta name="og:site_name" content="Orkestra" /><meta name="og:url" content="https://orkestra.tech" /><meta name="og:type" content="website" /><meta name="og:description" content="Functional DevOps with Scala and Kubernetes" /><link rel="icon" type="image/png" href="/img/favicon.png" /><meta name="twitter:title" content="Orkestra: Secrets" /><meta name="twitter:image" content="https://orkestra.techimg/poster.png" /><meta name="twitter:description" content="Functional DevOps with Scala and Kubernetes" /><meta name="twitter:card" content="summary_large_image" /><link rel="icon" type="image/png" sizes="16x16" href="/img/favicon16x16.png" /><link rel="icon" type="image/png" sizes="24x24" href="/img/favicon24x24.png" /><link rel="icon" type="image/png" sizes="32x32" href="/img/favicon32x32.png" /><link rel="icon" type="image/png" sizes="48x48" href="/img/favicon48x48.png" /><link rel="icon" type="image/png" sizes="57x57" href="/img/favicon57x57.png" /><link rel="icon" type="image/png" sizes="60x60" href="/img/favicon60x60.png" /><link rel="icon" type="image/png" sizes="64x64" href="/img/favicon64x64.png" /><link rel="icon" type="image/png" sizes="70x70" href="/img/favicon70x70.png" /><link rel="icon" type="image/png" sizes="72x72" href="/img/favicon72x72.png" /><link rel="icon" type="image/png" sizes="76x76" href="/img/favicon76x76.png" /><link rel="icon" type="image/png" sizes="96x96" href="/img/favicon96x96.png" /><link rel="icon" type="image/png" sizes="114x114" href="/img/favicon114x114.png" /><link rel="icon" type="image/png" sizes="120x120" href="/img/favicon120x120.png" /><link rel="icon" type="image/png" sizes="128x128" href="/img/favicon128x128.png" /><link rel="icon" type="image/png" sizes="144x144" href="/img/favicon144x144.png" /><link rel="icon" type="image/png" sizes="150x150" href="/img/favicon150x150.png" /><link rel="icon" type="image/png" sizes="152x152" href="/img/favicon152x152.png" /><link rel="icon" type="image/png" sizes="196x196" href="/img/favicon196x196.png" /><link rel="icon" type="image/png" sizes="310x310" href="/img/favicon310x310.png" /><link rel="icon" type="image/png" sizes="310x150" href="/img/favicon310x150.png" /><link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/bootstrap/3.3.7/css/bootstrap.min.css" /><link rel="stylesheet" href="https://maxcdn.bootstrapcdn.com/font-awesome/4.7.0/css/font-awesome.min.css" /><link rel="stylesheet" href="/highlight/styles/atom-one-light.css" /><link rel="stylesheet" href="/css/style.css" /><link rel="stylesheet" href="/css/palette.css" /><link rel="stylesheet" href="/css/codemirror.css" /><link rel="stylesheet" href="/css/override.css" /></head><body class="docs"><div id="wrapper"><div id="sidebar-wrapper"><ul id="sidebar" class="sidebar-nav"><li class="sidebar-brand"><a href="/" class="brand"><div class="brand-wrapper"><span>Orkestra</span></div></a></li> <li><a href="/jobsboards.html" class="">Jobs & Boards</a></li> <li><a href="/config.html" class="">Config</a></li> <li><a href="/parameters.html" class="">Parameters</a></li> <li><a href="/stages.html" class="">Stages</a></li> <li><a href="/shells.html" class="">Shell scripts</a></li> <li><a href="/directories.html" class="">Directories</a></li> <li><a href="/secrets.html" class=" active ">Secrets</a></li> <li><a href="/triggers.html" class="">Triggering jobs</a></li> <li><a href="/runid.html" class="">RunId</a></li> <li><a href="/containers.html" class="">Containers</a></li> <li><a href="/plugins" class="">Plugins</a> <ul class="sub_section"> <li><a href="/plugins/github.html" class="">Github</a></li> <li><a href="/plugins/cron.html" class="">Cron jobs</a></li> <li><a href="/plugins/locking.html" class="">Locking</a></li></ul></li></ul></div><div id="page-content-wrapper"><div class="nav"><div class="container-fluid"><div class="row"><div class="col-lg-12"><div class="action-menu pull-left clearfix"><a href="#menu-toggle" id="menu-toggle"><i class="fa fa-bars" aria-hidden="true"></i></a></div><ul class="pull-right"><li id="gh-eyes-item" class="hidden-xs"><a href="https://github.com/Orkestra-Tech/orkestra"><i class="fa fa-eye"></i><span>WATCH<span id="eyes" class="label label-default">--</span></span></a></li><li id="gh-stars-item" class="hidden-xs"><a href="https://github.com/Orkestra-Tech/orkestra"><i class="fa fa-star-o"></i><span>STARS<span id="stars" class="label label-default">--</span></span></a></li><li><a href="#" onclick="shareSiteTwitter('Orkestra Functional DevOps with Scala and Kubernetes');"><i class="fa fa-twitter"></i></a></li><li><a href="#" onclick="shareSiteFacebook('Orkestra Functional DevOps with Scala and Kubernetes');"><i class="fa fa-facebook"></i></a></li><li><a href="#" onclick="shareSiteGoogle();"><i class="fa fa-google-plus"></i></a></li></ul></div></div></div></div><div id="content" data-github-owner="Orkestra-Tech" data-github-repo="orkestra"><div class="content-wrapper"><section><h1 id="secrets">Secrets</h1>
<p>Secrets in Orkestra relies on the <a href="https://kubernetes.io/docs/concepts/configuration/secret/">Kubernetes Secrets</a>. As
this is already implemented we thought there is no need to add an Orkestra specific implementation.</p>
<h2 id="secrets-as-environment-variables">Secrets as Environment Variables</h2>
<p>On Kubernetes we most commonly use secrets as environment variables.<br />
First we need to create the secret on Kubernetes, then pass the secret to the container, all of that is well explained
in the documentation of <a href="https://kubernetes.io/docs/concepts/configuration/secret/">Kubernetes Secrets</a>.<br />
Then we can access the secret safely with the <code class="highlighter-rouge">Secrets</code> utility object which will make sure the secrets are not saved in
the logs:</p>
<div class="language-scala highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="k">import</span> <span class="nn">tech.orkestra.utils.Secrets</span>
<span class="k">val</span> <span class="n">slackToken</span> <span class="k">=</span> <span class="nc">Secrets</span><span class="o">.</span><span class="n">get</span><span class="o">(</span><span class="s">"SLACK_TOKEN"</span><span class="o">).</span><span class="n">getOrElse</span><span class="o">(</span><span class="s">"not set"</span><span class="o">)</span>
<span class="n">println</span><span class="o">(</span><span class="n">s</span><span class="s">"Look at my secret Slack token: $slackToken!"</span><span class="o">)</span>
</code></pre></div></div>
<p>This will print <code class="highlighter-rouge">Look at my secret Slack token: **********!</code> in the logs.</p>
<p>Attention: Do not use the Scala <code class="highlighter-rouge">sys.env.get()</code> or the Java <code class="highlighter-rouge">System.getEnv()</code> as these will not prevent the secret to be
logged.</p>
<h2 id="secrets-as-files">Secrets as Files</h2>
<p>You might want to use for example an SSH key file as a Secret. We usually mount the secret in a file under
<code class="highlighter-rouge">/opt/docker/secrets/ssh</code> and then access it via this path:</p>
<div class="language-scala highlighter-rouge"><div class="highlight"><pre class="highlight"><code><span class="n">sh</span><span class="o">(</span><span class="n">s</span><span class="s">"ansible-playbook some-playbook.yml --private-key /opt/docker/secrets/ssh"</span><span class="o">)</span>
</code></pre></div></div>
</section></div></div></div></div><script src="https://cdnjs.cloudflare.com/ajax/libs/jquery/1.11.3/jquery.min.js"></script><script src="https://cdnjs.cloudflare.com/ajax/libs/twitter-bootstrap/3.3.7/js/bootstrap.min.js"></script><script src="/highlight/highlight.pack.js"></script><script>hljs.configure({
languages:['scala','java','bash']
});
hljs.initHighlighting();
</script><script>((window.gitter = {}).chat = {}).options = {
room: 'orkestra-tech/Orkestra'};</script><script src="https://sidecar.gitter.im/dist/sidecar.v1.js"></script><script src="/js/main.js"></script></body></html>