philipp/uncloud
1
0
Fork 0
mirror of https://github.com/psviderski/uncloud.git synced 2026-11-11 05:04:16 +00:00
Code Issues Packages Projects Releases Wiki Activity

fix(compose): strip and resolve pre-deploy hook secrets like service env (#424)

Browse Source 
* fix(compose): strip and resolve pre-deploy hook secrets like service env (fixes #422)

normaliseContainerForStore only cleared Config.Env and
ServiceSpec.Container.Env before writing a container record to the
replicated Corrosion store, leaving ServiceSpec.PreDeploy.Env in place.
A secret set via x-pre_deploy.environment therefore replicated to
every machine in the cluster, unlike the same value set via
environment.

ResolveSecrets had the same asymmetry in the other direction: it only
resolved secret://name references in service.Environment, so a
reference placed in the pre-deploy hook's environment passed through
unresolved as a literal string. HasCommandSecretRefs is extended the
same way for consistency.

Add tests pinning both behaviours.

* update docs that secret references are available for pre-deploy hooks

---------

Co-authored-by: Pasha Sviderski <me@psviderski.name>
This commit is contained in:
Vaibhav Yadav
2026-10-12 15:48:47 +10:00
committed by GitHub
co-authored by Pasha Sviderski
parent ce1c6bd05a
commit 8ddbe3c606
6 changed files with 217 additions and 32 deletions
Download Patch File Download Diff File Expand all files Collapse all files
website/docs/3-concepts/8-secrets.md
+2 -2
View File
@@ -12,8 +12,8 @@ values at deploy time from your password manager, a cloud secrets store, or loca
Two things go into your Compose file:
1. Define a secret in the top-level `secrets` section. This tells Uncloud how to get the secret value.
2. Reference that secret value in a service's `environment` using the `secret://<name>` format. This tells Uncloud to
resolve the secret and set the environment variable to its value at deploy time.
2. Reference that secret value in a service's `environment` or `x-pre_deploy.environment` using the `secret://<name>`
format. This tells Uncloud to resolve the secret and set the environment variable to its value at deploy time.
```yaml title="compose.yaml"
services: