* fix(compose): strip and resolve pre-deploy hook secrets like service env (fixes#422)
normaliseContainerForStore only cleared Config.Env and
ServiceSpec.Container.Env before writing a container record to the
replicated Corrosion store, leaving ServiceSpec.PreDeploy.Env in place.
A secret set via x-pre_deploy.environment therefore replicated to
every machine in the cluster, unlike the same value set via
environment.
ResolveSecrets had the same asymmetry in the other direction: it only
resolved secret://name references in service.Environment, so a
reference placed in the pre-deploy hook's environment passed through
unresolved as a literal string. HasCommandSecretRefs is extended the
same way for consistency.
Add tests pinning both behaviours.
* update docs that secret references are available for pre-deploy hooks
---------
Co-authored-by: Pasha Sviderski <me@psviderski.name>
* feat(dns): implement extra dns names for machine in m.internal
This implements <machinename>.m.internal and <machineid>.m.internal as
names that can be queried in the cluster.
Listing all machines/services is not implemented, this may come later.
Fixes: #340
Signed-off-by: Miek Gieben <miek@miek.nl>
* Implement getting all machine address
A query for m.internal returns all ip address
There is no overflow check
Signed-off-by: Miek Gieben <miek@miek.nl>
---------
Signed-off-by: Miek Gieben <miek@miek.nl>
* feat: add uc dns set
This allows manual setting of the cluster's domain name. I use this to
make the local cluster admin aware that this has been done.
(and then manually update the external dns)
```
% uc dns set ctrl.u.science.ru.nl
Set cluster domain: ctrl.u.science.ru.nl
Deploy the Caddy reverse proxy service ('uc caddy deploy') to enable internet access to your services via the reserved or your custom domain.
% uc dns show
ctrl.u.science.ru.nl
% uc dns set ctrl.u.science.ru.nl
Error: domain already reserved
% uc dns release
Released cluster domain: ctrl.u.science.ru.nl
```
See: #37
Signed-off-by: Miek Gieben <miek@miek.nl>
* docs
Signed-off-by: Miek Gieben <miek@miek.nl>
* check validatity
Signed-off-by: Miek Gieben <miek@miek.nl>
* No need to call out to update anything, as set doesnt use uncloud dns
Signed-off-by: Miek Gieben <miek@miek.nl>
* Ignore domain when there is no endpoint
Prevents this error, when you know what you're doing:
Error: failed to update DNS records pointing to caddy service: create cluster domain records in Uncloud DNS: rpc error: code = Unknown desc = Post "/domains/ctrl.u.science.ru.nl/records": unsupported protocol scheme ""
Signed-off-by: Miek Gieben <miek@miek.nl>
* from main
Signed-off-by: Miek Gieben <miek@miek.nl>
* mise proto && make cli-docs
Signed-off-by: Miek Gieben <miek@miek.nl>
* Rebase and and generate protos again
Signed-off-by: Miek Gieben <miek@miek.nl>
* Rebase and fix
Signed-off-by: Miek Gieben <miek@miek.nl>
* feat(dns): allow setting an externally managed cluster domain
---------
Signed-off-by: Miek Gieben <miek@miek.nl>
Co-authored-by: Pasha Sviderski <me@psviderski.name>
* feat: support stdin_open and tty
This can be useful to leave a container running without specifying a
command like `sleep`, and probably in other situations as well.
Signed-off-by: Miek Gieben <miek@miek.nl>
* Complete full spec test case
Signed-off-by: Miek Gieben <miek@miek.nl>
* fix container log streaming for containers with TTY
---------
Signed-off-by: Miek Gieben <miek@miek.nl>
Co-authored-by: Pasha Sviderski <me@psviderski.name>
The community repository moved from debian.griffo.io to deb.griffo.io
(Debian trademark policy; old domain redirects permanently). Also use
the keyring + signed-by layout and add the missing sudo and apt update.
Pasha Sviderski