3 people 8ddbe3c606 fix(compose): strip and resolve pre-deploy hook secrets like service env (#424) ...

* fix(compose): strip and resolve pre-deploy hook secrets like service env (fixes #422)

normaliseContainerForStore only cleared Config.Env and
ServiceSpec.Container.Env before writing a container record to the
replicated Corrosion store, leaving ServiceSpec.PreDeploy.Env in place.
A secret set via x-pre_deploy.environment therefore replicated to
every machine in the cluster, unlike the same value set via
environment.

ResolveSecrets had the same asymmetry in the other direction: it only
resolved secret://name references in service.Environment, so a
reference placed in the pre-deploy hook's environment passed through
unresolved as a literal string. HasCommandSecretRefs is extended the
same way for consistency.

Add tests pinning both behaviours.

* update docs that secret references are available for pre-deploy hooks

---------

Co-authored-by: Pasha Sviderski <me@psviderski.name>

2026-10-12 15:48:47 +10:00

..

container_test.go

fix(compose): strip and resolve pre-deploy hook secrets like service env (#424)

2026-10-12 15:48:47 +10:00

container.go

fix(compose): strip and resolve pre-deploy hook secrets like service env (#424)

2026-10-12 15:48:47 +10:00

db

sync new and updated containers to cluster store, no deletion yet

2024-11-19 16:06:16 +10:00

keyspace.go

feat(caddystorage): generic namespace-scoped key-value storage using cluster table in Corrosion

2026-09-04 10:50:30 +10:00

replication.go

feat(store): improve waiting for store replication to skip unavailable members

2026-10-01 20:59:15 +10:00

schema.sql

feat: add created_at/updated_at columns to cluster and machines store tables

2026-05-26 10:07:12 +10:00

store.go

feat(store): improve waiting for store replication to skip unavailable members

2026-10-01 20:59:15 +10:00