Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Load drone server settings from file #2223

Closed
marcbachmann opened this issue Sep 16, 2017 · 10 comments
Closed

Load drone server settings from file #2223

marcbachmann opened this issue Sep 16, 2017 · 10 comments

Comments

@marcbachmann
Copy link

marcbachmann commented Sep 16, 2017 •
edited
Loading

Currently the only way to pass secrets to drone is to use environment variables.
When you run drone in docker, this enforces you to define them in a config file, which is basically visible to everybody who has access to the orchestration platform where drone runs on.

Within the last year Docker and Kubernetes improved the configuration management of secrets and implemented a similar solution to use them inside containers/pods.
When you define a secret in a service resource file, that secret is then mounted into the container as a file you can use in your application.

To improve the security, Drone should provide an option to read such a file instead of using environment variables. It's common in docker that you point to such a secret file using an environment variable postfixed with _FILE.

The variables that are affected by such a change are the following ones:

DRONE_AGENT_SECRET > DRONE_AGENT_SECRET_FILE
DRONE_GITHUB_SECRET >  > DRONE_GITHUB_SECRET_FILE
DRONE_BITBUCKET_SECRET > DRONE_BITBUCKET_SECRET_FILE
DRONE_GITLAB_SECRET > DRONE_GITLAB_SECRET_FILE
DRONE_CODING_SECRET > DRONE_CODING_SECRET_FILE
DRONE_DATABASE_DATASOURCE > DRONE_DATABASE_DATASOURCE_FILE

Here are also some references to read about that docker/kubernetes feature.
https://kubernetes.io/docs/concepts/configuration/secret/#using-secrets-as-files-from-a-pod
https://docs.docker.com/engine/swarm/secrets/#how-docker-manages-secrets
http://rancher.com/docs/rancher/v1.4/en/cattle/secrets/#docker-hub-images

I'm sorry if this issue is a duplicate. I couldn't find any issue that discussed that topic.
@gtaylor
Copy link

gtaylor commented Sep 16, 2017

When you define a secret in a service resource file, that secret is then mounted into the container as a file you can use in your application.

FWIW, you can mount a Kubernetes Secret as an env var without its value being visible to everyone. If that is your only concern, no change in Drone is needed.

@bradrydzewski
Copy link

bradrydzewski commented Sep 16, 2017 •
edited
Loading

@marcbachmann I issued a pull request to the library we use to read configuration parameters to optionally source values from file. The pull request has stalled and unfortunately I haven't had time to push it across the finish line.

I would LOVE for someone to pick this up and push it though. Relevant issue urfave/cli#613 and pull request urfave/cli#614

@so0k
Copy link

so0k commented Sep 24, 2017 •
edited
Loading

today - wouldn't it be up to drone to use altsrc package as described here - https://github.com/urfave/cli#values-from-alternate-input-sources-yaml-toml-and-others ?

@bradrydzewski
Copy link

actually, drone does support loading variables from a .env file in the working directory. So you could mount a .env file into to container at /.env and drone would read parameters from this file.

@bauer01 bauer01 mentioned this issue Oct 22, 2017
Open
@gesellix
Copy link

With urfave/cli#675 being merged, I would love to see secrets in files being implemented in Drone. I'd also be willing to pick this up and submit a PR, but I'd probably need some code pointers where to find the relevant places I'd have to change.

@gesellix gesellix mentioned this issue Jan 21, 2018
Closed
@mjpvandenberg
Copy link

@bradrydzewski could you expand on that please? How do I get the variables defined in an .env file to available as environment variables during the pipeline run?

@bradrydzewski
Copy link

@mjpvandenberg this issue is about loading drone server settings (eg your github client id and secret and database credentials). It is not for loading pipeline secrets. If you want to load pipeline secrets from a file, and propagate to your build, you want to use the global secrets file http://docs.drone.io/setup-global-secrets/

@bradrydzewski bradrydzewski changed the title Load drone server secrets from file Load drone server settings from file Jan 30, 2018
@mjpvandenberg
Copy link

That seems to be Enterprise Edition-only. For non-EE, I found a workable solution is to mount a volume with a .sh file with a bunch of export statements and then, in the first task in the pipeline step, . that file.

@tboerger
Copy link

@mjpvandenberg or if you are using it for a company just buy the enterprise license and support the drone development.

@bradrydzewski bradrydzewski mentioned this issue Mar 6, 2018
Closed
@clem109 clem109 mentioned this issue May 3, 2018
Closed
@bradrydzewski bradrydzewski added this to the v1.0.0 milestone Jul 30, 2018
@bradrydzewski bradrydzewski mentioned this issue Oct 11, 2018
Closed
@bradrydzewski bradrydzewski removed this from the v1.0.0 milestone Apr 9, 2019
@bradrydzewski
Copy link

you can now use docker run drone/drone --env-file /run/secrets/drone.conf to load an environment file, which should work with docker secrets.

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Assignees
No one assigned
Labels
None yet
Projects
None yet
Milestone
No milestone
Development

No branches or pull requests
7 participants
@gtaylor @tboerger @marcbachmann @gesellix @bradrydzewski @so0k @mjpvandenberg