This will make it possible to use docker secrets with stackstorm image.

[Smeds]

New version of previous remove pull-request

This pull request will make it possible to use docker secrets to mask user credentials when a container is created. To use the feature, just append "_FILE" to the regular environment variables and assign it the path where the secret is stored. It's a nice feature to have when using ansible-containers, since you then can use ansible vault to store credentials.

Follow the steps below to build stackstorm with docker secrets. I haven't changed the mongo credentials since I wasn't able to successfully change them using current docker compose file.

Howto use docker secrets

Step1: Create credentials

mkdir secrets
echo "rabbitmq" > secrets/rabbitmq_user.txt
echo "rabbitmq_pass" > secrets/rabbitmq_password.txt
echo "postgres" > secrets/postgres_user.txt
echo "postgres_pass" > secrets/postgres_password.txt
echo "redis_pass" > secrets/redis_password.txt
echo "st2admin" > secrets/stackstorm_user.txt
echo "stackstorm_password" > secrets/stackstorm_password.txt

Step2: Export variables

export RABBITMQ_DEFAULT_USER_FILE=/run/secrets/rabbitmq_secret_user
export RABBITMQ_DEFAULT_PASS_FILE=/run/secrets/rabbitmq_secret_pass
export POSTGRES_USER_FILE=/run/secrets/postgres_secret_user
export POSTGRES_PASSWORD_FILE=/run/secrets/postgres_secret_pass
export REDIS_PASSWORD_FILE=/run/secrets/redis_secret_pass
export ST2_USER_FILE=/run/secrets/stackstorm_secret_user
export ST2_PASSWORD_FILE=/run/secrets/stackstorm_secret_pass

Step3: Create env variables

make env

Step4: Build docker image

You need to build the image using the dockerfile found in this commit.

cd images/stackstorm
docker build . --tag stackstorm/stackstorm:latest

Step5: Run docker-compose

docker-compose -f docker-compose-with-secrets.yml up -d

Enter container and test stackstorm

docker exec -it stackstorm /bin/bash
st2ctl restart
st2 action list

[emptywee]

That (seems like) will break https://github.com/StackStorm/st2-docker/tree/master/runtime/kubernetes-1ppc stuff which is based heavily on env variables to setup components in the containers and will require most of the configuration part to be re-written.

[Smeds]

I will see if I can get access to a kubernetes environment to make the necessary updates for it to not break stuff

[dzimine]

Hi @Smeds
do you foresee any cycles on completing this?
Thanks much!

[Smeds]

Hi @dzimine

At the moment I haven't access to a kubernetes environment, which makes a bit hard for me to develop and test a solution right now. But we are planing of setting up one in the future, maybe within 6-12 month.