Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Support _FILE suffixed env vars in Docker entrypoint #47573

Merged
merged 21 commits into from
Nov 12, 2019
Merged

Support _FILE suffixed env vars in Docker entrypoint #47573

Changes from 2 commits
Commits
Show all changes
21 commits
Select commit Hold shift + click to select a range
05a0133
Support ELASTIC_PASSWORD_FILE in Docker entrypoint
pugnascotia Oct 2, 2019
65974f9
Support all envs vars with a _FILE suffix
pugnascotia Oct 2, 2019
2b90d97
Include _FILE names when checking files in Docker
pugnascotia Oct 8, 2019
1f03dad
Merge remote-tracking branch 'upstream/master' into 43603-docker-entr…
pugnascotia Oct 8, 2019
7e361ff
Trying to write tests
pugnascotia Oct 9, 2019
64175d2
Fix up new Docker test
pugnascotia Oct 9, 2019
9b940cf
Revert accidental changes
pugnascotia Oct 9, 2019
7ca020c
Tweaks
pugnascotia Oct 9, 2019
21c1104
Merge remote-tracking branch 'upstream/master' into 43603-docker-entr…
pugnascotia Nov 5, 2019
e564576
Post-merge fixes
pugnascotia Nov 5, 2019
6f1cf82
Check env var file permissions
pugnascotia Nov 5, 2019
8562703
Capture more logging on failure
pugnascotia Nov 6, 2019
7f616bd
Split env var file tests
pugnascotia Nov 8, 2019
0162ef2
Merge remote-tracking branch 'upstream/master' into 43603-docker-entr…
pugnascotia Nov 10, 2019
052d46f
Merge remote-tracking branch 'upstream/master' into 43603-docker-entr…
pugnascotia Nov 11, 2019
ebce9ef
Address review feedback
pugnascotia Nov 11, 2019
4054f2d
Tighter checks for _FILE vs regular vars
pugnascotia Nov 11, 2019
0a07f70
Update docs for _FILE variables
pugnascotia Nov 11, 2019
2a48087
Docs tweaks
pugnascotia Nov 11, 2019
3a778a7
Address further docs review feedback
pugnascotia Nov 12, 2019
4ac0a9e
Merge remote-tracking branch 'upstream/master' into 43603-docker-entr…
pugnascotia Nov 12, 2019
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
32 changes: 32 additions & 0 deletions distribution/docker/src/docker/bin/docker-entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -38,6 +38,38 @@ if [[ "$1" != "eswrapper" ]]; then
fi
fi

# Allow environment variables to be set by creating a file with the
# contents, and setting an environment variable with the suffix _FILE to
# point to it. This can be used to provide secrets to a container, without
# the values being specified explicitly when running the container.
for VAR_NAME_FILE in $(env | cut -f1 -d= | grep '_FILE$'); do
if [[ -n "$VAR_NAME_FILE" ]]; then
VAR_NAME="${VAR_NAME_FILE%_FILE}"

if [[ -n "${!VAR_NAME}" ]]; then
echo "ERROR: Both $VAR_NAME_FILE and $VAR_NAME are set. These are mutually exclusive." >&2
dliappis marked this conversation as resolved.
Show resolved Hide resolved
exit 1
fi

if [[ ! -e "${!VAR_NAME_FILE}" ]]; then
echo "ERROR: File ${!VAR_NAME_FILE} does not exist" >&2
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

May be worth extending the message to also include the variable name pointing to that file

exit 1
fi

if [[ ! -r "${!VAR_NAME_FILE}" ]]; then
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Might be worth combining the checks on permissions into a single one.
We could get into the situation when we tell the user it's not readable, then we tell him it's too broadly readable.

echo "ERROR: File ${!VAR_NAME_FILE} is not readable" >&2
exit 1
fi

echo "Setting $VAR_NAME from ${!VAR_NAME_FILE}" >&2
export "$VAR_NAME"="$(cat ${!VAR_NAME_FILE})"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Should we be stripping a possible newline at the end of the file here ?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

The newline is already stripped thanks to bash. An earlier implementation read the file without using cat, but didn't strip the newline.


unset VAR_NAME
# Unset the suffixed environment variable
unset "$VAR_NAME_FILE"
fi
done

# Parse Docker env vars to customize Elasticsearch
#
# e.g. Setting the env var cluster.name=testcluster
Expand Down