Use secrets in erb-evaluated accessory files

[cmatheson]

Given an accessory defined like:

accessories:
  myservice:
    image: some/image
    files:
      - config/needs.secrets.conf.erb:/service.conf

and a corresponding needs.secrets.conf.erb:

# i want to populate this secret value from my kamal secrets
secret = <%= ENV['secret'] %>

unfortunately, it seems that the secrets aren't available at erb-evaluation time. adding the needed secrets to the env config for the accessory doesn't affect the files/erb-evaluation stage either. is there any way to do what i'm trying to accomplish?

[nickhammond]

@cmatheson I think you just need a list of secrets for your accessory. The list of secrets specified will then get written to an env file on the server and used when the accessory is booted.

accessories:
  myservice:
    image: some/image
    env:
      secret:
        - secret
        - another_super_secret_thing
    files:
      - config/needs.secrets.conf.erb:/service.conf

And then you'll need to set the secret in .kamal/secrets however you'd like, static(don't commit to git) or from a password vault(commit to git).

[nickhammond]

@cmatheson If you run kamal secrets print does it output the correct secrets with the correct values?

[cmatheson]

@nickhammond yes, i do see the correct secrets/values when i run kamal secrets print

[nickhammond]

@cmatheson What is loading service.conf and what does that process look like? If you run a kamal accessory exec myservice printenv are you seeing the secrets?

[cmatheson]

Yeah, the secrets are actually available on the container. I think I haven't explained this well. the service in question is not able to read from the environment. What I would normally expect to do doesn't work. E.g.:

# DOESN'T WORK (this service can't read from environment variables)
secret = $SECRET

what i need to do is actually write the secret into the file before mounting it to the container. the erb would like:

secret = <%= ENV['SECRET'] %>

and the resulting file mounted in docker would be:

secret = sup3r.s3cr3t

does that make sense?

[nickhammond]

@cmatheson Ah, got it. What about overriding the accessory command to write the secrets to a file since they're available at the OS-level, something like cmd: echo "secret = $SECRET" > /service.conf && bin/run (bin/run is an example, not sure how the service boots since you haven't named it).

[dschaub]

Hi! I just wanted to 👍🏻 this request. For a concrete example, I'm running RabbitMQ as an accessory, and the SSL config requires a path to the private key. If secrets were available in ERB files, I could just have a private-key.pem.erb which does <%= ENV['RABBITMQ_TLS_PRIVATE_KEY'] %>. Much more convenient than creating a new Dockerfile or overriding the cmd, which could be brittle with upgrades to Rabbit.