Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Create secrets or configs from files already on remote #64

Closed
Zialus opened this issue Jan 2, 2021 · 7 comments · Fixed by #203
Closed

Create secrets or configs from files already on remote #64

Zialus opened this issue Jan 2, 2021 · 7 comments · Fixed by #203
Labels
docker-swarm Docker Swarm

Comments

@Zialus
Copy link

Zialus commented Jan 2, 2021

SUMMARY

Would it be possible to create secrets and/or configs from files already on the remote?
This would be specially useful for a GitOps workflow. One would use the git module to clone a repo with all the configs/secrets and use the docker_config/docker_secret module to add them to swarm.

ISSUE TYPE
  • Feature Idea
COMPONENT NAME
  • community.general.docker_secret
  • community.general.docker_config
ADDITIONAL INFORMATION

These are the current examples on the documentation

- name: Create secret foo (from a file on the control machine)
  community.general.docker_secret:
    name: foo
    # If the file is JSON or binary, Ansible might modify it (because
    # it is first decoded and later re-encoded). Base64-encoding the
    # file directly after reading it prevents this to happen.
    data: "{{ lookup('file', '/path/to/secret/file') | b64encode }}"
    data_is_b64: true
    state: present

- name: Create config foo (from a file on the control machine)
  community.general.docker_config:
    name: foo
    # If the file is JSON or binary, Ansible might modify it (because
    # it is first decoded and later re-encoded). Base64-encoding the
    # file directly after reading it prevents this to happen.
    data: "{{ lookup('file', '/path/to/config/file') | b64encode }}"
    data_is_b64: true
    state: present

Possibly a new flag could be added to indicate whether the source of the data is the machine running ansible or the target server.

@Zialus Zialus changed the title Create Secrets or configs from files already on remote Create secrets or configs from files already on remote Jan 2, 2021
@felixfontein
Copy link
Collaborator

What would make sense is add a data_src parameter, mutually exclusive with data, which allows to read from a file on the remote. Modules can only read data from the remote machine, not from the controller (only action plugins can do that), so a flag doesn't really make sense.

@Zialus
Copy link
Author

Zialus commented Jan 2, 2021

Sure, that would be great!

@WojciechowskiPiotr
Copy link
Collaborator

Why exclusive? The data points to file location, the data_src may get values local (by default) or remote depending on if the file is located on a local or remote host. But we need to exclude a situation where you connect to Docker Engine via API, not the local socket. In such a case, only the local value can be permitted.

@felixfontein
Copy link
Collaborator

@WojciechowskiPiotr data_src would be a path on the system where the module is executed (i.e. the remote host). The module cannot access files on the controller, except if it is executed there (or in case we add an accompanying action module - but I don't think that's necessary, since there's already a way more flexible mechanism when the data parameter is combined with lookups).

@felixfontein felixfontein added the docker-swarm Docker Swarm label Jan 2, 2021
@WojciechowskiPiotr
Copy link
Collaborator

Ok, I forgot we cannot send data to a remote host that way I wanted to send it :)

@felixfontein
Copy link
Collaborator

Yes, that requires an accompanying action plugin :) It's definitely possible to do that, but I don't think it's worth the effort here, since using lookups is a lot more flexible.

@felixfontein
Copy link
Collaborator

resolved_by_pr #203

Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
docker-swarm Docker Swarm
Projects
None yet
Development

Successfully merging a pull request may close this issue.

3 participants