CODEWITHSUNDEEP
environment-variablescontainerskeypodman
BlueCacti
BlueCacti

Reputation: 10850

Podman - generate ENV vars with secrets from file

Podman allows the use of a secret. This allows you to pass sensitive values, like credentials or API keys, to a container while running it, but excludes them from commits or exports.

So far I've been using the following format to include a config file with credentials as a secret config file within the container.

podman secret create my_creds /path/to/my/credfile.txt
podman run ... --secret=my_creds,mode=0400 ... container --credentials /run/secrets/my_creds

But now I'm confronted with a container that forces me to either include the credentials in a big config file (which I don't want to fully store in a secret) or via environment variables.

Podman does have an option to import secrets into a container as environment variables. However, the list of credentials I need to import is quite large, so I'd need to add quite a lot of lines creating secrets in my service file.

So my question now is: is there a way to take a file containing secrets stored as KEY=VALUE and import each line as a secret env variable in a podman container?

EDIT:

Currently I hacked together the following solution

ExecStartPre=-for l in $(cat /path/to/my/credfile.txt); do \
              echo $l | cut -d'=' -f 2 | /usr/bin/podman secret create $(echo $l | cut -d'=' -f 1 -) -; done


ExecStopPost=-for l in $(cat /path/to/my/credfile.txt); do \
              /usr/bin/podman secret rm $(echo $l | cut -d'=' -f 1 -); done

I still need to manually add all the --secret=SECRET_NAME,type=env params.

Upvotes: 1

Views: 1903

Answers (1)

d03j
d03j

Reputation: 1

If you name your secrets file .env and use podman-compose instead of podman run, you should be able to use any KEY from KEY=VALUE in the .env file as an environment variable.

I tested this a while back and it worked.

you can also do something like:

#!/bin/bash

ENVFILE=/my_path/.env

. $ENVFILE

podman run --replace --name=myap -d \
  -e MYAPP_VAR1=$KEY1 \
  -v $KEY2/file1:/file1:ro \
  -v $KEY2/dir1:/dir1:ro \
  --net $NETWORKSTRING \
  -p 1080:80 \
  -p 1443:443 \
  docker.io/image_name:latest

I haven't tried quadlets yet but you should also be able to take a similar approach using EnvironmentFile=.

Upvotes: 0

Related Questions