Conversation
186f6f2 to
13ca7bd
Compare
|
This looks very useful. I've been using |
|
I'm not super familiar but it seems like |
|
@zzak I can make a PR to add an adapter in kamal, but I would still need the Maybe I can remove the comments in |
|
I'm not sure but if new apps are using that why can't old ones? Maybe I'm missing something. |
|
@zzak I believe Kamal secrets fetches a secrets from passeord managers like 1password/Bitwarden. There's no specific Rails support. |
|
This is really clever. I like the concept that for some apps, they can just use rails credentials. We should add that as an example in the default .kamal/secrets file that we generate. cc @djmb |
byroot
left a comment
There was a problem hiding this comment.
There's some work needed, but I'll take care of it.
| load_environment_config! | ||
|
|
||
| if (yaml = credentials.read) | ||
| YAML.load(yaml).dig(*path.split("/")).tap do |value| |
There was a problem hiding this comment.
We should return an error if the key is missing. Also I think . is much more logical to nagigate than /.
| say value.to_s | ||
| end | ||
| else | ||
| say missing_credentials_message |
There was a problem hiding this comment.
| say missing_credentials_message | |
| say_error missing_credentials_message |
Error message should go on stderr, not stdout, it also should exit with non zero status code, otherwise this is very hard to use in a script.
```bash $ bin/rails credentials:fetch kamal_registry/password ``` Co-Authored-By: Jean Boussier <jean.boussier@gmail.com>
2645f1b to
ccf22d6
Compare
|
I noticed the default kamal/secrets file never got this added as an example. I skimmed the open PRs and did not see one there. This is the current status of the secrets template: https://github.com/basecamp/kamal/blob/4b88852aea58bf94009a6d854afdc630a5c111b5/lib/kamal/cli/templates/secrets#L4 |
This was [recently introduced in Rails][1] and it's worth teaching this new concept. [1]: rails/rails#53119
Motivation / Background
With Kamal 2, secrets are now stored in
.kamal/secrets. We are expected to use a 3rd party password manager such as1passwordto fetch secrets such asKAMAL_REGISTRY_PASSWORD.eg.
KAMAL_REGISTRY_PASSWORD=$(kamal secrets extract KAMAL_REGISTRY_PASSWORD ${SECRETS})I think it would be interesting to be able to fetch the password directly from Rails credentials.
eg.
KAMAL_REGISTRY_PASSWORD=$(bin/rails credentials:fetch kamal_registry/password)In order to allow it, I introduce the new command
credentials:fetch.Detail
Usage:
bin/rails credentials:fetch kamal_registry/password # abcd1234Additional information
Checklist
Before submitting the PR make sure the following are checked:
[Fix #issue-number]