on_container 0.0.11 → 0.0.12

checksums.yaml

@@ -1,7 +1,7 @@
 ---
 SHA256:
-  metadata.gz: 819d1f5a057f277e3b816eedd99435c9816b6d1ec6ff2e79e2d90798b5b74648
-  data.tar.gz: 163f0552ec15c2b0199934ec81313d8708877339e20504c427f270e228ecc94b
+  metadata.gz: cc7ffb417b7d418f2415df1cd5c6cbd0325d78e576e71a701010bd44ead098f6
+  data.tar.gz: 260e06a5fa81789bc977cac9b02c8e092100a0896d9eccc4c4f88423592a1f9d
 SHA512:
-  metadata.gz: 16c10e11aa18e20cd8fb02ee53018f5477c1ec661ef6c43329b6c0a74814d0bb7b00f785c9966f2006670e0c73858c36d719ff5177ece9b35fb54fbc33743808
-  data.tar.gz: 900379b6246d9d44f301a81213e965feec8cb1235bd514fc9235b3e5fd5dc97b5f91399f25b18ac7efd0596e9a15e878766f85726e98040b30a688e80f0519db
+  metadata.gz: 9e54869d4ec1c390a555731ac199ece8b804098eece937321123e48884d0b7fa0dff418147f97e811b4e05fb23517f433bf622b08fc4f4941d04801fa31f8570
+  data.tar.gz: 410eb4b5c14a632600ecccade83dcca9764965085dfa95177976365bc762516ac36e8d6ec70cdd51925d9204c19652afe80c50887774b67ffbe0990c9edeb18b

data/lib/on_container/load_env_secrets.rb

@@ -1,58 +1,12 @@
 # frozen_string_literal: true
 
-# Reads the specified secret paths (i.e. Docker Secrets) into environment
-# variables:
-
-require 'active_support'
-require 'active_support/core_ext/object'
-
-# Load secrets from Google Cloud Secret Manager to ENV, if any:
-require 'on_container/secrets/google_cloud/env_loader'
-OnContainer::Secrets::GoogleCloud::EnvLoader.perform!
-
-# Process only a known list of env vars that can filled by reading a file (i.e.
-# a docker secret):
-Dir["#{ENV.fetch('SECRETS_PATH', '/run/secrets')}/**/*"].map do |path|
-  Pathname.new(path)
-end.select(&:file?).each do |secret_filepath|
-  secret_envvarname = secret_filepath.basename('.*').to_s.upcase
-
-  # Skip if variable is already set - already-set variables have precedence over
-  # the secret files:
-  next if ENV.key?(secret_envvarname) && ENV[secret_envvarname].present?
-
-  ENV[secret_envvarname] = File.read(secret_filepath).strip
-end
-
-# For each *_URL environment variable where there's also a *_(USER|USERNAME) or
-# *_(PASS|PASSWORD), update the URL environment variable with the given
-# credentials. For example:
+# This script achieves a list of secret loading & processing:
 #
-# DATABASE_URL: postgres://postgres:5432/demo_production
-# DATABASE_USERNAME: lalito
-# DATABASE_PASSWORD: lepass
+# 1. Loads secrets from Google Cloud Secret Manager to ENV, if configured.
+# 2. Reads files in a configured Folder, and loads them into ENV variables.
+# 3. Processes "*_URL" env vars, adding their respective "*_USER" and "*_PASS".
 #
-# Results in the following updated DATABASE_URL:
-#  DATABASE_URL = postgres://lalito:lepass@postgres:5432/demo_production
-require 'uri' if (url_keys = ENV.keys.select { |key| key =~ /_URL/ }).any?
-
-url_keys.each do |url_key|
-  credential_pattern_string = url_key.gsub('_URL', '_(USER(NAME)?|PASS(WORD)?)')
-  credential_pattern = Regexp.new "\\A#{credential_pattern_string}\\z"
-  credential_keys = ENV.keys.select { |key| key =~ credential_pattern }
-  next unless credential_keys.any?
-
-  uri = URI(ENV[url_key])
-
-  credential_keys.each do |credential_key|
-    credential_value = URI.encode_www_form_component ENV[credential_key]
-    case credential_key
-    when /USER/ then uri.user = credential_value
-    when /PASS/ then uri.password = credential_value
-    end
-  end
-
-  ENV[url_key] = uri.to_s
-end
+# - See https://github.com/IcaliaLabs/on-container-for-ruby#loading-secrets-into-environment-variables
 
-# STDERR.puts ENV.inspect
+require 'on_container/secrets/env_loader'
+OnContainer::Secrets::EnvLoader.perform!

data/lib/on_container/secrets/env_loader.rb

@@ -0,0 +1,43 @@
+# frozen_string_literal: true
+
+require 'on_container/common/safe_performable'
+require 'on_container/secrets/google_cloud/env_loader'
+require 'on_container/secrets/mounted_files/env_loader'
+require 'on_container/secrets/url_variable_processor'
+
+module OnContainer
+  module Secrets
+    #= EnvLoader
+    #
+    # Reads the specified secret paths (i.e. Docker Secrets) into environment
+    # variables:
+    class EnvLoader
+      include OnContainer::Common::SafePerformable
+
+      def perform!
+        load_secrets_from_google_cloud if google_cloud_secrets?
+        load_secrets_from_mounted_files
+        process_url_variables
+        true
+      end
+
+      private
+
+      def google_cloud_secrets?
+        OnContainer::Secrets::GoogleCloud::EnvLoader.secret_manager?
+      end
+
+      def load_secrets_from_google_cloud
+        OnContainer::Secrets::GoogleCloud::EnvLoader.perform!
+      end
+
+      def load_secrets_from_mounted_files
+        OnContainer::Secrets::MountedFiles::EnvLoader.perform!
+      end
+
+      def process_url_variables
+        OnContainer::Secrets::UrlVariableProcessor.perform!
+      end
+    end
+  end
+end

data/lib/on_container/secrets/google_cloud/env_loader.rb

@@ -17,9 +17,13 @@ module OnContainer
         def env_keys?
           env_keys.any?
         end
+
+        def self.secret_manager?
+          defined?(Google::Cloud::SecretManager) == 'constant'
+        end
     
         def secret_manager?
-          defined?(Google::Cloud::SecretManager) == 'constant'
+          self.class.secret_manager?
         end
     
         def perform!
@@ -34,4 +38,4 @@ module OnContainer
       end
     end
   end
-end
+end

data/lib/on_container/secrets/mounted_files/env_loader.rb

@@ -0,0 +1,58 @@
+# frozen_string_literal: true
+
+require 'active_support'
+require 'active_support/core_ext/object'
+require 'on_container/common/safe_performable'
+
+module OnContainer
+  module Secrets
+    module MountedFiles
+      class EnvLoader
+        include OnContainer::Common::SafePerformable
+
+        def perform!
+          setup_secrets_path
+          scan_secrets_path_for_files
+          load_secret_files_to_env_vars
+        end
+
+        def secrets_path
+          @secrets_path ||= ENV.fetch('SECRETS_PATH', '/run/secrets')
+        end
+
+        def secret_mounted_file_paths
+          @secret_mounted_file_paths ||= Dir["#{secrets_path}/**/*"]
+            .map { |path| Pathname.new(path) }
+            .select(&:file?)
+        end
+
+        private
+
+        alias setup_secrets_path secrets_path
+        alias scan_secrets_path_for_files secret_mounted_file_paths
+
+        def load_secret_files_to_env_vars
+          return if @already_loaded
+
+          secret_mounted_file_paths
+            .each { |file_path| load_secret_file_to_env_var(file_path) }
+
+          @already_loaded = true
+        end
+
+        def load_secret_file_to_env_var(file_path)
+          env_var_name = file_path.basename('.*').to_s.upcase
+
+          # Skip if variable is already set - already-set variables have
+          # precedence over the secret files:
+          return if ENV.key?(env_var_name) && ENV[env_var_name].present?
+
+          contents = file_path.read.strip
+
+          # TODO: Do not load if content has null bytes
+          ENV[env_var_name] = file_path.read.strip
+        end
+      end
+    end
+  end
+end

data/lib/on_container/secrets/url_variable_processor.rb

@@ -0,0 +1,71 @@
+# frozen_string_literal: true
+
+require 'on_container/common/safe_performable'
+
+module OnContainer
+  module Secrets
+    #= UrlVariableProcessor
+    #
+    # For each *_URL environment variable where there's also a *_(USER|USERNAME)
+    # or *_(PASS|PASSWORD), updates the URL environment variable with the given
+    # credentials. For example:
+    #
+    # DATABASE_URL: postgres://postgres:5432/demo_production
+    # DATABASE_USERNAME: lalito
+    # DATABASE_PASSWORD: lepass
+    #
+    # Results in the following updated DATABASE_URL:
+    #  DATABASE_URL = postgres://lalito:lepass@postgres:5432/demo_production
+    class UrlVariableProcessor
+      include OnContainer::Common::SafePerformable
+
+      def perform!
+        require_uri_module if url_keys?
+        process_credential_keys
+      end
+
+      def url_keys
+        @url_keys ||= ENV.keys.select { |key| key =~ /_URL/ }
+      end
+
+      def url_keys?
+        url_keys.any?
+      end
+      
+      private
+
+      def process_credential_keys
+        url_keys.each { |url_key| process_credential_keys_for(url_key) }
+      end
+
+      def require_uri_module
+        require 'uri'
+      end
+
+      def credential_keys_for(url_key)
+        credential_pattern_string = url_key
+          .gsub('_URL', '_(USER(NAME)?|PASS(WORD)?)')
+
+        credential_pattern = Regexp.new "\\A#{credential_pattern_string}\\z"
+        ENV.keys.select { |key| key =~ credential_pattern }
+      end
+
+      def process_credential_keys_for(url_key)
+        return unless (credential_keys = credential_keys_for(url_key)).any?
+
+        uri = URI(ENV[url_key])
+
+        # Reverse sorting will place "*_USER" before "*_PASS":
+        credential_keys.sort.reverse.each do |credential_key|
+          credential_value = URI.encode_www_form_component ENV[credential_key]
+          case credential_key
+          when /USER/ then uri.user = credential_value
+          when /PASS/ then uri.password = credential_value
+          end
+        end
+
+        ENV[url_key] = uri.to_s
+      end
+    end
+  end
+end

data/lib/on_container/version.rb

@@ -1,5 +1,5 @@
 # frozen_string_literal: true
 
 module OnContainer
-  VERSION = '0.0.11'
+  VERSION = '0.0.12'
 end

data/on_container.gemspec

@@ -24,5 +24,6 @@ Gem::Specification.new do |spec|
   spec.bindir        = 'exe'
   spec.require_paths = ['lib']
 
+  spec.add_runtime_dependency 'activesupport', '>= 4'
   spec.add_development_dependency 'bundler', '~> 2.1'
 end

metadata

@@ -1,7 +1,7 @@
 --- !ruby/object:Gem::Specification
 name: on_container
 version: !ruby/object:Gem::Version
-  version: 0.0.11
+  version: 0.0.12
 platform: ruby
 authors:
 - Roberto Quintanilla
@@ -10,6 +10,20 @@ bindir: exe
 cert_chain: []
 date: 2021-02-23 00:00:00.000000000 Z
 dependencies:
+- !ruby/object:Gem::Dependency
+  name: activesupport
+  requirement: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '4'
+  type: :runtime
+  prerelease: false
+  version_requirements: !ruby/object:Gem::Requirement
+    requirements:
+    - - ">="
+      - !ruby/object:Gem::Version
+        version: '4'
 - !ruby/object:Gem::Dependency
   name: bundler
   requirement: !ruby/object:Gem::Requirement
@@ -49,9 +63,12 @@ files:
 - lib/on_container/dev/setup_ops.rb
 - lib/on_container/load_env_secrets.rb
 - lib/on_container/ops/service_connection_checks.rb
+- lib/on_container/secrets/env_loader.rb
 - lib/on_container/secrets/google_cloud/env_loader.rb
 - lib/on_container/secrets/google_cloud/fetcher.rb
 - lib/on_container/secrets/google_cloud/service_base.rb
+- lib/on_container/secrets/mounted_files/env_loader.rb
+- lib/on_container/secrets/url_variable_processor.rb
 - lib/on_container/version.rb
 - on_container.gemspec
 homepage: https://github.com/IcaliaLabs/on-container-for-ruby