diff --git a/podman_compose.py b/podman_compose.py index e41008a8..e5d8a8e4 100755 --- a/podman_compose.py +++ b/podman_compose.py @@ -544,24 +544,25 @@ def get_secret_args(compose, cnt, secret): dest_file = "" secret_opts = "" - target = None if is_str(secret) else secret.get("target", None) - uid = None if is_str(secret) else secret.get("uid", None) - gid = None if is_str(secret) else secret.get("gid", None) - mode = None if is_str(secret) else secret.get("mode", None) + secret_target = None if is_str(secret) else secret.get("target", None) + secret_uid = None if is_str(secret) else secret.get("uid", None) + secret_gid = None if is_str(secret) else secret.get("gid", None) + secret_mode = None if is_str(secret) else secret.get("mode", None) + secret_type = None if is_str(secret) else secret.get("type", None) if source_file: - if not target: - dest_file = f"/run/secrets/{secret_name}" - elif not target.startswith("/"): - sec = target if target else secret_name + if not secret_target: + dest_file = "/run/secrets/{}".format(secret_name) + elif not secret_target.startswith("/"): + sec = secret_target if secret_target else secret_name dest_file = f"/run/secrets/{sec}" else: - dest_file = target + dest_file = secret_target basedir = compose.dirname source_file = os.path.realpath(os.path.join(basedir, os.path.expanduser(source_file))) volume_ref = ["--volume", f"{source_file}:{dest_file}:ro,rprivate,rbind"] - if uid or gid or mode: - sec = target if target else secret_name + if secret_uid or secret_gid or secret_mode: + sec = secret_target if secret_target else secret_name log( f'WARNING: Service {cnt["_service"]} uses secret "{sec}" with uid, gid, or mode.' + " These fields are not supported by this implementation of the Compose file" @@ -575,10 +576,12 @@ def get_secret_args(compose, cnt, secret): # podman-create commands, albeit we can only support a 1:1 mapping # at the moment if declared_secret.get("external", False) or declared_secret.get("name", None): - secret_opts += f",uid={uid}" if uid else "" - secret_opts += f",gid={gid}" if gid else "" - secret_opts += f",mode={mode}" if mode else "" - # The target option is only valid for type=env, + secret_opts += f",uid={secret_uid}" if secret_uid else "" + secret_opts += f",gid={secret_gid}" if secret_gid else "" + secret_opts += f",mode={secret_mode}" if secret_mode else "" + secret_opts += f",type={secret_type}" if secret_type else "" + secret_opts += f",target={secret_target}" if secret_target and secret_type == "env" else "" + # The secret_target option is only valid for type=env, # which in an ideal world would work # for type=mount as well. # having a custom name for the external secret @@ -587,12 +590,12 @@ def get_secret_args(compose, cnt, secret): err_str = 'ERROR: Custom name/target reference "{}" for mounted external secret "{}" is not supported' if ext_name and ext_name != secret_name: raise ValueError(err_str.format(secret_name, ext_name)) - if target and target != secret_name: - raise ValueError(err_str.format(target, secret_name)) - if target: + if secret_target and secret_target != secret_name and secret_type != 'env': + raise ValueError(err_str.format(secret_target, secret_name)) + if secret_target and secret_type != 'env': log( 'WARNING: Service "{}" uses target: "{}" for secret: "{}".'.format( - cnt["_service"], target, secret_name + cnt["_service"], secret_target, secret_name ) + " That is un-supported and a no-op and is ignored." ) diff --git a/tests/secrets/docker-compose.yaml b/tests/secrets/docker-compose.yaml index 735746a6..81bde0f2 100644 --- a/tests/secrets/docker-compose.yaml +++ b/tests/secrets/docker-compose.yaml @@ -31,6 +31,9 @@ services: uid: '103' gid: '103' mode: 400 + - source: my_secret + target: ENV_SECRET + type: env secrets: my_secret: @@ -43,4 +46,3 @@ secrets: name: my_secret_3 file_secret: file: ./my_secret - diff --git a/tests/secrets/print_secrets.sh b/tests/secrets/print_secrets.sh index 7115716f..695749c5 100755 --- a/tests/secrets/print_secrets.sh +++ b/tests/secrets/print_secrets.sh @@ -4,3 +4,4 @@ ls -la /run/secrets/* ls -la /etc/custom_location cat /run/secrets/* cat /etc/custom_location +env | grep SECRET