Add support for environmental secrets

podman_compose.py

@@ -544,24 +544,25 @@ def get_secret_args(compose, cnt, secret):
     dest_file = ""
     secret_opts = ""
 
-    target = None if is_str(secret) else secret.get("target", None)
-    uid = None if is_str(secret) else secret.get("uid", None)
-    gid = None if is_str(secret) else secret.get("gid", None)
-    mode = None if is_str(secret) else secret.get("mode", None)
+    secret_target = None if is_str(secret) else secret.get("target", None)
+    secret_uid = None if is_str(secret) else secret.get("uid", None)
+    secret_gid = None if is_str(secret) else secret.get("gid", None)
+    secret_mode = None if is_str(secret) else secret.get("mode", None)
+    secret_type = None if is_str(secret) else secret.get("type", None)
 
     if source_file:
-        if not target:
-            dest_file = f"/run/secrets/{secret_name}"
-        elif not target.startswith("/"):
-            sec = target if target else secret_name
+        if not secret_target:
+            dest_file = "/run/secrets/{}".format(secret_name)
+        elif not secret_target.startswith("/"):
+            sec = secret_target if secret_target else secret_name
             dest_file = f"/run/secrets/{sec}"
         else:
-            dest_file = target
+            dest_file = secret_target
         basedir = compose.dirname
         source_file = os.path.realpath(os.path.join(basedir, os.path.expanduser(source_file)))
         volume_ref = ["--volume", f"{source_file}:{dest_file}:ro,rprivate,rbind"]
-        if uid or gid or mode:
-            sec = target if target else secret_name
+        if secret_uid or secret_gid or secret_mode:
+            sec = secret_target if secret_target else secret_name
             log(
                 f'WARNING: Service {cnt["_service"]} uses secret "{sec}" with uid, gid, or mode.'
                 + " These fields are not supported by this implementation of the Compose file"
@@ -575,10 +576,12 @@ def get_secret_args(compose, cnt, secret):
     # podman-create commands, albeit we can only support a 1:1 mapping
     # at the moment
     if declared_secret.get("external", False) or declared_secret.get("name", None):
-        secret_opts += f",uid={uid}" if uid else ""
-        secret_opts += f",gid={gid}" if gid else ""
-        secret_opts += f",mode={mode}" if mode else ""
-        # The target option is only valid for type=env,
+        secret_opts += f",uid={secret_uid}" if secret_uid else ""
+        secret_opts += f",gid={secret_gid}" if secret_gid else ""
+        secret_opts += f",mode={secret_mode}" if secret_mode else ""
+        secret_opts += f",type={secret_type}" if secret_type else ""
+        secret_opts += f",target={secret_target}" if secret_target and secret_type == "env" else ""
+        # The secret_target option is only valid for type=env,
         # which in an ideal world would work
         # for type=mount as well.
         # having a custom name for the external secret
@@ -587,12 +590,12 @@ def get_secret_args(compose, cnt, secret):
         err_str = 'ERROR: Custom name/target reference "{}" for mounted external secret "{}" is not supported'
         if ext_name and ext_name != secret_name:
             raise ValueError(err_str.format(secret_name, ext_name))
-        if target and target != secret_name:
-            raise ValueError(err_str.format(target, secret_name))
-        if target:
+        if secret_target and secret_target != secret_name and secret_type != 'env':
+            raise ValueError(err_str.format(secret_target, secret_name))
+        if secret_target and secret_type != 'env':
             log(
                 'WARNING: Service "{}" uses target: "{}" for secret: "{}".'.format(
-                    cnt["_service"], target, secret_name
+                    cnt["_service"], secret_target, secret_name
                 )
                 + " That is un-supported and a no-op and is ignored."
             )

tests/secrets/docker-compose.yaml

@@ -31,6 +31,9 @@ services:
           uid: '103'
           gid: '103'
           mode: 400
+        - source: my_secret
+          target: ENV_SECRET
+          type: env
 
 secrets:
   my_secret:
@@ -43,4 +46,3 @@ secrets:
     name: my_secret_3
   file_secret:
     file: ./my_secret
-

tests/secrets/print_secrets.sh

@@ -4,3 +4,4 @@ ls -la /run/secrets/*
 ls -la /etc/custom_location
 cat /run/secrets/*
 cat /etc/custom_location
+env | grep SECRET