Conversation
|
I know that Gemfile.lock is what we really care about, but is it ok to leave |
|
@yselkowitz PTAL. |
|
|
There was a problem hiding this comment.
See the specific comments wrt multi-arch. But is this compatible with ruby 2.y? I'm seeing the following with s2i (after fixing nokogiri and mini_portile2 as noted):
LoadError: cannot load such file -- bundler/setup
/opt/app-root/src/config/boot.rb:3:in `require'
/opt/app-root/src/config/boot.rb:3:in `<top (required)>'
/opt/app-root/src/config/application.rb:1:in `require_relative'
/opt/app-root/src/config/application.rb:1:in `<top (required)>'
/opt/app-root/src/Rakefile:4:in `require_relative'
/opt/app-root/src/Rakefile:4:in `<top (required)>'
/opt/app-root/src/bundle/ruby/2.7.0/gems/rake-13.0.3/exe/rake:27:in `<top (required)>'
/usr/share/gems/gems/bundler-2.1.4/lib/bundler/cli/exec.rb:63:in `load'
/usr/share/gems/gems/bundler-2.1.4/lib/bundler/cli/exec.rb:63:in `kernel_load'
/usr/share/gems/gems/bundler-2.1.4/lib/bundler/cli/exec.rb:28:in `run'
/usr/share/gems/gems/bundler-2.1.4/lib/bundler/cli.rb:476:in `exec'
/usr/share/gems/gems/bundler-2.1.4/lib/bundler/vendor/thor/lib/thor/command.rb:27:in `run'
/usr/share/gems/gems/bundler-2.1.4/lib/bundler/vendor/thor/lib/thor/invocation.rb:127:in `invoke_command'
/usr/share/gems/gems/bundler-2.1.4/lib/bundler/vendor/thor/lib/thor.rb:399:in `dispatch'
/usr/share/gems/gems/bundler-2.1.4/lib/bundler/cli.rb:30:in `dispatch'
/usr/share/gems/gems/bundler-2.1.4/lib/bundler/vendor/thor/lib/thor/base.rb:476:in `start'
/usr/share/gems/gems/bundler-2.1.4/lib/bundler/cli.rb:24:in `start'
/usr/share/gems/gems/bundler-2.1.4/libexec/bundle:46:in `block in <top (required)>'
/usr/share/gems/gems/bundler-2.1.4/lib/bundler/friendly_errors.rb:123:in `with_friendly_errors'
/usr/share/gems/gems/bundler-2.1.4/libexec/bundle:34:in `<top (required)>'
/opt/app-root/src/bin/bundle:3:in `load'
/opt/app-root/src/bin/bundle:3:in `<main>'
|
FTR the original PR works for 2.5 ... 2.7 as well: https://git.io/J3zWg Hopefully we can adapt it further to work with different archs (more in responses). |
I'm still working out the fix on the Gemfile level.
Not sure what the error here is. I'm testing it as posted on the gist. We'll also try it with the |
|
Lock file refresh: https://git.io/J3PKB |
|
Let me know if you find it ok, I'll squash relevant commits. Also would you mind if I include these scripts? (I can put them in a separate branch, if you like.) |
also regenerate Gemfile.lock.
|
Moved scripts to Squashed the commits (no additional change; the previous commits are still hopefully viewable from this PR). |
pvalena
changed the title
|
@yselkowitz @jackorp PTAL. |
|
Tests on ruby fedora s2i 2.7 fail on sassc extension compilation: https://gist.github.com/jackorp/e9c74a1f6dbffc83ef61f6220926d753 |
|
The other issue, even after you get the dependencies to compile/install, is that the application itself needs to be updated for compatibility with the latest rails. I've made progress on this but will have to follow up next week. |
This seems like an issue with your Fedora Ruby image :). |
What application needs to be updated? You mean the "app" dir? There should be some automated conversion tool. Unfortunately I'll be unable to do it in the next few weeks. Note that this fixes compatibility with Ruby 3.0 which is soon comming anyway. |
|
I should also note that when using this PR, the build (and tests) for s2i-ruby-container uses rails-ex in tests. |
|
@yselkowitz any chance getting this merged soon? This blocks us in s2i-ruby-container. For us, it works with this change. |
|
I don't see how, as the Rails code itself needs to be made compatible with the latest version: |
|
Filed pvalena#1 |
|
@pvalena @yselkowitz Any update on this one? |
|
@yselkowitz I won't have time to finish your PR anytime soon. Can you finish it? |
|
@yselkowitz does the change work for you now? Can you verify / test? Thanks! |
config/master.key
Outdated
| @@ -0,0 +1 @@ | |||
| 9cbfdc66d80a5b532b1b14c0e0cf16ff No newline at end of file | |||
There was a problem hiding this comment.
While this is just a randomly generated key, officially the credential keys are not supposed to be committed to version control. However, I have been unable to find a way to make this work "out of the box" (at least with s2i) without this being present. Any better ideas?
There was a problem hiding this comment.
Well...
The next important file is config/master.key which is where your RAILS_MASTER_KEY will be kept. Now this is a very important file that can never be committed to your source control tool! I can’t stress this enough because this key will give anyone access to your encrypted keys and will leave your application vulnerable to attacks. To avoid this you need to add your config/master.key to your .gitignore file and this will keep your master.key a secret.
Not having it would mean we need to regenerate it on every s2i build (or users need to do it).
$ bin/rails credentials:edit
One thing to know is that if you don’t have either of these files, running the above command will automatically create them for you (thanks Rails).
Or it can be stored in some OpenShift secrets / ENV:
Option 2: create a RAILS_MASTER_KEY ENV variable. Rails will detect it and use it as your master key, e.g. in Heroku: heroku config:set RAILS_MASTER_KEY=.
https://medium.com/@thorntonbrenden/rails-and-the-legendary-master-key-15c8be7799f1
There was a problem hiding this comment.
@yselkowitz @jackorp Do you want to try to fix this?
There was a problem hiding this comment.
That seems doable for the openshift template, except that you still have to have something for 1) pure s2i, 2) those using previous versions of the templates (e.g. all current versions of OpenShift). What's the intended fallback then?
There was a problem hiding this comment.
Also, iiuc the master key is used to encrypt credentials.yml.enc, so if we want to introduce a RAILS_MASTER_KEY env, then afaics there has to be the means to create credentials during s2i/assemble (and also non-interactively, as rails credentials:edit uses $EDITOR).
FWIW, django-ex provides a fallback secret key but I suppose it doesn't have the equivalent of credentials.yml.enc?
There was a problem hiding this comment.
Hmm, not sure we can get away with just adding the key generation and then just calling /usr/libexec/s2i/assemble...
By trying to generate the key I am hitting the chicken or the egg problem.
If I try to generate the key before calling the rest of the s2i script, the packages are not yet installed, if I try to generate it as the last thing, it fails on rails asset compilation because it does not have the key and credentials yet.
There was a problem hiding this comment.
Well, it doesn't seem it contains much logic for rails-related stuff:
https://github.com/sclorg/s2i-ruby-container/blob/master/3.0/s2i/bin/assemble
I think we can run bundle exec "rake assets:precompile" ourselves :) afterwards it will simply result it NOOP.
There was a problem hiding this comment.
Actually, I'm not sure that's the command we want to run (sorry), this one seems better:
https://github.com/sclorg/s2i-ruby-container/blob/master/3.0/s2i/bin/assemble#L51
I wouldn't worry about any args though (but we can copy the logic whole to be sure).
There was a problem hiding this comment.
I wouldn't worry about any args though (but we can copy the logic whole to be sure).
Sure, sounds good.
There was a problem hiding this comment.
Opened PR with the assemble script that seems to be working: pvalena#3
|
Tested with Ruby 2.5..3.0: https://git.io/JMLxD |
|
@yselkowitz thanks to @jackorp the issue should be fixed now. Please fire any OpenShift tests, otherwise we'll rely on s2i-ruby-container to do them, after we merge this. |
|
ReTested via s2i with the assemble script: https://git.io/JD4YM |
|
After much time, no feedback on this, and it's blocking further progress on dependent issues. Let's merge this. |
|
This is not fully compatible with ruby-26 and earlier, breaking OpenShift CI: https://bugzilla.redhat.com/show_bug.cgi?id=2058266 |
4 participants
also regenerate Gemfile.lock.
Test with Ruby 3.0: https://gist.github.com/pvalena/4ea74ca949efd18d15e14e4adb1886f9#file-rails-ex-test_ruby_3-0-log-L156
[ more testing follows ]