Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Allow BUILDKIT_SECRET_ and BUILDKIT_SSH params to use credential manager #78

Open
mmb opened this issue Dec 1, 2021 · 1 comment
Open

Comments

@mmb
Copy link

mmb commented Dec 1, 2021

A lot of users probably store these secrets in a credential manager. The only way I've found to use credential managers with this task is to run another task first that writes environment variables to files in an output. It would be great if there was an easier way. Using params for secrets instead of params pointing to input files seems simpler, more typical for Concourse and discourages bad practices like storing secrets in git.

I believe buildkit will already look up secrets in the environment instead of the filesystem if you pass it something like docker build --secret id=SOME_ENV_VAR. The task could see BUILDKIT_SECRET_SOME_SECRET, set SOME_SECRET when running the build and pass in --secret id=SOME_SECRET.

For BUILDKIT_SSH using params would be easier if it became more like BUILDKIT_SECRET and included the id in the param name (BUILDKIT_SSH_github_ssh_key: ((secret)) instead of BUILDKIT_SSH: github_ssh_key=<PATH-TO-YOUR-KEY>). The task would have to write a file though because I don't think it can use the environment like secrets can.

@mmb mmb changed the title Allow BUILDKIT_SECRET_ and BUILDKIT_SSH params to use credential store Allow BUILDKIT_SECRET_ and BUILDKIT_SSH params to use credential manager Dec 1, 2021
@ljcorreia
Copy link

I completely agree with @mmb as storing secrets in a credential manager is the right thing to do and the recommended way everywhere, not only for Concourse. I've tested the use of docker --secret with values coming from environment variables (Buildkit --secret argument) and it works really well when I build the OCI images locally, so it's a shame that it is not supported for this Concourse Resource. Building the image would be something like: docker build --secret id=some_secret,env=SOME_SECRET ..
I would not remove the file support though. It's good to have the options available.
Thanks everyone contributing to this.

charles-dyfis-net added a commit to charles-dyfis-net/oci-build-task that referenced this issue Apr 30, 2022
charles-dyfis-net added a commit to charles-dyfis-net/oci-build-task that referenced this issue May 1, 2022
charles-dyfis-net added a commit to charles-dyfis-net/oci-build-task that referenced this issue May 1, 2022
taylorsilva added a commit that referenced this issue May 6, 2022
Add support for passing secrets as text (#78)
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Projects
None yet
Development

No branches or pull requests

2 participants