From 49514473f1ebb75114a3de8d08ea338b59b252b8 Mon Sep 17 00:00:00 2001 From: David Karlsson <35727626+dvdksn@users.noreply.github.com> Date: Thu, 4 Jan 2024 10:12:14 +0100 Subject: [PATCH 1/3] swarm: remove incorrect statement about revoking secret access Closes #18990 Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com> --- content/engine/swarm/secrets.md | 7 +------ 1 file changed, 1 insertion(+), 6 deletions(-) diff --git a/content/engine/swarm/secrets.md b/content/engine/swarm/secrets.md index b6f1776ba0..120cbf2796 100644 --- a/content/engine/swarm/secrets.md +++ b/content/engine/swarm/secrets.md @@ -748,11 +748,6 @@ line. wvnh0siktqr3 mysql replicated 1/1 mysql:latest ``` - At this point, you could actually revoke the `mysql` service's access to the - `mysql_password` and `mysql_root_password` secrets because the passwords - have been saved in the MySQL system database. Don't do that for now, because - we use them later to facilitate rotating the MySQL password. - 5. Now that MySQL is set up, create a WordPress service that connects to the MySQL service. The WordPress service has the following characteristics: @@ -1041,4 +1036,4 @@ Each service uses environment variables to specify where the service should look for that secret data. More information on short and long syntax for secrets can be found in the -[Compose Specification](../../compose/compose-file/09-secrets.md). \ No newline at end of file +[Compose Specification](../../compose/compose-file/09-secrets.md). From 8964d94c7b9079eaeb56d3ea88ac22080ae99399 Mon Sep 17 00:00:00 2001 From: David Karlsson <35727626+dvdksn@users.noreply.github.com> Date: Thu, 4 Jan 2024 10:40:07 +0100 Subject: [PATCH 2/3] swarm: remove permission mode 0400 for wordpress service secret mount Permission mode 0400 caused a failure connecting to the database Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com> --- content/engine/swarm/secrets.md | 13 +++++-------- 1 file changed, 5 insertions(+), 8 deletions(-) diff --git a/content/engine/swarm/secrets.md b/content/engine/swarm/secrets.md index 120cbf2796..c0c24022dd 100644 --- a/content/engine/swarm/secrets.md +++ b/content/engine/swarm/secrets.md @@ -763,9 +763,7 @@ line. nodes. - Has access to the `mysql_password` secret, but specifies a different target file name within the container. The WordPress container uses - the mount point `/run/secrets/wp_db_password`. Also specifies that the - secret is not group-or-world-readable, by setting the mode to - `0400`. + the mount point `/run/secrets/wp_db_password`. - Sets the environment variable `WORDPRESS_DB_PASSWORD_FILE` to the file path where the secret is mounted. The WordPress service reads the MySQL password string from that file and add it to the `wp-config.php` @@ -783,7 +781,7 @@ line. --network mysql_private \ --publish published=30000,target=80 \ --mount type=volume,source=wpdata,destination=/var/www/html \ - --secret source=mysql_password,target=wp_db_password,mode=0400 \ + --secret source=mysql_password,target=wp_db_password \ -e WORDPRESS_DB_USER="wordpress" \ -e WORDPRESS_DB_PASSWORD_FILE="/run/secrets/wp_db_password" \ -e WORDPRESS_DB_HOST="mysql:3306" \ @@ -908,14 +906,13 @@ use it, then remove the old secret. ``` 4. Update the `wordpress` service to use the new password, keeping the target - path at `/run/secrets/wp_db_password` and keeping the file permissions at - `0400`. This triggers a rolling restart of the WordPress service and - the new secret is used. + path at `/run/secrets/wp_db_password`. This triggers a rolling restart of + the WordPress service and the new secret is used. ```console $ docker service update \ --secret-rm mysql_password \ - --secret-add source=mysql_password_v2,target=wp_db_password,mode=0400 \ + --secret-add source=mysql_password_v2,target=wp_db_password \ wordpress ``` From 5ef80807e3c969166d8f5609976764b405dfe939 Mon Sep 17 00:00:00 2001 From: David Karlsson <35727626+dvdksn@users.noreply.github.com> Date: Thu, 4 Jan 2024 14:02:25 +0100 Subject: [PATCH 3/3] chore: fix/add code block language tags Signed-off-by: David Karlsson <35727626+dvdksn@users.noreply.github.com> --- content/engine/swarm/secrets.md | 38 ++++++++++++++++----------------- 1 file changed, 19 insertions(+), 19 deletions(-) diff --git a/content/engine/swarm/secrets.md b/content/engine/swarm/secrets.md index c0c24022dd..0ad281bc05 100644 --- a/content/engine/swarm/secrets.md +++ b/content/engine/swarm/secrets.md @@ -214,7 +214,7 @@ real-world example, continue to 5. Verify that the secret is not available if you commit the container. - ```none + ```console $ docker commit $(docker ps --filter name=redis -q) committed_redis $ docker run --rm -it committed_redis cat /run/secrets/my_secret_data @@ -249,7 +249,7 @@ real-world example, continue to to the secret. The container ID is different, because the `service update` command redeploys the service. - ```none + ```console $ docker container exec -it $(docker ps --filter name=redis -q) cat /run/secrets/my_secret_data cat: can't open '/run/secrets/my_secret_data': No such file or directory @@ -284,24 +284,24 @@ This example assumes that you have PowerShell installed. 2. If you have not already done so, initialize or join the swarm. - ```powershell - docker swarm init + ```console + > docker swarm init ``` 3. Save the `index.html` file as a swarm secret named `homepage`. - ```powershell - docker secret create homepage index.html + ```console + > docker secret create homepage index.html ``` 4. Create an IIS service and grant it access to the `homepage` secret. - ```powershell - docker service create - --name my-iis - --publish published=8000,target=8000 - --secret src=homepage,target="\inetpub\wwwroot\index.html" - microsoft/iis:nanoserver + ```console + > docker service create ` + --name my-iis ` + --publish published=8000,target=8000 ` + --secret src=homepage,target="\inetpub\wwwroot\index.html" ` + microsoft/iis:nanoserver ``` > **Note** @@ -315,10 +315,10 @@ This example assumes that you have PowerShell installed. 6. Remove the service and the secret. - ```powershell - docker service rm my-iis - docker secret rm homepage - docker image remove secret-test + ```console + > docker service rm my-iis + > docker secret rm homepage + > docker image remove secret-test ``` ### Intermediate example: Use secrets with a Nginx service @@ -360,7 +360,7 @@ generate the site key and certificate, name the files `site.key` and the following contents into it. This constrains the root CA to signing leaf certificates and not intermediate CAs. - ```none + ```ini [root_ca] basicConstraints = critical,CA:TRUE,pathlen:1 keyUsage = critical, nonRepudiation, cRLSign, keyCertSign @@ -394,7 +394,7 @@ generate the site key and certificate, name the files `site.key` and certificate so that it can only be used to authenticate a server and can't be used to sign certificates. - ```none + ```ini [server] authorityKeyIdentifier=keyid,issuer basicConstraints = critical,CA:FALSE @@ -425,7 +425,7 @@ generate the site key and certificate, name the files `site.key` and In the current directory, create a new file called `site.conf` with the following contents: - ```none + ```nginx server { listen 443 ssl; server_name localhost;