alextab93/buildx
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 1 Wiki Activity

Merge pull request #3962 from crazy-max/bake-secret-source-override

Browse Source 
bake: allow overriding declared secret sources
This commit is contained in:
CrazyMax
2026-07-22 14:36:50 +02:00
committed by GitHub
parent 26f3b06d8d febb45afe2
commit 5c10fb7184
5 changed files with 152 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files
bake/bake.go
+52 -7
View File
@@ -685,9 +685,12 @@ func (c Config) newOverrides(v []string) (map[string]map[string]Override, error)
override.Append = appendTo
override.ArrValue = append(override.ArrValue, parts[1])
}
case "resources":
case "resources", "secret":
if len(keys) != 3 {
return nil, errors.Errorf("invalid key %s, resources requires name", parts[0])
return nil, errors.Errorf("invalid key %s, %s requires name", parts[0], keys[1])
}
if appendTo {
return nil, errors.Errorf("invalid key %s, %s does not support append", parts[0], keys[1])
}
override.Value = parts[1]
case "args":
@@ -1152,6 +1155,8 @@ func (t *Target) Merge(t2 *Target) {
func (t *Target) AddOverrides(overrides map[string]Override, ent *EntitlementConf) error {
// IMPORTANT: if you add more fields here, do not forget to update
// docs/bake-reference.md and https://docs.docker.com/build/bake/overrides/
secretOverrides := map[string]Override{}
secretEntitlements := map[string]struct{}{}
for key, o := range overrides {
value := o.Value
keys := strings.SplitN(key, ".", 2)
@@ -1239,21 +1244,24 @@ func (t *Target) AddOverrides(overrides map[string]Override, ent *EntitlementCon
t.Target = &value
case "call":
t.Call = &value
case "secret":
if len(keys) != 2 {
return errors.Errorf("invalid format for secret, expecting secret.<id>=<value>")
}
secretOverrides[keys[1]] = o
case "secrets":
secrets, err := parseArrValue[buildflags.Secret](o.ArrValue)
if err != nil {
return errors.Wrap(err, "invalid value for outputs")
}
for _, s := range secrets {
secretEntitlements[s.ID] = struct{}{}
}
if o.Append {
t.Secrets = t.Secrets.Merge(secrets)
} else {
t.Secrets = secrets
}
for _, s := range t.Secrets {
if s.FilePath != "" {
ent.FSRead = append(ent.FSRead, s.FilePath)
}
}
case "ssh":
ssh, err := parseArrValue[buildflags.SSH](o.ArrValue)
if err != nil {
@@ -1367,9 +1375,46 @@ func (t *Target) AddOverrides(overrides map[string]Override, ent *EntitlementCon
return errors.Errorf("unknown key: %s", keys[0])
}
}
for id, o := range secretOverrides {
if err := t.updateSecret(id, o.Value); err != nil {
return err
}
secretEntitlements[id] = struct{}{}
}
for _, s := range t.Secrets {
if _, ok := secretEntitlements[s.ID]; ok && s.FilePath != "" {
ent.FSRead = append(ent.FSRead, s.FilePath)
}
}
return nil
}
func (t *Target) updateSecret(id, value string) error {
if id == "" {
return errors.Errorf("invalid format for secret, expecting secret.<id>=<value>")
}
for _, s := range t.Secrets {
if s.ID != id {
continue
}
var next buildflags.Secret
if err := next.UnmarshalText([]byte(value)); err != nil {
return err
}
if next.ID != "" && next.ID != id {
return errors.Errorf("secret override id %q does not match declared secret %q", next.ID, id)
}
s.Env = next.Env
s.FilePath = next.FilePath
return nil
}
return errors.Errorf("secret %q must be declared before it can be overridden", id)
}
func (g *Group) GetEvalContexts(ectx *hcl.EvalContext, block *hcl.Block, loadDeps func(hcl.Expression) hcl.Diagnostics) ([]*hcl.EvalContext, error) {
content, _, err := block.Body.PartialContent(&hcl.BodySchema{
Attributes: []hcl.AttributeSchema{{Name: "matrix"}},
bake/bake_test.go
+43
View File
@@ -237,6 +237,49 @@ target "webapp" {
require.Equal(t, "BAR", m["webapp"].Secrets[1].ID)
})
t.Run("SecretSourceOverrideEnv", func(t *testing.T) {
m, _, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, []string{"webapp.secret.FOO=env=BAR"}, nil, nil, &EntitlementConf{})
require.NoError(t, err)
require.Len(t, m["webapp"].Secrets, 1)
require.Equal(t, "FOO", m["webapp"].Secrets[0].ID)
require.Equal(t, "BAR", m["webapp"].Secrets[0].Env)
require.Empty(t, m["webapp"].Secrets[0].FilePath)
})
t.Run("SecretSourceOverrideFile", func(t *testing.T) {
ent := &EntitlementConf{}
m, _, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, []string{"webapp.secret.FOO=src=/tmp/foo"}, nil, nil, ent)
require.NoError(t, err)
require.Len(t, m["webapp"].Secrets, 1)
require.Equal(t, "FOO", m["webapp"].Secrets[0].ID)
require.Equal(t, "/tmp/foo", m["webapp"].Secrets[0].FilePath)
require.Empty(t, m["webapp"].Secrets[0].Env)
require.Equal(t, []string{"/tmp/foo"}, ent.FSRead)
})
t.Run("SecretSourceOverrideUsesFinalSourceForEntitlements", func(t *testing.T) {
ent := &EntitlementConf{}
m, _, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, []string{"webapp.secrets=id=FOO,src=/tmp/foo", "webapp.secret.FOO=env=BAR"}, nil, nil, ent)
require.NoError(t, err)
require.Len(t, m["webapp"].Secrets, 1)
require.Equal(t, "FOO", m["webapp"].Secrets[0].ID)
require.Equal(t, "BAR", m["webapp"].Secrets[0].Env)
require.Empty(t, m["webapp"].Secrets[0].FilePath)
require.Empty(t, ent.FSRead)
})
t.Run("SecretSourceOverrideUndeclared", func(t *testing.T) {
_, _, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, []string{"webapp.secret.BAR=env=BAR"}, nil, nil, &EntitlementConf{})
require.Error(t, err)
require.Equal(t, `secret "BAR" must be declared before it can be overridden`, err.Error())
})
t.Run("SecretSourceOverrideMismatchedID", func(t *testing.T) {
_, _, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, []string{"webapp.secret.FOO=id=BAR,env=BAR"}, nil, nil, &EntitlementConf{})
require.Error(t, err)
require.Equal(t, `secret override id "BAR" does not match declared secret "FOO"`, err.Error())
})
t.Run("ShmSizeOverride", func(t *testing.T) {
m, _, err := ReadTargets(ctx, []File{fp}, []string{"webapp"}, []string{"webapp.shm-size=256m"}, nil, nil, &EntitlementConf{})
require.NoError(t, err)
docs/bake-reference.md
+8
View File
@@ -1006,6 +1006,14 @@ RUN --mount=type=secret,id=KUBECONFIG,env=KUBECONFIG \
helm upgrade --install
```
You can override the source for an existing secret without changing the target's
secret IDs. The secret must already be declared by the target.
```console
$ docker buildx bake --set default.secret.aws=env=AWS_CREDENTIALS
$ docker buildx bake --set default.secret.KUBECONFIG=src=/path/to/kubeconfig
```
### `target.shm-size`
Sets the size of the shared memory allocated for build containers when using
docs/reference/buildx_bake.md
+2
View File
@@ -441,6 +441,7 @@ $ docker buildx bake --set foo*.no-cache # bypass caching only fo
$ docker buildx bake --set target.platform+=linux/arm64 # appends 'linux/arm64' to the platform list
$ docker buildx bake --set target.contexts.bar=../bar # overrides 'bar' named context
$ docker buildx bake --set target.resources.memory=2g # overrides memory resource limit
$ docker buildx bake --set target.secret.aws=env=AWS # overrides source for an existing secret
```
> [!NOTE]
@@ -472,6 +473,7 @@ You can override the following fields:
* `pull`
* `push`
* `resources`
* `secret.<id>`
* `secrets`
* `ssh`
* `tags`
tests/bake.go
+47
View File
@@ -41,6 +41,7 @@ var bakeTests = []func(t *testing.T, sb integration.Sandbox){
testBakePrint,
testBakePrintSensitive,
testBakePrintOverrideEmpty,
testBakeSecretSourceOverride,
testBakePrintKeepEscaped,
testBakePrintRemoteContextSubdir,
testBakeLocal,
@@ -475,6 +476,52 @@ target "default" {
}`, stdout.String())
}
func testBakeSecretSourceOverride(t *testing.T, sb integration.Sandbox) {
bakefile := []byte(`
target "build" {
secret = [
"id=aws,src=aws-default",
"id=token,env=TOKEN",
]
}
`)
dir := tmpdir(
t,
fstest.CreateFile("docker-bake.hcl", bakefile, 0600),
fstest.CreateFile("Dockerfile", []byte("FROM scratch\n"), 0600),
fstest.CreateFile("aws-default", []byte("default"), 0600),
fstest.CreateFile("tokenfile", []byte("token"), 0600),
)
cmd := buildxCmd(sb, withDir(dir), withArgs(
"bake", "--print", "build",
"--set", "build.secret.aws=env=AWS_CREDENTIALS",
"--set", "build.secret.token=src=tokenfile",
))
stdout := bytes.Buffer{}
stderr := bytes.Buffer{}
cmd.Stdout = &stdout
cmd.Stderr = &stderr
require.NoError(t, cmd.Run(), stdout.String(), stderr.String())
var def struct {
Target map[string]*bake.Target `json:"target"`
}
require.NoError(t, json.Unmarshal(stdout.Bytes(), &def))
require.Contains(t, def.Target, "build")
require.Len(t, def.Target["build"].Secrets, 2)
require.Equal(t, "aws", def.Target["build"].Secrets[0].ID)
require.Equal(t, "AWS_CREDENTIALS", def.Target["build"].Secrets[0].Env)
require.Empty(t, def.Target["build"].Secrets[0].FilePath)
require.Equal(t, "token", def.Target["build"].Secrets[1].ID)
require.Equal(t, "tokenfile", def.Target["build"].Secrets[1].FilePath)
require.Empty(t, def.Target["build"].Secrets[1].Env)
out, err := bakeCmd(sb, withDir(dir), withArgs("--print", "build", "--set", "build.secret.missing=env=MISSING"))
require.Error(t, err)
require.Contains(t, out, `secret "missing" must be declared before it can be overridden`)
}
func testBakePrintKeepEscaped(t *testing.T, sb integration.Sandbox) {
bakefile := []byte(`
target "default" {