Skip to content

Commit

Permalink
Add a mutex around loading secrets
Browse files Browse the repository at this point in the history
Loading secrets may ask for use input, so we need to ensure only one
thread does it at a time.
  • Loading branch information
djmb committed Sep 16, 2024
1 parent 876eebc commit 6bbbd81
Show file tree
Hide file tree
Showing 2 changed files with 8 additions and 2 deletions.
4 changes: 3 additions & 1 deletion lib/kamal/configuration.rb
Original file line number Diff line number Diff line change
Expand Up @@ -9,7 +9,7 @@ class Kamal::Configuration
delegate :service, :image, :labels, :stop_wait_time, :hooks_path, to: :raw_config, allow_nil: true
delegate :argumentize, :optionize, to: Kamal::Utils

attr_reader :destination, :raw_config
attr_reader :destination, :raw_config, :secrets
attr_reader :accessories, :aliases, :boot, :builder, :env, :healthcheck, :logging, :traefik, :servers, :ssh, :sshkit, :registry

include Validation
Expand Down Expand Up @@ -64,6 +64,8 @@ def initialize(raw_config, destination: nil, version: nil, validate: true)
@ssh = Ssh.new(config: self)
@sshkit = Sshkit.new(config: self)

@secrets = Kamal::Secrets.new(destination: destination)

ensure_destination_if_required
ensure_required_keys_present
ensure_valid_kamal_version
Expand Down
6 changes: 5 additions & 1 deletion lib/kamal/secrets.rb
Original file line number Diff line number Diff line change
Expand Up @@ -8,10 +8,14 @@ class Kamal::Secrets
def initialize(destination: nil)
@secrets_files = \
[ ".kamal/secrets-common", ".kamal/secrets#{(".#{destination}" if destination)}" ].select { |f| File.exist?(f) }
@mutex = Mutex.new
end

def [](key)
secrets.fetch(key)
# Fetching secrets may ask the user for input, so ensure only one thread does that
@mutex.synchronize do
secrets.fetch(key)
end
rescue KeyError
if secrets_files
raise Kamal::ConfigurationError, "Secret '#{key}' not found in #{secrets_files.join(", ")}"
Expand Down

0 comments on commit 6bbbd81

Please sign in to comment.