Docker Secrets

A simple library to load Docker secrets in a swarm cluster as a map.

Download

Gradle

repositories {
  jcenter()
}

dependencies {
  compile 'com.cars:docker-secrets:0.2.0'
}

Maven

<dependency>
  <groupId>com.cars</groupId>
  <artifactId>docker-secrets</artifactId>
  <version>0.2.0</version>
</dependency>

Usage

Docker secrets are availble to a container under /run/secrets/

Given the below secrets :

$ echo "test-secret1-value" | docker secret create test-secret1 -
$ echo "test-secret2-value" | docker secret create test-secret2 -
$ echo "test-secret3-value" | docker secret create test-secret3 -

To load all secrets :

Map<String, String> secrets = DockerSecrets.load();
System.out.println(secrets.get("test-secret1")) // test-secret1-value

Since secrets are files, you can have a secret created with a properties file syntax as below

//secret-file.txt
dbuser=readonly
dbpass=super-secret-password
apikey=very-secret-api-key

Create the secret using the file:

$ docker secret create test-secret secret-file.txt

Then to load that secret:

Map<String, String> secrets = DockerSecrets.loadFromFile("test-secret");
System.out.println(secrets.get("dbuser")) // readonly

Working with Spring framework

Here is an example of how a SecretsConfig will look like when using Spring framework. It uses profiles to work with secrets locally. So if you are just testing you application outside of Docker, you can still use the same code

Create a file under src/main/resource/config/secrets-file

//secrets-file
dbuser=readonly
dbpass=secret-pass

And use this @Configuration:

package com.cars.devops.config;

import java.io.File;
import java.net.URL;
import java.util.Collections;
import java.util.Map;

import org.springframework.context.annotation.Bean;
import org.springframework.context.annotation.Configuration;
import org.springframework.context.annotation.Profile;

import com.cars.framework.secrets.DockerSecretLoadException;
import com.cars.framework.secrets.DockerSecrets;

@Configuration
public class SecretsConfig {

  //File under src/main/resources/config/
  private final String DEFAULT_SECRETS_FILE = "config/secrets-file";

  // This bean will be used in non-local or no profiles
  @Bean(name = "secrets")
  @Profile(value = "!local")
  public Map<String, String> secrets() {
    try {
      return DockerSecrets.loadFromFile("secrets-file");
    } catch (DockerSecretLoadException e) {
      System.out.println("Secrets Load failed : " + e.getMessage());
    }
    return Collections.emptyMap();
  }

  // This bean will be used for 'local' profile
  @Bean(name = "secrets")
  @Profile(value = "local")
  public Map<String, String> localSecrets() {
    try {
      URL url = ClassLoader.getSystemResource(DEFAULT_SECRETS_FILE);
      if (url != null) {
        return DockerSecrets.loadFromFile(new File(url.getPath()));
      } else {
        System.out.println("Secrets Load failed : No file at " + DEFAULT_SECRETS_FILE);
      }
    } catch (DockerSecretLoadException e) {
      System.out.println("Secrets Load failed : " + e.getMessage());
    }
    return Collections.emptyMap();
  }
}

Now you can run you application with the local profile :

$ java -Dspring.profiles.active=local -jar your.jar

Or if using Spring boot:

$ gradlew bootRun -Dspring.profiles.active=local

Use @Resource to reference the secrets bean in other beans/configs:

public class Application {

  @Resource(name = "secrets")
  private Map<String, String> secrets;

  // TODO Add your application beans here or use @Import as above

  @Bean
  public String somebean() {
    System.out.println("DBuser is : " + secrets.get("dbuser")); //should print readonly
    return "";
  }

  public static void main(String[] args) {
    SpringApplication.run(Application.class, args);
  }

}

Build

$ ./gradlew clean build

Test

$ ./gradlew clean test

License

Apache 2.0

ryan-airwallex/docker-secrets-java