Actions
Bug #23398
closedcluster-activity workflow fails because it leaks secrets
Status:
Resolved
Priority:
Normal
Assigned To:
Category:
CWL
Target version:
Story points:
-
Release:
Release relationship:
Auto
Description
If you try to run cluster-activity.cwl as documented, it will fail with:
cwltool: Workflow execution failed: Secret material leaked in environment, only file literals may contain secrets
This is because it tries to set the PROMETHEUS_APIKEY/PROMETHEUS_PASSWORD environment variables from secret inputs. It needs to not do that.
Updated by Brett Smith 2 months ago
23398-cluster-activity-secrets @ 3e09f098c206d67781c89bbfdd9553a2a7433e42 - developer-run-tests: #5013
- All agreed upon points are implemented / addressed. Describe changes from pre-implementation design.
- Fixes several bugs at different layers that prevented the cluster activity report from querying Prometheus.
- Anything not implemented (discovered or discussed during work) has a follow-up story.
- N/A
- Code is tested and passing, both automated and manual, what manual testing was done is described.
- Added tests of the Prometheus constructor to try to help prevent future issues.
- The workflow worked on a real cluster with this
DockerRequirementto patch over issues:DockerRequirement: dockerFile: | FROM python:3.11-slim-bookworm RUN pip install --no-cache-dir "arvados-cluster-activity[prometheus]" "prometheus-api-client[dataframe]" RUN sed -i "s/{auth}/{basic_auth}/" /usr/local/lib/python3.11/site-packages/arvados_cluster_activity/main.py dockerImageId: arvados/cluster-activity:3.2.0.post1
- Tested code incorporates recent main branch changes.
- Yes
- New or changed UI/UX and has gotten feedback from stakeholders.
- N/A
- Documentation has been updated.
- N/A
- Behaves appropriately at the intended scale (describe intended scale).
- No change in scale
- Considered backwards and forwards compatibility issues between client and server.
- N/A
- Follows our coding standards and GUI style guidelines.
- Yes
Updated by Brett Smith 2 months ago
- Status changed from In Progress to Resolved
Applied in changeset arvados|bcf417eb0f3c1cb6904f7753f582adcb958231b1.
Actions