Project

General

Profile

Actions

Bug #23398

closed

cluster-activity workflow fails because it leaks secrets

Added by Brett Smith 2 months ago. Updated 2 months ago.

Status:
Resolved
Priority:
Normal
Assigned To:
Category:
CWL
Target version:
Story points:
-
Release relationship:
Auto

Description

If you try to run cluster-activity.cwl as documented, it will fail with:

cwltool: Workflow execution failed:
Secret material leaked in environment, only file literals may contain secrets

This is because it tries to set the PROMETHEUS_APIKEY/PROMETHEUS_PASSWORD environment variables from secret inputs. It needs to not do that.


Subtasks 1 (0 open1 closed)

Task #23399: Review 23398-cluster-activity-secretsResolvedBrett Smith01/20/2026Actions
Actions #1

Updated by Brett Smith 2 months ago

23398-cluster-activity-secrets @ 3e09f098c206d67781c89bbfdd9553a2a7433e42 - developer-run-tests: #5013

  • All agreed upon points are implemented / addressed. Describe changes from pre-implementation design.
    • Fixes several bugs at different layers that prevented the cluster activity report from querying Prometheus.
  • Anything not implemented (discovered or discussed during work) has a follow-up story.
    • N/A
  • Code is tested and passing, both automated and manual, what manual testing was done is described.
    • Added tests of the Prometheus constructor to try to help prevent future issues.
    • The workflow worked on a real cluster with this DockerRequirement to patch over issues:
       DockerRequirement:
          dockerFile: |
            FROM python:3.11-slim-bookworm
            RUN pip install --no-cache-dir "arvados-cluster-activity[prometheus]" "prometheus-api-client[dataframe]" 
            RUN sed -i "s/{auth}/{basic_auth}/" /usr/local/lib/python3.11/site-packages/arvados_cluster_activity/main.py
          dockerImageId: arvados/cluster-activity:3.2.0.post1
      
  • Tested code incorporates recent main branch changes.
    • Yes
  • New or changed UI/UX and has gotten feedback from stakeholders.
    • N/A
  • Documentation has been updated.
    • N/A
  • Behaves appropriately at the intended scale (describe intended scale).
    • No change in scale
  • Considered backwards and forwards compatibility issues between client and server.
    • N/A
  • Follows our coding standards and GUI style guidelines.
    • Yes
Actions #2

Updated by Brett Smith 2 months ago

  • Subtask #23399 added
Actions #3

Updated by Tom Clegg 2 months ago

  • Status changed from New to In Progress

LGTM, thanks.

Actions #4

Updated by Brett Smith 2 months ago

  • Status changed from In Progress to Resolved
Actions

Also available in: Atom PDF