Variables and secrets

Anything that differs between environments, or may change without a new version, is a variable or a secret. A route uses both as ordinary Camel properties, such as {{erp-url}} and {{erp-api-key}}, so the same version runs in devtest and production with each environment’s values. A URL never has to live in a version.

Defaults and environment values#

A variable without an environment is the default, and one with an environment overrides it there:

apiVersion: weik.io/v1
kind: variable
metadata: { name: erp-url, project: finance }
spec: { value: https://erp-test.example.internal }

apiVersion: weik.io/v1
kind: variable
metadata: { name: erp-url, project: finance, environment: production }
spec: { value: https://erp.example.internal }

Each value is its own document because a document is the unit of permission. A developer allowed to edit devtest’s values never sees production’s, and the per-environment folders in Git follow from it.

$ weikio apply -f ./finance/variables/ -f ./finance/production/variables/ --env production

Target: https://hub.example, project finance (from finance/project.yaml), environment production (--env)
variable finance/erp-url unchanged
variable production/finance/erp-url updated
variable production/finance/page-size created

Secrets#

Secrets have the same shape as variables, but you set their values with the CLI so they never sit in Git. On a terminal the command asks for the value with hidden input, and in a pipeline it uses standard input:

$ weikio secret set finance/erp-api-key --env devtest

Target: https://hub.example, project finance (argument), environment devtest (--env)
Value:
secret finance/erp-api-key set for devtest (revision 4192)
1 deployment takes the new value at its next start:
  devtest   finance/erp-invoice-export   (started)

To restart it now, run:
  weikio secret set finance/erp-api-key --env devtest --restart

$ printf '%s' "$ERP_PROD_KEY" | weikio secret set finance/erp-api-key --env production

The platform seals every secret with AES-256-GCM under a master key that is kept in a file on each backend host, never in the message server or a backup. An integration receives its secrets in a properties file that only the agent’s user can read, never on a command line. --from-file sets a value from a file, and --as-file stores a whole file, such as a certificate, up to 128 KiB.

/settings/projects/finance/variables

Revealing a secret is a permission of its own, and every reveal is in the audit log. An environment can switch reveals off altogether, and then even a platform administrator gets this:

$ weikio secret reveal finance/erp-api-key --env production

error: Secret reveals aren't allowed in production.
       Ask a platform admin to run:
         weikio env set production --allow-secret-reveal=true

A deploy that needs a secret with no value in the environment fails at once with the command that sets it, before anything starts.

Which value wins#

When the same name has several values, the most specific wins:

1. A value set for the integration itself wins over the project’s.
2. A secret wins over a variable.
3. An environment’s value wins over the default.

A key that the integration’s own application.properties defines belongs to the integration. The project’s values don’t replace it, and only a value set for that integration or a deployment override does. --resolved shows what a deployment gets and where each value comes from:

$ weikio get variables --env production --resolved --integration erp-invoice-export

NAME          VALUE                            SOURCE
erp-url       https://erp.example.internal     variable:production
page-size     10                               deployment-override
erp-api-key   ********                         secret:production

A value for one integration#

Two integrations can each read ConnectionString, one for PostgreSQL and one for MongoDB, and neither receives the other’s value. --integration sets a value that only that integration gets:

$ weikio secret set finance/ConnectionString --integration orders-postgres --env production

Names follow Camel’s spelling, so {{erp.url}} and {{AWS_ACCESS_KEY}} work. {{name:default}} and {{?name}} work as they do in Camel: the platform’s value when there is one, otherwise the default after the colon, or nothing for {{?name}}.

A changed value and restarts#

A changed variable or secret reaches each deployment that uses it at its next start. Nothing running is restarted, because one shared value can feed dozens of integrations, and an edit must not restart all of them across production at once, in the middle of a transfer. The command lists the deployments the value reaches:

$ weikio variable set finance/page-size 200

Target: https://hub.example, project finance (argument), default environment (no --env)
variable finance/page-size updated (revision 4195)
2 deployments take the new value at their next start:
  devtest      finance/erp-invoice-export   (started)
  production   finance/erp-invoice-export   (started)

To restart them now, run:
  weikio variable set finance/page-size 200 --restart

--restart restarts them for you, and asks first when one of them runs in production:

$ weikio variable set finance/page-size 200 --restart

Target: https://hub.example, project finance (argument), default environment (no --env)
Deployments that will restart:
  devtest      finance/erp-invoice-export
  production   finance/erp-invoice-export
'production' is a production environment.
Continue? [y/N] y
variable finance/page-size updated (revision 4196)
deployment devtest/finance/erp-invoice-export restarted
deployment production/finance/erp-invoice-export restarted

The integration’s Variables and secrets section in the admin UI lists the names its routes use and marks each one that still needs a value.