Skip to content

Commit 593b815

Browse files
Flo4604autofix-ci[bot]chronark
authored
feat: better env var injection (#4468)
* feat: add environment variables db schema and queries * fix db query * feat: add SecretsConfig proto for encrypted env vars * [autofix.ci] apply automated fixes * feat: dashboard UI for environment variables management * fix comment and rename file * fix file export name * Remove unnecessary comments from add-env-vars * add toasts for environment variable operations * [autofix.ci] apply automated fixes * fix: add try/catch error handling to env var mutations * unfmt file * [autofix.ci] apply automated fixes * feat: decrypt env vars in CTRL workflow before passing to Krane * feat: inject env vars into pod spec via Krane * feat: add customer-workload service account for pod isolation * remove gw from k8s manifest, add agent fix ctrl vault for certs * seperate master keys too * add inital webhook stuff * add generated stuff * adjust comments * use otel lgtm stack in k8s too * fix some rabbit comments * fix some rabbit comments * get rid of some unncessary comments * actually add unkey env cmd gitignores... * fix golint issues (#4477) * [autofix.ci] apply automated fixes * fix fmt * linter be happy --------- Co-authored-by: autofix-ci[bot] <114827586+autofix-ci[bot]@users.noreply.github.com> Co-authored-by: Andreas Thomas <[email protected]>
1 parent 1073dbc commit 593b815

File tree

53 files changed

+2585
-398
lines changed

Some content is hidden

Large Commits have some content hidden by default. Use the searchbox below for content that may be hidden.

53 files changed

+2585
-398
lines changed

‎apps/dashboard/app/(app)/[workspaceSlug]/projects/[projectId]/details/env-variables-section/add-env-vars.tsx‎

Lines changed: 19 additions & 16 deletions
Original file line numberDiff line numberDiff line change
@@ -2,7 +2,7 @@ import { trpc } from "@/lib/trpc/client";
22
import { cn } from "@/lib/utils";
33
import { Plus, Trash } from "@unkey/icons";
44
import { Button, Input, toast } from "@unkey/ui";
5-
import { useEffect, useMemo, useRef, useState } from "react";
5+
import { useCallback, useEffect, useMemo, useRef, useState } from "react";
66
import { EnvVarSecretSwitch } from "./components/env-var-secret-switch";
77
import { ENV_VAR_KEY_REGEX, type EnvVar, type EnvVarType } from "./types";
88

@@ -154,30 +154,33 @@ export function AddEnvVars({
154154
}
155155
};
156156

157-
const getErrors = (entry: EnvVarEntry): { key?: string; value?: string } => {
158-
const errors: { key?: string; value?: string } = {};
159-
160-
if (entry.key && !ENV_VAR_KEY_REGEX.test(entry.key)) {
161-
errors.key = "Must be UPPERCASE";
162-
} else if (entry.key && getExistingEnvVar(entry.key)) {
163-
errors.key = "Already exists";
164-
} else if (entry.key) {
165-
const duplicates = entries.filter((e) => e.key === entry.key);
166-
if (duplicates.length > 1) {
167-
errors.key = "Duplicate";
157+
const getErrors = useCallback(
158+
(entry: EnvVarEntry): { key?: string; value?: string } => {
159+
const errors: { key?: string; value?: string } = {};
160+
161+
if (entry.key && !ENV_VAR_KEY_REGEX.test(entry.key)) {
162+
errors.key = "Must be UPPERCASE";
163+
} else if (entry.key && getExistingEnvVar(entry.key)) {
164+
errors.key = "Already exists";
165+
} else if (entry.key) {
166+
const duplicates = entries.filter((e) => e.key === entry.key);
167+
if (duplicates.length > 1) {
168+
errors.key = "Duplicate";
169+
}
168170
}
169-
}
170171

171-
return errors;
172-
};
172+
return errors;
173+
},
174+
[entries, getExistingEnvVar],
175+
);
173176

174177
const validEntries = useMemo(
175178
() =>
176179
entries.filter((e) => {
177180
const errors = getErrors(e);
178181
return e.key && e.value && !errors.key && !errors.value;
179182
}),
180-
[entries, getExistingEnvVar],
183+
[entries, getErrors],
181184
);
182185

183186
const handleSave = async () => {

‎apps/dashboard/gen/proto/ctrl/v1/secrets_pb.ts‎

Lines changed: 5 additions & 8 deletions
Original file line numberDiff line numberDiff line change
@@ -2,18 +2,15 @@
22
// @generated from file ctrl/v1/secrets.proto (package ctrl.v1, syntax proto3)
33
/* eslint-disable */
44

5-
import type { Message } from "@bufbuild/protobuf";
65
import type { GenFile, GenMessage } from "@bufbuild/protobuf/codegenv2";
76
import { fileDesc, messageDesc } from "@bufbuild/protobuf/codegenv2";
7+
import type { Message } from "@bufbuild/protobuf";
88

99
/**
1010
* Describes the file ctrl/v1/secrets.proto.
1111
*/
12-
export const file_ctrl_v1_secrets: GenFile =
13-
/*@__PURE__*/
14-
fileDesc(
15-
"ChVjdHJsL3YxL3NlY3JldHMucHJvdG8SB2N0cmwudjEidQoNU2VjcmV0c0NvbmZpZxI0CgdzZWNyZXRzGAEgAygLMiMuY3RybC52MS5TZWNyZXRzQ29uZmlnLlNlY3JldHNFbnRyeRouCgxTZWNyZXRzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4AUKOAQoLY29tLmN0cmwudjFCDFNlY3JldHNQcm90b1ABWjRnaXRodWIuY29tL3Vua2V5ZWQvdW5rZXkvZ28vZ2VuL3Byb3RvL2N0cmwvdjE7Y3RybHYxogIDQ1hYqgIHQ3RybC5WMcoCB0N0cmxcVjHiAhNDdHJsXFYxXEdQQk1ldGFkYXRh6gIIQ3RybDo6VjFiBnByb3RvMw",
16-
);
12+
export const file_ctrl_v1_secrets: GenFile = /*@__PURE__*/
13+
fileDesc("ChVjdHJsL3YxL3NlY3JldHMucHJvdG8SB2N0cmwudjEidQoNU2VjcmV0c0NvbmZpZxI0CgdzZWNyZXRzGAEgAygLMiMuY3RybC52MS5TZWNyZXRzQ29uZmlnLlNlY3JldHNFbnRyeRouCgxTZWNyZXRzRW50cnkSCwoDa2V5GAEgASgJEg0KBXZhbHVlGAIgASgJOgI4AUKOAQoLY29tLmN0cmwudjFCDFNlY3JldHNQcm90b1ABWjRnaXRodWIuY29tL3Vua2V5ZWQvdW5rZXkvZ28vZ2VuL3Byb3RvL2N0cmwvdjE7Y3RybHYxogIDQ1hYqgIHQ3RybC5WMcoCB0N0cmxcVjHiAhNDdHJsXFYxXEdQQk1ldGFkYXRh6gIIQ3RybDo6VjFiBnByb3RvMw");
1714

1815
/**
1916
* SecretsConfig is stored in the deployments table
@@ -34,6 +31,6 @@ export type SecretsConfig = Message<"ctrl.v1.SecretsConfig"> & {
3431
* Describes the message ctrl.v1.SecretsConfig.
3532
* Use `create(SecretsConfigSchema)` to create a new message.
3633
*/
37-
export const SecretsConfigSchema: GenMessage<SecretsConfig> =
38-
/*@__PURE__*/
34+
export const SecretsConfigSchema: GenMessage<SecretsConfig> = /*@__PURE__*/
3935
messageDesc(file_ctrl_v1_secrets, 0);
36+

‎apps/dashboard/gen/proto/krane/v1/deployment_pb.ts‎

Lines changed: 20 additions & 5 deletions
Original file line numberDiff line numberDiff line change
@@ -10,7 +10,7 @@ import type { Message } from "@bufbuild/protobuf";
1010
* Describes the file krane/v1/deployment.proto.
1111
*/
1212
export const file_krane_v1_deployment: GenFile = /*@__PURE__*/
13-
fileDesc("ChlrcmFuZS92MS9kZXBsb3ltZW50LnByb3RvEghrcmFuZS52MSL7AQoRRGVwbG95bWVudFJlcXVlc3QSEQoJbmFtZXNwYWNlGAEgASgJEhUKDWRlcGxveW1lbnRfaWQYAiABKAkSDQoFaW1hZ2UYAyABKAkSEAoIcmVwbGljYXMYBCABKA0SFgoOY3B1X21pbGxpY29yZXMYBSABKA0SFwoPbWVtb3J5X3NpemVfbWliGAYgASgEEjoKCGVudl92YXJzGAcgAygLMigua3JhbmUudjEuRGVwbG95bWVudFJlcXVlc3QuRW52VmFyc0VudHJ5Gi4KDEVudlZhcnNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBIkoKF0NyZWF0ZURlcGxveW1lbnRSZXF1ZXN0Ei8KCmRlcGxveW1lbnQYASABKAsyGy5rcmFuZS52MS5EZXBsb3ltZW50UmVxdWVzdCJGChhDcmVhdGVEZXBsb3ltZW50UmVzcG9uc2USKgoGc3RhdHVzGAEgASgOMhoua3JhbmUudjEuRGVwbG95bWVudFN0YXR1cyJKChdVcGRhdGVEZXBsb3ltZW50UmVxdWVzdBIvCgpkZXBsb3ltZW50GAEgASgLMhsua3JhbmUudjEuRGVwbG95bWVudFJlcXVlc3QiKwoYVXBkYXRlRGVwbG95bWVudFJlc3BvbnNlEg8KB3BvZF9pZHMYASADKAkiQwoXRGVsZXRlRGVwbG95bWVudFJlcXVlc3QSEQoJbmFtZXNwYWNlGAEgASgJEhUKDWRlcGxveW1lbnRfaWQYAiABKAkiGgoYRGVsZXRlRGVwbG95bWVudFJlc3BvbnNlIkAKFEdldERlcGxveW1lbnRSZXF1ZXN0EhEKCW5hbWVzcGFjZRgBIAEoCRIVCg1kZXBsb3ltZW50X2lkGAIgASgJIj4KFUdldERlcGxveW1lbnRSZXNwb25zZRIlCglpbnN0YW5jZXMYAiADKAsyEi5rcmFuZS52MS5JbnN0YW5jZSJTCghJbnN0YW5jZRIKCgJpZBgBIAEoCRIPCgdhZGRyZXNzGAIgASgJEioKBnN0YXR1cxgDIAEoDjIaLmtyYW5lLnYxLkRlcGxveW1lbnRTdGF0dXMqlgEKEERlcGxveW1lbnRTdGF0dXMSIQodREVQTE9ZTUVOVF9TVEFUVVNfVU5TUEVDSUZJRUQQABIdChlERVBMT1lNRU5UX1NUQVRVU19QRU5ESU5HEAESHQoZREVQTE9ZTUVOVF9TVEFUVVNfUlVOTklORxACEiEKHURFUExPWU1FTlRfU1RBVFVTX1RFUk1JTkFUSU5HEAMymwIKEURlcGxveW1lbnRTZXJ2aWNlElkKEENyZWF0ZURlcGxveW1lbnQSIS5rcmFuZS52MS5DcmVhdGVEZXBsb3ltZW50UmVxdWVzdBoiLmtyYW5lLnYxLkNyZWF0ZURlcGxveW1lbnRSZXNwb25zZRJQCg1HZXREZXBsb3ltZW50Eh4ua3JhbmUudjEuR2V0RGVwbG95bWVudFJlcXVlc3QaHy5rcmFuZS52MS5HZXREZXBsb3ltZW50UmVzcG9uc2USWQoQRGVsZXRlRGVwbG95bWVudBIhLmtyYW5lLnYxLkRlbGV0ZURlcGxveW1lbnRSZXF1ZXN0GiIua3JhbmUudjEuRGVsZXRlRGVwbG95bWVudFJlc3BvbnNlQpgBCgxjb20ua3JhbmUudjFCD0RlcGxveW1lbnRQcm90b1ABWjZnaXRodWIuY29tL3Vua2V5ZWQvdW5rZXkvZ28vZ2VuL3Byb3RvL2tyYW5lL3YxO2tyYW5ldjGiAgNLWFiqAghLcmFuZS5WMcoCCEtyYW5lXFYx4gIUS3JhbmVcVjFcR1BCTWV0YWRhdGHqAglLcmFuZTo6VjFiBnByb3RvMw");
13+
fileDesc("ChlrcmFuZS92MS9kZXBsb3ltZW50LnByb3RvEghrcmFuZS52MSLhAQoRRGVwbG95bWVudFJlcXVlc3QSEQoJbmFtZXNwYWNlGAEgASgJEhUKDWRlcGxveW1lbnRfaWQYAiABKAkSDQoFaW1hZ2UYAyABKAkSEAoIcmVwbGljYXMYBCABKA0SFgoOY3B1X21pbGxpY29yZXMYBSABKA0SFwoPbWVtb3J5X3NpemVfbWliGAYgASgEEhgKEGVudmlyb25tZW50X3NsdWcYByABKAkSHgoWZW5jcnlwdGVkX3NlY3JldHNfYmxvYhgIIAEoDBIWCg5lbnZpcm9ubWVudF9pZBgJIAEoCSJKChdDcmVhdGVEZXBsb3ltZW50UmVxdWVzdBIvCgpkZXBsb3ltZW50GAEgASgLMhsua3JhbmUudjEuRGVwbG95bWVudFJlcXVlc3QiRgoYQ3JlYXRlRGVwbG95bWVudFJlc3BvbnNlEioKBnN0YXR1cxgBIAEoDjIaLmtyYW5lLnYxLkRlcGxveW1lbnRTdGF0dXMiSgoXVXBkYXRlRGVwbG95bWVudFJlcXVlc3QSLwoKZGVwbG95bWVudBgBIAEoCzIbLmtyYW5lLnYxLkRlcGxveW1lbnRSZXF1ZXN0IisKGFVwZGF0ZURlcGxveW1lbnRSZXNwb25zZRIPCgdwb2RfaWRzGAEgAygJIkMKF0RlbGV0ZURlcGxveW1lbnRSZXF1ZXN0EhEKCW5hbWVzcGFjZRgBIAEoCRIVCg1kZXBsb3ltZW50X2lkGAIgASgJIhoKGERlbGV0ZURlcGxveW1lbnRSZXNwb25zZSJAChRHZXREZXBsb3ltZW50UmVxdWVzdBIRCgluYW1lc3BhY2UYASABKAkSFQoNZGVwbG95bWVudF9pZBgCIAEoCSI+ChVHZXREZXBsb3ltZW50UmVzcG9uc2USJQoJaW5zdGFuY2VzGAIgAygLMhIua3JhbmUudjEuSW5zdGFuY2UiUwoISW5zdGFuY2USCgoCaWQYASABKAkSDwoHYWRkcmVzcxgCIAEoCRIqCgZzdGF0dXMYAyABKA4yGi5rcmFuZS52MS5EZXBsb3ltZW50U3RhdHVzKpYBChBEZXBsb3ltZW50U3RhdHVzEiEKHURFUExPWU1FTlRfU1RBVFVTX1VOU1BFQ0lGSUVEEAASHQoZREVQTE9ZTUVOVF9TVEFUVVNfUEVORElORxABEh0KGURFUExPWU1FTlRfU1RBVFVTX1JVTk5JTkcQAhIhCh1ERVBMT1lNRU5UX1NUQVRVU19URVJNSU5BVElORxADMpsCChFEZXBsb3ltZW50U2VydmljZRJZChBDcmVhdGVEZXBsb3ltZW50EiEua3JhbmUudjEuQ3JlYXRlRGVwbG95bWVudFJlcXVlc3QaIi5rcmFuZS52MS5DcmVhdGVEZXBsb3ltZW50UmVzcG9uc2USUAoNR2V0RGVwbG95bWVudBIeLmtyYW5lLnYxLkdldERlcGxveW1lbnRSZXF1ZXN0Gh8ua3JhbmUudjEuR2V0RGVwbG95bWVudFJlc3BvbnNlElkKEERlbGV0ZURlcGxveW1lbnQSIS5rcmFuZS52MS5EZWxldGVEZXBsb3ltZW50UmVxdWVzdBoiLmtyYW5lLnYxLkRlbGV0ZURlcGxveW1lbnRSZXNwb25zZUKYAQoMY29tLmtyYW5lLnYxQg9EZXBsb3ltZW50UHJvdG9QAVo2Z2l0aHViLmNvbS91bmtleWVkL3Vua2V5L2dvL2dlbi9wcm90by9rcmFuZS92MTtrcmFuZXYxogIDS1hYqgIIS3JhbmUuVjHKAghLcmFuZVxWMeICFEtyYW5lXFYxXEdQQk1ldGFkYXRh6gIJS3JhbmU6OlYxYgZwcm90bzM");
1414

1515
/**
1616
* @generated from message krane.v1.DeploymentRequest
@@ -47,12 +47,27 @@ export type DeploymentRequest = Message<"krane.v1.DeploymentRequest"> & {
4747
memorySizeMib: bigint;
4848

4949
/**
50-
* Environment variables to inject into the container.
51-
* Keys are variable names, values are the (decrypted) values.
50+
* Environment slug (e.g., production, staging).
5251
*
53-
* @generated from field: map<string, string> env_vars = 7;
52+
* @generated from field: string environment_slug = 7;
5453
*/
55-
envVars: { [key: string]: string };
54+
environmentSlug: string;
55+
56+
/**
57+
* Encrypted secrets blob to be decrypted at runtime by unkey-env.
58+
* This is set as UNKEY_SECRETS_BLOB env var in the container.
59+
* unkey-env calls krane's DecryptSecretsBlob RPC to decrypt.
60+
*
61+
* @generated from field: bytes encrypted_secrets_blob = 8;
62+
*/
63+
encryptedSecretsBlob: Uint8Array;
64+
65+
/**
66+
* Environment ID for secrets decryption (keyring identifier).
67+
*
68+
* @generated from field: string environment_id = 9;
69+
*/
70+
environmentId: string;
5671
};
5772

5873
/**

‎apps/dashboard/gen/proto/krane/v1/secrets_pb.ts‎

Lines changed: 96 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,96 @@
1+
// @generated by protoc-gen-es v2.8.0 with parameter "target=ts"
2+
// @generated from file krane/v1/secrets.proto (package krane.v1, syntax proto3)
3+
/* eslint-disable */
4+
5+
import type { GenFile, GenMessage, GenService } from "@bufbuild/protobuf/codegenv2";
6+
import { fileDesc, messageDesc, serviceDesc } from "@bufbuild/protobuf/codegenv2";
7+
import type { Message } from "@bufbuild/protobuf";
8+
9+
/**
10+
* Describes the file krane/v1/secrets.proto.
11+
*/
12+
export const file_krane_v1_secrets: GenFile = /*@__PURE__*/
13+
fileDesc("ChZrcmFuZS92MS9zZWNyZXRzLnByb3RvEghrcmFuZS52MSJxChlEZWNyeXB0U2VjcmV0c0Jsb2JSZXF1ZXN0EhYKDmVuY3J5cHRlZF9ibG9iGAEgASgMEhYKDmVudmlyb25tZW50X2lkGAIgASgJEg0KBXRva2VuGAMgASgJEhUKDWRlcGxveW1lbnRfaWQYBCABKAkikQEKGkRlY3J5cHRTZWNyZXRzQmxvYlJlc3BvbnNlEkMKCGVudl92YXJzGAEgAygLMjEua3JhbmUudjEuRGVjcnlwdFNlY3JldHNCbG9iUmVzcG9uc2UuRW52VmFyc0VudHJ5Gi4KDEVudlZhcnNFbnRyeRILCgNrZXkYASABKAkSDQoFdmFsdWUYAiABKAk6AjgBMnEKDlNlY3JldHNTZXJ2aWNlEl8KEkRlY3J5cHRTZWNyZXRzQmxvYhIjLmtyYW5lLnYxLkRlY3J5cHRTZWNyZXRzQmxvYlJlcXVlc3QaJC5rcmFuZS52MS5EZWNyeXB0U2VjcmV0c0Jsb2JSZXNwb25zZUKVAQoMY29tLmtyYW5lLnYxQgxTZWNyZXRzUHJvdG9QAVo2Z2l0aHViLmNvbS91bmtleWVkL3Vua2V5L2dvL2dlbi9wcm90by9rcmFuZS92MTtrcmFuZXYxogIDS1hYqgIIS3JhbmUuVjHKAghLcmFuZVxWMeICFEtyYW5lXFYxXEdQQk1ldGFkYXRh6gIJS3JhbmU6OlYxYgZwcm90bzM");
14+
15+
/**
16+
* @generated from message krane.v1.DecryptSecretsBlobRequest
17+
*/
18+
export type DecryptSecretsBlobRequest = Message<"krane.v1.DecryptSecretsBlobRequest"> & {
19+
/**
20+
* The encrypted secrets blob from the pod spec (UNKEY_SECRETS_BLOB env var).
21+
* This is the SecretsConfig proto, encrypted with the environment's vault keyring.
22+
*
23+
* @generated from field: bytes encrypted_blob = 1;
24+
*/
25+
encryptedBlob: Uint8Array;
26+
27+
/**
28+
* Environment ID (keyring) to use for decryption.
29+
*
30+
* @generated from field: string environment_id = 2;
31+
*/
32+
environmentId: string;
33+
34+
/**
35+
* Token for authentication (K8s service account token or DB-stored token).
36+
*
37+
* @generated from field: string token = 3;
38+
*/
39+
token: string;
40+
41+
/**
42+
* Deployment ID for token validation.
43+
*
44+
* @generated from field: string deployment_id = 4;
45+
*/
46+
deploymentId: string;
47+
};
48+
49+
/**
50+
* Describes the message krane.v1.DecryptSecretsBlobRequest.
51+
* Use `create(DecryptSecretsBlobRequestSchema)` to create a new message.
52+
*/
53+
export const DecryptSecretsBlobRequestSchema: GenMessage<DecryptSecretsBlobRequest> = /*@__PURE__*/
54+
messageDesc(file_krane_v1_secrets, 0);
55+
56+
/**
57+
* @generated from message krane.v1.DecryptSecretsBlobResponse
58+
*/
59+
export type DecryptSecretsBlobResponse = Message<"krane.v1.DecryptSecretsBlobResponse"> & {
60+
/**
61+
* Decrypted environment variables (key -> plaintext value)
62+
*
63+
* @generated from field: map<string, string> env_vars = 1;
64+
*/
65+
envVars: { [key: string]: string };
66+
};
67+
68+
/**
69+
* Describes the message krane.v1.DecryptSecretsBlobResponse.
70+
* Use `create(DecryptSecretsBlobResponseSchema)` to create a new message.
71+
*/
72+
export const DecryptSecretsBlobResponseSchema: GenMessage<DecryptSecretsBlobResponse> = /*@__PURE__*/
73+
messageDesc(file_krane_v1_secrets, 1);
74+
75+
/**
76+
* SecretsService provides decrypted secrets to running workloads.
77+
* Called by the unkey-env binary injected into customer pods/containers.
78+
*
79+
* @generated from service krane.v1.SecretsService
80+
*/
81+
export const SecretsService: GenService<{
82+
/**
83+
* DecryptSecretsBlob decrypts an encrypted secrets blob passed in the pod spec.
84+
* This avoids DB lookups - the encrypted blob travels with the pod.
85+
* Authentication is via K8s service account token or DB-stored token.
86+
*
87+
* @generated from rpc krane.v1.SecretsService.DecryptSecretsBlob
88+
*/
89+
decryptSecretsBlob: {
90+
methodKind: "unary";
91+
input: typeof DecryptSecretsBlobRequestSchema;
92+
output: typeof DecryptSecretsBlobResponseSchema;
93+
},
94+
}> = /*@__PURE__*/
95+
serviceDesc(file_krane_v1_secrets, 0);
96+

‎apps/dashboard/lib/trpc/routers/deploy/env-vars/create.ts‎

Lines changed: 1 addition & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -50,7 +50,7 @@ export const createEnvVars = t.procedure
5050
const encryptedVars = await Promise.all(
5151
input.variables.map(async (v) => {
5252
const { encrypted } = await vault.encrypt({
53-
keyring: ctx.workspace.id,
53+
keyring: input.environmentId,
5454
data: v.value,
5555
});
5656

‎apps/dashboard/lib/trpc/routers/deploy/env-vars/decrypt.ts‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -35,6 +35,7 @@ export const decryptEnvVar = t.procedure
3535
id: true,
3636
value: true,
3737
type: true,
38+
environmentId: true,
3839
},
3940
});
4041

@@ -53,7 +54,7 @@ export const decryptEnvVar = t.procedure
5354
}
5455

5556
const { plaintext } = await vault.decrypt({
56-
keyring: ctx.workspace.id,
57+
keyring: envVar.environmentId,
5758
encrypted: envVar.value,
5859
});
5960

‎apps/dashboard/lib/trpc/routers/deploy/env-vars/update.ts‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -34,6 +34,7 @@ export const updateEnvVar = t.procedure
3434
id: true,
3535
type: true,
3636
key: true,
37+
environmentId: true,
3738
},
3839
});
3940

@@ -59,7 +60,7 @@ export const updateEnvVar = t.procedure
5960
}
6061

6162
const { encrypted } = await vault.encrypt({
62-
keyring: ctx.workspace.id,
63+
keyring: envVar.environmentId,
6364
data: input.value,
6465
});
6566

‎deployment/docker-compose.yaml‎

Lines changed: 1 addition & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -381,6 +381,7 @@ services:
381381
UNKEY_VAULT_S3_ACCESS_KEY_SECRET: "minio_root_password"
382382
UNKEY_VAULT_MASTER_KEYS: "Ch9rZWtfMmdqMFBJdVhac1NSa0ZhNE5mOWlLSnBHenFPENTt7an5MRogENt9Si6wms4pQ2XIvqNSIgNpaBenJmXgcInhu6Nfv2U="
383383
# ACME Vault - Let's Encrypt certificates
384+
UNKEY_ACME_VAULT_MASTER_KEYS: "Ch9rZWtfMmdqMFBJdVhac1NSa0ZhNE5mOWlLSnBHenFPENTt7an5MRogENt9Si6wms4pQ2XIvqNSIgNpaBenJmXgcInhu6Nfv2U="
384385
UNKEY_ACME_VAULT_S3_URL: "http://s3:3902"
385386
UNKEY_ACME_VAULT_S3_BUCKET: "acme-vault"
386387
UNKEY_ACME_VAULT_S3_ACCESS_KEY_ID: "minio_root_user"

‎go/.gitignore‎

Lines changed: 2 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -1,3 +1,4 @@
1-
unkey
1+
/unkey
2+
/unkey-env
23
# Added by goreleaser init:
34
dist/

‎go/Dockerfile.unkey-env‎

Lines changed: 10 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,10 @@
1+
# Minimal image for unkey-env binary
2+
# This image is injected as an init container into customer pods
3+
FROM alpine:3.19
4+
5+
# Add ca-certificates for HTTPS calls to krane
6+
RUN apk --no-cache add ca-certificates
7+
8+
COPY bin/unkey-env /unkey-env
9+
10+
ENTRYPOINT ["/unkey-env"]

0 commit comments

Comments
 (0)