Portainer Docker Swarm导入秘密撰写

Question

add Secrets in Portainer swarm，并尝试将其作为变量导入。任何人都可以给出示例，我如何导入它以合成

version: '3.1'

services:
  mongodb-sharded:
    image: docker.io/bitnami/mongodb-sharded:4.4
    environment:
      - MONGODB_ADVERTISED_HOSTNAME=mongodb-sharded
      - MONGODB_SHARDING_MODE=mongos
      - MONGODB_CFG_PRIMARY_HOST=mongodb-cfg-primary
      - MONGODB_CFG_REPLICA_SET_NAME=cfgreplicaset
      - MONGODB_REPLICA_SET_KEY=${MONGODB_KEY}
      - MONGODB_ROOT_PASSWORD=${MONGODB_PASSWORD}
    ports:
      - "27017:27017"

Answer 1

Docker secrets将作为文件在/run/secrets/secret-name下的容器中挂载(如果未指定显式挂载点)。要使用它，应用程序必须能够从这些文件中读取数据。这并不总是被支持。如果有什么不同的话，通常只有一小部分可用变量可以指定为file。

官方的Docker mongodb Image声明只支持MONGO_INITDB_ROOT_USERNAME_FILE和MONGO_INITDB_ROOT_PASSWORD_FILE。

bitnami/mongodb分片图像的自述文件没有提供任何信息，无论是否支持docker密钥。

带有为官方图像预先定义的秘密的合成文件将如下所示：

version: '3.1'

services:

  mongo:
    image: mongo
    restart: always
    environment:
      MONGO_INITDB_ROOT_USERNAME_FILE: /run/secrets/mongodb-root-username
      MONGO_INITDB_ROOT_PASSWORD_FILE: /run/secrets/mongodb-root-password
    secrets:
      - mongodb-root-username
      - mongodb-root-password

  secrets:
    mongodb-root-username:
      external: true
    mongodb-root-password:
      external: true

Answer 2

使用运行mongodb分片的portariner Docker Swarm Secret

version: '3.7'

secrets:
    mongo-root-password:
      external: true
    mongo-key:
      external: true
  

services:
  mongodb-sharded:
    image: docker.io/bitnami/mongodb-sharded:4.4
    environment:
      - MONGODB_ADVERTISED_HOSTNAME=mongodb-sharded
      - MONGODB_SHARDING_MODE=mongos
      - MONGODB_CFG_PRIMARY_HOST=mongodb-cfg-primary
      - MONGODB_CFG_REPLICA_SET_NAME=cfgreplicaset
      - MONGODB_REPLICA_SET_KEY_FILE=/run/secrets/mongo-key
      - MONGODB_ROOT_PASSWORD_FILE=/run/secrets/mongo-root-password
    ports:
      - "27017:27017"
    secrets:
      - mongo-key
      - mongo-root-password

  mongodb-sharded-2:
    image: docker.io/bitnami/mongodb-sharded:4.4
    environment:
      - MONGODB_ADVERTISED_HOSTNAME=mongodb-sharded-2
      - MONGODB_SHARDING_MODE=mongos
      - MONGODB_CFG_PRIMARY_HOST=mongodb-cfg-primary
      - MONGODB_CFG_REPLICA_SET_NAME=cfgreplicaset
      - MONGODB_REPLICA_SET_KEY_FILE=/run/secrets/mongo-key
      - MONGODB_ROOT_PASSWORD_FILE=/run/secrets/mongo-root-password
    secrets:
      - mongo-key
      - mongo-root-password

  mongodb-shard0-primary:
    image: docker.io/bitnami/mongodb-sharded:4.4
    environment:
      - MONGODB_ADVERTISED_HOSTNAME=mongodb-shard0-primary
      - MONGODB_SHARDING_MODE=shardsvr
      - MONGODB_MONGOS_HOST=mongodb-sharded
      - MONGODB_ROOT_PASSWORD_FILE=/run/secrets/mongo-root-password
      - MONGODB_REPLICA_SET_MODE=primary
      - MONGODB_REPLICA_SET_KEY_FILE=/run/secrets/mongo-key
      - MONGODB_REPLICA_SET_NAME=shard0
    volumes:
      - 'shard0_data:/bitnami'
    secrets:
      - mongo-key
      - mongo-root-password

  mongodb-shard0-secondary:
    image: docker.io/bitnami/mongodb-sharded:4.4
    depends_on:
      - mongodb-shard0-primary
    environment:
      - MONGODB_ADVERTISED_HOSTNAME=mongodb-shard0-secondary
      - MONGODB_REPLICA_SET_MODE=secondary
      - MONGODB_PRIMARY_HOST=mongodb-shard0-primary
      - MONGODB_PRIMARY_ROOT_PASSWORD_FILE=/run/secrets/mongo-root-password
      - MONGODB_REPLICA_SET_KEY_FILE=/run/secrets/mongo-key
      - MONGODB_SHARDING_MODE=shardsvr
      - MONGODB_REPLICA_SET_NAME=shard0
    volumes:
      - 'shard0_sec_data:/bitnami'
    secrets:
      - mongo-key
      - mongo-root-password

  mongodb-shard1-primary:
    image: docker.io/bitnami/mongodb-sharded:4.4
    environment:
      - MONGODB_ADVERTISED_HOSTNAME=mongodb-shard1-primary
      - MONGODB_SHARDING_MODE=shardsvr
      - MONGODB_MONGOS_HOST=mongodb-sharded
      - MONGODB_ROOT_PASSWORD_FILE=/run/secrets/mongo-root-password
      - MONGODB_REPLICA_SET_MODE=primary
      - MONGODB_REPLICA_SET_KEY_FILE=/run/secrets/mongo-key
      - MONGODB_REPLICA_SET_NAME=shard1
    volumes:
      - 'shard1_data:/bitnami'
    secrets:
      - mongo-key
      - mongo-root-password

  mongodb-shard1-secondary:
    image: docker.io/bitnami/mongodb-sharded:4.4
    depends_on:
      - mongodb-shard1-primary
    environment:
      - MONGODB_ADVERTISED_HOSTNAME=mongodb-shard1-secondary
      - MONGODB_REPLICA_SET_MODE=secondary
      - MONGODB_PRIMARY_HOST=mongodb-shard1-primary
      - MONGODB_PRIMARY_ROOT_PASSWORD_FILE=/run/secrets/mongo-root-password
      - MONGODB_REPLICA_SET_KEY_FILE=/run/secrets/mongo-key
      - MONGODB_SHARDING_MODE=shardsvr
      - MONGODB_REPLICA_SET_NAME=shard1
    volumes:
      - 'shard1_sec_data:/bitnami'
    secrets:
      - mongo-key
      - mongo-root-password

  mongodb-shard2-primary:
    image: docker.io/bitnami/mongodb-sharded:4.4
    environment:
      - MONGODB_ADVERTISED_HOSTNAME=mongodb-shard2-primary
      - MONGODB_SHARDING_MODE=shardsvr
      - MONGODB_MONGOS_HOST=mongodb-sharded
      - MONGODB_ROOT_PASSWORD_FILE=/run/secrets/mongo-root-password
      - MONGODB_REPLICA_SET_MODE=primary
      - MONGODB_REPLICA_SET_KEY_FILE=/run/secrets/mongo-key
      - MONGODB_REPLICA_SET_NAME=shard2
    volumes:
      - 'shard2_data:/bitnami'
    secrets:
      - mongo-key
      - mongo-root-password

  mongodb-shard2-secondary:
    image: docker.io/bitnami/mongodb-sharded:4.4
    depends_on:
      - mongodb-shard2-primary
    environment:
      - MONGODB_ADVERTISED_HOSTNAME=mongodb-shard2-secondary
      - MONGODB_REPLICA_SET_MODE=secondary
      - MONGODB_PRIMARY_HOST=mongodb-shard2-primary
      - MONGODB_PRIMARY_ROOT_PASSWORD_FILE=/run/secrets/mongo-root-password
      - MONGODB_REPLICA_SET_KEY_FILE=/run/secrets/mongo-key
      - MONGODB_SHARDING_MODE=shardsvr
      - MONGODB_REPLICA_SET_NAME=shard2
    volumes:
      - 'shard2_sec_data:/bitnami'
    secrets:
      - mongo-key
      - mongo-root-password

  mongodb-cfg-primary:
    image: docker.io/bitnami/mongodb-sharded:4.4
    environment:
      - MONGODB_ADVERTISED_HOSTNAME=mongodb-cfg-primary
      - MONGODB_SHARDING_MODE=configsvr
      - MONGODB_ROOT_PASSWORD_FILE=/run/secrets/mongo-root-password
      - MONGODB_REPLICA_SET_MODE=primary
      - MONGODB_REPLICA_SET_KEY_FILE=/run/secrets/mongo-key
      - MONGODB_REPLICA_SET_NAME=cfgreplicaset
    volumes:
      - 'cfg_data:/bitnami'
    secrets:
      - mongo-key
      - mongo-root-password

  mongodb-cfg-secondary:
    image: docker.io/bitnami/mongodb-sharded:4.4
    depends_on:
      - mongodb-cfg-primary
    environment:
      - MONGODB_ADVERTISED_HOSTNAME=mongodb-cfg-secondary
      - MONGODB_REPLICA_SET_MODE=secondary
      - MONGODB_PRIMARY_HOST=mongodb-cfg-primary
      - MONGODB_PRIMARY_ROOT_PASSWORD_FILE=/run/secrets/mongo-root-password
      - MONGODB_REPLICA_SET_KEY_FILE=/run/secrets/mongo-key
      - MONGODB_REPLICA_SET_NAME=cfgreplicaset
      - MONGODB_SHARDING_MODE=configsvr
    volumes:
      - 'cfg_sec_data:/bitnami'
    secrets:
      - mongo-key
      - mongo-root-password

volumes:
  shard0_data:
    driver: local
  shard0_sec_data:
    driver: local
  shard1_data:
    driver: local
  shard1_sec_data:
    driver: local
  shard2_data:
    driver: local
  shard2_sec_data:
    driver: local
  cfg_data:
    driver: local
  cfg_sec_data:
    driver: local