{"action":"created","issue":{"url":"https://api.github.com/repos/openfaas/faas/issues/521","repository_url":"https://api.github.com/repos/openfaas/faas","labels_url":"https://api.github.com/repos/openfaas/faas/issues/521/labels{/name}","comments_url":"https://api.github.com/repos/openfaas/faas/issues/521/comments","events_url":"https://api.github.com/repos/openfaas/faas/issues/521/events","html_url":"https://github.com/openfaas/faas/issues/521","id":298026420,"number":521,"title":"Docker Swarm secret not available to function on remote system","user":{"login":"lucasalexander","id":95673,"avatar_url":"https://avatars3.githubusercontent.com/u/95673?v=4","gravatar_id":"","url":"https://api.github.com/users/lucasalexander","html_url":"https://github.com/lucasalexander","followers_url":"https://api.github.com/users/lucasalexander/followers","following_url":"https://api.github.com/users/lucasalexander/following{/other_user}","gists_url":"https://api.github.com/users/lucasalexander/gists{/gist_id}","starred_url":"https://api.github.com/users/lucasalexander/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/lucasalexander/subscriptions","organizations_url":"https://api.github.com/users/lucasalexander/orgs","repos_url":"https://api.github.com/users/lucasalexander/repos","events_url":"https://api.github.com/users/lucasalexander/events{/privacy}","received_events_url":"https://api.github.com/users/lucasalexander/received_events","type":"User","site_admin":false},"labels":[],"state":"open","locked":false,"assignee":null,"assignees":[],"milestone":null,"comments":7,"created_at":"2018-02-17T18:41:14Z","updated_at":"2018-02-18T09:34:02Z","closed_at":null,"author_association":"NONE","body":"I have created a secret and granted my function access to it when deploying with faas-cli, and this works in my local environment (Docker 17.12-ce on Windows). When I deploy to my remote system (Docker 17.12-ce on Debian Linux 9), the secret is not available to the function.\r\n\r\n## Expected Behaviour\r\nThe secret should be available to the function in my remote instance.\r\n\r\n## Current Behaviour\r\nI deploy using this command: .\\faas-cli.exe deploy -f .\\python3-rabbit-crm-client.yml --secret rabbitsecrets\r\n\r\nWhen I inspect the python3-rabbit-crm-client service on my local instance, I see the secret in the task template:\r\n```\r\n\"TaskTemplate\": {\r\n    \"ContainerSpec\": {\r\n        \"Image\": \"lucasalexander/python3-rabbit-crm-client:latest\",\r\n        \"Labels\": {\r\n            \"com.openfaas.function\": \"python3-rabbit-crm-client\",\r\n            \"com.openfaas.uid\": \"173409400\",\r\n            \"function\": \"true\"\r\n        },\r\n        \"Env\": [\r\n            \"fprocess=python3 index.py\"\r\n        ],\r\n        \"StopGracePeriod\": 10000000000,\r\n        \"DNSConfig\": {},\r\n        \"Secrets\": [\r\n            {\r\n                \"File\": {\r\n                    \"Name\": \"rabbitsecrets\",\r\n                    \"UID\": \"0\",\r\n                    \"GID\": \"0\",\r\n                    \"Mode\": 292\r\n                },\r\n                \"SecretID\": \"gbry69xf5eu90h8asbcrp3gsz\",\r\n                \"SecretName\": \"rabbitsecrets\"\r\n            }\r\n        ],\r\n        \"Isolation\": \"default\"\r\n    },\r\n    \"Resources\": {},\r\n    \"RestartPolicy\": {\r\n        \"Condition\": \"any\",\r\n        \"Delay\": 5000000000,\r\n        \"MaxAttempts\": 5\r\n    },\r\n    \"Placement\": {\r\n        \"Constraints\": [\r\n            \"node.platform.os == linux\"\r\n        ]\r\n    },\r\n    \"Networks\": [\r\n        {\r\n            \"Target\": \"vor6lx717vhtr1st3s6zr3pst\"\r\n        }\r\n    ],\r\n    \"ForceUpdate\": 0,\r\n    \"Runtime\": \"container\"\r\n},\r\n```\r\n\r\nWhen I inspect the service on my remote instance, the secret is not listed in the task template:\r\n```\r\n\"TaskTemplate\": {\r\n\t\"ContainerSpec\": {\r\n\t\t\"Image\": \"lucasalexander/python3-rabbit-crm-client\",\r\n\t\t\"Labels\": {\r\n\t\t\t\"com.openfaas.function\": \"python3-rabbit-crm-client\",\r\n\t\t\t\"function\": \"true\"\r\n\t\t},\r\n\t\t\"Env\": [\r\n\t\t\t\"fprocess=python3 index.py\"\r\n\t\t],\r\n\t\t\"StopGracePeriod\": 10000000000,\r\n\t\t\"DNSConfig\": {},\r\n\t\t\"Isolation\": \"default\"\r\n\t},\r\n\t\"Resources\": {},\r\n\t\"RestartPolicy\": {\r\n\t\t\"Condition\": \"any\",\r\n\t\t\"Delay\": 5000000000,\r\n\t\t\"MaxAttempts\": 5\r\n\t},\r\n\t\"Placement\": {\r\n\t\t\"Constraints\": [\r\n\t\t\t\"node.platform.os == linux\"\r\n\t\t]\r\n\t},\r\n\t\"Networks\": [\r\n\t\t{\r\n\t\t\t\"Target\": \"15k7arichvdo2s1zc8u59p6ee\"\r\n\t\t}\r\n\t],\r\n\t\"ForceUpdate\": 0,\r\n\t\"Runtime\": \"container\"\r\n},\r\n```\r\nI have verified the secret exists on the remote system using \"secret inspect rabbitsecrets.\"\r\n\r\n## Possible Solution\r\n<!--- Not obligatory, but suggest a fix/reason for the bug, -->\r\n<!--- or ideas how to implement the addition or change -->\r\n\r\n## Steps to Reproduce (for bugs)\r\n<!--- Provide a link to a live example, or an unambiguous set of steps to -->\r\n<!--- reproduce this bug. Include code to reproduce, if relevant -->\r\n1. Create secret\r\n2. Create function that reads secret\r\n3. Build function\r\n4. Push function\r\n5. Deploy function with access to secret\r\n6. Run function (works on localhost, throws error on remote)\r\n\r\n## Context\r\nI need to allow the function to access secured resources with a username and password.\r\n\r\n## Your Environment\r\n<!--- Include as many relevant details about the environment you experienced the bug in -->\r\n* Docker version `docker version` (e.g. Docker 17.0.05 ): 17.12.0-ce\r\n\r\n* Are you using Docker Swarm or Kubernetes (FaaS-netes)? Swarm\r\n\r\n* Operating System and version (e.g. Linux, Windows, MacOS): Debian Linux 9\r\n\r\n* Link to your project or a code example to reproduce issue:\r\nhttps://hub.docker.com/r/lucasalexander/python3-rabbit-crm-client/\r\n\r\n```\r\nimport sys\r\nimport pika\r\nimport uuid\r\nimport datetime\r\nimport json\r\n\r\n\r\ndef get_secret(secret_name):\r\n    try:\r\n        with open('/run/secrets/{0}'.format(secret_name), 'r') as secret_file:\r\n            return secret_file.read()\r\n    except IOError:\r\n        return None\r\n\r\nclass CrmRpcClient(object):\r\n    def __init__(self):\r\n        print(get_secret('rabbitsecrets'))\r\n        #i've removed logic beyond this point where it fails to retrieve the secret\r\n\r\ndef handle(req):\r\n    #instantiate an rpc client\r\n    crm_rpc = CrmRpcClient()\r\n```\r\n\r\n* Please also follow the [troubleshooting guide](https://github.com/openfaas/faas/blob/master/guide/troubleshooting.md) and paste in any other diagnostic information you have:\r\n\r\n"},"comment":{"url":"https://api.github.com/repos/openfaas/faas/issues/comments/366503386","html_url":"https://github.com/openfaas/faas/issues/521#issuecomment-366503386","issue_url":"https://api.github.com/repos/openfaas/faas/issues/521","id":366503386,"user":{"login":"alexellis","id":6358735,"avatar_url":"https://avatars1.githubusercontent.com/u/6358735?v=4","gravatar_id":"","url":"https://api.github.com/users/alexellis","html_url":"https://github.com/alexellis","followers_url":"https://api.github.com/users/alexellis/followers","following_url":"https://api.github.com/users/alexellis/following{/other_user}","gists_url":"https://api.github.com/users/alexellis/gists{/gist_id}","starred_url":"https://api.github.com/users/alexellis/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/alexellis/subscriptions","organizations_url":"https://api.github.com/users/alexellis/orgs","repos_url":"https://api.github.com/users/alexellis/repos","events_url":"https://api.github.com/users/alexellis/events{/privacy}","received_events_url":"https://api.github.com/users/alexellis/received_events","type":"User","site_admin":false},"created_at":"2018-02-18T09:34:02Z","updated_at":"2018-02-18T09:34:02Z","author_association":"OWNER","body":"This is me using a Linux client against the play-with-docker.com environment.\r\n\r\nPerhaps you could try this too?\r\n\r\n```\r\nprovider:\r\n  name: faas\r\n  gateway: http://ip172-18-0-11-ba4keesa77ug00fmqr4g-8080.direct.labs.play-with-docker.com:8080\r\n\r\nfunctions:\r\n  secrets:\r\n    lang: python\r\n    handler: ./secrets\r\n    image: alexellis2/test-secrets\r\n    secrets:\r\n     - rabbitsecrets\r\n```\r\n\r\n![screenshot-pwd-admin](https://user-images.githubusercontent.com/6358735/36350332-cb4f4252-148e-11e8-843d-35877c5f7ece.png)\r\n![screenshot-success-pwd](https://user-images.githubusercontent.com/6358735/36350333-cb6f7f68-148e-11e8-8d8d-5d859aa80957.png)\r\n\r\nI don't have easy access to Windows machines but maybe @johnmccabe or @itscaro could try to repro?\r\n"}}
{"actor":{"display_login":"alexellis"}}