Is the Global Secrets File feature still supported?

Drone Support
1

I would like to add an instance-wide secret variable but I can’t find them anywhere in the docs(except for Global Secrets File which is in 0.8.0, is the feature still available now?

We have a lot of organizations and not want to set the secret organization by organization.

2

The 0.8 secret file is supported through a secrets extension. Please see the following extension repository and readme for installation instructions: github.com/drone/drone-secret-plugin

1 Like
3

Apologies for the ignorance, I’m finally able to look into this issue and encountered the following problems:

After I work around these problems I am able to launch the application, however, I am unable to make the docker runner successfully query the secret I defined in the YAML file:

$ drone plugins secret get --repo internal/drone-ci --event tag gitlab_auth_token
(no output)

drone-runner-docker       | time="2021-09-26T01:40:20+08:00" level=trace msg="secret: external: no matching secret" kind=secret name=gitlab_auth_token thread=16

secrets.yml:

- name: gitlab_auth_token
  value: __REDACTED__
  repos: [] # Match all
  events:
    #- push
    - tag

docker-compose.yaml:

version: "3.7"
services:
  drone:
    container_name: drone
    hostname: drone
    image: drone/drone:2
    restart: always

    environment:
      DRONE_RPC_SECRET: __REDACTED__
      DRONE_SERVER_HOST: drone.itzxa.local
      DRONE_SERVER_PROTO: http

      DRONE_GITLAB_CLIENT_ID: __REDACTED__
      DRONE_GITLAB_CLIENT_SECRET: __REDACTED__
      DRONE_GITLAB_SERVER: https://gitlab.itzxa.local
      DRONE_GITLAB_SKIP_VERIFY: "true"
      DRONE_GIT_ALWAYS_AUTH: "true"

      DRONE_USER_CREATE: 'username:brlin,admin:true'

    ports:
      - "80:80"

    volumes:
      - type: bind
        source: /etc/localtime
        target: /etc/localtime
        read_only: True
      - ./data:/data

  drone-secret-extension:
    container_name: drone-secret-extension
    hostname: drone-secret-extension
    #image: drone/secret-plugin
    build:
      context: ./drone-secret-plugin
    environment:
      DRONE_DEBUG: 'true'
      DRONE_SECRET: __REDACTED__
      DRONE_SECRET_FILE: /etc/secrets.yml
    restart: always
    volumes:
      - type: bind
        source: /etc/localtime
        target: /etc/localtime
        read_only: True
      - type: bind
        source: ./secrets.yml
        target: /etc/secrets.yml
        read_only: True

  drone-runner-docker:
    container_name: drone-runner-docker
    hostname: drone-runner-docker
    image: drone/drone-runner-docker:1
    restart: always

    environment:
      DRONE_RPC_HOST: drone.itzxa.local
      DRONE_RPC_PROTO: http
      DRONE_RPC_SECRET: __REDACTED__

      DRONE_RUNNER_CAPACITY: 16
      DRONE_RUNNER_NAME: docker

      DRONE_UI_USERNAME: root
      DRONE_UI_PASSWORD: __REDACTED__

      DRONE_SECRET_PLUGIN_ENDPOINT: http://drone-secret-extension:3000
      DRONE_SECRET_PLUGIN_SECRET: __REDACTED__

      #DRONE_LOGS_DEBUG: 'false'
      #DRONE_TRACE: 'false'

    ports:
      # dashboard web interface
      - "8081:3000"

    volumes:
      - type: bind
        source: /etc/localtime
        target: /etc/localtime
        read_only: True
      - type: bind
        source: /var/run/docker.sock
        target: /var/run/docker.sock

    depends_on:
      - drone
      - drone-secret-extension
4

Hello, I’d still like to progress this issue, assistance will be appreciated.