Skip to content

Commit 76bc287

Browse files
committed
fix(*): set etcd keys safely in /bin/boot
Each etcd configuration key should be set-if-unset. Previously, we were setting all of these defaults if one directory existed, but it's safer to set each one individually if it is unset.
1 parent e08abf6 commit 76bc287

1 file changed

Lines changed: 10 additions & 7 deletions

File tree

bin/boot

Lines changed: 10 additions & 7 deletions
Original file line numberDiff line numberDiff line change
@@ -24,13 +24,16 @@ done
2424
# wait until etcd has discarded potentially stale values
2525
sleep $(($ETCD_TTL+1))
2626

27-
# seed initial service configuration if necessary
28-
if ! etcdctl --no-sync -C $ETCD ls $ETCD_PATH >/dev/null 2>&1; then
29-
etcdctl --no-sync -C $ETCD set $ETCD_PATH/protocol ${DEIS_PROTOCOL:-http} >/dev/null
30-
etcdctl --no-sync -C $ETCD set $ETCD_PATH/secretKey ${DEIS_SECRET_KEY:-`openssl rand -base64 64 | tr -d '\n'`} >/dev/null
31-
etcdctl --no-sync -C $ETCD set $ETCD_PATH/builderKey ${DEIS_BUILDER_KEY:-`openssl rand -base64 64 | tr -d '\n'`} >/dev/null
32-
etcdctl --no-sync -C $ETCD set $ETCD_PATH/registrationEnabled 1 >/dev/null
33-
fi
27+
function etcd_safe_set {
28+
if ! etcdctl --no-sync -C $ETCD get $ETCD_PATH/$1 >/dev/null 2>&1; then
29+
etcdctl --no-sync -C $ETCD set $ETCD_PATH/$1 $2 >/dev/null
30+
fi
31+
}
32+
33+
etcd_safe_set protocol ${DEIS_PROTOCOL:-http}
34+
etcd_safe_set secretKey ${DEIS_SECRET_KEY:-`openssl rand -base64 64 | tr -d '\n'`}
35+
etcd_safe_set builderKey ${DEIS_BUILDER_KEY:-`openssl rand -base64 64 | tr -d '\n'`}
36+
etcd_safe_set registrationEnabled 1
3437

3538
# wait for confd to run once and install initial templates
3639
until confd -onetime -node $ETCD -config-file /app/confd.toml 2>/dev/null; do

0 commit comments

Comments
 (0)