Fix: manage v3 secret from docker entrypoint

CHANGELOG.md

@@ -11,6 +11,7 @@
   - Implemented automatic data migration from Bitnami deployments (PVC reuse)
   - Enabled AOF persistence by default for data durability
 - add CounterBasedGauge64 and ZeroBasedCounter64 as metrics types
+- manage snmpv3 secrets for docker compose from docker entrypoint
 
 ### Fixes
 - fix problem with service rendering when `traps.service.usemetallb` is set to false

Dockerfile

@@ -23,6 +23,8 @@ RUN poetry config virtualenvs.in-project true ;\
 FROM base AS final
 
 RUN mkdir /.pysnmp && chown 10001:10001 /.pysnmp
+COPY docker_scripts/manage_secrets.py /app/secrets/
+RUN chown 10001:10001 /app/secrets/
 RUN chown 10001:10001 /tmp
 COPY --from=builder /app/.venv /app/.venv
 COPY entrypoint.sh /app/entrypoint.sh

docker_compose/.env

@@ -6,6 +6,7 @@ TRAPS_CONFIG_FILE_ABSOLUTE_PATH=
 INVENTORY_FILE_ABSOLUTE_PATH=
 COREFILE_ABS_PATH=
 LOCAL_MIBS_PATH="./local_mibs"
+SECRET_FOLDER_PATH="./secrets"
 SC4SNMP_VERSION="1.14.2-beta.8"
 
 # Network configuration
@@ -64,6 +65,7 @@ WORKER_POLLER_CPU_LIMIT=1
 WORKER_POLLER_MEMORY_LIMIT=500M
 WORKER_POLLER_CPU_RESERVATIONS=0.5
 WORKER_POLLER_MEMORY_RESERVATIONS=250M
+ENABLE_WORKER_POLLER_SECRETS=false
 
 # Worker Sender
 WORKER_SENDER_CONCURRENCY=4
@@ -97,10 +99,9 @@ TRAPS_PORT=162
 TRAP_LOG_LEVEL=INFO
 TRAP_DISABLE_MONGO_DEBUG_LOGGING=true
 INCLUDE_SECURITY_CONTEXT_ID=false
+ENABLE_TRAPS_SECRETS=false
 
 # Scheduler configuration
 SCHEDULER_LOG_LEVEL=INFO
 
-FLOWER_PORT=80
-
-#Secrets
+FLOWER_PORT=80

docker_compose/docker-compose.yaml

@@ -148,6 +148,7 @@ services:
       LOG_LEVEL: ${TRAP_LOG_LEVEL:-INFO}
       SNMP_V3_SECURITY_ENGINE_ID: ${SNMP_V3_SECURITY_ENGINE_ID:-80003a8c04}
       DISABLE_MONGO_DEBUG_LOGGING: ${TRAP_DISABLE_MONGO_DEBUG_LOGGING:-true}
+      ENABLE_TRAPS_SECRETS: ${ENABLE_TRAPS_SECRETS:-false}
     image: ${SC4SNMP_IMAGE}:${SC4SNMP_TAG:-latest}
     ports:
     - mode: host
@@ -158,6 +159,7 @@ services:
     - ${TRAPS_CONFIG_FILE_ABSOLUTE_PATH}:/app/config/config.yaml:ro
     - traps-pysnmp-cache-volume:/.pysnmp/:rw
     - traps-tmp:/tmp/:rw
+    - ${SECRET_FOLDER_PATH}:/app/secrets/tmp:ro
   worker-poller:
     <<: [*dns_and_networks, *dependency_and_restart_policy]
     image: ${SC4SNMP_IMAGE}:${SC4SNMP_TAG:-latest}
@@ -179,10 +181,12 @@ services:
         *pysnmp_debug, *ipv6]
       WORKER_CONCURRENCY: ${WORKER_POLLER_CONCURRENCY:-2}
       PREFETCH_COUNT: ${PREFETCH_POLLER_COUNT:-1}
+      ENABLE_WORKER_POLLER_SECRETS: ${ENABLE_WORKER_POLLER_SECRETS:-false}
     volumes:
     - ${SCHEDULER_CONFIG_FILE_ABSOLUTE_PATH}:/app/config/config.yaml:ro
     - worker-poller-pysnmp-cache-volume:/.pysnmp/:rw
     - worker-poller-tmp:/tmp/:rw
+    - ${SECRET_FOLDER_PATH}:/app/secrets/tmp:ro
   worker-sender:
     <<: [*dns_and_networks, *dependency_and_restart_policy]
     image: ${SC4SNMP_IMAGE}:${SC4SNMP_TAG:-latest}