posit-dev / publisher

MIT License
5 stars 0 forks source link

Secrets and Environment collision #2326

Closed kgartland-rstudio closed 1 month ago

kgartland-rstudio commented 1 month ago

If I have a config that includes both a Secret an Environment Variable with the same name, Secret wins. If I then go to redeploy the Environment variable will win because we clear out the Secret after the initial deployment.

This could lead to some confusion. Can we add some validation to ensure Secrets and Environment cannot contain the same name?

Example config:

# Configuration file generated by Posit Publisher.
# Please review and modify as needed. See the documentation for more options:
# https://github.com/posit-dev/publisher/blob/main/docs/configuration.md
'$schema' = 'https://cdn.posit.co/publisher/schemas/posit-publishing-schema-v3.json'
type = 'python-fastapi'
entrypoint = 'simple.py'
validate = true
files = [
  '/simple.py',
  '/requirements.txt'
]
title = 'fastapi-simple'
secrets = ['secret1', 'secret2', 'secret3']

[environment]
secret3="environment"

[python]
version = '3.11.4'
package_file = 'requirements.txt'
package_manager = 'pip'
dotNomad commented 1 month ago

I'm thinking a combination of two changes could be very helpful here:

  1. When using the UI, change the add behavior to prevent adding a secret with the same name as an environment variable, or visa versa.

  2. When the selected Configuration has Secret / Env Var collision show a warning and potentially disable the deploy button (look to other behavior to keep it consistent).