...
Properties can be used to set flags and values that should change when building on a different machine. This allows local builds to interact with separate databases, worker queues, etc. from production and staging builds. This can also make local builds more lightweight (by setting certain features to only enable in production). Secrets provide similar benefits, but additionally restrict access to critical information such as credentials.
Adding a property or secret
The easiest way to set the default value of a property or secret is to add it to the stack.properties file.
| Note |
|---|
The stack.properties file is tracked in Git, so don't commit any secrets to this file! |
Once added to stack.properties, add a getter method to the StackConfiguration interface in lib/stackConfiguration and according implementation(s).
If the property is not a secret, the StackConfiguration implementation may simply use ConfigurationProperties.getProperty() to retrieve the property.
If the property is a secret, you should use ConfigurationProperties.getDecryptedProperty() to retrieve the property, as retrieved secrets will be encrypted.
Storing secret values
We use AWS Secrets Manager to store and retrieve secrets in production. Thus, secrets in production must be retrieved from the Secrets Manager. To add a secret to the Secret Manager, give an AWS administrator (currently Xavier Schildwachter) the property name and value (or how to generate or retrieve the value).
| Warning |
|---|
In most circumstances, developers should not have access to secrets, so you should rarely be able to directly give an administrator the secret. |
Overriding a property or a secret from the command line
...
And configure the build on Jenkins to export the property value into org_sagebionetworks_my_property_name:
| Code Block | ||||
|---|---|---|---|---|
| ||||
export user=pUser
export org_sagebionetworks_stack_iam_id=<id>
export org_sagebionetworks_stack_iam_key=<key>
export org_sagebionetworks_stackEncryptionKey=<key>
export rds_password=<pwd>
export github_token=<token>
export org_sagebionetworks_my_property_name=myValueForAutomatedBuilds
/var/lib/jenkins/workspace/${JOB_NAME}/jenkins_build.sh |
Adding a property
In progress
Adding a secret
...
Hierarchy of Properties and Secrets
In progress
Using the stack builder to override properties in prod
...