Skip to content

Commit 2256b92

Browse files
nicksnicks
authored
provider: add password back (#78)
fixes #77 Signed-off-by: Nick Santos <[email protected]>
1 parent 94c7737 commit 2256b92

File tree

2 files changed

+142
-12
lines changed

2 files changed

+142
-12
lines changed

‎docs/index.md

+80-7
Original file line numberDiff line numberDiff line change
@@ -28,21 +28,51 @@ description: |-
2828
2929
Authentication
3030
We have multiple ways to set your Docker credentials.
31-
Setting credentials
32-
Use docker login to log in to aregistry https://docs.docker.com/reference/cli/docker/login/. The docker CLI
31+
Setting credentials with docker login
32+
To login in an interactive command-line:
33+
34+
docker login
35+
36+
To login in a non-interactive script:
37+
38+
cat ~/my_password.txt | docker login --username my-username --password-stdin
39+
40+
The docker CLI
3341
will store your credentials securely in your credential store, such as the
3442
operating system native keychain. The Docker Terraform provider will
3543
use these credentials automatically.
44+
Setting credentials in CI
45+
The Docker Terraform provider will work with your CI provider's
46+
native Docker login action. For example, in GitHub Actions https://github.com/marketplace/actions/docker-login:
3647
37-
cat ~/my_password.txt | docker login --username my-username --password-stdin
48+
jobs:
49+
login:
50+
runs-on: ubuntu-latest
51+
steps:
52+
- name: Login to Docker Hub
53+
uses: docker/login-action@v3
54+
with:
55+
username: ${{ vars.DOCKERHUB_USERNAME }}
56+
password: ${{ secrets.DOCKERHUB_TOKEN }}
3857
58+
Setting credentials with environment variables
3959
If you'd like to use a different account for running the provider,
4060
you can set credentials in the environment:
4161
4262
export DOCKER_USERNAME=my-username
4363
export DOCKER_PASSWORD=my-secret-token
4464
terraform plan ...
4565
66+
Setting credentials in Terraform (NOT RECOMMENDED)
67+
[!WARNING]Hard-coding secrets in Terraform is risky. You risk leaking the secretsif they're committed to version control.
68+
Only pass in a password in Terraform if you're pulling the secret from a secure
69+
location, or if you're doing local testing.
70+
71+
provider "docker" {
72+
username = "my-username"
73+
password = "my-secret-token"
74+
}
75+
4676
Credential types
4777
You can create a personal access token (PAT) to use as an alternative to your
4878
password for Docker CLI authentication.
@@ -90,18 +120,44 @@ resource "docker_repository" "example" {
90120

91121
We have multiple ways to set your Docker credentials.
92122

93-
### Setting credentials
123+
### Setting credentials with `docker login`
124+
125+
To login in an interactive command-line:
126+
127+
```
128+
docker login
129+
```
130+
131+
To login in a non-interactive script:
132+
133+
```
134+
cat ~/my_password.txt | docker login --username my-username --password-stdin
135+
```
94136

95-
Use `docker login` to [log in to a
96-
registry](https://docs.docker.com/reference/cli/docker/login/). The `docker` CLI
137+
The `docker` CLI
97138
will store your credentials securely in your credential store, such as the
98139
operating system native keychain. The Docker Terraform provider will
99140
use these credentials automatically.
100141

142+
### Setting credentials in CI
143+
144+
The Docker Terraform provider will work with your CI provider's
145+
native Docker login action. For example, in [GitHub Actions](https://github.com/marketplace/actions/docker-login):
146+
101147
```
102-
cat ~/my_password.txt | docker login --username my-username --password-stdin
148+
jobs:
149+
login:
150+
runs-on: ubuntu-latest
151+
steps:
152+
- name: Login to Docker Hub
153+
uses: docker/login-action@v3
154+
with:
155+
username: ${{ vars.DOCKERHUB_USERNAME }}
156+
password: ${{ secrets.DOCKERHUB_TOKEN }}
103157
```
104158

159+
### Setting credentials with environment variables
160+
105161
If you'd like to use a different account for running the provider,
106162
you can set credentials in the environment:
107163

@@ -111,6 +167,22 @@ export DOCKER_PASSWORD=my-secret-token
111167
terraform plan ...
112168
```
113169

170+
### Setting credentials in Terraform (NOT RECOMMENDED)
171+
172+
> [!WARNING]
173+
> Hard-coding secrets in Terraform is risky. You risk leaking the secrets
174+
> if they're committed to version control.
175+
176+
Only pass in a password in Terraform if you're pulling the secret from a secure
177+
location, or if you're doing local testing.
178+
179+
```hcl
180+
provider "docker" {
181+
username = "my-username"
182+
password = "my-secret-token"
183+
}
184+
```
185+
114186
### Credential types
115187

116188
You can create a personal access token (PAT) to use as an alternative to your
@@ -134,4 +206,5 @@ this provider to manage organizations and teams, you will need to authenticate
134206
### Optional
135207

136208
- `host` (String) Docker Hub API Host. Default is `hub.docker.com`.
209+
- `password` (String, Sensitive) Password for authentication
137210
- `username` (String) Username for authentication

‎internal/provider/provider.go

+62-5
Original file line numberDiff line numberDiff line change
@@ -60,6 +60,7 @@ type DockerProvider struct {
6060
// DockerProviderModel describes the provider data model.
6161
type DockerProviderModel struct {
6262
Username types.String `tfsdk:"username"`
63+
Password types.String `tfsdk:"password"`
6364
Host types.String `tfsdk:"host"`
6465
}
6566

@@ -105,18 +106,44 @@ resource "docker_repository" "example" {
105106
106107
We have multiple ways to set your Docker credentials.
107108
108-
### Setting credentials
109+
### Setting credentials with ` + "`docker login`" + `
109110
110-
Use ` + "`docker login`" + ` to [log in to a
111-
registry](https://docs.docker.com/reference/cli/docker/login/). The ` + "`docker`" + ` CLI
111+
To login in an interactive command-line:
112+
113+
` + "```" + `
114+
docker login
115+
` + "```" + `
116+
117+
To login in a non-interactive script:
118+
119+
` + "```" + `
120+
cat ~/my_password.txt | docker login --username my-username --password-stdin
121+
` + "```" + `
122+
123+
The ` + "`docker`" + ` CLI
112124
will store your credentials securely in your credential store, such as the
113125
operating system native keychain. The Docker Terraform provider will
114126
use these credentials automatically.
115127
128+
### Setting credentials in CI
129+
130+
The Docker Terraform provider will work with your CI provider's
131+
native Docker login action. For example, in [GitHub Actions](https://github.com/marketplace/actions/docker-login):
132+
116133
` + "```" + `
117-
cat ~/my_password.txt | docker login --username my-username --password-stdin
134+
jobs:
135+
login:
136+
runs-on: ubuntu-latest
137+
steps:
138+
- name: Login to Docker Hub
139+
uses: docker/login-action@v3
140+
with:
141+
username: ${{ vars.DOCKERHUB_USERNAME }}
142+
password: ${{ secrets.DOCKERHUB_TOKEN }}
118143
` + "```" + `
119144
145+
### Setting credentials with environment variables
146+
120147
If you'd like to use a different account for running the provider,
121148
you can set credentials in the environment:
122149
@@ -126,6 +153,22 @@ export DOCKER_PASSWORD=my-secret-token
126153
terraform plan ...
127154
` + "```" + `
128155
156+
### Setting credentials in Terraform (NOT RECOMMENDED)
157+
158+
> [!WARNING]
159+
> Hard-coding secrets in Terraform is risky. You risk leaking the secrets
160+
> if they're committed to version control.
161+
162+
Only pass in a password in Terraform if you're pulling the secret from a secure
163+
location, or if you're doing local testing.
164+
165+
` + "```" + `hcl
166+
provider "docker" {
167+
username = "my-username"
168+
password = "my-secret-token"
169+
}
170+
` + "```" + `
171+
129172
### Credential types
130173
131174
You can create a personal access token (PAT) to use as an alternative to your
@@ -153,6 +196,11 @@ this provider to manage organizations and teams, you will need to authenticate
153196
MarkdownDescription: "Username for authentication",
154197
Optional: true,
155198
},
199+
"password": schema.StringAttribute{
200+
MarkdownDescription: "Password for authentication",
201+
Optional: true,
202+
Sensitive: true,
203+
},
156204
},
157205
}
158206
}
@@ -174,14 +222,20 @@ func (p *DockerProvider) Configure(ctx context.Context, req provider.ConfigureRe
174222
"Either target apply the source of the value first, set the value statically in the configuration, or use the DOCKER_HUB_HOST environment variable.",
175223
)
176224
}
177-
178225
if data.Username.IsUnknown() {
179226
resp.Diagnostics.AddAttributeError(
180227
path.Root("username"),
181228
"Unknown Docker Hub API Username",
182229
"The provider cannot create the Docker Hub API client as there is an unknown configuration value for the Docker Hub API username.",
183230
)
184231
}
232+
if data.Password.IsUnknown() {
233+
resp.Diagnostics.AddAttributeError(
234+
path.Root("password"),
235+
"Unknown Docker Hub API Password",
236+
"The provider cannot create the Docker Hub API client as there is an unknown configuration value for the Docker Hub API password.",
237+
)
238+
}
185239

186240
if resp.Diagnostics.HasError() {
187241
return
@@ -203,6 +257,9 @@ func (p *DockerProvider) Configure(ctx context.Context, req provider.ConfigureRe
203257
}
204258

205259
password := os.Getenv("DOCKER_PASSWORD")
260+
if !data.Password.IsNull() {
261+
password = data.Password.ValueString()
262+
}
206263

207264
// If DOCKER_USERNAME and DOCKER_PASSWORD are not set, or if they are empty,
208265
// retrieve them from the credential store

0 commit comments

Comments
 (0)