Database connection through ENV var

[mieliespoor]

Currently the database connection has to be supplied in the config.yml file like

connstring: host=clair-db port=5432 user=clair dbname=clair sslmode=disable

Is it possible to instead pass it via ENV var?

We ideally don't want to have connection string details stored like that, and our corporate security also don't approve of that. With ENV variables, we can then store these in something like AWS Secret Manager and the ECS Service can then pull in the secret value and expose it as an ENV variable.

[crozzy]

Yes, that functionality was recently added: https://github.com/quay/clair/blob/main/config/database.go#L15. You should be able to use the documented PG* env vars to configure the DB connection(s).

[hdonnay]

Although, claircore may not appreciate the empty strings. It's not tested, yet.

[mieliespoor]

Is the above mentioned code included in the latest release, 4.3.5? Commit history indicates yes.

We deployed the notifier now by removing the connstring property from the config.yaml and then deployed the following ENV vars:

PGDATABASE=postgres
PGHOST=clair-server.xxx.eu-west-1.rds.amazonaws.com
PGPASSWORD=xxx
PGPORT=5432
PGSSLMODE=disable
PGUSER=10

We get the error:

2022/01/10 11:12:42 failed to validate config: notifier mode requires a database connection string

We also tried it like PG_DATABASE which also didn't work.

Ref: https://www.postgresql.org/docs/current/libpq-envars.html

Edit:
I also tried to add a knowingly wrong connstring to the config.yaml and then the ENV vars, but even that didn't work.

service initialization failed: failed to initialize notifier: failed to initialize store and lockpool: failed to create ConnPool: failed to connect to host=clair user=postgres database=postgres: hostname resolving error (lookup clair on 10.26.0.2:53: no such host)

[mieliespoor]

So it looks like the release-4.3 branch does not have this code. We will then wait for the next release.

[mieliespoor]

@crozzy Any idea when this database config change would make it to the release branch? I see v4.3.6 was released yesterday, but this change didn't make it.