Skip to content

removed GCloud-specific docker registry secret creation #77

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Open
henzigo wants to merge 1 commit into
base: jg/sf-graceful-shutdown
Choose a base branch
from
Open

removed GCloud-specific docker registry secret creation #77

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
1 change: 1 addition & 0 deletions UPGRADE.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -12,6 +12,7 @@

## Upgrade from v5.0.0 to v5.1.0

- removed GCloud-specific docker registry secret creation ([#77](https://github.com/shopsys/deployment/pull/77))
- improved probes and graceful shutdown for storefront ([#76](https://github.com/shopsys/deployment/pull/76))
- added probes for RabbitMQ with graceful shutdown ([#75](https://github.com/shopsys/deployment/pull/75))
- changed container order for Redis ([#74](https://github.com/shopsys/deployment/pull/74))
Expand Down
6 changes: 1 addition & 5 deletions deploy/parts/deploy.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,11 +26,7 @@ echo -n " Delete secret for docker registry "
runCommand "SKIP" "kubectl delete secret dockerregistry -n ${PROJECT_NAME}"

echo -n " Create new secret for docker registry "
if [ "${GCLOUD_DEPLOY}" = "true" ]; then
runCommand "ERROR" "kubectl create secret docker-registry dockerregistry --docker-server=eu.gcr.io --docker-username _json_key --docker-email ${GCLOUD_CONTAINER_REGISTRY_EMAIL} --docker-password='${GCLOUD_CONTAINER_REGISTRY_ACCOUNT}' -n ${PROJECT_NAME}"
else
runCommand "ERROR" "kubectl create secret docker-registry dockerregistry --docker-server=${CI_REGISTRY} --docker-username=${DEPLOY_REGISTER_USER} --docker-password=${DEPLOY_REGISTER_PASSWORD} -n ${PROJECT_NAME}"
fi
runCommand "ERROR" "kubectl create secret docker-registry dockerregistry --docker-server=${CI_REGISTRY} --docker-username=${DEPLOY_REGISTER_USER} --docker-password=${DEPLOY_REGISTER_PASSWORD} -n ${PROJECT_NAME}"
Copy link

Copilot AI Apr 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

CI_REGISTRY is now required for all deployments (the GCloud branch was removed), but it is not validated at the top like the other required env vars. Add assertVariable "CI_REGISTRY" (or otherwise ensure it’s always set) so the script fails early with a clear message rather than running kubectl ... --docker-server=.

Copilot uses AI. Check for mistakes.
Copy link

Copilot AI Apr 15, 2026

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

runCommand executes commands via eval (see deploy/functions.sh), but this kubectl create secret command interpolates DEPLOY_REGISTER_USER/DEPLOY_REGISTER_PASSWORD/CI_REGISTRY without shell-escaping. If any value contains spaces/shell metacharacters, the command can break or be exploited. Quote/escape these arguments (or avoid eval for command execution).

Suggested change
runCommand "ERROR" "kubectl create secret docker-registry dockerregistry --docker-server=${CI_REGISTRY} --docker-username=${DEPLOY_REGISTER_USER} --docker-password=${DEPLOY_REGISTER_PASSWORD} -n ${PROJECT_NAME}"
printf -v ESCAPED_CI_REGISTRY '%q' "${CI_REGISTRY}"
printf -v ESCAPED_DEPLOY_REGISTER_USER '%q' "${DEPLOY_REGISTER_USER}"
printf -v ESCAPED_DEPLOY_REGISTER_PASSWORD '%q' "${DEPLOY_REGISTER_PASSWORD}"
printf -v ESCAPED_PROJECT_NAME '%q' "${PROJECT_NAME}"
runCommand "ERROR" "kubectl create secret docker-registry dockerregistry --docker-server=${ESCAPED_CI_REGISTRY} --docker-username=${ESCAPED_DEPLOY_REGISTER_USER} --docker-password=${ESCAPED_DEPLOY_REGISTER_PASSWORD} -n ${ESCAPED_PROJECT_NAME}"

Copilot uses AI. Check for mistakes.

if [ ${RUNNING_PRODUCTION} -eq "0" ] || [ ${#FORCE_HTTP_AUTH_IN_PRODUCTION[@]} -ne "0" ]; then
echo -n " Create or update secret for http auth "
Expand Down