From 98fa6db9c1855a9edbc3c69f7fc9937583fb1e7e Mon Sep 17 00:00:00 2001 From: Ruben Fiszel Date: Sat, 15 Jul 2023 19:51:15 +0200 Subject: [PATCH] feat: add whitelist envs to passthrough the workers --- README.md | 3 ++- backend/windmill-worker/src/worker.rs | 23 ++++++++++++++++++----- 2 files changed, 20 insertions(+), 6 deletions(-) diff --git a/README.md b/README.md index 5bfd05857d..474af8d8f2 100644 --- a/README.md +++ b/README.md @@ -203,7 +203,7 @@ compiling from source or using without a postgres super user, see curl https://raw.githubusercontent.com/windmill-labs/windmill/main/docker-compose.yml -o docker-compose.yml curl https://raw.githubusercontent.com/windmill-labs/windmill/main/Caddyfile -o Caddyfile curl https://raw.githubusercontent.com/windmill-labs/windmill/main/.env -o .env -curl https://raw.githubusercontent.com/windmill-labs/windmill/main/oauth.json -o oauth.json +curl https://raw.githubusercontent.com/windmill-labs/windmill/main/oauth.json -o oauth.json docker compose up -d ``` @@ -389,6 +389,7 @@ it being synced automatically everyday. | SMTP_TLS_IMPLICIT | false | https://docs.rs/mail-send/latest/mail_send/struct.SmtpClientBuilder.html#method.implicit_tlsemails | Server | | CREATE_WORKSPACE_REQUIRE_SUPERADMIN | false | If true, only superadmin can create workspaces | Server | | GLOBAL_ERROR_HANDLER_PATH_IN_ADMINS_WORKSPACE | None | Path to a script to run when a root job fails. The script will be run in and from the admins workspace | Server | +| WHITELIST_ENVS | None | List of envs variables, separated by a ',' that are whitelisted as being safe to passthrough the workers | Worker | ## Run a local dev setup diff --git a/backend/windmill-worker/src/worker.rs b/backend/windmill-worker/src/worker.rs index 5cf6649617..2a9f4e4eb1 100644 --- a/backend/windmill-worker/src/worker.rs +++ b/backend/windmill-worker/src/worker.rs @@ -208,6 +208,10 @@ lazy_static::lazy_static! { + pub static ref WHITELIST_ENVS: Option> = std::env::var("WHITELIST_ENVS") + .ok() + .map(|x| x.split(',').map(|x| (x.to_string(), std::env::var(x).unwrap_or("".to_string()))).collect()); + static ref WHITELIST_WORKSPACES: Option> = std::env::var("WHITELIST_WORKSPACES") .ok() .map(|x| x.split(',').map(|x| x.to_string()).collect()); @@ -2333,11 +2337,20 @@ pub async fn get_reserved_variables( job.parent_job.map(|x| x.to_string()), flow_path, job.schedule_path.clone() - ); - Ok(variables - .into_iter() - .map(|rv| (rv.name, rv.value)) - .collect()) + ).to_vec(); + + let mut r: HashMap = variables + .into_iter() + .map(|rv| (rv.name, rv.value)) + .collect(); + + if let Some(ref envs) = *WHITELIST_ENVS { + for e in envs { + r.insert(e.0.clone(), e.1.clone()); + } + } + + Ok(r) } async fn get_mem_peak(pid: Option, nsjail: bool) -> i32 {