OpenCloud Security Scanner Logo Security scan for OpenCloud

CLI documentation

Secrets in the OpenCloud Security Scanner configuration

Resolve credentials from Docker secrets, files, the environment or a command instead of writing them down.

Keep credentials out of the configuration file by referring to their source instead. GitHub tokens, webhook URLs and service tokens can be read from a file, an environment variable or a command when needed.

The file itself, where it is looked for and how its keys map onto environment variables, is in Configuration file and secrets; config/check-opencloud-security.example.yml is a fully commented example.

Reference forms

Four prefixes are understood, wherever a value is expected:

Reference Resolves to
secret://name <secrets.dir>/name, i.e. /run/secrets/name for Docker and Kubernetes secrets
file:///path/to/file The contents of that file
env://VARIABLE The value of that environment variable
exec://command --arg The stdout of that command (requires secrets.allow_exec: true)

Alternatively append _file to any key or variable: COS_RELEASES_TOKEN_FILE=/run/secrets/token or token_file: /run/secrets/token. Trailing newlines are stripped, so echo secret > file works as expected.

Outside a container

secret://name looks below secrets.dir (COS_SECRETS_DIR), which defaults to /run/secrets - exactly where Docker and Kubernetes mount their secrets. Outside a container, point it at your own directory:

mkdir -p /etc/check-opencloud-security/secrets
printf '%s' '<github-token>' > /etc/check-opencloud-security/secrets/releases_token
chmod 600 /etc/check-opencloud-security/secrets/*

export COS_SECRETS_DIR=/etc/check-opencloud-security/secrets
check-opencloud-security --host opencloud.example.com \
  --release-token 'secret://releases_token'

The repository ships templates for both files in secrets/; copy them and replace the placeholder values.