Docker secrets not getting loaded while using docker-compose file - docker

Question

I wish to use secrets mechanism of dockers through docker-compose file. I created below docker-compose file. But I am unable to connect to the peer as while starting peer service it is exiting with the code "2023-02-16 04:31:33.807 UTC [nodeCmd] serve -> FATA 024 Failed to set TLS client certificate (error parsing client TLS key pair: tls: failed to find any PEM data in certificate input)
"
My docker-compose file is as follows. I am running docker in swarm mode. Can anyone tell me what is going wrong here. I followed inputs from here
version: '3'
networks:
basic:
secrets:
P0ORG1SRVCRT:
file: ./P0ORG1SRVCRT.txt
services:
peer0.org1.example.com:
container_name: peer0.org1.example.com
image: hyperledger/fabric-peer:$IMAGE_TAG
environment:
- CORE_VM_DOCKER_HOSTCONFIG_NETWORKMODE=${COMPOSE_PROJECT_NAME}_basic
- FABRIC_LOGGING_SPEC=DEBUG
- CORE_CHAINCODE_LOGGING_LEVEL=INFO
- CORE_PEER_TLS_ENABLED=true
- CORE_PEER_TLS_CERT_FILE=/run/secrets/P0ORG1SRVCRT
- CORE_PEER_TLS_KEY_FILE=/etc/hyperledger/fabric/tls/server.key
- CORE_PEER_TLS_ROOTCERT_FILE=/etc/hyperledger/fabric/tls/ca.crt
- CORE_PEER_LOCALMSPID=Org1MSP
- CORE_PEER_ID=peer0.org1.example.com
- CORE_PEER_ADDRESS=peer0.org1.example.com:8050
- CORE_PEER_LISTENADDRESS=0.0.0.0:8050
- CORE_PEER_CHAINCODEADDRESS=peer0.org1.example.com:8051
- CORE_PEER_CHAINCODELISTENADDRESS=0.0.0.0:8051
- CORE_PEER_GOSSIP_BOOTSTRAP=peer0.org1.example.com:8050
- CORE_PEER_GOSSIP_EXTERNALENDPOINT=peer0.org1.example.com:8050
- CORE_PEER_OPERATIONS_LISTENADDRESS=0.0.0.0:9335
- CORE_PEER_METRICS_PROVIDER=prometheus
working_dir: /opt/gopath/src/github.com/hyperledger/fabric/peer
secrets:
- P0ORG1SRVCRT
command: peer node start
volumes:
- ./crypto-config/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/msp:/etc/hyperledger/fabric/msp
- ./crypto-config/peerOrganizations/org1.example.com/peers/peer0.org1.example.com/tls:/etc/hyperledger/fabric/tls
ports:
- 8050:8050
- 9335:9335
depends_on:
- orderer0.consortiumorderer.example.com
networks:
- basic

Answer 1

The error message suggests that the issue is with the TLS client certificate for the peer. Specifically, it says "Failed to set TLS client certificate (error parsing client TLS key pair: tls: failed to find any PEM data in certificate input)".
It's possible that the content of the secret file P0ORG1SRVCRT.txt is not in the correct format, or that it's not being mounted correctly into the container. Here are a few things you can try to troubleshoot:
Check the content of the P0ORG1SRVCRT.txt file to ensure that it
contains the correct PEM-encoded certificate and private key for the
peer. You can use a text editor to open the file and inspect its
content.
Make sure that the secrets section is in the docker-compose.yaml
file is properly defined, and the path to the secret file is
correct. You can try running the docker-compose config command to
see if there are any issues with the syntax or configuration of the
file.
Check the logs of the peer container to see if there are any other
error messages that might provide additional context. You can use
the docker logs command to view the logs, like this:
docker logs peer0.org1.example.com
If the issue persists, you can try mounting the secret file as a
volume directly, instead of using the secrets mechanism. For
example:
volumes:
./P0ORG1SRVCRT.txt:/run/secrets/P0ORG1SRVCRT
This will mount the secret file as a volume at the expected path
inside the container, which should allow the TLS certificate to be
loaded correctly