fixing the lookup for preshared key

Dockerfile

@@ -20,6 +20,7 @@ FROM registry.access.redhat.com/ubi9/ubi-minimal:9.3
 COPY --from=builder /workspace/bin/ciam-rebac /usr/local/bin/
 COPY --from=builder /workspace/configs/config.yaml /usr/local/bin/
 
+ENV SPICEDB_PRESHARED $SPICEDB_PRESHARED
 EXPOSE 8000
 EXPOSE 9000
 

Makefile

@@ -85,9 +85,8 @@ kind/spicedb:
 
 .PHONY: run
 # run api locally
-run:
-	./bin/ciam-rebac -conf configs
-
+run: build
+	 ./bin/ciam-rebac -conf configs
 # show help
 help:
 	@echo ''

cmd/ciam-rebac/main.go

@@ -2,6 +2,7 @@ package main
 
 import (
 	"flag"
+	"github.com/go-kratos/kratos/v2/config/env"
 	"os"
 
 	"ciam-rebac/internal/conf"
@@ -60,6 +61,7 @@ func main() {
 	)
 	c := config.New(
 		config.WithSource(
+			env.NewSource("SPICEDB_"),
 			file.NewSource(flagconf),
 		),
 	)
@@ -74,6 +76,14 @@ func main() {
 		panic(err)
 	}
 
+	preshared, err := c.Value("PRESHARED").String()
+	if err != nil {
+		log.NewHelper(logger).Errorf("Failed to read preshared key env %d", err)
+	}
+	if preshared != "" {
+		bc.Data.SpiceDb.Token = preshared
+	}
+
 	app, cleanup, err := wireApp(bc.Server, bc.Data, logger)
 	if err != nil {
 		panic(err)

configs/config.yaml

@@ -9,4 +9,4 @@ data:
   spiceDb:
     useTLS: false
     endpoint: spicedb:50051
-    tokenFile: /spicedb_pre_shared
+    token: "${SPICEDB_PRESHARED:foobar}"

docker-compose.yaml

@@ -3,8 +3,8 @@ version: "3.8"
 services:
   rebac:
     image: "quay.io/ciam_authz/insights-rebac:latest"
-    configs:
-      - spicedb_pre_shared
+    environment:
+      - "SPICEDB_PRESHARED=${SPICEDB_GRPC_PRESHARED_KEY}"
     build:
       dockerfile: Dockerfile
     profiles: ["rebac"]

internal/conf/conf.proto

@@ -29,7 +29,7 @@ message Data {
   message SpiceDb {
     bool useTLS = 1;
     string endpoint = 2;
-    string tokenFile = 3;
+    string token = 3;
   }
   SpiceDb spiceDb = 1;
 }

internal/data/spicedb.go

@@ -12,7 +12,6 @@ import (
 	"github.com/go-kratos/kratos/v2/log"
 	"google.golang.org/grpc"
 	"google.golang.org/grpc/credentials/insecure"
-	"os"
 )
 
 // SpiceDbRepository .
@@ -27,9 +26,9 @@ func NewSpiceDbRepository(c *conf.Data, logger log.Logger) (*SpiceDbRepository,
 	var opts []grpc.DialOption
 	opts = append(opts, grpc.WithBlock()) // TODO: always did it this way with authz. Still the right option?
 
-	token, err := readToken(c.SpiceDb.TokenFile)
-	if err != nil {
-		err = fmt.Errorf("error extracting token from file: %w", err)
+	token := c.SpiceDb.Token
+	if token == "" {
+		err := fmt.Errorf("token is empty: %s", token)
 		log.NewHelper(logger).Error(err)
 		return nil, nil, err
 	}
@@ -134,12 +133,3 @@ func createSpiceDbRelationship(relationship *apiV1.Relationship) *v1.Relationshi
 		Subject:  subject,
 	}
 }
-
-func readToken(file string) (string, error) {
-	bytes, err := os.ReadFile(file)
-	if err != nil {
-		return "", err
-	}
-
-	return string(bytes), nil
-}