pass --config as environment variable

[michaelkrieg]

If you use cnspec with multiple configurations (also referenced as files) it would be very handy to switch contexts easily by setting an environment variable.

Instead to execute:

cnspec scan --config $HOME/.config/mondoo/profile-a.yml ........
cnspec scan --config $HOME/.config/mondoo/profile-xyz.yml .......

... I could image to use something similar to this:

export MONDOO_CONFIG_FILE=profile-xyz.yml
cnspec scan ........

That said, additional tools come into play (e.g.: direnv).

Is this possible? If not yet: any plans to implement it?

Cheers,
Micha

[chris-rock]

@michaelkrieg that is a great question. We have multiple options to set the configuration path, which by default includes the service account to communicate with the Mondoo Platform.

If you have the config locally available, you can use MONDOO_CONFIG_PATH:

export MONDOO_CONFIG_PATH=~/.config/mondoo/mondoo-space1.yml

When you run cnspec or cnquery you see the log being read from the env variable:

$ export MONDOO_CONFIG_PATH=~/.config/mondoo/mondoo-default.yml
$ cnspec status
→ loaded configuration from /Users/chris/.config/mondoo/mondoo-default.yml using source $MONDOO_CONFIG_PATH

In CI/CD systems you normally need to store data as part of the ENV variables itself. Storing json files is not always well supported. Therefore, we also support reading base64 encoded config from the env variable MONDOO_CONFIG_BASE64. You see cnspec and cnquery picking up the config now:

export MONDOO_CONFIG_BASE64='YWd...zZQo='     
cnspec status
→ loaded configuration from environment using source $MONDOO_CONFIG_BASE64

You can create base64 encoded config via clicking the checkbox for base64 in the Mondoo Console under Space -> Settings -> Service Accounts:

or you just encode a config file to base64:

# macos
cat ~/.config/mondoo/mondoo-default.yml | base64
export MONDOO_CONFIG_BASE64='YWd...zZQo=''