Add automated sustainable workflow to update docker configs / secrets

[YuryHrytsuk]

Requirements

Preview Give feedback

1. Config updates shall propagate to the service automatically
2. both in CI Pipelines and when done manually

Related issues

• Sustainable Dask-certificates process #934
• Add fallback nginx to serve "something went wrong" #218
• [DOCUMENTATION] Why name field of secret is not documented? docker/compose#12504
• Update data for config and secrets moby/moby#35803

Useful articles

• https://blog.sunekeller.dk/2019/01/docker-stack-deploy-update-configs/
• https://blog.viktoradam.net/2018/02/28/swarm-secrets-made-easy/
• https://github.com/neuroforgede/docker-stack-deploy
• external secrets with name?

Useful scripts

• docker config decode https://gist.github.com/letsjustfixit/eb55d2cc12fcd34eae08b07c5eb8a93c

[YuryHrytsuk]

We use external secrets for:

• portainer
• local traefik
• minio

It looks like docker config / secret name solution does not apply when external is true

---

how to list all configs that belong to a particular stack:

docker config list --filter label=com.docker.stack.namespace=$STACK_NAME