Repository: jina-ai/jina
File: jina/orchestrate/deployments/config/helper.py (Python)

Code before:
        'uses_after',
        'workspace_id',
        'noblock_on_start',
        'env',
    }

    if pod_type == PodRoleType.HEAD:
        taboo.add('uses')
        taboo.add('workspace')

    if pod_type in {PodRoleType.WORKER, PodRoleType.GATEWAY}:
        taboo.add('polling')

    non_defaults = ArgNamespace.get_non_defaults_args(
        cargs,
        set_pod_parser(),
        taboo=taboo,
    )
    _args = ArgNamespace.kwargs2list(non_defaults)
    container_args = ['executor'] + _args
    if uses_metas is not None:
        container_args.extend(['--uses-metas', json.dumps(uses_metas)])
    if uses_with is not None:
        container_args.extend(['--uses-with', json.dumps(uses_with)])
    if env_from_secret is not None:
        container_args.extend(['--env-from-secret', json.dumps(env_from_secret)])
    container_args.append('--native')
    return container_args


def validate_uses(uses: str):
    """Validate uses argument

    :param uses: uses argument
    :return: boolean indicating whether is a valid uses to be used in K8s or docker compose
    """
    # Uses can be either None (not specified), default gateway class, default executor or docker image
    # None => deplyoment uses base container image and uses is determined inside container
    # default gateway class or default executor => deployment uses base container and sets uses in command
    # container images => deployment uses the specified container image and uses is defined by container
    if (
        uses is None
        or uses
        in [
            __default_http_gateway__,
            __default_websocket_gateway__,
            __default_grpc_gateway__,
            __default_composite_gateway__,
            __default_executor__,
        ]
        or uses.startswith('docker://')

Review comment (security):
I do not think `env_from_secret` should be added to the `container`. This is an `orchestration` argument and should not be seen by the `runtime`

Code after:
        'noblock_on_start',
        'env',
        'env_from_secret',
    }

    if pod_type == PodRoleType.HEAD:
        taboo.add('uses')
        taboo.add('workspace')

    if pod_type in {PodRoleType.WORKER, PodRoleType.GATEWAY}:
        taboo.add('polling')

    non_defaults = ArgNamespace.get_non_defaults_args(
        cargs,
        set_pod_parser(),
        taboo=taboo,
    )
    _args = ArgNamespace.kwargs2list(non_defaults)
    container_args = ['executor'] + _args
    if uses_metas is not None:
        container_args.extend(['--uses-metas', json.dumps(uses_metas)])
    if uses_with is not None:
        container_args.extend(['--uses-with', json.dumps(uses_with)])
    container_args.append('--native')
    return container_args


def validate_uses(uses: str):
    """Validate uses argument

    :param uses: uses argument
    :return: boolean indicating whether is a valid uses to be used in K8s or docker compose
    """
    # Uses can be either None (not specified), default gateway class, default executor or docker image
    # None => deplyoment uses base container image and uses is determined inside container
    # default gateway class or default executor => deployment uses base container and sets uses in command
    # container images => deployment uses the specified container image and uses is defined by container
    if (
        uses is None
        or uses
        in [
            __default_http_gateway__,
            __default_websocket_gateway__,
            __default_grpc_gateway__,
            __default_composite_gateway__,
            __default_executor__,
        ]
        or uses.startswith('docker://')
    ):
        return True