From 6c0d4c15e832745ceaae59c62cc462e8d9869b9f Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Fri, 18 Sep 2026 13:40:05 -0400 Subject: [PATCH 1/2] Annotate the soauth network leaves instead of the networks map SOC reported "Malformed config setting (docker.networks.soauth.range): Setting name 'networks' conflicts with another similarly named setting" and refused to render the config tree. soc_docker.yaml annotated docker.networks itself, and every key in that block was a scalar, so FlattenAnnotations registered docker.networks as a setting. defaults.yaml holds a nested map there, so FlattenPillar separately registered docker.networks.soauth.range, .gateway and .manager_only, and HydrateAnnotations unions the two sets. The config tree gives each id segment either a value or children, never both, so addToNode pushed docker.networks as a childless leaf and then threw when docker.networks.soauth.range tried to descend through it. The annotations move down to the three leaves that actually carry values, so docker.networks is a plain branch. This matches docker.containers, which is nested the same way and has never carried annotations of its own. docker.ulimits and the per-container networks list are unaffected: their pillar values are lists rather than maps, so they stay single settings. --- salt/docker/soc_docker.yaml | 35 ++++++++++++++++++++++++++--------- 1 file changed, 26 insertions(+), 9 deletions(-) diff --git a/salt/docker/soc_docker.yaml b/salt/docker/soc_docker.yaml index 18a7278a5..8c3b88e7b 100644 --- a/salt/docker/soc_docker.yaml +++ b/salt/docker/soc_docker.yaml @@ -8,15 +8,32 @@ docker: helpLink: docker advanced: True networks: - description: | - Docker networks used by the grid. sobridge carries most containers and takes its range and - gateway from the docker.range and docker.gateway settings above. soauth is an isolated - network for the authentication services, so that the Kratos admin and Hydra API is only reachable - from the containers placed on it. - helpLink: docker - readonly: True - advanced: True - global: True + soauth: + range: + description: | + IP range for the soauth docker network. soauth is an isolated network for the + authentication services, so that the Kratos and Hydra admin APIs are only reachable + from the containers placed on it. Most containers instead use sobridge, which takes + its range and gateway from the docker.range and docker.gateway settings above. + helpLink: docker + readonly: True + advanced: True + global: True + gateway: + description: Gateway for the soauth docker network. + helpLink: docker + readonly: True + advanced: True + global: True + manager_only: + description: | + Limits the soauth network to grid members running the authentication containers, + instead of creating it on every node. + helpLink: docker + readonly: True + advanced: True + global: True + forcedType: bool ulimits: description: | Default ulimit settings applied to all containers via the Docker daemon. Each entry specifies a resource name (e.g. nofile, memlock, core, nproc) with soft and hard limits. Individual container ulimits override these defaults. Valid resource names include: cpu, fsize, data, stack, core, rss, nproc, nofile, memlock, as, locks, sigpending, msgqueue, nice, rtprio, rttime. From d8884dbd996c7481e859fa2d367d33403fc9543f Mon Sep 17 00:00:00 2001 From: Mike Reeves Date: Fri, 18 Sep 2026 14:37:11 -0400 Subject: [PATCH 2/2] Document sobridge alongside the soauth network settings sobridge carries most containers but held no annotation, so it was absent from the config tree entirely. Its pillar entry is an empty map, so annotating it adds a setting with no children for docker.networks.soauth.range to collide with, and the tree still builds. docker.map.jinja fills in sobridge's range and gateway at render time from docker.range and docker.gateway, and resets the entry when it is not a mapping, so nothing writes keys underneath it. The sentence about sobridge is dropped from the soauth range description now that sobridge documents itself. --- salt/docker/soc_docker.yaml | 15 +++++++++++---- 1 file changed, 11 insertions(+), 4 deletions(-) diff --git a/salt/docker/soc_docker.yaml b/salt/docker/soc_docker.yaml index 8c3b88e7b..a3b11ecc5 100644 --- a/salt/docker/soc_docker.yaml +++ b/salt/docker/soc_docker.yaml @@ -8,13 +8,20 @@ docker: helpLink: docker advanced: True networks: + sobridge: + description: | + The default docker network, carrying most containers. Its range and gateway are taken + from the docker.range and docker.gateway settings above rather than set here. + helpLink: docker + readonly: True + advanced: True + global: True soauth: range: description: | - IP range for the soauth docker network. soauth is an isolated network for the - authentication services, so that the Kratos and Hydra admin APIs are only reachable - from the containers placed on it. Most containers instead use sobridge, which takes - its range and gateway from the docker.range and docker.gateway settings above. + IP range for the soauth docker network, an isolated network for the authentication + services, so that the Kratos and Hydra admin APIs are only reachable from the + containers placed on it. helpLink: docker readonly: True advanced: True