kemko/nomad
1
0
Fork 0
mirror of https://github.com/kemko/nomad.git synced 2026-01-01 16:05:42 +03:00
Code Issues Packages Projects Releases Wiki Activity

docs: minor wording tweaks + cl

Browse Source
This commit is contained in:
Seth Hoenig
2021-05-17 12:52:52 -06:00
parent 595cef8136
commit 845a3d3cdc
5 changed files with 9 additions and 7 deletions
Download Patch File Download Diff File Expand all files Collapse all files

1
CHANGELOG.md
View File

@@ -13,6 +13,7 @@ FEATURES:
__BACKWARDS INCOMPATIBILITIES:__
* csi: The `attachment_mode` and `access_mode` field are required for `volume` blocks in job specifications. Registering a volume requires at least one `capability` block with the `attachment_mode` and `access_mode` fields set. [[GH-10330](https://github.com/hashicorp/nomad/issues/10330)]
* drivers/exec+java: Reduce set of linux capabilities enabled by default [[GH-10600](https://github.com/hashicorp/nomad/pull/10600)]
* licensing: Enterprise licenses are no longer stored in raft or synced between servers. Loading the Enterprise license from disk or environment is required. The `nomad license put` command has been removed. [[GH-10458](https://github.com/hashicorp/nomad/issues/10458)]
SECURITY:

2
website/content/docs/drivers/docker.mdx
View File

@@ -824,7 +824,7 @@ plugin "docker" {
```
which is the same list of capabilities allowed by [docker by default][docker_caps]
(sans [`NET_RAW`][no_net_raw]). Allows the operator to control which capabilities can be obtained
(without [`NET_RAW`][no_net_raw]). Allows the operator to control which capabilities can be obtained
by tasks using [`cap_add`][cap_add] and [`cap_drop`][cap_drop] options. Supports
the value `"all"` as a shortcut for allow-listing all capabilities supported by
the operating system.

2
website/content/docs/drivers/exec.mdx
View File

@@ -167,7 +167,7 @@ able to make use of IPC features, like sending unexpected POSIX signals.
```
which is modeled after the capabilities allowed by [docker by default][docker_caps]
(sans [`NET_RAW`][no_net_raw]). Allows the operator to control which capabilities
(without [`NET_RAW`][no_net_raw]). Allows the operator to control which capabilities
can be obtained by tasks using [`cap_add`][cap_add] and [`cap_drop`][cap_drop] options.
Supports the value `"all"` as a shortcut for allow-listing all capabilities supported
by the operating system.

2
website/content/docs/drivers/java.mdx
View File

@@ -167,7 +167,7 @@ able to make use of IPC features, like sending unexpected POSIX signals.
```
which is modeled after the capabilities allowed by [docker by default][docker_caps]
(sans [`NET_RAW`][no_net_raw]). Allows the operator to control which capabilities
(without [`NET_RAW`][no_net_raw]). Allows the operator to control which capabilities
can be obtained by tasks using [`cap_add`][cap_add] and [`cap_drop`][cap_drop] options.
Supports the value `"all"` as a shortcut for allow-listing all capabilities supported
by the operating system.

9
website/content/docs/upgrade/upgrade-specific.mdx
View File

@@ -60,20 +60,21 @@ already explicitly set `CONSUL_HTTP_ADDR` then it will not get overridden.
Following the security [remediation][no_net_raw] in Nomad versions 0.12.12, 1.0.5,
and 1.1.0-rc1, the `exec` and `java` task drivers will additionally no longer enable
the following linux capabilities by default:
the following linux capabilities by default.
```
AUDIT_CONTROL AUDIT_READ BLOCK_SUSPEND DAC_READ_SEARCH IPC_LOCK IPC_OWNER LEASE
LINUX_IMMUTABLE MAC_ADMIN MAC_OVERRIDE NET_ADMIN NET_BROADCAST SYS_ADMIN
LINUX_IMMUTABLE MAC_ADMIN MAC_OVERRIDE NET_ADMIN NET_BROADCAST NET_RAW SYS_ADMIN
SYS_BOOT SYSLOG SYS_MODULE SYS_NICE SYS_PACCT SYS_PTRACE SYS_RAWIO SYS_RESOURCE
SYS_TIME SYS_TTY_CONFIG WAKE_ALARM
```
The capabilities now enabled by default are modeled after Docker default [`linux capabilities`]:
The capabilities now enabled by default are modeled after Docker default
[`linux capabilities`] (excluding `NET_RAW`).
```
AUDIT_WRITE CHOWN DAC_OVERRIDE FOWNER FSETID KILL MKNOD NET_BIND_SERVICE
NET_RAW SETFCAP SETGID SETPCAP SETUID SYS_CHROOT
SETFCAP SETGID SETPCAP SETUID SYS_CHROOT
```
A new `allow_caps` plugin configuration parameter for [`exec`][allow_caps_exec]