kemko/nomad
1
0
Fork 0
mirror of https://github.com/kemko/nomad.git synced 2026-01-06 18:35:44 +03:00
Code Issues Packages Projects Releases Wiki Activity

client: split identity_hook across allocrunner and taskrunner (#18431)

Browse Source 
This commit splits identity_hook between the allocrunner and taskrunner. The
allocrunner-level part of the hook signs each task identity, and the
taskrunner-level part picks it up and stores secrets for each task.

The code revamps the WIDMgr, which is now split into 2 interfaces:
IdentityManager which manages renewals of signatures and handles sending
updates to subscribers via Watch method, and IdentitySigner which only does the
signing.

This work is necessary for having a unified Consul login workflow that comes
with the new Consul integration. A new, allocrunner-level consul_hook will now
be the only hook doing Consul authentication.
This commit is contained in:
Piotr Kazmierczak
2023-09-21 17:31:27 +02:00
committed by GitHub
parent cf8dde0850
commit 86d2cdcf80
17 changed files with 829 additions and 409 deletions
Download Patch File Download Diff File Expand all files Collapse all files

9
client/allocrunner/taskrunner/task_runner.go
View File

@@ -34,6 +34,7 @@ import (
cstructs "github.com/hashicorp/nomad/client/structs"
"github.com/hashicorp/nomad/client/taskenv"
"github.com/hashicorp/nomad/client/vaultclient"
"github.com/hashicorp/nomad/client/widmgr"
"github.com/hashicorp/nomad/helper"
"github.com/hashicorp/nomad/helper/pluginutils/hclspecutils"
"github.com/hashicorp/nomad/helper/pluginutils/hclutils"
@@ -267,8 +268,8 @@ type TaskRunner struct {
// system features like cgroups
wranglers cinterfaces.ProcessWranglers
// widmgr fetches workload identities
widmgr IdentitySigner
// widmgr manages workload identities
widmgr widmgr.IdentityManager
}
type Config struct {
@@ -342,8 +343,8 @@ type Config struct {
// allocrunner hooks
AllocHookResources *cstructs.AllocHookResources
// WIDMgr fetches workload identities
WIDMgr IdentitySigner
// WIDMgr manages workload identities
WIDMgr widmgr.IdentityManager
}
func NewTaskRunner(config *Config) (*TaskRunner, error) {