kemko/nomad
1
0
Fork 0
mirror of https://github.com/kemko/nomad.git synced 2026-01-01 16:05:42 +03:00
Code Issues Packages Projects Releases Wiki Activity

client: consul hook not called for templates (#19490)

Browse Source 
Due to some refactoring mishap, task-level Consul hook was never triggered and
thus never wrote any secrets in task secret dirs.
This commit is contained in:
Piotr Kazmierczak
2023-12-15 17:16:00 +01:00
committed by GitHub
parent 2e33115c15
commit f1fb51422b
3 changed files with 23 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files

3
.changelog/19490.txt Normal file
View File

@@ -0,0 +1,3 @@
```release-note:bug
client: Fixed a bug where where the environment variable / file for the Consul token weren't written.
```

27
client/allocrunner/taskrunner/consul_hook.go
View File

@@ -18,10 +18,9 @@ import (
)
const (
// consulTokenFilePrefix is the begging of the name of the file holding the
// Consul SI token inside the task's secret directory. Full name of the file is
// always consulTokenFilePrefix_identityName
consulTokenFilePrefix = "nomad_consul"
// consulTokenFilename is the name of the file holding the Consul SI token
// inside the task's secret directory.
consulTokenFilename = "consul_token"
// consulTokenFilePerms is the level of file permissions granted on the file in
// the secrets directory for the task
@@ -32,14 +31,15 @@ type consulHook struct {
task *structs.Task
tokenDir string
hookResources *cstructs.AllocHookResources
logger log.Logger
logger log.Logger
}
func newConsulHook(logger log.Logger, tr *TaskRunner, hookResources *cstructs.AllocHookResources) *consulHook {
func newConsulHook(logger log.Logger, tr *TaskRunner) *consulHook {
h := &consulHook{
task: tr.Task(),
tokenDir: tr.taskDir.SecretsDir,
hookResources: hookResources,
hookResources: tr.allocHookResources,
}
h.logger = logger.Named(h.Name())
return h
@@ -49,13 +49,13 @@ func (*consulHook) Name() string {
return "consul_task"
}
func (h *consulHook) Prestart(context.Context, *interfaces.TaskPrestartRequest, *interfaces.TaskPrestartResponse) error {
func (h *consulHook) Prestart(ctx context.Context, req *interfaces.TaskPrestartRequest, resp *interfaces.TaskPrestartResponse) error {
mErr := multierror.Error{}
tokens := h.hookResources.GetConsulTokens()
// Write tokens to tasks' secret dirs
for cluster, t := range tokens {
for _, t := range tokens {
for identity, token := range t {
// do not write tokens that do not belong to any of this task's
// identities
@@ -66,11 +66,16 @@ func (h *consulHook) Prestart(context.Context, *interfaces.TaskPrestartRequest,
continue
}
filename := fmt.Sprintf("%s_%s_%s", consulTokenFilePrefix, cluster, identity)
tokenPath := filepath.Join(h.tokenDir, filename)
tokenPath := filepath.Join(h.tokenDir, consulTokenFilename)
if err := os.WriteFile(tokenPath, []byte(token.SecretID), consulTokenFilePerms); err != nil {
mErr.Errors = append(mErr.Errors, fmt.Errorf("failed to write Consul SI token: %w", err))
}
env := map[string]string{
"CONSUL_TOKEN": token.SecretID,
}
resp.Env = env
}
}

4
client/allocrunner/taskrunner/task_runner_hooks.go
View File

@@ -107,6 +107,10 @@ func (tr *TaskRunner) initHooks() {
// Get the consul namespace for the TG of the allocation.
consulNamespace := tr.alloc.ConsulNamespaceForTask(tr.taskName)
// Add the consul hook (populates task secret dirs and sets the environment if
// consul tokens are present for the task).
tr.runnerHooks = append(tr.runnerHooks, newConsulHook(hookLogger, tr))
// If there are templates is enabled, add the hook
if len(task.Templates) != 0 {
tr.runnerHooks = append(tr.runnerHooks, newTemplateHook(&templateHookConfig{