mirror of
https://github.com/kemko/nomad.git
synced 2026-01-03 08:55:43 +03:00
3b0b7db1a1
The Nomad clients store their Nomad identity in memory and within their state store. While active, it is not possible to dump the state to view the stored identity token, so having a way to view the current claims while running aids debugging and operations. This change adds a client identity workflow, allowing operators to view the current claims of the nodes identity. It does not return any of the signing key material.
81 lines
2.4 KiB
Go
81 lines
2.4 KiB
Go
// Copyright (c) HashiCorp, Inc.
|
|
// SPDX-License-Identifier: BUSL-1.1
|
|
|
|
package agent
|
|
|
|
import (
|
|
"net/http"
|
|
|
|
"github.com/hashicorp/nomad/nomad/structs"
|
|
)
|
|
|
|
func (s *HTTPServer) NodeIdentityGetRequest(resp http.ResponseWriter, req *http.Request) (any, error) {
|
|
|
|
if req.Method != http.MethodGet {
|
|
return nil, CodedError(http.StatusMethodNotAllowed, ErrInvalidMethod)
|
|
}
|
|
|
|
// Build the request by parsing all common parameters and node id
|
|
args := structs.NodeIdentityGetReq{}
|
|
s.parse(resp, req, &args.QueryOptions.Region, &args.QueryOptions)
|
|
parseNode(req, &args.NodeID)
|
|
|
|
// Determine the handler to use
|
|
useLocalClient, useClientRPC, useServerRPC := s.rpcHandlerForNode(args.NodeID)
|
|
|
|
// Make the RPC
|
|
var reply structs.NodeIdentityGetResp
|
|
var rpcErr error
|
|
if useLocalClient {
|
|
rpcErr = s.agent.Client().ClientRPC(structs.NodeIdentityGetRPCMethod, &args, &reply)
|
|
} else if useClientRPC {
|
|
rpcErr = s.agent.Client().RPC(structs.NodeIdentityGetRPCMethod, &args, &reply)
|
|
} else if useServerRPC {
|
|
rpcErr = s.agent.Server().RPC(structs.NodeIdentityGetRPCMethod, &args, &reply)
|
|
} else {
|
|
rpcErr = CodedError(http.StatusBadRequest, "no local Node and node_id not provided")
|
|
}
|
|
|
|
if rpcErr != nil {
|
|
if structs.IsErrNoNodeConn(rpcErr) {
|
|
rpcErr = CodedError(http.StatusNotFound, rpcErr.Error())
|
|
}
|
|
return nil, rpcErr
|
|
}
|
|
|
|
return reply, nil
|
|
}
|
|
|
|
func (s *HTTPServer) NodeIdentityRenewRequest(resp http.ResponseWriter, req *http.Request) (any, error) {
|
|
// Build the request by parsing all common parameters and node id
|
|
args := structs.NodeIdentityRenewReq{}
|
|
s.parse(resp, req, &args.QueryOptions.Region, &args.QueryOptions)
|
|
parseNode(req, &args.NodeID)
|
|
|
|
// Determine the handler to use
|
|
useLocalClient, useClientRPC, useServerRPC := s.rpcHandlerForNode(args.NodeID)
|
|
|
|
// Make the RPC
|
|
var reply structs.NodeIdentityRenewResp
|
|
var rpcErr error
|
|
if useLocalClient {
|
|
rpcErr = s.agent.Client().ClientRPC(structs.NodeIdentityRenewRPCMethod, &args, &reply)
|
|
} else if useClientRPC {
|
|
rpcErr = s.agent.Client().RPC(structs.NodeIdentityRenewRPCMethod, &args, &reply)
|
|
} else if useServerRPC {
|
|
rpcErr = s.agent.Server().RPC(structs.NodeIdentityRenewRPCMethod, &args, &reply)
|
|
} else {
|
|
rpcErr = CodedError(http.StatusBadRequest, "no local Node and node_id not provided")
|
|
}
|
|
|
|
if rpcErr != nil {
|
|
if structs.IsErrNoNodeConn(rpcErr) {
|
|
rpcErr = CodedError(http.StatusNotFound, rpcErr.Error())
|
|
}
|
|
|
|
return nil, rpcErr
|
|
}
|
|
|
|
return reply, nil
|
|
}
|