mirror of
https://github.com/kemko/nomad.git
synced 2026-01-01 16:05:42 +03:00
5a5b4b04cb
Allocations created before 1.4.0 will not have a workload identity token. When the client running these allocs is upgraded to 1.4.x, the identity hook will run and replace the node secret ID token used previously with an empty string. This causes service discovery queries to fail. Fallback to the node's secret ID when the allocation doesn't have a signed identity. Note that pre-1.4.0 allocations won't have templates that read Variables, so there's no threat that this new node ID secret will be able to read data that the allocation shouldn't have access to.
55 lines
1.2 KiB
Go
55 lines
1.2 KiB
Go
package taskrunner
|
|
|
|
import (
|
|
"context"
|
|
"sync"
|
|
|
|
log "github.com/hashicorp/go-hclog"
|
|
|
|
"github.com/hashicorp/nomad/client/allocrunner/interfaces"
|
|
)
|
|
|
|
// identityHook sets the task runner's Nomad workload identity token
|
|
// based on the signed identity stored on the Allocation
|
|
type identityHook struct {
|
|
tr *TaskRunner
|
|
logger log.Logger
|
|
taskName string
|
|
lock sync.Mutex
|
|
}
|
|
|
|
func newIdentityHook(tr *TaskRunner, logger log.Logger) *identityHook {
|
|
h := &identityHook{
|
|
tr: tr,
|
|
taskName: tr.taskName,
|
|
}
|
|
h.logger = logger.Named(h.Name())
|
|
return h
|
|
}
|
|
|
|
func (*identityHook) Name() string {
|
|
return "identity"
|
|
}
|
|
|
|
func (h *identityHook) Prestart(ctx context.Context, req *interfaces.TaskPrestartRequest, resp *interfaces.TaskPrestartResponse) error {
|
|
h.lock.Lock()
|
|
defer h.lock.Unlock()
|
|
|
|
token := h.tr.alloc.SignedIdentities[h.taskName]
|
|
if token != "" {
|
|
h.tr.setNomadToken(token)
|
|
}
|
|
return nil
|
|
}
|
|
|
|
func (h *identityHook) Update(_ context.Context, req *interfaces.TaskUpdateRequest, _ *interfaces.TaskUpdateResponse) error {
|
|
h.lock.Lock()
|
|
defer h.lock.Unlock()
|
|
|
|
token := h.tr.alloc.SignedIdentities[h.taskName]
|
|
if token != "" {
|
|
h.tr.setNomadToken(token)
|
|
}
|
|
return nil
|
|
}
|