mirror of
https://github.com/kemko/nomad.git
synced 2026-01-02 00:15:43 +03:00
b25f1b66ce
On supported platforms, the secrets directory is a 1MiB tmpfs. But some tasks need larger space for downloading large secrets. This is especially the case for tasks using `templates`, which need extra room to write a temporary file to the secrets directory that gets renamed to the old file atomically. This changeset allows increasing the size of the tmpfs in the `resources` block. Because this is a memory resource, we need to include it in the memory we allocate for scheduling purposes. The task is already prevented from using more memory in the tmpfs than the `resources.memory` field allows, but can bypass that limit by writing to the tmpfs via `template` or `artifact` blocks. Therefore, we need to account for the size of the tmpfs in the allocation resources. Simply adding it to the memory needed when we create the allocation allows it to be accounted for in all downstream consumers, and then we'll subtract that amount from the memory resources just before configuring the task driver. For backwards compatibility, the default value of 1MiB is "free" and ignored by the scheduler. Otherwise we'd be increasing the allocated resources for every existing alloc, which could cause problems across upgrades. If a user explicitly sets `resources.secrets = 1` it will no longer be free. Fixes: https://github.com/hashicorp/nomad/issues/2481 Ref: https://hashicorp.atlassian.net/browse/NET-10070
145 lines
3.6 KiB
Go
145 lines
3.6 KiB
Go
// Copyright (c) HashiCorp, Inc.
|
|
// SPDX-License-Identifier: BUSL-1.1
|
|
|
|
package allocdir
|
|
|
|
import (
|
|
"os"
|
|
"os/user"
|
|
"path/filepath"
|
|
"testing"
|
|
|
|
"github.com/hashicorp/nomad/ci"
|
|
"github.com/hashicorp/nomad/helper/testlog"
|
|
"github.com/hashicorp/nomad/plugins/drivers/fsisolation"
|
|
"github.com/shoenig/test/must"
|
|
)
|
|
|
|
// Test that building a chroot will skip nonexistent directories.
|
|
func TestTaskDir_EmbedNonexistent(t *testing.T) {
|
|
ci.Parallel(t)
|
|
|
|
tmp := t.TempDir()
|
|
|
|
d := NewAllocDir(testlog.HCLogger(t), tmp, tmp, "test")
|
|
defer d.Destroy()
|
|
td := d.NewTaskDir(t1)
|
|
must.NoError(t, d.Build())
|
|
|
|
fakeDir := "/foobarbaz"
|
|
mapping := map[string]string{fakeDir: fakeDir}
|
|
must.NoError(t, td.embedDirs(mapping))
|
|
}
|
|
|
|
// Test that building a chroot copies files from the host into the task dir.
|
|
func TestTaskDir_EmbedDirs(t *testing.T) {
|
|
ci.Parallel(t)
|
|
|
|
tmp := t.TempDir()
|
|
|
|
d := NewAllocDir(testlog.HCLogger(t), tmp, tmp, "test")
|
|
defer d.Destroy()
|
|
td := d.NewTaskDir(t1)
|
|
must.NoError(t, d.Build())
|
|
|
|
// Create a fake host directory, with a file, and a subfolder that contains
|
|
// a file.
|
|
host := t.TempDir()
|
|
|
|
subDirName := "subdir"
|
|
subDir := filepath.Join(host, subDirName)
|
|
must.NoError(t, os.MkdirAll(subDir, 0o777))
|
|
|
|
file := "foo"
|
|
subFile := "bar"
|
|
must.NoError(t, os.WriteFile(filepath.Join(host, file), []byte{'a'}, 0o777))
|
|
must.NoError(t, os.WriteFile(filepath.Join(subDir, subFile), []byte{'a'}, 0o777))
|
|
|
|
// Create mapping from host dir to task dir.
|
|
taskDest := "bin/test/"
|
|
mapping := map[string]string{host: taskDest}
|
|
must.NoError(t, td.embedDirs(mapping))
|
|
|
|
exp := []string{filepath.Join(td.Dir, taskDest, file), filepath.Join(td.Dir, taskDest, subDirName, subFile)}
|
|
for _, f := range exp {
|
|
if _, err := os.Stat(f); os.IsNotExist(err) {
|
|
t.Fatalf("File %v not embedded: %v", f, err)
|
|
}
|
|
}
|
|
}
|
|
|
|
// Test that task dirs for image based isolation don't require root.
|
|
func TestTaskDir_NonRoot_Image(t *testing.T) {
|
|
requireNonRoot(t)
|
|
|
|
ci.Parallel(t)
|
|
|
|
tmp := t.TempDir()
|
|
|
|
d := NewAllocDir(testlog.HCLogger(t), tmp, tmp, "test")
|
|
defer d.Destroy()
|
|
td := d.NewTaskDir(t1)
|
|
must.NoError(t, d.Build())
|
|
must.NoError(t, td.Build(fsisolation.Image, nil, "nobody"))
|
|
}
|
|
|
|
// Test that task dirs with no isolation don't require root.
|
|
func TestTaskDir_NonRoot(t *testing.T) {
|
|
requireNonRoot(t)
|
|
|
|
ci.Parallel(t)
|
|
|
|
tmp := t.TempDir()
|
|
|
|
d := NewAllocDir(testlog.HCLogger(t), tmp, tmp, "test")
|
|
defer d.Destroy()
|
|
td := d.NewTaskDir(t1)
|
|
must.NoError(t, d.Build())
|
|
must.NoError(t, td.Build(fsisolation.None, nil, "nobody"))
|
|
|
|
// ${TASK_DIR}/alloc should not exist!
|
|
if _, err := os.Stat(td.SharedTaskDir); !os.IsNotExist(err) {
|
|
t.Fatalf("Expected a NotExist error for shared alloc dir in task dir: %q", td.SharedTaskDir)
|
|
}
|
|
}
|
|
|
|
func TestTaskDir_NonRoot_Unveil(t *testing.T) {
|
|
requireNonRoot(t)
|
|
|
|
ci.Parallel(t)
|
|
|
|
tmp := t.TempDir()
|
|
|
|
// non-root, should still work for tasks running as the same user as the
|
|
// nomad client agent
|
|
u, err := user.Current()
|
|
must.NoError(t, err)
|
|
|
|
d := NewAllocDir(testlog.HCLogger(t), tmp, tmp, "test")
|
|
defer d.Destroy()
|
|
td := d.NewTaskDir(t1)
|
|
must.NoError(t, d.Build())
|
|
must.NoError(t, td.Build(fsisolation.Unveil, nil, u.Username))
|
|
fi, err := os.Stat(td.MountsTaskDir)
|
|
must.NoError(t, err)
|
|
must.NotNil(t, fi)
|
|
}
|
|
|
|
func TestTaskDir_Root_Unveil(t *testing.T) {
|
|
requireRoot(t)
|
|
|
|
ci.Parallel(t)
|
|
|
|
tmp := t.TempDir()
|
|
|
|
// root, can build task dirs for another user
|
|
d := NewAllocDir(testlog.HCLogger(t), tmp, tmp, "test")
|
|
defer d.Destroy()
|
|
td := d.NewTaskDir(t1)
|
|
must.NoError(t, d.Build())
|
|
must.NoError(t, td.Build(fsisolation.Unveil, nil, "nobody"))
|
|
fi, err := os.Stat(td.MountsTaskDir)
|
|
must.NoError(t, err)
|
|
must.NotNil(t, fi)
|
|
}
|