Deniz Onur Duzgun 22b7470ccf sec: fix alloc workload identity namespace permission (#24683) ...

Sanitize the Allocations SignedIdentities to prevent privilege escalation within a namespace through unauthorized impersonation of [workload associated with ACL policies](https://developer.hashicorp.com/nomad/docs/concepts/workload-identity#workload-associated-acl-policies) in any workload within the namespace.

Ref: CVE-2024-12678.
Ref: https://github.com/hashicorp/nomad-enterprise/pull/2098

2024-12-16 16:35:10 -05:00

..

auth

heartbeat: use leader's ACL token when failing heartbeat (#24241)

2024-10-17 13:48:20 -04:00

deploymentwatcher

deployment watcher: fix goroutine leak when job is purged (#20348)

2024-04-11 14:51:05 -04:00

drainer

update go1.21 (#18184)

2023-08-14 08:43:27 -05:00

lock

license: fix some imports of BUSL-1.1 in MPL-2.0 (#19832)

2024-01-29 12:04:12 -05:00

mock

gc: be consistent with setting create/modify timestamp tz (#24389)

2024-11-07 22:53:54 +01:00

reporting

server: Add reporting configuration to nomad server (#18609)

2023-09-28 22:00:43 +02:00

state

state: remove TimeTable and rely on objects' modify times instead (#24112)

2024-11-01 19:38:04 +01:00

stream

acl: remove remaining unused nil ACL object handling (#20456)

2024-04-18 14:34:17 -04:00

structs

sec: fix alloc workload identity namespace permission (#24683)

2024-12-16 16:35:10 -05:00

volumewatcher

state: remove TimeTable and rely on objects' modify times instead (#24112)

2024-11-01 19:38:04 +01:00

acl_endpoint_test.go

refactor identity claims constructor to builder (#23708)

2024-08-05 14:31:56 -04:00

acl_endpoint.go

deps: update to go-set/v3 and refactor to use custom iterators (#23971)

2024-09-16 13:40:10 -05:00

acl_test.go

keyring in raft (#23977)

2024-09-19 13:56:42 -04:00

acl.go

auth: enforce use of node secret and remove legacy auth (#23838)

2024-09-05 14:24:28 -04:00

alloc_endpoint_test.go

keyring in raft (#23977)

2024-09-19 13:56:42 -04:00

alloc_endpoint.go

sec: fix alloc workload identity namespace permission (#24683)

2024-12-16 16:35:10 -05:00

autopilot_ce.go

autopilot: add Enterprise health information to API endpoint (#20153)

2024-03-18 11:38:17 -04:00

autopilot_test.go

autopilot: add Enterprise health information to API endpoint (#20153)

2024-03-18 11:38:17 -04:00

autopilot.go

autopilot: add Enterprise health information to API endpoint (#20153)

2024-03-18 11:38:17 -04:00

blocked_evals_stats_test.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

blocked_evals_stats.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

blocked_evals_system.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

blocked_evals_test.go

scheduler: appropriately unblock evals with quotas (#18838)

2023-10-24 11:22:24 -05:00

blocked_evals.go

gc: be consistent with setting create/modify timestamp tz (#24389)

2024-11-07 22:53:54 +01:00

client_agent_endpoint_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

client_agent_endpoint.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

client_alloc_endpoint_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

client_alloc_endpoint.go

jobspec: time based task execution (#22201)

2024-05-22 15:40:25 -05:00

client_csi_endpoint_test.go

testing: RPC-only test client helper (#24371)

2024-11-05 14:59:53 -05:00

client_csi_endpoint.go

Revert "deps: update go-metrics to v0.5.3 (#19190)" (#19374)

2023-12-08 08:46:55 -05:00

client_fs_endpoint_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

client_fs_endpoint.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

client_meta_endpoint_test.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

client_meta_endpoint.go

Revert "deps: update go-metrics to v0.5.3 (#19190)" (#19374)

2023-12-08 08:46:55 -05:00

client_rpc_test.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

client_rpc.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

client_stats_endpoint_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

client_stats_endpoint.go

Revert "deps: update go-metrics to v0.5.3 (#19190)" (#19374)

2023-12-08 08:46:55 -05:00

config.go

identity: adds ability to specify custom filepath for saving workload identities (#24038)

2024-09-23 10:27:00 -04:00

consul_ce_test.go

admin: rename _oss files to _ce (#18209)

2023-08-18 07:47:24 +01:00

consul_policy_ce_test.go

admin: rename _oss files to _ce (#18209)

2023-08-18 07:47:24 +01:00

consul_policy_test.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

consul_policy.go

Fixes Consul token checking when policies exist within namespaces (#18516)

2023-12-11 10:07:32 -06:00

consul_test.go

consul: set partition for gateway config entries (#22228)

2024-05-29 16:31:02 -04:00

consul.go

consul: set partition for gateway config entries (#22228)

2024-05-29 16:31:02 -04:00

core_sched_test.go

scheduler: fix a bug where force GC wasn't respected (#24456)

2024-11-21 09:07:23 +01:00

core_sched.go

scheduler: fix a bug where force GC wasn't respected (#24456)

2024-11-21 09:07:23 +01:00

csi_endpoint_test.go

CSI: fix namespace ACL bypass on create/register APIs (#24396)

2024-11-07 14:47:30 -05:00

csi_endpoint.go

CSI: fix namespace ACL bypass on create/register APIs (#24396)

2024-11-07 14:47:30 -05:00

deployment_endpoint_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

deployment_endpoint.go

Revert "deps: update go-metrics to v0.5.3 (#19190)" (#19374)

2023-12-08 08:46:55 -05:00

deployment_watcher_shims.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

drainer_int_test.go

auth: enforce use of node secret and remove legacy auth (#23838)

2024-09-05 14:24:28 -04:00

drainer_shims.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

encrypter_ce.go

keyring: support external KMS for key encryption key (KEK) (#23580)

2024-07-18 09:42:28 -04:00

encrypter_test.go

keyring: Fix a panic when decrypting aead with empty RSA block. (#24442)

2024-11-12 14:26:35 +00:00

encrypter.go

keyring: Fix a panic when decrypting aead with empty RSA block. (#24442)

2024-11-12 14:26:35 +00:00

endpoints_ce.go

admin: rename _oss files to _ce (#18209)

2023-08-18 07:47:24 +01:00

eval_broker_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

eval_broker.go

eval_broker: track enqueue and dequeue times (#20329)

2024-04-15 16:16:50 +02:00

eval_endpoint_test.go

deps: update to go-set/v3 and refactor to use custom iterators (#23971)

2024-09-16 13:40:10 -05:00

eval_endpoint.go

Revert "deps: update go-metrics to v0.5.3 (#19190)" (#19374)

2023-12-08 08:46:55 -05:00

event_endpoint_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

event_endpoint.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

fsm_ce.go

Update nomad operator snapshot inspect with more detail (#20062)

2024-06-06 06:57:10 +01:00

fsm_registry_ce.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

fsm_test.go

state: remove TimeTable and rely on objects' modify times instead (#24112)

2024-11-01 19:38:04 +01:00

fsm.go

fsm: handle EventSinkSnapshot type correctly (#24418)

2024-11-12 10:42:19 +01:00

heartbeat_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

heartbeat.go

heartbeat: use leader's ACL token when failing heartbeat (#24241)

2024-10-17 13:48:20 -04:00

job_endpoint_ce_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

job_endpoint_ce.go

[sentinel] Add existing job to enforceSubmitJob (#18553)

2023-09-21 14:12:51 -04:00

job_endpoint_hook_connect_test.go

Permit Consul Connect Gateways to be used with podman (#20611)

2024-05-17 09:26:09 -05:00

job_endpoint_hook_connect.go

deps: update to go-set/v3 and refactor to use custom iterators (#23971)

2024-09-16 13:40:10 -05:00

job_endpoint_hook_consul_ce_test.go

consul: support admin partitions (#19665)

2024-01-10 10:41:29 -05:00

job_endpoint_hook_consul_ce.go

consul: refactor job mutation hook (#19699)

2024-01-10 16:29:05 -05:00

job_endpoint_hook_consul.go

consul: refactor job mutation hook (#19699)

2024-01-10 16:29:05 -05:00

job_endpoint_hook_expose_check_test.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

job_endpoint_hook_expose_check.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

job_endpoint_hook_implicit_identities_test.go

client version constraints for implicit identities for WI (#18932)

2023-12-01 13:51:21 -05:00

job_endpoint_hook_implicit_identities.go

client version constraints for implicit identities for WI (#18932)

2023-12-01 13:51:21 -05:00

job_endpoint_hook_node_pool_ce.go

admin: rename _oss files to _ce (#18209)

2023-08-18 07:47:24 +01:00

job_endpoint_hook_node_pool.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

job_endpoint_hook_numa_ce_test.go

core: plumbing to support numa aware scheduling (#18681)

2023-10-19 15:09:30 -05:00

job_endpoint_hook_numa_ce.go

core: plumbing to support numa aware scheduling (#18681)

2023-10-19 15:09:30 -05:00

job_endpoint_hook_numa.go

core: plumbing to support numa aware scheduling (#18681)

2023-10-19 15:09:30 -05:00

job_endpoint_hook_sched_ce.go

jobspec: time based task execution (#22201)

2024-05-22 15:40:25 -05:00

job_endpoint_hook_sched.go

jobspec: time based task execution (#22201)

2024-05-22 15:40:25 -05:00

job_endpoint_hook_vault_ce_test.go

config: fix panic in job using Vault cluster not in agent config. (#22227)

2024-05-24 15:13:20 +01:00

job_endpoint_hook_vault_ce.go

core: plumbing to support numa aware scheduling (#18681)

2023-10-19 15:09:30 -05:00

job_endpoint_hook_vault.go

vault: ignore allow_unauthenticated config if identity is set (#19585)

2024-01-02 16:46:34 -05:00

job_endpoint_hooks_test.go

job endpoint: fix implicit constraint mutation for task-level services (#22229)

2024-05-23 19:27:47 +02:00

job_endpoint_hooks.go

job endpoint: fix implicit constraint mutation for task-level services (#22229)

2024-05-23 19:27:47 +02:00

job_endpoint_statuses_test.go

job statuses: fix filtering for namespace parameter (#23456)

2024-06-27 16:19:36 -04:00

job_endpoint_statuses.go

deps: update to go-set/v3 and refactor to use custom iterators (#23971)

2024-09-16 13:40:10 -05:00

job_endpoint_test.go

Allow scaling system jobs to 0 (#24363)

2024-11-18 13:35:47 +01:00

job_endpoint_validators_test.go

namespaces: add allowed network modes to capabilities. (#23813)

2024-08-16 09:47:19 -04:00

job_endpoint_validators.go

namespaces: add allowed network modes to capabilities. (#23813)

2024-08-16 09:47:19 -04:00

job_endpoint.go

Allow scaling system jobs to 0 (#24363)

2024-11-18 13:35:47 +01:00

keyring_endpoint_test.go

keyring in raft (#23977)

2024-09-19 13:56:42 -04:00

keyring_endpoint.go

keyring in raft (#23977)

2024-09-19 13:56:42 -04:00

leader_ce.go

[f-gh-1106-reporting] Use full cluster metadata for reporting (#18660)

2023-10-05 09:32:54 +02:00

leader_test.go

vault: remove revoked Vault accessors from state (#19706)

2024-01-11 14:38:51 -05:00

leader.go

state: remove TimeTable and rely on objects' modify times instead (#24112)

2024-11-01 19:38:04 +01:00

license_config_ce.go

admin: rename _oss files to _ce (#18209)

2023-08-18 07:47:24 +01:00

license_config.go

all: swap exp packages for maps, slices (#18311)

2023-08-23 15:42:13 -05:00

locks_test.go

identity: default to RS256 for new workload ids (#18882)

2023-10-31 11:25:20 -07:00

locks.go

[17449] Introduces a locking mechanism over variables (#18207)

2023-09-21 17:56:33 +02:00

merge.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

namespace_endpoint_test.go

namespaces: warn if deleting namespaces that have allocs, volumes, vars or quotas associated with them (#23499)

2024-07-09 17:10:09 +02:00

namespace_endpoint.go

namespaces: warn if deleting namespaces that have allocs, volumes, vars or quotas associated with them (#23499)

2024-07-09 17:10:09 +02:00

node_endpoint_test.go

heartbeat: use leader's ACL token when failing heartbeat (#24241)

2024-10-17 13:48:20 -04:00

node_endpoint.go

auth: enforce use of node secret and remove legacy auth (#23838)

2024-09-05 14:24:28 -04:00

node_pool_endpoint_ce.go

admin: rename _oss files to _ce (#18209)

2023-08-18 07:47:24 +01:00

node_pool_endpoint_test.go

deps: update to go-set/v3 and refactor to use custom iterators (#23971)

2024-09-16 13:40:10 -05:00

node_pool_endpoint.go

state: enable more reverse sorting (#20410)

2024-04-16 15:10:11 -05:00

operator_endpoint_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

operator_endpoint.go

acl: remove remaining unused nil ACL object handling (#20456)

2024-04-18 14:34:17 -04:00

periodic_endpoint_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

periodic_endpoint.go

Revert "deps: update go-metrics to v0.5.3 (#19190)" (#19374)

2023-12-08 08:46:55 -05:00

periodic_test.go

test: fix panic from concurrent writes in periodic dispatch test (#24602)

2024-12-04 09:57:38 -05:00

periodic.go

state: enable more reverse sorting (#20410)

2024-04-16 15:10:11 -05:00

plan_apply_ce.go

admin: rename _oss files to _ce (#18209)

2023-08-18 07:47:24 +01:00

plan_apply_node_tracker_test.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

plan_apply_node_tracker.go

Revert "deps: update go-metrics to v0.5.3 (#19190)" (#19374)

2023-12-08 08:46:55 -05:00

plan_apply_pool_test.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

plan_apply_pool.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

plan_apply_test.go

state: remove TimeTable and rely on objects' modify times instead (#24112)

2024-11-01 19:38:04 +01:00

plan_apply.go

refactor identity claims constructor to builder (#23708)

2024-08-05 14:31:56 -04:00

plan_endpoint_test.go

test: wait for keyring for plan apply tests (#24021)

2024-09-20 10:33:40 -04:00

plan_endpoint.go

Revert "deps: update go-metrics to v0.5.3 (#19190)" (#19374)

2023-12-08 08:46:55 -05:00

plan_normalization_test.go

Port and AllocatedPortMapping msgpack omitempty (#23980)

2024-09-17 14:21:54 -05:00

plan_queue_test.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

plan_queue.go

Revert "deps: update go-metrics to v0.5.3 (#19190)" (#19374)

2023-12-08 08:46:55 -05:00

raft_rpc.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

regions_endpoint_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

regions_endpoint.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

rpc_rate_metrics.go

Revert "deps: update go-metrics to v0.5.3 (#19190)" (#19374)

2023-12-08 08:46:55 -05:00

rpc_test.go

test: change some helpers testing.T to .TB (#20427)

2024-04-17 14:03:12 -05:00

rpc.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

scaling_endpoint_test.go

scaling policy: use request namespace as target if unset in jobspec (#24065)

2024-10-01 11:41:40 -04:00

scaling_endpoint.go

Revert "deps: update go-metrics to v0.5.3 (#19190)" (#19374)

2023-12-08 08:46:55 -05:00

search_endpoint_ce.go

admin: rename _oss files to _ce (#18209)

2023-08-18 07:47:24 +01:00

search_endpoint_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

search_endpoint.go

acl: remove remaining unused nil ACL object handling (#20456)

2024-04-18 14:34:17 -04:00

serf_test.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

serf.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

server_setup_ce.go

admin: rename _oss files to _ce (#18209)

2023-08-18 07:47:24 +01:00

server_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

server.go

state: remove TimeTable and rely on objects' modify times instead (#24112)

2024-11-01 19:38:04 +01:00

service_registration_endpoint_test.go

services: reject node secret for Read/List RPC (#23910)

2024-09-05 13:52:32 -04:00

service_registration_endpoint.go

deps: update to go-set/v3 and refactor to use custom iterators (#23971)

2024-09-16 13:40:10 -05:00

stats_fetcher_test.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

stats_fetcher.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

status_endpoint_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

status_endpoint.go

auth: use ACLsDisabledACL when ACLs are disabled (#18754)

2023-10-16 09:30:24 -04:00

system_endpoint_test.go

scheduler: fix a bug where force GC wasn't respected (#24456)

2024-11-21 09:07:23 +01:00

system_endpoint.go

auth: use ACLsDisabledACL when ACLs are disabled (#18754)

2023-10-16 09:30:24 -04:00

testing_ce.go

admin: rename _oss files to _ce (#18209)

2023-08-18 07:47:24 +01:00

testing.go

testing: fix serf join on keyring test and tighten serf config (#23594)

2024-07-15 14:17:46 -04:00

util_test.go

test: use correct parallel test setup func (#18326)

2023-08-25 13:51:36 +01:00

util.go

auth: add client-only ACL (#18730)

2023-10-12 12:21:48 -04:00

variables_endpoint_test.go

refactor identity claims constructor to builder (#23708)

2024-08-05 14:31:56 -04:00

variables_endpoint.go

Revert "deps: update go-metrics to v0.5.3 (#19190)" (#19374)

2023-12-08 08:46:55 -05:00

vault_noop.go

vault: remove revoked Vault accessors from state (#19706)

2024-01-11 14:38:51 -05:00

vault_test.go

test: add missing checks for vault binary in unit tests (#23986)

2024-09-18 17:12:29 -04:00

vault_testing.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

vault.go

remove repetitive words (#20110)

2024-03-11 08:52:08 +00:00

worker_string_schedulerworkerstatus.go

Make number of scheduler workers reloadable (#11593)

2022-01-06 11:56:13 -05:00

worker_string_workerstatus.go

Make number of scheduler workers reloadable (#11593)

2022-01-06 11:56:13 -05:00

worker_test.go

test: wait for keyring in plan submission tests (#24122)

2024-10-03 13:22:41 -04:00

worker.go

Fix server shutdown not waiting for worker run completion (#19560)

2024-01-05 08:45:07 -06:00