Tim Gross ce04fe4a4e acls: reduce permissions of client agent virtual policy (#23304) ...

Nomad client agents run as privileged processes and require access to much of
the cluster state, secrets, etc. to operate. But we can improve upon this by
tightening up the virtual policy that use for RPC requests authenticated by the
node secret ID. This changeset removes the `node:read`, `plugin:read`, and
`plugin:list` policy, as well as namespace operations. In return, we add a
`AllowClientOp` check to the RPCs the client uses that would otherwise need
those policies.

Where possible, the update RPCs have also been changed to match on node ID so
that a client can only make the RPC that impacts itself. In future work, we may
be able to downscope further by adding node pool filtering to `AllowClientOp`.

Ref: https://github.com/hashicorp/nomad-enterprise/issues/1528
Ref: https://github.com/hashicorp/nomad-enterprise/pull/1529
Ref: https://hashicorp.atlassian.net/browse/NET-9925

2024-06-12 11:32:22 -04:00

..

auth

deps: purge use of old x/exp packages (#20373)

2024-04-12 08:29:00 -05:00

deploymentwatcher

deployment watcher: fix goroutine leak when job is purged (#20348)

2024-04-11 14:51:05 -04:00

drainer

update go1.21 (#18184)

2023-08-14 08:43:27 -05:00

lock

license: fix some imports of BUSL-1.1 in MPL-2.0 (#19832)

2024-01-29 12:04:12 -05:00

mock

job endpoint: fix implicit constraint mutation for task-level services (#22229)

2024-05-23 19:27:47 +02:00

reporting

server: Add reporting configuration to nomad server (#18609)

2023-09-28 22:00:43 +02:00

state

CSI: allow plugin GC to detect jobs with updated plugin IDs (#20555)

2024-05-16 10:29:07 -04:00

stream

acl: remove remaining unused nil ACL object handling (#20456)

2024-04-18 14:34:17 -04:00

structs

numa: fix scheduler panic due to topology serialization bug (#23284)

2024-06-11 08:55:00 -04:00

volumewatcher

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

acl_endpoint_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

acl_endpoint.go

acl: remove unused nil ACL object handling (#20150)

2024-03-18 10:04:51 -04:00

acl_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

acl.go

server: use same receiver name for all server funcs. (#18896)

2023-10-27 16:36:10 +01:00

alloc_endpoint_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

alloc_endpoint.go

acls: reduce permissions of client agent virtual policy (#23304)

2024-06-12 11:32:22 -04:00

autopilot_ce.go

autopilot: add Enterprise health information to API endpoint (#20153)

2024-03-18 11:38:17 -04:00

autopilot_test.go

autopilot: add Enterprise health information to API endpoint (#20153)

2024-03-18 11:38:17 -04:00

autopilot.go

autopilot: add Enterprise health information to API endpoint (#20153)

2024-03-18 11:38:17 -04:00

blocked_evals_stats_test.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

blocked_evals_stats.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

blocked_evals_system.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

blocked_evals_test.go

scheduler: appropriately unblock evals with quotas (#18838)

2023-10-24 11:22:24 -05:00

blocked_evals.go

Revert "deps: update go-metrics to v0.5.3 (#19190)" (#19374)

2023-12-08 08:46:55 -05:00

client_agent_endpoint_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

client_agent_endpoint.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

client_alloc_endpoint_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

client_alloc_endpoint.go

jobspec: time based task execution (#22201)

2024-05-22 15:40:25 -05:00

client_csi_endpoint_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

client_csi_endpoint.go

Revert "deps: update go-metrics to v0.5.3 (#19190)" (#19374)

2023-12-08 08:46:55 -05:00

client_fs_endpoint_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

client_fs_endpoint.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

client_meta_endpoint_test.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

client_meta_endpoint.go

Revert "deps: update go-metrics to v0.5.3 (#19190)" (#19374)

2023-12-08 08:46:55 -05:00

client_rpc_test.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

client_rpc.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

client_stats_endpoint_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

client_stats_endpoint.go

Revert "deps: update go-metrics to v0.5.3 (#19190)" (#19374)

2023-12-08 08:46:55 -05:00

config.go

metrics: quota utilization configuration and documentation (#22912)

2024-06-03 21:06:19 +02:00

consul_ce_test.go

admin: rename _oss files to _ce (#18209)

2023-08-18 07:47:24 +01:00

consul_policy_ce_test.go

admin: rename _oss files to _ce (#18209)

2023-08-18 07:47:24 +01:00

consul_policy_test.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

consul_policy.go

Fixes Consul token checking when policies exist within namespaces (#18516)

2023-12-11 10:07:32 -06:00

consul_test.go

consul: set partition for gateway config entries (#22228)

2024-05-29 16:31:02 -04:00

consul.go

consul: set partition for gateway config entries (#22228)

2024-05-29 16:31:02 -04:00

core_sched_test.go

CSI: allow plugin GC to detect jobs with updated plugin IDs (#20555)

2024-05-16 10:29:07 -04:00

core_sched.go

core: do not create evaluations within batch deregister endpoint. (#20510)

2024-05-07 07:39:13 +01:00

csi_endpoint_test.go

acls: reduce permissions of client agent virtual policy (#23304)

2024-06-12 11:32:22 -04:00

csi_endpoint.go

acls: reduce permissions of client agent virtual policy (#23304)

2024-06-12 11:32:22 -04:00

deployment_endpoint_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

deployment_endpoint.go

Revert "deps: update go-metrics to v0.5.3 (#19190)" (#19374)

2023-12-08 08:46:55 -05:00

deployment_watcher_shims.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

drainer_int_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

drainer_shims.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

encrypter_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

encrypter.go

keyring: replicate RSA private key via GetKey RPC (#19350)

2023-12-07 14:15:08 -05:00

endpoints_ce.go

admin: rename _oss files to _ce (#18209)

2023-08-18 07:47:24 +01:00

eval_broker_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

eval_broker.go

eval_broker: track enqueue and dequeue times (#20329)

2024-04-15 16:16:50 +02:00

eval_endpoint_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

eval_endpoint.go

Revert "deps: update go-metrics to v0.5.3 (#19190)" (#19374)

2023-12-08 08:46:55 -05:00

event_endpoint_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

event_endpoint.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

fsm_ce.go

Update nomad operator snapshot inspect with more detail (#20062)

2024-06-06 06:57:10 +01:00

fsm_registry_ce.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

fsm_test.go

state: ensure the job submission table is persisted and restored. (#19605)

2024-01-05 08:12:27 +00:00

fsm.go

Update nomad operator snapshot inspect with more detail (#20062)

2024-06-06 06:57:10 +01:00

heartbeat_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

heartbeat.go

Revert "deps: update go-metrics to v0.5.3 (#19190)" (#19374)

2023-12-08 08:46:55 -05:00

job_endpoint_ce_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

job_endpoint_ce.go

[sentinel] Add existing job to enforceSubmitJob (#18553)

2023-09-21 14:12:51 -04:00

job_endpoint_hook_connect_test.go

Permit Consul Connect Gateways to be used with podman (#20611)

2024-05-17 09:26:09 -05:00

job_endpoint_hook_connect.go

Consul Connect: Fix validation with multiple local_bind_socket_paths (#22312)

2024-06-04 08:46:24 -04:00

job_endpoint_hook_consul_ce_test.go

consul: support admin partitions (#19665)

2024-01-10 10:41:29 -05:00

job_endpoint_hook_consul_ce.go

consul: refactor job mutation hook (#19699)

2024-01-10 16:29:05 -05:00

job_endpoint_hook_consul.go

consul: refactor job mutation hook (#19699)

2024-01-10 16:29:05 -05:00

job_endpoint_hook_expose_check_test.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

job_endpoint_hook_expose_check.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

job_endpoint_hook_implicit_identities_test.go

client version constraints for implicit identities for WI (#18932)

2023-12-01 13:51:21 -05:00

job_endpoint_hook_implicit_identities.go

client version constraints for implicit identities for WI (#18932)

2023-12-01 13:51:21 -05:00

job_endpoint_hook_node_pool_ce.go

admin: rename _oss files to _ce (#18209)

2023-08-18 07:47:24 +01:00

job_endpoint_hook_node_pool.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

job_endpoint_hook_numa_ce_test.go

core: plumbing to support numa aware scheduling (#18681)

2023-10-19 15:09:30 -05:00

job_endpoint_hook_numa_ce.go

core: plumbing to support numa aware scheduling (#18681)

2023-10-19 15:09:30 -05:00

job_endpoint_hook_numa.go

core: plumbing to support numa aware scheduling (#18681)

2023-10-19 15:09:30 -05:00

job_endpoint_hook_sched_ce.go

jobspec: time based task execution (#22201)

2024-05-22 15:40:25 -05:00

job_endpoint_hook_sched.go

jobspec: time based task execution (#22201)

2024-05-22 15:40:25 -05:00

job_endpoint_hook_vault_ce_test.go

config: fix panic in job using Vault cluster not in agent config. (#22227)

2024-05-24 15:13:20 +01:00

job_endpoint_hook_vault_ce.go

core: plumbing to support numa aware scheduling (#18681)

2023-10-19 15:09:30 -05:00

job_endpoint_hook_vault.go

vault: ignore allow_unauthenticated config if identity is set (#19585)

2024-01-02 16:46:34 -05:00

job_endpoint_hooks_test.go

job endpoint: fix implicit constraint mutation for task-level services (#22229)

2024-05-23 19:27:47 +02:00

job_endpoint_hooks.go

job endpoint: fix implicit constraint mutation for task-level services (#22229)

2024-05-23 19:27:47 +02:00

job_endpoint_statuses_test.go

api: new /v1/jobs/statuses endpoint for /ui/jobs page (#20130)

2024-05-03 15:01:40 -05:00

job_endpoint_statuses.go

jobspec: time based task execution (#22201)

2024-05-22 15:40:25 -05:00

job_endpoint_test.go

numa: fix scheduler panic due to topology serialization bug (#23284)

2024-06-11 08:55:00 -04:00

job_endpoint_validators_test.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

job_endpoint_validators.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

job_endpoint.go

consul: set partition for gateway config entries (#22228)

2024-05-29 16:31:02 -04:00

keyring_endpoint_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

keyring_endpoint.go

Revert "deps: update go-metrics to v0.5.3 (#19190)" (#19374)

2023-12-08 08:46:55 -05:00

leader_ce.go

[f-gh-1106-reporting] Use full cluster metadata for reporting (#18660)

2023-10-05 09:32:54 +02:00

leader_test.go

vault: remove revoked Vault accessors from state (#19706)

2024-01-11 14:38:51 -05:00

leader.go

state: enable more reverse sorting (#20410)

2024-04-16 15:10:11 -05:00

license_config_ce.go

admin: rename _oss files to _ce (#18209)

2023-08-18 07:47:24 +01:00

license_config.go

all: swap exp packages for maps, slices (#18311)

2023-08-23 15:42:13 -05:00

locks_test.go

identity: default to RS256 for new workload ids (#18882)

2023-10-31 11:25:20 -07:00

locks.go

[17449] Introduces a locking mechanism over variables (#18207)

2023-09-21 17:56:33 +02:00

merge.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

namespace_endpoint_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

namespace_endpoint.go

acl: remove remaining unused nil ACL object handling (#20456)

2024-04-18 14:34:17 -04:00

node_endpoint_test.go

services: fix data integrity errors for Nomad native services (#20590)

2024-05-15 11:56:07 -04:00

node_endpoint.go

acls: reduce permissions of client agent virtual policy (#23304)

2024-06-12 11:32:22 -04:00

node_pool_endpoint_ce.go

admin: rename _oss files to _ce (#18209)

2023-08-18 07:47:24 +01:00

node_pool_endpoint_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

node_pool_endpoint.go

state: enable more reverse sorting (#20410)

2024-04-16 15:10:11 -05:00

operator_endpoint_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

operator_endpoint.go

acl: remove remaining unused nil ACL object handling (#20456)

2024-04-18 14:34:17 -04:00

periodic_endpoint_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

periodic_endpoint.go

Revert "deps: update go-metrics to v0.5.3 (#19190)" (#19374)

2023-12-08 08:46:55 -05:00

periodic_test.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

periodic.go

state: enable more reverse sorting (#20410)

2024-04-16 15:10:11 -05:00

plan_apply_ce.go

admin: rename _oss files to _ce (#18209)

2023-08-18 07:47:24 +01:00

plan_apply_node_tracker_test.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

plan_apply_node_tracker.go

Revert "deps: update go-metrics to v0.5.3 (#19190)" (#19374)

2023-12-08 08:46:55 -05:00

plan_apply_pool_test.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

plan_apply_pool.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

plan_apply_test.go

core: plumbing to support numa aware scheduling (#18681)

2023-10-19 15:09:30 -05:00

plan_apply.go

Introduces Disconnect block into the TaskGroup configuration (#19886)

2024-02-19 16:41:35 +01:00

plan_endpoint_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

plan_endpoint.go

Revert "deps: update go-metrics to v0.5.3 (#19190)" (#19374)

2023-12-08 08:46:55 -05:00

plan_normalization_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

plan_queue_test.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

plan_queue.go

Revert "deps: update go-metrics to v0.5.3 (#19190)" (#19374)

2023-12-08 08:46:55 -05:00

raft_rpc.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

regions_endpoint_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

regions_endpoint.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

rpc_rate_metrics.go

Revert "deps: update go-metrics to v0.5.3 (#19190)" (#19374)

2023-12-08 08:46:55 -05:00

rpc_test.go

test: change some helpers testing.T to .TB (#20427)

2024-04-17 14:03:12 -05:00

rpc.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

scaling_endpoint_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

scaling_endpoint.go

Revert "deps: update go-metrics to v0.5.3 (#19190)" (#19374)

2023-12-08 08:46:55 -05:00

search_endpoint_ce.go

admin: rename _oss files to _ce (#18209)

2023-08-18 07:47:24 +01:00

search_endpoint_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

search_endpoint.go

acl: remove remaining unused nil ACL object handling (#20456)

2024-04-18 14:34:17 -04:00

serf_test.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

serf.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

server_setup_ce.go

admin: rename _oss files to _ce (#18209)

2023-08-18 07:47:24 +01:00

server_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

server.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

service_registration_endpoint_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

service_registration_endpoint.go

acls: reduce permissions of client agent virtual policy (#23304)

2024-06-12 11:32:22 -04:00

stats_fetcher_test.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

stats_fetcher.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

status_endpoint_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

status_endpoint.go

auth: use ACLsDisabledACL when ACLs are disabled (#18754)

2023-10-16 09:30:24 -04:00

system_endpoint_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

system_endpoint.go

auth: use ACLsDisabledACL when ACLs are disabled (#18754)

2023-10-16 09:30:24 -04:00

testing_ce.go

admin: rename _oss files to _ce (#18209)

2023-08-18 07:47:24 +01:00

testing.go

test: change some helpers testing.T to .TB (#20427)

2024-04-17 14:03:12 -05:00

timetable_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

timetable.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

util_test.go

test: use correct parallel test setup func (#18326)

2023-08-25 13:51:36 +01:00

util.go

auth: add client-only ACL (#18730)

2023-10-12 12:21:48 -04:00

variables_endpoint_test.go

Upgrade go-msgpack to v2 (#20173)

2024-03-21 11:44:23 -07:00

variables_endpoint.go

Revert "deps: update go-metrics to v0.5.3 (#19190)" (#19374)

2023-12-08 08:46:55 -05:00

vault_noop.go

vault: remove revoked Vault accessors from state (#19706)

2024-01-11 14:38:51 -05:00

vault_test.go

vault: use an importable const for Vault header string. (#18740)

2023-10-13 07:39:06 +01:00

vault_testing.go

Update copyright file headers to BUSL-1.1

2023-08-10 17:27:09 -05:00

vault.go

remove repetitive words (#20110)

2024-03-11 08:52:08 +00:00

worker_string_schedulerworkerstatus.go

Make number of scheduler workers reloadable (#11593)

2022-01-06 11:56:13 -05:00

worker_string_workerstatus.go

Make number of scheduler workers reloadable (#11593)

2022-01-06 11:56:13 -05:00

worker_test.go

Fix server shutdown not waiting for worker run completion (#19560)

2024-01-05 08:45:07 -06:00

worker.go

Fix server shutdown not waiting for worker run completion (#19560)

2024-01-05 08:45:07 -06:00