Files
nomad/contributing
Tim Gross cbd7248248 auth: use ACLsDisabledACL when ACLs are disabled (#18754)
The RPC handlers expect to see `nil` ACL objects whenever ACLs are disabled. By
using `nil` as a sentinel value, we have the risk of nil pointer exceptions and
improper handling of `nil` when returned from our various auth methods that can
lead to privilege escalation bugs. This is the final patch in a series to
eliminate the use of `nil` ACLs as a sentinel value for when ACLs are disabled.

This patch adds a new virtual ACL policy field for when ACLs are disabled and
updates our authentication logic to use it. Included:

* Extends auth package tests to demonstrate that nil ACLs are treated as failed
  auth and disabled ACLs succeed auth.
* Adds a new `AllowDebug` ACL check for the weird special casing we have for
  pprof debugging when ACLs are disabled.
* Removes the remaining unexported methods (and repeated tests) from the
  `nomad/acl.go` file.
* Update the semgrep rules to detect improper nil ACL checking and remove the
  old invalid ACL checks.
* Update the contributing guide for RPC authentication.

Ref: https://github.com/hashicorp/nomad-enterprise/pull/1218
Ref: https://github.com/hashicorp/nomad/pull/18703
Ref: https://github.com/hashicorp/nomad/pull/18715
Ref: https://github.com/hashicorp/nomad/pull/16799
Ref: https://github.com/hashicorp/nomad/pull/18730
Ref: https://github.com/hashicorp/nomad/pull/18744
2023-10-16 09:30:24 -04:00
..
2022-03-09 12:46:57 -06:00
2021-10-04 13:50:42 -04:00
2023-03-20 16:35:32 -04:00
2023-10-10 16:37:24 -04:00

Nomad Codebase Documentation

This directory contains some documentation about the Nomad codebase, aimed at readers who are interested in making code contributions.

If you're looking for information on using Nomad, please instead refer to the Nomad website.

Developing with Vagrant

A development environment is supplied via Vagrant to make getting started easier.

  1. Install Vagrant

  2. Install Virtualbox

  3. Bring up the Vagrant project

    $ git clone https://github.com/hashicorp/nomad.git
    $ cd nomad
    $ vagrant up
    

    The virtual machine will launch, and a provisioning script will install the needed dependencies within the VM.

  4. SSH into the VM

    $ vagrant ssh
    

Developing without Vagrant

  1. Install Go 1.21.3+ (Note: gcc-go is not supported)
  2. Clone this repo
    $ git clone https://github.com/hashicorp/nomad.git
    $ cd nomad
    
  3. Bootstrap your environment
    $ make bootstrap
    
  4. (Optionally) Set a higher ulimit, as Nomad creates many file handles during normal operations
    $ [ "$(ulimit -n)" -lt 1024 ] && ulimit -n 1024
    
  5. Verify you can run smoke tests
    $ make test
    
    Note: You can think of this as a smoke test which runs a subset of tests and some may fail because of operation not permitted error which requires root access. You can use go test to test the specific subsystem which you are working on and let the CI run rest of the tests for you.

Running a development build

  1. Compile a development binary (see the UI README to include the web UI in the binary)
    $ make dev
    # find the built binary at ./bin/nomad
    
  2. Start the agent in dev mode
    $ sudo bin/nomad agent -dev
    
  3. (Optionally) Run Consul to enable service discovery and health checks
    1. Download Consul
    2. Start Consul in dev mode
      $ consul agent -dev
      

Compiling Protobufs

If in the course of your development you change a Protobuf file (those ending in .proto), you'll need to recompile the protos.

  1. Run make boostrap to install the buf command.
  2. Compile Protobufs
    $ make proto
    

Building the Web UI

See the UI README for instructions.

Create a release binary

To create a release binary:

$ make prerelease
$ make release
$ ls ./pkg

This will generate all the static assets, compile Nomad for multiple platforms and place the resulting binaries into the ./pkg directory.

API Compatibility

Only the api/ and plugins/ packages are intended to be imported by other projects. The root Nomad module does not follow semver and is not intended to be imported directly by other projects.

Architecture

The code for Nomad's major components is organized as:

  • api/ provides a Go client for Nomad's HTTP API.
  • client/ contains Nomad's client agent code.
  • command/ contains Nomad's CLI code.
  • nomad/ contains Nomad's server agent code.
  • ui/ contains Nomad's UI code.
  • website/ contains Nomad's website and documentation.

The high level control flow for many Nomad actions (via the CLI or UI) are:

# Read actions:
Client -> HTTP API -> RPC -> StateStore

# Actions that change state:
Client -> HTTP API -> RPC -> Raft -> FSM -> StateStore

Checklists

When adding new features to Nomad there are often many places to make changes. It is difficult to determine where changes must be made and easy to make mistakes.

The following checklists are meant to be copied and pasted into PRs to give developers and reviewers confidence that the proper changes have been made:

Tooling