The RPC handlers expect to see `nil` ACL objects whenever ACLs are disabled. By using `nil` as a sentinel value, we have the risk of nil pointer exceptions and improper handling of `nil` when returned from our various auth methods that can lead to privilege escalation bugs. This is the final patch in a series to eliminate the use of `nil` ACLs as a sentinel value for when ACLs are disabled. This patch adds a new virtual ACL policy field for when ACLs are disabled and updates our authentication logic to use it. Included: * Extends auth package tests to demonstrate that nil ACLs are treated as failed auth and disabled ACLs succeed auth. * Adds a new `AllowDebug` ACL check for the weird special casing we have for pprof debugging when ACLs are disabled. * Removes the remaining unexported methods (and repeated tests) from the `nomad/acl.go` file. * Update the semgrep rules to detect improper nil ACL checking and remove the old invalid ACL checks. * Update the contributing guide for RPC authentication. Ref: https://github.com/hashicorp/nomad-enterprise/pull/1218 Ref: https://github.com/hashicorp/nomad/pull/18703 Ref: https://github.com/hashicorp/nomad/pull/18715 Ref: https://github.com/hashicorp/nomad/pull/16799 Ref: https://github.com/hashicorp/nomad/pull/18730 Ref: https://github.com/hashicorp/nomad/pull/18744
Nomad Codebase Documentation
This directory contains some documentation about the Nomad codebase, aimed at readers who are interested in making code contributions.
If you're looking for information on using Nomad, please instead refer to the Nomad website.
Developing with Vagrant
A development environment is supplied via Vagrant to make getting started easier.
-
Install Vagrant
-
Install Virtualbox
-
Bring up the Vagrant project
$ git clone https://github.com/hashicorp/nomad.git $ cd nomad $ vagrant upThe virtual machine will launch, and a provisioning script will install the needed dependencies within the VM.
-
SSH into the VM
$ vagrant ssh
Developing without Vagrant
- Install Go 1.21.3+ (Note:
gcc-gois not supported) - Clone this repo
$ git clone https://github.com/hashicorp/nomad.git $ cd nomad - Bootstrap your environment
$ make bootstrap - (Optionally) Set a higher ulimit, as Nomad creates many file handles during normal operations
$ [ "$(ulimit -n)" -lt 1024 ] && ulimit -n 1024 - Verify you can run smoke tests
Note: You can think of this as a
$ make testsmoketest which runs a subset of tests and some may fail because ofoperation not permittederror which requiresrootaccess. You can usego testto test the specific subsystem which you are working on and let the CI run rest of the tests for you.
Running a development build
- Compile a development binary (see the UI README to include the web UI in the binary)
$ make dev # find the built binary at ./bin/nomad - Start the agent in dev mode
$ sudo bin/nomad agent -dev - (Optionally) Run Consul to enable service discovery and health checks
- Download Consul
- Start Consul in dev mode
$ consul agent -dev
Compiling Protobufs
If in the course of your development you change a Protobuf file (those ending in .proto), you'll need to recompile the protos.
- Run
make boostrapto install thebufcommand. - Compile Protobufs
$ make proto
Building the Web UI
See the UI README for instructions.
Create a release binary
To create a release binary:
$ make prerelease
$ make release
$ ls ./pkg
This will generate all the static assets, compile Nomad for multiple
platforms and place the resulting binaries into the ./pkg directory.
API Compatibility
Only the api/ and plugins/ packages are intended to be imported by other projects. The root Nomad module does not follow semver and is not intended to be imported directly by other projects.
Architecture
The code for Nomad's major components is organized as:
api/provides a Go client for Nomad's HTTP API.client/contains Nomad's client agent code.command/contains Nomad's CLI code.nomad/contains Nomad's server agent code.ui/contains Nomad's UI code.website/contains Nomad's website and documentation.
The high level control flow for many Nomad actions (via the CLI or UI) are:
# Read actions:
Client -> HTTP API -> RPC -> StateStore
# Actions that change state:
Client -> HTTP API -> RPC -> Raft -> FSM -> StateStore
Checklists
When adding new features to Nomad there are often many places to make changes. It is difficult to determine where changes must be made and easy to make mistakes.
The following checklists are meant to be copied and pasted into PRs to give developers and reviewers confidence that the proper changes have been made: