2020-05-13 20:15:55 +00:00
|
|
|
package taskrunner
|
|
|
|
|
|
|
|
import (
|
|
|
|
"context"
|
2022-04-02 00:24:02 +00:00
|
|
|
"fmt"
|
2020-05-13 20:15:55 +00:00
|
|
|
"io"
|
|
|
|
"os"
|
|
|
|
"path/filepath"
|
|
|
|
|
2022-04-02 00:24:02 +00:00
|
|
|
"github.com/hashicorp/go-hclog"
|
2020-07-13 21:53:10 +00:00
|
|
|
"github.com/hashicorp/nomad/client/allocdir"
|
2020-05-13 20:15:55 +00:00
|
|
|
ifs "github.com/hashicorp/nomad/client/allocrunner/interfaces"
|
|
|
|
"github.com/hashicorp/nomad/nomad/structs"
|
|
|
|
"github.com/hashicorp/nomad/nomad/structs/config"
|
|
|
|
)
|
|
|
|
|
|
|
|
const (
|
|
|
|
connectNativeHookName = "connect_native"
|
|
|
|
)
|
|
|
|
|
|
|
|
type connectNativeHookConfig struct {
|
|
|
|
consulShareTLS bool
|
|
|
|
consul consulTransportConfig
|
|
|
|
alloc *structs.Allocation
|
|
|
|
logger hclog.Logger
|
|
|
|
}
|
|
|
|
|
|
|
|
func newConnectNativeHookConfig(alloc *structs.Allocation, consul *config.ConsulConfig, logger hclog.Logger) *connectNativeHookConfig {
|
|
|
|
return &connectNativeHookConfig{
|
|
|
|
alloc: alloc,
|
|
|
|
logger: logger,
|
|
|
|
consulShareTLS: consul.ShareSSL == nil || *consul.ShareSSL, // default enabled
|
|
|
|
consul: newConsulTransportConfig(consul),
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// connectNativeHook manages additional automagic configuration for a connect
|
|
|
|
// native task.
|
|
|
|
//
|
|
|
|
// If nomad client is configured to talk to Consul using TLS (or other special
|
|
|
|
// auth), the native task will inherit that configuration EXCEPT for the consul
|
|
|
|
// token.
|
|
|
|
//
|
|
|
|
// If consul is configured with ACLs enabled, a Service Identity token will be
|
|
|
|
// generated on behalf of the native service and supplied to the task.
|
2020-07-13 21:53:10 +00:00
|
|
|
//
|
|
|
|
// If the alloc is configured with bridge networking enabled, the standard
|
|
|
|
// CONSUL_HTTP_ADDR environment variable is defaulted to the unix socket created
|
|
|
|
// for the alloc by the consul_grpc_sock_hook alloc runner hook.
|
2020-05-13 20:15:55 +00:00
|
|
|
type connectNativeHook struct {
|
|
|
|
// alloc is the allocation with the connect native task being run
|
|
|
|
alloc *structs.Allocation
|
|
|
|
|
|
|
|
// consulShareTLS is used to toggle whether the TLS configuration of the
|
|
|
|
// Nomad Client may be shared with Connect Native applications.
|
|
|
|
consulShareTLS bool
|
|
|
|
|
|
|
|
// consulConfig is used to enable the connect native enabled task to
|
|
|
|
// communicate with consul directly, as is necessary for the task to request
|
|
|
|
// its connect mTLS certificates.
|
|
|
|
consulConfig consulTransportConfig
|
|
|
|
|
|
|
|
// logger is used to log things
|
|
|
|
logger hclog.Logger
|
|
|
|
}
|
|
|
|
|
|
|
|
func newConnectNativeHook(c *connectNativeHookConfig) *connectNativeHook {
|
|
|
|
return &connectNativeHook{
|
|
|
|
alloc: c.alloc,
|
|
|
|
consulShareTLS: c.consulShareTLS,
|
|
|
|
consulConfig: c.consul,
|
|
|
|
logger: c.logger.Named(connectNativeHookName),
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func (connectNativeHook) Name() string {
|
|
|
|
return connectNativeHookName
|
|
|
|
}
|
|
|
|
|
2020-07-13 21:53:10 +00:00
|
|
|
// merge b into a, overwriting on conflicts
|
|
|
|
func merge(a, b map[string]string) {
|
|
|
|
for k, v := range b {
|
|
|
|
a[k] = v
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2020-05-13 20:15:55 +00:00
|
|
|
func (h *connectNativeHook) Prestart(
|
|
|
|
ctx context.Context,
|
|
|
|
request *ifs.TaskPrestartRequest,
|
|
|
|
response *ifs.TaskPrestartResponse) error {
|
|
|
|
|
|
|
|
if !request.Task.Kind.IsConnectNative() {
|
|
|
|
response.Done = true
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2020-07-13 21:53:10 +00:00
|
|
|
environment := make(map[string]string)
|
|
|
|
|
2020-05-13 20:15:55 +00:00
|
|
|
if h.consulShareTLS {
|
|
|
|
// copy TLS certificates
|
|
|
|
if err := h.copyCertificates(h.consulConfig, request.TaskDir.SecretsDir); err != nil {
|
|
|
|
h.logger.Error("failed to copy Consul TLS certificates", "error", err)
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
|
|
|
// set environment variables for communicating with Consul agent, but
|
|
|
|
// only if those environment variables are not already set
|
2020-07-13 21:53:10 +00:00
|
|
|
merge(environment, h.tlsEnv(request.TaskEnv.EnvMap))
|
2020-05-13 20:15:55 +00:00
|
|
|
}
|
|
|
|
|
2020-07-13 21:53:10 +00:00
|
|
|
if err := h.maybeSetSITokenEnv(request.TaskDir.SecretsDir, request.Task.Name, environment); err != nil {
|
2020-05-13 20:15:55 +00:00
|
|
|
h.logger.Error("failed to load Consul Service Identity Token", "error", err, "task", request.Task.Name)
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
|
2020-07-13 21:53:10 +00:00
|
|
|
merge(environment, h.bridgeEnv(request.TaskEnv.EnvMap))
|
2021-03-26 17:16:19 +00:00
|
|
|
merge(environment, h.hostEnv(request.TaskEnv.EnvMap))
|
2020-07-13 21:53:10 +00:00
|
|
|
|
2020-05-13 20:15:55 +00:00
|
|
|
// tls/acl setup for native task done
|
|
|
|
response.Done = true
|
2020-07-13 21:53:10 +00:00
|
|
|
response.Env = environment
|
2020-05-13 20:15:55 +00:00
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
const (
|
2020-06-23 17:06:28 +00:00
|
|
|
secretCAFilename = "consul_ca_file.pem"
|
|
|
|
secretCertfileFilename = "consul_cert_file.pem"
|
|
|
|
secretKeyfileFilename = "consul_key_file.pem"
|
2020-05-13 20:15:55 +00:00
|
|
|
)
|
|
|
|
|
|
|
|
func (h *connectNativeHook) copyCertificates(consulConfig consulTransportConfig, dir string) error {
|
|
|
|
if err := h.copyCertificate(consulConfig.CAFile, dir, secretCAFilename); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
if err := h.copyCertificate(consulConfig.CertFile, dir, secretCertfileFilename); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
if err := h.copyCertificate(consulConfig.KeyFile, dir, secretKeyfileFilename); err != nil {
|
|
|
|
return err
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (connectNativeHook) copyCertificate(source, dir, name string) error {
|
|
|
|
if source == "" {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
original, err := os.Open(source)
|
|
|
|
if err != nil {
|
2022-04-02 00:24:02 +00:00
|
|
|
return fmt.Errorf("failed to open consul TLS certificate: %w", err)
|
2020-05-13 20:15:55 +00:00
|
|
|
}
|
|
|
|
defer original.Close()
|
|
|
|
|
|
|
|
destination := filepath.Join(dir, name)
|
|
|
|
fd, err := os.Create(destination)
|
|
|
|
if err != nil {
|
2022-04-02 00:24:02 +00:00
|
|
|
return fmt.Errorf("failed to create secrets/%s: %w", name, err)
|
2020-05-13 20:15:55 +00:00
|
|
|
}
|
|
|
|
defer fd.Close()
|
|
|
|
|
|
|
|
if _, err := io.Copy(fd, original); err != nil {
|
2022-04-02 00:24:02 +00:00
|
|
|
return fmt.Errorf("failed to copy certificate secrets/%s: %w", name, err)
|
2020-05-13 20:15:55 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
if err := fd.Sync(); err != nil {
|
2022-04-02 00:24:02 +00:00
|
|
|
return fmt.Errorf("failed to write secrets/%s: %w", name, err)
|
2020-05-13 20:15:55 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// tlsEnv creates a set of additional of environment variables to be used when launching
|
|
|
|
// the connect native task. This will enable the task to communicate with Consul
|
|
|
|
// if Consul has transport security turned on.
|
|
|
|
//
|
|
|
|
// We do NOT set CONSUL_HTTP_TOKEN from the nomad agent's consul config, as that
|
|
|
|
// is a separate security concern addressed by the service identity hook.
|
|
|
|
func (h *connectNativeHook) tlsEnv(env map[string]string) map[string]string {
|
|
|
|
m := make(map[string]string)
|
|
|
|
|
|
|
|
if _, exists := env["CONSUL_CACERT"]; !exists && h.consulConfig.CAFile != "" {
|
|
|
|
m["CONSUL_CACERT"] = filepath.Join("/secrets", secretCAFilename)
|
|
|
|
}
|
|
|
|
|
|
|
|
if _, exists := env["CONSUL_CLIENT_CERT"]; !exists && h.consulConfig.CertFile != "" {
|
|
|
|
m["CONSUL_CLIENT_CERT"] = filepath.Join("/secrets", secretCertfileFilename)
|
|
|
|
}
|
|
|
|
|
|
|
|
if _, exists := env["CONSUL_CLIENT_KEY"]; !exists && h.consulConfig.KeyFile != "" {
|
|
|
|
m["CONSUL_CLIENT_KEY"] = filepath.Join("/secrets", secretKeyfileFilename)
|
|
|
|
}
|
|
|
|
|
|
|
|
if _, exists := env["CONSUL_HTTP_SSL"]; !exists {
|
|
|
|
if v := h.consulConfig.SSL; v != "" {
|
|
|
|
m["CONSUL_HTTP_SSL"] = v
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if _, exists := env["CONSUL_HTTP_SSL_VERIFY"]; !exists {
|
|
|
|
if v := h.consulConfig.VerifySSL; v != "" {
|
|
|
|
m["CONSUL_HTTP_SSL_VERIFY"] = v
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return m
|
|
|
|
}
|
|
|
|
|
2020-07-13 21:53:10 +00:00
|
|
|
// bridgeEnv creates a set of additional environment variables to be used when launching
|
|
|
|
// the connect native task. This will enable the task to communicate with Consul
|
|
|
|
// if the task is running inside an alloc's network namespace (i.e. bridge mode).
|
|
|
|
//
|
|
|
|
// Sets CONSUL_HTTP_ADDR if not already set.
|
2021-06-23 19:04:10 +00:00
|
|
|
// Sets CONSUL_TLS_SERVER_NAME if not already set, and consul tls is enabled.
|
2020-07-13 21:53:10 +00:00
|
|
|
func (h *connectNativeHook) bridgeEnv(env map[string]string) map[string]string {
|
2021-06-23 19:04:10 +00:00
|
|
|
|
2020-07-13 21:53:10 +00:00
|
|
|
if h.alloc.AllocatedResources.Shared.Networks[0].Mode != "bridge" {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2021-06-23 19:04:10 +00:00
|
|
|
result := make(map[string]string)
|
|
|
|
|
2020-07-13 21:53:10 +00:00
|
|
|
if _, exists := env["CONSUL_HTTP_ADDR"]; !exists {
|
2021-06-23 19:04:10 +00:00
|
|
|
result["CONSUL_HTTP_ADDR"] = "unix:///" + allocdir.AllocHTTPSocket
|
|
|
|
}
|
|
|
|
|
|
|
|
if _, exists := env["CONSUL_TLS_SERVER_NAME"]; !exists {
|
|
|
|
if v := h.consulConfig.SSL; v != "" {
|
|
|
|
result["CONSUL_TLS_SERVER_NAME"] = "localhost"
|
2020-07-13 21:53:10 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2021-06-23 19:04:10 +00:00
|
|
|
return result
|
2020-07-13 21:53:10 +00:00
|
|
|
}
|
|
|
|
|
2021-03-26 17:16:19 +00:00
|
|
|
// hostEnv creates a set of additional environment variables to be used when launching
|
|
|
|
// the connect native task. This will enable the task to communicate with Consul
|
|
|
|
// if the task is running in host network mode.
|
|
|
|
//
|
|
|
|
// Sets CONSUL_HTTP_ADDR if not already set.
|
|
|
|
func (h *connectNativeHook) hostEnv(env map[string]string) map[string]string {
|
|
|
|
if h.alloc.AllocatedResources.Shared.Networks[0].Mode != "host" {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
if _, exists := env["CONSUL_HTTP_ADDR"]; !exists {
|
|
|
|
return map[string]string{
|
|
|
|
"CONSUL_HTTP_ADDR": h.consulConfig.HTTPAddr,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2020-05-13 20:15:55 +00:00
|
|
|
// maybeSetSITokenEnv will set the CONSUL_HTTP_TOKEN environment variable in
|
|
|
|
// the given env map, if the token is found to exist in the task's secrets
|
2020-06-24 14:16:28 +00:00
|
|
|
// directory AND the CONSUL_HTTP_TOKEN environment variable is not already set.
|
2020-05-13 20:15:55 +00:00
|
|
|
//
|
|
|
|
// Following the pattern of the envoy_bootstrap_hook, the Consul Service Identity
|
|
|
|
// ACL Token is generated prior to this hook, if Consul ACLs are enabled. This is
|
|
|
|
// done in the sids_hook, which places the token at secrets/si_token in the task
|
|
|
|
// workspace. The content of that file is the SI token specific to this task
|
|
|
|
// instance.
|
|
|
|
func (h *connectNativeHook) maybeSetSITokenEnv(dir, task string, env map[string]string) error {
|
2020-06-24 14:16:28 +00:00
|
|
|
if _, exists := env["CONSUL_HTTP_TOKEN"]; exists {
|
|
|
|
// Consul token was already set - typically by using the Vault integration
|
2023-01-30 14:48:43 +00:00
|
|
|
// and a template block to set the environment. Ignore the SI token as
|
2020-06-24 14:16:28 +00:00
|
|
|
// the configured token takes precedence.
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2023-03-08 19:25:10 +00:00
|
|
|
token, err := os.ReadFile(filepath.Join(dir, sidsTokenFile))
|
2020-05-13 20:15:55 +00:00
|
|
|
if err != nil {
|
|
|
|
if !os.IsNotExist(err) {
|
2022-04-02 00:24:02 +00:00
|
|
|
return fmt.Errorf("failed to load SI token for native task %s: %w", task, err)
|
2020-05-13 20:15:55 +00:00
|
|
|
}
|
|
|
|
h.logger.Trace("no SI token to load for native task", "task", task)
|
|
|
|
return nil // token file DNE; acls not enabled
|
|
|
|
}
|
|
|
|
h.logger.Trace("recovered pre-existing SI token for native task", "task", task)
|
|
|
|
env["CONSUL_HTTP_TOKEN"] = string(token)
|
|
|
|
return nil
|
|
|
|
}
|