2019-08-15 15:22:37 +00:00
|
|
|
package nomad
|
|
|
|
|
|
|
|
import (
|
|
|
|
"fmt"
|
|
|
|
"time"
|
|
|
|
|
|
|
|
"github.com/hashicorp/nomad/helper/uuid"
|
|
|
|
"github.com/hashicorp/nomad/nomad/structs"
|
|
|
|
)
|
|
|
|
|
|
|
|
var (
|
2019-08-20 05:22:46 +00:00
|
|
|
// connectSidecarResources returns the set of resources used by default for
|
|
|
|
// the Consul Connect sidecar task
|
|
|
|
connectSidecarResources = func() *structs.Resources {
|
|
|
|
return &structs.Resources{
|
|
|
|
CPU: 250,
|
|
|
|
MemoryMB: 128,
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
// connectDriverConfig is the driver configuration used by the injected
|
|
|
|
// connect proxy sidecar task
|
|
|
|
connectDriverConfig = map[string]interface{}{
|
|
|
|
"image": "${meta.connect.sidecar_image}",
|
|
|
|
"args": []interface{}{
|
2019-09-03 15:43:38 +00:00
|
|
|
"-c", structs.EnvoyBootstrapPath,
|
2019-08-20 05:22:46 +00:00
|
|
|
"-l", "${meta.connect.log_level}",
|
2019-12-06 06:49:01 +00:00
|
|
|
"--disable-hot-restart",
|
2019-08-20 05:22:46 +00:00
|
|
|
},
|
2019-08-15 15:22:37 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// connectVersionConstraint is used when building the sidecar task to ensure
|
|
|
|
// the proper Consul version is used that supports the nessicary Connect
|
|
|
|
// features. This includes bootstraping envoy with a unix socket for Consul's
|
|
|
|
// grpc xDS api.
|
2019-08-20 05:22:46 +00:00
|
|
|
connectVersionConstraint = func() *structs.Constraint {
|
|
|
|
return &structs.Constraint{
|
|
|
|
LTarget: "${attr.consul.version}",
|
2019-11-13 23:36:15 +00:00
|
|
|
RTarget: ">= 1.6.0-beta1",
|
|
|
|
Operand: structs.ConstraintSemver,
|
2019-08-20 05:22:46 +00:00
|
|
|
}
|
2019-08-15 15:22:37 +00:00
|
|
|
}
|
|
|
|
)
|
|
|
|
|
2019-12-06 20:46:46 +00:00
|
|
|
// jobConnectHook implements a job Mutating and Validating admission controller
|
2019-08-15 15:22:37 +00:00
|
|
|
type jobConnectHook struct{}
|
|
|
|
|
|
|
|
func (jobConnectHook) Name() string {
|
|
|
|
return "connect"
|
|
|
|
}
|
|
|
|
|
|
|
|
func (jobConnectHook) Mutate(job *structs.Job) (_ *structs.Job, warnings []error, err error) {
|
|
|
|
for _, g := range job.TaskGroups {
|
2019-10-28 14:46:51 +00:00
|
|
|
// TG isn't validated yet, but validation
|
|
|
|
// may depend on mutation results.
|
|
|
|
// Do basic validation here and skip mutation,
|
|
|
|
// so Validate can return a meaningful error
|
|
|
|
// messages
|
|
|
|
if len(g.Networks) == 0 {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
2019-12-12 23:46:14 +00:00
|
|
|
if err := groupConnectHook(job, g); err != nil {
|
2019-08-15 15:22:37 +00:00
|
|
|
return nil, nil, err
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return job, nil, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func (jobConnectHook) Validate(job *structs.Job) (warnings []error, err error) {
|
|
|
|
for _, g := range job.TaskGroups {
|
|
|
|
w, err := groupConnectValidate(g)
|
|
|
|
if err != nil {
|
|
|
|
return nil, err
|
|
|
|
}
|
|
|
|
if w != nil {
|
|
|
|
warnings = append(warnings, w...)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return warnings, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
// getSidecarTaskForService looks for the sidecar task for a given service within
|
|
|
|
// a task group. If no sidecar task is found nil is returned
|
|
|
|
func getSidecarTaskForService(tg *structs.TaskGroup, svc string) *structs.Task {
|
|
|
|
for _, t := range tg.Tasks {
|
|
|
|
if isSidecarForService(t, svc) {
|
|
|
|
return t
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
|
|
|
func isSidecarForService(t *structs.Task, svc string) bool {
|
|
|
|
return t.Kind == structs.TaskKind(fmt.Sprintf("%s:%s", structs.ConnectProxyPrefix, svc))
|
|
|
|
}
|
|
|
|
|
2019-12-12 23:46:14 +00:00
|
|
|
func groupConnectHook(job *structs.Job, g *structs.TaskGroup) error {
|
2019-08-15 15:22:37 +00:00
|
|
|
for _, service := range g.Services {
|
|
|
|
if service.Connect.HasSidecar() {
|
|
|
|
// Check to see if the sidecar task already exists
|
|
|
|
task := getSidecarTaskForService(g, service.Name)
|
|
|
|
|
|
|
|
// If the task doesn't already exist, create a new one and add it to the job
|
|
|
|
if task == nil {
|
2019-12-12 23:46:14 +00:00
|
|
|
task = newConnectTask(service.Name)
|
2019-08-15 15:22:37 +00:00
|
|
|
|
|
|
|
// If there happens to be a task defined with the same name
|
|
|
|
// append an UUID fragment to the task name
|
|
|
|
for _, t := range g.Tasks {
|
|
|
|
if t.Name == task.Name {
|
|
|
|
task.Name = task.Name + "-" + uuid.Generate()[:6]
|
|
|
|
break
|
|
|
|
}
|
|
|
|
}
|
|
|
|
g.Tasks = append(g.Tasks, task)
|
|
|
|
}
|
|
|
|
|
2019-08-20 05:22:46 +00:00
|
|
|
if service.Connect.SidecarTask != nil {
|
|
|
|
service.Connect.SidecarTask.MergeIntoTask(task)
|
|
|
|
}
|
2019-08-15 15:22:37 +00:00
|
|
|
|
2019-12-12 23:46:14 +00:00
|
|
|
// Canonicalize task since this mutator runs after job canonicalization
|
|
|
|
task.Canonicalize(job, g)
|
|
|
|
|
2019-08-15 15:22:37 +00:00
|
|
|
// port to be added for the sidecar task's proxy port
|
|
|
|
port := structs.Port{
|
|
|
|
Label: fmt.Sprintf("%s-%s", structs.ConnectProxyPrefix, service.Name),
|
|
|
|
|
|
|
|
// -1 is a sentinel value to instruct the
|
|
|
|
// scheduler to map the host's dynamic port to
|
|
|
|
// the same port in the netns.
|
|
|
|
To: -1,
|
|
|
|
}
|
|
|
|
|
|
|
|
// check that port hasn't already been defined before adding it to tg
|
|
|
|
var found bool
|
|
|
|
for _, p := range g.Networks[0].DynamicPorts {
|
|
|
|
if p.Label == port.Label {
|
|
|
|
found = true
|
|
|
|
break
|
|
|
|
}
|
|
|
|
}
|
|
|
|
if !found {
|
|
|
|
g.Networks[0].DynamicPorts = append(g.Networks[0].DynamicPorts, port)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
|
2019-12-12 23:46:14 +00:00
|
|
|
func newConnectTask(serviceName string) *structs.Task {
|
2019-08-15 15:22:37 +00:00
|
|
|
task := &structs.Task{
|
|
|
|
// Name is used in container name so must start with '[A-Za-z0-9]'
|
2019-12-12 23:46:14 +00:00
|
|
|
Name: fmt.Sprintf("%s-%s", structs.ConnectProxyPrefix, serviceName),
|
|
|
|
Kind: structs.TaskKind(fmt.Sprintf("%s:%s", structs.ConnectProxyPrefix, serviceName)),
|
2019-08-20 05:22:46 +00:00
|
|
|
Driver: "docker",
|
|
|
|
Config: connectDriverConfig,
|
2019-08-15 15:22:37 +00:00
|
|
|
ShutdownDelay: 5 * time.Second,
|
|
|
|
LogConfig: &structs.LogConfig{
|
|
|
|
MaxFiles: 2,
|
|
|
|
MaxFileSizeMB: 2,
|
|
|
|
},
|
2019-08-20 05:22:46 +00:00
|
|
|
Resources: connectSidecarResources(),
|
2019-08-15 15:22:37 +00:00
|
|
|
Constraints: structs.Constraints{
|
2019-08-20 05:22:46 +00:00
|
|
|
connectVersionConstraint(),
|
2019-08-15 15:22:37 +00:00
|
|
|
},
|
|
|
|
}
|
|
|
|
|
|
|
|
return task
|
|
|
|
}
|
|
|
|
|
|
|
|
func groupConnectValidate(g *structs.TaskGroup) (warnings []error, err error) {
|
|
|
|
for _, s := range g.Services {
|
|
|
|
if s.Connect.HasSidecar() {
|
|
|
|
if n := len(g.Networks); n != 1 {
|
|
|
|
return nil, fmt.Errorf("Consul Connect sidecars require exactly 1 network, found %d in group %q", n, g.Name)
|
|
|
|
}
|
|
|
|
|
|
|
|
if g.Networks[0].Mode != "bridge" {
|
|
|
|
return nil, fmt.Errorf("Consul Connect sidecar requires bridge network, found %q in group %q", g.Networks[0].Mode, g.Name)
|
|
|
|
}
|
|
|
|
|
|
|
|
// Stopping loop, only need to do the validation once
|
|
|
|
break
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
return nil, nil
|
|
|
|
}
|