Commit graph

1390 commits

Author SHA1 Message Date
Chris Baker ce68ee164b Version 1.0.3
-----BEGIN PGP SIGNATURE-----
 Version: GnuPG v1
 
 iQEcBAABAgAGBQJgEuOKAAoJEFGFLYc0j/xMxF8H/3TTU6Tu+Xm0YvcsDaYDphZ/
 X7KQBV0aFiuL5VkTw4PzKEsgryIy9/sqEPyxxyKRowAmos9qhiusjNAIfqdP4TF8
 tdZmTedkfWir9uPD+hyv/LXpwbQ2T8kTwS3xHTYvaOmaCxZr710FEn+imnMk1AUn
 Xs5itkd/CYGr0nBLm+I5GutWSDPmL7Uw8J5Z30fFyoaxoCPAbCWQQNk793SCRUc5
 f/uo18V2tFInmQ+3sAdnM4gPewyStK/a5VvzWavL9fVDtYK83wlqWSchTXY5jpVz
 zNEzt/rYhbBzakPQQKb5zieblh2iGI8aHWpD5w4WduqO2Sg6B/5lAeNZIlW0UJg=
 =2g3c
 -----END PGP SIGNATURE-----

Merge tag 'v1.0.3' into post-release-1.0.3

Version 1.0.3
2021-01-29 19:30:08 +00:00
Chris Baker 8806294cd9 updated changelog for release 2021-01-28 14:46:57 +00:00
Seth Hoenig 8b05efcf88 consul/connect: Add support for Connect terminating gateways
This PR implements Nomad built-in support for running Consul Connect
terminating gateways. Such a gateway can be used by services running
inside the service mesh to access "legacy" services running outside
the service mesh while still making use of Consul's service identity
based networking and ACL policies.

https://www.consul.io/docs/connect/gateways/terminating-gateway

These gateways are declared as part of a task group level service
definition within the connect stanza.

service {
  connect {
    gateway {
      proxy {
        // envoy proxy configuration
      }
      terminating {
        // terminating-gateway configuration entry
      }
    }
  }
}

Currently Envoy is the only supported gateway implementation in
Consul. The gateay task can be customized by configuring the
connect.sidecar_task block.

When the gateway.terminating field is set, Nomad will write/update
the Configuration Entry into Consul on job submission. Because CEs
are global in scope and there may be more than one Nomad cluster
communicating with Consul, there is an assumption that any terminating
gateway defined in Nomad for a particular service will be the same
among Nomad clusters.

Gateways require Consul 1.8.0+, checked by a node constraint.

Closes #9445
2021-01-25 10:36:04 -06:00
Tim Gross 45a45ebb3f changelog entry 2021-01-22 13:41:28 -05:00
Tim Gross 64449cddc1 implement alloc runner task restart hook
Most allocation hooks don't need to know when a single task within the
allocation is restarted. The check watcher for group services triggers the
alloc runner to restart all tasks, but the alloc runner's `Restart` method
doesn't trigger any of the alloc hooks, including the group service hook. The
result is that after the first time a check triggers a restart, we'll never
restart the tasks of an allocation again.

This commit adds a `RunnerTaskRestartHook` interface so that alloc runner
hooks can act if a task within the alloc is restarted. The only implementation
is in the group service hook, which will force a re-registration of the
alloc's services and fix check restarts.
2021-01-22 10:55:40 -05:00
Drew Bailey bae0c6cd20
changelog entry for 9768 (#9873) 2021-01-22 09:22:02 -05:00
Charlie Voiselle 4f4d6e6c37
Enable network namespaces for QEMU driver (#9861)
* Enable network namespaces for QEMU driver
* Add CHANGELOG entry
2021-01-21 14:05:46 -05:00
Drew Bailey 3099eb0c73
fix changelog date (#9862) 2021-01-20 13:14:21 -05:00
Seth Hoenig 53218716b3
docs: fix typo in changelog
Co-authored-by: Tim Gross <tgross@hashicorp.com>
2021-01-20 09:50:59 -06:00
Seth Hoenig 991884e715 consul/connect: Enable running multiple ingress gateways per Nomad agent
Connect ingress gateway services were being registered into Consul without
an explicit deterministic service ID. Consul would generate one automatically,
but then Nomad would have no way to register a second gateway on the same agent
as it would not supply 'proxy-id' during envoy bootstrap.

Set the ServiceID for gateways, and supply 'proxy-id' when doing envoy bootstrap.

Fixes #9834
2021-01-19 12:58:36 -06:00
Seth Hoenig f213b8c51b consul/connect: always set gateway proxy default timeout
If the connect.proxy stanza is left unset, the connection timeout
value is not set but is assumed to be, and may cause a non-fatal NPE
on job submission.
2021-01-19 11:23:41 -06:00
Drew Bailey 009b8d5363
Persist shared allocated ports for inplace update (#9830)
* Persist shared allocated ports for inplace update

Ports were not copied over when performing inplace updates in the
generic scheduler

* changelog

* drop spew
2021-01-15 12:45:12 -05:00
leonardobsjr 16ec2c76e7
Missed improvement regarding IGW improvement
Seems like this was missing from the docs. Was trying to make this work on 1.0.1 (it was on the docs), however, it's only working on 1.0.2.
2021-01-15 12:34:11 -03:00
Drew Bailey cdc7f85964
Release 1.0.2 (#9819)
* changelog for release 1.0.2

* Generate files for 1.0.2 release

* Release v1.0.2

* rm generated files, update changelog for next release

* checkout bindata_assetfs

* bump version

Co-authored-by: Nomad Release bot <nomad@hashicorp.com>
2021-01-14 15:08:28 -05:00
Drew Bailey 9cd274ba8d
changelogfmt (#9807) 2021-01-13 15:21:17 -05:00
Drew Bailey a7aaa57258
changelog for release 1.0.2 2021-01-13 11:44:30 -05:00
Dave May 35d43c19ab
nomad agent-info: Add json/gotemplate formatting (#9788)
* nomad agent-info: Add json/gotemplate formatting
* Add CHANGELOG entry
* update docs
2021-01-13 09:42:46 -05:00
Jasmine Dahilig 0b8c1865e1
changelog for #9361 (#9783) 2021-01-12 15:12:49 -05:00
Michael Lange 7f2cb4037a
Merge pull request #9780 from hashicorp/d/changelog-9733
Changelog entry for 9733
2021-01-12 10:34:52 -08:00
Seth Hoenig 17bb46903d
Merge pull request #9770 from hashicorp/docs-update-cl
docs: update cl with graviton fix
2021-01-12 12:30:01 -06:00
Michael Lange 1ea19d8616 Changelog entry for 9733 2021-01-12 09:56:02 -08:00
Florian Apolloner df7e22362d Properly detect unloaded dynamic modules on RHEL derivates. Fixes #9776
The modules.dep file on RHEL includes .xz for compressed kernel modules.
2021-01-12 18:28:00 +01:00
Seth Hoenig c145e630c4 docs: update cl with graviton fix 2021-01-11 12:07:05 -06:00
Tim Gross d78b4fc1a1 safely handle existing net namespace in default network manager
When a client restarts, the network_hook's prerun will call
`CreateNetwork`. Drivers that don't implement their own network manager will
fall back to the default network manager, which doesn't handle the case where
the network namespace is being recreated safely. This results in an error and
the task being restarted for `exec` tasks with `network` blocks (this also
impacts the community `containerd` and probably other community task drivers).

If we get an error when attempting to create the namespace and that error is
because the file already exists and is locked by its process, then we'll
return a `nil` error with the `created` flag set to false, just as we do with
the `docker` driver.
2021-01-11 11:31:03 -05:00
Chris Baker a53e54d7a6 changelog for 9761 2021-01-08 19:26:42 +00:00
Drew Bailey c87adfac62
persist shared ports during inplace updates (#9736)
AllocatedSharedResources were not being copied over to the new
allocation struct the scheduler makes during inplace updates. This
caused downstream issues after the plan was applied, namely the shared
ports were dropped causing issues with service
registration/deregistration.

test that shared ports are preserved

change log, also carry over shared network

copy networks
2021-01-08 09:00:41 -05:00
Tim Gross cb0c4b1d0b changelog entry for #9532 2021-01-07 15:44:13 -05:00
Seth Hoenig 09c13b0066
Merge pull request #9751 from hashicorp/b-envoyv-segfault
consul/connect: fix panic during in-place upgrade with connect jobs
2021-01-07 14:22:27 -06:00
Tim Gross 4eafcb06ef changelog: add entry for GH-9050 2021-01-07 15:01:04 -05:00
Seth Hoenig 303856183c consul/connect: fix panic during in-place upgrade with connect jobs
When upgrading from Nomad v0.12.x to v1.0.x, Nomad client will panic on
startup if the node is running Connect enabled jobs. This is caused by
a missing piece of plumbing of the Consul Proxies API interface during the
client restore process.

Fixes #9738
2021-01-07 13:24:24 -06:00
Nick Ethier ab01e19df3 command/agent/consul: use port's to value when building service address under 'alloc' addr_mode 2021-01-06 13:52:48 -05:00
Seth Hoenig c46a503fdb docs: update changelog 2021-01-05 09:31:22 -06:00
Seth Hoenig bc7dd881dd docs: add changelog entry 2021-01-05 08:48:12 -06:00
Chris Baker 60095f47a5 changelog 2021-01-04 22:25:37 +00:00
Michael Schurter 7a6e55b21f
Merge pull request #9686 from hashicorp/golang1.15.6
build: upgrade from Go 1.15.5 -> 1.15.6
2021-01-04 12:07:41 -08:00
Michael Schurter 772ab5502d build: upgrade from Go 1.15.5 -> 1.15.6
Also updated scripts/update_golang_version.sh to handle new CircleCI
file layout.
2021-01-04 08:34:00 -08:00
Mahmood Ali 66c0e85b9c add changelog 2021-01-04 09:09:58 -05:00
Tim Gross ea395d5636 changelog: add missing entry from 0.12.4 2020-12-17 14:31:43 -05:00
Seth Hoenig 93da234e9d docs: move changelog entry 2020-12-16 17:42:28 -06:00
Michael Schurter 72329f8356 docs: release v1.0.1
- Update release date in changelog
- Update download version
- Update alert banner to not be so specific
2020-12-16 13:55:09 -08:00
Michael Schurter 9530d0733e
Merge pull request #9653 from hashicorp/docs-9625-changelog
docs: add #9625 to changelog
2020-12-16 11:13:59 -08:00
Tim Gross 1785822386
template: trigger change_mode for dynamic secrets on restore (#9636)
When a task is restored after a client restart, the template runner will
create a new lease for any dynamic secret (ex. Consul or PKI secrets
engines). But because this lease is being created in the prestart hook, we
don't trigger the `change_mode`.

This changeset uses the the existence of the task handle to detect a
previously running task that's been restored, so that we can trigger the
template `change_mode` if the template is changed, as it will be only with
dynamic secrets.
2020-12-16 13:36:19 -05:00
Michael Schurter e5c54708a7 docs: add #9625 to changelog 2020-12-16 09:50:10 -08:00
Seth Hoenig 283be57d30 docs: add two connect entries to changelog
https://github.com/hashicorp/nomad/pull/9624
https://github.com/hashicorp/nomad/pull/9611
2020-12-16 11:02:12 -06:00
Tim Gross 782c05f8c0
cni: prevent NPE if no interface has sandbox field set
When we iterate over the interfaces returned from CNI setup, we filter for one
with the `Sandbox` field set. Ensure that if none of the interfaces has that
field set that we still return an available interface.
2020-12-16 10:36:03 -05:00
Mahmood Ali de954da350
docker: introduce a new hcl2-friendly mount syntax (#9635)
Introduce a new more-block friendly syntax for specifying mounts with a new `mount` block type with the target as label:

```hcl
config {
  image = "..."

  mount {
    type = "..."
    target = "target-path"
    volume_options { ... }
  }
}
```

The main benefit here is that by `mount` being a block, it can nest blocks and avoids the compatibility problems noted in https://github.com/hashicorp/nomad/pull/9634/files#diff-2161d829655a3a36ba2d916023e4eec125b9bd22873493c1c2e5e3f7ba92c691R128-R155 .

The intention is for us to promote this `mount` blocks and quietly deprecate the `mounts` type, while still honoring to preserve compatibility as much as we could.

This addresses the issue in https://github.com/hashicorp/nomad/issues/9604 .
2020-12-15 14:13:50 -05:00
Drew Bailey 54becaab7d
Events/acl events (#9595)
* fix acl event creation

* allow way to access secretID without exposing it to stream

test that values are omitted

test event creation

test acl events

payloads are pointers

fix failing tests, do all security steps inside constructor

* increase time

* ignore empty tokens

* uncomment line

* changelog
2020-12-11 10:40:50 -05:00
Seth Hoenig ead89d3a2b
docs: fixup changelog
Co-authored-by: Tim Gross <tgross@hashicorp.com>
2020-12-09 11:27:12 -06:00
Seth Hoenig b51459a879 consul/connect: interpolate connect block
This PR enables job submitters to use interpolation in the connect
block of jobs making use of consul connect. Before, only the name of
the connect service would be interpolated, and only for a few select
identifiers related to the job itself (#6853). Now, all connect fields
can be interpolated using the full spectrum of runtime parameters.

Note that the service name is interpolated at job-submission time,
and cannot make use of values known only at runtime.

Fixes #7221
2020-12-09 09:10:00 -06:00
Michael Schurter b70f5f2ff3 docs: fix cpu comment for 10->1 to 20->1
Reported by https://github.com/hashicorp/nomad/pull/8996/files#r538702174
2020-12-08 10:59:19 -08:00