Commit graph

21914 commits

Author SHA1 Message Date
Seth Hoenig 4a4a960b3f
Merge pull request #10600 from hashicorp/f-exec-allow_caps
drivers/exec+java: reduce default set of linux capabilities
2021-05-17 13:11:04 -06:00
Seth Hoenig 591f0f0219 docs: minor wording tweaks + cl 2021-05-17 12:52:52 -06:00
Seth Hoenig fe9258b754 drivers/exec: pass capabilities through executor RPC
Add capabilities to the LaunchRequest proto so that the
capabilities set actually gets plumbed all the way through
to task launch.
2021-05-17 12:37:40 -06:00
Seth Hoenig 2e041e0813 deps: update go mod tidy
Looks like we no longer need a package.
2021-05-17 12:37:40 -06:00
Seth Hoenig e365652e81 drivers: fixup linux version dependent test cases
The error output being checked depends on the linux caps supported
by the particular operating system. Fix these test cases to just
check that an error did occur.
2021-05-17 12:37:40 -06:00
Seth Hoenig f64baec276 docs: update docs for linux capabilities in exec/java/docker drivers
Update docs for allow_caps, cap_add, cap_drop in exec/java/docker driver
pages. Also update upgrade guide with guidance on new default linux
capabilities for exec and java drivers.
2021-05-17 12:37:40 -06:00
Seth Hoenig 87c96eed11 drivers/docker: reuse capabilities plumbing in docker driver
This changeset does not introduce any functional change for the
docker driver, but rather cleans up the implementation around
computing configured capabilities by re-using code written for
the exec/java task drivers.
2021-05-17 12:37:40 -06:00
Seth Hoenig 2361a91938 drivers/java: enable setting allow_caps on java driver
Enable setting allow_caps on the java task driver plugin, along
with the associated cap_add and cap_drop options in java task
configuration.
2021-05-17 12:37:40 -06:00
Seth Hoenig 5b8a32f23d drivers/exec: enable setting allow_caps on exec driver
This PR enables setting allow_caps on the exec driver
plugin configuration, as well as cap_add and cap_drop in
exec task configuration. These options replicate the
functionality already present in the docker task driver.

Important: this change also reduces the default set of
capabilities enabled by the exec driver to match the
default set enabled by the docker driver. Until v1.0.5
the exec task driver would enable all capabilities supported
by the operating system. v1.0.5 removed NET_RAW from that
list of default capabilities, but left may others which
could potentially also be leveraged by compromised tasks.

Important: the "root" user is still special cased when
used with the exec driver. Older versions of Nomad enabled
enabled all capabilities supported by the operating system
for tasks set with the root user. To maintain compatibility
with existing clusters we continue supporting this "feature",
however we maintain support for the legacy set of capabilities
rather than enabling all capabilities now supported on modern
operating systems.
2021-05-17 12:37:40 -06:00
Tim Gross a99decde7d fix missing changelog entries from backports 2021-05-17 10:05:01 -04:00
Tim Gross 5a92e3fd5c fix missing changelog entries from backports 2021-05-17 10:04:22 -04:00
Michael Schurter d775c33479
Merge pull request #10550 from hashicorp/docs-rtd
Remote Task Driver docs
2021-05-14 10:49:35 -07:00
Michael Schurter f560120588
Apply suggestions from code review
Co-authored-by: Seth Hoenig <shoenig@hashicorp.com>
2021-05-14 10:45:12 -07:00
changli0617 b36b5f4c82 Update alert-banner.js 2021-05-14 08:35:29 -04:00
Michael Schurter e9de5e5323 docs: mention #10592 in rtd docs 2021-05-13 15:14:56 -07:00
Lars Lehtonen c50c6f6ee6
client: fix multiple imports (#10537) 2021-05-13 14:30:31 -04:00
Michael Schurter 9eedb124ad docs: document remote task drivers & ecs driver 2021-05-13 10:43:46 -07:00
Mahmood Ali abf6418976
add a section about memory oversubscription (#10573)
add a section about memory oversubscription

Co-authored-by: Tim Gross <tgross@hashicorp.com>
2021-05-13 13:35:51 -04:00
Buck Doyle 7b42bb0e2d
ui: Fix server list leader determination for IPv6 (#10530)
This closes #10513, thanks to @bastelfreak for the report.
GET /status/leader returns an IPv6 host with square brackets
around the IP address as expected, but the rpcAddr property
on the agent model does not.

This fixes rpcAddr, updates the Mirage /status/leader mock
to properly format an IPv6 host, and changes the agent
factory to sometimes produce IPv6 addresses.

I added a formatHost utility function to centralise the
conditional square bracket-wrapping that would have
otherwise been further scattered around.
2021-05-13 12:29:51 -05:00
Michael Schurter c8ec7aa642
Merge pull request #10585 from hashicorp/docs-1.1.0-rc1
website: update 1.1.0-beta1 to 1.1.0-rc1
2021-05-13 08:16:30 -07:00
Michael Schurter fdb13f4913 website: update 1.1.0-beta1 to 1.1.0-rc1 2021-05-13 08:10:03 -07:00
Georges-Etienne Legendre 5ad8c8136a
Fix exec not working for another region (#10539)
This conditionally includes a region query parameter when
opening the exec socket.
2021-05-13 09:14:16 -05:00
Tim Gross d161d79b67 docs: fix fields in 'volume create' example
The `capacity` block was removed during implementation in lieu of the
`capacity_max` and `capacity_min` fields, but it wasn't removed from the
example in the documentation.
2021-05-13 08:48:49 -04:00
Nomad Release Bot 412081a3e1 remove generated files 2021-05-12 23:14:02 +00:00
Nomad Release Bot c44b2d1a9c
Release v1.1.0-rc1 2021-05-12 23:13:55 +00:00
Nomad Release bot 5be44af07d Generate files for 1.1.0-rc1 release 2021-05-12 22:43:48 +00:00
Seth Hoenig 701f8a2e4e
Merge pull request #10577 from joel0/cf-capitalization
minor: update 'Cloudflare' capitalization
2021-05-12 16:34:20 -06:00
Joel May bfaf8cf040 minor: update 'Cloudflare' capitalization 2021-05-12 15:15:54 -07:00
Michael Schurter 103eb6f60a
Merge pull request #10574 from hashicorp/docs-1.0.5
update website to Nomad 1.0.5
2021-05-12 14:31:06 -07:00
Michael Schurter 40d69664e8 update website to Nomad 1.0.5 2021-05-12 14:25:48 -07:00
Michael Schurter 6393ed1295
Merge pull request #10572 from hashicorp/cve-2021-32575
drivers/docker+exec+java: disable net_raw capability by default
2021-05-12 14:21:25 -07:00
Seth Hoenig 1e75f99839 drivers/docker+exec+java: disable net_raw capability by default
The default Linux Capabilities set enabled by the docker, exec, and
java task drivers includes CAP_NET_RAW (for making ping just work),
which has the side affect of opening an ARP DoS/MiTM attack between
tasks using bridge networking on the same host network.

https://docs.docker.com/engine/reference/run/#runtime-privilege-and-linux-capabilities

This PR disables CAP_NET_RAW for the docker, exec, and java task
drivers. The previous behavior can be restored for docker using the
allow_caps docker plugin configuration option.

A future version of nomad will enable similar configurability for the
exec and java task drivers.
2021-05-12 13:22:09 -07:00
Kendall Strautman 4dd26c8aa2
content: swap out diagrams with typos (#10571) 2021-05-12 08:50:20 -07:00
Drew Bailey a805cd8f52
check and return error from parsing var-files (#10569)
* check and return error from parsing var-files

* changelog entry for 1.1.0 and 1.0.5
2021-05-12 09:08:59 -04:00
Kyle MacDonald b2344c829c
website: set up /trial redirection (#10565) 2021-05-11 11:10:34 -05:00
Isabel Suchanek ed9e12cdc7
Clean up docker driver test to make it less flaky (#10559)
Co-authored-by: Mahmood Ali <mahmood@hashicorp.com>
2021-05-10 14:58:19 -07:00
Tim Gross d4465f01ac E2E: remove references to nomad_sha 2021-05-10 16:42:39 -04:00
Mahmood Ali a33ec72dd7
e2e: enable memory oversubscription (#10557)
Enable memory oversubscription for the oversubscription tests.
2021-05-10 14:33:47 -04:00
Mike Nomitch 859fa96308
docs: add detail to 1.1 upgrade guide for licensing 2021-05-10 12:28:05 -04:00
Mike Noordermeer 2445bece66
docs: clarify that a default update strategy is used when update strategy is omitted 2021-05-10 08:27:22 -04:00
Isabel Suchanek b5a2f48c78 Fix test panic in docker driver test 2021-05-07 12:12:33 -07:00
Luiz Aoqui 3e4a3ff8eb
docs: restructure autoscaling plugins menu (#10534)
* docs: restructure autoscaling plugins menu

* docs: add autoscaling threshold strategy (#10535)
2021-05-07 14:21:50 -04:00
Chris Baker 263ddd567c
Node Drain Metadata (#10250) 2021-05-07 13:58:40 -04:00
Tim Gross 1fdb4c1511 documentation for disable_default_tcp_check 2021-05-07 13:16:39 -04:00
Mahmood Ali 102763c979
Support disabling TCP checks for connect sidecar services 2021-05-07 12:10:26 -04:00
Seth Hoenig d8083fa053
Merge pull request #10543 from hashicorp/docs-consul-grpc-addr
docs: add agent consul grpc_address docs
2021-05-07 09:32:04 -06:00
Seth Hoenig 62d76ee63a docs: add agent consul grpc_address docs
We already supported this configuration, but forgot to document it.
2021-05-07 09:25:09 -06:00
Tim Gross 6237224681 update golang to 1.16.4 2021-05-07 11:06:54 -04:00
Seth Hoenig 20ae274ecb
Merge pull request #10532 from hashicorp/docs-fixup-dc-region-arch-words-10515
docs: fixup wording around datacenters and regions on architecture docs
2021-05-07 09:02:43 -06:00
dependabot[bot] 08203e5a34
ui: build(deps): bump underscore from 1.12.0 to 1.13.1 in /ui (#10525)
Bumps [underscore](https://github.com/jashkenas/underscore) from 1.12.0 to 1.13.1.
- [Release notes](https://github.com/jashkenas/underscore/releases)
- [Commits](https://github.com/jashkenas/underscore/compare/1.12.0...1.13.1)

Signed-off-by: dependabot[bot] <support@github.com>

Co-authored-by: dependabot[bot] <49699333+dependabot[bot]@users.noreply.github.com>
2021-05-07 09:38:16 -05:00