1fb1c9c5d4
Prior to Nomad 0.12.5, you could use `${NOMAD_SECRETS_DIR}/mysecret.txt` as
the `artifact.destination` and `template.destination` because we would always
append the destination to the task working directory. In the recent security
patch we treated the `destination` absolute path as valid if it didn't escape
the working directory, but this breaks backwards compatibility and
interpolation of `destination` fields.
This changeset partially reverts the behavior so that we always append the
destination, but we also perform the escape check on that new destination
after interpolation so the security hole is closed.
Also, ConsulTemplate test should exercise interpolation
120 lines
1.9 KiB
HCL
120 lines
1.9 KiB
HCL
job "templating" {
|
|
datacenters = ["dc1", "dc2"]
|
|
|
|
constraint {
|
|
attribute = "${attr.kernel.name}"
|
|
value = "linux"
|
|
}
|
|
|
|
group "docker_downstream" {
|
|
|
|
task "task" {
|
|
|
|
driver = "docker"
|
|
|
|
config {
|
|
image = "busybox:1"
|
|
command = "/bin/sh"
|
|
args = ["-c", "sleep 300"]
|
|
}
|
|
|
|
template {
|
|
data = <<EOT
|
|
{{ range service "upstream-service" }}
|
|
server {{ .Name }} {{ .Address }}:{{ .Port }}{{ end }}
|
|
EOT
|
|
|
|
destination = "${NOMAD_TASK_DIR}/services.conf"
|
|
change_mode = "noop"
|
|
}
|
|
|
|
template {
|
|
data = <<EOT
|
|
---
|
|
key: {{ key "consultemplatetest" }}
|
|
job: {{ env "NOMAD_JOB_NAME" }}
|
|
EOT
|
|
|
|
destination = "${NOMAD_TASK_DIR}/kv.yml"
|
|
change_mode = "restart"
|
|
}
|
|
|
|
resources {
|
|
cpu = 128
|
|
memory = 64
|
|
}
|
|
}
|
|
}
|
|
|
|
group "exec_downstream" {
|
|
|
|
task "task" {
|
|
|
|
driver = "exec"
|
|
|
|
config {
|
|
command = "/bin/sh"
|
|
args = ["-c", "sleep 300"]
|
|
}
|
|
|
|
template {
|
|
data = <<EOT
|
|
{{ range service "upstream-service" }}
|
|
server {{ .Name }} {{ .Address }}:{{ .Port }}{{ end }}
|
|
EOT
|
|
|
|
destination = "${NOMAD_TASK_DIR}/services.conf"
|
|
change_mode = "noop"
|
|
}
|
|
|
|
template {
|
|
data = <<EOT
|
|
---
|
|
key: {{ key "consultemplatetest" }}
|
|
job: {{ env "NOMAD_JOB_NAME" }}
|
|
EOT
|
|
destination = "${NOMAD_TASK_DIR}/kv.yml"
|
|
change_mode = "restart"
|
|
}
|
|
|
|
resources {
|
|
cpu = 128
|
|
memory = 64
|
|
}
|
|
}
|
|
}
|
|
|
|
group "upstream" {
|
|
|
|
count = 2
|
|
|
|
network {
|
|
mode = "bridge"
|
|
port "web" {
|
|
to = -1
|
|
}
|
|
}
|
|
|
|
service {
|
|
name = "upstream-service"
|
|
port = "web"
|
|
}
|
|
|
|
task "task" {
|
|
|
|
driver = "exec"
|
|
|
|
config {
|
|
command = "/bin/sh"
|
|
args = ["-c", "sleep 300"]
|
|
}
|
|
|
|
resources {
|
|
cpu = 128
|
|
memory = 64
|
|
}
|
|
}
|
|
}
|
|
|
|
}
|