0971114f0c
Instead of checking Consul's version on startup to see if it supports TLSSkipVerify, assume that it does and only log in the job service handler if we discover Consul does not support TLSSkipVerify. The old code would break TLSSkipVerify support if Nomad started before Consul (such as on system boot) as TLSSkipVerify would default to false if Consul wasn't running. Since TLSSkipVerify has been supported since Consul 0.7.2, it's safe to relax our handling.
87 lines
1.7 KiB
Go
87 lines
1.7 KiB
Go
package consul
|
|
|
|
import (
|
|
"context"
|
|
"log"
|
|
"strings"
|
|
"time"
|
|
|
|
version "github.com/hashicorp/go-version"
|
|
)
|
|
|
|
// checkConsulTLSSkipVerify logs if Consul does not support TLSSkipVerify on
|
|
// checks and is intended to be run in a goroutine.
|
|
func checkConsulTLSSkipVerify(ctx context.Context, logger *log.Logger, client AgentAPI, done chan struct{}) {
|
|
const (
|
|
baseline = time.Second
|
|
limit = 20 * time.Second
|
|
)
|
|
|
|
defer close(done)
|
|
|
|
i := uint64(0)
|
|
for {
|
|
self, err := client.Self()
|
|
if err == nil {
|
|
if supportsTLSSkipVerify(self) {
|
|
logger.Printf("[TRACE] consul.sync: supports TLSSkipVerify")
|
|
} else {
|
|
logger.Printf("[WARN] consul.sync: Consul does NOT support TLSSkipVerify; please upgrade to Consul %s or newer",
|
|
consulTLSSkipVerifyMinVersion)
|
|
}
|
|
return
|
|
}
|
|
|
|
backoff := (1 << (2 * uint64(i))) * baseline
|
|
if backoff > limit {
|
|
backoff = limit
|
|
} else {
|
|
i++
|
|
}
|
|
|
|
select {
|
|
case <-ctx.Done():
|
|
return
|
|
case <-time.After(time.Duration(backoff)):
|
|
}
|
|
}
|
|
}
|
|
|
|
var consulTLSSkipVerifyMinVersion = version.Must(version.NewVersion("0.7.2"))
|
|
|
|
// supportsTLSSkipVerify returns true if Consul supports TLSSkipVerify.
|
|
func supportsTLSSkipVerify(self map[string]map[string]interface{}) bool {
|
|
member, ok := self["Member"]
|
|
if !ok {
|
|
return false
|
|
}
|
|
tagsI, ok := member["Tags"]
|
|
if !ok {
|
|
return false
|
|
}
|
|
tags, ok := tagsI.(map[string]interface{})
|
|
if !ok {
|
|
return false
|
|
}
|
|
buildI, ok := tags["build"]
|
|
if !ok {
|
|
return false
|
|
}
|
|
build, ok := buildI.(string)
|
|
if !ok {
|
|
return false
|
|
}
|
|
parts := strings.SplitN(build, ":", 2)
|
|
if len(parts) != 2 {
|
|
return false
|
|
}
|
|
v, err := version.NewVersion(parts[0])
|
|
if err != nil {
|
|
return false
|
|
}
|
|
if v.LessThan(consulTLSSkipVerifyMinVersion) {
|
|
return false
|
|
}
|
|
return true
|
|
}
|