ed13e5723f
As newer versions of Consul are released, the minimum version of Envoy it supports as a sidecar proxy also gets bumped. Starting with the upcoming Consul v1.9.X series, Envoy v1.11.X will no longer be supported. Current versions of Nomad hardcode a version of Envoy v1.11.2 to be used as the default implementation of Connect sidecar proxy. This PR introduces a change such that each Nomad Client will query its local Consul for a list of Envoy proxies that it supports (https://github.com/hashicorp/consul/pull/8545) and then launch the Connect sidecar proxy task using the latest supported version of Envoy. If the `SupportedProxies` API component is not available from Consul, Nomad will fallback to the old version of Envoy supported by old versions of Consul. Setting the meta configuration option `meta.connect.sidecar_image` or setting the `connect.sidecar_task` stanza will take precedence as is the current behavior for sidecar proxies. Setting the meta configuration option `meta.connect.gateway_image` will take precedence as is the current behavior for connect gateways. `meta.connect.sidecar_image` and `meta.connect.gateway_image` may make use of the special `${NOMAD_envoy_version}` variable interpolation, which resolves to the newest version of Envoy supported by the Consul agent. Addresses #8585 #7665
53 lines
1.8 KiB
Go
53 lines
1.8 KiB
Go
package consul
|
|
|
|
import (
|
|
"github.com/hashicorp/nomad/command/agent/consul"
|
|
"github.com/hashicorp/nomad/nomad/structs"
|
|
)
|
|
|
|
// ConsulServiceAPI is the interface the Nomad Client uses to register and
|
|
// remove services and checks from Consul.
|
|
//
|
|
// ACL requirements
|
|
// - service:write
|
|
type ConsulServiceAPI interface {
|
|
// RegisterWorkload with Consul. Adds all service entries and checks to Consul.
|
|
RegisterWorkload(*consul.WorkloadServices) error
|
|
|
|
// RemoveWorkload from Consul. Removes all service entries and checks.
|
|
RemoveWorkload(*consul.WorkloadServices)
|
|
|
|
// UpdateWorkload in Consul. Does not alter the service if only checks have
|
|
// changed.
|
|
UpdateWorkload(old, newTask *consul.WorkloadServices) error
|
|
|
|
// AllocRegistrations returns the registrations for the given allocation.
|
|
AllocRegistrations(allocID string) (*consul.AllocRegistration, error)
|
|
|
|
// UpdateTTL is used to update the TTL of a check.
|
|
UpdateTTL(id, output, status string) error
|
|
}
|
|
|
|
// TokenDeriverFunc takes an allocation and a set of tasks and derives a
|
|
// service identity token for each. Requests go through nomad server.
|
|
type TokenDeriverFunc func(*structs.Allocation, []string) (map[string]string, error)
|
|
|
|
// ServiceIdentityAPI is the interface the Nomad Client uses to request Consul
|
|
// Service Identity tokens through Nomad Server.
|
|
//
|
|
// ACL requirements
|
|
// - acl:write (used by Server only)
|
|
type ServiceIdentityAPI interface {
|
|
// DeriveSITokens contacts the nomad server and requests consul service
|
|
// identity tokens be generated for tasks in the allocation.
|
|
DeriveSITokens(alloc *structs.Allocation, tasks []string) (map[string]string, error)
|
|
}
|
|
|
|
// SupportedProxiesAPI is the interface the Nomad Client uses to request from
|
|
// Consul the set of supported proxied to use for Consul Connect.
|
|
//
|
|
// No ACL requirements
|
|
type SupportedProxiesAPI interface {
|
|
Proxies() (map[string][]string, error)
|
|
}
|