luxolus
/
open-nomad
2
0
Fork 0
Code Issues 1 Pull Requests Packages Releases Wiki Activity
open-nomad/client
History
grembo 7936c1e33f
Add `disable_file` parameter to job's `vault` stanza (#13343) 
This complements the `env` parameter, so that the operator can author
tasks that don't share their Vault token with the workload when using 
`image` filesystem isolation. As a result, more powerful tokens can be used 
in a job definition, allowing it to use template stanzas to issue all kinds of 
secrets (database secrets, Vault tokens with very specific policies, etc.), 
without sharing that issuing power with the task itself.

This is accomplished by creating a directory called `private` within
the task's working directory, which shares many properties of
the `secrets` directory (tmpfs where possible, not accessible by
`nomad alloc fs` or Nomad's web UI), but isn't mounted into/bound to the
container.

If the `disable_file` parameter is set to `false` (its default), the Vault token
is also written to the NOMAD_SECRETS_DIR, so the default behavior is
backwards compatible. Even if the operator never changes the default,
they will still benefit from the improved behavior of Nomad never reading
the token back in from that - potentially altered - location.
 		2023-06-23 15:15:04 -04:00
..
allocdir Add `disable_file` parameter to job's `vault` stanza (#13343) 2023-06-23 15:15:04 -04:00
allochealth [COMPLIANCE] Add Copyright and License Headers 2023-04-10 15:36:59 +00:00
allocrunner Add `disable_file` parameter to job's `vault` stanza (#13343) 2023-06-23 15:15:04 -04:00
allocwatcher allocrunner: provide factory function so we can build mock ARs (#17161) 2023-05-12 13:29:44 -04:00
config compliance: add headers with fixed copywrite tool (#17353) 2023-05-30 09:20:32 -05:00
consul [COMPLIANCE] Add Copyright and License Headers 2023-04-10 15:36:59 +00:00
devicemanager [COMPLIANCE] Add Copyright and License Headers 2023-04-10 15:36:59 +00:00
dynamicplugins Merge pull request #16836 from hashicorp/compliance/add-headers 2023-04-10 16:32:03 -07:00
fingerprint fingerprint: added windows os.build attribute to host fingerprint (#17576) 2023-06-21 10:53:50 -04:00
interfaces [COMPLIANCE] Add Copyright and License Headers 2023-04-10 15:36:59 +00:00
lib client: do not disable memory swappiness if kernel does not support it (#17625) 2023-06-22 09:36:31 -05:00
logmon [COMPLIANCE] Add Copyright and License Headers 2023-04-10 15:36:59 +00:00
pluginmanager Merge pull request #16836 from hashicorp/compliance/add-headers 2023-04-10 16:32:03 -07:00
servers [COMPLIANCE] Add Copyright and License Headers 2023-04-10 15:36:59 +00:00
serviceregistration client: remove unused nsd check allocation result diff func (#17695) 2023-06-23 15:26:06 +01:00
state client: send node secret with every client-to-server RPC (#16799) 2023-06-22 11:06:49 -04:00
stats [COMPLIANCE] Add Copyright and License Headers 2023-04-10 15:36:59 +00:00
structs client: send node secret with every client-to-server RPC (#16799) 2023-06-22 11:06:49 -04:00
taskenv fix host port handling for ipv6 (#16723) 2023-04-20 19:53:20 -07:00
testutil Revert "hashicorp/go-msgpack v2 (#16810)" (#17047) 2023-05-01 17:18:34 -04:00
vaultclient [COMPLIANCE] Add Copyright and License Headers 2023-04-10 15:36:59 +00:00
acl.go [COMPLIANCE] Add Copyright and License Headers 2023-04-10 15:36:59 +00:00
acl_test.go [COMPLIANCE] Add Copyright and License Headers 2023-04-10 15:36:59 +00:00
agent_endpoint.go Revert "hashicorp/go-msgpack v2 (#16810)" (#17047) 2023-05-01 17:18:34 -04:00
agent_endpoint_test.go Revert "hashicorp/go-msgpack v2 (#16810)" (#17047) 2023-05-01 17:18:34 -04:00
alloc_endpoint.go Revert "hashicorp/go-msgpack v2 (#16810)" (#17047) 2023-05-01 17:18:34 -04:00
alloc_endpoint_test.go Revert "hashicorp/go-msgpack v2 (#16810)" (#17047) 2023-05-01 17:18:34 -04:00
alloc_watcher_e2e_test.go cli: tls certs not created with correct SANs (#16959) 2023-05-22 09:31:56 -04:00
client.go client: send node secret with every client-to-server RPC (#16799) 2023-06-22 11:06:49 -04:00
client_interface_test.go prioritized client updates (#17354) 2023-05-31 15:34:16 -04:00
client_stats_endpoint.go [COMPLIANCE] Add Copyright and License Headers 2023-04-10 15:36:59 +00:00
client_stats_endpoint_test.go [COMPLIANCE] Add Copyright and License Headers 2023-04-10 15:36:59 +00:00
client_test.go client: send node secret with every client-to-server RPC (#16799) 2023-06-22 11:06:49 -04:00
csi_endpoint.go [COMPLIANCE] Add Copyright and License Headers 2023-04-10 15:36:59 +00:00
csi_endpoint_test.go [COMPLIANCE] Add Copyright and License Headers 2023-04-10 15:36:59 +00:00
drain.go compliance: add headers with fixed copywrite tool (#17353) 2023-05-30 09:20:32 -05:00
drain_test.go compliance: add headers with fixed copywrite tool (#17353) 2023-05-30 09:20:32 -05:00
driver_manager_test.go [COMPLIANCE] Add Copyright and License Headers 2023-04-10 15:36:59 +00:00
enterprise_client_oss.go [COMPLIANCE] Add Copyright and License Headers 2023-04-10 15:36:59 +00:00
fingerprint_manager.go [COMPLIANCE] Add Copyright and License Headers 2023-04-10 15:36:59 +00:00
fingerprint_manager_test.go [COMPLIANCE] Add Copyright and License Headers 2023-04-10 15:36:59 +00:00
fs_endpoint.go Revert "hashicorp/go-msgpack v2 (#16810)" (#17047) 2023-05-01 17:18:34 -04:00
fs_endpoint_test.go Revert "hashicorp/go-msgpack v2 (#16810)" (#17047) 2023-05-01 17:18:34 -04:00
gc.go allocrunner: provide factory function so we can build mock ARs (#17161) 2023-05-12 13:29:44 -04:00
gc_test.go allocrunner: provide factory function so we can build mock ARs (#17161) 2023-05-12 13:29:44 -04:00
heartbeatstop.go allocrunner: provide factory function so we can build mock ARs (#17161) 2023-05-12 13:29:44 -04:00
heartbeatstop_test.go [COMPLIANCE] Add Copyright and License Headers 2023-04-10 15:36:59 +00:00
meta_endpoint.go [COMPLIANCE] Add Copyright and License Headers 2023-04-10 15:36:59 +00:00
meta_endpoint_test.go [COMPLIANCE] Add Copyright and License Headers 2023-04-10 15:36:59 +00:00
node_updater.go [COMPLIANCE] Add Copyright and License Headers 2023-04-10 15:36:59 +00:00
rpc.go client: send node secret with every client-to-server RPC (#16799) 2023-06-22 11:06:49 -04:00
rpc_test.go cli: tls certs not created with correct SANs (#16959) 2023-05-22 09:31:56 -04:00
testing.go [COMPLIANCE] Add Copyright and License Headers 2023-04-10 15:36:59 +00:00
util.go client: de-duplicate alloc updates and gate during restore (#17074) 2023-05-11 09:05:24 -04:00