1a29811169
As part of deprecating legacy drivers, we're moving the env package to a new drivers/shared tree, as it is used by the modern docker and rkt driver packages, and is useful for 3rd party plugins.
67 lines
1.9 KiB
Go
67 lines
1.9 KiB
Go
package taskrunner
|
|
|
|
import (
|
|
"context"
|
|
"fmt"
|
|
|
|
log "github.com/hashicorp/go-hclog"
|
|
multierror "github.com/hashicorp/go-multierror"
|
|
"github.com/hashicorp/nomad/client/allocrunner/interfaces"
|
|
"github.com/hashicorp/nomad/client/config"
|
|
"github.com/hashicorp/nomad/drivers/shared/env"
|
|
"github.com/hashicorp/nomad/nomad/structs"
|
|
)
|
|
|
|
// validateHook validates the task is able to be run.
|
|
type validateHook struct {
|
|
config *config.Config
|
|
logger log.Logger
|
|
}
|
|
|
|
func newValidateHook(config *config.Config, logger log.Logger) *validateHook {
|
|
h := &validateHook{
|
|
config: config,
|
|
}
|
|
h.logger = logger.Named(h.Name())
|
|
return h
|
|
}
|
|
|
|
func (*validateHook) Name() string {
|
|
return "validate"
|
|
}
|
|
|
|
func (h *validateHook) Prestart(ctx context.Context, req *interfaces.TaskPrestartRequest, resp *interfaces.TaskPrestartResponse) error {
|
|
if err := validateTask(req.Task, req.TaskEnv, h.config); err != nil {
|
|
return err
|
|
}
|
|
|
|
resp.Done = true
|
|
return nil
|
|
}
|
|
|
|
func validateTask(task *structs.Task, taskEnv *env.TaskEnv, conf *config.Config) error {
|
|
var mErr multierror.Error
|
|
|
|
// Validate the user
|
|
unallowedUsers := conf.ReadStringListToMapDefault("user.blacklist", config.DefaultUserBlacklist)
|
|
checkDrivers := conf.ReadStringListToMapDefault("user.checked_drivers", config.DefaultUserCheckedDrivers)
|
|
if _, driverMatch := checkDrivers[task.Driver]; driverMatch {
|
|
if _, unallowed := unallowedUsers[task.User]; unallowed {
|
|
mErr.Errors = append(mErr.Errors, fmt.Errorf("running as user %q is disallowed", task.User))
|
|
}
|
|
}
|
|
|
|
// Validate the Service names once they're interpolated
|
|
for i, service := range task.Services {
|
|
name := taskEnv.ReplaceEnv(service.Name)
|
|
if err := service.ValidateName(name); err != nil {
|
|
mErr.Errors = append(mErr.Errors, fmt.Errorf("service (%d) failed validation: %v", i, err))
|
|
}
|
|
}
|
|
|
|
if len(mErr.Errors) == 1 {
|
|
return mErr.Errors[0]
|
|
}
|
|
return mErr.ErrorOrNil()
|
|
}
|