bfcbc00f4e
In order to support implicit ACL policies for tasks to get their own secrets, each task would need to have its own ACL token. This would add extra raft overhead as well as new garbage collection jobs for cleaning up task-specific ACL tokens. Instead, Nomad will create a workload Identity Claim for each task. An Identity Claim is a JSON Web Token (JWT) signed by the server’s private key and attached to an Allocation at the time a plan is applied. The encoded JWT can be submitted as the X-Nomad-Token header to replace ACL token secret IDs for the RPCs that support identity claims. Whenever a key is is added to a server’s keyring, it will use the key as the seed for a Ed25519 public-private private keypair. That keypair will be used for signing the JWT and for verifying the JWT. This implementation is a ruthlessly minimal approach to support the secure variables feature. When a JWT is verified, the allocation ID will be checked against the Nomad state store, and non-existent or terminal allocation IDs will cause the validation to be rejected. This is sufficient to support the secure variables feature at launch without requiring implementation of a background process to renew soon-to-expire tokens.
280 lines
14 KiB
Modula-2
280 lines
14 KiB
Modula-2
module github.com/hashicorp/nomad
|
|
|
|
go 1.18
|
|
|
|
// Pinned dependencies are noted in github.com/hashicorp/nomad/issues/11826
|
|
replace (
|
|
github.com/Microsoft/go-winio => github.com/endocrimes/go-winio v0.4.13-0.20190628114223-fb47a8b41948
|
|
github.com/hashicorp/go-discover => github.com/hashicorp/go-discover v0.0.0-20210818145131-c573d69da192
|
|
github.com/hashicorp/hcl => github.com/hashicorp/hcl v1.0.1-0.20201016140508-a07e7d50bbee
|
|
)
|
|
|
|
// Nomad is built using the current source of the API module
|
|
replace github.com/hashicorp/nomad/api => ./api
|
|
|
|
require (
|
|
github.com/LK4D4/joincontext v0.0.0-20171026170139-1724345da6d5
|
|
github.com/Microsoft/go-winio v0.4.17
|
|
github.com/armon/circbuf v0.0.0-20150827004946-bbbad097214e
|
|
github.com/armon/go-metrics v0.3.10
|
|
github.com/aws/aws-sdk-go v1.42.27
|
|
github.com/container-storage-interface/spec v1.4.0
|
|
github.com/containerd/go-cni v1.1.1
|
|
github.com/containernetworking/cni v1.0.1
|
|
github.com/containernetworking/plugins v1.0.1
|
|
github.com/coreos/go-iptables v0.6.0
|
|
github.com/coreos/go-semver v0.3.0
|
|
github.com/creack/pty v1.1.18
|
|
github.com/docker/cli v20.10.3-0.20220113150236-6e2838e18645+incompatible
|
|
github.com/docker/distribution v2.7.1+incompatible
|
|
github.com/docker/docker v20.10.12+incompatible
|
|
github.com/docker/go-units v0.4.0
|
|
github.com/docker/libnetwork v0.8.0-dev.2.0.20210525090646-64b7a4574d14
|
|
github.com/dustin/go-humanize v1.0.0
|
|
github.com/elazarl/go-bindata-assetfs v1.0.1-0.20200509193318-234c15e7648f
|
|
github.com/fatih/color v1.13.0 // indirect
|
|
github.com/fsouza/go-dockerclient v1.6.5
|
|
github.com/golang/protobuf v1.5.2
|
|
github.com/golang/snappy v0.0.4
|
|
github.com/google/go-cmp v0.5.8
|
|
github.com/gorilla/handlers v1.5.1
|
|
github.com/gorilla/websocket v1.4.2
|
|
github.com/gosuri/uilive v0.0.4
|
|
github.com/grpc-ecosystem/go-grpc-middleware v1.2.1-0.20200228141219-3ce3d519df39
|
|
github.com/hashicorp/consul v1.7.8
|
|
github.com/hashicorp/consul-template v0.29.1
|
|
github.com/hashicorp/consul/api v1.13.0
|
|
github.com/hashicorp/consul/sdk v0.8.0
|
|
github.com/hashicorp/cronexpr v1.1.1
|
|
github.com/hashicorp/go-bexpr v0.1.11
|
|
github.com/hashicorp/go-checkpoint v0.0.0-20171009173528-1545e56e46de
|
|
github.com/hashicorp/go-cleanhttp v0.5.2
|
|
github.com/hashicorp/go-connlimit v0.3.0
|
|
github.com/hashicorp/go-cty-funcs v0.0.0-20200930094925-2721b1e36840
|
|
// NOTE: update the version for github.com/hashicorp/go-discover in the
|
|
// `replace` block as well to prevent other dependencies from pulling older
|
|
// versions.
|
|
github.com/hashicorp/go-discover v0.0.0-20220621183603-a413e131e836
|
|
github.com/hashicorp/go-envparse v0.0.0-20180119215841-310ca1881b22
|
|
github.com/hashicorp/go-getter v1.6.1
|
|
github.com/hashicorp/go-hclog v1.2.0
|
|
github.com/hashicorp/go-immutable-radix v1.3.1
|
|
github.com/hashicorp/go-memdb v1.3.2
|
|
github.com/hashicorp/go-msgpack v1.1.5
|
|
github.com/hashicorp/go-multierror v1.1.1
|
|
github.com/hashicorp/go-plugin v1.4.3
|
|
github.com/hashicorp/go-secure-stdlib/listenerutil v0.1.4
|
|
github.com/hashicorp/go-secure-stdlib/strutil v0.1.2
|
|
github.com/hashicorp/go-sockaddr v1.0.2
|
|
github.com/hashicorp/go-syslog v1.0.0
|
|
github.com/hashicorp/go-uuid v1.0.2
|
|
github.com/hashicorp/go-version v1.4.0
|
|
github.com/hashicorp/golang-lru v0.5.4
|
|
github.com/hashicorp/hcl v1.0.1-vault-3
|
|
github.com/hashicorp/hcl/v2 v2.9.2-0.20220525143345-ab3cae0737bc
|
|
github.com/hashicorp/logutils v1.0.0
|
|
github.com/hashicorp/memberlist v0.3.1
|
|
github.com/hashicorp/net-rpc-msgpackrpc v0.0.0-20151116020338-a14192a58a69
|
|
github.com/hashicorp/nomad/api v0.0.0-20220407202126-2eba643965c4
|
|
github.com/hashicorp/raft v1.3.5
|
|
github.com/hashicorp/raft-boltdb/v2 v2.2.0
|
|
github.com/hashicorp/serf v0.9.7
|
|
github.com/hashicorp/vault/api v1.4.1
|
|
github.com/hashicorp/vault/sdk v0.4.1
|
|
github.com/hashicorp/yamux v0.0.0-20211028200310-0bc27b27de87
|
|
github.com/hpcloud/tail v1.0.1-0.20170814160653-37f427138745
|
|
github.com/kr/pretty v0.3.0
|
|
github.com/kr/text v0.2.0
|
|
github.com/mattn/go-colorable v0.1.12
|
|
github.com/miekg/dns v1.1.41
|
|
github.com/mitchellh/cli v1.1.2
|
|
github.com/mitchellh/colorstring v0.0.0-20150917214807-8631ce90f286
|
|
github.com/mitchellh/copystructure v1.2.0
|
|
github.com/mitchellh/go-glint v0.0.0-20210722152315-6515ceb4a127
|
|
github.com/mitchellh/go-ps v0.0.0-20190716172923-621e5597135b
|
|
github.com/mitchellh/go-testing-interface v1.14.1
|
|
github.com/mitchellh/hashstructure v1.1.0
|
|
github.com/mitchellh/mapstructure v1.4.3
|
|
github.com/mitchellh/reflectwalk v1.0.2
|
|
github.com/moby/sys/mount v0.3.0
|
|
github.com/moby/sys/mountinfo v0.6.0
|
|
github.com/moby/term v0.0.0-20210619224110-3f7ff695adc6
|
|
github.com/opencontainers/runc v1.0.3
|
|
github.com/opencontainers/runtime-spec v1.0.3-0.20210326190908-1c3f411f0417
|
|
github.com/posener/complete v1.2.3
|
|
github.com/prometheus/client_golang v1.12.0
|
|
github.com/prometheus/common v0.32.1
|
|
github.com/rs/cors v1.8.2
|
|
github.com/ryanuber/columnize v2.1.1-0.20170703205827-abc90934186a+incompatible
|
|
github.com/ryanuber/go-glob v1.0.0
|
|
github.com/sean-/seed v0.0.0-20170313163322-e2103e2c3529
|
|
github.com/shirou/gopsutil/v3 v3.21.12
|
|
github.com/shoenig/test v0.2.8
|
|
github.com/skratchdot/open-golang v0.0.0-20160302144031-75fb7ed4208c
|
|
github.com/stretchr/testify v1.8.0
|
|
github.com/syndtr/gocapability v0.0.0-20200815063812-42c35b437635
|
|
github.com/zclconf/go-cty v1.8.0
|
|
github.com/zclconf/go-cty-yaml v1.0.2
|
|
go.etcd.io/bbolt v1.3.5
|
|
go.uber.org/goleak v1.1.12
|
|
golang.org/x/crypto v0.0.0-20220622213112-05595931fe9d
|
|
golang.org/x/exp v0.0.0-20220609121020-a51bd0440498
|
|
golang.org/x/net v0.0.0-20220225172249-27dd8689420f
|
|
golang.org/x/sync v0.0.0-20210220032951-036812b2e83c
|
|
golang.org/x/sys v0.0.0-20220517195934-5e4e11fc645e
|
|
golang.org/x/time v0.0.0-20220224211638-0e9765cccd65
|
|
google.golang.org/grpc v1.45.0
|
|
google.golang.org/protobuf v1.27.1
|
|
gopkg.in/tomb.v1 v1.0.0-20141024135613-dd632973f1e7
|
|
gopkg.in/tomb.v2 v2.0.0-20140626144623-14b3d72120e8
|
|
oss.indeed.com/go/libtime v1.5.0
|
|
)
|
|
|
|
require (
|
|
cloud.google.com/go v0.97.0 // indirect
|
|
cloud.google.com/go/storage v1.18.2 // indirect
|
|
github.com/Azure/azure-sdk-for-go v56.3.0+incompatible // indirect
|
|
github.com/Azure/go-ansiterm v0.0.0-20210617225240-d185dfc1b5a1 // indirect
|
|
github.com/Azure/go-autorest v14.2.0+incompatible // indirect
|
|
github.com/Azure/go-autorest/autorest v0.11.20 // indirect
|
|
github.com/Azure/go-autorest/autorest/adal v0.9.15 // indirect
|
|
github.com/Azure/go-autorest/autorest/azure/auth v0.5.1 // indirect
|
|
github.com/Azure/go-autorest/autorest/azure/cli v0.4.0 // indirect
|
|
github.com/Azure/go-autorest/autorest/date v0.3.0 // indirect
|
|
github.com/Azure/go-autorest/autorest/to v0.4.0 // indirect
|
|
github.com/Azure/go-autorest/autorest/validation v0.3.0 // indirect
|
|
github.com/Azure/go-autorest/logger v0.2.1 // indirect
|
|
github.com/Azure/go-autorest/tracing v0.6.0 // indirect
|
|
github.com/BurntSushi/toml v1.0.0 // indirect
|
|
github.com/DataDog/datadog-go v3.2.0+incompatible // indirect
|
|
github.com/Masterminds/goutils v1.1.1 // indirect
|
|
github.com/Masterminds/semver v1.5.0 // indirect
|
|
github.com/Masterminds/sprig v2.22.0+incompatible // indirect
|
|
github.com/Microsoft/hcsshim v0.8.23 // indirect
|
|
github.com/VividCortex/ewma v1.1.1 // indirect
|
|
github.com/agext/levenshtein v1.2.1 // indirect
|
|
github.com/apparentlymart/go-cidr v1.0.1 // indirect
|
|
github.com/apparentlymart/go-textseg/v13 v13.0.0 // indirect
|
|
github.com/armon/go-radix v1.0.0 // indirect
|
|
github.com/beorn7/perks v1.0.1 // indirect
|
|
github.com/bgentry/go-netrc v0.0.0-20140422174119-9fd32a8b3d3d // indirect
|
|
github.com/bgentry/speakeasy v0.1.0 // indirect
|
|
github.com/bits-and-blooms/bitset v1.2.0 // indirect
|
|
github.com/bmatcuk/doublestar v1.1.5 // indirect
|
|
github.com/boltdb/bolt v1.3.1 // indirect
|
|
github.com/brianvoe/gofakeit/v6 v6.16.0
|
|
github.com/cenkalti/backoff/v3 v3.2.2 // indirect
|
|
github.com/census-instrumentation/opencensus-proto v0.3.0 // indirect
|
|
github.com/cespare/xxhash/v2 v2.1.2 // indirect
|
|
github.com/checkpoint-restore/go-criu/v5 v5.3.0 // indirect
|
|
github.com/cheggaaa/pb/v3 v3.0.5 // indirect
|
|
github.com/cilium/ebpf v0.8.1 // indirect
|
|
github.com/circonus-labs/circonus-gometrics v2.3.1+incompatible // indirect
|
|
github.com/circonus-labs/circonusllhist v0.1.3 // indirect
|
|
github.com/cncf/udpa/go v0.0.0-20210930031921-04548b0d99d4 // indirect
|
|
github.com/cncf/xds/go v0.0.0-20211011173535-cb28da3451f1 // indirect
|
|
github.com/containerd/cgroups v1.0.2 // indirect
|
|
github.com/containerd/console v1.0.3 // indirect
|
|
github.com/containerd/containerd v1.5.9 // indirect
|
|
github.com/coreos/go-systemd/v22 v22.3.2 // indirect
|
|
github.com/cyphar/filepath-securejoin v0.2.3 // indirect
|
|
github.com/davecgh/go-spew v1.1.1 // indirect
|
|
github.com/denverdino/aliyungo v0.0.0-20190125010748-a747050bb1ba // indirect
|
|
github.com/digitalocean/godo v1.10.0 // indirect
|
|
github.com/dimchansky/utfbom v1.1.0 // indirect
|
|
github.com/docker/docker-credential-helpers v0.6.4 // indirect
|
|
github.com/docker/go-connections v0.4.0 // indirect
|
|
github.com/docker/go-metrics v0.0.1 // indirect
|
|
github.com/docker/libtrust v0.0.0-20160708172513-aabc10ec26b7 // indirect
|
|
github.com/envoyproxy/go-control-plane v0.10.0 // indirect
|
|
github.com/envoyproxy/protoc-gen-validate v0.6.2 // indirect
|
|
github.com/felixge/httpsnoop v1.0.1 // indirect
|
|
github.com/go-ole/go-ole v1.2.6 // indirect
|
|
github.com/godbus/dbus/v5 v5.1.0 // indirect
|
|
github.com/gogo/protobuf v1.3.2 // indirect
|
|
github.com/gojuno/minimock/v3 v3.0.6 // indirect
|
|
github.com/golang-jwt/jwt/v4 v4.4.1
|
|
github.com/golang/groupcache v0.0.0-20210331224755-41bb18bfe9da // indirect
|
|
github.com/google/btree v1.0.0 // indirect
|
|
github.com/google/go-querystring v0.0.0-20170111101155-53e6ce116135 // indirect
|
|
github.com/google/uuid v1.3.0 // indirect
|
|
github.com/googleapis/gax-go/v2 v2.1.1 // indirect
|
|
github.com/gookit/color v1.3.1 // indirect
|
|
github.com/gophercloud/gophercloud v0.1.0 // indirect
|
|
github.com/gorilla/mux v1.8.0 // indirect
|
|
github.com/hashicorp/errwrap v1.1.0 // indirect
|
|
github.com/hashicorp/go-retryablehttp v0.7.0 // indirect
|
|
github.com/hashicorp/go-rootcerts v1.0.2 // indirect
|
|
github.com/hashicorp/go-safetemp v1.0.0 // indirect
|
|
github.com/hashicorp/go-secure-stdlib/mlock v0.1.2 // indirect
|
|
github.com/hashicorp/go-secure-stdlib/parseutil v0.1.4 // indirect
|
|
github.com/hashicorp/go-secure-stdlib/reloadutil v0.1.1 // indirect
|
|
github.com/hashicorp/go-secure-stdlib/tlsutil v0.1.1 // indirect
|
|
github.com/hashicorp/mdns v1.0.4 // indirect
|
|
github.com/hashicorp/vault/api/auth/kubernetes v0.1.0 // indirect
|
|
github.com/hashicorp/vic v1.5.1-0.20190403131502-bbfe86ec9443 // indirect
|
|
github.com/huandu/xstrings v1.3.2 // indirect
|
|
github.com/imdario/mergo v0.3.12 // indirect
|
|
github.com/ishidawataru/sctp v0.0.0-20191218070446-00ab2ac2db07 // indirect
|
|
github.com/jefferai/isbadcipher v0.0.0-20190226160619-51d2077c035f // indirect
|
|
github.com/jmespath/go-jmespath v0.4.0 // indirect
|
|
github.com/joyent/triton-go v0.0.0-20190112182421-51ffac552869 // indirect
|
|
github.com/klauspost/compress v1.13.6 // indirect
|
|
github.com/linode/linodego v0.7.1 // indirect
|
|
github.com/lufia/plan9stats v0.0.0-20211012122336-39d0f177ccd0 // indirect
|
|
github.com/mattn/go-isatty v0.0.14 // indirect
|
|
github.com/mattn/go-runewidth v0.0.7 // indirect
|
|
github.com/matttproud/golang_protobuf_extensions v1.0.2-0.20181231171920-c182affec369 // indirect
|
|
github.com/mitchellh/go-homedir v1.1.0 // indirect
|
|
github.com/mitchellh/go-wordwrap v1.0.1 // indirect
|
|
github.com/mitchellh/pointerstructure v1.2.1 // indirect
|
|
github.com/morikuni/aec v1.0.0 // indirect
|
|
github.com/mrunalp/fileutils v0.5.0 // indirect
|
|
github.com/nicolai86/scaleway-sdk v1.10.2-0.20180628010248-798f60e20bb2 // indirect
|
|
github.com/niemeyer/pretty v0.0.0-20200227124842-a10e7caefd8e // indirect
|
|
github.com/oklog/run v1.1.0 // indirect
|
|
github.com/opencontainers/go-digest v1.0.0 // indirect
|
|
github.com/opencontainers/image-spec v1.0.2 // indirect
|
|
github.com/opencontainers/selinux v1.10.0 // indirect
|
|
github.com/packethost/packngo v0.1.1-0.20180711074735-b9cb5096f54c // indirect
|
|
github.com/pierrec/lz4 v2.6.1+incompatible // indirect
|
|
github.com/pkg/errors v0.9.1 // indirect
|
|
github.com/pmezard/go-difflib v1.0.0 // indirect
|
|
github.com/power-devops/perfstat v0.0.0-20210106213030-5aafc221ea8c // indirect
|
|
github.com/prometheus/client_model v0.2.0 // indirect
|
|
github.com/prometheus/procfs v0.7.3 // indirect
|
|
github.com/renier/xmlrpc v0.0.0-20170708154548-ce4a1a486c03 // indirect
|
|
github.com/rogpeppe/go-internal v1.6.1 // indirect
|
|
github.com/seccomp/libseccomp-golang v0.9.2-0.20210429002308-3879420cc921 // indirect
|
|
github.com/sirupsen/logrus v1.8.1 // indirect
|
|
github.com/softlayer/softlayer-go v0.0.0-20180806151055-260589d94c7d // indirect
|
|
github.com/stretchr/objx v0.4.0 // indirect
|
|
github.com/tencentcloud/tencentcloud-sdk-go v1.0.162 // indirect
|
|
github.com/tj/go-spin v1.1.0 // indirect
|
|
github.com/tklauser/go-sysconf v0.3.9 // indirect
|
|
github.com/tklauser/numcpus v0.3.0 // indirect
|
|
github.com/tv42/httpunix v0.0.0-20150427012821-b75d8614f926 // indirect
|
|
github.com/ulikunitz/xz v0.5.10 // indirect
|
|
github.com/vishvananda/netlink v1.1.1-0.20210330154013-f5de75959ad5 // indirect
|
|
github.com/vishvananda/netns v0.0.0-20210104183010-2eb08e3e575f // indirect
|
|
github.com/vmihailenco/msgpack/v4 v4.3.12 // indirect
|
|
github.com/vmihailenco/tagparser v0.1.1 // indirect
|
|
github.com/vmware/govmomi v0.18.0 // indirect
|
|
github.com/yusufpapurcu/wmi v1.2.2 // indirect
|
|
go.opencensus.io v0.23.0 // indirect
|
|
go.uber.org/atomic v1.9.0 // indirect
|
|
golang.org/x/oauth2 v0.0.0-20211104180415-d3ed0bb246c8 // indirect
|
|
golang.org/x/term v0.0.0-20210927222741-03fcf44c2211 // indirect
|
|
golang.org/x/text v0.3.7 // indirect
|
|
golang.org/x/xerrors v0.0.0-20200804184101-5ec99f83aff1 // indirect
|
|
google.golang.org/api v0.60.0 // indirect
|
|
google.golang.org/appengine v1.6.7 // indirect
|
|
google.golang.org/genproto v0.0.0-20220314164441-57ef72a4c106 // indirect
|
|
gopkg.in/check.v1 v1.0.0-20200227125254-8fa46927fb4f // indirect
|
|
gopkg.in/fsnotify.v1 v1.4.7 // indirect
|
|
gopkg.in/resty.v1 v1.12.0 // indirect
|
|
gopkg.in/square/go-jose.v2 v2.6.0 // indirect
|
|
gopkg.in/yaml.v2 v2.4.0 // indirect
|
|
gopkg.in/yaml.v3 v3.0.1 // indirect
|
|
)
|