diff --git a/.changelog/20073.txt b/.changelog/20073.txt new file mode 100644 index 00000000000..8b5be9343c5 --- /dev/null +++ b/.changelog/20073.txt @@ -0,0 +1,3 @@ +```release-note:improvement +drivers: add posibility to restrict user and group for exec and rawexec +``` diff --git a/.changelog/24157.txt b/.changelog/24157.txt new file mode 100644 index 00000000000..f758fa8c2db --- /dev/null +++ b/.changelog/24157.txt @@ -0,0 +1,3 @@ +```release-note:improvement +getter: Added option to chown artifact(s) to task user +``` diff --git a/.changelog/24169.txt b/.changelog/24169.txt new file mode 100644 index 00000000000..3f43a4a3d83 --- /dev/null +++ b/.changelog/24169.txt @@ -0,0 +1,3 @@ +```release-note:improvement +fingerprint gce: fingerprint preemptibility +``` diff --git a/.release/versions.hcl b/.release/versions.hcl index 57141806c86..92a95049231 100644 --- a/.release/versions.hcl +++ b/.release/versions.hcl @@ -6,6 +6,9 @@ schema = 1 active_versions { + version "1.9.x" { + ce_active = true + } version "1.8.x" { ce_active = true lts = true @@ -13,7 +16,4 @@ active_versions { version "1.7.x" { ce_active = true } - version "1.6.x" { - ce_active = true - } } diff --git a/CHANGELOG-unsupported.md b/CHANGELOG-unsupported.md index dac9196652e..c9c9b1c6de0 100644 --- a/CHANGELOG-unsupported.md +++ b/CHANGELOG-unsupported.md @@ -2,6 +2,415 @@ The versions of Nomad listed here are no longer supported by HashiCorp. +## 1.6.15 Enterprise (September 17, 2024) + +BREAKING CHANGES: + +* docker: The default infra_image for pause containers is now registry.k8s.io/pause [[GH-23927](https://github.com/hashicorp/nomad/issues/23927)] + +IMPROVEMENTS: + +* build: update to go1.22.6 [[GH-23805](https://github.com/hashicorp/nomad/issues/23805)] +* cli: Increase default log level and duration when capturing logs with `operator debug` [[GH-23850](https://github.com/hashicorp/nomad/issues/23850)] + +BUG FIXES: + +* node: Fixed bug where sysbatch allocations were started prematurely [[GH-23858](https://github.com/hashicorp/nomad/issues/23858)] + +## 1.6.14 Enterprise (August 13, 2024) + +SECURITY: + +* security: Fix symlink escape during unarchiving by removing existing paths within the same allocdir. Compromising the Nomad client agent at the source allocation first is a prerequisite for leveraging this issue. [[GH-23738](https://github.com/hashicorp/nomad/issues/23738)] + +IMPROVEMENTS: + +* keyring: Added support for prepublishing keys [[GH-23577](https://github.com/hashicorp/nomad/issues/23577)] + +BUG FIXES: + +* cni: .conf and .json config files are now parsed properly [[GH-23629](https://github.com/hashicorp/nomad/issues/23629)] +* docker: Fixed a bug where plugin SELinux labels would conflict with read-only `volume` options [[GH-23750](https://github.com/hashicorp/nomad/issues/23750)] +* keyring: Fixed a bug where keys could be garbage collected before workload identities expire [[GH-23577](https://github.com/hashicorp/nomad/issues/23577)] +* keyring: Fixed a bug where keys would never exit the "rekeying" state after a rotation with the `-full` flag [[GH-23577](https://github.com/hashicorp/nomad/issues/23577)] +* keyring: Fixed a bug where periodic key rotation would not occur [[GH-23577](https://github.com/hashicorp/nomad/issues/23577)] +* networking: The same static port can now be used more than once on host networks with multiple IPs [[GH-23693](https://github.com/hashicorp/nomad/issues/23693)] +* scaling: Fixed a bug where state store corruption could occur when writing scaling events [[GH-23673](https://github.com/hashicorp/nomad/issues/23673)] +* template: Fixed a bug where change_mode = "script" would not execute after a client restart [[GH-23663](https://github.com/hashicorp/nomad/issues/23663)] +* windows: Fix bug with containers capabilities on Docker CE [[GH-23599](https://github.com/hashicorp/nomad/issues/23599)] + +## 1.6.13 Enterprise (July 16, 2024) + +BREAKING CHANGES: + +* docker: default to hyper-v isolation mode on Windows [[GH-23452](https://github.com/hashicorp/nomad/issues/23452)] + +SECURITY: + +* build: Updated Go to 1.22.5 to address CVE-2024-24791 [[GH-23498](https://github.com/hashicorp/nomad/issues/23498)] +* migration: Added a check for relative paths escaping the allocation directory when unpacking archive during migration, to harden clients against compromised peer clients sending malicious archives [[GH-23319](https://github.com/hashicorp/nomad/issues/23319)] +* security: Removed insecure TLS cipher suites: `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256`, `TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA25` and `TLS_RSA_WITH_AES_128_CBC_SHA256`. [[GH-23551](https://github.com/hashicorp/nomad/issues/23551)] + +IMPROVEMENTS: + +* deps: Updated Consul API to 1.29.1. [[GH-23436](https://github.com/hashicorp/nomad/issues/23436)] +* deps: Updated consul-template to 0.39 to allow admin partition and sameness groups queries. [[GH-23436](https://github.com/hashicorp/nomad/issues/23436)] +* docker: Validate that unprivileged containers aren't running as ContainerAdmin on Windows [[GH-23443](https://github.com/hashicorp/nomad/issues/23443)] + +BUG FIXES: + +* api: Fixed bug where newlines in JobSubmission vars weren't encoded correctly [[GH-23560](https://github.com/hashicorp/nomad/issues/23560)] +* cli: Fixed bug where the `plugin status` command would fail if the plugin ID was a prefix of another plugin ID [[GH-23502](https://github.com/hashicorp/nomad/issues/23502)] +* cli: Fixed bug where the `quota status` and `quota inspect` commands would fail if the quota name was a prefix of another quota name [[GH-23502](https://github.com/hashicorp/nomad/issues/23502)] +* cli: Fixed bug where the `scaling policy info` command would fail if the policy ID was a prefix of another policy ID [[GH-23502](https://github.com/hashicorp/nomad/issues/23502)] +* cli: Fixed bug where the `service info` command would fail if the service name was a prefix of another service name in the same namespace [[GH-23502](https://github.com/hashicorp/nomad/issues/23502)] +* cli: Fixed bug where the `volume deregister`, `volume detach`, and `volume status` commands would fail if the volume ID was a prefix of another volume ID in the same namespace [[GH-23502](https://github.com/hashicorp/nomad/issues/23502)] +* quota (Enterprise): Fixed a bug where a task's resource core count was not translated to CPU MHz and checked against its quota when performing a job plan [[GH-18876](https://github.com/hashicorp/nomad/issues/18876)] +* scheduler: Fix a bug where reserved resources are not calculated correctly [[GH-23386](https://github.com/hashicorp/nomad/issues/23386)] +* server: Fixed a bug where expiring heartbeats for garbage collected nodes could panic the server [[GH-23383](https://github.com/hashicorp/nomad/issues/23383)] +* template: Fix template rendering on Windows [[GH-23432](https://github.com/hashicorp/nomad/issues/23432)] + +## 1.6.12 Enterprise (June 19, 2024) + +SECURITY: + +* build: Updated Go to 1.22.4 to address Go stdlib vulnerabilities CVE-2024-24789 and CVE-2024-24790 [[GH-23172](https://github.com/hashicorp/nomad/issues/23172)] + +IMPROVEMENTS: + +* cli: `operator snapshot inspect` now includes details of data in snapshot [[GH-18372](https://github.com/hashicorp/nomad/issues/18372)] +* docker: Added container_exists_attempts plugin configuration variable [[GH-22419](https://github.com/hashicorp/nomad/issues/22419)] +* exec: Fixed a bug where `exec` driver tasks would fail on older versions of glibc [[GH-23331](https://github.com/hashicorp/nomad/issues/23331)] + +BUG FIXES: + +* acl: Fix plugin policy validation when checking write permissions [[GH-23274](https://github.com/hashicorp/nomad/issues/23274)] +* connect: fix validation with multiple socket paths [[GH-22312](https://github.com/hashicorp/nomad/issues/22312)] +* driver: Fixed a bug where the exec, java, and raw_exec drivers would not configure cgroups to allow access to devices provided by device plugins [[GH-22518](https://github.com/hashicorp/nomad/issues/22518)] +* scheduler: Fixed a bug where rescheduled allocations that could not be placed would later ignore their reschedule policy limits [[GH-12319](https://github.com/hashicorp/nomad/issues/12319)] + +## 1.6.11 Enterprise (May 28, 2024) + +SECURITY: + +* deps: Updated `docker` dependency to 25.0.5 [[GH-20171](https://github.com/hashicorp/nomad/issues/20171)] + +BUG FIXES: + +* cli: Fix handling of scaling jobs which don't generate evals [[GH-20479](https://github.com/hashicorp/nomad/issues/20479)] +* client: terminate old exec task processes before starting new ones, to avoid accidentally leaving running processes in case of an error [[GH-20500](https://github.com/hashicorp/nomad/issues/20500)] +* core: Fix multiple incorrect type conversion for potential overflows [[GH-20553](https://github.com/hashicorp/nomad/issues/20553)] +* csi: Fixed a bug where concurrent mount and unmount operations could unstage volumes needed by another allocation [[GH-20550](https://github.com/hashicorp/nomad/issues/20550)] +* csi: Fixed a bug where plugins would not be deleted on GC if their job updated the plugin ID [[GH-20555](https://github.com/hashicorp/nomad/issues/20555)] +* csi: Fixed a bug where volumes in different namespaces but the same ID would fail to stage on the same client [[GH-20532](https://github.com/hashicorp/nomad/issues/20532)] +* quota (Enterprise): Fixed a bug where quota usage would not be freed if a job was purged +* services: Added retry to Nomad service deregistration RPCs during alloc stop [[GH-20596](https://github.com/hashicorp/nomad/issues/20596)] +* services: Fixed bug where Nomad services might not be deregistered when nodes are marked down or allocations are terminal [[GH-20590](https://github.com/hashicorp/nomad/issues/20590)] +* structs: Fix job canonicalization for array type fields [[GH-20522](https://github.com/hashicorp/nomad/issues/20522)] +* ui: Show the namespace in the web UI exec command hint [[GH-20218](https://github.com/hashicorp/nomad/issues/20218)] + +## 1.6.10 (April 16, 2024) + +SECURITY: + +* artifact: Updated `go-getter` dependency to v1.7.4 to address CVE-2024-3817 [[GH-20391](https://github.com/hashicorp/nomad/issues/20391)] + +BUG FIXES: + +* api: Fixed a bug where `AllocDirStats` field was missing from Read Stats client API [[GH-20261](https://github.com/hashicorp/nomad/issues/20261)] +* cli: Fixed a bug where `operator debug` did not respect the `-pprof-interval` flag and would take only one profile [[GH-20206](https://github.com/hashicorp/nomad/issues/20206)] +* cni: Fixed a regression where default DNS set by `dockerd` or other task drivers was not respected [[GH-20189](https://github.com/hashicorp/nomad/issues/20189)] +* config: Fixed a bug where IPv6 addresses were not accepted without ports for `client.servers` blocks [[GH-20324](https://github.com/hashicorp/nomad/issues/20324)] +* deployments: Fixed a goroutine leak when jobs are purged [[GH-20348](https://github.com/hashicorp/nomad/issues/20348)] +* deps: Updated consul-template dependency to 0.37.4 to fix a resource leak [[GH-20234](https://github.com/hashicorp/nomad/issues/20234)] +* drain: Fixed a bug where Workload Identity tokens could not be used to drain a node [[GH-20317](https://github.com/hashicorp/nomad/issues/20317)] +* namespace/node pool: Fixed a bug where the `-region` flag would not be respected for namespace and node pool updates if ACLs were disabled [[GH-20220](https://github.com/hashicorp/nomad/issues/20220)] +* state: Fixed a bug where restarting a server could fail if the Raft logs include a drain update that used a now-expired token [[GH-20317](https://github.com/hashicorp/nomad/issues/20317)] +* template: Fixed a bug where a partial `client.template` block would cause defaults for unspecified fields to be ignored [[GH-20165](https://github.com/hashicorp/nomad/issues/20165)] +* ui: Fix an issue where the job status box would error if an allocation had no task events [[GH-20383](https://github.com/hashicorp/nomad/issues/20383)] + +## 1.6.9 (March 12, 2024) + +SECURITY: + +* build: Update to go1.22 to address Go standard library vulnerabilities CVE-2024-24783, CVE-2023-45290, and CVE-2024-24785. [[GH-20066](https://github.com/hashicorp/nomad/issues/20066)] +* deps: Upgrade protobuf library to 1.33.0 to avoid scan alerts for CVE-2024-24786, which Nomad is not vulnerable to [[GH-20100](https://github.com/hashicorp/nomad/issues/20100)] + +BUG FIXES: + +* cli: Fixed a bug where the `nomad job restart` command could crash if the job type was not present in a response from the server [[GH-20049](https://github.com/hashicorp/nomad/issues/20049)] +* client: Fixed a bug where corrupt client state could panic the client [[GH-19972](https://github.com/hashicorp/nomad/issues/19972)] +* cni: Fixed a bug where DNS set by CNI plugins was not provided to task drivers [[GH-20007](https://github.com/hashicorp/nomad/issues/20007)] +* connect: Fixed a bug where `expose` blocks would not appear in `job plan` diff output [[GH-19990](https://github.com/hashicorp/nomad/issues/19990)] + +## 1.6.8 (February 13, 2024) + +SECURITY: + +* windows: Remove `LazyDLL` calls for system modules to harden Nomad against attacks from the host [[GH-19925](https://github.com/hashicorp/nomad/issues/19925)] + +BUG FIXES: + +* cli: Fix return code when `nomad job run` succeeds after a blocked eval [[GH-19876](https://github.com/hashicorp/nomad/issues/19876)] +* cli: Fixed a bug where the `nomad tls ca create` command failed when the `-domain` was used without other values [[GH-19892](https://github.com/hashicorp/nomad/issues/19892)] +* connect: Fixed envoy sidecars being unable to restart after node reboots [[GH-19787](https://github.com/hashicorp/nomad/issues/19787)] +* exec: Fixed a bug in `alloc exec` where closing websocket streams could cause a panic [[GH-19932](https://github.com/hashicorp/nomad/issues/19932)] +* scheduler: Fixed a bug that caused blocked evaluations due to port conflict to not have a reason explaining why the evaluation was blocked [[GH-19933](https://github.com/hashicorp/nomad/issues/19933)] +* ui: Fix an issue where a same-named task from a different group could be selected when the user clicks Exec from a task group page where multiple allocations would be valid [[GH-19878](https://github.com/hashicorp/nomad/issues/19878)] + +## 1.6.7 (February 08, 2024) + +SECURITY: + +* deps: Updated runc to 1.1.12 to address CVE-2024-21626 [[GH-19851](https://github.com/hashicorp/nomad/issues/19851)] +* migration: Fixed a bug where archives used for migration were not checked for symlinks that escaped the allocation directory [[GH-19887](https://github.com/hashicorp/nomad/issues/19887)] +* template: Fixed a bug where symlinks could force templates to read and write to arbitrary locations (CVE-2024-1329) [[GH-19888](https://github.com/hashicorp/nomad/issues/19888)] + +## 1.6.6 (January 15, 2024) + +IMPROVEMENTS: + +* build: update to go 1.21.6 [[GH-19709](https://github.com/hashicorp/nomad/issues/19709)] + +BUG FIXES: + +* acl: Fixed auth method hashing which meant changing some fields would be silently ignored [[GH-19677](https://github.com/hashicorp/nomad/issues/19677)] +* auth: Added new optional OIDCDisableUserInfo setting for OIDC auth provider [[GH-19566](https://github.com/hashicorp/nomad/issues/19566)] +* core: Ensure job HCL submission data is persisted and restored during the FSM snapshot process [[GH-19605](https://github.com/hashicorp/nomad/issues/19605)] +* namespaces: Failed delete calls no longer return success codes [[GH-19483](https://github.com/hashicorp/nomad/issues/19483)] +* server: Fix server not waiting for workers to submit nacks for dequeued evaluations before shutting down [[GH-19560](https://github.com/hashicorp/nomad/issues/19560)] +* state: Fixed a bug where purged jobs would not get new deployments [[GH-19609](https://github.com/hashicorp/nomad/issues/19609)] + +## 1.6.5 (December 13, 2023) + +BUG FIXES: + +* cli: Fix a bug in the `var put` command which prevented combining items as CLI arguments and other parameters as flags [[GH-19423](https://github.com/hashicorp/nomad/issues/19423)] +* client: remove incomplete allocation entries from client state database during client restarts [[GH-16638](https://github.com/hashicorp/nomad/issues/16638)] +* connect: Fixed a bug where deployments would not wait for Connect sidecar task health checks to pass [[GH-19334](https://github.com/hashicorp/nomad/issues/19334)] +* consul: uses token namespace to fetch policies for verification [[GH-18516](https://github.com/hashicorp/nomad/issues/18516)] +* csi: Added validation to `csi_plugin` blocks to prevent `stage_publish_base_dir` from being a subdirectory of `mount_dir` [[GH-19441](https://github.com/hashicorp/nomad/issues/19441)] +* metrics: Revert upgrade of `go-metrics` to fix an issue where metrics from dependencies, such as raft, were no longer emitted [[GH-19375](https://github.com/hashicorp/nomad/issues/19375)] + +## 1.6.4 (December 07, 2023) + +BREAKING CHANGES: + +* core: Honor job's namespace when checking `distinct_hosts` feasibility [[GH-19004](https://github.com/hashicorp/nomad/issues/19004)] + +SECURITY: + +* build: Update to go1.21.4 to resolve Windows path validation CVE in Go [[GH-19013](https://github.com/hashicorp/nomad/issues/19013)] +* build: Update to go1.21.5 to resolve Windows path validation CVE in Go [[GH-19320](https://github.com/hashicorp/nomad/issues/19320)] + +IMPROVEMENTS: + +* cli: Add file prediction for operator raft/snapshot commands [[GH-18901](https://github.com/hashicorp/nomad/issues/18901)] +* ui: color-code node and server status cells [[GH-18318](https://github.com/hashicorp/nomad/issues/18318)] +* ui: show plan output warnings alongside placement failures and dry-run info when running a job through the web ui [[GH-19225](https://github.com/hashicorp/nomad/issues/19225)] + +BUG FIXES: + +* agent: Correct websocket status code handling [[GH-19172](https://github.com/hashicorp/nomad/issues/19172)] +* api: Fix panic in `Allocation.Stub` method when `Job` is unset [[GH-19115](https://github.com/hashicorp/nomad/issues/19115)] +* cli: Fixed a bug that caused the `nomad job restart` command to miscount the allocations to restart [[GH-19155](https://github.com/hashicorp/nomad/issues/19155)] +* cli: Fixed a panic when the `nomad job restart` command received an interrupt signal while waiting for an answer [[GH-19154](https://github.com/hashicorp/nomad/issues/19154)] +* cli: Fixed the `nomad job restart` command to create replacements for batch and system jobs and to prevent sysbatch jobs from being rescheduled since they never create replacements [[GH-19147](https://github.com/hashicorp/nomad/issues/19147)] +* client: Fixed a bug where client API calls would fail incorrectly with permission denied errors when using ACL tokens with dangling policies [[GH-18972](https://github.com/hashicorp/nomad/issues/18972)] +* core: Fix incorrect submit time for stopped jobs [[GH-18967](https://github.com/hashicorp/nomad/issues/18967)] +* ui: Fixed an issue where purging a job with a namespace did not process correctly [[GH-19139](https://github.com/hashicorp/nomad/issues/19139)] +* ui: fix an issue where starting a stopped job with default-less variables would not retain those variables when done via the job page start button in the web ui [[GH-19220](https://github.com/hashicorp/nomad/issues/19220)] +* ui: fix the job auto-linked variable path name when user lacks variable write permissions [[GH-18598](https://github.com/hashicorp/nomad/issues/18598)] +* variables: Fixed a bug where poststop tasks were not allowed access to Variables [[GH-19270](https://github.com/hashicorp/nomad/issues/19270)] +* vault: Fixed a bug where poststop tasks would not get a Vault token [[GH-19268](https://github.com/hashicorp/nomad/issues/19268)] +* vault: Fixed an issue that could cause Nomad to attempt to renew a Vault token that is already expired [[GH-18985](https://github.com/hashicorp/nomad/issues/18985)] + +## 1.6.3 (October 30, 2023) + +SECURITY: + +* build: Update to Go 1.21.3 [[GH-18717](https://github.com/hashicorp/nomad/issues/18717)] + +IMPROVEMENTS: + +* agent: Added config option to enable file and line log detail [[GH-18768](https://github.com/hashicorp/nomad/issues/18768)] +* api: Added support for the `log_include_location` query parameter within the + `/v1/agent/monitor` HTTP endpoint [[GH-18795](https://github.com/hashicorp/nomad/issues/18795)] +* cli: Add `-prune` flag to `nomad operator force-leave` command [[GH-18463](https://github.com/hashicorp/nomad/issues/18463)] +* cli: Added `log-include-location` flag to the `monitor` command [[GH-18795](https://github.com/hashicorp/nomad/issues/18795)] +* cli: Added `log-include-location` flag to the `operator debug` command [[GH-18795](https://github.com/hashicorp/nomad/issues/18795)] +* csi: add ability to expand the size of volumes for plugins that support it [[GH-18359](https://github.com/hashicorp/nomad/issues/18359)] +* template: reduce memory usage associated with communicating with the Nomad API [[GH-18524](https://github.com/hashicorp/nomad/issues/18524)] +* ui: observe a token's roles' rules in the UI and add an interface for managing tokens, roles, and policies [[GH-17770](https://github.com/hashicorp/nomad/issues/17770)] + +BUG FIXES: + +* build: Add `timetzdata` Go build tag on Windows binaries to embed time zone data so periodic jobs are able to specify a time zone value on Windows environments [[GH-18676](https://github.com/hashicorp/nomad/issues/18676)] +* cli: Fixed an unexpected behavior of the `nomad acl token update` command that could cause a management token to be downgraded to client on update [[GH-18689](https://github.com/hashicorp/nomad/issues/18689)] +* cli: Use same offset when following single or multiple alloc logs [[GH-18604](https://github.com/hashicorp/nomad/issues/18604)] +* cli: ensure HCL env vars are added to the job submission object in the `job run` command [[GH-18832](https://github.com/hashicorp/nomad/issues/18832)] +* client: ensure null dynamic node metadata values are removed from memory [[GH-18664](https://github.com/hashicorp/nomad/issues/18664)] +* client: prevent tasks from starting without the prestart hooks running [[GH-18662](https://github.com/hashicorp/nomad/issues/18662)] +* metrics: Fixed a bug where CPU counters could report errors for negative values [[GH-18835](https://github.com/hashicorp/nomad/issues/18835)] +* scaling: Unblock blocking queries to /v1/job/{job-id}/scale if the job goes away [[GH-18637](https://github.com/hashicorp/nomad/issues/18637)] +* scheduler (Enterprise): auto-unblock evals with associated quotas when node resources are freed up [[GH-18838](https://github.com/hashicorp/nomad/issues/18838)] +* scheduler: Ensure duplicate allocation indexes are tracked and fixed when performing job updates [[GH-18873](https://github.com/hashicorp/nomad/issues/18873)] +* server: Fixed a bug where Raft server configuration parameters were not correctly merged [[GH-18494](https://github.com/hashicorp/nomad/issues/18494)] +* services: use interpolated address when performing nomad service health checks [[GH-18584](https://github.com/hashicorp/nomad/issues/18584)] +* ui: using start/stop from the job page in the UI will no longer fail when the job lacks HCL submission data [[GH-18621](https://github.com/hashicorp/nomad/issues/18621)] + +## 1.6.2 (September 13, 2023) + +IMPROVEMENTS: + +* build: Update to Go 1.21.0 [[GH-18184](https://github.com/hashicorp/nomad/issues/18184)] +* cli: support wildcard namespaces in alloc subcommands when the `-job` flag is used [[GH-18095](https://github.com/hashicorp/nomad/issues/18095)] +* config: Added an option to configure how many historic versions of jobs are retained in the state store [[GH-17939](https://github.com/hashicorp/nomad/issues/17939)] +* consul/connect: Added support for `DestinationPeer`, `DestinationType`, `LocalBindSocketPath`, and `LocalBindSocketMode` in upstream block [[GH-16745](https://github.com/hashicorp/nomad/issues/16745)] +* jobspec: Add 'crons' field for multiple `cron` expressions [[GH-17858](https://github.com/hashicorp/nomad/issues/17858)] +* jobspec: Add new parameter `render_templates` for `restart` block to allow explicit re-render of templates on task restart. The default value is `false` and is fully backward compatible [[GH-18054](https://github.com/hashicorp/nomad/issues/18054)] +* jobspec: add `node_pool` as a valid field [[GH-18366](https://github.com/hashicorp/nomad/issues/18366)] +* raft: remove use of deprecated Leader func [[GH-18352](https://github.com/hashicorp/nomad/issues/18352)] +* status: go-getter failure reason now shown in `alloc status` [[GH-18444](https://github.com/hashicorp/nomad/issues/18444)] +* ui: Added configurable content security policy header [[GH-18085](https://github.com/hashicorp/nomad/issues/18085)] +* ui: adds a new Variables page to all job pages [[GH-17964](https://github.com/hashicorp/nomad/issues/17964)] +* ui: adds keyboard commands for pagination on lists using [[ and ]] [[GH-18210](https://github.com/hashicorp/nomad/issues/18210)] +* ui: sort variable key/values alphabetically by key when editing [[GH-18051](https://github.com/hashicorp/nomad/issues/18051)] +* ui: trim variable path names before saving [[GH-18198](https://github.com/hashicorp/nomad/issues/18198)] + +BUG FIXES: + +* acl: Fixed a bug where ACL tokens linked to ACL roles containing duplicate policies would cause erronous permission denined responses [[GH-18419](https://github.com/hashicorp/nomad/issues/18419)] +* cli: Add missing help message for the `-consul-namespace` flag in the `nomad job run` command [[GH-18081](https://github.com/hashicorp/nomad/issues/18081)] +* cli: Fix panic in `alloc logs` command when receiving empty stdout or stderr log frames [[GH-17815](https://github.com/hashicorp/nomad/issues/17815)] +* cli: Fixed a bug that prevented CSI volumes in namespaces other than `default` from being displayed in the `nomad node status -verbose` output [[GH-17925](https://github.com/hashicorp/nomad/issues/17925)] +* cli: Snapshot name is required in `volume snapshot create` command [[GH-17958](https://github.com/hashicorp/nomad/issues/17958)] +* client: Fixed a bug where the state of poststop tasks could be corrupted by client gc [[GH-17971](https://github.com/hashicorp/nomad/issues/17971)] +* client: Ignore stale server updates to prevent GCing allocations that should be running [[GH-18269](https://github.com/hashicorp/nomad/issues/18269)] +* client: return 404 instead of 500 when trying to access logs and files from allocations that have been garbage collected [[GH-18232](https://github.com/hashicorp/nomad/issues/18232)] +* core: Fixed a bug where exponential backoff could result in excessive CPU usage [[GH-18200](https://github.com/hashicorp/nomad/issues/18200)] +* csi: fixed a bug that could case a panic when deleting volumes [[GH-18234](https://github.com/hashicorp/nomad/issues/18234)] +* fingerprint: fix 'default' alias not being added to interface specified by network_interface [[GH-18096](https://github.com/hashicorp/nomad/issues/18096)] +* jobspec: Add diff for Task Group scaling block [[GH-18332](https://github.com/hashicorp/nomad/issues/18332)] +* migration: Fixed a bug where previous alloc logs were destroyed when migrating ephemeral_disk on the same client [[GH-18108](https://github.com/hashicorp/nomad/issues/18108)] +* scheduler: Fixed a bug where device IDs were not correctly filtered in constraints [[GH-18141](https://github.com/hashicorp/nomad/issues/18141)] +* services: Add validation message when `tls_skip_verify` is set to `true` on a Nomad service [[GH-18333](https://github.com/hashicorp/nomad/issues/18333)] +* ui: maintain HCL2 jobspec when using Start Job in the web ui [[GH-18120](https://github.com/hashicorp/nomad/issues/18120)] +* ui: search results are no longer overridden by sorting preferences on the jobs index page [[GH-18053](https://github.com/hashicorp/nomad/issues/18053)] + +## 1.6.1 (July 21, 2023) + +IMPROVEMENTS: + +* cli: Display volume namespace on `nomad volume status` and `nomad node status` output [[GH-17911](https://github.com/hashicorp/nomad/issues/17911)] +* cpustats: Use config "cpu_total_compute" (if set) for all CPU statistics [[GH-17628](https://github.com/hashicorp/nomad/issues/17628)] +* metrics: Add `allocs.memory.max_allocated` to report the value of tasks' `memory_max` resource value [[GH-17938](https://github.com/hashicorp/nomad/issues/17938)] +* ui: added a button to copy variable path to clipboard [[GH-17935](https://github.com/hashicorp/nomad/issues/17935)] +* ui: adds a keyboard shortcut for Create Variable [[GH-17932](https://github.com/hashicorp/nomad/issues/17932)] +* ui: if a job is remotely purged while you're actively on it, it will let you know and re-route you to the index page [[GH-17915](https://github.com/hashicorp/nomad/issues/17915)] +* ui: indicate that nomad/jobs as a variable path is auto-accessible by all nomad jobs [[GH-17933](https://github.com/hashicorp/nomad/issues/17933)] + +BUG FIXES: + +* core: Fixed a bug where namespaces were not canonicalized on snapshot restore, resulting in potential nil access panic [[GH-18017](https://github.com/hashicorp/nomad/issues/18017)] +* csi: Fixed a bug in sending concurrent requests to CSI controller plugins by serializing them per plugin [[GH-17996](https://github.com/hashicorp/nomad/issues/17996)] +* csi: Fixed a bug where CSI controller requests could be sent to unhealthy plugins [[GH-17996](https://github.com/hashicorp/nomad/issues/17996)] +* csi: Fixed a bug where CSI controller requests could not be sent to controllers on nodes ineligible for scheduling [[GH-17996](https://github.com/hashicorp/nomad/issues/17996)] +* services: Fixed a bug that prevented passing query parameters in Nomad native service discovery HTTP health check paths [[GH-17936](https://github.com/hashicorp/nomad/issues/17936)] +* ui: Fixed a bug that could cause an error when accessing a region running versions of Nomad prior to 1.6.0 [[GH-18021](https://github.com/hashicorp/nomad/issues/18021)] +* ui: Fixed a bug that prevented nodes from being filtered by the "Ineligible" and "Draining" state filters [[GH-17940](https://github.com/hashicorp/nomad/issues/17940)] +* ui: Fixed error handling for cross-region requests when the receiving region does not implement the endpoint being requested [[GH-18020](https://github.com/hashicorp/nomad/issues/18020)] + +## 1.6.0 (July 18, 2023) + +FEATURES: + +* **Node Pools**: Allow cluster operators to partition Nomad clients and control which jobs are allowed to run in each pool. [[GH-11041](https://github.com/hashicorp/nomad/issues/11041)] + +BREAKING CHANGES: + +* acl: Job evaluate endpoint now requires `submit-job` instead of `read-job` capability [[GH-16463](https://github.com/hashicorp/nomad/issues/16463)] + +SECURITY: + +* acl: Fixed a bug where a namespace ACL policy without label was applied to an unexpected namespace. [CVE-2023-3072](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3072) [[GH-17908](https://github.com/hashicorp/nomad/issues/17908)] +* search: Fixed a bug where ACL did not filter plugin and variable names in search endpoint. [CVE-2023-3300](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3300) [[GH-17906](https://github.com/hashicorp/nomad/issues/17906)] +* sentinel (Enterprise): Fixed a bug where ACL tokens could be exfiltrated via Sentinel logs [CVE-2023-3299](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3299) [[GH-17907](https://github.com/hashicorp/nomad/issues/17907)] + +IMPROVEMENTS: + +* agent: Display server node ID in agent configuration at startup [[GH-17084](https://github.com/hashicorp/nomad/issues/17084)] +* api: enable support for storing original job source [[GH-16763](https://github.com/hashicorp/nomad/issues/16763)] +* api: return a structured error for unexpected responses [[GH-16743](https://github.com/hashicorp/nomad/issues/16743)] +* build: Publish official Docker images with the Nomad CLI [[GH-17017](https://github.com/hashicorp/nomad/issues/17017)] +* checks: Added support for Consul check field tls_server_name [[GH-17334](https://github.com/hashicorp/nomad/issues/17334)] +* cli: Add `-quiet` flag to `nomad var init` command [[GH-17526](https://github.com/hashicorp/nomad/issues/17526)] +* cli: Add check for missing host volume `path` in `nomad config validate` command [[GH-17393](https://github.com/hashicorp/nomad/issues/17393)] +* cli: Add leader status to output of `nomad server members -json` [[GH-17138](https://github.com/hashicorp/nomad/issues/17138)] +* cli: Add the ability to customize the details of the CA when running `nomad tls ca create` [[GH-17309](https://github.com/hashicorp/nomad/issues/17309)] +* cli: Sort output by Node name of the command `nomad operator raft list-peers` [[GH-16221](https://github.com/hashicorp/nomad/issues/16221)] +* cli: `job plan` help text for running the plan now includes the `-namespace` flag [[GH-16243](https://github.com/hashicorp/nomad/issues/16243)] +* client: check kernel module in `/sys/module` to help with WSL2 bridge networking [[GH-17306](https://github.com/hashicorp/nomad/issues/17306)] +* client: de-duplicate allocation client status updates and prevent allocation client status updates from being sent until clients have first synchronized with the server [[GH-17074](https://github.com/hashicorp/nomad/issues/17074)] +* client: prioritize allocation updates to reduce Raft and RPC load [[GH-17354](https://github.com/hashicorp/nomad/issues/17354)] +* cni: Ensure to setup CNI addresses in deterministic order [[GH-17766](https://github.com/hashicorp/nomad/issues/17766)] +* connect: Auto detect when to use podman for connect sidecar proxies [[GH-17065](https://github.com/hashicorp/nomad/issues/17065)] +* connect: do not restrict automatic envoy versioning to docker driver [[GH-17041](https://github.com/hashicorp/nomad/issues/17041)] +* connect: use full docker.io prefixed name for envoy image references [[GH-17045](https://github.com/hashicorp/nomad/issues/17045)] +* deploymentwatcher: Allow deployments to fail early when running out of reschedule attempts [[GH-17341](https://github.com/hashicorp/nomad/issues/17341)] +* deps: Updated Vault SDK to 0.9.0 [[GH-17281](https://github.com/hashicorp/nomad/issues/17281)] +* deps: Updated consul-template to v0.31.0 [[GH-16908](https://github.com/hashicorp/nomad/issues/16908)] +* deps: update docker to 23.0.3 [[GH-16862](https://github.com/hashicorp/nomad/issues/16862)] +* deps: update github.com/hashicorp/raft from 1.3.11 to 1.5.0 [[GH-17421](https://github.com/hashicorp/nomad/issues/17421)] +* deps: update go.etcd.io/bbolt from 1.3.6 to 1.3.7 [[GH-16228](https://github.com/hashicorp/nomad/issues/16228)] +* docker: Add `group_add` configuration [[GH-17313](https://github.com/hashicorp/nomad/issues/17313)] +* docker: Added option for labeling container with parent job ID of periodic/dispatch jobs [[GH-17843](https://github.com/hashicorp/nomad/issues/17843)] +* drivers: Add `DisableLogCollection` to task driver capabilities interface [[GH-17196](https://github.com/hashicorp/nomad/issues/17196)] +* metrics: add "total_ticks_count" counter for allocs/host CPU usage [[GH-17579](https://github.com/hashicorp/nomad/issues/17579)] +* runtime: Added 'os.build' attribute to node fingerprint on windows os [[GH-17576](https://github.com/hashicorp/nomad/issues/17576)] +* ui: Added a new Job Status Panel that helps show allocation status throughout a deployment and in steady state [[GH-16134](https://github.com/hashicorp/nomad/issues/16134)] +* ui: Adds a Download as .nomad.hcl button to jobspec editing in the UI [[GH-17752](https://github.com/hashicorp/nomad/issues/17752)] +* ui: Job status and deployment redesign [[GH-16932](https://github.com/hashicorp/nomad/issues/16932)] +* ui: Restyles "toast" notifications in the web UI with the Helios Design System [[GH-16099](https://github.com/hashicorp/nomad/issues/16099)] +* ui: add tooltips to the node and datacenter labels in the Topology page [[GH-17647](https://github.com/hashicorp/nomad/issues/17647)] +* ui: adds a toggle and localStorage property to Word Wrap logs and job definitions [[GH-17754](https://github.com/hashicorp/nomad/issues/17754)] +* ui: adds keyboard nav for switching between regions by pressing "r 1", "r 2", etc. [[GH-17169](https://github.com/hashicorp/nomad/issues/17169)] +* ui: affix page header to the top of the browser window to handle browser extension push-down gracefully [[GH-17783](https://github.com/hashicorp/nomad/issues/17783)] +* ui: change token input type from text to password [[GH-17345](https://github.com/hashicorp/nomad/issues/17345)] +* ui: remove namespace, type, and priority columns from child job table [[GH-17645](https://github.com/hashicorp/nomad/issues/17645)] +* vault: Add new configuration `disable_file` to prevent access to the Vault token by tasks that use `image` filesystem isolation [[GH-13343](https://github.com/hashicorp/nomad/issues/13343)] + +DEPRECATIONS: + +* envoy: remove support for envoy fallback image [[GH-17044](https://github.com/hashicorp/nomad/issues/17044)] + +BUG FIXES: + +* api: Fixed a bug that caused a panic when calling the `Jobs().Plan()` function with a job missing an ID [[GH-17689](https://github.com/hashicorp/nomad/issues/17689)] +* api: add missing constant for unknown allocation status [[GH-17726](https://github.com/hashicorp/nomad/issues/17726)] +* api: add missing field NetworkStatus for Allocation [[GH-17280](https://github.com/hashicorp/nomad/issues/17280)] +* cgroups: Fixed a bug removing all DevicesSets when alloc is created/removed [[GH-17535](https://github.com/hashicorp/nomad/issues/17535)] +* cli: Fix a panic in the `nomad job restart` command when monitoring replacement allocations [[GH-17346](https://github.com/hashicorp/nomad/issues/17346)] +* cli: Output error messages during deployment monitoring [[GH-17348](https://github.com/hashicorp/nomad/issues/17348)] +* client: Fixed a bug where Nomad incorrectly wrote to memory swappiness cgroup on old kernels [[GH-17625](https://github.com/hashicorp/nomad/issues/17625)] +* client: Fixed a bug where agent would panic during drain incurred by shutdown [[GH-17450](https://github.com/hashicorp/nomad/issues/17450)] +* client: fixed a bug that prevented Nomad from fingerprinting Consul 1.13.8 correctly [[GH-17349](https://github.com/hashicorp/nomad/issues/17349)] +* consul: Fixed a bug where Nomad would repeatedly try to revoke successfully revoked SI tokens [[GH-17847](https://github.com/hashicorp/nomad/issues/17847)] +* core: Fix panic around client deregistration and pending heartbeats [[GH-17316](https://github.com/hashicorp/nomad/issues/17316)] +* core: fixed a bug that caused job validation to fail when a task with `kill_timeout` was placed inside a group with `update.progress_deadline` set to 0 [[GH-17342](https://github.com/hashicorp/nomad/issues/17342)] +* csi: Fixed a bug where CSI volumes would fail to restore during client restarts [[GH-17840](https://github.com/hashicorp/nomad/issues/17840)] +* docker: Fixed a bug where network pause container would not be removed after node restart [[GH-17455](https://github.com/hashicorp/nomad/issues/17455)] +* drivers/docker: Fixed a bug where long-running docker operations would incorrectly timeout [[GH-17731](https://github.com/hashicorp/nomad/issues/17731)] +* identity: Fixed a bug where workload identities for periodic and dispatch jobs would not have access to their parent job's ACL policy [[GH-17018](https://github.com/hashicorp/nomad/issues/17018)] +* replication: Fix a potential panic when a non-authoritative region is upgraded and a server with the new version becomes the leader. [[GH-17476](https://github.com/hashicorp/nomad/issues/17476)] +* scheduler: Fixed a panic when a node has only one configured dynamic port [[GH-17619](https://github.com/hashicorp/nomad/issues/17619)] +* tls: Fixed a bug where the `nomad tls cert` command did not create certificates with the correct SANs for them to work with non default domain and region names. [[GH-16959](https://github.com/hashicorp/nomad/issues/16959)] +* ui: dont show a service as healthy when its parent allocation stops running [[GH-17465](https://github.com/hashicorp/nomad/issues/17465)] +* ui: fix a mirage-only issue where our mock token logs repeated unnecessarily [[GH-17010](https://github.com/hashicorp/nomad/issues/17010)] +* ui: fixed a handful of UX-related bugs during variable editing [[GH-17319](https://github.com/hashicorp/nomad/issues/17319)] +* ui: fixes an issue where the allocations table on child (periodic, parameterized) job pages wouldn't update when accessed via their parent [[GH-17214](https://github.com/hashicorp/nomad/issues/17214)] +* ui: preserve newlines when displaying shown variables in non-json mode [[GH-17343](https://github.com/hashicorp/nomad/issues/17343)] + ## 1.5.17 (April 16, 2024) SECURITY: diff --git a/CHANGELOG.md b/CHANGELOG.md index 6966b42cf3a..2481b9f5bc8 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,37 +1,12 @@ ## 1.9.1 (October 21, 2024) -BREAKING CHANGES: - -* heartbeats: clients older than 1.6.0 will fail heartbeats to 1.9.0+ servers [[GH-23838](https://github.com/hashicorp/nomad/issues/23838)] -* jobspec: Removed support for HCLv1 [[GH-23912](https://github.com/hashicorp/nomad/issues/23912)] -* services: Clients older than 1.5.0 will fail to read Nomad native services via template blocks [[GH-23910](https://github.com/hashicorp/nomad/issues/23910)] -* tls: Removed deprecated `tls.prefer_server_cipher_suites` field from agent configuration [[GH-23712](https://github.com/hashicorp/nomad/issues/23712)] - -SECURITY: - -* security: Fixed a bug in client FS API where the check to prevent reads from the secrets dir could be bypassed on case-insensitive file systems [[GH-24125](https://github.com/hashicorp/nomad/issues/24125)] - IMPROVEMENTS: -* cli: Added redaction options to operator snapshot commands [[GH-24023](https://github.com/hashicorp/nomad/issues/24023)] * cli: Added synopsis for `operator root` and `operator gossip` command [[GH-23671](https://github.com/hashicorp/nomad/issues/23671)] -* cli: Increase default log level and duration when capturing logs with `operator debug` [[GH-23850](https://github.com/hashicorp/nomad/issues/23850)] * cli: Updated example job specifications in nomad job init [[GH-24232](https://github.com/hashicorp/nomad/issues/24232)] -* deps: Upgraded yamux to v0.1.2 to fix a bug where RPC connections could deadlock [[GH-24058](https://github.com/hashicorp/nomad/issues/24058)] -* docker: Use official docker SDK instead of a 3rd party client [[GH-23966](https://github.com/hashicorp/nomad/issues/23966)] -* identity: Added filepath parameter to identity block for persisting workload identities [[GH-24038](https://github.com/hashicorp/nomad/issues/24038)] -* jobs: Added Version Tags to job versions, to prevent them from being garbage collected and allow for diffs [[GH-24055](https://github.com/hashicorp/nomad/issues/24055)] -* keyring: Stored wrapped data encryption keys in Raft [[GH-23977](https://github.com/hashicorp/nomad/issues/23977)] -* metrics: introduce client config to include alloc metadata as part of the base labels [[GH-23964](https://github.com/hashicorp/nomad/issues/23964)] -* networking: Added an option to ignore static port collisions when scheduling, for programs that use the SO_REUSEPORT unix socket option [[GH-23956](https://github.com/hashicorp/nomad/issues/23956)] -* networking: IPv6 can now be enabled on the Nomad bridge network mode [[GH-23882](https://github.com/hashicorp/nomad/issues/23882)] -* quotas (Enterprise): Added the possibility to set device count limits [[GH-23894](https://github.com/hashicorp/nomad/issues/23894)] -* raft: Bump raft to v1.7.1 which includes pre-vote. This should make servers more stable after network partitions [[GH-24029](https://github.com/hashicorp/nomad/issues/24029)] BUG FIXES: -* bug: Allow client template config block to be parsed when using json config [[GH-24007](https://github.com/hashicorp/nomad/issues/24007)] -* cli: Fixed a bug in job status command where -t would act as though -json was also set [[GH-24054](https://github.com/hashicorp/nomad/issues/24054)] * consul: Fixed a bug where broken Consul ACL tokens could block registration and deregistration of services and checks [[GH-24166](https://github.com/hashicorp/nomad/issues/24166)] * consul: Fixed a bug where service deregistration could fail because Consul ACL tokens were revoked during allocation GC [[GH-24166](https://github.com/hashicorp/nomad/issues/24166)] * docker: Always negotiate API version when initializing clients [[GH-24237](https://github.com/hashicorp/nomad/issues/24237)] @@ -40,17 +15,12 @@ BUG FIXES: * docker: Fixed a bug where alloc exec with stdin would hang [[GH-24202](https://github.com/hashicorp/nomad/issues/24202)] * docker: Fixed a bug where task CPU stats were reported incorrectly [[GH-24229](https://github.com/hashicorp/nomad/issues/24229)] * heartbeat: Fixed a bug where failed nodes would not be marked down [[GH-24241](https://github.com/hashicorp/nomad/issues/24241)] -* scaling: Fixed a bug where scaling policies would not get created during job submission unless namespace field was set in jobspec [[GH-24065](https://github.com/hashicorp/nomad/issues/24065)] * scheduler: fixes reconnecting allocations not getting picked correctly when replacements failed [[GH-24165](https://github.com/hashicorp/nomad/issues/24165)] -* state: Fixed a bug where compatibility updates for node topology for nodes older than 1.7.0 were not being correctly applied [[GH-24127](https://github.com/hashicorp/nomad/issues/24127)] -* task: adds node.pool attribute to interpretable values in task env [[GH-24052](https://github.com/hashicorp/nomad/issues/24052)] -* template: Fixed a panic on client restart when using change_mode=script [[GH-24057](https://github.com/hashicorp/nomad/issues/24057)] * ui: Fix an issue where a dropdown on the variables page would appear underneath table headers [[GH-24162](https://github.com/hashicorp/nomad/issues/24162)] -* ui: Fixes an issue where variables paths would not let namespaced users write variables unless they also had wildcard namespace variable write permissions [[GH-24073](https://github.com/hashicorp/nomad/issues/24073)] * ui: Put a max-width on token name so it doesn't collide with the search box in the top nav [[GH-24240](https://github.com/hashicorp/nomad/issues/24240)] * windows: Fixed a bug where a crashed executor would orphan task processes [[GH-24214](https://github.com/hashicorp/nomad/issues/24214)] -## 1.9.1 (October 21, 2024) +## 1.9.0 (October 10, 2024) BREAKING CHANGES: @@ -66,9 +36,7 @@ SECURITY: IMPROVEMENTS: * cli: Added redaction options to operator snapshot commands [[GH-24023](https://github.com/hashicorp/nomad/issues/24023)] -* cli: Added synopsis for `operator root` and `operator gossip` command [[GH-23671](https://github.com/hashicorp/nomad/issues/23671)] * cli: Increase default log level and duration when capturing logs with `operator debug` [[GH-23850](https://github.com/hashicorp/nomad/issues/23850)] -* cli: Updated example job specifications in nomad job init [[GH-24232](https://github.com/hashicorp/nomad/issues/24232)] * deps: Upgraded yamux to v0.1.2 to fix a bug where RPC connections could deadlock [[GH-24058](https://github.com/hashicorp/nomad/issues/24058)] * docker: Use official docker SDK instead of a 3rd party client [[GH-23966](https://github.com/hashicorp/nomad/issues/23966)] * identity: Added filepath parameter to identity block for persisting workload identities [[GH-24038](https://github.com/hashicorp/nomad/issues/24038)] @@ -84,32 +52,27 @@ BUG FIXES: * bug: Allow client template config block to be parsed when using json config [[GH-24007](https://github.com/hashicorp/nomad/issues/24007)] * cli: Fixed a bug in job status command where -t would act as though -json was also set [[GH-24054](https://github.com/hashicorp/nomad/issues/24054)] -* consul: Fixed a bug where broken Consul ACL tokens could block registration and deregistration of services and checks [[GH-24166](https://github.com/hashicorp/nomad/issues/24166)] -* consul: Fixed a bug where service deregistration could fail because Consul ACL tokens were revoked during allocation GC [[GH-24166](https://github.com/hashicorp/nomad/issues/24166)] -* docker: Always negotiate API version when initializing clients [[GH-24237](https://github.com/hashicorp/nomad/issues/24237)] -* docker: Fix incorrect auth parsing for private registries [[GH-24215](https://github.com/hashicorp/nomad/issues/24215)] -* docker: Fixed a bug where alloc exec could leak a goroutine [[GH-24244](https://github.com/hashicorp/nomad/issues/24244)] -* docker: Fixed a bug where alloc exec with stdin would hang [[GH-24202](https://github.com/hashicorp/nomad/issues/24202)] -* docker: Fixed a bug where task CPU stats were reported incorrectly [[GH-24229](https://github.com/hashicorp/nomad/issues/24229)] -* heartbeat: Fixed a bug where failed nodes would not be marked down [[GH-24241](https://github.com/hashicorp/nomad/issues/24241)] * scaling: Fixed a bug where scaling policies would not get created during job submission unless namespace field was set in jobspec [[GH-24065](https://github.com/hashicorp/nomad/issues/24065)] -* scheduler: fixes reconnecting allocations not getting picked correctly when replacements failed [[GH-24165](https://github.com/hashicorp/nomad/issues/24165)] * state: Fixed a bug where compatibility updates for node topology for nodes older than 1.7.0 were not being correctly applied [[GH-24127](https://github.com/hashicorp/nomad/issues/24127)] * task: adds node.pool attribute to interpretable values in task env [[GH-24052](https://github.com/hashicorp/nomad/issues/24052)] * template: Fixed a panic on client restart when using change_mode=script [[GH-24057](https://github.com/hashicorp/nomad/issues/24057)] -* ui: Fix an issue where a dropdown on the variables page would appear underneath table headers [[GH-24162](https://github.com/hashicorp/nomad/issues/24162)] * ui: Fixes an issue where variables paths would not let namespaced users write variables unless they also had wildcard namespace variable write permissions [[GH-24073](https://github.com/hashicorp/nomad/issues/24073)] -* ui: Put a max-width on token name so it doesn't collide with the search box in the top nav [[GH-24240](https://github.com/hashicorp/nomad/issues/24240)] -* windows: Fixed a bug where a crashed executor would orphan task processes [[GH-24214](https://github.com/hashicorp/nomad/issues/24214)] -## 1.9.0 (October 10, 2024) +## 1.8.6 Enterprise(October 21, 2024) -BREAKING CHANGES: +IMPROVEMENTS: -* heartbeats: clients older than 1.6.0 will fail heartbeats to 1.9.0+ servers [[GH-23838](https://github.com/hashicorp/nomad/issues/23838)] -* jobspec: Removed support for HCLv1 [[GH-23912](https://github.com/hashicorp/nomad/issues/23912)] -* services: Clients older than 1.5.0 will fail to read Nomad native services via template blocks [[GH-23910](https://github.com/hashicorp/nomad/issues/23910)] -* tls: Removed deprecated `tls.prefer_server_cipher_suites` field from agent configuration [[GH-23712](https://github.com/hashicorp/nomad/issues/23712)] +* cli: Added synopsis for `operator root` and `operator gossip` command [[GH-23671](https://github.com/hashicorp/nomad/issues/23671)] + +BUG FIXES: + +* consul: Fixed a bug where broken Consul ACL tokens could block registration and deregistration of services and checks [[GH-24166](https://github.com/hashicorp/nomad/issues/24166)] +* consul: Fixed a bug where service deregistration could fail because Consul ACL tokens were revoked during allocation GC [[GH-24166](https://github.com/hashicorp/nomad/issues/24166)] +* deps: Fixed a bug where restarting Nomad could cause an unrelated process with the same PID as a failed executor to be killed [[GH-24265](https://github.com/hashicorp/nomad/issues/24265)] +* scheduler: fixes reconnecting allocations not getting picked correctly when replacements failed [[GH-24165](https://github.com/hashicorp/nomad/issues/24165)] +* windows: Fixed a bug where a crashed executor would orphan task processes [[GH-24214](https://github.com/hashicorp/nomad/issues/24214)] + +## 1.8.5 Enterprise (October 10, 2024) SECURITY: @@ -117,28 +80,17 @@ SECURITY: IMPROVEMENTS: -* cli: Added redaction options to operator snapshot commands [[GH-24023](https://github.com/hashicorp/nomad/issues/24023)] * cli: Increase default log level and duration when capturing logs with `operator debug` [[GH-23850](https://github.com/hashicorp/nomad/issues/23850)] -* deps: Upgraded yamux to v0.1.2 to fix a bug where RPC connections could deadlock [[GH-24058](https://github.com/hashicorp/nomad/issues/24058)] -* docker: Use official docker SDK instead of a 3rd party client [[GH-23966](https://github.com/hashicorp/nomad/issues/23966)] -* identity: Added filepath parameter to identity block for persisting workload identities [[GH-24038](https://github.com/hashicorp/nomad/issues/24038)] -* jobs: Added Version Tags to job versions, to prevent them from being garbage collected and allow for diffs [[GH-24055](https://github.com/hashicorp/nomad/issues/24055)] -* keyring: Stored wrapped data encryption keys in Raft [[GH-23977](https://github.com/hashicorp/nomad/issues/23977)] -* metrics: introduce client config to include alloc metadata as part of the base labels [[GH-23964](https://github.com/hashicorp/nomad/issues/23964)] -* networking: Added an option to ignore static port collisions when scheduling, for programs that use the SO_REUSEPORT unix socket option [[GH-23956](https://github.com/hashicorp/nomad/issues/23956)] -* networking: IPv6 can now be enabled on the Nomad bridge network mode [[GH-23882](https://github.com/hashicorp/nomad/issues/23882)] -* quotas (Enterprise): Added the possibility to set device count limits [[GH-23894](https://github.com/hashicorp/nomad/issues/23894)] -* raft: Bump raft to v1.7.1 which includes pre-vote. This should make servers more stable after network partitions [[GH-24029](https://github.com/hashicorp/nomad/issues/24029)] BUG FIXES: * bug: Allow client template config block to be parsed when using json config [[GH-24007](https://github.com/hashicorp/nomad/issues/24007)] * cli: Fixed a bug in job status command where -t would act as though -json was also set [[GH-24054](https://github.com/hashicorp/nomad/issues/24054)] +* licensing: Fixed a bug where environment variable to opt-out of reporting was not respected * scaling: Fixed a bug where scaling policies would not get created during job submission unless namespace field was set in jobspec [[GH-24065](https://github.com/hashicorp/nomad/issues/24065)] * state: Fixed a bug where compatibility updates for node topology for nodes older than 1.7.0 were not being correctly applied [[GH-24127](https://github.com/hashicorp/nomad/issues/24127)] * task: adds node.pool attribute to interpretable values in task env [[GH-24052](https://github.com/hashicorp/nomad/issues/24052)] * template: Fixed a panic on client restart when using change_mode=script [[GH-24057](https://github.com/hashicorp/nomad/issues/24057)] -* ui: Fixes an issue where variables paths would not let namespaced users write variables unless they also had wildcard namespace variable write permissions [[GH-24073](https://github.com/hashicorp/nomad/issues/24073)] ## 1.8.4 (September 17, 2024) @@ -342,6 +294,35 @@ BUG FIXES: * ui: Show the namespace in the web UI exec command hint [[GH-20218](https://github.com/hashicorp/nomad/issues/20218)] * windows: Fixed a regression where scanning task processes was inefficient [[GH-20619](https://github.com/hashicorp/nomad/issues/20619)] +## 1.7.14 Enterprise (October 21, 2024) + +IMPROVEMENTS: + +* cli: Added synopsis for `operator root` and `operator gossip` command [[GH-23671](https://github.com/hashicorp/nomad/issues/23671)] + +BUG FIXES: + +* consul: Fixed a bug where broken Consul ACL tokens could block registration and deregistration of services and checks [[GH-24166](https://github.com/hashicorp/nomad/issues/24166)] +* consul: Fixed a bug where service deregistration could fail because Consul ACL tokens were revoked during allocation GC [[GH-24166](https://github.com/hashicorp/nomad/issues/24166)] +* plugins: Fix panic on systems that don't support NUMA [[GH-23399](https://github.com/hashicorp/nomad/issues/23399)] +* scheduler: fixes reconnecting allocations not getting picked correctly when replacements failed [[GH-24165](https://github.com/hashicorp/nomad/issues/24165)] +* windows: Fixed a bug where a crashed executor would orphan task processes [[GH-24214](https://github.com/hashicorp/nomad/issues/24214)] + +## 1.7.13 Enterprise (October 10, 2024) + +SECURITY: + +* security: Fixed a bug in client FS API where the check to prevent reads from the secrets dir could be bypassed on case-insensitive file systems [[GH-24125](https://github.com/hashicorp/nomad/issues/24125)] + +BUG FIXES: + +* bug: Allow client template config block to be parsed when using json config [[GH-24007](https://github.com/hashicorp/nomad/issues/24007)] +* cli: Fixed a bug in job status command where -t would act as though -json was also set [[GH-24054](https://github.com/hashicorp/nomad/issues/24054)] +* licensing: Fixed a bug where environment variable to opt-out of reporting was not respected +* scaling: Fixed a bug where scaling policies would not get created during job submission unless namespace field was set in jobspec [[GH-24065](https://github.com/hashicorp/nomad/issues/24065)] +* state: Fixed a bug where compatibility updates for node topology for nodes older than 1.7.0 were not being correctly applied [[GH-24127](https://github.com/hashicorp/nomad/issues/24127)] +* template: Fixed a panic on client restart when using change_mode=script [[GH-24057](https://github.com/hashicorp/nomad/issues/24057)] + ## 1.7.12 Enterprise (September 17, 2024) BREAKING CHANGES: @@ -703,415 +684,6 @@ BUG FIXES: * vault: Fixed a bug where poststop tasks would not get a Vault token [[GH-19268](https://github.com/hashicorp/nomad/issues/19268)] * vault: Fixed an issue that could cause Nomad to attempt to renew a Vault token that is already expired [[GH-18985](https://github.com/hashicorp/nomad/issues/18985)] -## 1.6.15 Enterprise (September 17, 2024) - -BREAKING CHANGES: - -* docker: The default infra_image for pause containers is now registry.k8s.io/pause [[GH-23927](https://github.com/hashicorp/nomad/issues/23927)] - -IMPROVEMENTS: - -* build: update to go1.22.6 [[GH-23805](https://github.com/hashicorp/nomad/issues/23805)] -* cli: Increase default log level and duration when capturing logs with `operator debug` [[GH-23850](https://github.com/hashicorp/nomad/issues/23850)] - -BUG FIXES: - -* node: Fixed bug where sysbatch allocations were started prematurely [[GH-23858](https://github.com/hashicorp/nomad/issues/23858)] - -## 1.6.14 Enterprise (August 13, 2024) - -SECURITY: - -* security: Fix symlink escape during unarchiving by removing existing paths within the same allocdir. Compromising the Nomad client agent at the source allocation first is a prerequisite for leveraging this issue. [[GH-23738](https://github.com/hashicorp/nomad/issues/23738)] - -IMPROVEMENTS: - -* keyring: Added support for prepublishing keys [[GH-23577](https://github.com/hashicorp/nomad/issues/23577)] - -BUG FIXES: - -* cni: .conf and .json config files are now parsed properly [[GH-23629](https://github.com/hashicorp/nomad/issues/23629)] -* docker: Fixed a bug where plugin SELinux labels would conflict with read-only `volume` options [[GH-23750](https://github.com/hashicorp/nomad/issues/23750)] -* keyring: Fixed a bug where keys could be garbage collected before workload identities expire [[GH-23577](https://github.com/hashicorp/nomad/issues/23577)] -* keyring: Fixed a bug where keys would never exit the "rekeying" state after a rotation with the `-full` flag [[GH-23577](https://github.com/hashicorp/nomad/issues/23577)] -* keyring: Fixed a bug where periodic key rotation would not occur [[GH-23577](https://github.com/hashicorp/nomad/issues/23577)] -* networking: The same static port can now be used more than once on host networks with multiple IPs [[GH-23693](https://github.com/hashicorp/nomad/issues/23693)] -* scaling: Fixed a bug where state store corruption could occur when writing scaling events [[GH-23673](https://github.com/hashicorp/nomad/issues/23673)] -* template: Fixed a bug where change_mode = "script" would not execute after a client restart [[GH-23663](https://github.com/hashicorp/nomad/issues/23663)] -* windows: Fix bug with containers capabilities on Docker CE [[GH-23599](https://github.com/hashicorp/nomad/issues/23599)] - -## 1.6.13 Enterprise (July 16, 2024) - -BREAKING CHANGES: - -* docker: default to hyper-v isolation mode on Windows [[GH-23452](https://github.com/hashicorp/nomad/issues/23452)] - -SECURITY: - -* build: Updated Go to 1.22.5 to address CVE-2024-24791 [[GH-23498](https://github.com/hashicorp/nomad/issues/23498)] -* migration: Added a check for relative paths escaping the allocation directory when unpacking archive during migration, to harden clients against compromised peer clients sending malicious archives [[GH-23319](https://github.com/hashicorp/nomad/issues/23319)] -* security: Removed insecure TLS cipher suites: `TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256`, `TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA25` and `TLS_RSA_WITH_AES_128_CBC_SHA256`. [[GH-23551](https://github.com/hashicorp/nomad/issues/23551)] - -IMPROVEMENTS: - -* deps: Updated Consul API to 1.29.1. [[GH-23436](https://github.com/hashicorp/nomad/issues/23436)] -* deps: Updated consul-template to 0.39 to allow admin partition and sameness groups queries. [[GH-23436](https://github.com/hashicorp/nomad/issues/23436)] -* docker: Validate that unprivileged containers aren't running as ContainerAdmin on Windows [[GH-23443](https://github.com/hashicorp/nomad/issues/23443)] - -BUG FIXES: - -* api: Fixed bug where newlines in JobSubmission vars weren't encoded correctly [[GH-23560](https://github.com/hashicorp/nomad/issues/23560)] -* cli: Fixed bug where the `plugin status` command would fail if the plugin ID was a prefix of another plugin ID [[GH-23502](https://github.com/hashicorp/nomad/issues/23502)] -* cli: Fixed bug where the `quota status` and `quota inspect` commands would fail if the quota name was a prefix of another quota name [[GH-23502](https://github.com/hashicorp/nomad/issues/23502)] -* cli: Fixed bug where the `scaling policy info` command would fail if the policy ID was a prefix of another policy ID [[GH-23502](https://github.com/hashicorp/nomad/issues/23502)] -* cli: Fixed bug where the `service info` command would fail if the service name was a prefix of another service name in the same namespace [[GH-23502](https://github.com/hashicorp/nomad/issues/23502)] -* cli: Fixed bug where the `volume deregister`, `volume detach`, and `volume status` commands would fail if the volume ID was a prefix of another volume ID in the same namespace [[GH-23502](https://github.com/hashicorp/nomad/issues/23502)] -* quota (Enterprise): Fixed a bug where a task's resource core count was not translated to CPU MHz and checked against its quota when performing a job plan [[GH-18876](https://github.com/hashicorp/nomad/issues/18876)] -* scheduler: Fix a bug where reserved resources are not calculated correctly [[GH-23386](https://github.com/hashicorp/nomad/issues/23386)] -* server: Fixed a bug where expiring heartbeats for garbage collected nodes could panic the server [[GH-23383](https://github.com/hashicorp/nomad/issues/23383)] -* template: Fix template rendering on Windows [[GH-23432](https://github.com/hashicorp/nomad/issues/23432)] - -## 1.6.12 Enterprise (June 19, 2024) - -SECURITY: - -* build: Updated Go to 1.22.4 to address Go stdlib vulnerabilities CVE-2024-24789 and CVE-2024-24790 [[GH-23172](https://github.com/hashicorp/nomad/issues/23172)] - -IMPROVEMENTS: - -* cli: `operator snapshot inspect` now includes details of data in snapshot [[GH-18372](https://github.com/hashicorp/nomad/issues/18372)] -* docker: Added container_exists_attempts plugin configuration variable [[GH-22419](https://github.com/hashicorp/nomad/issues/22419)] -* exec: Fixed a bug where `exec` driver tasks would fail on older versions of glibc [[GH-23331](https://github.com/hashicorp/nomad/issues/23331)] - -BUG FIXES: - -* acl: Fix plugin policy validation when checking write permissions [[GH-23274](https://github.com/hashicorp/nomad/issues/23274)] -* connect: fix validation with multiple socket paths [[GH-22312](https://github.com/hashicorp/nomad/issues/22312)] -* driver: Fixed a bug where the exec, java, and raw_exec drivers would not configure cgroups to allow access to devices provided by device plugins [[GH-22518](https://github.com/hashicorp/nomad/issues/22518)] -* scheduler: Fixed a bug where rescheduled allocations that could not be placed would later ignore their reschedule policy limits [[GH-12319](https://github.com/hashicorp/nomad/issues/12319)] - -## 1.6.11 Enterprise (May 28, 2024) - -SECURITY: - -* deps: Updated `docker` dependency to 25.0.5 [[GH-20171](https://github.com/hashicorp/nomad/issues/20171)] - -BUG FIXES: - -* cli: Fix handling of scaling jobs which don't generate evals [[GH-20479](https://github.com/hashicorp/nomad/issues/20479)] -* client: terminate old exec task processes before starting new ones, to avoid accidentally leaving running processes in case of an error [[GH-20500](https://github.com/hashicorp/nomad/issues/20500)] -* core: Fix multiple incorrect type conversion for potential overflows [[GH-20553](https://github.com/hashicorp/nomad/issues/20553)] -* csi: Fixed a bug where concurrent mount and unmount operations could unstage volumes needed by another allocation [[GH-20550](https://github.com/hashicorp/nomad/issues/20550)] -* csi: Fixed a bug where plugins would not be deleted on GC if their job updated the plugin ID [[GH-20555](https://github.com/hashicorp/nomad/issues/20555)] -* csi: Fixed a bug where volumes in different namespaces but the same ID would fail to stage on the same client [[GH-20532](https://github.com/hashicorp/nomad/issues/20532)] -* quota (Enterprise): Fixed a bug where quota usage would not be freed if a job was purged -* services: Added retry to Nomad service deregistration RPCs during alloc stop [[GH-20596](https://github.com/hashicorp/nomad/issues/20596)] -* services: Fixed bug where Nomad services might not be deregistered when nodes are marked down or allocations are terminal [[GH-20590](https://github.com/hashicorp/nomad/issues/20590)] -* structs: Fix job canonicalization for array type fields [[GH-20522](https://github.com/hashicorp/nomad/issues/20522)] -* ui: Show the namespace in the web UI exec command hint [[GH-20218](https://github.com/hashicorp/nomad/issues/20218)] - -## 1.6.10 (April 16, 2024) - -SECURITY: - -* artifact: Updated `go-getter` dependency to v1.7.4 to address CVE-2024-3817 [[GH-20391](https://github.com/hashicorp/nomad/issues/20391)] - -BUG FIXES: - -* api: Fixed a bug where `AllocDirStats` field was missing from Read Stats client API [[GH-20261](https://github.com/hashicorp/nomad/issues/20261)] -* cli: Fixed a bug where `operator debug` did not respect the `-pprof-interval` flag and would take only one profile [[GH-20206](https://github.com/hashicorp/nomad/issues/20206)] -* cni: Fixed a regression where default DNS set by `dockerd` or other task drivers was not respected [[GH-20189](https://github.com/hashicorp/nomad/issues/20189)] -* config: Fixed a bug where IPv6 addresses were not accepted without ports for `client.servers` blocks [[GH-20324](https://github.com/hashicorp/nomad/issues/20324)] -* deployments: Fixed a goroutine leak when jobs are purged [[GH-20348](https://github.com/hashicorp/nomad/issues/20348)] -* deps: Updated consul-template dependency to 0.37.4 to fix a resource leak [[GH-20234](https://github.com/hashicorp/nomad/issues/20234)] -* drain: Fixed a bug where Workload Identity tokens could not be used to drain a node [[GH-20317](https://github.com/hashicorp/nomad/issues/20317)] -* namespace/node pool: Fixed a bug where the `-region` flag would not be respected for namespace and node pool updates if ACLs were disabled [[GH-20220](https://github.com/hashicorp/nomad/issues/20220)] -* state: Fixed a bug where restarting a server could fail if the Raft logs include a drain update that used a now-expired token [[GH-20317](https://github.com/hashicorp/nomad/issues/20317)] -* template: Fixed a bug where a partial `client.template` block would cause defaults for unspecified fields to be ignored [[GH-20165](https://github.com/hashicorp/nomad/issues/20165)] -* ui: Fix an issue where the job status box would error if an allocation had no task events [[GH-20383](https://github.com/hashicorp/nomad/issues/20383)] - -## 1.6.9 (March 12, 2024) - -SECURITY: - -* build: Update to go1.22 to address Go standard library vulnerabilities CVE-2024-24783, CVE-2023-45290, and CVE-2024-24785. [[GH-20066](https://github.com/hashicorp/nomad/issues/20066)] -* deps: Upgrade protobuf library to 1.33.0 to avoid scan alerts for CVE-2024-24786, which Nomad is not vulnerable to [[GH-20100](https://github.com/hashicorp/nomad/issues/20100)] - -BUG FIXES: - -* cli: Fixed a bug where the `nomad job restart` command could crash if the job type was not present in a response from the server [[GH-20049](https://github.com/hashicorp/nomad/issues/20049)] -* client: Fixed a bug where corrupt client state could panic the client [[GH-19972](https://github.com/hashicorp/nomad/issues/19972)] -* cni: Fixed a bug where DNS set by CNI plugins was not provided to task drivers [[GH-20007](https://github.com/hashicorp/nomad/issues/20007)] -* connect: Fixed a bug where `expose` blocks would not appear in `job plan` diff output [[GH-19990](https://github.com/hashicorp/nomad/issues/19990)] - -## 1.6.8 (February 13, 2024) - -SECURITY: - -* windows: Remove `LazyDLL` calls for system modules to harden Nomad against attacks from the host [[GH-19925](https://github.com/hashicorp/nomad/issues/19925)] - -BUG FIXES: - -* cli: Fix return code when `nomad job run` succeeds after a blocked eval [[GH-19876](https://github.com/hashicorp/nomad/issues/19876)] -* cli: Fixed a bug where the `nomad tls ca create` command failed when the `-domain` was used without other values [[GH-19892](https://github.com/hashicorp/nomad/issues/19892)] -* connect: Fixed envoy sidecars being unable to restart after node reboots [[GH-19787](https://github.com/hashicorp/nomad/issues/19787)] -* exec: Fixed a bug in `alloc exec` where closing websocket streams could cause a panic [[GH-19932](https://github.com/hashicorp/nomad/issues/19932)] -* scheduler: Fixed a bug that caused blocked evaluations due to port conflict to not have a reason explaining why the evaluation was blocked [[GH-19933](https://github.com/hashicorp/nomad/issues/19933)] -* ui: Fix an issue where a same-named task from a different group could be selected when the user clicks Exec from a task group page where multiple allocations would be valid [[GH-19878](https://github.com/hashicorp/nomad/issues/19878)] - -## 1.6.7 (February 08, 2024) - -SECURITY: - -* deps: Updated runc to 1.1.12 to address CVE-2024-21626 [[GH-19851](https://github.com/hashicorp/nomad/issues/19851)] -* migration: Fixed a bug where archives used for migration were not checked for symlinks that escaped the allocation directory [[GH-19887](https://github.com/hashicorp/nomad/issues/19887)] -* template: Fixed a bug where symlinks could force templates to read and write to arbitrary locations (CVE-2024-1329) [[GH-19888](https://github.com/hashicorp/nomad/issues/19888)] - -## 1.6.6 (January 15, 2024) - -IMPROVEMENTS: - -* build: update to go 1.21.6 [[GH-19709](https://github.com/hashicorp/nomad/issues/19709)] - -BUG FIXES: - -* acl: Fixed auth method hashing which meant changing some fields would be silently ignored [[GH-19677](https://github.com/hashicorp/nomad/issues/19677)] -* auth: Added new optional OIDCDisableUserInfo setting for OIDC auth provider [[GH-19566](https://github.com/hashicorp/nomad/issues/19566)] -* core: Ensure job HCL submission data is persisted and restored during the FSM snapshot process [[GH-19605](https://github.com/hashicorp/nomad/issues/19605)] -* namespaces: Failed delete calls no longer return success codes [[GH-19483](https://github.com/hashicorp/nomad/issues/19483)] -* server: Fix server not waiting for workers to submit nacks for dequeued evaluations before shutting down [[GH-19560](https://github.com/hashicorp/nomad/issues/19560)] -* state: Fixed a bug where purged jobs would not get new deployments [[GH-19609](https://github.com/hashicorp/nomad/issues/19609)] - -## 1.6.5 (December 13, 2023) - -BUG FIXES: - -* cli: Fix a bug in the `var put` command which prevented combining items as CLI arguments and other parameters as flags [[GH-19423](https://github.com/hashicorp/nomad/issues/19423)] -* client: remove incomplete allocation entries from client state database during client restarts [[GH-16638](https://github.com/hashicorp/nomad/issues/16638)] -* connect: Fixed a bug where deployments would not wait for Connect sidecar task health checks to pass [[GH-19334](https://github.com/hashicorp/nomad/issues/19334)] -* consul: uses token namespace to fetch policies for verification [[GH-18516](https://github.com/hashicorp/nomad/issues/18516)] -* csi: Added validation to `csi_plugin` blocks to prevent `stage_publish_base_dir` from being a subdirectory of `mount_dir` [[GH-19441](https://github.com/hashicorp/nomad/issues/19441)] -* metrics: Revert upgrade of `go-metrics` to fix an issue where metrics from dependencies, such as raft, were no longer emitted [[GH-19375](https://github.com/hashicorp/nomad/issues/19375)] - -## 1.6.4 (December 07, 2023) - -BREAKING CHANGES: - -* core: Honor job's namespace when checking `distinct_hosts` feasibility [[GH-19004](https://github.com/hashicorp/nomad/issues/19004)] - -SECURITY: - -* build: Update to go1.21.4 to resolve Windows path validation CVE in Go [[GH-19013](https://github.com/hashicorp/nomad/issues/19013)] -* build: Update to go1.21.5 to resolve Windows path validation CVE in Go [[GH-19320](https://github.com/hashicorp/nomad/issues/19320)] - -IMPROVEMENTS: - -* cli: Add file prediction for operator raft/snapshot commands [[GH-18901](https://github.com/hashicorp/nomad/issues/18901)] -* ui: color-code node and server status cells [[GH-18318](https://github.com/hashicorp/nomad/issues/18318)] -* ui: show plan output warnings alongside placement failures and dry-run info when running a job through the web ui [[GH-19225](https://github.com/hashicorp/nomad/issues/19225)] - -BUG FIXES: - -* agent: Correct websocket status code handling [[GH-19172](https://github.com/hashicorp/nomad/issues/19172)] -* api: Fix panic in `Allocation.Stub` method when `Job` is unset [[GH-19115](https://github.com/hashicorp/nomad/issues/19115)] -* cli: Fixed a bug that caused the `nomad job restart` command to miscount the allocations to restart [[GH-19155](https://github.com/hashicorp/nomad/issues/19155)] -* cli: Fixed a panic when the `nomad job restart` command received an interrupt signal while waiting for an answer [[GH-19154](https://github.com/hashicorp/nomad/issues/19154)] -* cli: Fixed the `nomad job restart` command to create replacements for batch and system jobs and to prevent sysbatch jobs from being rescheduled since they never create replacements [[GH-19147](https://github.com/hashicorp/nomad/issues/19147)] -* client: Fixed a bug where client API calls would fail incorrectly with permission denied errors when using ACL tokens with dangling policies [[GH-18972](https://github.com/hashicorp/nomad/issues/18972)] -* core: Fix incorrect submit time for stopped jobs [[GH-18967](https://github.com/hashicorp/nomad/issues/18967)] -* ui: Fixed an issue where purging a job with a namespace did not process correctly [[GH-19139](https://github.com/hashicorp/nomad/issues/19139)] -* ui: fix an issue where starting a stopped job with default-less variables would not retain those variables when done via the job page start button in the web ui [[GH-19220](https://github.com/hashicorp/nomad/issues/19220)] -* ui: fix the job auto-linked variable path name when user lacks variable write permissions [[GH-18598](https://github.com/hashicorp/nomad/issues/18598)] -* variables: Fixed a bug where poststop tasks were not allowed access to Variables [[GH-19270](https://github.com/hashicorp/nomad/issues/19270)] -* vault: Fixed a bug where poststop tasks would not get a Vault token [[GH-19268](https://github.com/hashicorp/nomad/issues/19268)] -* vault: Fixed an issue that could cause Nomad to attempt to renew a Vault token that is already expired [[GH-18985](https://github.com/hashicorp/nomad/issues/18985)] - -## 1.6.3 (October 30, 2023) - -SECURITY: - -* build: Update to Go 1.21.3 [[GH-18717](https://github.com/hashicorp/nomad/issues/18717)] - -IMPROVEMENTS: - -* agent: Added config option to enable file and line log detail [[GH-18768](https://github.com/hashicorp/nomad/issues/18768)] -* api: Added support for the `log_include_location` query parameter within the -`/v1/agent/monitor` HTTP endpoint [[GH-18795](https://github.com/hashicorp/nomad/issues/18795)] -* cli: Add `-prune` flag to `nomad operator force-leave` command [[GH-18463](https://github.com/hashicorp/nomad/issues/18463)] -* cli: Added `log-include-location` flag to the `monitor` command [[GH-18795](https://github.com/hashicorp/nomad/issues/18795)] -* cli: Added `log-include-location` flag to the `operator debug` command [[GH-18795](https://github.com/hashicorp/nomad/issues/18795)] -* csi: add ability to expand the size of volumes for plugins that support it [[GH-18359](https://github.com/hashicorp/nomad/issues/18359)] -* template: reduce memory usage associated with communicating with the Nomad API [[GH-18524](https://github.com/hashicorp/nomad/issues/18524)] -* ui: observe a token's roles' rules in the UI and add an interface for managing tokens, roles, and policies [[GH-17770](https://github.com/hashicorp/nomad/issues/17770)] - -BUG FIXES: - -* build: Add `timetzdata` Go build tag on Windows binaries to embed time zone data so periodic jobs are able to specify a time zone value on Windows environments [[GH-18676](https://github.com/hashicorp/nomad/issues/18676)] -* cli: Fixed an unexpected behavior of the `nomad acl token update` command that could cause a management token to be downgraded to client on update [[GH-18689](https://github.com/hashicorp/nomad/issues/18689)] -* cli: Use same offset when following single or multiple alloc logs [[GH-18604](https://github.com/hashicorp/nomad/issues/18604)] -* cli: ensure HCL env vars are added to the job submission object in the `job run` command [[GH-18832](https://github.com/hashicorp/nomad/issues/18832)] -* client: ensure null dynamic node metadata values are removed from memory [[GH-18664](https://github.com/hashicorp/nomad/issues/18664)] -* client: prevent tasks from starting without the prestart hooks running [[GH-18662](https://github.com/hashicorp/nomad/issues/18662)] -* metrics: Fixed a bug where CPU counters could report errors for negative values [[GH-18835](https://github.com/hashicorp/nomad/issues/18835)] -* scaling: Unblock blocking queries to /v1/job/{job-id}/scale if the job goes away [[GH-18637](https://github.com/hashicorp/nomad/issues/18637)] -* scheduler (Enterprise): auto-unblock evals with associated quotas when node resources are freed up [[GH-18838](https://github.com/hashicorp/nomad/issues/18838)] -* scheduler: Ensure duplicate allocation indexes are tracked and fixed when performing job updates [[GH-18873](https://github.com/hashicorp/nomad/issues/18873)] -* server: Fixed a bug where Raft server configuration parameters were not correctly merged [[GH-18494](https://github.com/hashicorp/nomad/issues/18494)] -* services: use interpolated address when performing nomad service health checks [[GH-18584](https://github.com/hashicorp/nomad/issues/18584)] -* ui: using start/stop from the job page in the UI will no longer fail when the job lacks HCL submission data [[GH-18621](https://github.com/hashicorp/nomad/issues/18621)] - -## 1.6.2 (September 13, 2023) - -IMPROVEMENTS: - -* build: Update to Go 1.21.0 [[GH-18184](https://github.com/hashicorp/nomad/issues/18184)] -* cli: support wildcard namespaces in alloc subcommands when the `-job` flag is used [[GH-18095](https://github.com/hashicorp/nomad/issues/18095)] -* config: Added an option to configure how many historic versions of jobs are retained in the state store [[GH-17939](https://github.com/hashicorp/nomad/issues/17939)] -* consul/connect: Added support for `DestinationPeer`, `DestinationType`, `LocalBindSocketPath`, and `LocalBindSocketMode` in upstream block [[GH-16745](https://github.com/hashicorp/nomad/issues/16745)] -* jobspec: Add 'crons' field for multiple `cron` expressions [[GH-17858](https://github.com/hashicorp/nomad/issues/17858)] -* jobspec: Add new parameter `render_templates` for `restart` block to allow explicit re-render of templates on task restart. The default value is `false` and is fully backward compatible [[GH-18054](https://github.com/hashicorp/nomad/issues/18054)] -* jobspec: add `node_pool` as a valid field [[GH-18366](https://github.com/hashicorp/nomad/issues/18366)] -* raft: remove use of deprecated Leader func [[GH-18352](https://github.com/hashicorp/nomad/issues/18352)] -* status: go-getter failure reason now shown in `alloc status` [[GH-18444](https://github.com/hashicorp/nomad/issues/18444)] -* ui: Added configurable content security policy header [[GH-18085](https://github.com/hashicorp/nomad/issues/18085)] -* ui: adds a new Variables page to all job pages [[GH-17964](https://github.com/hashicorp/nomad/issues/17964)] -* ui: adds keyboard commands for pagination on lists using [[ and ]] [[GH-18210](https://github.com/hashicorp/nomad/issues/18210)] -* ui: sort variable key/values alphabetically by key when editing [[GH-18051](https://github.com/hashicorp/nomad/issues/18051)] -* ui: trim variable path names before saving [[GH-18198](https://github.com/hashicorp/nomad/issues/18198)] - -BUG FIXES: - -* acl: Fixed a bug where ACL tokens linked to ACL roles containing duplicate policies would cause erronous permission denined responses [[GH-18419](https://github.com/hashicorp/nomad/issues/18419)] -* cli: Add missing help message for the `-consul-namespace` flag in the `nomad job run` command [[GH-18081](https://github.com/hashicorp/nomad/issues/18081)] -* cli: Fix panic in `alloc logs` command when receiving empty stdout or stderr log frames [[GH-17815](https://github.com/hashicorp/nomad/issues/17815)] -* cli: Fixed a bug that prevented CSI volumes in namespaces other than `default` from being displayed in the `nomad node status -verbose` output [[GH-17925](https://github.com/hashicorp/nomad/issues/17925)] -* cli: Snapshot name is required in `volume snapshot create` command [[GH-17958](https://github.com/hashicorp/nomad/issues/17958)] -* client: Fixed a bug where the state of poststop tasks could be corrupted by client gc [[GH-17971](https://github.com/hashicorp/nomad/issues/17971)] -* client: Ignore stale server updates to prevent GCing allocations that should be running [[GH-18269](https://github.com/hashicorp/nomad/issues/18269)] -* client: return 404 instead of 500 when trying to access logs and files from allocations that have been garbage collected [[GH-18232](https://github.com/hashicorp/nomad/issues/18232)] -* core: Fixed a bug where exponential backoff could result in excessive CPU usage [[GH-18200](https://github.com/hashicorp/nomad/issues/18200)] -* csi: fixed a bug that could case a panic when deleting volumes [[GH-18234](https://github.com/hashicorp/nomad/issues/18234)] -* fingerprint: fix 'default' alias not being added to interface specified by network_interface [[GH-18096](https://github.com/hashicorp/nomad/issues/18096)] -* jobspec: Add diff for Task Group scaling block [[GH-18332](https://github.com/hashicorp/nomad/issues/18332)] -* migration: Fixed a bug where previous alloc logs were destroyed when migrating ephemeral_disk on the same client [[GH-18108](https://github.com/hashicorp/nomad/issues/18108)] -* scheduler: Fixed a bug where device IDs were not correctly filtered in constraints [[GH-18141](https://github.com/hashicorp/nomad/issues/18141)] -* services: Add validation message when `tls_skip_verify` is set to `true` on a Nomad service [[GH-18333](https://github.com/hashicorp/nomad/issues/18333)] -* ui: maintain HCL2 jobspec when using Start Job in the web ui [[GH-18120](https://github.com/hashicorp/nomad/issues/18120)] -* ui: search results are no longer overridden by sorting preferences on the jobs index page [[GH-18053](https://github.com/hashicorp/nomad/issues/18053)] - -## 1.6.1 (July 21, 2023) - -IMPROVEMENTS: - -* cli: Display volume namespace on `nomad volume status` and `nomad node status` output [[GH-17911](https://github.com/hashicorp/nomad/issues/17911)] -* cpustats: Use config "cpu_total_compute" (if set) for all CPU statistics [[GH-17628](https://github.com/hashicorp/nomad/issues/17628)] -* metrics: Add `allocs.memory.max_allocated` to report the value of tasks' `memory_max` resource value [[GH-17938](https://github.com/hashicorp/nomad/issues/17938)] -* ui: added a button to copy variable path to clipboard [[GH-17935](https://github.com/hashicorp/nomad/issues/17935)] -* ui: adds a keyboard shortcut for Create Variable [[GH-17932](https://github.com/hashicorp/nomad/issues/17932)] -* ui: if a job is remotely purged while you're actively on it, it will let you know and re-route you to the index page [[GH-17915](https://github.com/hashicorp/nomad/issues/17915)] -* ui: indicate that nomad/jobs as a variable path is auto-accessible by all nomad jobs [[GH-17933](https://github.com/hashicorp/nomad/issues/17933)] - -BUG FIXES: - -* core: Fixed a bug where namespaces were not canonicalized on snapshot restore, resulting in potential nil access panic [[GH-18017](https://github.com/hashicorp/nomad/issues/18017)] -* csi: Fixed a bug in sending concurrent requests to CSI controller plugins by serializing them per plugin [[GH-17996](https://github.com/hashicorp/nomad/issues/17996)] -* csi: Fixed a bug where CSI controller requests could be sent to unhealthy plugins [[GH-17996](https://github.com/hashicorp/nomad/issues/17996)] -* csi: Fixed a bug where CSI controller requests could not be sent to controllers on nodes ineligible for scheduling [[GH-17996](https://github.com/hashicorp/nomad/issues/17996)] -* services: Fixed a bug that prevented passing query parameters in Nomad native service discovery HTTP health check paths [[GH-17936](https://github.com/hashicorp/nomad/issues/17936)] -* ui: Fixed a bug that could cause an error when accessing a region running versions of Nomad prior to 1.6.0 [[GH-18021](https://github.com/hashicorp/nomad/issues/18021)] -* ui: Fixed a bug that prevented nodes from being filtered by the "Ineligible" and "Draining" state filters [[GH-17940](https://github.com/hashicorp/nomad/issues/17940)] -* ui: Fixed error handling for cross-region requests when the receiving region does not implement the endpoint being requested [[GH-18020](https://github.com/hashicorp/nomad/issues/18020)] - -## 1.6.0 (July 18, 2023) - -FEATURES: - -* **Node Pools**: Allow cluster operators to partition Nomad clients and control which jobs are allowed to run in each pool. [[GH-11041](https://github.com/hashicorp/nomad/issues/11041)] - -BREAKING CHANGES: - -* acl: Job evaluate endpoint now requires `submit-job` instead of `read-job` capability [[GH-16463](https://github.com/hashicorp/nomad/issues/16463)] - -SECURITY: - -* acl: Fixed a bug where a namespace ACL policy without label was applied to an unexpected namespace. [CVE-2023-3072](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3072) [[GH-17908](https://github.com/hashicorp/nomad/issues/17908)] -* search: Fixed a bug where ACL did not filter plugin and variable names in search endpoint. [CVE-2023-3300](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3300) [[GH-17906](https://github.com/hashicorp/nomad/issues/17906)] -* sentinel (Enterprise): Fixed a bug where ACL tokens could be exfiltrated via Sentinel logs [CVE-2023-3299](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2023-3299) [[GH-17907](https://github.com/hashicorp/nomad/issues/17907)] - -IMPROVEMENTS: - -* agent: Display server node ID in agent configuration at startup [[GH-17084](https://github.com/hashicorp/nomad/issues/17084)] -* api: enable support for storing original job source [[GH-16763](https://github.com/hashicorp/nomad/issues/16763)] -* api: return a structured error for unexpected responses [[GH-16743](https://github.com/hashicorp/nomad/issues/16743)] -* build: Publish official Docker images with the Nomad CLI [[GH-17017](https://github.com/hashicorp/nomad/issues/17017)] -* checks: Added support for Consul check field tls_server_name [[GH-17334](https://github.com/hashicorp/nomad/issues/17334)] -* cli: Add `-quiet` flag to `nomad var init` command [[GH-17526](https://github.com/hashicorp/nomad/issues/17526)] -* cli: Add check for missing host volume `path` in `nomad config validate` command [[GH-17393](https://github.com/hashicorp/nomad/issues/17393)] -* cli: Add leader status to output of `nomad server members -json` [[GH-17138](https://github.com/hashicorp/nomad/issues/17138)] -* cli: Add the ability to customize the details of the CA when running `nomad tls ca create` [[GH-17309](https://github.com/hashicorp/nomad/issues/17309)] -* cli: Sort output by Node name of the command `nomad operator raft list-peers` [[GH-16221](https://github.com/hashicorp/nomad/issues/16221)] -* cli: `job plan` help text for running the plan now includes the `-namespace` flag [[GH-16243](https://github.com/hashicorp/nomad/issues/16243)] -* client: check kernel module in `/sys/module` to help with WSL2 bridge networking [[GH-17306](https://github.com/hashicorp/nomad/issues/17306)] -* client: de-duplicate allocation client status updates and prevent allocation client status updates from being sent until clients have first synchronized with the server [[GH-17074](https://github.com/hashicorp/nomad/issues/17074)] -* client: prioritize allocation updates to reduce Raft and RPC load [[GH-17354](https://github.com/hashicorp/nomad/issues/17354)] -* cni: Ensure to setup CNI addresses in deterministic order [[GH-17766](https://github.com/hashicorp/nomad/issues/17766)] -* connect: Auto detect when to use podman for connect sidecar proxies [[GH-17065](https://github.com/hashicorp/nomad/issues/17065)] -* connect: do not restrict automatic envoy versioning to docker driver [[GH-17041](https://github.com/hashicorp/nomad/issues/17041)] -* connect: use full docker.io prefixed name for envoy image references [[GH-17045](https://github.com/hashicorp/nomad/issues/17045)] -* deploymentwatcher: Allow deployments to fail early when running out of reschedule attempts [[GH-17341](https://github.com/hashicorp/nomad/issues/17341)] -* deps: Updated Vault SDK to 0.9.0 [[GH-17281](https://github.com/hashicorp/nomad/issues/17281)] -* deps: Updated consul-template to v0.31.0 [[GH-16908](https://github.com/hashicorp/nomad/issues/16908)] -* deps: update docker to 23.0.3 [[GH-16862](https://github.com/hashicorp/nomad/issues/16862)] -* deps: update github.com/hashicorp/raft from 1.3.11 to 1.5.0 [[GH-17421](https://github.com/hashicorp/nomad/issues/17421)] -* deps: update go.etcd.io/bbolt from 1.3.6 to 1.3.7 [[GH-16228](https://github.com/hashicorp/nomad/issues/16228)] -* docker: Add `group_add` configuration [[GH-17313](https://github.com/hashicorp/nomad/issues/17313)] -* docker: Added option for labeling container with parent job ID of periodic/dispatch jobs [[GH-17843](https://github.com/hashicorp/nomad/issues/17843)] -* drivers: Add `DisableLogCollection` to task driver capabilities interface [[GH-17196](https://github.com/hashicorp/nomad/issues/17196)] -* metrics: add "total_ticks_count" counter for allocs/host CPU usage [[GH-17579](https://github.com/hashicorp/nomad/issues/17579)] -* runtime: Added 'os.build' attribute to node fingerprint on windows os [[GH-17576](https://github.com/hashicorp/nomad/issues/17576)] -* ui: Added a new Job Status Panel that helps show allocation status throughout a deployment and in steady state [[GH-16134](https://github.com/hashicorp/nomad/issues/16134)] -* ui: Adds a Download as .nomad.hcl button to jobspec editing in the UI [[GH-17752](https://github.com/hashicorp/nomad/issues/17752)] -* ui: Job status and deployment redesign [[GH-16932](https://github.com/hashicorp/nomad/issues/16932)] -* ui: Restyles "toast" notifications in the web UI with the Helios Design System [[GH-16099](https://github.com/hashicorp/nomad/issues/16099)] -* ui: add tooltips to the node and datacenter labels in the Topology page [[GH-17647](https://github.com/hashicorp/nomad/issues/17647)] -* ui: adds a toggle and localStorage property to Word Wrap logs and job definitions [[GH-17754](https://github.com/hashicorp/nomad/issues/17754)] -* ui: adds keyboard nav for switching between regions by pressing "r 1", "r 2", etc. [[GH-17169](https://github.com/hashicorp/nomad/issues/17169)] -* ui: affix page header to the top of the browser window to handle browser extension push-down gracefully [[GH-17783](https://github.com/hashicorp/nomad/issues/17783)] -* ui: change token input type from text to password [[GH-17345](https://github.com/hashicorp/nomad/issues/17345)] -* ui: remove namespace, type, and priority columns from child job table [[GH-17645](https://github.com/hashicorp/nomad/issues/17645)] -* vault: Add new configuration `disable_file` to prevent access to the Vault token by tasks that use `image` filesystem isolation [[GH-13343](https://github.com/hashicorp/nomad/issues/13343)] - -DEPRECATIONS: - -* envoy: remove support for envoy fallback image [[GH-17044](https://github.com/hashicorp/nomad/issues/17044)] - -BUG FIXES: - -* api: Fixed a bug that caused a panic when calling the `Jobs().Plan()` function with a job missing an ID [[GH-17689](https://github.com/hashicorp/nomad/issues/17689)] -* api: add missing constant for unknown allocation status [[GH-17726](https://github.com/hashicorp/nomad/issues/17726)] -* api: add missing field NetworkStatus for Allocation [[GH-17280](https://github.com/hashicorp/nomad/issues/17280)] -* cgroups: Fixed a bug removing all DevicesSets when alloc is created/removed [[GH-17535](https://github.com/hashicorp/nomad/issues/17535)] -* cli: Fix a panic in the `nomad job restart` command when monitoring replacement allocations [[GH-17346](https://github.com/hashicorp/nomad/issues/17346)] -* cli: Output error messages during deployment monitoring [[GH-17348](https://github.com/hashicorp/nomad/issues/17348)] -* client: Fixed a bug where Nomad incorrectly wrote to memory swappiness cgroup on old kernels [[GH-17625](https://github.com/hashicorp/nomad/issues/17625)] -* client: Fixed a bug where agent would panic during drain incurred by shutdown [[GH-17450](https://github.com/hashicorp/nomad/issues/17450)] -* client: fixed a bug that prevented Nomad from fingerprinting Consul 1.13.8 correctly [[GH-17349](https://github.com/hashicorp/nomad/issues/17349)] -* consul: Fixed a bug where Nomad would repeatedly try to revoke successfully revoked SI tokens [[GH-17847](https://github.com/hashicorp/nomad/issues/17847)] -* core: Fix panic around client deregistration and pending heartbeats [[GH-17316](https://github.com/hashicorp/nomad/issues/17316)] -* core: fixed a bug that caused job validation to fail when a task with `kill_timeout` was placed inside a group with `update.progress_deadline` set to 0 [[GH-17342](https://github.com/hashicorp/nomad/issues/17342)] -* csi: Fixed a bug where CSI volumes would fail to restore during client restarts [[GH-17840](https://github.com/hashicorp/nomad/issues/17840)] -* docker: Fixed a bug where network pause container would not be removed after node restart [[GH-17455](https://github.com/hashicorp/nomad/issues/17455)] -* drivers/docker: Fixed a bug where long-running docker operations would incorrectly timeout [[GH-17731](https://github.com/hashicorp/nomad/issues/17731)] -* identity: Fixed a bug where workload identities for periodic and dispatch jobs would not have access to their parent job's ACL policy [[GH-17018](https://github.com/hashicorp/nomad/issues/17018)] -* replication: Fix a potential panic when a non-authoritative region is upgraded and a server with the new version becomes the leader. [[GH-17476](https://github.com/hashicorp/nomad/issues/17476)] -* scheduler: Fixed a panic when a node has only one configured dynamic port [[GH-17619](https://github.com/hashicorp/nomad/issues/17619)] -* tls: Fixed a bug where the `nomad tls cert` command did not create certificates with the correct SANs for them to work with non default domain and region names. [[GH-16959](https://github.com/hashicorp/nomad/issues/16959)] -* ui: dont show a service as healthy when its parent allocation stops running [[GH-17465](https://github.com/hashicorp/nomad/issues/17465)] -* ui: fix a mirage-only issue where our mock token logs repeated unnecessarily [[GH-17010](https://github.com/hashicorp/nomad/issues/17010)] -* ui: fixed a handful of UX-related bugs during variable editing [[GH-17319](https://github.com/hashicorp/nomad/issues/17319)] -* ui: fixes an issue where the allocations table on child (periodic, parameterized) job pages wouldn't update when accessed via their parent [[GH-17214](https://github.com/hashicorp/nomad/issues/17214)] -* ui: preserve newlines when displaying shown variables in non-json mode [[GH-17343](https://github.com/hashicorp/nomad/issues/17343)] - ## Unsupported Versions Versions of Nomad before 1.6.0 are no longer supported. See [CHANGELOG-unsupported.md](./CHANGELOG-unsupported.md) for their changelogs. diff --git a/api/allocations.go b/api/allocations.go index f8a3a0aeee9..b35e338c559 100644 --- a/api/allocations.go +++ b/api/allocations.go @@ -547,7 +547,10 @@ type AllocPauseRequest struct { } type AllocGetPauseResponse struct { - // ScheduleState will be one of "pause", "run", "scheduled". + // ScheduleState will be one of "" (run), "force_run", "scheduled_pause", + // "force_pause", or "schedule_resume". + // + // See nomad/structs/task_sched.go for details. ScheduleState string } diff --git a/api/tasks.go b/api/tasks.go index d1a9ee53c90..21d99bf4c2c 100644 --- a/api/tasks.go +++ b/api/tasks.go @@ -864,6 +864,7 @@ type TaskArtifact struct { GetterMode *string `mapstructure:"mode" hcl:"mode,optional"` GetterInsecure *bool `mapstructure:"insecure" hcl:"insecure,optional"` RelativeDest *string `mapstructure:"destination" hcl:"destination,optional"` + Chown bool `mapstructure:"chown" hcl:"chown,optional"` } func (a *TaskArtifact) Canonicalize() { diff --git a/api/tasks_test.go b/api/tasks_test.go index 675e5df998d..f860fa16d04 100644 --- a/api/tasks_test.go +++ b/api/tasks_test.go @@ -321,6 +321,7 @@ func TestTask_Artifact(t *testing.T) { must.Eq(t, "local/foo.txt", filepath.ToSlash(*a.RelativeDest)) must.Nil(t, a.GetterOptions) must.Nil(t, a.GetterHeaders) + must.Eq(t, false, a.Chown) } func TestTask_VolumeMount(t *testing.T) { diff --git a/client/allocrunner/taskrunner/artifact_hook.go b/client/allocrunner/taskrunner/artifact_hook.go index 600328e0126..833b2fc4492 100644 --- a/client/allocrunner/taskrunner/artifact_hook.go +++ b/client/allocrunner/taskrunner/artifact_hook.go @@ -31,7 +31,14 @@ func newArtifactHook(e ti.EventEmitter, getter ci.ArtifactGetter, logger log.Log return h } -func (h *artifactHook) doWork(req *interfaces.TaskPrestartRequest, resp *interfaces.TaskPrestartResponse, jobs chan *structs.TaskArtifact, errorChannel chan error, wg *sync.WaitGroup, responseStateMutex *sync.Mutex) { +func (h *artifactHook) doWork( + req *interfaces.TaskPrestartRequest, + resp *interfaces.TaskPrestartResponse, + jobs chan *structs.TaskArtifact, + errorChannel chan error, + wg *sync.WaitGroup, + responseStateMutex *sync.Mutex, +) { defer wg.Done() for artifact := range jobs { aid := artifact.Hash() @@ -45,7 +52,7 @@ func (h *artifactHook) doWork(req *interfaces.TaskPrestartRequest, resp *interfa h.logger.Debug("downloading artifact", "artifact", artifact.GetterSource, "aid", aid) - if err := h.getter.Get(req.TaskEnv, artifact); err != nil { + if err := h.getter.Get(req.TaskEnv, artifact, req.Task.User); err != nil { wrapped := structs.NewRecoverableError( fmt.Errorf("failed to download artifact %q: %v", artifact.GetterSource, err), true, diff --git a/client/allocrunner/taskrunner/getter/params.go b/client/allocrunner/taskrunner/getter/params.go index f8352556d12..7fd60b3497b 100644 --- a/client/allocrunner/taskrunner/getter/params.go +++ b/client/allocrunner/taskrunner/getter/params.go @@ -45,6 +45,8 @@ type parameters struct { // Task Filesystem AllocDir string `json:"alloc_dir"` TaskDir string `json:"task_dir"` + User string `json:"user"` + Chown bool `json:"chown"` } func (p *parameters) reader() io.Reader { diff --git a/client/allocrunner/taskrunner/getter/params_test.go b/client/allocrunner/taskrunner/getter/params_test.go index 0a11cd44ea1..a7320dd5cdb 100644 --- a/client/allocrunner/taskrunner/getter/params_test.go +++ b/client/allocrunner/taskrunner/getter/params_test.go @@ -39,7 +39,9 @@ const paramsAsJSON = ` "X-Nomad-Artifact": ["hi"] }, "alloc_dir": "/path/to/alloc", - "task_dir": "/path/to/alloc/task" + "task_dir": "/path/to/alloc/task", + "chown": true, + "user":"nobody" }` var paramsAsStruct = ¶meters{ @@ -65,6 +67,8 @@ var paramsAsStruct = ¶meters{ Headers: map[string][]string{ "X-Nomad-Artifact": {"hi"}, }, + User: "nobody", + Chown: true, } func TestParameters_reader(t *testing.T) { diff --git a/client/allocrunner/taskrunner/getter/sandbox.go b/client/allocrunner/taskrunner/getter/sandbox.go index a4855beb801..2d6a1c1c38a 100644 --- a/client/allocrunner/taskrunner/getter/sandbox.go +++ b/client/allocrunner/taskrunner/getter/sandbox.go @@ -24,8 +24,8 @@ type Sandbox struct { ac *config.ArtifactConfig } -func (s *Sandbox) Get(env interfaces.EnvReplacer, artifact *structs.TaskArtifact) error { - s.logger.Debug("get", "source", artifact.GetterSource, "destination", artifact.RelativeDest) +func (s *Sandbox) Get(env interfaces.EnvReplacer, artifact *structs.TaskArtifact, user string) error { + s.logger.Debug("get", "source", artifact.GetterSource, "destination", artifact.RelativeDest, "user", user) source, err := getURL(env, artifact) if err != nil { @@ -66,10 +66,13 @@ func (s *Sandbox) Get(env interfaces.EnvReplacer, artifact *structs.TaskArtifact // task filesystem AllocDir: allocDir, TaskDir: taskDir, + User: user, + Chown: artifact.Chown, } if err = s.runCmd(params); err != nil { return err } + return nil } diff --git a/client/allocrunner/taskrunner/getter/sandbox_test.go b/client/allocrunner/taskrunner/getter/sandbox_test.go index 7906c7668fa..1b09118b726 100644 --- a/client/allocrunner/taskrunner/getter/sandbox_test.go +++ b/client/allocrunner/taskrunner/getter/sandbox_test.go @@ -8,6 +8,7 @@ import ( "net/http/httptest" "os" "path/filepath" + "syscall" "testing" "time" @@ -46,7 +47,7 @@ func TestSandbox_Get_http(t *testing.T) { RelativeDest: "local/downloads", } - err := sbox.Get(env, artifact) + err := sbox.Get(env, artifact, "nobody") must.NoError(t, err) b, err := os.ReadFile(filepath.Join(taskDir, "local", "downloads", "go.mod")) @@ -74,11 +75,37 @@ func TestSandbox_Get_insecure_http(t *testing.T) { RelativeDest: "local/downloads", } - err := sbox.Get(env, artifact) + err := sbox.Get(env, artifact, "nobody") must.Error(t, err) must.StrContains(t, err.Error(), "x509: certificate signed by unknown authority") artifact.GetterInsecure = true - err = sbox.Get(env, artifact) + err = sbox.Get(env, artifact, "nobody") must.NoError(t, err) } + +func TestSandbox_Get_chown(t *testing.T) { + testutil.RequireRoot(t) + logger := testlog.HCLogger(t) + + ac := artifactConfig(10 * time.Second) + sbox := New(ac, logger) + + _, taskDir := SetupDir(t) + env := noopTaskEnv(taskDir) + + artifact := &structs.TaskArtifact{ + GetterSource: "https://raw.githubusercontent.com/hashicorp/go-set/main/go.mod", + RelativeDest: "local/downloads", + Chown: true, + } + + err := sbox.Get(env, artifact, "nobody") + must.NoError(t, err) + + info, err := os.Stat(filepath.Join(taskDir, "local", "downloads")) + must.NoError(t, err) + + uid := info.Sys().(*syscall.Stat_t).Uid + must.Eq(t, 65534, uid) // nobody's conventional uid +} diff --git a/client/allocrunner/taskrunner/getter/util.go b/client/allocrunner/taskrunner/getter/util.go index afe961fe83c..a2a0cd25594 100644 --- a/client/allocrunner/taskrunner/getter/util.go +++ b/client/allocrunner/taskrunner/getter/util.go @@ -11,6 +11,7 @@ import ( "os" "os/exec" "path/filepath" + "runtime" "sort" "strings" "unicode" @@ -18,6 +19,7 @@ import ( "github.com/hashicorp/go-getter" "github.com/hashicorp/nomad/client/interfaces" "github.com/hashicorp/nomad/helper/subproc" + "github.com/hashicorp/nomad/helper/users" "github.com/hashicorp/nomad/nomad/structs" ) @@ -84,6 +86,32 @@ func getMode(artifact *structs.TaskArtifact) getter.ClientMode { } } +func chownDestination(destination, username string) error { + if destination == "" || username == "" { + return nil + } + + if os.Geteuid() != 0 { + return nil + } + + if runtime.GOOS == "windows" { + return nil + } + + uid, gid, _, err := users.LookupUnix(username) + if err != nil { + return err + } + + return filepath.Walk(destination, func(path string, info os.FileInfo, err error) error { + if err != nil { + return err + } + return os.Chown(path, uid, gid) + }) +} + func isInsecure(artifact *structs.TaskArtifact) bool { return artifact.GetterInsecure } diff --git a/client/allocrunner/taskrunner/getter/z_getter_cmd.go b/client/allocrunner/taskrunner/getter/z_getter_cmd.go index 0dae2b67e2f..f5971081553 100644 --- a/client/allocrunner/taskrunner/getter/z_getter_cmd.go +++ b/client/allocrunner/taskrunner/getter/z_getter_cmd.go @@ -51,6 +51,16 @@ func init() { return subproc.ExitFailure } + // chown the resulting artifact to the task user, but only if configured + // to do so in the artifact block (for compatibility) + if env.Chown { + err := chownDestination(env.Destination, env.User) + if err != nil { + subproc.Print("failed to chown artifact: %v", err) + return subproc.ExitFailure + } + } + subproc.Print("artifact download was a success") return subproc.ExitSuccess }) diff --git a/client/fingerprint/env_gce.go b/client/fingerprint/env_gce.go index 108fbde9365..7d773c6bb5e 100644 --- a/client/fingerprint/env_gce.go +++ b/client/fingerprint/env_gce.go @@ -160,6 +160,7 @@ func (f *EnvGCEFingerprint) Fingerprint(req *FingerprintRequest, resp *Fingerpri "cpu-platform": false, "scheduling/automatic-restart": false, "scheduling/on-host-maintenance": false, + "scheduling/preemptible": false, } for k, unique := range keys { diff --git a/client/fingerprint/env_gce_test.go b/client/fingerprint/env_gce_test.go index 7277ad0b46c..b04169bd5c7 100644 --- a/client/fingerprint/env_gce_test.go +++ b/client/fingerprint/env_gce_test.go @@ -148,6 +148,7 @@ func testFingerprint_GCE(t *testing.T, withExternalIp bool) { assertNodeAttributeEquals(t, response.Attributes, "platform.gce.scheduling.automatic-restart", "TRUE") assertNodeAttributeEquals(t, response.Attributes, "platform.gce.scheduling.on-host-maintenance", "MIGRATE") + assertNodeAttributeEquals(t, response.Attributes, "platform.gce.scheduling.preemptible", "FALSE") assertNodeAttributeEquals(t, response.Attributes, "platform.gce.cpu-platform", "Intel Ivy Bridge") assertNodeAttributeEquals(t, response.Attributes, "platform.gce.tag.abc", "true") assertNodeAttributeEquals(t, response.Attributes, "platform.gce.tag.def", "true") @@ -200,6 +201,11 @@ const GCE_routes = ` "content-type": "text/plain", "body": "MIGRATE" }, + { + "uri": "/computeMetadata/v1/instance/scheduling/preemptible", + "content-type": "text/plain", + "body": "FALSE" + }, { "uri": "/computeMetadata/v1/instance/cpu-platform", "content-type": "text/plain", diff --git a/client/interfaces/client.go b/client/interfaces/client.go index 796c52250fa..a5da62cc82e 100644 --- a/client/interfaces/client.go +++ b/client/interfaces/client.go @@ -41,7 +41,7 @@ type EnvReplacer interface { // ArtifactGetter is an interface satisfied by the getter package. type ArtifactGetter interface { // Get artifact and put it in the task directory. - Get(EnvReplacer, *structs.TaskArtifact) error + Get(EnvReplacer, *structs.TaskArtifact, string) error } // ProcessWranglers is an interface satisfied by the proclib package. diff --git a/client/lib/numalib/hw/ids.go b/client/lib/numalib/hw/ids.go index 4d3566ef804..71da965ade8 100644 --- a/client/lib/numalib/hw/ids.go +++ b/client/lib/numalib/hw/ids.go @@ -14,7 +14,7 @@ type ( // Must be an alias because go-msgpack cannot handle the real type. NodeID = uint8 - // A SocketID represents a physicsl CPU socket. + // A SocketID represents a physical CPU socket. SocketID uint8 // A CoreID represents one logical (vCPU) core. diff --git a/command/agent/job_endpoint.go b/command/agent/job_endpoint.go index 2ea4ea6ae0f..ea6c6bf9c9e 100644 --- a/command/agent/job_endpoint.go +++ b/command/agent/job_endpoint.go @@ -1426,6 +1426,7 @@ func ApiTaskToStructsTask(job *structs.Job, group *structs.TaskGroup, GetterMode: *ta.GetterMode, GetterInsecure: *ta.GetterInsecure, RelativeDest: *ta.RelativeDest, + Chown: ta.Chown, }) } } diff --git a/command/agent/job_endpoint_test.go b/command/agent/job_endpoint_test.go index d52f94f3931..be15d0eca0f 100644 --- a/command/agent/job_endpoint_test.go +++ b/command/agent/job_endpoint_test.go @@ -2932,6 +2932,7 @@ func TestJobs_ApiJobToStructsJob(t *testing.T) { }, GetterMode: pointer.Of("dir"), RelativeDest: pointer.Of("dest"), + Chown: true, }, }, Vault: &api.Vault{ @@ -3387,6 +3388,7 @@ func TestJobs_ApiJobToStructsJob(t *testing.T) { }, GetterMode: "dir", RelativeDest: "dest", + Chown: true, }, }, Vault: &structs.Vault{ diff --git a/drivers/exec/driver.go b/drivers/exec/driver.go index 072b430a715..caad707d9ad 100644 --- a/drivers/exec/driver.go +++ b/drivers/exec/driver.go @@ -20,6 +20,7 @@ import ( "github.com/hashicorp/nomad/drivers/shared/eventer" "github.com/hashicorp/nomad/drivers/shared/executor" "github.com/hashicorp/nomad/drivers/shared/resolvconf" + "github.com/hashicorp/nomad/drivers/shared/validators" "github.com/hashicorp/nomad/helper/pluginutils/loader" "github.com/hashicorp/nomad/helper/pointer" "github.com/hashicorp/nomad/plugins/base" @@ -83,6 +84,8 @@ var ( hclspec.NewAttr("allow_caps", "list(string)", false), hclspec.NewLiteral(capabilities.HCLSpecLiteral), ), + "denied_host_uids": hclspec.NewAttr("denied_host_uids", "string", false), + "denied_host_gids": hclspec.NewAttr("denied_host_gids", "string", false), }) // taskConfigSpec is the hcl specification for the driver config section of @@ -140,6 +143,8 @@ type Driver struct { // compute contains cpu compute information compute cpustats.Compute + + userIDValidator UserIDValidator } // Config is the driver configuration set by the SetConfig RPC call @@ -159,6 +164,9 @@ type Config struct { // AllowCaps configures which Linux Capabilities are enabled for tasks // running on this node. AllowCaps []string `codec:"allow_caps"` + + DeniedHostUids string `codec:"denied_host_uids"` + DeniedHostGids string `codec:"denied_host_gids"` } func (c *Config) validate() error { @@ -223,6 +231,7 @@ func (tc *TaskConfig) validate() error { if !badAdds.Empty() { return fmt.Errorf("cap_add configured with capabilities not supported by system: %s", badAdds) } + badDrops := supported.Difference(capabilities.New(tc.CapDrop)) if !badDrops.Empty() { return fmt.Errorf("cap_drop configured with capabilities not supported by system: %s", badDrops) @@ -241,6 +250,10 @@ type TaskState struct { StartedAt time.Time } +type UserIDValidator interface { + HasValidIDs(userName string) error +} + // NewExecDriver returns a new DrivePlugin implementation func NewExecDriver(ctx context.Context, logger hclog.Logger) drivers.DriverPlugin { logger = logger.Named(pluginName) @@ -285,14 +298,26 @@ func (d *Driver) ConfigSchema() (*hclspec.Spec, error) { func (d *Driver) SetConfig(cfg *base.Config) error { // unpack, validate, and set agent plugin config var config Config + if len(cfg.PluginConfig) != 0 { if err := base.MsgPackDecode(cfg.PluginConfig, &config); err != nil { return err } } + if err := config.validate(); err != nil { return err } + + if d.userIDValidator == nil { + idValidator, err := validators.NewValidator(d.logger, config.DeniedHostUids, config.DeniedHostGids) + if err != nil { + return fmt.Errorf("unable to start validator: %w", err) + } + + d.userIDValidator = idValidator + } + d.config = config if cfg != nil && cfg.AgentConfig != nil { @@ -437,6 +462,16 @@ func (d *Driver) StartTask(cfg *drivers.TaskConfig) (*drivers.TaskHandle, *drive return nil, nil, fmt.Errorf("failed driver config validation: %v", err) } + if cfg.User == "" { + cfg.User = "nobody" + } + + d.logger.Debug("setting up user", "user", cfg.User) + + if err := d.userIDValidator.HasValidIDs(cfg.User); err != nil { + return nil, nil, fmt.Errorf("failed host user validation: %v", err) + } + d.logger.Info("starting task", "driver_cfg", hclog.Fmt("%+v", driverConfig)) handle := drivers.NewTaskHandle(taskHandleVersion) handle.Config = cfg @@ -457,10 +492,6 @@ func (d *Driver) StartTask(cfg *drivers.TaskConfig) (*drivers.TaskHandle, *drive } user := cfg.User - if user == "" { - user = "nobody" - } - if cfg.DNS != nil { dnsMount, err := resolvconf.GenerateDNSMount(cfg.TaskDir().Dir, cfg.DNS) if err != nil { diff --git a/drivers/exec/driver_test.go b/drivers/exec/driver_test.go index 60429530512..cd275bc87f2 100644 --- a/drivers/exec/driver_test.go +++ b/drivers/exec/driver_test.go @@ -36,6 +36,12 @@ import ( "github.com/stretchr/testify/require" ) +type mockIDValidator struct{} + +func (mv *mockIDValidator) HasValidIDs(userName string) error { + return nil +} + func TestMain(m *testing.M) { if !testtask.Run() { os.Exit(m.Run()) @@ -70,6 +76,8 @@ func newExecDriverTest(t *testing.T, ctx context.Context) drivers.DriverPlugin { topology := numalib.Scan(numalib.PlatformScanners()) d := NewExecDriver(ctx, testlog.HCLogger(t)) d.(*Driver).nomadConfig = &base.ClientDriverConfig{Topology: topology} + d.(*Driver).userIDValidator = &mockIDValidator{} + return d } @@ -831,6 +839,81 @@ func TestExecDriver_OOMKilled(t *testing.T) { must.NoError(t, harness.DestroyTask(task.ID, true)) } +func TestDriver_Config_setDeniedIds(t *testing.T) { + + ci.Parallel(t) + + testCases := []struct { + name string + uidRanges string + gidRanges string + exError bool + }{ + { + name: "empty_ranges", + uidRanges: "", + gidRanges: "", + exError: false, + }, + { + name: "valid_ranges", + uidRanges: "1-10", + gidRanges: "1-10", + exError: false, + }, + { + name: "empty_GID_invalid_UID_range", + uidRanges: "10-1", + gidRanges: "", + exError: true, + }, + { + name: "empty_UID_invalid_GID_range", + uidRanges: "", + gidRanges: "10-1", + exError: true, + }, + } + + for _, tc := range testCases { + t.Run(tc.name, func(t *testing.T) { + ctx, cancel := context.WithCancel(context.Background()) + defer cancel() + + d := newExecDriverTest(t, ctx) + + // Force the creation of the validatior. + d.(*Driver).userIDValidator = nil + + harness := dtestutil.NewDriverHarness(t, d) + defer harness.Kill() + + config := &Config{ + NoPivotRoot: false, + DefaultModePID: executor.IsolationModePrivate, + DefaultModeIPC: executor.IsolationModePrivate, + DeniedHostUids: tc.uidRanges, + DeniedHostGids: tc.gidRanges, + } + + var data []byte + must.NoError(t, base.MsgPackEncode(&data, config)) + + baseConfig := &base.Config{ + PluginConfig: data, + AgentConfig: &base.AgentConfig{ + Driver: &base.ClientDriverConfig{ + Topology: d.(*Driver).nomadConfig.Topology, + }, + }, + } + + err := harness.SetConfig(baseConfig) + must.Eq(t, err != nil, tc.exError) + }) + } +} + func TestDriver_Config_validate(t *testing.T) { ci.Parallel(t) t.Run("pid/ipc", func(t *testing.T) { @@ -874,6 +957,7 @@ func TestDriver_Config_validate(t *testing.T) { func TestDriver_TaskConfig_validate(t *testing.T) { ci.Parallel(t) + t.Run("pid/ipc", func(t *testing.T) { for _, tc := range []struct { pidMode, ipcMode string @@ -889,7 +973,7 @@ func TestDriver_TaskConfig_validate(t *testing.T) { {pidMode: "", ipcMode: "host", exp: nil}, {pidMode: "other", ipcMode: "host", exp: errors.New(`pid_mode must be "private" or "host", got "other"`)}, } { - require.Equal(t, tc.exp, (&TaskConfig{ + must.Eq(t, tc.exp, (&TaskConfig{ ModePID: tc.pidMode, ModeIPC: tc.ipcMode, }).validate()) @@ -907,7 +991,7 @@ func TestDriver_TaskConfig_validate(t *testing.T) { {adds: []string{"chown", "sys_time"}, exp: nil}, {adds: []string{"chown", "not_valid", "sys_time"}, exp: errors.New("cap_add configured with capabilities not supported by system: not_valid")}, } { - require.Equal(t, tc.exp, (&TaskConfig{ + must.Eq(t, tc.exp, (&TaskConfig{ CapAdd: tc.adds, }).validate()) } @@ -924,7 +1008,7 @@ func TestDriver_TaskConfig_validate(t *testing.T) { {drops: []string{"chown", "sys_time"}, exp: nil}, {drops: []string{"chown", "not_valid", "sys_time"}, exp: errors.New("cap_drop configured with capabilities not supported by system: not_valid")}, } { - require.Equal(t, tc.exp, (&TaskConfig{ + must.Eq(t, tc.exp, (&TaskConfig{ CapDrop: tc.drops, }).validate()) } diff --git a/drivers/rawexec/driver.go b/drivers/rawexec/driver.go index 9e59488a979..39493e16948 100644 --- a/drivers/rawexec/driver.go +++ b/drivers/rawexec/driver.go @@ -18,6 +18,7 @@ import ( "github.com/hashicorp/nomad/client/lib/cpustats" "github.com/hashicorp/nomad/drivers/shared/eventer" "github.com/hashicorp/nomad/drivers/shared/executor" + "github.com/hashicorp/nomad/drivers/shared/validators" "github.com/hashicorp/nomad/helper/pluginutils/hclutils" "github.com/hashicorp/nomad/helper/pluginutils/loader" "github.com/hashicorp/nomad/plugins/base" @@ -81,6 +82,8 @@ var ( hclspec.NewAttr("enabled", "bool", false), hclspec.NewLiteral("false"), ), + "denied_host_uids": hclspec.NewAttr("denied_host_uids", "string", false), + "denied_host_gids": hclspec.NewAttr("denied_host_gids", "string", false), }) // taskConfigSpec is the hcl specification for the driver config section of @@ -107,6 +110,10 @@ var ( } ) +type UserIDValidator interface { + HasValidIDs(userName string) error +} + // Driver is a privileged version of the exec driver. It provides no // resource isolation and just fork/execs. The Exec driver should be preferred // and this should only be used when explicitly needed. @@ -133,12 +140,17 @@ type Driver struct { // compute contains cpu compute information compute cpustats.Compute + + userIDValidator UserIDValidator } // Config is the driver configuration set by the SetConfig RPC call type Config struct { // Enabled is set to true to enable the raw_exec driver Enabled bool `codec:"enabled"` + + DeniedHostUids string `codec:"denied_host_uids"` + DeniedHostGids string `codec:"denied_host_gids"` } // TaskConfig is the driver configuration of a task within a job @@ -194,17 +206,29 @@ func (d *Driver) ConfigSchema() (*hclspec.Spec, error) { func (d *Driver) SetConfig(cfg *base.Config) error { var config Config + if len(cfg.PluginConfig) != 0 { if err := base.MsgPackDecode(cfg.PluginConfig, &config); err != nil { return err } } + if d.userIDValidator == nil { + idValidator, err := validators.NewValidator(d.logger, config.DeniedHostUids, config.DeniedHostGids) + if err != nil { + return fmt.Errorf("unable to start validator: %w", err) + } + + d.userIDValidator = idValidator + } + d.config = &config + if cfg.AgentConfig != nil { d.nomadConfig = cfg.AgentConfig.Driver d.compute = cfg.AgentConfig.Compute() } + return nil } @@ -332,6 +356,10 @@ func (d *Driver) StartTask(cfg *drivers.TaskConfig) (*drivers.TaskHandle, *drive return nil, nil, fmt.Errorf("oom_score_adj must not be negative") } + if err := d.Validate(*cfg); err != nil { + return nil, nil, fmt.Errorf("failed driver config validation: %v", err) + } + d.logger.Info("starting task", "driver_cfg", hclog.Fmt("%+v", driverConfig)) handle := drivers.NewTaskHandle(taskHandleVersion) handle.Config = cfg diff --git a/drivers/rawexec/driver_test.go b/drivers/rawexec/driver_test.go index df360f5eb92..693eac2d3dd 100644 --- a/drivers/rawexec/driver_test.go +++ b/drivers/rawexec/driver_test.go @@ -76,6 +76,12 @@ var ( topology = numalib.Scan(numalib.PlatformScanners()) ) +type mockIDValidator struct{} + +func (mv *mockIDValidator) HasValidIDs(userName string) error { + return nil +} + func newEnabledRawExecDriver(t *testing.T) *Driver { ctx, cancel := context.WithCancel(context.Background()) t.Cleanup(cancel) @@ -86,13 +92,13 @@ func newEnabledRawExecDriver(t *testing.T) *Driver { d.nomadConfig = &base.ClientDriverConfig{ Topology: topology, } + d.userIDValidator = &mockIDValidator{} return d } func TestRawExecDriver_SetConfig(t *testing.T) { ci.Parallel(t) - require := require.New(t) ctx, cancel := context.WithCancel(context.Background()) defer cancel() @@ -110,18 +116,35 @@ func TestRawExecDriver_SetConfig(t *testing.T) { ) // Default is raw_exec is disabled. - require.NoError(basePlug.MsgPackEncode(&data, config)) + must.NoError(t, basePlug.MsgPackEncode(&data, config)) bconfig.PluginConfig = data - require.NoError(harness.SetConfig(bconfig)) - require.Exactly(config, d.(*Driver).config) + must.NoError(t, harness.SetConfig(bconfig)) + must.Eq(t, config, d.(*Driver).config) // Enable raw_exec, but disable cgroups. config.Enabled = true data = []byte{} - require.NoError(basePlug.MsgPackEncode(&data, config)) + + must.NoError(t, basePlug.MsgPackEncode(&data, config)) + bconfig.PluginConfig = data + + must.NoError(t, harness.SetConfig(bconfig)) + must.Eq(t, config, d.(*Driver).config) + + // Turns on uid/gid restrictions, and sets the range to a bad value and + // force the recreation of the validator. + d.(*Driver).userIDValidator = nil + config.DeniedHostUids = "100-1" + data = []byte{} + + must.NoError(t, basePlug.MsgPackEncode(&data, config)) + bconfig.PluginConfig = data - require.NoError(harness.SetConfig(bconfig)) - require.Exactly(config, d.(*Driver).config) + err := harness.SetConfig(bconfig) + must.Error(t, err) + + must.ErrorContains(t, err, "invalid range deniedHostUIDs \"100-1\": lower bound cannot be greater than upper bound") + } func TestRawExecDriver_Fingerprint(t *testing.T) { @@ -209,6 +232,7 @@ func TestRawExecDriver_StartWait(t *testing.T) { Args: []string{"sleep", "10ms"}, } require.NoError(task.EncodeConcreteDriverConfig(&tc)) + testtask.SetTaskConfigEnv(task) cleanup := harness.MkAllocDir(task, false) diff --git a/drivers/rawexec/driver_unix.go b/drivers/rawexec/driver_unix.go new file mode 100644 index 00000000000..04ef5417338 --- /dev/null +++ b/drivers/rawexec/driver_unix.go @@ -0,0 +1,30 @@ +// Copyright (c) HashiCorp, Inc. +// SPDX-License-Identifier: BUSL-1.1 + +//go:build !windows + +package rawexec + +import ( + "fmt" + + "github.com/hashicorp/nomad/helper/users" + "github.com/hashicorp/nomad/plugins/drivers" +) + +func (d *Driver) Validate(cfg drivers.TaskConfig) error { + usernameToLookup := cfg.User + + // Uses the current user of the client agent process + // if no override is given (differs from exec) + if usernameToLookup == "" { + user, err := users.Current() + if err != nil { + return fmt.Errorf("failed to get current user: %w", err) + } + + usernameToLookup = user.Username + } + + return d.userIDValidator.HasValidIDs(usernameToLookup) +} diff --git a/drivers/rawexec/driver_unix_test.go b/drivers/rawexec/driver_unix_test.go index c09e3e0eba3..6912590a3cc 100644 --- a/drivers/rawexec/driver_unix_test.go +++ b/drivers/rawexec/driver_unix_test.go @@ -7,6 +7,7 @@ package rawexec import ( "context" + "errors" "fmt" "os" "path/filepath" @@ -22,6 +23,7 @@ import ( "github.com/hashicorp/nomad/ci" clienttestutil "github.com/hashicorp/nomad/client/testutil" "github.com/hashicorp/nomad/helper/testtask" + "github.com/hashicorp/nomad/helper/users" "github.com/hashicorp/nomad/helper/uuid" "github.com/hashicorp/nomad/plugins/base" basePlug "github.com/hashicorp/nomad/plugins/base" @@ -456,6 +458,7 @@ func TestRawExecDriver_StartWaitRecoverWaitStop(t *testing.T) { config := &Config{Enabled: true} var data []byte + require.NoError(basePlug.MsgPackEncode(&data, config)) bconfig := &basePlug.Config{ PluginConfig: data, @@ -476,6 +479,7 @@ func TestRawExecDriver_StartWaitRecoverWaitStop(t *testing.T) { Env: defaultEnv(), Resources: testResources(allocID, taskName), } + tc := &TaskConfig{ Command: testtask.Path(), Args: []string{"sleep", "100s"}, @@ -542,3 +546,69 @@ func TestRawExecDriver_StartWaitRecoverWaitStop(t *testing.T) { require.NoError(d.DestroyTask(task.ID, false)) require.True(waitDone) } + +func TestRawExec_Validate(t *testing.T) { + ci.Parallel(t) + + current, err := users.Current() + must.NoError(t, err) + + currentUserErrStr := fmt.Sprintf("running as uid %s is disallowed", current.Uid) + + allowAll := "" + denyCurrent := current.Uid + + configAllowCurrent := Config{DeniedHostUids: allowAll} + configDenyCurrent := Config{DeniedHostUids: denyCurrent} + + driverConfigNoUserSpecified := drivers.TaskConfig{} + driverTaskConfig := drivers.TaskConfig{User: current.Name} + + for _, tc := range []struct { + config Config + driverConfig drivers.TaskConfig + exp error + }{ + { + config: configAllowCurrent, + driverConfig: driverTaskConfig, + exp: nil, + }, + { + config: configDenyCurrent, + driverConfig: driverConfigNoUserSpecified, + exp: errors.New(currentUserErrStr), + }, + { + config: configDenyCurrent, + driverConfig: driverTaskConfig, + exp: errors.New(currentUserErrStr), + }, + } { + + d := newEnabledRawExecDriver(t) + + // Force the creation of the validatior, the mock is used by newEnabledRawExecDriver by default + d.userIDValidator = nil + + harness := dtestutil.NewDriverHarness(t, d) + defer harness.Kill() + + config := tc.config + + var data []byte + + must.NoError(t, base.MsgPackEncode(&data, config)) + bconfig := &base.Config{ + PluginConfig: data, + AgentConfig: &base.AgentConfig{ + Driver: &base.ClientDriverConfig{ + Topology: d.nomadConfig.Topology, + }, + }, + } + + must.NoError(t, harness.SetConfig(bconfig)) + must.Eq(t, tc.exp, d.Validate(tc.driverConfig)) + } +} diff --git a/drivers/rawexec/driver_windows.go b/drivers/rawexec/driver_windows.go new file mode 100644 index 00000000000..f64cbb8f398 --- /dev/null +++ b/drivers/rawexec/driver_windows.go @@ -0,0 +1,18 @@ +// Copyright (c) HashiCorp, Inc. +// SPDX-License-Identifier: BUSL-1.1 + +//go:build windows + +package rawexec + +import ( + "github.com/hashicorp/nomad/plugins/drivers" +) + +func (d *Driver) Validate(cfg drivers.TaskConfig) error { + // This is a noop on windows since the uid and gid cannot be checked against a range easily + // We could eventually extend this functionality to check for individual users IDs strings + // but that is not currently supported. See driverValidators.HasValidIds for + // unix logic + return nil +} diff --git a/drivers/shared/validators/validators.go b/drivers/shared/validators/validators.go new file mode 100644 index 00000000000..ca2518fd988 --- /dev/null +++ b/drivers/shared/validators/validators.go @@ -0,0 +1,151 @@ +// Copyright (c) HashiCorp, Inc. +// SPDX-License-Identifier: MPL-2.0 + +package validators + +import ( + "errors" + "fmt" + "strconv" + "strings" + + "github.com/hashicorp/go-hclog" + "github.com/hashicorp/nomad/client/lib/idset" + "github.com/hashicorp/nomad/helper/users" +) + +var ( + ErrInvalidBound = errors.New("range bound not valid") + //ErrEmptyRange = errors.New("range value cannot be empty") + ErrInvalidRange = errors.New("lower bound cannot be greater than upper bound") +) + +type ( + + // A GroupID (GID) represents a unique numerical value assigned to each user group. + GroupID uint64 + + // A UserID represents a unique numerical value assigned to each user account. + UserID uint64 +) + +type Validator struct { + // DeniedHostUids configures which host uids are disallowed + deniedUIDs *idset.Set[UserID] + + // DeniedHostGids configures which host gids are disallowed + deniedGIDs *idset.Set[GroupID] + + // logger will log to the Nomad agent + logger hclog.Logger +} + +func NewValidator(logger hclog.Logger, deniedHostUIDs, deniedHostGIDs string) (*Validator, error) { + valLogger := logger.Named("id_validator") + + err := validateIDRange("deniedHostUIDs", deniedHostUIDs) + if err != nil { + return nil, err + } + valLogger.Debug("user range configured", "denied range", deniedHostUIDs) + + err = validateIDRange("deniedHostGIDs", deniedHostGIDs) + if err != nil { + return nil, err + } + valLogger.Debug("group range configured", "denied range", deniedHostGIDs) + + v := &Validator{ + deniedUIDs: idset.Parse[UserID](deniedHostUIDs), + deniedGIDs: idset.Parse[GroupID](deniedHostGIDs), + logger: valLogger, + } + + return v, nil +} + +// HasValidIDs is used when running a task to ensure the +// given user is in the ID range defined in the task config +func (v *Validator) HasValidIDs(userName string) error { + user, err := users.Lookup(userName) + if err != nil { + return fmt.Errorf("failed to identify user %q: %w", userName, err) + } + + uid, err := getUserID(user) + if err != nil { + return fmt.Errorf("validator: %w", err) + } + + // check uids + if v.deniedUIDs.Contains(uid) { + return fmt.Errorf("running as uid %d is disallowed", uid) + } + + gids, err := getGroupsID(user) + if err != nil { + return fmt.Errorf("validator: %w", err) + } + + // check gids + for _, gid := range gids { + if v.deniedGIDs.Contains(gid) { + return fmt.Errorf("running as gid %d is disallowed", gid) + } + } + + return nil +} + +// validateIDRange is used to ensure that the configuration for ID ranges is valid +// by checking the syntax and bounds. +func validateIDRange(rangeType string, deniedRanges string) error { + + parts := strings.Split(deniedRanges, ",") + + // exit early if empty string + if len(parts) == 1 && parts[0] == "" { + return nil + } + + for _, rangeStr := range parts { + err := validateBounds(rangeStr) + if err != nil { + return fmt.Errorf("invalid range %s \"%s\": %w", rangeType, rangeStr, err) + } + } + + return nil +} + +func validateBounds(boundsString string) error { + uidDenyRangeParts := strings.Split(boundsString, "-") + + switch len(uidDenyRangeParts) { + case 1: + disallowedIdStr := uidDenyRangeParts[0] + if _, err := strconv.ParseUint(disallowedIdStr, 10, 32); err != nil { + return ErrInvalidBound + } + + case 2: + lowerBoundStr := uidDenyRangeParts[0] + upperBoundStr := uidDenyRangeParts[1] + + lowerBoundInt, err := strconv.ParseUint(lowerBoundStr, 10, 32) + if err != nil { + return ErrInvalidBound + } + + upperBoundInt, err := strconv.ParseUint(upperBoundStr, 10, 32) + if err != nil { + return ErrInvalidBound + } + + if lowerBoundInt > upperBoundInt { + return ErrInvalidRange + } + } + + return nil +} diff --git a/drivers/shared/validators/validators_default.go b/drivers/shared/validators/validators_default.go new file mode 100644 index 00000000000..b35cfeb07af --- /dev/null +++ b/drivers/shared/validators/validators_default.go @@ -0,0 +1,20 @@ +// Copyright (c) HashiCorp, Inc. +// SPDX-License-Identifier: MPL-2.0 + +//go:build windows + +package validators + +import ( + "os/user" +) + +// noop +func getUserID(*user.User) (UserID, error) { + return 0, nil +} + +// noop +func getGroupsID(*user.User) ([]GroupID, error) { + return []GroupID{}, nil +} diff --git a/drivers/shared/validators/validators_test.go b/drivers/shared/validators/validators_test.go new file mode 100644 index 00000000000..367358e2b3e --- /dev/null +++ b/drivers/shared/validators/validators_test.go @@ -0,0 +1,122 @@ +// Copyright (c) HashiCorp, Inc. +// SPDX-License-Identifier: MPL-2.0 + +//go:build !windows + +package validators + +import ( + "fmt" + "os/user" + "strconv" + "testing" + + "github.com/hashicorp/go-hclog" + "github.com/shoenig/test/must" +) + +var validRangeStr = "1-100" +var validRangeSingleStr = "1" +var flippedBoundsMessage = "lower bound cannot be greater than upper bound" +var invalidRangeFlipped = "100-1" + +var invalidBound = "range bound not valid" +var invalidRangeSubstring = "1-100,foo" +var invalidRangeEmpty = "1-100,,200-300" + +func Test_IDRangeValid(t *testing.T) { + testCases := []struct { + name string + idRange string + expectedErr string + }{ + {name: "standard-range-is-valid", idRange: validRangeStr}, + {name: "same-number-for-both-bounds-is-valid", idRange: validRangeSingleStr}, + {name: "lower-higher-than-upper-is-invalid", idRange: invalidRangeFlipped, expectedErr: flippedBoundsMessage}, + {name: "missing-lower-is-invalid", idRange: invalidRangeSubstring, expectedErr: invalidBound}, + {name: "missing-higher-is-invalid", idRange: invalidRangeEmpty, expectedErr: invalidBound}, + } + + for _, tc := range testCases { + t.Run(tc.name, func(t *testing.T) { + err := validateIDRange("uid", tc.idRange) + if tc.expectedErr == "" { + must.NoError(t, err) + } else { + must.Error(t, err) + must.ErrorContains(t, err, tc.expectedErr) + } + }) + } +} + +func Test_HasValidIds(t *testing.T) { + + user, err := user.Current() + must.NoError(t, err) + + userID, err := strconv.ParseUint(user.Uid, 10, 32) + groupID, err := strconv.ParseUint(user.Gid, 10, 32) + must.NoError(t, err) + + userNotIncluded := fmt.Sprintf("%d-%d", userID+1, userID+11) + userIncluded := fmt.Sprintf("%d-%d", userID, userID+11) + userNotIncludedSingle := fmt.Sprintf("%d", userID+1) + + groupNotIncluded := fmt.Sprintf("%d-%d", groupID+1, groupID+11) + groupIncluded := fmt.Sprintf("%d-%d", groupID, groupID+11) + groupNotIncludedSingle := fmt.Sprintf("%d", groupID+1) + + emptyRanges := "" + + userDeniedRangesList := fmt.Sprintf("%s,%s", userNotIncluded, userNotIncludedSingle) + groupDeniedRangesList := fmt.Sprintf("%s,%s", groupNotIncluded, groupNotIncludedSingle) + + testCases := []struct { + name string + uidRanges string + gidRanges string + expectedErr string + }{ + {name: "user_not_in_denied_ranges", uidRanges: userDeniedRangesList, gidRanges: emptyRanges}, + {name: "user_and group_not_in_denied_ranges", uidRanges: userDeniedRangesList, gidRanges: groupDeniedRangesList}, + {name: "uid_in_one_of_ranges_is_invalid", uidRanges: userIncluded, gidRanges: groupDeniedRangesList, expectedErr: fmt.Sprintf("running as uid %s is disallowed", user.Uid)}, + {name: "gid-in-one-of-ranges-is-invalid", uidRanges: userDeniedRangesList, gidRanges: groupIncluded, expectedErr: fmt.Sprintf("running as gid %s is disallowed", user.Gid)}, + } + + for _, tc := range testCases { + t.Run(tc.name, func(t *testing.T) { + v, err := NewValidator(hclog.NewNullLogger(), tc.uidRanges, tc.gidRanges) + must.NoError(t, err) + + err = v.HasValidIDs(user.Username) + + if tc.expectedErr == "" { + must.NoError(t, err) + } else { + must.Error(t, err) + must.ErrorContains(t, err, tc.expectedErr) + } + }) + } +} + +func Test_ValidateBounds(t *testing.T) { + testCases := []struct { + name string + bounds string + expectedErr error + }{ + {name: "invalid_bound", bounds: "banana", expectedErr: ErrInvalidBound}, + {name: "invalid_lower_bound", bounds: "banana-10", expectedErr: ErrInvalidBound}, + {name: "invalid_upper_bound", bounds: "10-banana", expectedErr: ErrInvalidBound}, + {name: "lower_bigger_than_upper", bounds: "10-1", expectedErr: ErrInvalidRange}, + } + + for _, tc := range testCases { + t.Run(tc.name, func(t *testing.T) { + err := validateBounds(tc.bounds) + must.ErrorIs(t, err, tc.expectedErr) + }) + } +} diff --git a/drivers/shared/validators/validators_unix.go b/drivers/shared/validators/validators_unix.go new file mode 100644 index 00000000000..4469205e43f --- /dev/null +++ b/drivers/shared/validators/validators_unix.go @@ -0,0 +1,41 @@ +// Copyright (c) HashiCorp, Inc. +// SPDX-License-Identifier: MPL-2.0 + +//go:build !windows + +package validators + +import ( + "fmt" + "os/user" + "strconv" +) + +func getUserID(user *user.User) (UserID, error) { + id, err := strconv.ParseUint(user.Uid, 10, 32) + if err != nil { + return 0, fmt.Errorf("unable to convert userid %s to integer", user.Uid) + } + + return UserID(id), nil +} + +func getGroupsID(user *user.User) ([]GroupID, error) { + gidStrings, err := user.GroupIds() + if err != nil { + return []GroupID{}, fmt.Errorf("unable to lookup user's group membership: %w", err) + } + + gids := make([]GroupID, len(gidStrings)) + + for _, gidString := range gidStrings { + u, err := strconv.ParseUint(gidString, 10, 32) + if err != nil { + return []GroupID{}, fmt.Errorf("unable to convert user's group %q to integer: %w", gidString, err) + } + + gids = append(gids, GroupID(u)) + } + + return gids, nil +} diff --git a/e2e/ui/package-lock.json b/e2e/ui/package-lock.json index f4f6673c98a..d85ee949c6f 100644 --- a/e2e/ui/package-lock.json +++ b/e2e/ui/package-lock.json @@ -5,17 +5,17 @@ "packages": { "": { "devDependencies": { - "@playwright/test": "^1.47.0" + "@playwright/test": "^1.48.0" } }, "node_modules/@playwright/test": { - "version": "1.47.0", - "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.47.0.tgz", - "integrity": "sha512-SgAdlSwYVpToI4e/IH19IHHWvoijAYH5hu2MWSXptRypLSnzj51PcGD+rsOXFayde4P9ZLi+loXVwArg6IUkCA==", + "version": "1.48.0", + "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.48.0.tgz", + "integrity": "sha512-W5lhqPUVPqhtc/ySvZI5Q8X2ztBOUgZ8LbAFy0JQgrXZs2xaILrUcNO3rQjwbLPfGK13+rZsDa1FpG+tqYkT5w==", "dev": true, "license": "Apache-2.0", "dependencies": { - "playwright": "1.47.0" + "playwright": "1.48.0" }, "bin": { "playwright": "cli.js" @@ -40,13 +40,13 @@ } }, "node_modules/playwright": { - "version": "1.47.0", - "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.47.0.tgz", - "integrity": "sha512-jOWiRq2pdNAX/mwLiwFYnPHpEZ4rM+fRSQpRHwEwZlP2PUANvL3+aJOF/bvISMhFD30rqMxUB4RJx9aQbfh4Ww==", + "version": "1.48.0", + "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.48.0.tgz", + "integrity": "sha512-qPqFaMEHuY/ug8o0uteYJSRfMGFikhUysk8ZvAtfKmUK3kc/6oNl/y3EczF8OFGYIi/Ex2HspMfzYArk6+XQSA==", "dev": true, "license": "Apache-2.0", "dependencies": { - "playwright-core": "1.47.0" + "playwright-core": "1.48.0" }, "bin": { "playwright": "cli.js" @@ -59,9 +59,9 @@ } }, "node_modules/playwright-core": { - "version": "1.47.0", - "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.47.0.tgz", - "integrity": "sha512-1DyHT8OqkcfCkYUD9zzUTfg7EfTd+6a8MkD/NWOvjo0u/SCNd5YmY/lJwFvUZOxJbWNds+ei7ic2+R/cRz/PDg==", + "version": "1.48.0", + "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.48.0.tgz", + "integrity": "sha512-RBvzjM9rdpP7UUFrQzRwR8L/xR4HyC1QXMzGYTbf1vjw25/ya9NRAVnXi/0fvFopjebvyPzsmoK58xxeEOaVvA==", "dev": true, "license": "Apache-2.0", "bin": { @@ -74,12 +74,12 @@ }, "dependencies": { "@playwright/test": { - "version": "1.47.0", - "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.47.0.tgz", - "integrity": "sha512-SgAdlSwYVpToI4e/IH19IHHWvoijAYH5hu2MWSXptRypLSnzj51PcGD+rsOXFayde4P9ZLi+loXVwArg6IUkCA==", + "version": "1.48.0", + "resolved": "https://registry.npmjs.org/@playwright/test/-/test-1.48.0.tgz", + "integrity": "sha512-W5lhqPUVPqhtc/ySvZI5Q8X2ztBOUgZ8LbAFy0JQgrXZs2xaILrUcNO3rQjwbLPfGK13+rZsDa1FpG+tqYkT5w==", "dev": true, "requires": { - "playwright": "1.47.0" + "playwright": "1.48.0" } }, "fsevents": { @@ -90,19 +90,19 @@ "optional": true }, "playwright": { - "version": "1.47.0", - "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.47.0.tgz", - "integrity": "sha512-jOWiRq2pdNAX/mwLiwFYnPHpEZ4rM+fRSQpRHwEwZlP2PUANvL3+aJOF/bvISMhFD30rqMxUB4RJx9aQbfh4Ww==", + "version": "1.48.0", + "resolved": "https://registry.npmjs.org/playwright/-/playwright-1.48.0.tgz", + "integrity": "sha512-qPqFaMEHuY/ug8o0uteYJSRfMGFikhUysk8ZvAtfKmUK3kc/6oNl/y3EczF8OFGYIi/Ex2HspMfzYArk6+XQSA==", "dev": true, "requires": { "fsevents": "2.3.2", - "playwright-core": "1.47.0" + "playwright-core": "1.48.0" } }, "playwright-core": { - "version": "1.47.0", - "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.47.0.tgz", - "integrity": "sha512-1DyHT8OqkcfCkYUD9zzUTfg7EfTd+6a8MkD/NWOvjo0u/SCNd5YmY/lJwFvUZOxJbWNds+ei7ic2+R/cRz/PDg==", + "version": "1.48.0", + "resolved": "https://registry.npmjs.org/playwright-core/-/playwright-core-1.48.0.tgz", + "integrity": "sha512-RBvzjM9rdpP7UUFrQzRwR8L/xR4HyC1QXMzGYTbf1vjw25/ya9NRAVnXi/0fvFopjebvyPzsmoK58xxeEOaVvA==", "dev": true } } diff --git a/e2e/ui/package.json b/e2e/ui/package.json index 6aaa478d243..a655fe54b65 100644 --- a/e2e/ui/package.json +++ b/e2e/ui/package.json @@ -1,5 +1,5 @@ { "devDependencies": { - "@playwright/test": "^1.47.0" + "@playwright/test": "^1.48.0" } } diff --git a/e2e/ui/run.sh b/e2e/ui/run.sh index bed02badab1..a976393c786 100755 --- a/e2e/ui/run.sh +++ b/e2e/ui/run.sh @@ -33,7 +33,7 @@ EOF } -IMAGE="mcr.microsoft.com/playwright:v1.47.0-noble" +IMAGE="mcr.microsoft.com/playwright:v1.48.0-noble" pushd $(dirname "${BASH_SOURCE[0]}") > /dev/null run_tests() { diff --git a/nomad/structs/diff_test.go b/nomad/structs/diff_test.go index 7aafa69c0ed..0f87387ff6c 100644 --- a/nomad/structs/diff_test.go +++ b/nomad/structs/diff_test.go @@ -6059,6 +6059,7 @@ func TestTaskDiff(t *testing.T) { }, GetterMode: "dir", RelativeDest: "bar", + Chown: false, }, }, }, @@ -6082,6 +6083,7 @@ func TestTaskDiff(t *testing.T) { }, GetterMode: "file", RelativeDest: "bam", + Chown: true, }, }, }, @@ -6104,6 +6106,12 @@ func TestTaskDiff(t *testing.T) { Type: DiffTypeAdded, Name: "Artifact", Fields: []*FieldDiff{ + { + Type: DiffTypeAdded, + Name: "Chown", + Old: "", + New: "true", + }, { Type: DiffTypeAdded, Name: "GetterHeaders[User-Agent]", @@ -6152,13 +6160,18 @@ func TestTaskDiff(t *testing.T) { Type: DiffTypeDeleted, Name: "Artifact", Fields: []*FieldDiff{ + { + Type: DiffTypeDeleted, + Name: "Chown", + Old: "false", + New: "", + }, { Type: DiffTypeDeleted, Name: "GetterHeaders[User]", Old: "user1", New: "", }, - { Type: DiffTypeDeleted, Name: "GetterInsecure", diff --git a/nomad/structs/structs.go b/nomad/structs/structs.go index 004da160c37..2ce8d93f8fc 100644 --- a/nomad/structs/structs.go +++ b/nomad/structs/structs.go @@ -9815,6 +9815,11 @@ type TaskArtifact struct { // RelativeDest is the download destination given relative to the task's // directory. RelativeDest string + + // Chown the resulting files and directories to the user of the task. + // + // Defaults to false. + Chown bool } func (ta *TaskArtifact) Equal(o *TaskArtifact) bool { @@ -9834,6 +9839,8 @@ func (ta *TaskArtifact) Equal(o *TaskArtifact) bool { return false case ta.RelativeDest != o.RelativeDest: return false + case ta.Chown != o.Chown: + return false } return true } @@ -9849,6 +9856,7 @@ func (ta *TaskArtifact) Copy() *TaskArtifact { GetterMode: ta.GetterMode, GetterInsecure: ta.GetterInsecure, RelativeDest: ta.RelativeDest, + Chown: ta.Chown, } } @@ -9890,6 +9898,7 @@ func (ta *TaskArtifact) Hash() string { _, _ = h.Write([]byte(ta.GetterMode)) _, _ = h.Write([]byte(strconv.FormatBool(ta.GetterInsecure))) _, _ = h.Write([]byte(ta.RelativeDest)) + _, _ = h.Write([]byte(strconv.FormatBool(ta.Chown))) return base64.RawStdEncoding.EncodeToString(h.Sum(nil)) } diff --git a/nomad/structs/structs_test.go b/nomad/structs/structs_test.go index c4105d822f1..9f739137444 100644 --- a/nomad/structs/structs_test.go +++ b/nomad/structs/structs_test.go @@ -5065,6 +5065,17 @@ func TestTaskArtifact_Hash(t *testing.T) { GetterInsecure: true, RelativeDest: "i", }, + { + GetterSource: "b", + GetterOptions: map[string]string{ + "c": "c", + "d": "e", + }, + GetterMode: "g", + GetterInsecure: true, + RelativeDest: "i", + Chown: true, + }, } // Map of hash to source @@ -7860,7 +7871,7 @@ func TestTaskArtifact_Equal(t *testing.T) { ci.Parallel(t) must.Equal[*TaskArtifact](t, nil, nil) - must.NotEqual[*TaskArtifact](t, nil, new(TaskArtifact)) + must.NotEqual(t, nil, new(TaskArtifact)) must.StructEqual(t, &TaskArtifact{ GetterSource: "source", @@ -7883,7 +7894,11 @@ func TestTaskArtifact_Equal(t *testing.T) { }, { Field: "RelativeDest", Apply: func(ta *TaskArtifact) { ta.RelativeDest = "./alloc" }, - }}) + }, { + Field: "Chown", + Apply: func(ta *TaskArtifact) { ta.Chown = true }, + }, + }) } func TestVault_Equal(t *testing.T) { diff --git a/website/content/api-docs/allocations.mdx b/website/content/api-docs/allocations.mdx index 65eded2e2a3..4590f2aeb46 100644 --- a/website/content/api-docs/allocations.mdx +++ b/website/content/api-docs/allocations.mdx @@ -983,6 +983,19 @@ The table below shows this endpoint's support for must be the full UUID, not the short 8-character one. This is specified as part of the path. +- `Task` `(string: )` - Specifies the name of the task whose schedule + should be overridden. + +- `ScheduleState` `(string: )` - Specifies the pause state to force + the task into. One of: + + - `"pause"` - Forces the task to pause. + + - `"run"` - Forces the task to run. + + - `"scheduled"` - Removes any overrides and forces the task to adhere to + its schedule. + ### Sample Request ```shell-session @@ -1018,12 +1031,12 @@ The table below shows this endpoint's support for ### Parameters -- `:alloc_id` `(string: )`- Specifies the UUID of the allocation. This - must be the full UUID, not the short 8-character one. This is specified as - part of the path. +- `:alloc_id` `(string: )` - Specifies the UUID of the allocation. + This must be the full UUID, not the short 8-character one. This is + specified as part of the path. -- `task` - Specifies the task from which to retrieve the time based task - execution state. +- `task` `(string: )` - Specifies the name of the task from which to + retrieve the time-based task execution state. ### Sample Request @@ -1039,5 +1052,24 @@ $ nomad operator api /v1/client/allocation/23f520cc-629a-46ff-395f-0661e7aa939e/ } ``` +#### Field Reference + +- `ScheduleState` `(string)`: The task's current paused state. It can can have + one of the following values: + + - `""` - The task is running. The only state returned for tasks with no + schedule. + + - `force_run` - The task's schedule has been overridden to run. + + - `force_pause` - The task's schedule has been overridden to pause. + + - `scheduled_pause` - The task is paused according to its schedule. + + - `schedule_resume` - A schedule override is being removed. Subsequent calls + should return running (`""`) or paused (`scheduled_pause`) states. This + state is rarely possible to observe since it transitions immediately to + another state. + [`shutdown_delay`]: /nomad/docs/job-specification/group#shutdown_delay [schedule]: /nomad/docs/job-specification/schedule diff --git a/website/content/docs/drivers/exec.mdx b/website/content/docs/drivers/exec.mdx index a1e46c91043..7ddd240d373 100644 --- a/website/content/docs/drivers/exec.mdx +++ b/website/content/docs/drivers/exec.mdx @@ -188,6 +188,30 @@ able to make use of IPC features, like sending unexpected POSIX signals. undesirable consequences, including untrusted tasks being able to compromise the host system. +- `denied_host_uids` - (Optional) Specifies a comma-separated list of host uids to + deny. Ranges can be specified by using a hyphen separating the two inclusive ends. + If a "user" value is specified in task configuration and that user has a user id in + the given ranges, the task will error before starting. This will not be checked on Windows + clients. + +```hcl +config { + denied_host_uids = "0,10-15,22" +} +``` + +- `denied_host_gids` - (Optional) Specifies a comma-separated list of host gids to + deny. Ranges can be specified by using a hyphen separating the two inclusive ends. + If a "user" value is specified in task configuration and that user is part of + any groups with gid's in the specified ranges, the task will error before + starting. This will not be checked on Windows clients. + +```hcl +config { + denied_host_gids = "2,4-8" +} +``` + ## Client Attributes The `exec` driver will set the following client attributes: diff --git a/website/content/docs/drivers/raw_exec.mdx b/website/content/docs/drivers/raw_exec.mdx index b69807186ff..0bdc73ae942 100644 --- a/website/content/docs/drivers/raw_exec.mdx +++ b/website/content/docs/drivers/raw_exec.mdx @@ -130,6 +130,30 @@ client { - `enabled` - Specifies whether the driver should be enabled or disabled. Defaults to `false`. +- `denied_host_uids` - (Optional) Specifies a comma-separated list of host uids to + deny. Ranges can be specified by using a hyphen separating the two inclusive ends. + If a "user" value is specified in task configuration and that user has a user id in + the given ranges, the task will error before starting. This will not be checked on Windows + clients. + +```hcl +config { + denied_host_uids = "0,10-15,22" +} +``` + +- `denied_host_gids` - (Optional) Specifies a comma-separated list of host gids to + deny. Ranges can be specified by using a hyphen separating the two inclusive ends. + If a "user" value is specified in task configuration and that user is part of + any groups with gid's in the specified ranges, the task will error before + starting. This will not be checked on Windows clients. + +```hcl +config { + denied_host_gids = "2,4-8" +} +``` + ## Client Options ~> Note: client configuration options will soon be deprecated. Please use @@ -166,7 +190,6 @@ resources { } ``` - [hardening]: /nomad/docs/install/production/requirements#user-permissions [plugin-options]: #plugin-options [plugin-block]: /nomad/docs/configuration/plugin diff --git a/website/content/docs/job-specification/artifact.mdx b/website/content/docs/job-specification/artifact.mdx index 3960f80b353..fc791862f56 100644 --- a/website/content/docs/job-specification/artifact.mdx +++ b/website/content/docs/job-specification/artifact.mdx @@ -62,6 +62,9 @@ automatically unarchived before the starting the task. - `source` `(string: )` - Specifies the URL of the artifact to download. See [`go-getter`][go-getter] for details. +- `chown` `(bool: false)` - Specifies whether Nomad should recursively `chown` + the downloaded artifact to be owned by the [`task.user`][task_user] uid and gid. + ## Operation Limits The client [`artifact`][client_artifact] configuration can set limits to @@ -279,5 +282,6 @@ client configuration. [s3-region-endpoints]: http://docs.aws.amazon.com/general/latest/gr/rande.html#s3_region 'Amazon S3 Region Endpoints' [iam-instance-profiles]: https://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_use_switch-role-ec2_instance-profiles.html 'EC2 IAM instance profiles' [task's working directory]: /nomad/docs/runtime/environment#task-directories 'Task Directories' +[task_user]: /nomad/docs/job-specification/task#user [filesystem internals]: /nomad/docs/concepts/filesystem#templates-artifacts-and-dispatch-payloads [do_spaces]: https://www.digitalocean.com/products/spaces