jobspec: add a chown option to artifact block #24157
Conversation
shoenig
force-pushed
the
artifact-chown
branch
from
c820e6e
to
6ad77b6
Compare
shoenig
force-pushed
the
artifact-chown
branch
from
6ad77b6
to
07f4aca
Compare
shoenig
force-pushed
the
artifact-chown
branch
from
07f4aca
to
9666a6e
Compare
shoenig
force-pushed
the
artifact-chown
branch
from
9666a6e
to
049b37d
Compare
shoenig
force-pushed
the
artifact-chown
branch
from
049b37d
to
ce366b1
Compare
|
not sure what's up with |
This PR adds a boolean 'chown' field to the artifact block. It indicates whether the Nomad client should chown the downloaded files and directories to be owned by the task.user. This is useful for drivers like raw_exec and exec2 which are subject to the host filesystem user permissions structure. Before, these drivers might not be able to use or manage the downloaded artifacts since they would be owned by the root user on a typical Nomad client configuration.
shoenig
force-pushed
the
artifact-chown
branch
from
ce366b1
to
1979bac
Compare
I've been seeing it fail intermittently today with that |
command/agent/job_endpoint.go
Outdated
| @@ -1426,6 +1426,7 @@ func ApiTaskToStructsTask(job *structs.Job, group *structs.TaskGroup, | |||
| GetterMode: *ta.GetterMode, | |||
| GetterInsecure: *ta.GetterInsecure, | |||
| RelativeDest: *ta.RelativeDest, | |||
| Chown: *ta.Chown, | |||
There was a problem hiding this comment.
This panics if ta.Chown is nil, which will be the case if we receive a HTTP request outside of the Go API because the zero value for the unset field is now nil instead of false. (But see also my note on the API struct.)
api/tasks.go
Outdated
| if a.Chown == nil { | ||
| a.Chown = pointerOf(false) | ||
| } |
There was a problem hiding this comment.
If we're going to canonicalize it to the zero-value (false) anyways, we can make it bool with the tag hcl:"chown,optional" instead of a *bool and avoid downstream nil checking.
* jobspec: add a chown option to artifact block This PR adds a boolean 'chown' field to the artifact block. It indicates whether the Nomad client should chown the downloaded files and directories to be owned by the task.user. This is useful for drivers like raw_exec and exec2 which are subject to the host filesystem user permissions structure. Before, these drivers might not be able to use or manage the downloaded artifacts since they would be owned by the root user on a typical Nomad client configuration. * api: no need for pointer of chown field
|
I got this on Flatcar Linux this morning: Seems something changed with regards to artifact permissions to read certificates: After upgrading to 1.9.1 -> 1.9.3. Temporarily solved it by setting On Fedora CoreOS machines I do not have this issue (yet). Flatcar info: Fedora CoreOS info: |
|
@ahjohannessen the sandbox controls weren't really impacted by this change other than chowning the artifact. You're not even getting to that step. Can you open a new issue please? |
This PR adds a boolean
chownfield to the artifact block.It indicates whether the Nomad client should
chownthe downloaded filesand directories to be owned by the
task.user. This is useful for driverslike
raw_execandexec2which are subject to the host filesystem userpermissions structure. Before, these drivers might not be able to use or
modify the downloaded artifacts since they would be owned by the root
user on a typical Nomad client configuration.
In this example the
local/javadirectory will recursively become owned by the task's user instead ofroot.Fixes hashicorp/nomad-driver-exec2#51