Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

docs: warn about UID overlap between workload and Envoy tproxy #24291

Merged
merged 1 commit into from
Oct 24, 2024
Merged

docs: warn about UID overlap between workload and Envoy tproxy #24291

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
3 changes: 3 additions & 0 deletions website/content/docs/integrations/consul/service-mesh.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -159,6 +159,8 @@ Using transparent proxy has several important requirements:
`client_addr`).
* The Consul agent must be configured with [`recursors`][] if you want
allocations to make DNS queries for applications outside the service mesh.
* Your workload's task cannot use the same [Unix user ID (UID)][uid] as the
Envoy sidecar proxy.
* You cannot set a [`network.dns`][] block on the allocation (unless you set
[`no_dns`][tproxy_no_dns], see below).

Expand Down Expand Up @@ -515,3 +517,4 @@ nomad node meta apply -node-id $nodeID \
[consul_dns_port]: /consul/docs/agent/config/config-files#dns_port
[`network.dns`]: /nomad/docs/job-specification/network#dns-parameters
[`client.meta`]: /nomad/docs/configuration/client#meta
[uid]: /nomad/docs/job-specification/transparent_proxy#uid
5 changes: 4 additions & 1 deletion website/content/docs/job-specification/transparent_proxy.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -40,6 +40,8 @@ Using transparent proxy has some important restrictions:
[`no_dns`](#no_dns), see below).
* The node where the allocation is placed must be configured as described in
the Service Mesh integration documentation for [Transparent Proxy][].
* The workload's task cannot use the same Unix user ID (UID) as the Envoy
sidecar proxy.

## `transparent_proxy` Parameters

Expand Down Expand Up @@ -78,7 +80,8 @@ Using transparent proxy has some important restrictions:
* `uid` `(string "101")` - The Unix user ID (UID) used by the Envoy proxy. You
should only set this value if you have a custom build of the Envoy container
image which uses a different UID. You can change the default value for a given
node via [client metadata](#client-metadata) (see below).
node via [client metadata](#client-metadata) (see below). Note that your
workload's task cannot use the same UID as the Envoy sidecar proxy.

## Client Metadata

Expand Down