Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

acl: gate ACL role write and delete RPC usage on v1.4.0 or greater. #14908

Merged
merged 2 commits into from
Oct 18, 2022
Merged

acl: gate ACL role write and delete RPC usage on v1.4.0 or greater. #14908

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
a1299ad
acl: gate ACL role write and delete RPC usage on v1.4.0 or greater.
jrasell Oct 18, 2022
73a94d3
Merge branch 'main' into jrasell/b-gate-acl-role-rpc-write-usage
jrasell Oct 18, 2022
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
3 changes: 3 additions & 0 deletions .changelog/14908.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
```release-note:bug
acl: Ensure all federated servers meet v.1.4.0 minimum before ACL roles can be written
```
14 changes: 14 additions & 0 deletions nomad/acl_endpoint.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -1097,6 +1097,13 @@ func (a *ACL) UpsertRoles(
}
defer metrics.MeasureSince([]string{"nomad", "acl", "upsert_roles"}, time.Now())

// ACL roles can only be used once all servers, in all federated regions
// have been upgraded to 1.4.0 or greater.
if !ServersMeetMinimumVersion(a.srv.Members(), AllRegions, minACLRoleVersion, false) {
return fmt.Errorf("all servers should be running version %v or later to use ACL roles",
minACLRoleVersion)
}

// Only tokens with management level permissions can create ACL roles.
if acl, err := a.srv.ResolveToken(args.AuthToken); err != nil {
return err
Expand Down Expand Up @@ -1233,6 +1240,13 @@ func (a *ACL) DeleteRolesByID(
}
defer metrics.MeasureSince([]string{"nomad", "acl", "delete_roles"}, time.Now())

// ACL roles can only be used once all servers, in all federated regions
jrasell marked this conversation as resolved.
Show resolved Hide resolved
// have been upgraded to 1.4.0 or greater.
if !ServersMeetMinimumVersion(a.srv.Members(), AllRegions, minACLRoleVersion, false) {
return fmt.Errorf("all servers should be running version %v or later to use ACL roles",
minACLRoleVersion)
}

// Only tokens with management level permissions can create ACL roles.
if acl, err := a.srv.ResolveToken(args.AuthToken); err != nil {
return err
Expand Down
5 changes: 5 additions & 0 deletions nomad/leader.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -49,6 +49,11 @@ var minJobRegisterAtomicEvalVersion = version.Must(version.NewVersion("0.12.1"))

var minOneTimeAuthenticationTokenVersion = version.Must(version.NewVersion("1.1.0"))

// minACLRoleVersion is the Nomad version at which the ACL role table was
// introduced. It forms the minimum version all federated servers must meet
// before the feature can be used.
var minACLRoleVersion = version.Must(version.NewVersion("1.4.0"))

// minNomadServiceRegistrationVersion is the Nomad version at which the service
// registrations table was introduced. It forms the minimum version all local
// servers must meet before the feature can be used.
Expand Down