Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

Deployment Status Command Does Not Respect -namespace Wildcard #16792

Merged
merged 7 commits into from
Apr 12, 2023
Merged

Deployment Status Command Does Not Respect -namespace Wildcard #16792

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
7 commits
Select commit Hold shift + click to select a range
0da9033
func: add namespace support for list deployment
Juanadelacuesta Apr 5, 2023
7ee10ee
func: add wildcard to namespace filter for deployments
Juanadelacuesta Apr 11, 2023
4403656
Update deployment_endpoint.go
Juanadelacuesta Apr 11, 2023
78ba537
style: use must instead of require or asseert
Juanadelacuesta Apr 11, 2023
e87ddbe
style: rename paginator to avoid clash with import
Juanadelacuesta Apr 11, 2023
f6e1ecd
style: add changelog entry
Juanadelacuesta Apr 11, 2023
25e4c7c
fix: add missing parameter for upsert jobs
Juanadelacuesta Apr 11, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Jump to
Jump to file
Failed to load files.
Diff view
Diff view
3 changes: 3 additions & 0 deletions .changelog/16792.txt
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -0,0 +1,3 @@
```release-note:bug
core: the deployment's list endpoint now supports look up by prefix using the wildcard for namespace
```
33 changes: 27 additions & 6 deletions nomad/deployment_endpoint.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -450,20 +450,33 @@ func (d *Deployment) List(args *structs.DeploymentListRequest, reply *structs.De

// Check namespace read-job permissions against request namespace since
// results are filtered by request namespace.
if aclObj, err := d.srv.ResolveACL(args); err != nil {
aclObj, err := d.srv.ResolveACL(args)
if err != nil {
return err
} else if aclObj != nil && !aclObj.AllowNsOp(namespace, acl.NamespaceCapabilityReadJob) {
}

if aclObj != nil && !aclObj.AllowNsOp(namespace, acl.NamespaceCapabilityReadJob) {
return structs.ErrPermissionDenied
}

allow := aclObj.AllowNsOpFunc(acl.NamespaceCapabilityReadJob)

// Setup the blocking query
sort := state.SortOption(args.Reverse)
opts := blockingOptions{
queryOpts: &args.QueryOptions,
queryMeta: &reply.QueryMeta,
run: func(ws memdb.WatchSet, store *state.StateStore) error {
allowableNamespaces, err := allowedNSes(aclObj, store, allow)
if err != nil {
if err == structs.ErrPermissionDenied {
reply.Deployments = make([]*structs.Deployment, 0)
return nil
}
return err
}
Comment on lines +470 to +477
Copy link
Member

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Not blocking but something we might want to get agreement on with the team and then document in our RPC checklist...

There's a small inconsistency here between the behavior of the first permissions check (on line 458) and this permissions check in the blocking query:

  • If you have no permission to any namespace when you make the query, you get ErrPermissionDenied
  • If you have permissions and make a blocking query, and while you're waiting on the blocking query the permissions are removed, you get an empty list.

I spot-checked some of the other List RPCs and it looks like we're inconsistent with this across the code base; some RPCs have both checks (ex. Eval.List, Job.List) while others only have the second check (ex. Namespaces.ListNamespace, Variables.List).


// Capture all the deployments
var err error
var iter memdb.ResultIterator
var opts paginator.StructsTokenizerOptions

Expand Down Expand Up @@ -491,8 +504,14 @@ func (d *Deployment) List(args *structs.DeploymentListRequest, reply *structs.De

tokenizer := paginator.NewStructsTokenizer(iter, opts)

filters := []paginator.Filter{
paginator.NamespaceFilter{
AllowableNamespaces: allowableNamespaces,
},
}

var deploys []*structs.Deployment
paginator, err := paginator.NewPaginator(iter, tokenizer, nil, args.QueryOptions,
pnator, err := paginator.NewPaginator(iter, tokenizer, filters, args.QueryOptions,
func(raw interface{}) error {
deploy := raw.(*structs.Deployment)
deploys = append(deploys, deploy)
Expand All @@ -503,7 +522,7 @@ func (d *Deployment) List(args *structs.DeploymentListRequest, reply *structs.De
http.StatusBadRequest, "failed to create result paginator: %v", err)
}

nextToken, err := paginator.Page()
nextToken, err := pnator.Page()
if err != nil {
return structs.NewErrRPCCodedf(
http.StatusBadRequest, "failed to read result page: %v", err)
Expand All @@ -522,7 +541,9 @@ func (d *Deployment) List(args *structs.DeploymentListRequest, reply *structs.De
// Set the query response
d.srv.setQueryMeta(&reply.QueryMeta)
return nil
}}
},
}

return d.srv.blockingRPC(&opts)
}

Expand Down