|
| 1 | +package taskrunner |
| 2 | + |
| 3 | +import ( |
| 4 | + "context" |
| 5 | + "strings" |
| 6 | + |
| 7 | + "github.com/hashicorp/go-hclog" |
| 8 | + "github.com/hashicorp/go-version" |
| 9 | + ifs "github.com/hashicorp/nomad/client/allocrunner/interfaces" |
| 10 | + "github.com/hashicorp/nomad/client/consul" |
| 11 | + "github.com/hashicorp/nomad/nomad/structs" |
| 12 | + "github.com/pkg/errors" |
| 13 | +) |
| 14 | + |
| 15 | +const ( |
| 16 | + // envoyVersionHookName is the name of this hook and appears in logs. |
| 17 | + envoyVersionHookName = "envoy_version" |
| 18 | + |
| 19 | + // envoyLegacyImage is used when the version of Consul is too old to support |
| 20 | + // the SupportedProxies field in the self API. |
| 21 | + // |
| 22 | + // This is the version defaulted by Nomad before v0.13.0 and/or when using versions |
| 23 | + // of Consul before v1.7.8, v1.8.5, and v1.9.0. |
| 24 | + envoyLegacyImage = "envoyproxy/envoy:v1.11.2@sha256:a7769160c9c1a55bb8d07a3b71ce5d64f72b1f665f10d81aa1581bc3cf850d09" |
| 25 | +) |
| 26 | + |
| 27 | +type envoyVersionHookConfig struct { |
| 28 | + alloc *structs.Allocation |
| 29 | + proxiesClient consul.SupportedProxiesAPI |
| 30 | + logger hclog.Logger |
| 31 | +} |
| 32 | + |
| 33 | +func newEnvoyVersionHookConfig(alloc *structs.Allocation, proxiesClient consul.SupportedProxiesAPI, logger hclog.Logger) *envoyVersionHookConfig { |
| 34 | + return &envoyVersionHookConfig{ |
| 35 | + alloc: alloc, |
| 36 | + logger: logger, |
| 37 | + proxiesClient: proxiesClient, |
| 38 | + } |
| 39 | +} |
| 40 | + |
| 41 | +// envoyVersionHook is used to determine and set the Docker image used for Consul |
| 42 | +// Connect sidecar proxy tasks. It will query Consul for a set of preferred Envoy |
| 43 | +// versions if the task image is unset or references ${NOMAD_envoy_version}. Nomad |
| 44 | +// will fallback the image to the previous default Envoy v1.11.2 if Consul is too old |
| 45 | +// to support the supported proxies API. |
| 46 | +type envoyVersionHook struct { |
| 47 | + // alloc is the allocation with the envoy task being rewritten. |
| 48 | + alloc *structs.Allocation |
| 49 | + |
| 50 | + // proxiesClient is the subset of the Consul API for getting information |
| 51 | + // from Consul about the versions of Envoy it supports. |
| 52 | + proxiesClient consul.SupportedProxiesAPI |
| 53 | + |
| 54 | + // logger is used to log things. |
| 55 | + logger hclog.Logger |
| 56 | +} |
| 57 | + |
| 58 | +func newEnvoyVersionHook(c *envoyVersionHookConfig) *envoyVersionHook { |
| 59 | + return &envoyVersionHook{ |
| 60 | + alloc: c.alloc, |
| 61 | + proxiesClient: c.proxiesClient, |
| 62 | + logger: c.logger.Named(envoyVersionHookName), |
| 63 | + } |
| 64 | +} |
| 65 | + |
| 66 | +func (envoyVersionHook) Name() string { |
| 67 | + return envoyVersionHookName |
| 68 | +} |
| 69 | + |
| 70 | +func (h *envoyVersionHook) Prestart(_ context.Context, request *ifs.TaskPrestartRequest, response *ifs.TaskPrestartResponse) error { |
| 71 | + if h.skip(request) { |
| 72 | + response.Done = true |
| 73 | + return nil |
| 74 | + } |
| 75 | + |
| 76 | + // We either need to acquire Consul's preferred Envoy version or fallback |
| 77 | + // to the legacy default. Query Consul and use the (possibly empty) result. |
| 78 | + proxies, err := h.proxiesClient.Proxies() |
| 79 | + if err != nil { |
| 80 | + return errors.Wrap(err, "error retrieving supported Envoy versions from Consul") |
| 81 | + } |
| 82 | + |
| 83 | + // Determine the concrete Envoy image identifier by applying version string |
| 84 | + // substitution (${NOMAD_envoy_version}). |
| 85 | + image, err := h.tweakImage(h.taskImage(request.Task.Config), proxies) |
| 86 | + if err != nil { |
| 87 | + return errors.Wrap(err, "error interpreting desired Envoy version from Consul") |
| 88 | + } |
| 89 | + |
| 90 | + // Set the resulting image. |
| 91 | + h.logger.Trace("setting task envoy image", "image", image) |
| 92 | + request.Task.Config["image"] = image |
| 93 | + response.Done = true |
| 94 | + return nil |
| 95 | +} |
| 96 | + |
| 97 | +// skip will return true if the request does not contain a task that should have |
| 98 | +// its envoy proxy version resolved automatically. |
| 99 | +func (h *envoyVersionHook) skip(request *ifs.TaskPrestartRequest) bool { |
| 100 | + switch { |
| 101 | + case request.Task.Driver != "docker": |
| 102 | + return true |
| 103 | + case !request.Task.UsesConnectSidecar(): |
| 104 | + return true |
| 105 | + case !h.needsVersion(request.Task.Config): |
| 106 | + return true |
| 107 | + } |
| 108 | + return false |
| 109 | +} |
| 110 | + |
| 111 | +// getConfiguredImage extracts the configured config.image value from the request. |
| 112 | +// If the image is empty or not a string, Nomad will fallback to the normal |
| 113 | +// official Envoy image as if the setting was not configured. This is also what |
| 114 | +// Nomad would do if the sidecar_task was not set in the first place. |
| 115 | +func (_ *envoyVersionHook) taskImage(config map[string]interface{}) string { |
| 116 | + value, exists := config["image"] |
| 117 | + if !exists { |
| 118 | + return structs.EnvoyImageFormat |
| 119 | + } |
| 120 | + |
| 121 | + image, ok := value.(string) |
| 122 | + if !ok { |
| 123 | + return structs.EnvoyImageFormat |
| 124 | + } |
| 125 | + |
| 126 | + return image |
| 127 | +} |
| 128 | + |
| 129 | +// needsVersion returns true if the docker.config.image is making use of the |
| 130 | +// ${NOMAD_envoy_version} faux environment variable. |
| 131 | +// Nomad does not need to query Consul to get the preferred Envoy version, etc.) |
| 132 | +func (h *envoyVersionHook) needsVersion(config map[string]interface{}) bool { |
| 133 | + if len(config) == 0 { |
| 134 | + return false |
| 135 | + } |
| 136 | + |
| 137 | + image := h.taskImage(config) |
| 138 | + |
| 139 | + return strings.Contains(image, structs.EnvoyVersionVar) |
| 140 | +} |
| 141 | + |
| 142 | +// image determines the best Envoy version to use. If supported is nil or empty |
| 143 | +// Nomad will fallback to the legacy envoy image used before Nomad v0.13. |
| 144 | +func (_ *envoyVersionHook) tweakImage(configured string, supported map[string][]string) (string, error) { |
| 145 | + versions := supported["envoy"] |
| 146 | + if len(versions) == 0 { |
| 147 | + return envoyLegacyImage, nil |
| 148 | + } |
| 149 | + |
| 150 | + latest, err := semver(versions[0]) |
| 151 | + if err != nil { |
| 152 | + return "", err |
| 153 | + } |
| 154 | + |
| 155 | + return strings.ReplaceAll(configured, structs.EnvoyVersionVar, latest), nil |
| 156 | +} |
| 157 | + |
| 158 | +// semver sanitizes the envoy version string coming from Consul into the format |
| 159 | +// used by the Envoy project when publishing images (i.e. proper semver). This |
| 160 | +// resulting string value does NOT contain the 'v' prefix for 2 reasons: |
| 161 | +// 1) the version library does not include the 'v' |
| 162 | +// 2) its plausible unofficial images use the 3 numbers without the prefix for |
| 163 | +// tagging their own images |
| 164 | +func semver(chosen string) (string, error) { |
| 165 | + v, err := version.NewVersion(chosen) |
| 166 | + if err != nil { |
| 167 | + return "", errors.Wrap(err, "unexpected envoy version format") |
| 168 | + } |
| 169 | + return v.String(), nil |
| 170 | +} |
0 commit comments