From 4a70b0a6a74ad7ec93f0485668aeadeb3797909b Mon Sep 17 00:00:00 2001 From: hc-github-team-nomad-core <82989552+hc-github-team-nomad-core@users.noreply.github.com> Date: Tue, 26 Mar 2024 10:14:45 -0500 Subject: [PATCH] Backport of namespace/node pool: forward RPCs cross-region if ACLs aren't enabled into release/1.6.x (#20229) Co-authored-by: Tim Gross --- .changelog/20220.txt | 3 +++ nomad/namespace_endpoint.go | 12 ++++++++++-- nomad/node_pool_endpoint.go | 12 ++++++++++-- 3 files changed, 23 insertions(+), 4 deletions(-) create mode 100644 .changelog/20220.txt diff --git a/.changelog/20220.txt b/.changelog/20220.txt new file mode 100644 index 00000000000..e4df9136fba --- /dev/null +++ b/.changelog/20220.txt @@ -0,0 +1,3 @@ +```release-note:bug +namespace/node pool: Fixed a bug where the `-region` flag would not be respected for namespace and node pool updates if ACLs were disabled +``` diff --git a/nomad/namespace_endpoint.go b/nomad/namespace_endpoint.go index 5e9b5073e4d..eba96052c36 100644 --- a/nomad/namespace_endpoint.go +++ b/nomad/namespace_endpoint.go @@ -30,7 +30,11 @@ func (n *Namespace) UpsertNamespaces(args *structs.NamespaceUpsertRequest, reply *structs.GenericResponse) error { authErr := n.srv.Authenticate(n.ctx, args) - args.Region = n.srv.config.AuthoritativeRegion + if n.srv.config.ACLEnabled || args.Region == "" { + // only forward to the authoritative region if ACLs are enabled, + // otherwise we silently write to the local region + args.Region = n.srv.config.AuthoritativeRegion + } if done, err := n.srv.forward("Namespace.UpsertNamespaces", args, args, reply); done { return err } @@ -77,7 +81,11 @@ func (n *Namespace) UpsertNamespaces(args *structs.NamespaceUpsertRequest, func (n *Namespace) DeleteNamespaces(args *structs.NamespaceDeleteRequest, reply *structs.GenericResponse) error { authErr := n.srv.Authenticate(n.ctx, args) - args.Region = n.srv.config.AuthoritativeRegion + if n.srv.config.ACLEnabled || args.Region == "" { + // only forward to the authoritative region if ACLs are enabled, + // otherwise we silently write to the local region + args.Region = n.srv.config.AuthoritativeRegion + } if done, err := n.srv.forward("Namespace.DeleteNamespaces", args, args, reply); done { return err } diff --git a/nomad/node_pool_endpoint.go b/nomad/node_pool_endpoint.go index ac71ba72102..56e55697120 100644 --- a/nomad/node_pool_endpoint.go +++ b/nomad/node_pool_endpoint.go @@ -170,7 +170,11 @@ func (n *NodePool) GetNodePool(args *structs.NodePoolSpecificRequest, reply *str // cannot be updated. func (n *NodePool) UpsertNodePools(args *structs.NodePoolUpsertRequest, reply *structs.GenericResponse) error { authErr := n.srv.Authenticate(n.ctx, args) - args.Region = n.srv.config.AuthoritativeRegion + if n.srv.config.ACLEnabled || args.Region == "" { + // only forward to the authoritative region if ACLs are enabled, + // otherwise we silently write to the local region + args.Region = n.srv.config.AuthoritativeRegion + } if done, err := n.srv.forward("NodePool.UpsertNodePools", args, args, reply); done { return err } @@ -231,7 +235,11 @@ func (n *NodePool) UpsertNodePools(args *structs.NodePoolUpsertRequest, reply *s // deleted. func (n *NodePool) DeleteNodePools(args *structs.NodePoolDeleteRequest, reply *structs.GenericResponse) error { authErr := n.srv.Authenticate(n.ctx, args) - args.Region = n.srv.config.AuthoritativeRegion + if n.srv.config.ACLEnabled || args.Region == "" { + // only forward to the authoritative region if ACLs are enabled, + // otherwise we silently write to the local region + args.Region = n.srv.config.AuthoritativeRegion + } if done, err := n.srv.forward("NodePool.DeleteNodePools", args, args, reply); done { return err }