aws / aws/aws-nitro-enclaves-cli

nitro-enclaves-allocator: config file silently ignored without a leading '---' line, misleading error message

Open
#759 0 comments 0 reactions 0 assignees View on GitHub
Dominant language
Rust
Stars
156
Forks
99
PR merge metrics
No merged PRs in 30d

Description

## Summary

`nitro-enclaves-allocator` (installed via `dnf install aws-nitro-enclaves-cli` on Amazon Linux 2023) fails to parse `/etc/nitro_enclaves/allocator.yaml` unless the file begins with a literal YAML document-start marker (`---`) on its own line. Without it, the parser silently skips every line in the file and then reports a confusing error that gives no hint about the real cause.

## Steps to reproduce

1. On an AL2023 host with `aws-nitro-enclaves-cli` installed, write a config file **without** a `---` marker:
```
memory_mib: 4096
cpu_count: 2
```
2. `systemctl restart nitro-enclaves-allocator`
3. `systemctl status nitro-enclaves-allocator` / `journalctl -u nitro-enclaves-allocator`

## Observed

```
Error: Config error: missing memory reservation (`memory_mib`).
```

This is misleading — the value *is* present in the file. Nothing in the message or in the `--help` output points at the actual cause.

## Root cause

In `/usr/bin/nitro-enclaves-allocator` (`parse_config`), the line-reading loop only starts consuming key/value pairs after it sees a line equal to `---`:

```sh
while read line; do
...
[[ "$line" = "---" ]] && { skip=false; continue; }
[[ $skip = false ]] || continue
...
done < "$CONFIG_FILE_PATH"
```

If `---` is never present, `skip` stays `true` for the entire file, so every line is silently skipped via `continue` — including `memory_mib` and `cpu_count` — and the file is effectively parsed as empty. The subsequent validation then reports "missing memory reservation," which is technically true (nothing was parsed) but doesn't point at the actual problem (missing `---`).

## Expected

Either:
- Document the required `---` marker prominently (the packaged example/reference `allocator.yaml`, man page, and the [Getting Started](https://docs.aws.amazon.com/enclaves/latest/user/getting-started.html) docs I found don't mention it), or
- Make the parser tolerate a config file without a leading `---` (most users will write plain `key: value` YAML without a document marker).

## Environment

- OS: Amazon Linux 2023 (x86_64)
- Package: `aws-nitro-enclaves-cli` (dnf-installed, matching `nitro-cli 1.4.5`)

Contributor guide

Open the contributing guide

Research direction

Start by inspecting parse_config in /usr/bin/nitro-enclaves-allocator and reproduce the behavior with the supplied allocator.yaml, systemctl restart, and journalctl commands. Compare the packaged allocator.yaml example, man page, and Getting Started documentation. Done means either configs without a leading --- are parsed correctly or the required marker is prominently documented.

Written by the indexing model from the issue text.

Assessment

Tech stack
shell
Domain
cli, operating-systems
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Quiet
Clarity
Mostly clear
Newbie friendliness
58/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.