hashicorp / hashicorp/nomad

ACLs filter allocation resource usage on Node API

Open
#9,655 5 comments 0 reactions 0 assignees View on GitHub
hcc/cst theme/auth type/bug
Dominant language
Go
Stars
17k
Forks
2.1k
Avg merge
1d 9h
Merged PRs (30d)
105

Description

If filing a bug please include the following:

### Nomad version
Nomad v1.0.0 (cfca6405ad9b5f66dffc8843e3d16f92f3bedb43)

### Operating system and Environment details

Operating system:
- Architecture.......: "x86_64"
- CPU Cores..........: "8"
- Memory.............: "16046" Mb
- OS.................: "Ubuntu"
- Release............: "16.04"
- Kernel.............: "4.4.0-131-generic"

Nomad ACL Enabled.

### Issue

API Call [/v1/node/:node_id/allocations](https://www.nomadproject.io/api-docs/nodes#list-node-allocations) return empty list even allocations presented on node

### Reproduction steps

Simple curl request on node with allocations `curl -v --header "X-Nomad-Token: " "http://:4646/v1/node//allocations"` return empty list

```
< HTTP/1.1 200 OK
< Content-Type: application/json
< Vary: Accept-Encoding
< X-Nomad-Index: 159510
< X-Nomad-Knownleader: true
< X-Nomad-Lastcontact: 0
< Date: Wed, 16 Dec 2020 21:56:13 GMT
< Content-Length: 2
<
[]
```

Second request with index param `curl --header "X-Nomad-Token: " "http://:4646/v1/node//allocations?index=159510"` return empty list after wait about minute.

```
> GET /v1/node//allocations?index=159510 HTTP/1.1
> User-Agent: curl/7.47.0
> Accept: */*
> X-Nomad-Token:
>
< HTTP/1.1 200 OK
< Content-Type: application/json
< Vary: Accept-Encoding
< X-Nomad-Index: 159510
< X-Nomad-Knownleader: true
< X-Nomad-Lastcontact: 0
< Date: Wed, 16 Dec 2020 22:25:44 GMT
< Content-Length: 2
<
[]
```

Token has policies described in docs

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by reproducing the GET /v1/node/:node_id/allocations request with ACLs enabled and the documented token policy, then compare the result with the allocations shown on that node. Trace the Node API allocation filtering and verify the fix with an ACL-enabled request where authorized allocations are returned rather than an empty list.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
api, authorization, backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
25/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.