Skip to content
GitLab
Projects
Groups
Snippets
Help
Loading...
Help
Help
Support
Community forum
Keyboard shortcuts
?
Submit feedback
Contribute to GitLab
Sign in
Toggle navigation
C
container-manager
Project overview
Project overview
Details
Activity
Releases
Repository
Repository
Files
Commits
Branches
Tags
Contributors
Graph
Compare
Issues
1
Issues
1
List
Boards
Labels
Service Desk
Milestones
Merge Requests
1
Merge Requests
1
CI / CD
CI / CD
Pipelines
Jobs
Schedules
Operations
Operations
Incidents
Environments
Packages & Registries
Packages & Registries
Container Registry
Analytics
Analytics
CI / CD
Repository
Value Stream
Wiki
Wiki
Snippets
Snippets
Members
Members
Collapse sidebar
Close sidebar
Activity
Graph
Create a new issue
Jobs
Commits
Issue Boards
Open sidebar
nomad-lab
container-manager
Commits
e48b9d7a
Commit
e48b9d7a
authored
Nov 29, 2018
by
Fawzi Mohamed
Browse files
Options
Browse Files
Download
Email Patches
Plain Diff
secure kube templates against injection
parent
3f8e5fd3
Changes
5
Hide whitespace changes
Inline
Side-by-side
Showing
5 changed files
with
69 additions
and
56 deletions
+69
-56
app/components.js
app/components.js
+13
-0
templates/kube/defaultTemplate.yaml
templates/kube/defaultTemplate.yaml
+24
-24
templates/kube/jupyterTemplate.yaml
templates/kube/jupyterTemplate.yaml
+22
-22
templates/kube/namespace.yaml
templates/kube/namespace.yaml
+1
-1
templates/kube/remoteVisTemplate.yaml
templates/kube/remoteVisTemplate.yaml
+9
-9
No files found.
app/components.js
View file @
e48b9d7a
...
...
@@ -31,6 +31,19 @@ handlebars.registerHelper('prettyJson', function(object){
return
stringify
(
object
,
null
,
2
);
});
// guarantees an integer number
handlebars
.
registerHelper
(
'
n
'
,
function
(
object
){
return
~~
object
});
// escapes so that the object can go in a double quote (") string
handlebars
.
registerHelper
(
'
e
'
,
function
(
object
){
let
s
=
stringify
(
object
)
if
(
!
s
.
startsWith
(
'
"
'
))
s
=
stringify
(
s
)
return
new
Handlebars
.
SafeString
(
s
.
slice
(
1
,
s
.
length
-
1
))
});
// Create a template from the given string
function
templatize
(
str
)
{
return
handlebars
.
compile
(
str
)
...
...
templates/kube/defaultTemplate.yaml
View file @
e48b9d7a
...
...
@@ -2,21 +2,21 @@
apiVersion
:
"
v1"
kind
:
Pod
metadata
:
name
:
"
{{podName}}"
name
:
"
{{
e
podName}}"
labels
:
user
:
"
{{user}}"
image-type
:
"
{{imageType}}"
image-subtype
:
"
{{imageSubtype}}"
replacements-checksum
:
"
{{replacementsChecksum}}"
user
:
"
{{
e
user}}"
image-type
:
"
{{
e
imageType}}"
image-subtype
:
"
{{
e
imageSubtype}}"
replacements-checksum
:
"
{{
e
replacementsChecksum}}"
spec
:
imagePullSecrets
:
-
name
:
garching-kube
restartPolicy
:
Never
containers
:
-
image
:
"
{{image}}"
name
:
"
{{imageType}}"
-
image
:
"
{{
e
image}}"
name
:
"
{{
e
imageType}}"
ports
:
-
containerPort
:
{{
port
}}
-
containerPort
:
{{
e
port
}}
name
:
"
main-port"
protocol
:
"
TCP"
imagePullPolicy
:
"
IfNotPresent"
...
...
@@ -30,35 +30,35 @@ spec:
-
mountPath
:
"
/normalized"
name
:
"
normalized-data-volume"
readOnly
:
true
-
mountPath
:
"
/data/private/{{user}}"
-
mountPath
:
"
/data/private/{{
e
user}}"
name
:
"
private-data-volume"
-
mountPath
:
"
/data/shared"
name
:
"
shared-data-volume"
readOnly
:
true
-
mountPath
:
"
/data/shared/{{user}}"
-
mountPath
:
"
/data/shared/{{
e
user}}"
name
:
"
my-shared-data-volume"
readinessProbe
:
httpGet
:
path
:
"
{{healthPath}}"
port
:
{{
port
}}
initialDelaySeconds
:
{{
healthDelay
}}
periodSeconds
:
{{
healthPeriod
}}
path
:
"
{{
e
healthPath}}"
port
:
{{
n
port
}}
initialDelaySeconds
:
{{
n
healthDelay
}}
periodSeconds
:
{{
n
healthPeriod
}}
livenessProbe
:
httpGet
:
path
:
"
{{livePath}}"
port
:
{{
port
}}
initialDelaySeconds
:
{{
liveDelay
}}
periodSeconds
:
{{
livePeriod
}}
path
:
"
{{
e
livePath}}"
port
:
{{
n
port
}}
initialDelaySeconds
:
{{
n
liveDelay
}}
periodSeconds
:
{{
n
livePeriod
}}
volumes
:
-
name
:
"
parsed-data-volume"
hostPath
:
{
"
path"
:
"
{{nomadRoot}}/parsed"
}
hostPath
:
{
"
path"
:
"
{{
e
nomadRoot}}/parsed"
}
-
name
:
"
raw-data-volume"
hostPath
:
{
"
path"
:
"
{{nomadRoot}}/raw-data"
}
hostPath
:
{
"
path"
:
"
{{
e
nomadRoot}}/raw-data"
}
-
name
:
"
normalized-data-volume"
hostPath
:
{
"
path"
:
"
{{nomadRoot}}/normalized"
}
hostPath
:
{
"
path"
:
"
{{
e
nomadRoot}}/normalized"
}
-
name
:
"
private-data-volume"
hostPath
:
{
"
path"
:
"
{{
nomadRoot}}/user-data/private/{{
user}}"
}
hostPath
:
{
"
path"
:
"
{{
e
nomadRoot}}/user-data/private/{{e
user}}"
}
-
name
:
"
shared-data-volume"
hostPath
:
{
"
path"
:
"
{{nomadRoot}}/user-data/shared"
}
hostPath
:
{
"
path"
:
"
{{
e
nomadRoot}}/user-data/shared"
}
-
name
:
"
my-shared-data-volume"
hostPath
:
{
"
path"
:
"
{{
nomadRoot}}/user-data/shared/{{
user}}"
}
hostPath
:
{
"
path"
:
"
{{
e
nomadRoot}}/user-data/shared/{{e
user}}"
}
templates/kube/jupyterTemplate.yaml
View file @
e48b9d7a
...
...
@@ -2,23 +2,23 @@
apiVersion
:
"
v1"
kind
:
Pod
metadata
:
name
:
"
{{podName}}"
name
:
"
{{
e
podName}}"
labels
:
user
:
"
{{user}}"
image-type
:
"
{{imageType}}"
image-subtype
:
"
{{imageSubtype}}"
replacements-checksum
:
"
{{replacementsChecksum}}"
user
:
"
{{
e
user}}"
image-type
:
"
{{
e
imageType}}"
image-subtype
:
"
{{
e
imageSubtype}}"
replacements-checksum
:
"
{{
e
replacementsChecksum}}"
spec
:
imagePullSecrets
:
-
name
:
garching-kube
restartPolicy
:
Never
containers
:
-
image
:
"
{{image}}"
name
:
"
{{imageType}}"
-
image
:
"
{{
e
image}}"
name
:
"
{{
e
imageType}}"
command
:
[
"
start-notebook.sh"
]
args
:
[
"
--NotebookApp.token=
\"\"
"
,
"
--NotebookApp.base_url=/jupyter"
,
"
--NotebookApp.allow_origin=*"
,
"
--NotebookApp.notebook_dir=/data/private/"
]
ports
:
-
containerPort
:
{{
port
}}
-
containerPort
:
{{
n
port
}}
name
:
"
main-port"
protocol
:
"
TCP"
imagePullPolicy
:
"
IfNotPresent"
...
...
@@ -41,26 +41,26 @@ spec:
name
:
"
my-shared-data-volume"
readinessProbe
:
httpGet
:
path
:
"
{{healthPath}}"
port
:
{{
port
}}
initialDelaySeconds
:
{{
healthDelay
}}
periodSeconds
:
{{
healthPeriod
}}
path
:
"
{{
e
healthPath}}"
port
:
{{
n
port
}}
initialDelaySeconds
:
{{
n
healthDelay
}}
periodSeconds
:
{{
n
healthPeriod
}}
livenessProbe
:
httpGet
:
path
:
"
{{livePath}}"
port
:
{{
port
}}
initialDelaySeconds
:
{{
liveDelay
}}
periodSeconds
:
{{
livePeriod
}}
path
:
"
{{
e
livePath}}"
port
:
{{
n
port
}}
initialDelaySeconds
:
{{
n
liveDelay
}}
periodSeconds
:
{{
n
livePeriod
}}
volumes
:
-
name
:
"
parsed-data-volume"
hostPath
:
{
"
path"
:
"
{{nomadRoot}}/parsed"
}
hostPath
:
{
"
path"
:
"
{{
e
nomadRoot}}/parsed"
}
-
name
:
"
raw-data-volume"
hostPath
:
{
"
path"
:
"
{{nomadRoot}}/raw-data"
}
hostPath
:
{
"
path"
:
"
{{
e
nomadRoot}}/raw-data"
}
-
name
:
"
normalized-data-volume"
hostPath
:
{
"
path"
:
"
{{nomadRoot}}/normalized"
}
hostPath
:
{
"
path"
:
"
{{
e
nomadRoot}}/normalized"
}
-
name
:
"
private-data-volume"
hostPath
:
{
"
path"
:
"
{{
nomadRoot}}/user-data/private/{{
user}}"
}
hostPath
:
{
"
path"
:
"
{{
e
nomadRoot}}/user-data/private/{{e
user}}"
}
-
name
:
"
shared-data-volume"
hostPath
:
{
"
path"
:
"
{{nomadRoot}}/user-data/shared"
}
hostPath
:
{
"
path"
:
"
{{
e
nomadRoot}}/user-data/shared"
}
-
name
:
"
my-shared-data-volume"
hostPath
:
{
"
path"
:
"
{{
nomadRoot}}/user-data/shared/{{
user}}"
}
hostPath
:
{
"
path"
:
"
{{
e
nomadRoot}}/user-data/shared/{{e
user}}"
}
templates/kube/namespace.yaml
View file @
e48b9d7a
kind
:
Namespace
apiVersion
:
v1
metadata
:
name
:
{{
namespace
}}
name
:
"
{{e
namespace}}"
templates/kube/remoteVisTemplate.yaml
View file @
e48b9d7a
apiVersion
:
v1
kind
:
Pod
metadata
:
name
:
{{
podName
}}
name
:
"
{{e
podName}}"
labels
:
user
:
"
{{user}}"
image-type
:
"
{{imageType}}"
image-subtype
:
"
{{imageSubtype}}"
replacements-checksum
:
"
{{replacementsChecksum}}"
user
:
"
{{
e
user}}"
image-type
:
"
{{
e
imageType}}"
image-subtype
:
"
{{
e
imageSubtype}}"
replacements-checksum
:
"
{{
e
replacementsChecksum}}"
spec
:
terminationGracePeriodSeconds
:
5
restartPolicy
:
Never
...
...
@@ -17,9 +17,9 @@ spec:
args
:
[
"
/software/scripts/startup.sh"
]
env
:
-
name
:
USERNAME
value
:
{{
user
}}
value
:
"
{{e
user}}"
-
name
:
DATAPID
value
:
{{
datapid
}}
value
:
"
{{e
datapid}}"
volumeMounts
:
-
mountPath
:
/data/test
name
:
data-test
...
...
@@ -58,10 +58,10 @@ spec:
path
:
/nomad/mcompo/CO2-CaO
-
name
:
data-shared
hostPath
:
path
:
/nomad/nomadlab/user-data/shared/{{user}}
path
:
"
/nomad/nomadlab/user-data/shared/{{e
user}}"
-
name
:
data-private
hostPath
:
path
:
/nomad/nomadlab/user-data/private/{{user}}
path
:
"
/nomad/nomadlab/user-data/private/{{e
user}}"
-
name
:
nginx-volume
hostPath
:
path
:
/etc/nginx/ssl
...
...
Write
Preview
Markdown
is supported
0%
Try again
or
attach a new file
.
Attach a file
Cancel
You are about to add
0
people
to the discussion. Proceed with caution.
Finish editing this message first!
Cancel
Please
register
or
sign in
to comment