Repository: hashicorp/nomad
File: nomad/job_endpoint_hook_connect.go (Go)

Code before:
	for _, network := range g.Networks {
		for _, reservedPort := range network.ReservedPorts {
			if reservedPort.Label == portLabel {
				return true
			}
		}
	}
	return false
}

func groupConnectNetworkModeValidate(g *structs.TaskGroup, errorPrefix string, allowHost bool) (warn, err error) {
	if nn := len(g.Networks); nn != 1 {
		return nil, fmt.Errorf("%s: %w: group %q has %d networks",
			errorPrefix, ErrConnectRequireOneNetwork, g.Name, nn)
	}

	mode := g.Networks[0].Mode

	if mode == "bridge" || (allowHost && mode == "host") {
		return nil, nil
	}

	if strings.HasPrefix(mode, "cni/") {
		warn = fmt.Errorf("%s: %w: group %q uses network mode %q",
			errorPrefix, ErrConnectWithCNIWarning, g.Name, mode)
		return warn, nil
	}

	// helpful error message
	allowed := `"bridge" or "cni/*"`
	if allowHost {
		allowed = `"bridge", "host", or "cni/*"`
	}
	return nil, fmt.Errorf("%s: %w: group %q uses network mode %q; must be %s",
		errorPrefix, ErrConnectInvalidNetworkMode, g.Name, mode, allowed)
}

func groupConnectSidecarValidate(g *structs.TaskGroup, s *structs.Service) (warn, err error) {
	warn, err = groupConnectNetworkModeValidate(g, "connect sidecar", false)
	if err != nil {
		return warn, err
	}

	// We must enforce lowercase characters on group and service names for connect
	// sidecar proxies, because Consul assumes this invariant without validating it.
	// https://github.com/hashicorp/consul/blob/v1.9.5/command/connect/proxy/proxy.go#L235

	if s.Name != strings.ToLower(s.Name) {
		return warn, fmt.Errorf("Consul Connect service name %q in group %q must not contain uppercase characters", s.Name, g.Name)
	}


Review comment (suggestion):
This seems like a reasonable idea on its face but you're probably going to have your whole cluster wired up the same way, which means you're going to get a warning every single time you submit a job forever. As much as it might darkly amuse me to annoy someone doing this :grin: , I'm not sure it makes sense to add this to the warnings instead of telling people what the risks are in the docs.

Code after:
func groupConnectNetworkModeValidate(g *structs.TaskGroup, errorPrefix string, allowHost bool) error {
	if nn := len(g.Networks); nn != 1 {
		return fmt.Errorf("%s: %w: group %q has %d networks",
			errorPrefix, ErrConnectRequireOneNetwork, g.Name, nn)
	}

	mode := g.Networks[0].Mode
	if mode == "bridge" || (allowHost && mode == "host") || strings.HasPrefix(mode, "cni/") {
		return nil
	}

	// helpful error message
	allowed := `"bridge" or "cni/*"`
	if allowHost {
		allowed = `"bridge", "host", or "cni/*"`
	}
	return fmt.Errorf("%s: %w: group %q uses network mode %q; must be %s",
		errorPrefix, ErrConnectInvalidNetworkMode, g.Name, mode, allowed)
}

func groupConnectSidecarValidate(g *structs.TaskGroup, s *structs.Service) error {
	if err := groupConnectNetworkModeValidate(g, "connect sidecar", false); err != nil {
		return err
	}

	// We must enforce lowercase characters on group and service names for connect
	// sidecar proxies, because Consul assumes this invariant without validating it.
	// https://github.com/hashicorp/consul/blob/v1.9.5/command/connect/proxy/proxy.go#L235

	if s.Name != strings.ToLower(s.Name) {
		return fmt.Errorf("Consul Connect service name %q in group %q must not contain uppercase characters", s.Name, g.Name)
	}

	if g.Name != strings.ToLower(g.Name) {
		return fmt.Errorf("Consul Connect group %q with service %q must not contain uppercase characters", g.Name, s.Name)
	}

	return nil
}

func groupConnectNativeValidate(g *structs.TaskGroup, s *structs.Service) error {
	// note that network mode is not enforced for connect native services

	if _, err := getNamedTaskForNativeService(g, s.Name, s.TaskName); err != nil {
		return err
	}
	return nil
}

func groupConnectGatewayValidate(g *structs.TaskGroup) error {
	// note that gateways can run in host network mode