backport of commit 7d08e79

.github/dependabot.yml

@@ -40,3 +40,13 @@ updates:
     labels:
       - "theme/dependencies"
       - "theme/website"
+  - package-ecosystem: github-actions
+    open-pull-requests-limit: 5
+    directory: /
+    labels:
+      - "theme/dependencies"
+      - "theme/ci"
+    schedule:
+      interval: "weekly"
+      day: "sunday"
+      time: "09:00"

.github/workflows/checks.yaml

@@ -43,7 +43,7 @@ jobs:
         run: git config --global url.'https://${{ env.ELEVATED_GITHUB_TOKEN }}@github.com'.insteadOf 'https://github.com'
       - uses: actions/setup-go@f111f3307d8850f501ac008e886eec1fd1932a34 # v5.3.0
         with:
-          cache: ${{ contains(runner.name, 'Github Actions') }}
+          cache: true
           go-version-file: .go-version
           cache-dependency-path: '**/go.sum'
       - name: Run make check

.gitignore

@@ -137,10 +137,3 @@ tools/missing/missing
 
 # allow security scanner file
 !scan.hcl
-
-# generated variables for upgrade tests
-enos.vars.hcl
-enos/modules/*/*.tfvars
-
-# local license files
-*.hclic

CODEOWNERS

@@ -2,20 +2,3 @@
 
 /.release/                              @hashicorp/github-nomad-core @hashicorp/nomad-eng
 /.github/workflows/build.yml            @hashicorp/github-nomad-core @hashicorp/nomad-eng
-
-# codeowner default
-*                              @hashicorp/github-nomad-core @hashicorp/nomad-eng
-
-
-# engineering and web presence get notified of, and can approve changes to web tooling, but not content.
-
-/website/               @hashicorp/web-presence @hashicorp/github-nomad-core @hashicorp/nomad-eng
-/website/data/
-/website/public/
-/website/content/
-
-# education and engineering get notified of, and can approve changes to web content.
-
-/website/data/          @hashicorp/nomad-docs @hashicorp/github-nomad-core @hashicorp/nomad-eng
-/website/public/        @hashicorp/nomad-docs @hashicorp/github-nomad-core @hashicorp/nomad-eng
-/website/content/       @hashicorp/nomad-docs @hashicorp/github-nomad-core @hashicorp/nomad-eng

GNUmakefile

@@ -23,7 +23,7 @@ ifndef BIN
 BIN := $(GOPATH)/bin
 endif
 
-GO_TAGS := hashicorpmetrics $(GO_TAGS)
+GO_TAGS := $(GO_TAGS)
 
 ifeq ($(CI),true)
 GO_TAGS := codegen_generated $(GO_TAGS)

acl/acl_test.go

@@ -79,12 +79,10 @@ func TestACLManagement(t *testing.T) {
 	// Check default namespace rights
 	must.True(t, acl.AllowNamespaceOperation("default", NamespaceCapabilityListJobs))
 	must.True(t, acl.AllowNamespaceOperation("default", NamespaceCapabilitySubmitJob))
-	must.True(t, acl.AllowNamespaceOperation("default", NamespaceCapabilityHostVolumeCreate))
 	must.True(t, acl.AllowNamespace("default"))
 
 	// Check non-specified namespace
 	must.True(t, acl.AllowNamespaceOperation("foo", NamespaceCapabilityListJobs))
-	must.True(t, acl.AllowNamespaceOperation("foo", NamespaceCapabilityHostVolumeCreate))
 	must.True(t, acl.AllowNamespace("foo"))
 
 	// Check node pool rights.
@@ -157,11 +155,9 @@ func TestACLMerge(t *testing.T) {
 	// Check default namespace rights
 	must.True(t, acl.AllowNamespaceOperation("default", NamespaceCapabilityListJobs))
 	must.False(t, acl.AllowNamespaceOperation("default", NamespaceCapabilitySubmitJob))
-	must.False(t, acl.AllowNamespaceOperation("default", NamespaceCapabilityHostVolumeRegister))
 
 	// Check non-specified namespace
 	must.False(t, acl.AllowNamespaceOperation("foo", NamespaceCapabilityListJobs))
-	must.False(t, acl.AllowNamespaceOperation("foo", NamespaceCapabilityHostVolumeCreate))
 
 	// Check rights in the node pool specified in policies.
 	must.True(t, acl.AllowNodePoolOperation("my-pool", NodePoolCapabilityRead))

acl/policy.go

@@ -47,11 +47,6 @@ const (
 	NamespaceCapabilityCSIReadVolume        = "csi-read-volume"
 	NamespaceCapabilityCSIListVolume        = "csi-list-volume"
 	NamespaceCapabilityCSIMountVolume       = "csi-mount-volume"
-	NamespaceCapabilityHostVolumeCreate     = "host-volume-create"
-	NamespaceCapabilityHostVolumeRegister   = "host-volume-register"
-	NamespaceCapabilityHostVolumeRead       = "host-volume-read"
-	NamespaceCapabilityHostVolumeWrite      = "host-volume-write"
-	NamespaceCapabilityHostVolumeDelete     = "host-volume-delete"
 	NamespaceCapabilityListScalingPolicies  = "list-scaling-policies"
 	NamespaceCapabilityReadScalingPolicy    = "read-scaling-policy"
 	NamespaceCapabilityReadJobScaling       = "read-job-scaling"
@@ -212,7 +207,7 @@ func isNamespaceCapabilityValid(cap string) bool {
 		NamespaceCapabilityReadFS, NamespaceCapabilityAllocLifecycle,
 		NamespaceCapabilityAllocExec, NamespaceCapabilityAllocNodeExec,
 		NamespaceCapabilityCSIReadVolume, NamespaceCapabilityCSIWriteVolume, NamespaceCapabilityCSIListVolume, NamespaceCapabilityCSIMountVolume, NamespaceCapabilityCSIRegisterPlugin,
-		NamespaceCapabilityListScalingPolicies, NamespaceCapabilityReadScalingPolicy, NamespaceCapabilityReadJobScaling, NamespaceCapabilityScaleJob, NamespaceCapabilityHostVolumeCreate, NamespaceCapabilityHostVolumeRegister, NamespaceCapabilityHostVolumeWrite, NamespaceCapabilityHostVolumeRead:
+		NamespaceCapabilityListScalingPolicies, NamespaceCapabilityReadScalingPolicy, NamespaceCapabilityReadJobScaling, NamespaceCapabilityScaleJob:
 		return true
 	// Separate the enterprise-only capabilities
 	case NamespaceCapabilitySentinelOverride, NamespaceCapabilitySubmitRecommendation:
@@ -246,7 +241,6 @@ func expandNamespacePolicy(policy string) []string {
 		NamespaceCapabilityReadJobScaling,
 		NamespaceCapabilityListScalingPolicies,
 		NamespaceCapabilityReadScalingPolicy,
-		NamespaceCapabilityHostVolumeRead,
 	}
 
 	write := make([]string, len(read))
@@ -263,7 +257,6 @@ func expandNamespacePolicy(policy string) []string {
 		NamespaceCapabilityCSIMountVolume,
 		NamespaceCapabilityCSIWriteVolume,
 		NamespaceCapabilitySubmitRecommendation,
-		NamespaceCapabilityHostVolumeCreate,
 	}...)
 
 	switch policy {
@@ -285,32 +278,6 @@ func expandNamespacePolicy(policy string) []string {
 	}
 }
 
-// expandNamespaceCapabilities adds extra capabilities implied by fine-grained
-// capabilities.
-func expandNamespaceCapabilities(ns *NamespacePolicy) {
-	extraCaps := []string{}
-	for _, cap := range ns.Capabilities {
-		switch cap {
-		case NamespaceCapabilityHostVolumeWrite:
-			extraCaps = append(extraCaps,
-				NamespaceCapabilityHostVolumeRegister,
-				NamespaceCapabilityHostVolumeCreate,
-				NamespaceCapabilityHostVolumeDelete,
-				NamespaceCapabilityHostVolumeRead)
-		case NamespaceCapabilityHostVolumeRegister:
-			extraCaps = append(extraCaps,
-				NamespaceCapabilityHostVolumeCreate,
-				NamespaceCapabilityHostVolumeRead)
-		case NamespaceCapabilityHostVolumeCreate:
-			extraCaps = append(extraCaps, NamespaceCapabilityHostVolumeRead)
-		}
-	}
-
-	// These may end up being duplicated, but they'll get deduplicated in NewACL
-	// when inserted into the radix tree.
-	ns.Capabilities = append(ns.Capabilities, extraCaps...)
-}
-
 func isNodePoolCapabilityValid(cap string) bool {
 	switch cap {
 	case NodePoolCapabilityDelete, NodePoolCapabilityRead, NodePoolCapabilityWrite,
@@ -421,9 +388,6 @@ func Parse(rules string) (*Policy, error) {
 			ns.Capabilities = append(ns.Capabilities, extraCap...)
 		}
 
-		// Expand implicit capabilities
-		expandNamespaceCapabilities(ns)
-
 		if ns.Variables != nil {
 			if len(ns.Variables.Paths) == 0 {
 				return nil, fmt.Errorf("Invalid variable policy: no variable paths in namespace %s", ns.Name)