Allow disabling exec only for the entrypoint

.changelog/1973.txt

@@ -0,0 +1,4 @@
+```release-note:improvement
+entrypoint: Can disable `waypoint exec` only by setting the
+`WAYPOINT_CEB_DISABLE_EXEC` environment variable to a truthy value.
+```

internal/ceb/ceb.go

@@ -30,6 +30,7 @@ const (
  envServerTls = "WAYPOINT_SERVER_TLS"
  envServerTlsSkipVerify = "WAYPOINT_SERVER_TLS_SKIP_VERIFY"
  envCEBDisable = "WAYPOINT_CEB_DISABLE"
+ envCEBDisableExec = "WAYPOINT_CEB_DISABLE_EXEC"
  envCEBServerRequired = "WAYPOINT_CEB_SERVER_REQUIRED"
  envCEBToken = "WAYPOINT_CEB_INVITE_TOKEN"
 
@@ -49,6 +50,7 @@ type CEB struct {
  deploymentId string
  context context.Context
  execIdx int64
+ execDisable bool
 
  // stateCond and its associated locker are used to protect all the
  // state-prefixed fields. These state fields can be watched using this
@@ -326,6 +328,11 @@ func WithEnvDefaults() Option {
 
  ceb.deploymentId = os.Getenv(envDeploymentId)
 
+ ceb.execDisable, err = env.GetBool(envCEBDisableExec, false)
+ if err != nil {
+ return err
+ }
+
  return nil
  }
 }

internal/ceb/config.go

@@ -70,6 +70,7 @@ func (ceb *CEB) initConfigStreamReceiver(
  client, err := serverClient.EntrypointConfig(ctx, &pb.EntrypointConfigRequest{
  DeploymentId: ceb.deploymentId,
  InstanceId: ceb.id,
+ DisableExec: ceb.execDisable,
  }, grpc.WaitForReady(isRetry || cfg.ServerRequired))
  if err != nil {
  // If the server is unavailable and this is our first time, then

internal/ceb/exec.go

@@ -17,6 +17,15 @@ import (
 )
 
 func (ceb *CEB) startExecGroup(es []*pb.EntrypointConfig_Exec, env []string) {
+ // If exec is disabled, log. This should never happen because we advertise
+ // disabled exec to the server, and the server should not assign us any
+ // exec sessions. However, we don't want to explicitly trust the server
+ // so we also safeguard here that we do not exec if we've disabled it.
+ if ceb.execDisable {
+ ceb.logger.Warn("startExecGroup called but disableExec is true. This should not happen.")
+ return
+ }
+
  idx := ceb.execIdx
  for _, exec := range es {
  // Ignore exec sessions we already have