Update templated nomad policies #21872
Conversation
github-actions
bot
added
the
theme/cli
tristanmorgan
force-pushed
the
update_nomad_server_template
branch
from
c1bd646 to
af26f0e
Compare
| @@ -2,7 +2,7 @@ agent_prefix "" { | |||
| policy = "read" | |||
| } | |||
| node_prefix "" { | |||
| policy = "read" | |||
| policy = "write" | |||
There was a problem hiding this comment.
@tristanmorgan Does Nomad register nodes into Consul? I thought it only registered services to existing Consul nodes.
There was a problem hiding this comment.
this is from:
since Consul 1.15 Nomad agents require a node:write policy, and not node:read like our documentation suggests.
There was a problem hiding this comment.
References from the pr minimal Consul policy for Nomad agents needs node:write
There was a problem hiding this comment.
Updated policy to limit changes to the named node.
| @@ -1,10 +1,12 @@ | |||
|
|
|||
| acl = "write" | |||
| acl = "write" | |||
| mesh = "write" | |||
There was a problem hiding this comment.
Why do Nomad servers need the mesh:write permission?
There was a problem hiding this comment.
from https://developer.hashicorp.com/nomad/docs/integrations/consul/acl#nomad-agents
Nomad servers also create configuration entries for Consul Service Mesh, so the specific permissions vary slightly between Nomad servers and clients.
tristanmorgan
force-pushed
the
update_nomad_server_template
branch
from
87c87db to
c5dffcc
Compare
|
This pull request has been automatically flagged for inactivity because it has not been acted upon in the last 60 days. It will be closed if no new activity occurs in the next 30 days. Please feel free to re-open to resurrect the change if you feel this has happened by mistake. Thank you for your contributions. |
github-actions
bot
added
the
meta/stale
tristanmorgan
force-pushed
the
update_nomad_server_template
branch
from
0eb8dca to
1ba81be
Compare
github-actions
bot
removed
the
meta/stale
Description
Updated the templated polices to match the recommended in the docs.
Links
https://developer.hashicorp.com/nomad/docs/integrations/consul/acl#nomad-agents
hashicorp/nomad#23802
PR Checklist