Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Update templated nomad policies #21872

Open
wants to merge 3 commits into
base: main
Choose a base branch
from
+36 −28
Open

Update templated nomad policies #21872

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
3 commits
Select commit Hold shift + click to select a range
e495978
Update nomad policies to match https://developer.hashicorp.com/nomad/…
tristanmorgan Oct 23, 2024
b00c1a8
Update policy to template the Nomad node name in.
tristanmorgan Nov 4, 2024
1ba81be
Update policies to scope agent access.
tristanmorgan Nov 12, 2024
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
8 changes: 4 additions & 4 deletions agent/structs/acltemplatedpolicy/policies/ce/nomad-client.hcl
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,12 +1,12 @@
agent_prefix "" {
agent "{{.Name}}" {
policy = "read"
}
node_prefix "" {
policy = "read"
node "{{.Name}}" {
policy = "write"
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

@tristanmorgan Does Nomad register nodes into Consul? I thought it only registered services to existing Consul nodes.

Copy link
Member Author

@tristanmorgan tristanmorgan Nov 1, 2024 •
edited by blake
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

this is from:

since Consul 1.15 Nomad agents require a node:write policy, and not node:read like our documentation suggests.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

References from the pr minimal Consul policy for Nomad agents needs node:write

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Updated policy to limit changes to the named node.

service_prefix "" {
policy = "write"
}
key_prefix "" {
policy = "read"
}
}
11 changes: 6 additions & 5 deletions agent/structs/acltemplatedpolicy/policies/ce/nomad-server.hcl
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,11 +1,12 @@
acl = "write"
mesh = "write"
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Why do Nomad servers need the mesh:write permission?

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

from https://developer.hashicorp.com/nomad/docs/integrations/consul/acl#nomad-agents

Nomad servers also create configuration entries for Consul Service Mesh, so the specific permissions vary slightly between Nomad servers and clients.

Copy link
Member Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

linking in Nomad#20159.
with a note that acl = "write" is needed for the upgrade to workload identity.


acl = "write"
agent_prefix "" {
agent "{{.Name}}" {
policy = "read"
}
node_prefix "" {
policy = "read"
node "{{.Name}}" {
policy = "write"
}
service_prefix "" {
policy = "write"
}
}
4 changes: 2 additions & 2 deletions command/acl/templatedpolicy/formatter.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -71,11 +71,11 @@ func (f *prettyFormatter) FormatTemplatedPolicy(templatedPolicy api.ACLTemplated
switch templatedPolicy.TemplateName {
case api.ACLTemplatedPolicyServiceName:
nameRequiredVariableOutput(&buffer, templatedPolicy.TemplateName, "The name of the service", "api")
case api.ACLTemplatedPolicyNodeName:
case api.ACLTemplatedPolicyNodeName, api.ACLTemplatedPolicyNomadServerName, api.ACLTemplatedPolicyNomadClientName:
nameRequiredVariableOutput(&buffer, templatedPolicy.TemplateName, "The node name", "node-1")
case api.ACLTemplatedPolicyAPIGatewayName:
nameRequiredVariableOutput(&buffer, templatedPolicy.TemplateName, "The api gateway service name", "api-gateway")
case api.ACLTemplatedPolicyDNSName, api.ACLTemplatedPolicyNomadServerName, api.ACLTemplatedPolicyNomadClientName:
case api.ACLTemplatedPolicyDNSName:
noRequiredVariablesOutput(&buffer, templatedPolicy.TemplateName)
default:
buffer.WriteString(" None\n")
Expand Down
2 changes: 1 addition & 1 deletion ...mplatedpolicy/testdata/FormatTemplatedPolicy/ce/nomad-client-templated-policy.json.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"TemplateName": "builtin/nomad-client",
"Schema": "",
"Template": "agent_prefix \"\" {\n policy = \"read\"\n}\nnode_prefix \"\" {\n policy = \"read\"\n}\nservice_prefix \"\" {\n policy = \"write\"\n}\nkey_prefix \"\" {\n policy = \"read\"\n}",
"Template": "agent \"{{.Name}}\" {\n policy = \"read\"\n}\nnode \"{{.Name}}\" {\n policy = \"write\"\n}\nservice_prefix \"\" {\n policy = \"write\"\n}\nkey_prefix \"\" {\n policy = \"read\"\n}\n",
"Description": "Gives the token or role permissions required for integration with a nomad client."
}
12 changes: 7 additions & 5 deletions ...policy/testdata/FormatTemplatedPolicy/ce/nomad-client-templated-policy.pretty-meta.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,18 +1,20 @@
Name: builtin/nomad-client
Description: Gives the token or role permissions required for integration with a nomad client.
Input variables: None
Input variables:
Name: String - Required - The node name.
Example usage:
consul acl token create -templated-policy builtin/nomad-client
consul acl token create -templated-policy builtin/nomad-client -var name:node-1
Raw Template:
agent_prefix "" {
agent "{{.Name}}" {
policy = "read"
}
node_prefix "" {
policy = "read"
node "{{.Name}}" {
policy = "write"
}
service_prefix "" {
policy = "write"
}
key_prefix "" {
policy = "read"
}

5 changes: 3 additions & 2 deletions ...latedpolicy/testdata/FormatTemplatedPolicy/ce/nomad-client-templated-policy.pretty.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
Name: builtin/nomad-client
Description: Gives the token or role permissions required for integration with a nomad client.
Input variables: None
Input variables:
Name: String - Required - The node name.
Example usage:
consul acl token create -templated-policy builtin/nomad-client
consul acl token create -templated-policy builtin/nomad-client -var name:node-1
2 changes: 1 addition & 1 deletion ...mplatedpolicy/testdata/FormatTemplatedPolicy/ce/nomad-server-templated-policy.json.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,6 +1,6 @@
{
"TemplateName": "builtin/nomad-server",
"Schema": "",
"Template": "\nacl = \"write\"\nagent_prefix \"\" {\n policy = \"read\"\n}\nnode_prefix \"\" {\n policy = \"read\"\n}\nservice_prefix \"\" {\n policy = \"write\"\n}",
"Template": "acl = \"write\"\nmesh = \"write\"\n\nagent \"{{.Name}}\" {\n policy = \"read\"\n}\nnode \"{{.Name}}\" {\n policy = \"write\"\n}\nservice_prefix \"\" {\n policy = \"write\"\n}\n",
"Description": "Gives the token or role permissions required for integration with a nomad server."
}
15 changes: 9 additions & 6 deletions ...policy/testdata/FormatTemplatedPolicy/ce/nomad-server-templated-policy.pretty-meta.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,17 +1,20 @@
Name: builtin/nomad-server
Description: Gives the token or role permissions required for integration with a nomad server.
Input variables: None
Input variables:
Name: String - Required - The node name.
Example usage:
consul acl token create -templated-policy builtin/nomad-server
consul acl token create -templated-policy builtin/nomad-server -var name:node-1
Raw Template:
acl = "write"
mesh = "write"

acl = "write"
agent_prefix "" {
agent "{{.Name}}" {
policy = "read"
}
node_prefix "" {
policy = "read"
node "{{.Name}}" {
policy = "write"
}
service_prefix "" {
policy = "write"
}

5 changes: 3 additions & 2 deletions ...latedpolicy/testdata/FormatTemplatedPolicy/ce/nomad-server-templated-policy.pretty.golden
View file
Open in desktop
Original file line number Diff line number Diff line change
@@ -1,5 +1,6 @@
Name: builtin/nomad-server
Description: Gives the token or role permissions required for integration with a nomad server.
Input variables: None
Input variables:
Name: String - Required - The node name.
Example usage:
consul acl token create -templated-policy builtin/nomad-server
consul acl token create -templated-policy builtin/nomad-server -var name:node-1
Loading