Support AppRole for Vault Integration - Goal: Grouped Policies

[justenwalker]

Currently, Nomad 0.5.x supports Vault via injecting a specific token with a list of policies in the job file. It would be good to use AppRoles to group these common policies together under a specific name.

Essentially, this would mean supporting something like:

job "docs" {
  group "example" {
    task "server" {
      vault {
        # Vault App Role Name
        app_role_name = "server_role"

        change_mode   = "signal"
        change_signal = "SIGUSR1"
      }
    }
  }
}

And having the Nomad Client authenticate the task using the app role.

Caveat:

• App Roles can be mounted under any arbitrary path. Might need to add another option in the Nomad Config to specify the mount point?

[c4milo]

I would guess this issue also depends on hashicorp/consul-template#744

[dadgar]

@c4milo Nomad's Vault integration is actually separate from consul-templates. We just hand CT a token but Nomad does all the heavy lifting of getting it.

[dadgar]

@justenwalker Talked to the Vault team a bit and they have some future work that should make default policies possible without AppRole. AppRole is another authentication backend which is less than ideal since Nomad already uses the token backend.

I am going to keep this open but slightly rename the title.

[chris93111]

+1

with vault integration , nomad use auth/token/create , and with metrics of vault the number of customers is falsified

[tgross]

I'm reviewing open Vault issues following the new Vault workload identity work (ref #15617). We've implemented something roughly similar to what's been proposed here, using signed workload identities to login to Vault and then use roles defined for the auth config. Going to close this issue to tidy up.

[github-actions]

I'm going to lock this issue because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.