extra_claims job ID without periodic suffix for batch jobs

[EtienneBruines]

Proposal

Add a vault.default_identity.extra_claims interpolation for the job ID that does not include the /periodic-1234567 suffix, the same way the nomad_job_id does not include it.

Currently ${job.id} looks something like this my-batch-job-name/periodic-1723556632 and I'd like a variable (perhaps ${job.name}?) that gives me just my-batch-job-name

Use-cases

• Vault integration for batch jobs. Not having the periodic suffix makes it more doable to actually provide secrets/paths in the Vault policy that it can access.

Attempted Solutions

• No workaround is available.

Currently available interpolations:

nomad/nomad/structs/workload_id.go

Lines 235 to 252 in 90d646a

	r := strings.NewReplacer(
	// attributes that always exist
	"${job.region}", b.job.Region,
	"${job.namespace}", b.job.Namespace,
	"${job.id}", b.job.ID,
	"${job.node_pool}", b.job.NodePool,
	"${group.name}", b.tg.Name,
	// attributes that conditionally exist
	"${node.id}", strAttrGet(b.node, func(n *Node) string { return n.ID }),
	"${node.datacenter}", strAttrGet(b.node, func(n *Node) string { return n.Datacenter }),
	"${node.pool}", strAttrGet(b.node, func(n *Node) string { return n.NodePool }),
	"${node.class}", strAttrGet(b.node, func(n *Node) string { return n.NodeClass }),
	"${task.name}", strAttrGet(b.task, func(t *Task) string { return t.Name }),
	"${vault.cluster}", strAttrGet(b.vault, func(v *Vault) string { return v.Cluster }),
	"${vault.namespace}", strAttrGet(b.vault, func(v *Vault) string { return v.Namespace }),
	"${vault.role}", strAttrGet(b.vault, func(v *Vault) string { return v.Role }),
	)

Sorry @tgross for not realizing this when the PR was still a PR.

[tgross]

🤦 That's embarrassing. It should use the parent job ID when available, just as we do for other job claims. Will fix.

[the-nando]

hey @tgross I've run into this as well unfortunately, in my quest to migrate some clusters to workload identity. Do you know more or less when this bug fix will ship?

[tgross]

I've got a PR up with the fix #23817 but I've been on PTO the last couple weeks. Planning on shipping this in the upcoming Nomad 1.8.4.

[github-actions]

I'm going to lock this issue because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.