kemko/nomad
1
0
Fork 0
mirror of https://github.com/kemko/nomad.git synced 2026-01-05 01:45:44 +03:00
Code Issues Packages Projects Releases Wiki Activity

docs: warn about Consul auth method locality (#24275)

Browse Source 
* docs: warn about Consul auth method locality

The locality of Consul tokens we mint via Workload Identity is governed by the
Consul auth method configuration. By default tokens are local to the Consul
datacenter, which typically maps 1:1 with a Nomad region. Cluster administrators
who need cross-datacenter tokens can get them by setting the locality to global,
at the risk of placement problems if the primary DC isn't available.

Ref: https://github.com/hashicorp/consul/issues/21863
Fixes: https://github.com/hashicorp/nomad/issues/23505
This commit is contained in:
Tim Gross
2024-10-23 11:44:03 -04:00
committed by GitHub
parent 6a2e1e4216
commit 10358cc911
1 changed files with 4 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

5
website/content/docs/integrations/consul/acl.mdx
View File

@@ -109,7 +109,10 @@ Nomad uses to sign workload identities. With these keys, Consul is able to
validate their origin and confirm that they were actually created by Nomad.
Nomad cannot recreate Consul tokens that have been deleted. The auth method
configuration should never set the `MaxTokenTTL` field.
configuration should never set the `MaxTokenTTL` field. Consul tokens are
local to the Consul datacenter unless you set `TokenLocality: "global"` in the
auth method. We recommend using local tokens, which is the default. Global tokens
require that the primary Consul datacenter is available when allocations start.
<CodeBlockConfig highlight="2" filename="auth-method.json">