Audit config, seams for enterprise audit features

allow oss to parse sink duration

clean up audit sink parsing

ent eventer config reload

fix typo

SetEnabled to eventer interface

client acl test

rm dead code

fix failing test

client/acl.go

@@ -74,6 +74,11 @@ func (c *Client) ResolveToken(secretID string) (*acl.ACL, error) {
 	return a, err
 }
 
+func (c *Client) ResolveSecretToken(secretID string) (*structs.ACLToken, error) {
+	_, t, err := c.resolveTokenAndACL(secretID)
+	return t, err
+}
+
 func (c *Client) resolveTokenAndACL(secretID string) (*acl.ACL, *structs.ACLToken, error) {
 	// Fast-path if ACLs are disabled
 	if !c.config.ACLEnabled {

client/acl_test.go

@@ -165,3 +165,29 @@ func TestClient_ACL_ResolveToken(t *testing.T) {
 	assert.Equal(t, structs.ErrTokenNotFound, err)
 	assert.Nil(t, out4)
 }
+
+func TestClient_ACL_ResolveSecretToken(t *testing.T) {
+	t.Parallel()
+
+	s1, _, _, cleanupS1 := testACLServer(t, nil)
+	defer cleanupS1()
+	testutil.WaitForLeader(t, s1.RPC)
+
+	c1, cleanup := TestClient(t, func(c *config.Config) {
+		c.RPCHandler = s1
+		c.ACLEnabled = true
+	})
+	defer cleanup()
+
+	token := mock.ACLToken()
+
+	err := s1.State().UpsertACLTokens(110, []*structs.ACLToken{token})
+	assert.Nil(t, err)
+
+	respToken, err := c1.ResolveSecretToken(token.SecretID)
+	assert.Nil(t, err)
+	if assert.NotNil(t, respToken) {
+		assert.NotEmpty(t, respToken.AccessorID)
+	}
+
+}

command/agent/agent.go

@@ -22,6 +22,7 @@ import (
 	clientconfig "github.com/hashicorp/nomad/client/config"
 	"github.com/hashicorp/nomad/client/state"
 	"github.com/hashicorp/nomad/command/agent/consul"
+	"github.com/hashicorp/nomad/command/agent/event"
 	"github.com/hashicorp/nomad/helper/pluginutils/loader"
 	"github.com/hashicorp/nomad/helper/uuid"
 	"github.com/hashicorp/nomad/nomad"
@@ -53,6 +54,7 @@ type Agent struct {
 	configLock sync.Mutex
 
 	logger     log.InterceptLogger
+	eventer    event.Eventer
 	httpLogger log.Logger
 	logOutput  io.Writer
 
@@ -118,6 +120,9 @@ func NewAgent(config *Config, logger log.InterceptLogger, logOutput io.Writer, i
 	if err := a.setupClient(); err != nil {
 		return nil, err
 	}
+	if err := a.setupEnterpriseAgent(logger); err != nil {
+		return nil, err
+	}
 	if a.client == nil && a.server == nil {
 		return nil, fmt.Errorf("must have at least client or server mode enabled")
 	}
@@ -998,6 +1003,13 @@ func (a *Agent) Reload(newConfig *Config) error {
 		a.logger.SetLevel(log.LevelFromString(newConfig.LogLevel))
 	}
 
+	// Update eventer config
+	if newConfig.Audit != nil {
+		if err := a.entReloadEventer(a.config.Audit); err != nil {
+			return err
+		}
+	}
+
 	fullUpdateTLSConfig := func() {
 		// Completely reload the agent's TLS configuration (moving from non-TLS to
 		// TLS, or vice versa)

command/agent/agent_oss.go

@@ -0,0 +1,41 @@
+// +build !ent
+
+package agent
+
+import (
+	"context"
+
+	hclog "github.com/hashicorp/go-hclog"
+	"github.com/hashicorp/nomad/command/agent/event"
+	"github.com/hashicorp/nomad/nomad/structs/config"
+)
+
+type noOpEventer struct{}
+
+// Ensure noOpEventer is an Eventer
+var _ event.Eventer = &noOpEventer{}
+
+func (e *noOpEventer) Event(ctx context.Context, eventType string, payload interface{}) error {
+	return nil
+}
+
+func (e *noOpEventer) Enabled() bool {
+	return false
+}
+
+func (e *noOpEventer) Reopen() error {
+	return nil
+}
+
+func (e *noOpEventer) SetEnabled(enabled bool) {}
+
+func (a *Agent) setupEnterpriseAgent(log hclog.Logger) error {
+	// configure eventer
+	a.eventer = &noOpEventer{}
+
+	return nil
+}
+
+func (a *Agent) entReloadEventer(cfg *config.AuditConfig) error {
+	return nil
+}

command/agent/command.go

@@ -72,6 +72,7 @@ func (c *Command) readConfig() *Config {
 		},
 		Vault: &config.VaultConfig{},
 		ACL:   &ACLConfig{},
+		Audit: &config.AuditConfig{},
 	}
 
 	flags := flag.NewFlagSet("agent", flag.ContinueOnError)

command/agent/config.go

@@ -169,6 +169,9 @@ type Config struct {
 	// Limits contains the configuration for timeouts.
 	Limits config.Limits `hcl:"limits"`
 
+	// Audit contains the configuration for audit logging.
+	Audit *config.AuditConfig `hcl:"audit"`
+
 	// ExtraKeysHCL is used by hcl to surface unexpected keys
 	ExtraKeysHCL []string `hcl:",unusedKeys" json:"-"`
 }
@@ -865,6 +868,7 @@ func DefaultConfig() *Config {
 		Sentinel:           &config.SentinelConfig{},
 		Version:            version.GetVersion(),
 		Autopilot:          config.DefaultAutopilotConfig(),
+		Audit:              &config.AuditConfig{},
 		DisableUpdateCheck: helper.BoolToPtr(false),
 		Limits:             config.DefaultLimits(),
 	}
@@ -996,6 +1000,14 @@ func (c *Config) Merge(b *Config) *Config {
 		result.ACL = result.ACL.Merge(b.ACL)
 	}
 
+	// Apply the Audit config
+	if result.Audit == nil && b.Audit != nil {
+		audit := *b.Audit
+		result.Audit = &audit
+	} else if b.ACL != nil {
+		result.Audit = result.Audit.Merge(b.Audit)
+	}
+
 	// Apply the ports config
 	if result.Ports == nil && b.Ports != nil {
 		ports := *b.Ports

command/agent/config_parse.go

@@ -35,6 +35,7 @@ func ParseConfigFile(path string) (*Config, error) {
 	c := &Config{
 		Client:    &ClientConfig{ServerJoin: &ServerJoin{}},
 		ACL:       &ACLConfig{},
+		Audit:     &config.AuditConfig{},
 		Server:    &ServerConfig{ServerJoin: &ServerJoin{}},
 		Consul:    &config.ConsulConfig{},
 		Autopilot: &config.AutopilotConfig{},
@@ -48,7 +49,7 @@ func ParseConfigFile(path string) (*Config, error) {
 	}
 
 	// convert strings to time.Durations
-	err = durations([]td{
+	tds := []td{
 		{"gc_interval", &c.Client.GCInterval, &c.Client.GCIntervalHCL},
 		{"acl.token_ttl", &c.ACL.TokenTTL, &c.ACL.TokenTTLHCL},
 		{"acl.policy_ttl", &c.ACL.PolicyTTL, &c.ACL.PolicyTTLHCL},
@@ -61,7 +62,17 @@ func ParseConfigFile(path string) (*Config, error) {
 		{"autopilot.server_stabilization_time", &c.Autopilot.ServerStabilizationTime, &c.Autopilot.ServerStabilizationTimeHCL},
 		{"autopilot.last_contact_threshold", &c.Autopilot.LastContactThreshold, &c.Autopilot.LastContactThresholdHCL},
 		{"telemetry.collection_interval", &c.Telemetry.collectionInterval, &c.Telemetry.CollectionInterval},
-	})
+	}
+
+	// Add enterprise audit sinks for time.Duration parsing
+	for i, sink := range c.Audit.Sinks {
+		tds = append(tds, td{
+			fmt.Sprintf("audit.sink.%d", i), &sink.RotateDuration, &sink.RotateDurationHCL,
+		})
+	}
+
+	// convert strings to time.Durations
+	err = durations(tds)
 	if err != nil {
 		return nil, err
 	}
@@ -144,6 +155,17 @@ func extraKeys(c *Config) error {
 		removeEqualFold(&c.Client.ExtraKeysHCL, "host_volume")
 	}
 
+	// Remove AuditConfig extra keys
+	for _, f := range c.Audit.Filters {
+		removeEqualFold(&c.Audit.ExtraKeysHCL, f.Name)
+		removeEqualFold(&c.Audit.ExtraKeysHCL, "filter")
+	}
+
+	for _, s := range c.Audit.Sinks {
+		removeEqualFold(&c.Audit.ExtraKeysHCL, s.Name)
+		removeEqualFold(&c.Audit.ExtraKeysHCL, "sink")
+	}
+
 	for _, k := range []string{"enabled_schedulers", "start_join", "retry_join", "server_join"} {
 		removeEqualFold(&c.ExtraKeysHCL, k)
 		removeEqualFold(&c.ExtraKeysHCL, "server")

command/agent/config_parse_test.go

@@ -134,6 +134,31 @@ var basicConfig = &Config{
 		PolicyTTLHCL:     "60s",
 		ReplicationToken: "foobar",
 	},
+	Audit: &config.AuditConfig{
+		Enabled: helper.BoolToPtr(true),
+		Sinks: []*config.AuditSink{
+			{
+				DeliveryGuarantee: "enforced",
+				Name:              "file",
+				Type:              "file",
+				Format:            "json",
+				Path:              "/opt/nomad/audit.log",
+				RotateDuration:    24 * time.Hour,
+				RotateDurationHCL: "24h",
+				RotateBytes:       100,
+				RotateMaxFiles:    10,
+			},
+		},
+		Filters: []*config.AuditFilter{
+			{
+				Name:       "default",
+				Type:       "HTTPEvent",
+				Endpoints:  []string{"/ui/", "/v1/agent/health"},
+				Stages:     []string{"*"},
+				Operations: []string{"*"},
+			},
+		},
+	},
 	Telemetry: &Telemetry{
 		StatsiteAddr:               "127.0.0.1:1234",
 		StatsdAddr:                 "127.0.0.1:2345",
@@ -389,6 +414,7 @@ func TestConfig_ParseMerge(t *testing.T) {
 		Autopilot: config.DefaultAutopilotConfig(),
 		Client:    &ClientConfig{},
 		Server:    &ServerConfig{},
+		Audit:     &config.AuditConfig{},
 	}
 	merged := oldDefault.Merge(actual)
 	require.Equal(t, basicConfig.Client, merged.Client)
@@ -480,6 +506,9 @@ func (c *Config) addDefaults() {
 	if c.ACL == nil {
 		c.ACL = &ACLConfig{}
 	}
+	if c.Audit == nil {
+		c.Audit = &config.AuditConfig{}
+	}
 	if c.Consul == nil {
 		c.Consul = config.DefaultConsulConfig()
 	}
@@ -575,6 +604,31 @@ var sample0 = &Config{
 	ACL: &ACLConfig{
 		Enabled: true,
 	},
+	Audit: &config.AuditConfig{
+		Enabled: helper.BoolToPtr(true),
+		Sinks: []*config.AuditSink{
+			{
+				DeliveryGuarantee: "enforced",
+				Name:              "file",
+				Type:              "file",
+				Format:            "json",
+				Path:              "/opt/nomad/audit.log",
+				RotateDuration:    24 * time.Hour,
+				RotateDurationHCL: "24h",
+				RotateBytes:       100,
+				RotateMaxFiles:    10,
+			},
+		},
+		Filters: []*config.AuditFilter{
+			{
+				Name:       "default",
+				Type:       "HTTPEvent",
+				Endpoints:  []string{"/ui/", "/v1/agent/health"},
+				Stages:     []string{"*"},
+				Operations: []string{"*"},
+			},
+		},
+	},
 	Telemetry: &Telemetry{
 		PrometheusMetrics:        true,
 		DisableHostname:          true,
@@ -638,6 +692,31 @@ var sample1 = &Config{
 	ACL: &ACLConfig{
 		Enabled: true,
 	},
+	Audit: &config.AuditConfig{
+		Enabled: helper.BoolToPtr(true),
+		Sinks: []*config.AuditSink{
+			{
+				Name:              "file",
+				Type:              "file",
+				DeliveryGuarantee: "enforced",
+				Format:            "json",
+				Path:              "/opt/nomad/audit.log",
+				RotateDuration:    24 * time.Hour,
+				RotateDurationHCL: "24h",
+				RotateBytes:       100,
+				RotateMaxFiles:    10,
+			},
+		},
+		Filters: []*config.AuditFilter{
+			{
+				Name:       "default",
+				Type:       "HTTPEvent",
+				Endpoints:  []string{"/ui/", "/v1/agent/health"},
+				Stages:     []string{"*"},
+				Operations: []string{"*"},
+			},
+		},
+	},
 	Telemetry: &Telemetry{
 		PrometheusMetrics:        true,
 		DisableHostname:          true,

command/agent/config_test.go

@@ -34,6 +34,7 @@ func TestConfig_Merge(t *testing.T) {
 		Client:         &ClientConfig{},
 		Server:         &ServerConfig{},
 		ACL:            &ACLConfig{},
+		Audit:          &config.AuditConfig{},
 		Ports:          &Ports{},
 		Addresses:      &Addresses{},
 		AdvertiseAddrs: &AdvertiseAddrs{},
@@ -83,6 +84,22 @@ func TestConfig_Merge(t *testing.T) {
 			CirconusBrokerSelectTag:            "dc:dc1",
 			PrefixFilter:                       []string{"filter1", "filter2"},
 		},
+		Audit: &config.AuditConfig{
+			Enabled: helper.BoolToPtr(true),
+			Sinks: []*config.AuditSink{
+				{
+					DeliveryGuarantee: "enforced",
+					Name:              "file",
+					Type:              "file",
+					Format:            "json",
+					Path:              "/opt/nomad/audit.log",
+					RotateDuration:    24 * time.Hour,
+					RotateDurationHCL: "24h",
+					RotateBytes:       100,
+					RotateMaxFiles:    10,
+				},
+			},
+		},
 		Client: &ClientConfig{
 			Enabled:   false,
 			StateDir:  "/tmp/state1",
@@ -213,6 +230,22 @@ func TestConfig_Merge(t *testing.T) {
 		DisableUpdateCheck:        helper.BoolToPtr(true),
 		DisableAnonymousSignature: true,
 		BindAddr:                  "127.0.0.2",
+		Audit: &config.AuditConfig{
+			Enabled: helper.BoolToPtr(true),
+			Sinks: []*config.AuditSink{
+				{
+					DeliveryGuarantee: "enforced",
+					Name:              "file",
+					Type:              "file",
+					Format:            "json",
+					Path:              "/opt/nomad/audit.log",
+					RotateDuration:    24 * time.Hour,
+					RotateDurationHCL: "24h",
+					RotateBytes:       100,
+					RotateMaxFiles:    10,
+				},
+			},
+		},
 		Telemetry: &Telemetry{
 			StatsiteAddr:                       "127.0.0.2:8125",
 			StatsdAddr:                         "127.0.0.2:8125",

command/agent/event/event.go

@@ -0,0 +1,19 @@
+package event
+
+import (
+	"context"
+)
+
+// Eventer describes the interface that must be implemented by an eventer.
+type Eventer interface {
+	// Emit and event
+	Event(ctx context.Context, eventType string, payload interface{}) error
+	// Specifies if the eventer is enabled or not
+	Enabled() bool
+
+	// Reopen signals to eventer to reopen any files they have open.
+	Reopen() error
+
+	// SetEnabled sets the eventer to enabled or disabled.
+	SetEnabled(enabled bool)
+}

command/agent/http.go

@@ -31,6 +31,13 @@ const (
 	// ErrEntOnly is the error returned if accessing an enterprise only
 	// endpoint
 	ErrEntOnly = "Nomad Enterprise only endpoint"
+
+	// ContextKeyReqID is a unique ID for a given request
+	ContextKeyReqID = "requestID"
+
+	// MissingRequestID is a placeholder if we cannot retrieve a request
+	// UUID from context
+	MissingRequestID = "<missing request id>"
 )
 
 var (
@@ -49,6 +56,9 @@ var (
 	})
 )
 
+type handlerFn func(resp http.ResponseWriter, req *http.Request) (interface{}, error)
+type handlerByteFn func(resp http.ResponseWriter, req *http.Request) ([]byte, error)
+
 // HTTPServer is used to wrap an Agent and expose it over an HTTP interface
 type HTTPServer struct {
 	agent      *Agent
@@ -380,6 +390,32 @@ func handleRootFallthrough() http.Handler {
 	})
 }
 
+func errCodeFromHandler(err error) (int, string) {
+	if err == nil {
+		return 0, ""
+	}
+
+	code := 500
+	errMsg := err.Error()
+	if http, ok := err.(HTTPCodedError); ok {
+		code = http.Code()
+	} else if ecode, emsg, ok := structs.CodeFromRPCCodedErr(err); ok {
+		code = ecode
+		errMsg = emsg
+	} else {
+		// RPC errors get wrapped, so manually unwrap by only looking at their suffix
+		if strings.HasSuffix(errMsg, structs.ErrPermissionDenied.Error()) {
+			errMsg = structs.ErrPermissionDenied.Error()
+			code = 403
+		} else if strings.HasSuffix(errMsg, structs.ErrTokenNotFound.Error()) {
+			errMsg = structs.ErrTokenNotFound.Error()
+			code = 403
+		}
+	}
+
+	return code, errMsg
+}
+
 // wrap is used to wrap functions to make them more convenient
 func (s *HTTPServer) wrap(handler func(resp http.ResponseWriter, req *http.Request) (interface{}, error)) func(resp http.ResponseWriter, req *http.Request) {
 	f := func(resp http.ResponseWriter, req *http.Request) {
@@ -390,7 +426,7 @@ func (s *HTTPServer) wrap(handler func(resp http.ResponseWriter, req *http.Reque
 		defer func() {
 			s.logger.Debug("request complete", "method", req.Method, "path", reqURL, "duration", time.Now().Sub(start))
 		}()
-		obj, err := handler(resp, req)
+		obj, err := s.auditHandler(handler)(resp, req)
 
 		// Check for an error
 	HAS_ERR:
@@ -462,28 +498,11 @@ func (s *HTTPServer) wrapNonJSON(handler func(resp http.ResponseWriter, req *htt
 		defer func() {
 			s.logger.Debug("request complete", "method", req.Method, "path", reqURL, "duration", time.Now().Sub(start))
 		}()
-		obj, err := handler(resp, req)
+		obj, err := s.auditByteHandler(handler)(resp, req)
 
 		// Check for an error
 		if err != nil {
-			code := 500
-			errMsg := err.Error()
-			if http, ok := err.(HTTPCodedError); ok {
-				code = http.Code()
-			} else if ecode, emsg, ok := structs.CodeFromRPCCodedErr(err); ok {
-				code = ecode
-				errMsg = emsg
-			} else {
-				// RPC errors get wrapped, so manually unwrap by only looking at their suffix
-				if strings.HasSuffix(errMsg, structs.ErrPermissionDenied.Error()) {
-					errMsg = structs.ErrPermissionDenied.Error()
-					code = 403
-				} else if strings.HasSuffix(errMsg, structs.ErrTokenNotFound.Error()) {
-					errMsg = structs.ErrTokenNotFound.Error()
-					code = 403
-				}
-			}
-
+			code, errMsg := errCodeFromHandler(err)
 			resp.WriteHeader(code)
 			resp.Write([]byte(errMsg))
 			s.logger.Error("request failed", "method", req.Method, "path", reqURL, "error", err, "code", code)

command/agent/http_oss.go

@@ -22,3 +22,15 @@ func (s *HTTPServer) registerEnterpriseHandlers() {
 func (s *HTTPServer) entOnly(resp http.ResponseWriter, req *http.Request) (interface{}, error) {
 	return nil, CodedError(501, ErrEntOnly)
 }
+
+func (s HTTPServer) auditHandler(h handlerFn) handlerFn {
+	return h
+}
+
+func (s *HTTPServer) auditByteHandler(h handlerByteFn) handlerByteFn {
+	return h
+}
+
+func (s *HTTPServer) auditHTTPHandler(h http.Handler) http.Handler {
+	return h
+}

command/agent/testdata/basic.hcl

@@ -142,6 +142,27 @@ acl {
   replication_token = "foobar"
 }
 
+audit {
+  enabled = true
+
+  sink "file" {
+    type               = "file"
+    delivery_guarantee = "enforced"
+    format             = "json"
+    path               = "/opt/nomad/audit.log"
+    rotate_bytes       = 100
+    rotate_duration    = "24h"
+    rotate_max_files   = 10
+  }
+
+  filter "default" {
+    type       = "HTTPEvent"
+    endpoints  = ["/ui/", "/v1/agent/health"]
+    stages     = ["*"]
+    operations = ["*"]
+  }
+}
+
 telemetry {
   statsite_address             = "127.0.0.1:1234"
   statsd_address               = "127.0.0.1:2345"

command/agent/testdata/basic.json

@@ -7,6 +7,34 @@
       "token_ttl": "60s"
     }
   ],
+  "audit": {
+    "enabled": true,
+    "sink": [
+      {
+        "file": {
+          "type": "file",
+          "format": "json",
+          "delivery_guarantee": "enforced",
+          "path": "/opt/nomad/audit.log",
+          "rotate_bytes": 100,
+          "rotate_duration": "24h",
+          "rotate_max_files": 10
+        }
+      }
+    ],
+    "filter": [
+      {
+        "default": [
+          {
+            "endpoints": ["/ui/", "/v1/agent/health"],
+            "operations": ["*"],
+            "stages": ["*"],
+            "type": "HTTPEvent"
+          }
+        ]
+      }
+    ]
+  },
   "addresses": [
     {
       "http": "127.0.0.1",

command/agent/testdata/sample0.json

@@ -5,6 +5,34 @@
   "acl": {
     "enabled": true
   },
+  "audit": {
+    "enabled": true,
+    "sink": [
+      {
+        "file": {
+          "type": "file",
+          "format": "json",
+          "delivery_guarantee": "enforced",
+          "path": "/opt/nomad/audit.log",
+          "rotate_bytes": 100,
+          "rotate_duration": "24h",
+          "rotate_max_files": 10
+        }
+      }
+    ],
+    "filter": [
+      {
+        "default": [
+          {
+            "endpoints": ["/ui/", "/v1/agent/health"],
+            "operations": ["*"],
+            "stages": ["*"],
+            "type": "HTTPEvent"
+          }
+        ]
+      }
+    ]
+  },
   "advertise": {
     "http": "host.example.com",
     "rpc": "host.example.com",

command/agent/testdata/sample1/sample2.hcl

@@ -17,3 +17,24 @@
 vault = {
   enabled = true
 }
+
+audit {
+  enabled = true
+
+  sink "file" {
+    type               = "file"
+    format             = "json"
+    delivery_guarantee = "enforced"
+    path               = "/opt/nomad/audit.log"
+    rotate_bytes       = 100
+    rotate_duration    = "24h"
+    rotate_max_files   = 10
+  }
+
+  filter "default" {
+    type       = "HTTPEvent"
+    endpoints  = ["/ui/", "/v1/agent/health"]
+    stages     = ["*"]
+    operations = ["*"]
+  }
+}

jobspec/test-fixtures/basic.hcl

@@ -293,7 +293,7 @@ job "binstore-storagelocker" {
       driver = "docker"
 
       lifecycle {
-        hook = "prestart"
+        hook    = "prestart"
         sidecar = true
       }
 

nomad/acl.go

@@ -84,3 +84,37 @@ func resolveTokenFromSnapshotCache(snap *state.StateSnapshot, cache *lru.TwoQueu
 	}
 	return aclObj, nil
 }
+
+// ResolveSecretToken is used to translate an ACL Token Secret ID into
+// an ACLToken object, nil if ACLs are disabled, or an error.
+func (s *Server) ResolveSecretToken(secretID string) (*structs.ACLToken, error) {
+	// TODO(Drew) Look into using ACLObject cache or create a separate cache
+
+	// Fast-path if ACLs are disabled
+	if !s.config.ACLEnabled {
+		return nil, nil
+	}
+	defer metrics.MeasureSince([]string{"nomad", "acl", "resolveSecretToken"}, time.Now())
+
+	snap, err := s.fsm.State().Snapshot()
+	if err != nil {
+		return nil, err
+	}
+
+	// Lookup the ACL Token
+	var token *structs.ACLToken
+	// Handle anonymous requests
+	if secretID == "" {
+		token = structs.AnonymousACLToken
+	} else {
+		token, err = snap.ACLTokenBySecretID(nil, secretID)
+		if err != nil {
+			return nil, err
+		}
+		if token == nil {
+			return nil, structs.ErrTokenNotFound
+		}
+	}
+
+	return token, nil
+}

nomad/acl_test.go

@@ -107,3 +107,27 @@ func TestResolveACLToken_LeaderToken(t *testing.T) {
 		assert.True(token.IsManagement())
 	}
 }
+
+func TestResolveSecretToken(t *testing.T) {
+	t.Parallel()
+
+	s1, _, cleanupS1 := TestACLServer(t, nil)
+	defer cleanupS1()
+	testutil.WaitForLeader(t, s1.RPC)
+
+	state := s1.State()
+	leaderToken := s1.getLeaderAcl()
+	assert.NotEmpty(t, leaderToken)
+
+	token := mock.ACLToken()
+
+	err := state.UpsertACLTokens(110, []*structs.ACLToken{token})
+	assert.Nil(t, err)
+
+	respToken, err := s1.ResolveSecretToken(token.SecretID)
+	assert.Nil(t, err)
+	if assert.NotNil(t, respToken) {
+		assert.NotEmpty(t, respToken.AccessorID)
+	}
+
+}

nomad/structs/config/audit.go

@@ -0,0 +1,213 @@
+package config
+
+import (
+	"time"
+
+	"github.com/hashicorp/nomad/helper"
+)
+
+// AuditConfig is the configuration specific to Audit Logging
+type AuditConfig struct {
+	// Enabled controls the Audit Logging mode
+	Enabled *bool `hcl:"enabled"`
+
+	// Sinks configure output sinks for audit logs
+	Sinks []*AuditSink `hcl:"sink"`
+
+	// Filters configure audit event filters to filter out certain eevents
+	// from being written to a sink.
+	Filters []*AuditFilter `hcl:"filter"`
+
+	// ExtraKeysHCL is used by hcl to surface unexpected keys
+	ExtraKeysHCL []string `hcl:",unusedKeys" json:"-"`
+}
+
+type AuditSink struct {
+	// Name is a unique name given to the filter
+	Name string `hcl:",key"`
+
+	// DeliveryGuarantee is the level at which delivery of logs must
+	// be met in order to successfully make requests
+	DeliveryGuarantee string `hcl:"delivery_guarantee"`
+
+	// Type is the sink type to configure. (file)
+	Type string `hcl:"type"`
+
+	// Format is the sink output format. (json)
+	Format string `hcl:"format"`
+
+	// FileName is the name that the audit log should follow.
+	// If rotation is enabled the pattern will be name-timestamp.log
+	Path string `hcl:"path"`
+
+	// RotateDuration is the time period that logs should be rotated in
+	RotateDuration    time.Duration
+	RotateDurationHCL string `hcl:"rotate_duration" json:"-"`
+
+	// RotateBytes is the max number of bytes that should be written to a file
+	RotateBytes int `hcl:"rotate_bytes"`
+
+	// RotateMaxFiles is the max number of log files to keep
+	RotateMaxFiles int `hcl:"rotate_max_files"`
+}
+
+// AuditFilter is the configuration for a Audit Log Filter
+type AuditFilter struct {
+	// Name is a unique name given to the filter
+	Name string `hcl:",key"`
+
+	// Type of auditing event to filter, such as HTTPEvent
+	Type string `hcl:"type"`
+
+	// Endpoints is the list of endpoints to include in the filter
+	Endpoints []string `hcl:"endpoints"`
+
+	// State is the auditing request lifecycle stage to filter
+	Stages []string `hcl:"stages"`
+
+	// Operations is the type of operation to filter, such as GET, DELETE
+	Operations []string `hcl:"operations"`
+}
+
+// Copy returns a new copy of an AuditConfig
+func (a *AuditConfig) Copy() *AuditConfig {
+	if a == nil {
+		return nil
+	}
+
+	nc := new(AuditConfig)
+	*nc = *a
+
+	// Copy bool pointers
+	if a.Enabled != nil {
+		nc.Enabled = helper.BoolToPtr(*a.Enabled)
+	}
+
+	// Copy Sinks and Filters
+	nc.Sinks = copySliceAuditSink(nc.Sinks)
+	nc.Filters = copySliceAuditFilter(nc.Filters)
+
+	return nc
+}
+
+// Merge is used to merge two Audit Configs together. Settings from the input take precedence.
+func (a *AuditConfig) Merge(b *AuditConfig) *AuditConfig {
+	result := a.Copy()
+
+	if b.Enabled != nil {
+		result.Enabled = helper.BoolToPtr(*b.Enabled)
+	}
+
+	// Merge Sinks
+	if len(a.Sinks) == 0 && len(b.Sinks) != 0 {
+		result.Sinks = copySliceAuditSink(b.Sinks)
+	} else if len(b.Sinks) != 0 {
+		result.Sinks = auditSinkSliceMerge(a.Sinks, b.Sinks)
+	}
+
+	// Merge Filters
+	if len(a.Filters) == 0 && len(b.Filters) != 0 {
+		result.Filters = copySliceAuditFilter(b.Filters)
+	} else if len(b.Filters) != 0 {
+		result.Filters = auditFilterSliceMerge(a.Filters, b.Filters)
+	}
+
+	return result
+}
+
+func (a *AuditSink) Copy() *AuditSink {
+	if a == nil {
+		return nil
+	}
+
+	nc := new(AuditSink)
+	*nc = *a
+
+	return nc
+}
+
+func (a *AuditFilter) Copy() *AuditFilter {
+	if a == nil {
+		return nil
+	}
+
+	nc := new(AuditFilter)
+	*nc = *a
+
+	// Copy slices
+	nc.Endpoints = helper.CopySliceString(nc.Endpoints)
+	nc.Stages = helper.CopySliceString(nc.Stages)
+	nc.Operations = helper.CopySliceString(nc.Operations)
+
+	return nc
+}
+
+func copySliceAuditFilter(a []*AuditFilter) []*AuditFilter {
+	l := len(a)
+	if l == 0 {
+		return nil
+	}
+
+	ns := make([]*AuditFilter, l)
+	for idx, cfg := range a {
+		ns[idx] = cfg.Copy()
+	}
+
+	return ns
+}
+
+func auditFilterSliceMerge(a, b []*AuditFilter) []*AuditFilter {
+	n := make([]*AuditFilter, len(a))
+	seenKeys := make(map[string]int, len(a))
+
+	for i, config := range a {
+		n[i] = config.Copy()
+		seenKeys[config.Name] = i
+	}
+
+	for _, config := range b {
+		if fIndex, ok := seenKeys[config.Name]; ok {
+			n[fIndex] = config.Copy()
+			continue
+		}
+
+		n = append(n, config.Copy())
+	}
+
+	return n
+}
+
+func copySliceAuditSink(a []*AuditSink) []*AuditSink {
+	l := len(a)
+	if l == 0 {
+		return nil
+	}
+
+	ns := make([]*AuditSink, l)
+	for idx, cfg := range a {
+		ns[idx] = cfg.Copy()
+	}
+
+	return ns
+}
+
+func auditSinkSliceMerge(a, b []*AuditSink) []*AuditSink {
+	n := make([]*AuditSink, len(a))
+	seenKeys := make(map[string]int, len(a))
+
+	for i, config := range a {
+		n[i] = config.Copy()
+		seenKeys[config.Name] = i
+	}
+
+	for _, config := range b {
+		if fIndex, ok := seenKeys[config.Name]; ok {
+			n[fIndex] = config.Copy()
+			continue
+		}
+
+		n = append(n, config.Copy())
+	}
+
+	return n
+}

nomad/structs/config/audit_test.go

@@ -0,0 +1,106 @@
+package config
+
+import (
+	"testing"
+	"time"
+
+	"github.com/hashicorp/nomad/helper"
+	"github.com/stretchr/testify/require"
+)
+
+func TestAuditConfig_Merge(t *testing.T) {
+	c1 := &AuditConfig{
+		Enabled: helper.BoolToPtr(true),
+		Sinks: []*AuditSink{
+			{
+				DeliveryGuarantee: "enforced",
+				Name:              "file",
+				Type:              "file",
+				Format:            "json",
+				Path:              "/opt/nomad/audit.log",
+				RotateDuration:    24 * time.Hour,
+				RotateDurationHCL: "24h",
+				RotateBytes:       100,
+				RotateMaxFiles:    10,
+			},
+		},
+		Filters: []*AuditFilter{
+			{
+				Name:       "one",
+				Type:       "HTTPEvent",
+				Endpoints:  []string{"/ui/", "/v1/agent/health"},
+				Stages:     []string{"*"},
+				Operations: []string{"*"},
+			},
+		},
+	}
+
+	c2 := &AuditConfig{
+		Sinks: []*AuditSink{
+			{
+				DeliveryGuarantee: "best-effort",
+				Name:              "file",
+				Type:              "file",
+				Format:            "json",
+				Path:              "/opt/nomad/audit.log",
+				RotateDuration:    48 * time.Hour,
+				RotateDurationHCL: "48h",
+				RotateBytes:       20,
+				RotateMaxFiles:    2,
+			},
+		},
+		Filters: []*AuditFilter{
+			{
+				Name:       "one",
+				Type:       "HTTPEvent",
+				Endpoints:  []string{"/ui/", "/v1/agent/health"},
+				Stages:     []string{"OperationReceived"},
+				Operations: []string{"GET"},
+			},
+			{
+				Name:       "two",
+				Type:       "HTTPEvent",
+				Endpoints:  []string{"*"},
+				Stages:     []string{"OperationReceived"},
+				Operations: []string{"OPTIONS"},
+			},
+		},
+	}
+
+	e := &AuditConfig{
+		Enabled: helper.BoolToPtr(true),
+		Sinks: []*AuditSink{
+			{
+				DeliveryGuarantee: "best-effort",
+				Name:              "file",
+				Type:              "file",
+				Format:            "json",
+				Path:              "/opt/nomad/audit.log",
+				RotateDuration:    48 * time.Hour,
+				RotateDurationHCL: "48h",
+				RotateBytes:       20,
+				RotateMaxFiles:    2,
+			},
+		},
+		Filters: []*AuditFilter{
+			{
+				Name:       "one",
+				Type:       "HTTPEvent",
+				Endpoints:  []string{"/ui/", "/v1/agent/health"},
+				Stages:     []string{"OperationReceived"},
+				Operations: []string{"GET"},
+			},
+			{
+				Name:       "two",
+				Type:       "HTTPEvent",
+				Endpoints:  []string{"*"},
+				Stages:     []string{"OperationReceived"},
+				Operations: []string{"OPTIONS"},
+			},
+		},
+	}
+
+	result := c1.Merge(c2)
+
+	require.Equal(t, e, result)
+}