mirror of
https://github.com/kemko/nomad.git
synced 2026-01-04 17:35:43 +03:00
bc50eebebd
Although we encourage users to use Vault roles, sometimes they're going to want to assign policies based on entity and pre-create entities and aliases based on claims. This allows them to use single default role (or at least small number of them) that has a templated policy, but have an escape hatch from that. When defining Vault entities the `user_claim` must be unique. When writing Vault binding rules for use with Nomad workload identities the binding rule won't be able to create a 1:1 mapping because the selector language allows accessing only a single field. The `nomad_job_id` claim isn't sufficient to uniquely identify a job because of namespaces. It's possible to create a JWT auth role with `bound_claims` to avoid this becoming a security problem, but this doesn't allow for correct accounting of user claims. Add support for an `extra_claims` block on the server's `default_identity` blocks for Vault. This allows a cluster administrator to add a custom claim on all allocations. The values for these claims are interpolatable with a limited subset of fields, similar to how we interpolate the task environment. Fixes: https://github.com/hashicorp/nomad/issues/23510 Ref: https://hashicorp.atlassian.net/browse/NET-10372 Ref: https://hashicorp.atlassian.net/browse/NET-10387
39 lines
940 B
HCL
39 lines
940 B
HCL
# Copyright (c) HashiCorp, Inc.
|
|
# SPDX-License-Identifier: BUSL-1.1
|
|
|
|
job "restricted_jwt" {
|
|
type = "batch"
|
|
|
|
// Tasks in this group are expected to succeed and run to completion.
|
|
group "success" {
|
|
vault {}
|
|
|
|
count = 2
|
|
|
|
// Task default_identity uses the default workload identity injected by the
|
|
// server and the inherits the Vault configuration from the group.
|
|
task "authorized" {
|
|
driver = "raw_exec"
|
|
|
|
config {
|
|
command = "cat"
|
|
args = ["${NOMAD_SECRETS_DIR}/secret.txt"]
|
|
}
|
|
|
|
// Vault has an alias that maps this job's nomad_workload_id to an entity
|
|
// with a policy that allows access to these secrets
|
|
template {
|
|
data = <<EOF
|
|
{{with secret "secret/data/restricted"}}{{.Data.data.secret}}{{end}}
|
|
EOF
|
|
destination = "${NOMAD_SECRETS_DIR}/secret.txt"
|
|
}
|
|
|
|
restart {
|
|
attempts = 0
|
|
mode = "fail"
|
|
}
|
|
}
|
|
}
|
|
}
|