mirror of
https://github.com/kemko/nomad.git
synced 2026-01-05 18:05:42 +03:00
bc50eebebd
Although we encourage users to use Vault roles, sometimes they're going to want to assign policies based on entity and pre-create entities and aliases based on claims. This allows them to use single default role (or at least small number of them) that has a templated policy, but have an escape hatch from that. When defining Vault entities the `user_claim` must be unique. When writing Vault binding rules for use with Nomad workload identities the binding rule won't be able to create a 1:1 mapping because the selector language allows accessing only a single field. The `nomad_job_id` claim isn't sufficient to uniquely identify a job because of namespaces. It's possible to create a JWT auth role with `bound_claims` to avoid this becoming a security problem, but this doesn't allow for correct accounting of user claims. Add support for an `extra_claims` block on the server's `default_identity` blocks for Vault. This allows a cluster administrator to add a custom claim on all allocations. The values for these claims are interpolatable with a limited subset of fields, similar to how we interpolate the task environment. Fixes: https://github.com/hashicorp/nomad/issues/23510 Ref: https://hashicorp.atlassian.net/browse/NET-10372 Ref: https://hashicorp.atlassian.net/browse/NET-10387
68 lines
1.6 KiB
Go
68 lines
1.6 KiB
Go
// Copyright (c) HashiCorp, Inc.
|
|
// SPDX-License-Identifier: BUSL-1.1
|
|
|
|
//go:build !ent
|
|
|
|
package vaultcompat
|
|
|
|
import (
|
|
"context"
|
|
"testing"
|
|
|
|
"github.com/hashicorp/go-version"
|
|
"github.com/shoenig/test/must"
|
|
)
|
|
|
|
// usable is used by the downloader to verify that we're getting the right
|
|
// versions of Vault CE
|
|
func usable(v, minimum *version.Version) bool {
|
|
switch {
|
|
case v.Metadata() != "":
|
|
return false
|
|
case v.LessThan(minimum):
|
|
return false
|
|
default:
|
|
return true
|
|
}
|
|
}
|
|
|
|
func testVaultLegacy(t *testing.T, b build) {
|
|
vStop, vc := startVault(t, b)
|
|
defer vStop()
|
|
setupVaultLegacy(t, vc)
|
|
|
|
nStop, nc := startNomad(t, configureNomadVaultLegacy(vc))
|
|
defer nStop()
|
|
runJob(t, nc, "input/cat.hcl", "default", validateLegacyAllocs)
|
|
}
|
|
|
|
func testVaultJWT(t *testing.T, b build) {
|
|
vStop, vc := startVault(t, b)
|
|
defer vStop()
|
|
|
|
// Start Nomad without access to the Vault token.
|
|
vaultToken := vc.Token()
|
|
vc.SetToken("")
|
|
nStop, nc := startNomad(t, configureNomadVaultJWT(vc))
|
|
defer nStop()
|
|
|
|
// Restore token and configure Vault for JWT login.
|
|
vc.SetToken(vaultToken)
|
|
setupVaultJWT(t, vc, nc.Address()+"/.well-known/jwks.json")
|
|
|
|
// Write secrets for test job.
|
|
_, err := vc.KVv2("secret").Put(context.Background(), "default/cat_jwt", map[string]any{
|
|
"secret": "workload",
|
|
})
|
|
must.NoError(t, err)
|
|
|
|
_, err = vc.KVv2("secret").Put(context.Background(), "restricted", map[string]any{
|
|
"secret": "restricted",
|
|
})
|
|
must.NoError(t, err)
|
|
|
|
// Run test job.
|
|
runJob(t, nc, "input/cat_jwt.hcl", "default", validateJWTAllocs)
|
|
runJob(t, nc, "input/restricted_jwt.hcl", "default", validateJWTAllocs)
|
|
}
|