-
Notifications
You must be signed in to change notification settings - Fork 1.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
policies for workload identity aren't merged #14031
Comments
@angrycub @mikenomitch this issue description makes me realize we probably need to come up with some standardized and documented name for the difference between:
|
|
Yeah, in retrospect I think we want a name for this mostly for our own internal discussions because it's easy to mix up the two. |
I think I've got an approach in mind for this but want to land #14140 first. I'll fork from that branch with the fix. |
After a bit more investigation I discovered this is an invalid bug. The problem in the original description is that I've got an invalid policy document of the same sort of user error that we'll catch now with #14123. I've added an extra test to #14140 that demonstrates this is actually working just fine. 🤦 |
I'm going to lock this issue because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active issues. |
If you have a job
example
with task groupweb
and task namehttpd
the allocation's workload identity will automatically be granted Read access to the secure variable pathnomad/jobs/example/web/httpd
(as well asnomad/jobs
,nomad/jobs/example
, andnomad/jobs/example/web
. However, if you add an extra policy to get automatically associated to the job, only that policy is used. So for example, if I create the following policy at_:example/web/httpd
(keeping in mind this name doesn't actually work, see #13995):Then I the task's WI can no longer Read
nomad/jobs/example/web/httpd
, only List it. Instead we need:This is counter to the way we normally expect policies to be additive.
The text was updated successfully, but these errors were encountered: