Workload identity for parameterised jobs

[michael-strigo]

Proposal

Allow attaching workload identities to parameterised job dispatches.

Use-cases

Having the ability to read/write variables in non-default paths.

Attempted Solutions

I tried attaching a policy to the parameterised job with nomad acl policy apply -namespace default -job param policy_name /tmp/policy.hcl

policy.hcl:

namespace "default" {
  variables {
    path "*" {
      capabilities = ["list"]
    }
  }
}

However when running, the token only provided access to the default variable at nomad/jobs/param.

[tgross]

Hi @michael-strigo! This is actually supposed to work already. We merged the bug fix in #17018 yesterday. The PR says it fixes periodic jobs but the dispatch jobs pick up their identity the same way (with a parent job ID). That will ship in Nomad 1.6.0 (with a backport to Nomad 1.5.x and 1.4.x). I'm going to close this issue out, but thanks for reporting it!

[michael-strigo]

Nice, you are closing issues faster than I can report. There's nothing for me left to do here 🤣