error message says need "root" capabilities. Now called "sudo" in vault

[kmcvicker]

Nomad version

not sure, I run the vault server not the nomad server

Operating system and Environment details

linux

Issue

From the nomad error logs.

• token must have one of the following capabilities ["update" "root"] on "auth/token/revoke-accessor"; has [deny]
• token must have one of the following capabilities ["read" "root"] on "auth/token/roles/nomad-server"; has [deny]
• token must have one of the following capabilities ["update" "root"] on "auth/token/create/nomad-server"; has [deny]

vault now uses "sudo" not "root" in the capabilities, same effect but different syntax

Reproduction steps

have the wrong permissions on vault paths.

Nomad Server logs (if appropriate)

Nomad Client logs (if appropriate)

Job file (if appropriate)

[angrycub]

There is a known issue with compatibility between older Vault versions (before Vault 0.10.0) with Nomad 0.8.5. This was corrected and additional testing to prevent regression added in Nomad 0.8.6 via #4698. Is it possible that you are encountering that combination?

Or is your concern that the label is incorrect? For the first error, the labels indicate that the token is expected to have update capability or be a root token, so root would be an appropriate capability to sense.

[angrycub]

A follow-up comment: the sudo capability in Vault is used (when paired with an appropriate action capability—create,read,update,delete,list) to perform that action on "paths that are root-protected". Nomad does not use those paths, so does not require the sudo capability.

I will mark this resolved, but please ping back if this additional information doesn't resolve your concerns.

[github-actions]

I'm going to lock this issue because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.