Namespace ACL policy to allow force launching existing periodic jobs but deny modification

[jdebbink]

Nomad version

0.10.4

Issue

There is no namespace ACL policy that allows a periodic job to be launched without also giving permission to change and delete jobs.

This policy allows parameterized jobs to be launched but not periodic:

namespace "default" {
  policy = "read"
  capabilities = ["dispatch-job", "read-logs"]
}

This policy allows periodic jobs to be launched but it also gives permission to modify/stop/delete jobs, which is far more permission than we want to grant to just launch a job that already exists.

namespace "default" {
  policy = "read"
  capabilities = ["submit-job", "read-logs"]
}

Use Case

In production we want to allow teams to launch periodic/batch jobs that already exist but not be able to modify them in any way.

[notnoop]

Thanks for the suggestion @jdebbink . That does seem like a reasonable use case indeed!

[github-actions]

I'm going to lock this issue because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.