Commits on Jan 6, 2022

1. Un-break templates when using vault stanza change_mode noop …

   Templates in nomad jobs make use of the vault token defined in
   the vault stanza when issuing credentials like client certificates.
   
   When using change_mode "noop" in the vault stanza, consul-template
   is not informed in case a vault token is re-issued (which can
   happen from time to time for various reasons, as described
   in https://www.nomadproject.io/docs/job-specification/vault).
   
   As a result, consul-template will keep using the old vault token
   to renew credentials and - once the token expired - stop renewing
   credentials. The symptom of this problem is a vault_token
   file that is newer than the issued credential (e.g., TLS certificate)
   in a job's /secrets directory.
   
   This change corrects this, so that h.updater.updatedVaultToken(token)
   is called, which will inform stakeholders about the new
   token and make sure, the new token is used by consul-template.
   
   Example job template fragment:
   
       vault {
           policies = ["nomad-job-policy"]
           change_mode = "noop"
       }
   
       template {
         data = <<-EOH
           {{ with secret "pki_int/issue/nomad-job"
           "common_name=myjob.service.consul" "ttl=90m"
           "alt_names=localhost" "ip_sans=127.0.0.1"}}
           {{ .Data.certificate }}
           {{ .Data.private_key }}
           {{ .Data.issuing_ca }}
           {{ end }}
         EOH
         destination = "${NOMAD_SECRETS_DIR}/myjob.crt"
         change_mode = "noop"
       }
   
   This fix does not alter the meaning of the three change modes of vault
   
   - "noop" - Take no action
   - "restart" - Restart the job
   - "signal" - send a signal to the task
   
   as the switch statement following line 232 contains the necessary
   logic.
   
   It is assumed that "take no action" was never meant to mean "don't tell
   consul-template about the new vault token".
   
   Successfully tested in a staging cluster consisting of multiple
   nomad client nodes.

   

   grembo committed Jan 6, 2022
   Configuration menu

   • View commit details
   • Copy full SHA for 990e055
   • Browse repository at this point

   Copy the full SHA

   990e055 View commit details

   Browse the repository at this point in the history