Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

allow periodic jobs to use workload identity ACL policies #17018

Merged
merged 3 commits into from
May 22, 2023

Commits on Apr 28, 2023

  1. allow periodic jobs to use workload identity ACL policies

    prevent all calls to the [Task API](https://developer.hashicorp.com/nomad/api-docs/task-api) from a periodically-dispatched job failing with `403`.
    
    Since no policy for the job id (one with a `periodic-\d+` suffix) matches the generated token claims (that specifically use the [parent job id](https://github.com/hashicorp/nomad/blob/891999789689240006b2a6076b73ddc67249d48d/nomad/structs/structs.go#L10912C19-L10914)).
    
    ## steps to reproduce
    
    Create a policy with
    
    ```sh
    nomad acl policy apply -namespace default -job example example-job <(cat <<EOF
    namespace "default" {
      policy = "write"
    }
    EOF
    )
    ```
    
    Create a job
    
    ```hcl
    # example.nomad
    job "example" {
      datacenters = ["casa"]
      type = "batch"
      priority = 10
    
      periodic {
        cron             = "*/15 * * * * *"
        prohibit_overlap = true
      }
    
      group "example" {
        task "example" {
          driver = "docker"
    
          config {
            image = "curlimages/curl:7.87.0"
            args = [
              "--unix-socket", "${NOMAD_SECRETS_DIR}/api.sock",
              "-H", "Authorization: Bearer ${NOMAD_TOKEN}",
              "--fail-with-body",
              "--verbose",
              "localhost/v1/client/metadata",
            ]
          }
    
    
          identity {
            env = true
            file = false
          }
        }
      }
    
    }
    ```
    
    Run and dispatch
    ```sh
    nomad run example.nomad 
    echo "{}" | nomad job dispatch example -
    ```
    
    It'll fail with a 403, and upon inspecting the claims we find
    
    ```json
    echo "the second part of the JWT, possibly padded with equal signs" | base64 -d | jq
    {
      "nomad_namespace": "default",
      "nomad_job_id": "example",
      "nomad_allocation_id": "dcc6477e-1b20-afbd-b46a-d3810d198b53",
      "nomad_task": "example",
      "nbf": 1682647044,
      "iat": 1682647044
    }
    ```
    
    but current code searches for policies for job id `example/periodic-\d+`
    unRob committed Apr 28, 2023
    Configuration menu
    Copy the full SHA
    8711838 View commit details
    Browse the repository at this point in the history

Commits on May 19, 2023

  1. fixup tests for dispatch jobs

    tgross committed May 19, 2023
    Configuration menu
    Copy the full SHA
    8b1d2ac View commit details
    Browse the repository at this point in the history
  2. add changelog entry

    tgross committed May 19, 2023
    Configuration menu
    Copy the full SHA
    47732e1 View commit details
    Browse the repository at this point in the history