docs: describe the default Workload Identity ACL policy #17245
Merged
Conversation
This file contains bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Workload Identities have an implicit default policy. This policy can't currently be described via HCL because it includes task interpolation for Variables and access to the Services API (which doesn't exist as its own ACL capbility). Describe this in our WI documentation. Fixes: #16277
tgross
added
theme/docs
jrasell
approved these changes
May 19, 2023
Comment on lines
+50
to
+52
| described in [Task Access to Variables][]. The implicit policy also allows | ||
| access to list or read any Nomad service registration as with the [List Services | ||
| API][] or [Read Service API][]. |
There was a problem hiding this comment.
Suggested change
| described in [Task Access to Variables][]. The implicit policy also allows | |
| access to list or read any Nomad service registration as with the [List Services | |
| API][] or [Read Service API][]. | |
| described in [Task Access to Variables][]. The implicit policy also allows | |
| access to list or read any Nomad service registration in the same namespace | |
| as the job, as with the [List Services API][] or [Read Service API][]. |
There was a problem hiding this comment.
Looking at the code I don't think that's the case? The template block uses the job's namespace but we don't enforce that as an ACL policy. So if a workload uses the Task API it can read services in another namespace.
The current code assumes that if you have a valid WI claim that we don't need to check the namespace (ref service_registration_endpoint.go#L220). Which seems like it could have been a regression in behavior. But if I look at the original auth code from 1.3.0 (ref service_registration_endpoint.go#L437-L477) where we only had a node secret and not a WI, that's always been the policy.
I don't think this is unintentional either, as we have #14177 open which is saying "hey let's make sure the template block can do that too!"
tgross
added
backport/1.4.x
This was referenced May 19, 2023
Merged
tgross
added a commit
that referenced
this pull request
May 19, 2023
Workload Identities have an implicit default policy. This policy can't currently be described via HCL because it includes task interpolation for Variables and access to the Services API (which doesn't exist as its own ACL capbility). Describe this in our WI documentation. Fixes: #16277
tgross
added a commit
that referenced
this pull request
May 19, 2023
) Workload Identities have an implicit default policy. This policy can't currently be described via HCL because it includes task interpolation for Variables and access to the Services API (which doesn't exist as its own ACL capbility). Describe this in our WI documentation. Fixes: #16277 Co-authored-by: Tim Gross <tgross@hashicorp.com>
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Workload Identities have an implicit default policy. This policy can't currently be described via HCL because it includes task interpolation for Variables and access to the Services API (which doesn't exist as its own ACL capbility). Describe this in our WI documentation.
Fixes: #16277