-
Notifications
You must be signed in to change notification settings - Fork 1.9k
New issue
Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.
By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.
Already on GitHub? Sign in to your account
docs: Consul Workload Identity integration #18685
Conversation
52041ab
to
f606552
Compare
f606552
to
5be077f
Compare
5be077f
to
c377e4f
Compare
c377e4f
to
fedb510
Compare
fedb510
to
ba0ddd1
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Some comments, but mostly are probably due to my own ignorance on the topic 😅
|
||
```json | ||
{ | ||
"JWKSURL": "https://nomad.example.com:4646/.well-known/jwks.json", |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Can Consul reference internal services here? 🤔
"JWKSURL": "https://nomad.example.com:4646/.well-known/jwks.json", | |
"JWKSURL": "https://nomad.service.consul:4646/.well-known/jwks.json", |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Probably, but I doubt Nomad's TLS cert is going to be set up for that typically?
The Nomad client will make the Consul token available to the task by writing it | ||
to the secret directory at `secrets/consul_token` and by injecting a | ||
`CONSUL_TOKEN` environment variable in the task. If the Nomad cluster is |
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
Adding env
and file
to the consul
block (like vault
) could be a nice future work.
ba0ddd1
to
e634fc6
Compare
There was a problem hiding this comment.
Choose a reason for hiding this comment
The reason will be displayed to describe this comment to others. Learn more.
High level thoughts:
- Overall this is looking good! I hadn't 100% followed along with the ways that this diverged with Vault, but its really not that much harder once you configure the agent defaults. I'm excited to get this going!
- In "Using Nomad Workload Identity with Consul" on "integrations/consul-integration" we should explicitly say that you no longer will need to pass in Consul tokens on job submit. Probably also worth mentioning in the "Migrating to Using Workload Identity with Consul" category.
- Should we elevate the Workload Identity example in the agent config section to come right after the Default? Should this become the default in 1.8? In 1.9?
- Parsing error at end of docs/job-specification/consul (see the preview page, it'll be obvious) - also at "The token provided by the [-consul-token] flag" and at "Refer to [Configuring Consul Authentication][] for more details." - A few other link rendering errors too
Good call. Done.
Done. Yes, in Nomad 1.9 we'll make it the default.
Gah. Ok, I think I've fixed them all. Will re-review once the new preview is done. |
355c76f
to
8b341e2
Compare
Documentation updates to support the new Consul integration with Nomad Workload Identity. Included: * Added a large section to the Consul integration docs to explain how to set up auth methods and binding rules (by hand, assuming we don't ship a `nomad setup-consul` tool for now), and how to safely migrate from the existing workflow to the new one. * Move `consul` block out of `group` and onto its own page now that we have it available at the `task` scope, and expanded examples of its use. * Added the `service_identity` and `task_identity` blocks to the Nomad agent configuration, and provided a recommended default. * Added the `identity` block to the `service` block page. * Added a rough compatibility matrix to the Consul integration page.
8b341e2
to
ea93817
Compare
Documentation updates to support the new Consul integration with Nomad Workload Identity. Included: * Added a large section to the Consul integration docs to explain how to set up auth methods and binding rules (by hand, assuming we don't ship a `nomad setup-consul` tool for now), and how to safely migrate from the existing workflow to the new one. * Move `consul` block out of `group` and onto its own page now that we have it available at the `task` scope, and expanded examples of its use. * Added the `service_identity` and `task_identity` blocks to the Nomad agent configuration, and provided a recommended default. * Added the `identity` block to the `service` block page. * Added a rough compatibility matrix to the Consul integration page.
Documentation updates to support the new Consul integration with Nomad Workload Identity. Included: * Added a large section to the Consul integration docs to explain how to set up auth methods and binding rules (by hand, assuming we don't ship a `nomad setup-consul` tool for now), and how to safely migrate from the existing workflow to the new one. * Move `consul` block out of `group` and onto its own page now that we have it available at the `task` scope, and expanded examples of its use. * Added the `service_identity` and `task_identity` blocks to the Nomad agent configuration, and provided a recommended default. * Added the `identity` block to the `service` block page. * Added a rough compatibility matrix to the Consul integration page.
Documentation updates to support the new Consul integration with Nomad Workload Identity. Included:
nomad setup-consul
tool for now), and how to safely migrate from the existing workflow to the new one.consul
block out ofgroup
and onto its own page now that we have it available at thetask
scope, and expanded examples of its use.service_identity
andtask_identity
blocks to the Nomad agent configuration, and provided a recommended default.identity
block to theservice
block page.Preview links for the significant page changes (I'll try to keep these links up to date as I land changes):