Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Jump to bottom

docs: add Consul policy for Consul Namespace support #9014

Merged
merged 2 commits into from
Oct 2, 2020
Merged

docs: add Consul policy for Consul Namespace support #9014

Show file tree
Hide file tree
Changes from 1 commit
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
d553a59
docs: add Consul policy for Consul Namespace support
tgross Oct 2, 2020
af2b111
Apply suggestions from code review
tgross Oct 2, 2020
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 1 addition & 1 deletion CHANGELOG.md
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -5,7 +5,7 @@ IMPROVEMENTS:
* api: Added support for cancellation contexts to HTTP API. [[GH-8836](https://github.com/hashicorp/nomad/issues/8836)]
* client: Added support for Azure fingerprinting. [[GH-8979](https://github.com/hashicorp/nomad/issues/8979)]
* client: Updated consul-template to v0.25.0 - config function_blacklist deprecated and replaced with function_denylist [[GH-8988](https://github.com/hashicorp/nomad/pull/8988)]
* consul: Support consul namespace (consul enterprise) in client configuration. [[GH-8849](https://github.com/hashicorp/nomad/pull/8849)]
* consul: Support Consul namespace (Consul Enterprise) in client configuration. [[GH-8849](https://github.com/hashicorp/nomad/pull/8849)]
* driver/docker: Upgrade pause container and detect architecture [[GH-8957](https://github.com/hashicorp/nomad/pull/8957)]
* jobspec: Lowered minimum CPU allowed from 10 to 1. [[GH-8996](https://github.com/hashicorp/nomad/issues/8996)]

Expand Down
32 changes: 32 additions & 0 deletions website/pages/docs/configuration/consul.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -180,5 +180,37 @@ consul {
}
```

### Consul Namespace

Consul does not allow ACL policies associated with namespaces to use agent
permissions. Nomad requires `agent:read` permissions. In order to use the
`consul_namespace` feature, Nomad will need a token generated in Consul's
default namespace. That token should be created from with `agent:read` as well
tgross marked this conversation as resolved.
Show resolved Hide resolved
as a `namespace` block with the other relevant permissions for running Nomad
in the intended namespace. The Consul policy below shows the required policy
tgross marked this conversation as resolved.
Show resolved Hide resolved
configuration:
tgross marked this conversation as resolved.
Show resolved Hide resolved

```
agent_prefix "" {
policy = "read"
}

namespace "nomad-ns" {
acl = "write"

key_prefix "" {
policy = "write"
tgross marked this conversation as resolved.
Show resolved Hide resolved
}

node_prefix "" {
policy = "read"
}

service_prefix "" {
policy = "write"
}
}
```

[consul]: https://www.consul.io/ 'Consul by HashiCorp'
[bootstrap]: https://learn.hashicorp.com/tutorials/nomad/clustering 'Automatic Bootstrapping'