Update templated nomad policies #21872
Conversation
github-actions
bot
added
the
theme/cli
tristanmorgan
force-pushed
the
update_nomad_server_template
branch
from
c1bd646
to
af26f0e
Compare
| @@ -2,7 +2,7 @@ agent_prefix "" { | |||
| policy = "read" | |||
| } | |||
| node_prefix "" { | |||
| policy = "read" | |||
| policy = "write" | |||
There was a problem hiding this comment.
@tristanmorgan Does Nomad register nodes into Consul? I thought it only registered services to existing Consul nodes.
There was a problem hiding this comment.
this is from:
since Consul 1.15 Nomad agents require a node:write policy, and not node:read like our documentation suggests.
There was a problem hiding this comment.
References from the pr minimal Consul policy for Nomad agents needs node:write
There was a problem hiding this comment.
Updated policy to limit changes to the named node.
| @@ -1,10 +1,12 @@ | |||
|
|
|||
| acl = "write" | |||
| acl = "write" | |||
| mesh = "write" | |||
There was a problem hiding this comment.
Why do Nomad servers need the mesh:write permission?
There was a problem hiding this comment.
from https://developer.hashicorp.com/nomad/docs/integrations/consul/acl#nomad-agents
Nomad servers also create configuration entries for Consul Service Mesh, so the specific permissions vary slightly between Nomad servers and clients.
tristanmorgan
force-pushed
the
update_nomad_server_template
branch
from
87c87db
to
c5dffcc
Compare
Description
Updated the templated polices to match the recommended in the docs.
Links
https://developer.hashicorp.com/nomad/docs/integrations/consul/acl#nomad-agents
hashicorp/nomad#23802
PR Checklist