2017-08-23 23:56:05 +00:00
|
|
|
---
|
2020-02-06 23:45:31 +00:00
|
|
|
layout: docs
|
|
|
|
|
page_title: acl Stanza - Agent Configuration
|
|
|
|
|
description: >-
|
|
|
|
|
The "acl" stanza configures the Nomad agent to enable ACLs and tune various
|
|
|
|
|
parameters.
|
2017-08-23 23:56:05 +00:00
|
|
|
---
|
|
|
|
|
|
|
|
|
|
# `acl` Stanza
|
|
|
|
|
|
2020-02-06 23:45:31 +00:00
|
|
|
<Placement groups={['acl']} />
|
2017-08-23 23:56:05 +00:00
|
|
|
|
2020-03-13 17:16:01 +00:00
|
|
|
The `acl` stanza configures the Nomad agent to enable ACLs and tunes various
|
|
|
|
|
ACL parameters. Learn more about configuring Nomad's ACL system in the [Secure
|
|
|
|
|
Nomad with Access Control guide][secure-guide].
|
2017-08-23 23:56:05 +00:00
|
|
|
|
|
|
|
|
```hcl
|
|
|
|
|
acl {
|
|
|
|
|
enabled = true
|
|
|
|
|
token_ttl = "30s"
|
|
|
|
|
policy_ttl = "60s"
|
|
|
|
|
}
|
|
|
|
|
```
|
|
|
|
|
|
|
|
|
|
## `acl` Parameters
|
|
|
|
|
|
|
|
|
|
- `enabled` `(bool: false)` - Specifies if ACL enforcement is enabled. All other
|
2022-01-07 21:18:41 +00:00
|
|
|
ACL configuration options depend on this value. Note that the Nomad command
|
|
|
|
|
line client will send requests for client endpoints such as `alloc exec`
|
|
|
|
|
directly to Nomad clients whenever they are accessible. In this scenario, the
|
|
|
|
|
client will enforce ACLs, so both servers and clients should have ACLs enabled.
|
2017-08-23 23:56:05 +00:00
|
|
|
|
|
|
|
|
- `token_ttl` `(string: "30s")` - Specifies the maximum time-to-live (TTL) for
|
|
|
|
|
cached ACL tokens. This does not affect servers, since they do not cache tokens.
|
|
|
|
|
Setting this value lower reduces how stale a token can be, but increases
|
|
|
|
|
the request load against servers. If a client cannot reach a server, for example
|
|
|
|
|
because of an outage, the TTL will be ignored and the cached value used.
|
|
|
|
|
|
|
|
|
|
- `policy_ttl` `(string: "30s")` - Specifies the maximum time-to-live (TTL) for
|
|
|
|
|
cached ACL policies. This does not affect servers, since they do not cache policies.
|
|
|
|
|
Setting this value lower reduces how stale a policy can be, but increases
|
|
|
|
|
the request load against servers. If a client cannot reach a server, for example
|
|
|
|
|
because of an outage, the TTL will be ignored and the cached value used.
|
|
|
|
|
|
|
|
|
|
- `replication_token` `(string: "")` - Specifies the Secret ID of the ACL token
|
|
|
|
|
to use for replicating policies and tokens. This is used by servers in non-authoritative
|
2021-08-03 10:56:00 +00:00
|
|
|
region to mirror the policies and tokens into the local region from [authoritative_region][authoritative-region].
|
2020-03-13 17:16:01 +00:00
|
|
|
|
2020-09-29 16:48:32 +00:00
|
|
|
[secure-guide]: https://learn.hashicorp.com/collections/nomad/access-control
|
2021-08-03 10:56:00 +00:00
|
|
|
[authoritative-region]: /docs/configuration/server#authoritative_region
|
