luxolus
/
open-nomad
2
0
Fork 0
Code Issues 1 Pull Requests Packages Releases Wiki Activity
open-nomad/nomad/structs
History
Tim Gross bfcbc00f4e workload identity (#13223) 
In order to support implicit ACL policies for tasks to get their own
secrets, each task would need to have its own ACL token. This would
add extra raft overhead as well as new garbage collection jobs for
cleaning up task-specific ACL tokens. Instead, Nomad will create a
workload Identity Claim for each task.

An Identity Claim is a JSON Web Token (JWT) signed by the server’s
private key and attached to an Allocation at the time a plan is
applied. The encoded JWT can be submitted as the X-Nomad-Token header
to replace ACL token secret IDs for the RPCs that support identity
claims.

Whenever a key is is added to a server’s keyring, it will use the key
as the seed for a Ed25519 public-private private keypair. That keypair
will be used for signing the JWT and for verifying the JWT.

This implementation is a ruthlessly minimal approach to support the
secure variables feature. When a JWT is verified, the allocation ID
will be checked against the Nomad state store, and non-existent or
terminal allocation IDs will cause the validation to be rejected. This
is sufficient to support the secure variables feature at launch
without requiring implementation of a background process to renew
soon-to-expire tokens.
 		2022-07-11 13:34:05 -04:00
..
config Merge pull request #13109 from hashicorp/merge-release-1.3.1-branch 2022-05-25 10:45:09 -04:00
alloc.go client: fixed a problem calculating a service namespace. (#13493) 2022-06-28 09:47:28 +02:00
alloc_test.go client: fixed a problem calculating a service namespace. (#13493) 2022-06-28 09:47:28 +02:00
batch_future.go drain: refactor batch_future into its own file 2018-04-02 16:40:06 -07:00
batch_future_test.go ci: swap ci parallelization for unconstrained gomaxprocs 2022-03-15 12:58:52 -05:00
bitmap.go assign names 2017-07-07 12:03:11 -07:00
bitmap_test.go ci: swap ci parallelization for unconstrained gomaxprocs 2022-03-15 12:58:52 -05:00
connect.go e2e: consul namespace tests from nomad ent 2021-04-19 15:35:31 -06:00
connect_test.go ci: swap ci parallelization for unconstrained gomaxprocs 2022-03-15 12:58:52 -05:00
consul.go jobspec: add service block provider parameter and validation. 2022-03-14 09:21:20 +01:00
consul_oss.go gofmt all the files 2021-10-01 10:14:28 -04:00
consul_oss_test.go ci: swap ci parallelization for unconstrained gomaxprocs 2022-03-15 12:58:52 -05:00
consul_test.go ci: swap ci parallelization for unconstrained gomaxprocs 2022-03-15 12:58:52 -05:00
csi.go CSI: make plugin health_timeout configurable in csi_plugin stanza (#13340) 2022-06-14 10:04:16 -04:00
csi_test.go CSI: enforce single access mode at validation time (#12337) 2022-03-23 09:21:26 -04:00
devices.go Initial implementation of device preemption 2018-11-15 11:09:26 -06:00
devices_test.go ci: swap ci parallelization for unconstrained gomaxprocs 2022-03-15 12:58:52 -05:00
diff.go adding support for customized ingress tls (#13184) 2022-06-02 18:43:58 -04:00
diff_test.go adding support for customized ingress tls (#13184) 2022-06-02 18:43:58 -04:00
encoding.go json handles were moved to a new package in #10202 2021-04-02 13:31:10 +00:00
errors.go api: enable selecting subset of services using rendezvous hashing 2022-06-25 10:37:37 -05:00
errors_test.go ci: swap ci parallelization for unconstrained gomaxprocs 2022-03-15 12:58:52 -05:00
eval.go core: allow deleting of evaluations (#13492) 2022-07-06 16:30:11 +02:00
event.go events: fixup service events and rename topic to service. 2022-04-05 08:25:22 +01:00
extensions.go remove end-user algorithm selection (#13190) 2022-07-11 13:34:04 -04:00
funcs.go vault: revert support for entity aliases (#12723) 2022-04-22 10:46:34 -04:00
funcs_test.go vault: revert support for entity aliases (#12723) 2022-04-22 10:46:34 -04:00
generate.sh workload identity (#13223) 2022-07-11 13:34:05 -04:00
handlers.go json handles were moved to a new package in #10202 2021-04-02 13:31:10 +00:00
job.go job_hooks: add implicit constraint when using Consul for services. (#12602) 2022-04-20 14:09:13 +02:00
job_test.go job_hooks: add implicit constraint when using Consul for services. (#12602) 2022-04-20 14:09:13 +02:00
network.go build: update golangci-lint to v1.46.2 2022-05-31 23:32:01 +00:00
network_test.go ci: swap ci parallelization for unconstrained gomaxprocs 2022-03-15 12:58:52 -05:00
node.go CSI: allow updates to volumes on re-registration (#12167) 2022-03-07 11:06:59 -05:00
node_class.go use allow/deny instead of the colored alternatives (#9019) 2020-10-12 08:47:05 -04:00
node_class_test.go ci: swap ci parallelization for unconstrained gomaxprocs 2022-03-15 12:58:52 -05:00
node_test.go ci: swap ci parallelization for unconstrained gomaxprocs 2022-03-15 12:58:52 -05:00
operator.go core: allow pausing and un-pausing of leader broker routine (#13045) 2022-07-06 16:13:48 +02:00
search.go api: implement fuzzy search API 2021-04-16 16:36:07 -06:00
secure_variables.go remove end-user algorithm selection (#13190) 2022-07-11 13:34:04 -04:00
service_identities.go consul: plubming for specifying consul namespace in job/group 2021-04-05 10:03:19 -06:00
service_registration.go api: enable selecting subset of services using rendezvous hashing 2022-06-25 10:37:37 -05:00
service_registration_test.go api: enable selecting subset of services using rendezvous hashing 2022-06-25 10:37:37 -05:00
services.go adding support for customized ingress tls (#13184) 2022-06-02 18:43:58 -04:00
services_test.go docs: add docs and tests for tagged_addresses 2022-05-31 13:02:48 -05:00
streaming_rpc.go Fix some errcheck errors (#9811) 2021-01-14 12:46:35 -08:00
structs.go workload identity (#13223) 2022-07-11 13:34:05 -04:00
structs_codegen.go Codecgen full package 2018-04-26 15:24:53 -07:00
structs_oss.go gofmt all the files 2021-10-01 10:14:28 -04:00
structs_periodic_test.go ci: swap ci parallelization for unconstrained gomaxprocs 2022-03-15 12:58:52 -05:00
structs_test.go client: enforce max_kill_timeout client configuration 2022-07-06 15:29:38 -05:00
testing.go chore: fix incorrect docstring formatting. 2021-08-30 11:08:12 +02:00
uuid.go core: allow deleting of evaluations (#13492) 2022-07-06 16:30:11 +02:00
vault.go vault: revert support for entity aliases (#12723) 2022-04-22 10:46:34 -04:00
volume_test.go CSI: enforce single access mode at validation time (#12337) 2022-03-23 09:21:26 -04:00
volumes.go CSI: enforce single access mode at validation time (#12337) 2022-03-23 09:21:26 -04:00