0

We have successfully enabled the ACL subsystem on our Nomad cluster by setting acl.enabled = true for all the Nomad servers on the cluster. It appears that the ACL works as expected without needing to set acl.enabled = true for the Nomad clients on the cluster.

The Nomad ACL docs do mention enabling ACL’s on Nomad clients:

To enforce client endpoints, you need to enable ACLs on clients as well. Do this by setting the enabled value of the acl stanza to true. Once complete, restart the client to read in the new configuration.

However, what we've seen is that Nomad CLI commands run from a client (without acl.enabled = true) are still gated with 403 (Permission Denied), as expected.

As our cluster has many clients, it would save us time if we did not have to explicitly enable ACL for every client.

To summarize - we would like to know if it is absolutely required that the Nomad clients also have their configuration updated to enable ACL, even though the ACL subsystem appears to already work by just enabling ACL on the Nomad servers.

Francis
  • 183
  • 2
  • 9

1 Answers1

1

if all of your nomad systems are on 100% trusted systems and you are fine with anyone on the network being able to submit jobs, etc... Then you don't need ACL's.

If you are NOT ok with that, for whatever reason, then you have to go through the ACL song and dance and make it work. If you also use Vault, you can integrate the two, making your life easier, see: https://www.vaultproject.io/docs/secrets/nomad

ACL's must be enabled on the client as well, "To enforce client endpoints, you need to enable ACLs on clients as well. " - https://learn.hashicorp.com/tutorials/nomad/access-control-bootstrap?in=nomad/access-control#enable-acls-on-nomad-clients

zie
  • 710
  • 4
  • 7
  • As mentioned in the original post, the Nomad clients already appear to be ACL-governed simply by enabling ACL on the Nomad servers. For example, Nomad CLI commands executed on Nomad clients (which don't have `acl.enabled = true`) are already gated with 403 (Permission Denied). What additional security comes with setting `acl.enabled = true` for Nomad clients? – Francis Mar 26 '21 at 20:49
  • 1
    Ah, Sorry, yes you definitely should enable acl.enabled = true on the clients as well. The reason is, the clients have their own API endpoints, and they also need to be secured. per documentation: "To enforce client endpoints, you need to enable ACLs on clients as well. " - https://learn.hashicorp.com/tutorials/nomad/access-control-bootstrap?in=nomad/access-control#enable-acls-on-nomad-clients – zie Mar 28 '21 at 18:23