Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Enable ACLs on E2E test clients #16530

Merged
merged 2 commits into from
Mar 16, 2023
Merged

Enable ACLs on E2E test clients #16530

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
2 commits
Select commit Hold shift + click to select a range
2005b05
e2e: uniformly enable acls across all agents
schmichael Mar 16, 2023
ece6ec8
docs: clarify that acls should be set everywhere
schmichael Mar 16, 2023
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
10 changes: 10 additions & 0 deletions e2e/terraform/etc/nomad.d/base.hcl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -7,6 +7,16 @@ audit {
enabled = true
}

acl {
enabled = true

# These values are used by the testACLTokenExpiration test within the acl
# test suite. If these need to be updated, please ensure the new values are
# reflected within the test suite and do not break the tests. Thanks.
token_min_expiration_ttl = "1s"
token_max_expiration_ttl = "24h"
}

telemetry {
collection_interval = "1s"
disable_hostname = true
Expand Down
10 changes: 0 additions & 10 deletions e2e/terraform/etc/nomad.d/server-linux.hcl
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -2,13 +2,3 @@ server {
enabled = true
bootstrap_expect = 3
}

acl {
enabled = true

# These values are used by the testACLTokenExpiration test within the acl
# test suite. If these need to be updated, please ensure the new values are
# reflected within the test suite and do not break the tests. Thanks.
token_min_expiration_ttl = "1s"
token_max_expiration_ttl = "24h"
}
9 changes: 5 additions & 4 deletions website/content/docs/configuration/acl.mdx
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -26,10 +26,11 @@ acl {
## `acl` Parameters

- `enabled` `(bool: false)` - Specifies if ACL enforcement is enabled. All other
ACL configuration options depend on this value. Note that the Nomad command
line client will send requests for client endpoints such as `alloc exec`
directly to Nomad clients whenever they are accessible. In this scenario, the
client will enforce ACLs, so both servers and clients should have ACLs enabled.
ACL configuration options depend on this value. All agents should have the
same value for this parameter. For example the Nomad command line will
send requests for client endpoints such as `alloc exec` directly to Nomad
clients whenever they are accessible. In this scenario, the client will
enforce ACLs, so both servers and clients should have ACLs enabled.

- `token_ttl` `(string: "30s")` - Specifies the maximum time-to-live (TTL) for
cached ACL tokens. This does not affect servers, since they do not cache tokens.
Expand Down