How can I create a Vault template policy referencing Nomad job metadata?

ddaws · July 12, 2022, 3:32pm

Hi, teams I support are deploying workloads using Nomad and retrieving credentials from Vault using the Nomad Vault integration.

To simplify policy management I would like to be able to create a Vault template policy to allow services to access their own credentials from the KV store similar to the identity policy example in the policies guide.

Something like

path "secret/data/{{identity.entity.metadata.team}}/services/{{identity.entity.name}}/*" {
  capabilities = ["read", "list"]
}

And then grant team access via a team admin policy like

path "secret/data/{{identity.entity.metadata.team}}/services/+/*" {
  capabilities = ["create", "update", "patch", "read", "delete"]
}

I can’t find any information about how or if entity information is populated when Nomad generates a Vault job token. Is what I would like to do possible? Could you share some reference on what identity information is associated to the Vault token generated by Nomad, and how to associate metadata to the token?

Thank you

owen · September 26, 2022, 1:34pm

I did some research on this and in fact came here to post this exact question, but since you beat me to it and this post got no replies, I gather that the answer is no. Furthermore, I don’t think Vault can do this, at least as it stands today - there’s no way for Nomad to create Vault identities (since it doesn’t provide an auth engine for Vault, and since the auth/token/create endpoint doesn’t allow associating an arbitrary identity with the new token), and there’s no way today for Vault ACLs to reference token metadata, which Nomad otherwise could set.

The compromise I’ve arrived at is that each Nomad job also has a unique policy associated with it. This unfortunately means that my automation layer has to have the ability to create those policies, giving it de facto root access to Vault (since it can always create a policy with sudo access), but it works for my needs. I’d love to see this addressed in the product, though.

jrasell · October 3, 2022, 2:06pm

Hi @ddaws,

This is not currently possible, but certainly something we would be interested into looking into if possible. Would you be able to open a feature request against our repository so more engineers and community members could take a look?

Thanks,
jrasell and the Nomad team

ddaws · October 12, 2022, 7:27pm

Hey @jrasell, I’ve created an issue here:

github.com/hashicorp/nomad

Add support for passing identity information from Nomad to Vault

opened 07:27PM - 12 Oct 22 UTC

ddaws

type/enhancement

### Proposal It would be useful to be able to pass identity information from …Nomad to Vault to support creating template policies for services. Currently the Nomad to Vault integration does not pass any identity information, so each service ends up having it's own policy. For example, given two Nomad jobs like ```hcl # job-abc.nomad job "abc" { # ... } job "xyz" { # ... } ``` I need to create two policies in Vault to provide access to different paths in the KV store ```hcl # service-abc.hcl path "secrets/data/services/abc" { capabilities = [ "read" ] } # service-xyz.hcl path "secrets/data/services/xyz" { capabilities = [ "read" ] } ``` It would be great if this could be expressed as a single dynamic policy like ```hcl # service.hcl path "secrets/data/services/{{ identity.entity.name }}" { capabilities = [ "read" ] } ``` ### Use-cases The primary use case is providing consistent access to Vault for services. In my toy example I talked about two services but in practices teams are often running 10s or 100s of jobs in Nomad and most jobs need roughly the same access to their own secrets, with some jobs needing extra access that could be provided through additional policies. ### Attempted Solutions I am currently solving this using Terraform to manage policies in Vault and the `templatefile` function in Terraform, but this still requires a change to my Terraform code for every additional service (needs to be added to the list of services and therefor needs and MR and review). Templating policies through Terraform still results in a large number of static policies being created in Vault which makes the Vault UI and CLI less usable.