# Initiate node drain from the node itself

**URL:** <https://discuss.hashicorp.com/t/initiate-node-drain-from-the-node-itself/37454>\
**Category:** Nomad\
**Created:** [March 23, 2022, 3:57pm UTC](https://discuss.hashicorp.com/t/initiate-node-drain-from-the-node-itself/37454 "2022-03-23T15:57:28Z")\
**Posts on this page:** 2\
**Page:** 1

<div class="post-metadata">

**Author:** ![rnugmanov](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/rnugmanov/32/26919_2.png) [@rnugmanov](https://discuss.hashicorp.com/u/rnugmanov)\
**Post date:** [March 23, 2022, 3:57pm UTC](https://discuss.hashicorp.com/t/initiate-node-drain-from-the-node-itself/37454/1 "2022-03-23T15:57:28Z")

</div>

Hi,

I have a use case where a script running on nomad client node would need to trigger the drain mode on the same node.

The cluster has ACL enabled and to provide all nomad client machines with tokens capable of `node:write` is not an option

I am wondering since that script would already have root access on the node, is there any way to bypass the ACL? In other words, is there any way for the client to tell servers that it has to be drained?

Thanks a lot,  
Ruslan

---

<div class="post-metadata">

**Author:** ![bogue1979](https://sea2.discourse-cdn.com/hashicorp/user_avatar/discuss.hashicorp.com/bogue1979/32/15492_2.png) [@bogue1979](https://discuss.hashicorp.com/u/bogue1979)\
**Post date:** [April 13, 2022, 10:44pm UTC](https://discuss.hashicorp.com/t/initiate-node-drain-from-the-node-itself/37454/2 "2022-04-13T22:44:45Z")

</div>

If you have vault integration, you could create a nomad token via vault with `node:write` permissions within your script and use this token which may be valid only for some minutes.

> **[Generate Nomad Tokens with HashiCorp Vault | Nomad - HashiCorp Learn](https://learn.hashicorp.com/tutorials/nomad/vault-nomad-secrets?in=vault%2Fcross-products)**
>
> Configure the Nomad secrets engine in Vault to deliver Vault-managed Nomad
> ACL tokens.

Depending how the node drain is triggered, this process has to get a vault token which has a policy assigned with permissions to get a nomad token capable to drain the node in question.