wi: new endpoint for listing workload attached ACL policies #25588

pkazmierczak · 2025-04-02T15:10:23Z

This introduces a new HTTP endpoint (and an associated CLI command) for querying
ACL policies associated with a workload identity. It allows users that want
to learn about the ACL capabilities from within WI-tasks to know what sort of
policies are enabled.

Fixes #24663
Internal ref: https://hashicorp.atlassian.net/browse/NMD-423

(reviewers: this requires #25547 to work)

Co-authored-by: Tim Gross <[email protected]>

arodd

Would be good to make sure we present enough data to determine whether the policy is applied at the job/group/task level, and it looks like this is potentially covered.

website/content/api-docs/acl/policies.mdx

aimeeu · 2025-04-03T17:02:36Z

@pkazmierczak is this going into the 1.10 release?
Nevermind - I saw the Slack thread that this will go into a dot release.

pkazmierczak · 2025-04-03T17:12:08Z

no, this is not going into 1.10.

gulducat · 2025-04-04T15:17:57Z

website/content/api-docs/acl/policies.mdx

+    },
+    "ModifyIndex": 26,
+    "Name": "nomad-policy",
+    "Rules": "# Allow read only access to the default namespace\nnamespace \"default\" {\n  policy = \"read\"\n}\n\n# Allow writing to the `foo` namespace\nnamespace \"foo\" {\n  policy = \"write\"\n}\n\nagent {\n  policy = \"read\"\n}\n\nnode {\n  policy = \"read\"\n}\n\nquota {\n  policy = \"read\"\n}\n",


I find myself right away also wanting this for non-WI tokens. I know that I can do nomad acl token self, then look at the Policies/Roles, then go inspect those (if I have permission?), but seeing the rules this clearly in a single API call is quite nice (if perhaps a bit of a security concern...)

if the command name was more specific, like nomad acl workload-identity-policy self then I wouldn't have this expectation, but I feel this new command has the same issue as "why doesn't nomad acl token self tell me about my WI token?" only in reverse: "why doesn't nomad acl policy self tell me about my ACL policy?"

Yeah, having nomad acl token self and nomad acl policy self both work for both WI and ACL Tokens really seems like the most intuitive behavior.

gulducat · 2025-04-04T15:30:16Z

Anyone wanting an easy way to try this out (after building locally):

wi-policy.hcl:

namespace "shared" {
  variables {
    path "*" {
      capabilities = ["read"]
    }
  }
}

wi-policy.nomad.hcl:

job "wi-policy" {
  type = "batch"
  group "g" {
    restart { attempts = 0 }
    reschedule { attempts = 0 }
    task "t" {
      driver = "raw_exec"
      config {
        command = "bash"
        args    =  ["-xc", "nomad acl policy self; nomad acl policy self -json"]
      }
      env {
        NOMAD_ADDR = "unix:${NOMAD_SECRETS_DIR}/api.sock"
      }
      identity {
        env = true
      }
    }
  }
}

$ nomad acl policy apply -namespace default -job wi-policy shared-policy ./wi-policy.hcl
Successfully wrote "shared-policy" ACL policy!

$ nomad run wi-policy.nomad.hcl
...

$ nomad logs -job wi-policy
Name           Job ID     Group Name       Task Name
shared-policy  wi-policy  <not specified>  <not specified>
{
    "shared-policy": {
        "CreateIndex": 470,
        "Description": "",
        "JobACL": {
            "Group": "",
            "JobID": "wi-policy",
            "Namespace": "default",
            "Task": ""
        },
        "ModifyIndex": 536,
        "Name": "shared-policy",
        "Rules": "namespace \"shared\" {\n  variables {\n    path \"*\" {\n      capabilities = [\"read\"]\n    }\n  }\n}\n\n"
    }
}

gulducat · 2025-04-04T15:44:08Z

command/acl_token_self.go

@@ -66,7 +66,17 @@ func (c *ACLTokenSelfCommand) Run(args []string) int {
 	// Get the specified token information
 	token, _, err := client.ACLTokens().Self(nil)
 	if err != nil {
-		c.Ui.Error(fmt.Sprintf("Error fetching self token: %s", err))
+		if !strings.Contains(err.Error(), "Unexpected response code: 404") {


I think this bool check is reversed, because this is what happens when I use a non-existent token in current main:

$ NOMAD_TOKEN=10000000-0000-0000-0000-000000000000 nomad acl token self Error fetching self token: Unexpected response code: 404 (ACL token not found)

Suggested change

if !strings.Contains(err.Error(), "Unexpected response code: 404") {

if strings.Contains(err.Error(), "Unexpected response code: 404") {

🤔 I don't follow, Daniel.

On main you will of course get 404 if you try to query token self with WI. What you're showing above is strange to me, prefixing nomad acl token self with a bogus token should give you 403 instead.

The conditional here is correct, though. For any error other than 404, we return error. In case we get 404, we further check job-attached policies, and only if we cannot find any, we say: no acl token and no policies attached.

Does that make sense?

what exactly I was thinking back then is lost to the mists of time, alas.

but, while I'm here comparing the two error messages from a bad, but valid (uuid), ACL token:

nomad release 1.10 is clearly about one thing:

Error fetching self token: Unexpected response code: 404 (ACL token not found)

this pr:

No ACL tokens or ACL policies attached to a workload identity found.

the new one seems to me like acl token self is only for workload ID, because I don't parse "or ACL policies attached to a workload identity" as a separate item? I get lost grammatically somewhere along the way before hitting "found" and I parse it as "No ... workload identity found."

this might be resolved for me with a single character:

No ACL tokens nor ACL policies attached to a workload identity found.

for bonus clarity, if a bit choppy in rhythm:

No ACL tokens, nor ACL policies attached to a workload identity, found.

The base branch was changed.

mismithhisler

This is a really nice feature, and thanks @gulducat for quick local testing policy/job!

command/acl_policy_self.go

tgross · 2025-05-06T13:14:41Z

command/agent/acl_endpoint.go

+	// Resolve policies for workload identities
+	policyReply := structs.ACLPolicySetResponse{}
+	if err := s.agent.RPC("ACL.GetClaimPolicies", &policyArgs, &policyReply); err != nil {
+		return nil, err
+	}


My objection to this API as it stands is that we're only presenting the ACL policies for Workload Identity claims but the API is /v1/acl/policy/self. Ignoring unifying the CLI output for the moment, either (a) this API should retrieve policies for any authenticated request or (b) it should be under a different route than /v1/acl/policy/self or (c) the RPC handler should be changed to cover both ACL tokens and WI claims. Unfortunately it looks like we shipped the RPC handler as-is and now it would be awkward to retrieve ACL token policies there. So I think (a) is my preferred option, but we'd need to split the API to send to different RPC handlers.

4053a48 implements option (a), but then we end up with a bit of a mess, because GetClaimPolicies and ListPolicies RPCs return different types (maps or slices, respectively). I thought perhaps the key in the map is the WI name, but it's just policy name, so I'll follow-up with a change that just returns a list of ACLPolicyStub to get a unified output.

ah but then we'd lose some data that's useful for WI-attached policies if we only return ACLPolicyStub :/

// ACLPolicyListStub is used to for listing ACL policies type ACLPolicyListStub struct { Name string Description string Hash []byte CreateIndex uint64 ModifyIndex uint64 }

This doesn't contain JobACLs or Rules.

aimeeu

Thanks for creating the docs content! I left a few style nits.

aimeeu · 2025-05-12T18:51:45Z

website/content/docs/commands/acl/policy/self.mdx

+The `acl policy self` command is used to fetch information about the currently
+set ACL policies attached to the workload.


Suggested change

The `acl policy self` command is used to fetch information about the currently

set ACL policies attached to the workload.

The `nomad acl policy self` command fetches information about the currently

set ACL policies attached to the workload.

Style nit: use active voice

aimeeu · 2025-05-12T18:52:03Z

website/content/docs/commands/acl/policy/self.mdx

+
+## Examples
+
+Fetch information about an existing ACL policies attached to the workload:


Suggested change

Fetch information about an existing ACL policies attached to the workload:

Fetch information about an existing ACL policies attached to the workload.

FYI the style guide wants us to introduce a code block with a descriptive, imperative sentence that ends with a period.

aimeeu · 2025-05-12T18:55:12Z

website/content/docs/commands/acl/token/self.mdx

@@ -40,3 +40,13 @@ Modify Index = 8
 Policies     = n/a
 Roles        = n/a
 ```
+
+The command will also detect if the current Nomad token is a workload identity


Suggested change

The command will also detect if the current Nomad token is a workload identity

The command also detects if the current Nomad token is a workload identity

style nit: use present tense

aimeeu · 2025-05-12T18:55:21Z

website/content/docs/commands/acl/token/self.mdx

@@ -40,3 +40,13 @@ Modify Index = 8
 Policies     = n/a
 Roles        = n/a
 ```
+
+The command will also detect if the current Nomad token is a workload identity
+JWT and respond with a hint if that's the case:


Suggested change

JWT and respond with a hint if that's the case:

JWT and respond with a hint if that's the case.

aimeeu · 2025-05-12T18:56:47Z

website/content/api-docs/acl/policies.mdx

+|--------|-----------------------|--------------------|
+| `GET`  | `/v1/acl/policy/self` | `application/json` |
+
+The table below shows this endpoint's support for


Suggested change

The table below shows this endpoint's support for

This table shows this endpoint's support for

style nit: we avoid using "below" or "above"

pkazmierczak and others added 7 commits March 28, 2025 17:22

acl: obsolete ResolveToken and use WhoAmI RPC endpoint instead

9b27f84

Update command/agent/acl_endpoint.go

0362ab6

Co-authored-by: Tim Gross <[email protected]>

better error message

3aff3b2

restore RPC

0fa3bfb

WhoAmI RPC should set query meta

7db690e

set reply index if there's an ACL token

6e72924

draft

654661d

pkazmierczak requested review from a team as code owners April 2, 2025 15:10

pkazmierczak marked this pull request as draft April 2, 2025 15:10

vercel bot deployed to Preview – nomad-ui April 2, 2025 15:10 View deployment

pkazmierczak added 2 commits April 3, 2025 12:05

url update

a59e92d

typo in the api route

1454528

vercel bot deployed to Preview – nomad-ui April 3, 2025 10:08 View deployment

pkazmierczak added 5 commits April 3, 2025 17:05

move SelfPolicy method to ACLPolicies

605bc14

add check for WI policies in acl token self CLI

7435e19

fix URL handling

d8f496a

changelog

d4e97f6

documentation

1683ae7

vercel bot deployed to Preview – nomad-ui April 3, 2025 15:18 View deployment

vercel bot deployed to Preview – nomad April 3, 2025 15:24 View deployment

pkazmierczak added 3 commits April 3, 2025 17:25

API doc

3ae337a

cli unit test

50686ec

acl endpoint test

8565bf2

vercel bot deployed to Preview – nomad-ui April 3, 2025 16:08 View deployment

pkazmierczak requested review from schmichael, gulducat, aimeeu and mismithhisler April 3, 2025 16:10

pkazmierczak self-assigned this Apr 3, 2025

vercel bot deployed to Preview – nomad-ui April 3, 2025 16:23 View deployment

aimeeu previously approved these changes Apr 3, 2025

View reviewed changes

aimeeu added the theme/docs Documentation issues and enhancements label Apr 3, 2025

arodd reviewed Apr 3, 2025

View reviewed changes

website/content/api-docs/acl/policies.mdx Show resolved Hide resolved

more elaborate acl policy self output

7d8e6ce

vercel bot deployed to Preview – nomad-ui April 4, 2025 08:13 View deployment

reformat mdx tables

739ecc6

vercel bot deployed to Preview – nomad-ui April 4, 2025 08:15 View deployment

pkazmierczak requested a review from tgross April 4, 2025 08:16

vercel bot deployed to Preview – nomad April 4, 2025 08:25 View deployment

gulducat reviewed Apr 4, 2025

View reviewed changes

pkazmierczak requested a review from gulducat April 22, 2025 15:25

Base automatically changed from f-self-token-lookup-wi-jwt to main April 22, 2025 15:53

pkazmierczak added the backport/1.10.x backport to 1.10.x release line label Apr 23, 2025

pkazmierczak requested a review from jrasell April 24, 2025 15:09

, n

56dfa5f

vercel bot deployed to Preview – nomad-ui April 25, 2025 17:32 View deployment

mismithhisler previously approved these changes May 6, 2025

View reviewed changes

tgross reviewed May 6, 2025

View reviewed changes

s/auth methods/policies

d229c19

pkazmierczak dismissed mismithhisler’s stale review via d229c19 May 6, 2025 13:35

vercel bot deployed to Preview – nomad-ui May 6, 2025 13:36 View deployment

list policies regardless of WI

4053a48

vercel bot deployed to Preview – nomad-ui May 6, 2025 16:25 View deployment

aimeeu reviewed May 12, 2025

View reviewed changes

Provide feedback

Saved searches

Use saved searches to filter your results more quickly

wi: new endpoint for listing workload attached ACL policies #25588

wi: new endpoint for listing workload attached ACL policies #25588

pkazmierczak commented Apr 2, 2025 •

edited

Loading

arodd left a comment

aimeeu commented Apr 3, 2025 •

edited

Loading

pkazmierczak commented Apr 3, 2025 via email

gulducat Apr 4, 2025

tgross Apr 4, 2025

gulducat commented Apr 4, 2025

gulducat Apr 4, 2025

pkazmierczak Apr 10, 2025

gulducat Apr 25, 2025

pkazmierczak Apr 25, 2025

mismithhisler left a comment

tgross May 6, 2025 •

edited

Loading

pkazmierczak May 6, 2025

pkazmierczak May 6, 2025

aimeeu left a comment

aimeeu May 12, 2025

aimeeu May 12, 2025

aimeeu May 12, 2025

aimeeu May 12, 2025

aimeeu May 12, 2025

	if !strings.Contains(err.Error(), "Unexpected response code: 404") {
	if strings.Contains(err.Error(), "Unexpected response code: 404") {

		The `acl policy self` command is used to fetch information about the currently
		set ACL policies attached to the workload.


		## Examples

		Fetch information about an existing ACL policies attached to the workload:

	The command will also detect if the current Nomad token is a workload identity
	The command also detects if the current Nomad token is a workload identity

	JWT and respond with a hint if that's the case:
	JWT and respond with a hint if that's the case.

	The table below shows this endpoint's support for
	This table shows this endpoint's support for

wi: new endpoint for listing workload attached ACL policies #25588

Are you sure you want to change the base?

wi: new endpoint for listing workload attached ACL policies #25588

Conversation

pkazmierczak commented Apr 2, 2025 • edited Loading

arodd left a comment

Choose a reason for hiding this comment

aimeeu commented Apr 3, 2025 • edited Loading

pkazmierczak commented Apr 3, 2025 via email

Choose a reason for hiding this comment

Choose a reason for hiding this comment

gulducat commented Apr 4, 2025

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

mismithhisler left a comment

Choose a reason for hiding this comment

tgross May 6, 2025 • edited Loading

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

aimeeu left a comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

Choose a reason for hiding this comment

pkazmierczak commented Apr 2, 2025 •

edited

Loading

aimeeu commented Apr 3, 2025 •

edited

Loading

tgross May 6, 2025 •

edited

Loading