Nomad secrets engine
Note: This engine can use external X.509 certificates as part of TLS or signature validation. Verifying signatures against X.509 certificates that use SHA-1 is deprecated and is no longer usable without a workaround starting in Vault 1.12. See the deprecation FAQ for more information.
Name: Nomad
Nomad is a simple, flexible scheduler and workload orchestrator. The Nomad secrets secrets engine for Vault generates Nomad ACL tokens dynamically based on pre-existing Nomad ACL policies.
This page will show a quick start for this secrets engine. For detailed documentation
on every path, use vault path-help
after mounting the secrets engine.
Version information ACLs are only available on Nomad 0.7.0 and above.
Quick start
The first step to using the Vault secrets engine is to enable it.
Optionally, we can configure the lease settings for credentials generated
by Vault. This is done by writing to the config/lease
key:
For a quick start, you can use the SecretID token provided by the Nomad ACL bootstrap process, although this is discouraged for production deployments.
The suggested pattern is to generate a token specifically for Vault, following the Nomad ACL guide
Next, we must configure Vault to know how to contact Nomad. This is done by writing the access information:
In this case, we've configured Vault to connect to Nomad
on the default port with the loopback address. We've also provided
an ACL token to use with the token
parameter. Vault must have a management
type token so that it can create and revoke ACL tokens.
The next step is to configure a role. A role is a logical name that maps to a set of policy names used to generate those credentials. For example, let's create a "monitoring" role that maps to a "readonly" policy:
The secrets engine expects either a single or a comma separated list of policy names.
To generate a new Nomad ACL token, we simply read from that role:
Here we can see that Vault has generated a new Nomad ACL token for us. We can test this token out, by reading it in Nomad (by it's accessor):
Tutorial
Refer to Generate Nomad Tokens with HashiCorp Vault for a step-by-step tutorial.
API
The Nomad secrets engine has a full HTTP API. Please see the Nomad Secrets Engine API for more details.