allow attaching ACL policy to entire namespace

[michael-strigo]

Proposal

Having the ability to apply policy to the entire namespace.

Use-cases

We operate dev environments. Each env is a Nomad job. These jobs share the same set of variables under unified variable path.
It would be nice, if we could allow all of the jobs in the namespace to be able to access the variable path without having to manually apply a policy per job. Since policy apply requires a management token, this requires anyone that needs to deploy such environment to have a root token.

Attempted Solutions

Right now we just have a job that monitors the nomad event stream and applies policies to jobs in the namespace.

[tgross]

Hi @michael-strigo I took a look at the original design docs and PR #14140 for that and I think the reason we didn't do it that way originally was that it made the state store indexer (ref schema.go#L829-L891) weirdly ambiguous in some corner cases because there are very few restrictions on Job names. But it might be possible for us to come up with a reasonable workaround for it.

I'll mark this for roadmapping.

[michael-strigo]

A possible alternative would be to maybe allow wildcards in job names.

[msherman13]

Coming in from duplicate issue #19803 , expressing support for this feature. Job name wildcards seems like a good idea.