Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

add deprecation warning for Vault/Consul token usage #18863

Merged
merged 1 commit into from
Oct 26, 2023

Conversation

tgross
Copy link
Member

@tgross tgross commented Oct 25, 2023

Submitting a Consul or Vault token with a job is deprecated in Nomad 1.7 and intended for removal in Nomad 1.9. Add a deprecation warning to the CLI when the user passes in the appropriate flag or environment variable.

Nomad agents will no longer need a Vault token when configured with workload identity, and we'll ignore Vault tokens in the agent config after Nomad 1.9. Log a warning at agent startup.

Ref: #15617
Ref: #15618


Resulting log line in the agent:

2023-10-25T10:15:27.664-0400 [WARN] agent: Setting a Vault token in the agent configuration is deprecated and will be removed in Nomad 1.9. Migrate your Vault configuration to use workload identity.: cluster=default

Resulting output from nomad job run:

$ nomad job run -vault-token hvs.RYwFOzaEc8aKyNIMzNiHfi4w ~/ws/nomad/etc/jobs/httpd.nomad
Warning: setting a Vault token when submitting a job is deprecated and will be
removed in Nomad 1.9. Migrate your Vault configuration to use workload identity.
==> 2023-10-25T10:16:19-04:00: Monitoring evaluation "a884a82e"
    2023-10-25T10:16:19-04:00: Evaluation triggered by job "httpd"
    2023-10-25T10:16:20-04:00: Evaluation within deployment: "25cc4819"
    2023-10-25T10:16:20-04:00: Allocation "a4ca7d9b" created: node "7a1e78e3", group "web"
    2023-10-25T10:16:20-04:00: Evaluation status changed: "pending" -> "complete"
==> 2023-10-25T10:16:20-04:00: Evaluation "a884a82e" finished with status "complete"
==> 2023-10-25T10:16:20-04:00: Monitoring deployment "25cc4819"
  ⠇ Deployment "25cc4819" in progress...
  ...

Submitting a Consul or Vault token with a job is deprecated in Nomad 1.7 and
intended for removal in Nomad 1.9. Add a deprecation warning to the CLI when the
user passes in the appropriate flag or environment variable.

Nomad agents will no longer need a Vault token when configured with workload
identity, and we'll ignore Vault tokens in the agent config after Nomad 1.9. Log
a warning at agent startup.

Ref: #15617
Ref: #15618
@tgross tgross merged commit 8f8265f into main Oct 26, 2023
28 checks passed
@tgross tgross deleted the token-deprecation-warning branch October 26, 2023 14:46
lgfa29 added a commit that referenced this pull request Oct 26, 2023
Apply the same deprecation notice from #18863 to the `nomad job plan`
command.
lgfa29 added a commit that referenced this pull request Oct 27, 2023
Apply the same deprecation notice from #18863 to the `nomad job plan`
command.
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

Successfully merging this pull request may close these issues.

2 participants