{"action":"created","issue":{"url":"https://api.github.com/repos/ketzacoatl/compute-demo/issues/9","repository_url":"https://api.github.com/repos/ketzacoatl/compute-demo","labels_url":"https://api.github.com/repos/ketzacoatl/compute-demo/issues/9/labels{/name}","comments_url":"https://api.github.com/repos/ketzacoatl/compute-demo/issues/9/comments","events_url":"https://api.github.com/repos/ketzacoatl/compute-demo/issues/9/events","html_url":"https://github.com/ketzacoatl/compute-demo/issues/9","id":287049286,"number":9,"title":"secure access (who can do what) to nomad with ACLs","user":{"login":"ketzacoatl","id":10122937,"avatar_url":"https://avatars3.githubusercontent.com/u/10122937?v=4","gravatar_id":"","url":"https://api.github.com/users/ketzacoatl","html_url":"https://github.com/ketzacoatl","followers_url":"https://api.github.com/users/ketzacoatl/followers","following_url":"https://api.github.com/users/ketzacoatl/following{/other_user}","gists_url":"https://api.github.com/users/ketzacoatl/gists{/gist_id}","starred_url":"https://api.github.com/users/ketzacoatl/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/ketzacoatl/subscriptions","organizations_url":"https://api.github.com/users/ketzacoatl/orgs","repos_url":"https://api.github.com/users/ketzacoatl/repos","events_url":"https://api.github.com/users/ketzacoatl/events{/privacy}","received_events_url":"https://api.github.com/users/ketzacoatl/received_events","type":"User","site_admin":false},"labels":[{"id":808915430,"url":"https://api.github.com/repos/ketzacoatl/compute-demo/labels/P2","name":"P2","color":"1d76db","default":false}],"state":"open","locked":false,"assignee":{"login":"kerscher","id":5324013,"avatar_url":"https://avatars3.githubusercontent.com/u/5324013?v=4","gravatar_id":"","url":"https://api.github.com/users/kerscher","html_url":"https://github.com/kerscher","followers_url":"https://api.github.com/users/kerscher/followers","following_url":"https://api.github.com/users/kerscher/following{/other_user}","gists_url":"https://api.github.com/users/kerscher/gists{/gist_id}","starred_url":"https://api.github.com/users/kerscher/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kerscher/subscriptions","organizations_url":"https://api.github.com/users/kerscher/orgs","repos_url":"https://api.github.com/users/kerscher/repos","events_url":"https://api.github.com/users/kerscher/events{/privacy}","received_events_url":"https://api.github.com/users/kerscher/received_events","type":"User","site_admin":false},"assignees":[{"login":"kerscher","id":5324013,"avatar_url":"https://avatars3.githubusercontent.com/u/5324013?v=4","gravatar_id":"","url":"https://api.github.com/users/kerscher","html_url":"https://github.com/kerscher","followers_url":"https://api.github.com/users/kerscher/followers","following_url":"https://api.github.com/users/kerscher/following{/other_user}","gists_url":"https://api.github.com/users/kerscher/gists{/gist_id}","starred_url":"https://api.github.com/users/kerscher/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kerscher/subscriptions","organizations_url":"https://api.github.com/users/kerscher/orgs","repos_url":"https://api.github.com/users/kerscher/repos","events_url":"https://api.github.com/users/kerscher/events{/privacy}","received_events_url":"https://api.github.com/users/kerscher/received_events","type":"User","site_admin":false}],"milestone":null,"comments":1,"created_at":"2018-01-09T11:02:04Z","updated_at":"2018-02-15T22:05:46Z","closed_at":null,"author_association":"OWNER","body":"See https://www.nomadproject.io/guides/acl.html for more info about ACLs in Nomad. The purpose of this ticket is to map out and demonstrate the basic configuration that is needed to put in place ACLs we would feel comfortable/interested to run in production. Deliverables should include:\r\n\r\n- [ ] a demonstration\r\n- [ ] a document describing the ACL configuration and stepping an operator/engineer through the process of re-creating the demo (helper scripts are OK)\r\n- [ ] the basic configs needed for the ACL setup.\r\n\r\nAssume a new compute stack deployed. Please research, think over and write up a description of the ACL configuration proposed, before actually implementing the configuration in nomad. ATM, requests to run jobs (as well as commands to change existing/running jobs) can be sent to the Nomad server from the worker/clients, and any user on the host has `nomad` available.\r\n\r\nWhile SSL (another ticket) is needed to really secure this configuration, the the general expectation for ACLs, and in an ideal configuration, would limit access to Nomad to human operators, or agents we explicitly provide access to. As part of this work, it would make sense to consider how we will provide credentials to user/operators, and how they will use those credentials in practice, rotate to get new creds, and revoking access."},"comment":{"url":"https://api.github.com/repos/ketzacoatl/compute-demo/issues/comments/366077227","html_url":"https://github.com/ketzacoatl/compute-demo/issues/9#issuecomment-366077227","issue_url":"https://api.github.com/repos/ketzacoatl/compute-demo/issues/9","id":366077227,"user":{"login":"kerscher","id":5324013,"avatar_url":"https://avatars3.githubusercontent.com/u/5324013?v=4","gravatar_id":"","url":"https://api.github.com/users/kerscher","html_url":"https://github.com/kerscher","followers_url":"https://api.github.com/users/kerscher/followers","following_url":"https://api.github.com/users/kerscher/following{/other_user}","gists_url":"https://api.github.com/users/kerscher/gists{/gist_id}","starred_url":"https://api.github.com/users/kerscher/starred{/owner}{/repo}","subscriptions_url":"https://api.github.com/users/kerscher/subscriptions","organizations_url":"https://api.github.com/users/kerscher/orgs","repos_url":"https://api.github.com/users/kerscher/repos","events_url":"https://api.github.com/users/kerscher/events{/privacy}","received_events_url":"https://api.github.com/users/kerscher/received_events","type":"User","site_admin":false},"created_at":"2018-02-15T22:05:46Z","updated_at":"2018-02-15T22:05:46Z","author_association":"COLLABORATOR","body":"Demo document with instructions [available here](https://gist.github.com/kerscher/1797987f2d0cc491d7717a15539dbe88). The policies are located on [this new repository](https://github.com/kerscher/nomad-acl-policies).\r\n\r\nThe built-in way of writing it has some ugly quoting issues, so I converted them to YAML and the `Makefile` takes care of [making a valid JSON](https://github.com/kerscher/nomad-acl-policies/blob/25f8c6ded256dce07428c37870d2d9d48159504f/Makefile#L12) for the user. This is mentioned in the demo document."}}
{"actor":{"display_login":"kerscher"}}