Nomad添加acl認(rèn)證

1、在server節(jié)點(diǎn)的配置文件/etc/nomad/server.hcl添加啟用acl，如下：
server {
enabled = true
bootstrap_expect = 1
}
acl {
enabled = true
token_ttl = "30s"
policy_ttl = "60s"
}
配置添加完成后重啟nomad服務(wù)：service nomad restart

2、生成初始令牌
啟用ACL系統(tǒng)后，我們需要生成初始令牌。第一個(gè)令牌用于引導(dǎo)系統(tǒng)，應(yīng)注意不要丟失它。啟用ACL系統(tǒng)后，我們使用Bootstrap CLI
nomad acl bootstrap
Accessor ID = 5b7fd453-d3f7-6814-81dc-fcfe6daedea5
Secret ID = 9184ec35-65d4-9258-61e3-0c066d0a45c5
Name = Bootstrap Token
Type = management
Global = true
Policies = n/a
Create Time = 2017-09-11 17:38:10.999089612 +0000 UTC
Create Index = 7
Modify Index = 7
執(zhí)行初始引導(dǎo)后，除非重置，否則無法再次執(zhí)行。確保保存此AccessorID和SecretID。引導(dǎo)令牌是management類型令牌，這意味著它可以執(zhí)行任何操作。它應(yīng)該用于設(shè)置ACL策略并創(chuàng)建其他ACL令牌。引導(dǎo)令牌可以刪除，就像任何其他令牌一樣，因此應(yīng)注意不要撤銷所有管理令牌。

3、設(shè)置匿名策略
Store our token secret ID
export NOMAD_TOKEN="BOOTSTRAP_SECRET_ID"

Write out the payload
cat > payload.json <<EOF
{
"Name": "anonymous",
"Description": "Allow read-only access for anonymous requests",
"Rules": "
namespace \"default\" {
policy = \"read\"
}
agent {
policy = \"read\"
}
node {
policy = \"read\"
}
"
}
EOF

Install the policy
curl --request POST \
--data @payload.json \
-H "X-Nomad-Token: $NOMAD_TOKEN" \
https://localhost:4646/v1/acl/policy/anonymous

Verify anonymous request works
curl https://localhost:4646/v1/jobs

4、規(guī)則規(guī)范

ACL系統(tǒng)的核心部分是規(guī)則語言，用于描述必須強(qiáng)制執(zhí)行的策略。我們使用HashiCorp配置語言（HCL）來指定規(guī)則。這種語言是人類可讀的并且可與JSON互操作，因此可以輕松地生成機(jī)器。策略可以包含任意數(shù)量的規(guī)則。

政策通常有幾種處置方式：

read：允許讀取資源但不修改資源
write：允許讀取和修改資源
deny：不允許讀取或修改資源。當(dāng)多個(gè)策略與令牌關(guān)聯(lián)時(shí)，拒絕優(yōu)先。
HCL格式的規(guī)范如下：

Allow read only access to the default namespace

namespace "default" {
policy = "read"
}

Allow writing to the foo namespace

namespace "foo" {
policy = "write"
}

agent {
policy = "read"
}

node {
policy = "read"
}

quota {
policy = "read"
}
這相當(dāng)于以下JSON輸入：

{
"namespace": {
"default": {
"policy": "read"
},
"foo": {
"policy": "write"
}
},
"agent": {
"policy": "read"
},
"node": {
"policy": "read"
},
"quota": {
"policy": "read"
}
}