Skip to content

Commit d51eecc

Browse files
Backport of docs: include Consul namespace claim mapping in auth config example (#26730) (#26734)
When configuring Nomad Enterprise with Consul Enterprise and multiple namespaces, you need to include the `consul_namespace` mapping in the auth method configuration. Otherwise you'll see an error like "unknown variable accessed: value.consul_namespace". There's no example of the updated auth method configuration you need, which makes this detail unclear when we're showing the claim being used in the following `consul acl auth-method create` command. Co-authored-by: Tim Gross <[email protected]>
1 parent b98c6ed commit d51eecc

File tree

1 file changed

+31
-12
lines changed
  • website/content/docs/integrations/consul

1 file changed

+31
-12
lines changed

website/content/docs/integrations/consul/acl.mdx

Lines changed: 31 additions & 12 deletions
Original file line numberDiff line numberDiff line change
@@ -263,9 +263,33 @@ Consul Enterprise supports multiple namespaces and Nomad Enterprise allows jobs
263263
to use the [`consul.namespace`][] parameter to register services and read KV
264264
data from different Consul namespaces.
265265

266-
In a multi-namespace environment, you should create the auth method and binding
267-
rules in the `default` namespace and configure the auth method with a set of
268-
[`NamespaceRules`][].
266+
In Nomad Enterprise, workload identities for tasks and services placed within
267+
the scope of a `consul` block with a `namespace` value, have an additional claim
268+
called `consul_namespace` that represents the Consul namespace defined in Nomad
269+
for the workload. In a multi-namespace environment, you should configure the
270+
auth method to include the `consul_namespace` claim mapping.
271+
272+
<CodeBlockConfig highlight="6" filename="auth-method.json">
273+
274+
```json
275+
{
276+
"JWKSURL": "https://nomad.example.com:4646/.well-known/jwks.json",
277+
"JWTSupportedAlgs": ["RS256"],
278+
"BoundAudiences": ["consul.io"],
279+
"ClaimMappings": {
280+
"consul_namespace": "consul_namespace",
281+
"nomad_namespace": "nomad_namespace",
282+
"nomad_job_id": "nomad_job_id",
283+
"nomad_task": "nomad_task",
284+
"nomad_service": "nomad_service"
285+
}
286+
}
287+
```
288+
289+
</CodeBlockConfig>
290+
291+
You should create the auth method and binding rules in the `default` Consul
292+
namespace and configure the auth method with a set of [`NamespaceRules`][].
269293

270294
```shell-session
271295
$ consul acl auth-method create \
@@ -278,18 +302,13 @@ $ consul acl auth-method create \
278302

279303
Similarly to binding rules, namespace rules have a [`Selector`][] expression to
280304
determine when the rule should be applied and a [`BindNamespace`][] value that
281-
defines the namespace used.
305+
defines the Consul namespace used.
282306

283307
Auth methods with a namespace rule create Consul tokens in that Consul
284308
namespace. Binding rules with `-bind-type role` also target a role and
285-
associated policies in that same Consul namespace. So you should create the
286-
auth method and binding rules in the default namespace, and the role and
287-
policies in the target namespaces.
288-
289-
In Nomad Enterprise, workload identities for tasks and services placed within
290-
the scope of a `consul` block with a `namespace` value, have an additional
291-
claim called `consul_namespace` that represents the Consul namespace defined
292-
in Nomad for the workload.
309+
associated policies in that same Consul namespace. So you should create the auth
310+
method and binding rules in the default Consul namespace, and the role and
311+
policies in the target Consul namespaces.
293312

294313
<CodeBlockConfig highlight="9-11" filename="example.nomad.hcl">
295314

0 commit comments

Comments
 (0)