@@ -220,43 +220,37 @@ options.
220220
221221## Use client node introduction tokens
222222
223- You may restrict which clients join your cluster with a client
224- introduction token. The client node introduction feature is like multi-factor
225- authentication for your Nomad clusters. It does not replace mTLS but adds an
226- additional layer of security to prevent an unauthorized or misconfigured client
227- from joining a Nomad cluster. Although you do not need to configure mTLS to use
228- client node introduction tokens, we do recommend securing your cluster with mTLS.
229-
230- Each security layer answers a distinct question:
231-
232- - mTLS: Does the client have valid certificates for the cluster?
233- - Client introduction token: Does the client have a valid token to join the
234- cluster?
223+ Use client introduction tokens to restrict which clients join your cluster. The
224+ client node introduction feature is like multi-factor authentication for your
225+ Nomad clusters. ** It does not replace mTLS** , but instead adds an additional
226+ layer of security that prevents an unauthorized or misconfigured client from
227+ joining a Nomad cluster.
235228
236229When you generate a client introduction token, you may specify the following
237- optional parameters:
230+ optional parameters to further secure cluster access :
238231
239232- Node pool: The node pool that clients with this token may join. This
240233 token is not valid with any other node pool.
241234- Node name: The token is scoped to the node with this name. No other node may
242235 use this token to join the cluster.
243236- TTL: Token expiration. The token is not valid after expiration.
244237
238+ ### Create a client introduction token
245239
246240Follow these steps to use client node introduction tokens:
247241
2482421 . [ Create an ACL node policy] ( #create-an-acl-policy ) .
2492431 . [ Create an ACL role from the policy] ( #create-an-acl-role ) .
2502441 . [ Generate a client introduction token] ( #generate-a-client-introduction-token ) .
251- 1 . [ Configure the Nomad agent to use client introduction] ( #configure-the -nomad-agent ) .
252- 1 . [ Start the Nomad agent ] ( #start-the-nomad-agent ) .
245+ 1 . [ Update your Nomad server configuration to use client introduction] ( #update-your -nomad-server-configuration ) .
246+ 1 . [ Start the Nomad server ] ( #start-the-nomad-server ) .
2532471 . [ Monitor client join failures] ( #monitor-client-join-failures ) .
254248
255249### Prerequisites
256250
257- - You have [ bootstrapped the ACL system] ( /nomad/docs/secure/acl/bootstrap ) .
258- - You have a management token.
259- - You have configured the CLI to use the management token .
251+ You bootstrapped the ACL system and configured the CLI to use your management
252+ token. Refer to the [ Bootstrap the ACL system
253+ guide ] ( /nomad/docs/secure/acl/bootstrap ) for instructions .
260254
261255### Create an ACL policy
262256
@@ -315,12 +309,11 @@ The `intro-token.jwt` file contains the JWT.
315309 "eyJhbGciOiJSUzI1NiIsImtpZCI6IjljZDgy..."
316310```
317311
318- ### Configure the Nomad agent
312+ ### Update your Nomad server configuration
319313
320- Configure the Nomad agent's ` server.client_introduction ` block. This example
321- sets the ` enforcement ` parameter to ` strict ` , which means the agent rejects any
322- client without a valid token. Refer to the [ ` server.client_introduction `
323- block
314+ Configure your Nomad server's ` server.client_introduction ` block. This example
315+ sets strict enforcement, which means the server rejects any client without a
316+ valid token. Refer to the [ ` server.client_introduction ` block
324317documentation] ( /nomad/docs/configuration/server#client_introduction-parameters )
325318for additional enforcement options.
326319
@@ -336,8 +329,8 @@ server {
336329 bootstrap_expect = 1
337330 client_introduction {
338331 enforcement = "strict" # Default = "warn"
339- default_identity_ttl = "15m " # Default = "5m"
340- max_identity_ttl = "60m " # Default = "30m"
332+ default_identity_ttl = "5m " # Default = "5m"
333+ max_identity_ttl = "30m " # Default = "30m"
341334 }
342335}
343336tls {
@@ -351,12 +344,12 @@ tls {
351344
352345</CodeBlockConfig >
353346
354- There is no additional client configuration .
347+ No additional configuration is required on the client node .
355348
356- ### Start the Nomad agent
349+ ### Start the Nomad server
357350
358351You have the following options for passing the client introduction token to the
359- Nomad agent :
352+ Nomad server :
360353
361354- Set the token as the value of a ` NOMAD_CLIENT_INTRO_TOKEN ` environment
362355 variable.
@@ -366,7 +359,7 @@ Nomad agent:
366359- Place the ` intro_token.jwt ` file in the client's state directory, which is by
367360 default [ the ` <data_dir>/client_state_dir> ` directory] ( /nomad/docs/configuration/client#state_dir ) .
368361
369- This example starts the agent with the client introduction token passed in the
362+ This example starts the server with the client introduction token passed in the
370363` -client-intro-token ` parameter.
371364
372365``` shell-session
@@ -378,7 +371,7 @@ nomad agent -config /etc/nomad.d/nomad.hcl \
378371
379372You have the following options to determine when client registration fails:
380373
381- - Check the agent logs for `[ ERROR] nomad.client: node registration without
374+ - Check the server logs for `[ ERROR] nomad.client: node registration without
382375 introduction token` messages.
383376- Monitor the [ ` nomad.client.introduction.enforcement `
384377 counter] ( /nomad/docs/monitor#client-introduction ) , which increments when a
0 commit comments