Skip to content

Commit 052837e

Browse files
committed
address feedback; fix typo in release notes
1 parent a97b115 commit 052837e

File tree

2 files changed

+25
-32
lines changed

2 files changed

+25
-32
lines changed

content/nomad/v1.11.x/content/docs/deploy/clusters/connect-nodes.mdx

Lines changed: 23 additions & 30 deletions
Original file line numberDiff line numberDiff line change
@@ -220,43 +220,37 @@ options.
220220

221221
## Use client node introduction tokens
222222

223-
You may restrict which clients join your cluster with a client
224-
introduction token. The client node introduction feature is like multi-factor
225-
authentication for your Nomad clusters. It does not replace mTLS but adds an
226-
additional layer of security to prevent an unauthorized or misconfigured client
227-
from joining a Nomad cluster. Although you do not need to configure mTLS to use
228-
client node introduction tokens, we do recommend securing your cluster with mTLS.
229-
230-
Each security layer answers a distinct question:
231-
232-
- mTLS: Does the client have valid certificates for the cluster?
233-
- Client introduction token: Does the client have a valid token to join the
234-
cluster?
223+
Use client introduction tokens to restrict which clients join your cluster. The
224+
client node introduction feature is like multi-factor authentication for your
225+
Nomad clusters. **It does not replace mTLS**, but instead adds an additional
226+
layer of security that prevents an unauthorized or misconfigured client from
227+
joining a Nomad cluster.
235228

236229
When you generate a client introduction token, you may specify the following
237-
optional parameters:
230+
optional parameters to further secure cluster access:
238231

239232
- Node pool: The node pool that clients with this token may join. This
240233
token is not valid with any other node pool.
241234
- Node name: The token is scoped to the node with this name. No other node may
242235
use this token to join the cluster.
243236
- TTL: Token expiration. The token is not valid after expiration.
244237

238+
### Create a client introduction token
245239

246240
Follow these steps to use client node introduction tokens:
247241

248242
1. [Create an ACL node policy](#create-an-acl-policy).
249243
1. [Create an ACL role from the policy](#create-an-acl-role).
250244
1. [Generate a client introduction token](#generate-a-client-introduction-token).
251-
1. [Configure the Nomad agent to use client introduction](#configure-the-nomad-agent).
252-
1. [Start the Nomad agent](#start-the-nomad-agent).
245+
1. [Update your Nomad server configuration to use client introduction](#update-your-nomad-server-configuration).
246+
1. [Start the Nomad server](#start-the-nomad-server).
253247
1. [Monitor client join failures](#monitor-client-join-failures).
254248

255249
### Prerequisites
256250

257-
- You have [bootstrapped the ACL system](/nomad/docs/secure/acl/bootstrap).
258-
- You have a management token.
259-
- You have configured the CLI to use the management token.
251+
You bootstrapped the ACL system and configured the CLI to use your management
252+
token. Refer to the [Bootstrap the ACL system
253+
guide](/nomad/docs/secure/acl/bootstrap) for instructions.
260254

261255
### Create an ACL policy
262256

@@ -315,12 +309,11 @@ The `intro-token.jwt` file contains the JWT.
315309
"eyJhbGciOiJSUzI1NiIsImtpZCI6IjljZDgy..."
316310
```
317311

318-
### Configure the Nomad agent
312+
### Update your Nomad server configuration
319313

320-
Configure the Nomad agent's `server.client_introduction` block. This example
321-
sets the `enforcement` parameter to `strict`, which means the agent rejects any
322-
client without a valid token. Refer to the [`server.client_introduction`
323-
block
314+
Configure your Nomad server's `server.client_introduction` block. This example
315+
sets strict enforcement, which means the server rejects any client without a
316+
valid token. Refer to the [`server.client_introduction` block
324317
documentation](/nomad/docs/configuration/server#client_introduction-parameters)
325318
for additional enforcement options.
326319

@@ -336,8 +329,8 @@ server {
336329
bootstrap_expect = 1
337330
client_introduction {
338331
enforcement = "strict" # Default = "warn"
339-
default_identity_ttl = "15m" # Default = "5m"
340-
max_identity_ttl = "60m" # Default = "30m"
332+
default_identity_ttl = "5m" # Default = "5m"
333+
max_identity_ttl = "30m" # Default = "30m"
341334
}
342335
}
343336
tls {
@@ -351,12 +344,12 @@ tls {
351344

352345
</CodeBlockConfig>
353346

354-
There is no additional client configuration.
347+
No additional configuration is required on the client node.
355348

356-
### Start the Nomad agent
349+
### Start the Nomad server
357350

358351
You have the following options for passing the client introduction token to the
359-
Nomad agent:
352+
Nomad server:
360353

361354
- Set the token as the value of a `NOMAD_CLIENT_INTRO_TOKEN` environment
362355
variable.
@@ -366,7 +359,7 @@ Nomad agent:
366359
- Place the `intro_token.jwt` file in the client's state directory, which is by
367360
default [the `<data_dir>/client_state_dir>` directory](/nomad/docs/configuration/client#state_dir).
368361

369-
This example starts the agent with the client introduction token passed in the
362+
This example starts the server with the client introduction token passed in the
370363
`-client-intro-token` parameter.
371364

372365
```shell-session
@@ -378,7 +371,7 @@ nomad agent -config /etc/nomad.d/nomad.hcl \
378371

379372
You have the following options to determine when client registration fails:
380373

381-
- Check the agent logs for `[ERROR] nomad.client: node registration without
374+
- Check the server logs for `[ERROR] nomad.client: node registration without
382375
introduction token` messages.
383376
- Monitor the [`nomad.client.introduction.enforcement`
384377
counter](/nomad/docs/monitor#client-introduction), which increments when a

content/nomad/v1.11.x/content/docs/release-notes/nomad/v1-11-x.mdx

Lines changed: 2 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -13,7 +13,7 @@ We are pleased to announce the following Nomad updates.
1313

1414
### Client node introduction and identity
1515

16-
Nomad's client node identity feature uniquely identities each Nomad client node
16+
Nomad's client node identity feature uniquely identifies each Nomad client node
1717
and provides an authentication mechanism for nodes to make RPC calls to the
1818
Nomad servers.
1919

@@ -35,7 +35,7 @@ Using a client introduction token gives you additional control over misconfigure
3535
- [Client node identity concepts](/nomad/docs/architecture/cluster/node-identity)
3636
- [Client identity node pool TTL configuration
3737
option](/nomad/docs/other-specifications/node-pool#node_identity_ttl)
38-
- [Use client node introduction tokens to connect clients to your Nomad agent](/nomad/docs/deploy/clusters/connect-nodes#use-client-node-introduction-tokens)
38+
- [Use client node introduction tokens to connect clients to your Nomad server](/nomad/docs/deploy/clusters/connect-nodes#use-client-node-introduction-tokens)
3939
- [Client introduction server configuration options](/nomad/docs/configuration/server#client_introduction-parameters)
4040
- [Client introduction monitoring detail](/nomad/docs/monitor#client-introduction)
4141
- [Client introduction agent CLI token flag](/nomad/commands/agent#client-intro-token)

0 commit comments

Comments
 (0)