HashiCorp Nomad
Tasks authenticate with the workload identity Nomad signs for their job.
Tasks authenticate with the workload identity Nomad signs for their job.
What proves the identity
The token has to come from https://nomad.acme.com, and its nomad_job_id claim has to match the workload you named. penv compares that claim byte for byte, with no wildcards.
nomad_job_id is matched rather than sub, because this platform puts something per run in sub.
Every token also has to name your workspace as its audience. Ask for this audience and no other. A token requested for two audiences fails every exchange.
What the console asks for
| Field | Example | Advanced | What it pins |
|---|---|---|---|
| Nomad issuer URL | https://nomad.acme.com | no | The oidc_issuer in your server block, reachable from the internet. |
| Job ID | api | no | A job with this id in another namespace matches too. |
The console also asks which project and environment this identity reaches and which role it gets, with the credential lifetime behind Advanced.
What the trust holds
Built from the example answers above:
| What | Value |
|---|---|
| Issuer | https://nomad.acme.com |
| Claim compared | nomad_job_id |
| Subject | api |
| Identity name | nomad-api |
penv names the identity for you, so the form never asks for one.
The snippet the console prints
identity {
name = "penv"
# Ask for this audience and no other. A token requested for two audiences fails every exchange.
aud = ["YOUR_WORKSPACE_ID"]
file = true
ttl = "1h"
}
# in the task:
# T=$(cat "$NOMAD_SECRETS_DIR/nomad_penv.jwt")
# C=$(curl -sS "https://penv.cloud/api/v1/auth/oidc" \Related
- Machine identity
- Connect a Platform in the console
- HashiCorp Nomad documentation, where the value people get wrong is always the subject