Nomad Vault integration doesn't set `X-Vault-request` header
- Dominant language
- Go
- Stars
- 17k
- Forks
- 2.1k
- Avg merge
- 1d 9h
- Merged PRs (30d)
- 105
Description
### Nomad version
```console
$ nomad version
Nomad v1.3.3 (428b2cd8014c48ee9eae23f02712b7219da16d30)
```
### Operating system and Environment details
```console
$ cat /etc/lsb-release
DISTRIB_ID=Ubuntu
DISTRIB_RELEASE=20.04
DISTRIB_CODENAME=focal
DISTRIB_DESCRIPTION="Ubuntu 20.04.4 LTS"
$ uname -a
Linux nomad-client-navy 5.15.0-1016-gcp #21~20.04.1-Ubuntu SMP Fri Aug 5 12:53:07 UTC 2022 x86_64 x86_64 x86_64 GNU/Linux
```
### Issue
Nomad does not send the `x-vault-request` header when using the vault integration. When Vault agent is in use, and it is [configured with SSRF protection](https://developer.hashicorp.com/vault/docs/agent#require_request_header), the request will be rejected. This does not show up in the UI, which will simply appear to hang. The logs do show what happened:
```
client.vault: error deriving token:
error=
| failed to unwrap the token for task "uwsgi": Error making API request.
|
| URL: PUT http://localhost:8100/v1/sys/wrapping/unwrap
| Code: 412. Errors:
|
| * missing 'X-Vault-Request' header
alloc_id=13502184-f673-fbf5-63cd-82f97b8982ad task_names=["uwsgi"]
```
### Reproduction steps
1. Set up Vault Agent with
2. Point Nomad at the Vault agent instead of the Vault server
3. Attempt to use the Vault integration
#### Expected Result
Nomad can access Vault as normal
#### Actual Result
Nomad gets denied access by the SSRF protection.
### Job file (if appropriate)
### Nomad Server logs (if appropriate)
n/a
### Nomad Client logs (if appropriate)
Specified inline with the issue
Contributor guide
No contributing guide indexed for this repository
Research direction
Start by tracing the Nomad Vault integration request that unwraps the task token and compare it with Vault Agent's SSRF protection requirement. The issue is done when the required X-Vault-Request header is sent and the reported Vault Agent reproduction succeeds without the 412 error.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100