hashicorp / hashicorp/nomad

Vault 'default' name is not set on server,

Open
#19,901 8 comments 1 reaction 0 assignees View on GitHub
stage/needs-investigation theme/vault type/bug
Dominant language
Go
Stars
17k
Forks
2.1k
Avg merge
1d 9h
Merged PRs (30d)
105

Description

### Nomad version
Output from `nomad version`

client+server:

```sh
$ nomad version
Nomad v1.7.3
BuildDate 2024-01-15T16:55:40Z
Revision 60ee328f97d19d2d2d9761251b895b06d82eb1a1
```

### Operating system and Environment details

3 VMs for the servers, many client nodes for the jobs. All running Rocky Linux release 9.3

### Issue

I recently started looking into vault integrations - and while this worked in the past, I noticed with a recent test on the newer version that I get an error when scheduling jobs:
```
Error submitting job: Unexpected response code: 500 (rpc error: 1 error occurred:
* Vault "default" not enabled but used in the job)
```

The error comes from here:

https://github.com/hashicorp/nomad/blob/1e04fc461394d96bd4aab0e50cfa80048e1b5fd0/nomad/job_endpoint_hook_vault.go#L38

The name options is mentioned here and mention that it should be omitted for non-enterprise setups:
https://developer.hashicorp.com/nomad/docs/configuration/vault#parameters-for-nomad-clients-and-servers

The job spec mentions it here:
https://developer.hashicorp.com/nomad/docs/job-specification/vault#cluster

my vault config on the servers was like this:
```hcl
vault {
enabled = true
token = "{{ nomad_vault_token }}"
address = "https://vault.****.com"
create_from_role = "nomad-cluster-access-auth"
}
```

config of the job/task:

```hcl
vault {
# Attach our default policies to the task,
# so it is able to retrieve secrets from vault.
policies = ["nomad-cluster-access-kv"]
}
```

I noticed there has been some work done on this, e.g. here:
https://github.com/hashicorp/nomad/commit/1ef99f05364b7d3739befa6a789f0d55b2314dcf

and I think there might be a bug with the initialization of the "default" value.. It's either not set or not read.

### Reproduction steps

I think one might be able to reproduce this by setting up a 1.7.3 cluster and simply integrating vault.
If I add the `name = default` to both server and client, it works. If I don't I get the mentioned error message.

#### Expected Result

The "default" cluster is available by default.

#### Actual Result

```
Error submitting job: Unexpected response code: 500 (rpc error: 1 error occurred:
* Vault "default" not enabled but used in the job)
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with nomad/job_endpoint_hook_vault.go at the referenced validation and compare it with the Vault server and client configuration handling described in the issue. Reproduce the failure using the shown configuration without a name, then verify that the default Vault cluster is available without requiring an explicit name.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
infrastructure, security
Issue type
Bug
Difficulty
3/5
Estimated time
1-2 days
Activity status
Stale
Clarity
Clearly specified
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.