Vault 'default' name is not set on server,
- Dominant language
- Go
- Stars
- 17k
- Forks
- 2.1k
- Avg merge
- 1d 9h
- Merged PRs (30d)
- 105
Description
### Nomad version
Output from `nomad version`
client+server:
```sh
$ nomad version
Nomad v1.7.3
BuildDate 2024-01-15T16:55:40Z
Revision 60ee328f97d19d2d2d9761251b895b06d82eb1a1
```
### Operating system and Environment details
3 VMs for the servers, many client nodes for the jobs. All running Rocky Linux release 9.3
### Issue
I recently started looking into vault integrations - and while this worked in the past, I noticed with a recent test on the newer version that I get an error when scheduling jobs:
```
Error submitting job: Unexpected response code: 500 (rpc error: 1 error occurred:
* Vault "default" not enabled but used in the job)
```
The error comes from here:
https://github.com/hashicorp/nomad/blob/1e04fc461394d96bd4aab0e50cfa80048e1b5fd0/nomad/job_endpoint_hook_vault.go#L38
The name options is mentioned here and mention that it should be omitted for non-enterprise setups:
https://developer.hashicorp.com/nomad/docs/configuration/vault#parameters-for-nomad-clients-and-servers
The job spec mentions it here:
https://developer.hashicorp.com/nomad/docs/job-specification/vault#cluster
my vault config on the servers was like this:
```hcl
vault {
enabled = true
token = "{{ nomad_vault_token }}"
address = "https://vault.****.com"
create_from_role = "nomad-cluster-access-auth"
}
```
config of the job/task:
```hcl
vault {
# Attach our default policies to the task,
# so it is able to retrieve secrets from vault.
policies = ["nomad-cluster-access-kv"]
}
```
I noticed there has been some work done on this, e.g. here:
https://github.com/hashicorp/nomad/commit/1ef99f05364b7d3739befa6a789f0d55b2314dcf
and I think there might be a bug with the initialization of the "default" value.. It's either not set or not read.
### Reproduction steps
I think one might be able to reproduce this by setting up a 1.7.3 cluster and simply integrating vault.
If I add the `name = default` to both server and client, it works. If I don't I get the mentioned error message.
#### Expected Result
The "default" cluster is available by default.
#### Actual Result
```
Error submitting job: Unexpected response code: 500 (rpc error: 1 error occurred:
* Vault "default" not enabled but used in the job)
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with nomad/job_endpoint_hook_vault.go at the referenced validation and compare it with the Vault server and client configuration handling described in the issue. Reproduce the failure using the shown configuration without a name, then verify that the default Vault cluster is available without requiring an explicit name.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- infrastructure, security
- Issue type
- Bug
- Difficulty
- 3/5
- Estimated time
- 1-2 days
- Activity status
- Stale
- Clarity
- Clearly specified
- Newbie friendliness
- 35/100