nomad icon indicating copy to clipboard operation
nomad copied to clipboard

remove `WhoAmI` callers from client

Open tgross opened this issue 1 year ago • 1 comments

In Nomad 1.5.0 (https://github.com/hashicorp/nomad/commit/542b23e999b5338cdcfa56bfdae1db9aa834cb3c) we started using the ACL.WhoAmI RPC method from the client to allow clients to check Workload Identity tokens and not just ACL tokens. In Nomad 1.7.0, we broke this by accidentally changing the wire format of the WhoAmI RPC response. See https://github.com/hashicorp/nomad/issues/19555. We've fixed that in https://github.com/hashicorp/nomad/pull/19578, but there's a better long-term solution:

  • Remove the ACL.WhoAmI callers from the client
  • Have the client check WI tokens using the server public keys
  • Un-deprecated ACL.ResolveToken. For non-WI tokens, have the client check with the server via ACL.ResolveToken

We'll want to keep the existing ACL.WhoAmI method for backwards compatibility, but it might also be a good idea to provide a HTTP endpoint for it to make it a useful debugging tool.

tgross avatar Jan 02 '24 19:01 tgross

@schmichael pointed out in a sidebar discussion that we probably want to do this sooner rather than later, as the current implementation would make it easy to incorrectly change the code at https://github.com/hashicorp/nomad/blob/v1.7.2/nomad/structs/structs.go#L547 to check the claim expiration, which would be nil on the client.

tgross avatar Jan 03 '24 13:01 tgross