☂️ Nomad Actions

[philrenaud]

Nomad Actions

Operator-sanctioned sets of actions in a Nomad job spec that users can execute, allowing for fine-grained control over task execution with ACL policies using the principle of least privilege.

Divided into two main phases:

• alloc_exec-enabled actions
• ACL-granular actions

Draft implementation
Figma

RFC (NMD-184)

• Draft RFC
• Circulate and discuss
• RFC Approval

Scaffolding

• Action struct (go)
• Action adapter (js)
• [ui] Action model (Ember) #18726
• Actions at job level / job/:id/actions endpoint #18680
• nomad job actions cli command #18771
• Ember Data model relationships to jobs, tasks (js)
• Sockets service handling (js)
• Mirage (js)

UI

• Implementation on Job Index #18782
• Implementation on Task page #19035
• [ui] Actions implementation in Task Fly-out #19018
• Running/Run action notifications
• Actions service sidebar #19066

API

• GET /job/:id/actions
• socket at job/:id/action #18735

Expanded Functionality

• Run action on one specific, one random, or many allocs
• Actions with passed arguments / user-provided params
  • Presently out of scope
• Action.tags
• Action.ui.style (=critical, =primary, etc.)
• Alias nomad job action to nomad action #19039

Docs

• Add Actions block to jobspec docs
• Add running actions to ui tutorials
• Add nomad action to cli docs

ACL

(Items considered phase 2 - #18800)

• Blanket ACL rules (namespace.actions.policy)
• Task-level ACL rules (namespace.job.group.task.action.policy)
• Arbitrary tag-level ACL rules (action.tags.includes(x)

Expansion

• Expose actions metrics
• Mirage mocks for running actions in the UI
• Handle blocking queries on GET job/:job_id/actions #19187

[philrenaud]

Marking as complete/closed; this feature has happily been released in the wild for 6+ months and any further governance work can be handled in #18800