There is no documentation about what Nomad permissions are required when using ACLs with the Nomad provider

[regner]

Welcome!

• Yes, I've searched similar issues on GitHub and didn't find any.
• Yes, I've searched similar issues on the Traefik community forum and didn't find any.

What did you do?

Ran Traefik with the Nomad provider enabled pointing at a Nomad cluster that has ACLs enabled.

What did you see instead?

time="2023-01-27T14:46:48Z" level=error msg="Provider connection error failed to load initial nomad services: Unexpected response code: 403 (Permission denied), retrying in 6.129399793s" providerName=nomad

What version of Traefik are you using?

2.9.6

What is your environment & configuration?

providers:
  nomad:
    exposedByDefault: false
    endpoint:
      address: "http://{{ env "attr.unique.network.ip-address" }}:4646"

If applicable, please paste the log output in DEBUG level

No response

[mpl]

Hello @regner ,

have you seen and made sur to configure this part:
https://doc.traefik.io/traefik/providers/nomad/#token
?

[regner]

Hey @mpl,

Thank you for the response. Yes I have configured a token, and that is the problem here. Tokens in Nomad are associated with ACL policies. ACL policies can be fairly fine grained with what they allow and what they don't allow.

What I am hoping for is documentation on what permissions Traefik needs so I can create a relevant ACL policy in Nomad.

The alternative, which I would not be willing to ship to production, is generating a token against a policy that just allows everything. I have done this for local testing, and it works, but as I said am unwilling to do that in production.

More information about Nomad ACLs can be found here:

• https://developer.hashicorp.com/nomad/tutorials/access-control/access-control
• https://developer.hashicorp.com/nomad/tutorials/access-control/access-control-policies

Again thanks for the response. Hope this clarifies things and apologies for not including more information with the original ticket.

[rtribotte]

Hello @regner,

Thanks for the explanation and details, indeed, it clarifies the situation.

Traefik is only discovering services (LIST, GET), so, as per the Hashicorp documentation, the needed capabilities should be read-job for the service's namespace.

Could you try to give this capability to Traefik?

[regner]

Hey! Thanks, I will give that a shot when I can (hopefully tomorrow). I would think it needs list-jobs and read-job. Either way, I will test and get back to you. Thanks for the response.

[traefiker]

Hi! I'm Træfiker 🤖 the bot in charge of tidying up the issues.I have to close this one because of its lack of activity 😞Feel free to re-open it or join our Community Forum.