Nomad Job Publish Stanza Interaction with ACL Policies During Visibility Transition
0 reputation · 20 Jul 2022, 23:17 UTC
Understanding Nomad Job Publish Stanza and ACL Policy Interaction
The publish stanza in a Nomad job definition controls whether the job appears in the UI and API. When ACLs are enabled, token policies can further restrict visibility. The exact precedence between the publish setting and ACL enforcement is not fully documented, especially for jobs that omit the publish stanza or rely on default behavior.
Operators need to know whether setting publish=false guarantees that a job remains hidden from all users, including those with administrative tokens, or whether an ACL policy that grants read access to the job namespace can override that setting. Additionally, the default visibility for a job that does not specify publish when ACLs are enabled is unclear across Nomad versions.
- Does publish=false take precedence over any ACL token policy that would otherwise allow job visibility?
- In an ACL-enabled cluster, what is the default visibility of a job that omits the publish stanza?
- If a token policy grants namespace-read access, can it expose a job with publish=false through the Nomad API or UI?
