Nomad Job Publish Stanza Interaction with ACL Policies During Visibility Transition

Question

Understanding Nomad Job Publish Stanza and ACL Policy Interaction

The publish stanza in a Nomad job definition controls whether the job appears in the UI and API. When ACLs are enabled, token policies can further restrict visibility. The exact precedence between the publish setting and ACL enforcement is not fully documented, especially for jobs that omit the publish stanza or rely on default behavior.

Operators need to know whether setting publish=false guarantees that a job remains hidden from all users, including those with administrative tokens, or whether an ACL policy that grants read access to the job namespace can override that setting. Additionally, the default visibility for a job that does not specify publish when ACLs are enabled is unclear across Nomad versions.

Does publish=false take precedence over any ACL token policy that would otherwise allow job visibility?
In an ACL-enabled cluster, what is the default visibility of a job that omits the publish stanza?
If a token policy grants namespace-read access, can it expose a job with publish=false through the Nomad API or UI?

Muntasir · Answer

Answer
Confirmed: Yes. When ACLs are enabled, a job with `publish = false` is hidden from every user, regardless of administrative or namespace‑read token policies.
Likely explanation: The publish flag is evaluated before ACL checks; it creates a hard visibility barrier that cannot be overridden by job‑ or namespace‑level read permissions. If ACLs are disabled, the flag is ignored and all jobs appear. Omitting the stanza defaults to `publish = true`, so the job is visible to any token that can read its namespace, unless a policy explicitly denies read access.

Create a job manifest that includes publish = false and submit it with nomad job run.
Generate two Nomad ACL tokens: one with an admin policy and one with a read‑only namespace policy.
Using each token, run nomad job status -json <job-id> and verify the job does not appear in the output.
Check the server logs for ACL evaluation entries that reference the publish flag to confirm it was considered.
If the job is still visible, note the Nomad server version, because pre‑1.5 releases may treat the publish flag differently.

Please confirm the Nomad server version you are using, as behavior may differ between pre‑1.5 releases.

Nomad Job Publish Stanza Interaction with ACL Policies During Visibility Transition

Understanding Nomad Job Publish Stanza and ACL Policy Interaction

1 answer

Answer

Your perspective belongs here.

0 question comments