Provide job id and namespace for secrets plugins

[olljanat]

Proposal

Provide NOMAD_JOB_ID and NOMAD_NAMESPACE environment variables always for secrets plugins and do not allow user to overwrite them.

Use-cases

Nomad variables are automatically available for jobs based on their name and id like documented to here and as result of #25871 it is possible to create variables which are available for all jobs in namespace.

Secrets plugins can implement same logic if they know job id and namespace those requests are coming from and can trust to that information.

[jrasell]

Hi @olljanat and thanks for raising this issue. I had a quick chat internally with the secrets feature lead and we both agree this seems like a useful addition. I'll therefore get it added to our backlog. If you have any details on your intended use-case, it would be useful to know for future work on this. Thanks.

[tgross]

To "yes, and" this (😀)... maybe we want to let users expose a non-default workload identity to the secret block? That would let the secrets plugin use an identity block defined in the jobspec to "login" to whatever the remote secret store is.

[olljanat]

If you have any details on your intended use-case, it would be useful to know for future work on this.

Company where I'm working on is constantly acquiring other companies so I'm looking for solution which allow us easily migrate existing workloads to Nomad without replacing existing vault solution, no matter which they are using.

See Secrets plugin for Docker which I built for one environment and which for demonstration purposes has support for multiple backends even when we are using only one at the moment. Idea however is that you choose and configure backend when you install the plugin and those doing container deployments don't need to know details under the hood.

maybe we want to let users expose a non-default workload identity to the secret block?

Yes, that might be also useful in some use cases.

[olljanat]

@jrasell I wonder if this can still get milestone 1.11.0 because secrets plugins will be new feature released as part of that?

I can potentially help with implementation if needed but will need guidance about architecture you want to use for this?

Ping also @mismithhisler as you made initial implementation.

[jrasell]

Hi @olljanat; the 1.11.0 feature, enhancement, and non-critical bug merge freeze is already in-place, so this will need to be done as a follow up item in a subsequent 1.11.x release.