[NET-6251] Nomad client templated policy (#19827)

.changelog/19827.txt

@@ -0,0 +1,3 @@
+```release-note:feature
+acl: Adds nomad client templated policy
+```

agent/acl_endpoint_test.go

@@ -1407,7 +1407,7 @@ func TestACL_HTTP(t *testing.T) {
 
 			var list map[string]api.ACLTemplatedPolicyResponse
 			require.NoError(t, json.NewDecoder(resp.Body).Decode(&list))
-			require.Len(t, list, 6)
+			require.Len(t, list, 7)
 
 			require.Equal(t, api.ACLTemplatedPolicyResponse{
 				TemplateName: api.ACLTemplatedPolicyServiceName,

agent/structs/acl_templated_policy.go

@@ -41,13 +41,15 @@ const (
 	ACLTemplatedPolicyNomadServerID      = "00000000-0000-0000-0000-000000000006"
 	ACLTemplatedPolicyWorkloadIdentityID = "00000000-0000-0000-0000-000000000007"
 	ACLTemplatedPolicyAPIGatewayID       = "00000000-0000-0000-0000-000000000008"
+	ACLTemplatedPolicyNomadClientID      = "00000000-0000-0000-0000-000000000009"
 
 	ACLTemplatedPolicyServiceDescription          = "Gives the token or role permissions to register a service and discover services in the Consul catalog. It also gives the specified service's sidecar proxy the permission to discover and route traffic to other services."
 	ACLTemplatedPolicyNodeDescription             = "Gives the token or role permissions for a register an agent/node into the catalog. A node is typically a consul agent but can also be a physical server, cloud instance or a container."
 	ACLTemplatedPolicyDNSDescription              = "Gives the token or role permissions for the Consul DNS to query services in the network."
 	ACLTemplatedPolicyNomadServerDescription      = "Gives the token or role permissions required for integration with a nomad server."
 	ACLTemplatedPolicyWorkloadIdentityDescription = "Gives the token or role permissions for a specific workload identity."
 	ACLTemplatedPolicyAPIGatewayDescription       = "Gives the token or role permissions for a Consul api gateway"
+	ACLTemplatedPolicyNomadClientDescription      = "Gives the token or role permissions required for integration with a nomad client."
 
 	ACLTemplatedPolicyNoRequiredVariablesSchema = "" // catch-all schema for all templated policy that don't require a schema
 )
@@ -108,6 +110,13 @@ var (
 			Template:     ACLTemplatedPolicyAPIGateway,
 			Description:  ACLTemplatedPolicyAPIGatewayDescription,
 		},
+		api.ACLTemplatedPolicyNomadClientName: {
+			TemplateID:   ACLTemplatedPolicyNomadClientID,
+			TemplateName: api.ACLTemplatedPolicyNomadClientName,
+			Schema:       ACLTemplatedPolicyNoRequiredVariablesSchema,
+			Template:     ACLTemplatedPolicyNomadClient,
+			Description:  ACLTemplatedPolicyNomadClientDescription,
+		},
 	}
 )
 

agent/structs/acl_templated_policy_ce.go

@@ -25,6 +25,9 @@ var ACLTemplatedPolicyWorkloadIdentity string
 //go:embed acltemplatedpolicy/policies/ce/api-gateway.hcl
 var ACLTemplatedPolicyAPIGateway string
 
+//go:embed acltemplatedpolicy/policies/ce/nomad-client.hcl
+var ACLTemplatedPolicyNomadClient string
+
 func (t *ACLToken) TemplatedPolicyList() []*ACLTemplatedPolicy {
 	if len(t.TemplatedPolicies) == 0 {
 		return nil

agent/structs/acltemplatedpolicy/policies/ce/nomad-client.hcl

@@ -0,0 +1,12 @@
+agent_prefix "" {
+  policy = "read"
+}
+node_prefix "" {
+  policy = "read"
+}
+service_prefix "" {
+  policy = "write"
+}
+key_prefix "" {
+  policy = "read"
+}

api/acl.go

@@ -27,6 +27,7 @@ const (
 	ACLTemplatedPolicyNomadServerName      = "builtin/nomad-server"
 	ACLTemplatedPolicyWorkloadIdentityName = "builtin/workload-identity"
 	ACLTemplatedPolicyAPIGatewayName       = "builtin/api-gateway"
+	ACLTemplatedPolicyNomadClientName      = "builtin/nomad-client"
 )
 
 type ACLLink struct {

command/acl/templatedpolicy/formatter.go

@@ -77,7 +77,7 @@ func (f *prettyFormatter) FormatTemplatedPolicy(templatedPolicy api.ACLTemplated
 		nameRequiredVariableOutput(&buffer, templatedPolicy.TemplateName, "The workload name", "api")
 	case api.ACLTemplatedPolicyAPIGatewayName:
 		nameRequiredVariableOutput(&buffer, templatedPolicy.TemplateName, "The api gateway service name", "api-gateway")
-	case api.ACLTemplatedPolicyDNSName, api.ACLTemplatedPolicyNomadServerName:
+	case api.ACLTemplatedPolicyDNSName, api.ACLTemplatedPolicyNomadServerName, api.ACLTemplatedPolicyNomadClientName:
 		noRequiredVariablesOutput(&buffer, templatedPolicy.TemplateName)
 	default:
 		buffer.WriteString("   None\n")

command/acl/templatedpolicy/formatter_test.go

@@ -64,6 +64,14 @@ func testFormatTemplatedPolicy(t *testing.T, dirPath string) {
 				Description:  structs.ACLTemplatedPolicyNomadServerDescription,
 			},
 		},
+		"nomad-client-templated-policy": {
+			templatedPolicy: api.ACLTemplatedPolicyResponse{
+				TemplateName: api.ACLTemplatedPolicyNomadClientName,
+				Schema:       structs.ACLTemplatedPolicyNoRequiredVariablesSchema,
+				Template:     structs.ACLTemplatedPolicyNomadClient,
+				Description:  structs.ACLTemplatedPolicyNomadClientDescription,
+			},
+		},
 	}
 
 	formatters := map[string]Formatter{

command/acl/templatedpolicy/testdata/FormatTemplatedPolicy/ce/nomad-client-templated-policy.json.golden

@@ -0,0 +1,6 @@
+{
+    "TemplateName": "builtin/nomad-client",
+    "Schema": "",
+    "Template": "agent_prefix \"\" {\n  policy = \"read\"\n}\nnode_prefix \"\" {\n  policy = \"read\"\n}\nservice_prefix \"\" {\n  policy = \"write\"\n}\nkey_prefix \"\" {\n  policy = \"read\"\n}",
+    "Description": "Gives the token or role permissions required for integration with a nomad client."
+}

command/acl/templatedpolicy/testdata/FormatTemplatedPolicy/ce/nomad-client-templated-policy.pretty-meta.golden

@@ -0,0 +1,18 @@
+Name:            builtin/nomad-client
+Description:     Gives the token or role permissions required for integration with a nomad client.
+Input variables: None
+Example usage:
+	consul acl token create -templated-policy builtin/nomad-client
+Raw Template:
+agent_prefix "" {
+  policy = "read"
+}
+node_prefix "" {
+  policy = "read"
+}
+service_prefix "" {
+  policy = "write"
+}
+key_prefix "" {
+  policy = "read"
+}

command/acl/templatedpolicy/testdata/FormatTemplatedPolicy/ce/nomad-client-templated-policy.pretty.golden

@@ -0,0 +1,5 @@
+Name:            builtin/nomad-client
+Description:     Gives the token or role permissions required for integration with a nomad client.
+Input variables: None
+Example usage:
+	consul acl token create -templated-policy builtin/nomad-client