Skip to content

Commit

Permalink
Update descriptions and add intro paragraph
Browse files Browse the repository at this point in the history
  • Loading branch information
aimeeu committed Jan 9, 2025
1 parent 49cc9e2 commit b1450d5
Show file tree
Hide file tree
Showing 22 changed files with 263 additions and 162 deletions.
11 changes: 6 additions & 5 deletions website/content/docs/configuration/acl.mdx
Original file line number Diff line number Diff line change
@@ -1,16 +1,17 @@
---
layout: docs
page_title: acl Block - Agent Configuration
page_title: acl Block in Agent Configuration
description: >-
Use the "acl" block to configure the Nomad agent to enable ACLs and tune various parameters.
Configure Nomad's Access Control List (ACL) system behavior in the `acl` block of a Nomad agent configuration. Enable ACL enforcement, change token replication and expiration values, and tune the cache for token, role, and policy TTLs.
---

# `acl` Block
# acl Block in Agent Configuration

<Placement groups={['acl']} />

The `acl` block configures the Nomad agent to enable ACLs and tunes various
ACL parameters. Learn more about configuring Nomad's ACL system in the [Secure
This page provides reference information for configuring Nomad's Access Control List (ACL) system behavior in the `acl` block of a Nomad agent configuration. Enable ACL enforcement, change token replication and expiration values, and tune the cache for token, role, and policy TTLs.

Learn more about configuring Nomad's ACL system in the [Secure
Nomad with Access Control guide][secure-guide].

```hcl
Expand Down
16 changes: 9 additions & 7 deletions website/content/docs/configuration/audit.mdx
Original file line number Diff line number Diff line change
@@ -1,17 +1,19 @@
---
layout: docs
page_title: audit Block - Agent Configuration
page_title: audit Block in Agent Configuration
description: >-
Use the "audit" block to configure the Nomad agent's audit logging
behavior. Audit logging is available exclusively for Enterprise users.
Configure audit logging behavior in the `audit` block of a Nomad agent configuration. Enable audit logs, define a sink to stream audit logs to, and change filter rules to exclude events from the audit log. Review example audit logs.
---

# `audit` Block
# `audit` Block in Agent Configuration

<Placement groups={['audit']} />
<EnterpriseAlert product="nomad"/>

The `audit` block configures the Nomad agent to configure Audit logging behavior.
Audit logging is an Enterprise-only feature.
This page provides reference information for configuring audit logging behavior
in the `audit` block of a Nomad agent configuration. Enable audit logs, define a
sink to stream audit logs to, and change filter rules to exclude events from the
audit log.

```hcl
audit {
Expand Down Expand Up @@ -177,7 +179,7 @@ audit {
apply the filter to for a matching endpoint. For HTTPEvent types this
corresponds to an HTTP verb (GET, PUT, POST, DELETE...).

## Audit Log Format
## Example audit logs

Below are two audit log entries for a request made to `/v1/job/web/summary`. The
first entry is for the `OperationReceived` stage. The second entry is for the
Expand Down
25 changes: 15 additions & 10 deletions website/content/docs/configuration/autopilot.mdx
Original file line number Diff line number Diff line change
@@ -1,17 +1,21 @@
---
layout: docs
page_title: autopilot Block - Agent Configuration
page_title: autopilot Block in Agent Configuration
description: >-
Use the "autopilot" block to configure the Nomad agent's Autopilot
behavior.
Configure settings for Nomad Autopilot features in the `autopilot` block of a Nomad agent configuration. Enable dead server cleanup, redundancy zones, and custom upgrades. Disable upgrade migration. Tune Raft settings for stable server introduction.
---

# `autopilot` Block
# `autopilot` Block in Agent Configuration

<Placement groups={['autopilot']} />

The `autopilot` block configures the Nomad agent to configure Autopilot behavior.
For more information about Autopilot, see the [Autopilot Guide](/nomad/tutorials/manage-clusters/autopilot).
This page provides reference information for configuring settings for Nomad
Autopilot features in the `autopilot` block of a Nomad agent configuration.
Enable dead server cleanup, redundancy zones, and custom upgrades. Disable
upgrade migration. Tune Raft settings for stable server introduction.

Refer to the [Autopilot Guide](/nomad/tutorials/manage-clusters/autopilot) for
how to configure and use Autopilot.

```hcl
autopilot {
Expand Down Expand Up @@ -42,16 +46,17 @@ autopilot {
cluster. Only takes effect if all servers are running Raft protocol version 3
or higher. Must be a duration value such as `30s`.

- `enable_redundancy_zones` `(bool: false)` - (Enterprise-only) Controls whether
- `enable_redundancy_zones` `(bool: false)` - <EnterpriseAlert product="nomad" inline/> Controls whether
Autopilot separates servers into zones for redundancy, in conjunction with the
[redundancy_zone](/nomad/docs/configuration/server#redundancy_zone) parameter.
Only one server in each zone can be a voting member at one time.

- `disable_upgrade_migration` `(bool: false)` - (Enterprise-only) Disables Autopilot's
- `disable_upgrade_migration` `(bool: false)` - <EnterpriseAlert product="nomad" inline/> Disables Autopilot's
upgrade migration strategy in Nomad Enterprise of waiting until enough
newer-versioned servers have been added to the cluster before promoting any of
them to voters.

- `enable_custom_upgrades` `(bool: false)` - (Enterprise-only) Specifies whether to
- `enable_custom_upgrades` `(bool: false)` - <EnterpriseAlert product="nomad" inline/> Specifies whether to
enable using custom upgrade versions when performing migrations, in conjunction with
the [upgrade_version](/nomad/docs/configuration/server#upgrade_version) parameter.
the [upgrade_version](/nomad/docs/configuration/server#upgrade_version)
parameter.
17 changes: 12 additions & 5 deletions website/content/docs/configuration/client.mdx
Original file line number Diff line number Diff line change
@@ -1,16 +1,23 @@
---
layout: docs
page_title: client Block - Agent Configuration
page_title: client Block in Agent Configuration
description: |-
Use the "client" block to configure the Nomad agent to accept jobs as assigned by the Nomad server, join the cluster, and specify driver-specific configuration.
Configure a Nomad client in the `client` block of a Nomad agent configuration. Enable a client, configure allocation directories, artifact and template behavior, networking, node pools, servers to join, garbage collection, workload behavior, client resources, chroot, host volumes, host network, and driver-specific behavior.
---

# `client` Block
# `client` Block in Agent Configuration

<Placement groups={['client']} />

The `client` block configures the Nomad agent to accept jobs as assigned by
the Nomad server, join the cluster, and specify driver-specific configuration.
This page provides reference information for configuring a Nomad client in the
`client` block of a Nomad agent configuration. Enable a client, configure
allocation directories, artifact and template behavior, networking, node pools,
servers to join, garbage collection, workload behavior, client resources,
chroot, host volumes, host network, and driver-specific behavior.

Refer to the [Set Server and Client Nodes](/nomad/docs/operations/nomad-agent)
and [Nomad Agent](/nomad/docs/commands/agent) pages to learn about the Nomad
agent process and how to configure the server and client nodes in your cluster.

```hcl
client {
Expand Down
24 changes: 16 additions & 8 deletions website/content/docs/configuration/consul.mdx
Original file line number Diff line number Diff line change
@@ -1,19 +1,27 @@
---
layout: docs
page_title: consul Block - Agent Configuration
page_title: consul Block in Agent Configuration
description: |-
Use the "consul" block to configure the Nomad agent's communication with
Consul for service discovery and key-value integration.
Configure Nomad server and client integration with Consul in the `consul` block of a Nomad agent configuration for service discovery and key-value integration. Configure cluster name, the Consul namespace, whether Nomad should advertize its services, certificates, tokens, security, health checks, auto join, and workload service and task identity.
---

# `consul` Block
# `consul` Block in Agent Configuration

<Placement groups={['consul']} />

The `consul` block configures the Nomad agent's communication with
[Consul][consul] for service discovery and key-value integration. When
configured, tasks can register themselves with Consul, and the Nomad cluster can
[automatically bootstrap][bootstrap] itself.
This page provides reference information for configuring Nomad server and client
integration with [Consul][consul] in the `consul` block of a Nomad agent
configuration for service discovery and key-value integration. Configure cluster
name, the Consul namespace, whether Nomad should advertize its services,
certificates, tokens, security, health checks, auto join, and workload service
and task identity.

When configured, tasks can register themselves with Consul, and the Nomad
cluster can [automatically bootstrap][bootstrap] itself.

Refer to the [Service Discovery on Nomad
tutorial](/nomad/tutorials/service-discovery) for how to use Consul's service
discovery.

```hcl
consul {
Expand Down
23 changes: 15 additions & 8 deletions website/content/docs/configuration/index.mdx
Original file line number Diff line number Diff line change
@@ -1,17 +1,24 @@
---
layout: docs
page_title: Agent Configuration
description: Learn about the configuration options available for the Nomad agent.
page_title: Nomad Agent Configuration
description: This section contains reference information for configuring Nomad agents. Learn how Nomad loads and merges multiple configuration files. Configure networking and advertise addresses, Nomad regions and datacenters, data directories, Consul integration, handshake limits, connections per client, logging, plugins, Sentinel policies, security, update check behavior, and Vault integration. Enable debugging, writing to syslog, leave on interrupt or terminate, and cross-origin resource sharing (CORS).
---

# Nomad Configuration
# Nomad Agent Configuration

Nomad agents have a variety of parameters that can be specified via
configuration files or command-line flags. Configuration files are written in
[HCL][hcl]. Nomad can read and combine parameters from multiple configuration
files or directories to configure the Nomad agent.
This page provides an overview of reference information for configuring Nomad
agents. Learn how Nomad loads and merges multiple configuration files. Configure
networking and advertise addresses, Nomad regions and data centers, data
directories, Consul integration, handshake limits, connections per client,
logging, plugins, Sentinel policies, security, update check behavior, and Vault
integration. Enable debugging, writing to syslog, leave on interrupt or
terminate, and cross-origin resource sharing (CORS).

## Load Order and Merging
Write configuration files in [HCL][hcl] or specify parameters as command-line
flags. Nomad can read and combine parameters from multiple configuration files
or directories to configure the Nomad agent.

## Configuration File Load Order and Merging

The Nomad agent supports multiple configuration files, which can be provided
using the `-config` CLI flag. The flag can accept either a file or folder. In
Expand Down
16 changes: 10 additions & 6 deletions website/content/docs/configuration/keyring/awskms.mdx
Original file line number Diff line number Diff line change
@@ -1,16 +1,20 @@
---
layout: docs
page_title: AWS KMS - Keyring - Configuration
page_title: AWS Key Management Service (KMS) Keyring Configuration
description: |-
Use "awskms" to configure Nomad to use AWS KMS as the key material
wrapping mechanism.
Configure an AWS Key Management Service (KMS) keyring in the `keyring "awskms"` block of a Nomad agent configuration. Configure AWS region, KMS API endpoint, KMA key ID, and AWS authentication. Learn how Nomad supports KMS root key rotation.
---

# `awskms` keyring
# AWS Key Management Service (KMS) Keyring Configuration

This page provides reference information for configuring an AWS Key Management
Service (KMS) keyring in the `keyring "awskms"` block of a Nomad agent
configuration. Configure AWS region, KMS API endpoint, KMA key ID, and AWS
authentication. Learn how Nomad supports KMS root key rotation.

The AWS KMS keyring configures Nomad to use AWS KMS to wrap its keyring. This
example shows configuring AWS KMS keyring through the Nomad configuration file
by providing all the required values.
example shows configuring an AWS KMS keyring through the Nomad configuration
file by providing all the required values.

```hcl
keyring "awskms" {
Expand Down
22 changes: 14 additions & 8 deletions website/content/docs/configuration/keyring/azurekeyvault.mdx
Original file line number Diff line number Diff line change
@@ -1,18 +1,24 @@
---
layout: docs
page_title: Azure Key Vault - Keyring - Configuration
page_title: Azure Key Vault Keyring Configuration
description: >-
Use "azurekeyvault" to configure Nomad to use Azure Key Vault as the key material wrapping mechanism.
Configure an Azure Key Vault keyring in the `keyring "azurekeyvault"` block of a Nomad agent configuration. Configure the Key Vault resource's DNS, Azure Cloud environment API endpoints, vault and key names, tenant and client IDs, and the client secret. Learn how Nomad supports rotating keys defined in Azure Key Vault.
---

# `azurekeyvault` keyring
# Azure Key Vault Keyring Configuration

The AWS KMS keyring configures Nomad to use AWS KMS to wrap its keyring. This
example shows configuring Azure Key Vault keyring through the Nomad
configuration file by providing all the required values.
This page provides reference information for configuring an Azure Key Vault
keyring in the `keyring "azurekeyvault"` block of a Nomad agent
configuration. Configure the Key Vault resource's DNS, Azure Cloud environment
API endpoints, vault and key names, tenant and client IDs, and the client secret. Learn how Nomad supports rotating keys defined in Azure Key
Vault.

The Azure Key Vault keyring configures Nomad to use Azure Key Vault to wrap its
keyring. This example shows configuring Azure Key Vault keyring through the
Nomad configuration file by providing all the required values.

```hcl
seal "azurekeyvault" {
keyring "azurekeyvault" {
active = true
name = "example"
Expand Down Expand Up @@ -51,7 +57,7 @@ These parameters apply to the `keyring` block in the Nomad configuration file:
- `key_name` `(string: <required>)`: The Key Vault key to use for encryption and
decryption.

- `resource` `(string: "vault.azure.net")`: The AZ KeyVault resource's DNS
- `resource` `(string: "vault.azure.net")`: The Key Vault resource's DNS
Suffix to connect to. Alternately specify via the `AZURE_AD_RESOURCE`
environment variable. Needs to be changed to connect to Azure's Managed HSM
KeyVault instance type.
Expand Down
16 changes: 10 additions & 6 deletions website/content/docs/configuration/keyring/gcpckms.mdx
Original file line number Diff line number Diff line change
@@ -1,13 +1,17 @@
---
layout: docs
page_title: GCP Cloud KMS - Keyrings - Configuration
page_title: Google Cloud Platform Key Management Service Keyring Configuration
description: >-
Use "gcpkms" to configure Nomad to use GCP Cloud KMS as the keyring
wrapping mechanism.
Configure a Google Cloud Platform Key Management Service (GCP Cloud KMS) keyring in the `keyring "gcpckms"` block of a Nomad agent configuration. Configure GCP credentials, project, region, key ring, and crypto key. Learn how Nomad supports rotating keys defined in GCP Cloud KMS.
---

# `gcpckms` keyring
# Google Cloud Platform Key Management Service Keyring Configuration

This page provides reference information for configuring a Google Cloud Platform
Key Management Service (GCP Cloud KMS) keyring in the `keyring "gcpckms"` block
of a Nomad agent configuration. Configure GCP credentials, project, region, key
ring, and crypto key. Learn how Nomad supports rotating keys defined in GCP
Cloud KMS.

The GCP Cloud KMS keyring configures Nomad to use GCP Cloud KMS to wrap its
keyring. This example shows configuring GCP Cloud KMS keyring through the Nomad
Expand Down Expand Up @@ -41,9 +45,9 @@ These parameters apply to the `keyring` stanza in the Nomad configuration file:
- `region` `(string: <required>)`: The GCP region/location where the key ring
lives. Alternately specify via the `GOOGLE_REGION` environment variable.

- `key_ring` `(string: <required>)`: The GCP CKMS key ring to use.
- `key_ring` `(string: <required>)`: The GCP KMS key ring to use.

- `crypto_key` `(string: <required>)`: The GCP CKMS crypto key to use for
- `crypto_key` `(string: <required>)`: The GCP KMS crypto key to use for
encryption and decryption.

## Authentication &amp; permissions
Expand Down
15 changes: 9 additions & 6 deletions website/content/docs/configuration/keyring/index.mdx
Original file line number Diff line number Diff line change
@@ -1,14 +1,19 @@
---
layout: docs
page_title: keyring Block - Agent Configuration
page_title: keyring Block in Agent Configuration
description: >-
Use the "keyring" block to configure Nomad server keyring decryption behavior.
Configure keyring protection behavior in the `keyring` block of a Nomad agent configuration. Enable a keyring and configure a name. Learn how to configure keyring high availability (HA) and migrate keyrings.
---

# `keyring` Block
# `keyring` Block in Agent Configuration

<Placement groups={['keyring']} />

This page provides reference information for configuring keyring protection
behavior in the `keyring` block of a Nomad agent configuration. Enable a keyring
and configure a name. Learn how to configure keyring high availability (HA) and
migrate keyrings.

The `keyring` block configures how the Nomad server protects the keyring used
for encrypting [variables][] and signing [workload identities][]. By default,
Nomad encrypts the key material with a unique key encryption key (KEK) that is
Expand Down Expand Up @@ -68,9 +73,7 @@ keyring list`][keyring_list_cmd].

## High Availability

<EnterpriseAlert>
This functionality only exists in Nomad Enterprise.
</EnterpriseAlert>
<EnterpriseAlert product="nomad"/>

Keyring high availability provides the means to configure multiple active
`keyring` blocks, in order to have resilience against an outage of an external
Expand Down
23 changes: 14 additions & 9 deletions website/content/docs/configuration/keyring/transit.mdx
Original file line number Diff line number Diff line change
@@ -1,15 +1,20 @@
---
layout: docs
page_title: Vault Transit - Keyring - Configuration
page_title: Vault Transit Keyring Configuration
description: |-
Use "transit" to configure Nomad to use Vault's Transit Secret Engine as
the key material wrapping mechanism.
Configure a Vault transit secrets engine keyring in the `keyring "transit"` block of a Nomad agent configuration. Configure the address to the Vault cluster, key name, mount path, namespace, TLS authentication, whether to disable Vault token automatic renewal. Learn how Nomad supports rotating keys defined in Vault's transit secrets engine.
---

# `transit` keyring
# Vault Transit Keyring Configuration

The Vault transit keyring configures Nomad to use Vault's Transit Secret Engine
to wrap its keyring. This example shows configuring Vault Transit through the
This page provides reference information for configuring a Vault transit secrets
engine keyring in the `keyring "transit"` block of a Nomad agent configuration.
Configure the address to the Vault cluster, key name, mount path, namespace, TLS
authentication, whether to disable Vault token automatic renewal. Learn how
Nomad supports rotating keys defined in Vault's transit secrets engine.

The Vault transit keyring configures Nomad to use Vault's transit secrets engine
to wrap its keyring. This example shows configuring Vault transit through the
Nomad configuration file by providing all the required values.

```hcl
Expand Down Expand Up @@ -119,9 +124,9 @@ Other considerations for the token used:

## Key rotation

This keyring supports key rotation using the Transit Secret Engine's key
rotation endpoints. Refer to [Vault docs][rotate_doc]. Old keys must not be
disabled or deleted and are used to decrypt older data.
This keyring supports key rotation using Vault's transit secrets engine's key
rotation endpoints. Refer to [Vault docs][rotate_doc] for details. Old keys must
not be disabled or deleted and are used to decrypt older data.

[orphan token]: /vault/docs/concepts/tokens#token-hierarchies-and-orphan-tokens
[periodic token]: /vault/docs/concepts/tokens#periodic-tokens
Expand Down
Loading

0 comments on commit b1450d5

Please sign in to comment.