When using token with role with proper permissions, UI buttons are disabled

[Kamilcuk]

Nomad version

Nomad v1.5.0
BuildDate 2023-03-01T10:11:42Z
Revision fc40c49

Operating system and Environment details

Archlinux newest

Issue

When using token with role the UI buttons for running a job, draining node and eligible switch are greyed out, even when the token has correct permissions from the role. This also causes the setup of Vault SSO login from https://developer.hashicorp.com/nomad/tutorials/single-sign-on/sso-oidc-vault#create-a-vault-oidc-provider to have disabled buttons (it is an amazing tutorial).

Reproduction steps

nomad agent -dev -acl-enabled

export NOMAD_TOKEN=$(nomad acl bootstrap -json | jq -r .SecretID)
cat >acl_policy_engineering_read.hcl <<EOF
namespace "*" {
  policy = "write"
}
node {
  policy = "write"
}
EOF
nomad acl policy apply engineering-read acl_policy_engineering_read.hcl
nomad acl role create  -name=engineering-read  -policy=engineering-read
nomad acl token create -name=engineering -role-name=engineering-read

Copy the token from acl token create and login to UI. You will notice that the buttons are greyed out.

Expected Result

The token has permissions to drain a node, so the UI button shouldn't be greyed out.

Actual Result

The buttons are greyed out.

And: thanks for Nomad, except for that issue, Nomad SSO Vault OIDC is working quite fine and the integration works. If I copy the token from OIDC from UI to command line and use it, it works properly.

[lgfa29]

Hi @Kamilcuk 👋

Thanks for the report. Yes I think the UI may be missing logic to handle ACL token roles. I have placed this issue in our backlog for further roadmapping.

[Kamilcuk]

Hi! Also, node Meta and Attributes do not show up.

[lgfa29]

Hi! Also, node Meta and Attributes do not show up.

Yes, I suspect anything that requires specific capabilities is not going to work.

[michael-strigo]

Related: #14450

[lgfa29]

#17312 reported the same problem in the Variables page as well.

[philrenaud]

Hi @Kamilcuk , this should be resolved in #17770. Look for it in an upcoming Nomad release.