Skip to content

Commit 54d5a35

Browse files
committed
Enhance the client node intro rel note with blog content
1 parent 4c68ffa commit 54d5a35

File tree

2 files changed

+23
-3
lines changed

2 files changed

+23
-3
lines changed

content/nomad/v1.11.x/content/docs/architecture/cluster/node-identity.mdx

Lines changed: 8 additions & 2 deletions
Original file line numberDiff line numberDiff line change
@@ -8,14 +8,20 @@ description: Nomad's node identity feature uniquely identities each Nomad client
88

99
This page provides conceptual information about Nomad's node identity feature,
1010
which uniquely identities each Nomad client node and provides an authentication
11-
mechanism for nodes to make RPC calls to the Nomad servers. This feature does
12-
not replace mTLS.
11+
mechanism for nodes to make RPC calls to the Nomad servers.
1312

1413
The Nomad cluster gives every node a default identity once the cluster is able
1514
to fully support the feature with a defined lifetime. This node identity is a
1615
[JSON Web Token (JWT)][] that has been signed by the leader's keyring and is
1716
generated as part of the node's registration and heartbeat process.
1817

18+
The node identity feature is like multi-factor authentication for your Nomad
19+
clusters. It does not replace mTLS but adds a second layer of security to
20+
prevent an unauthorized client from joining a Nomad cluster. Using a client
21+
introduction token gives you the added benefit of additional control over
22+
misconfigured clients trying to join the cluster. You can specify node names,
23+
node pools, and TTLs for the tokens you generate.
24+
1925
## Node identity claims
2026

2127
Alongside the standard JWT claims such as `exp` (expiration time), `iat` (issued

content/nomad/v1.11.x/content/docs/release-notes/nomad/v1-11-x.mdx

Lines changed: 15 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -15,14 +15,28 @@ We are pleased to announce the following Nomad updates.
1515

1616
Nomad's client node identity feature uniquely identities each Nomad client node
1717
and provides an authentication mechanism for nodes to make RPC calls to the
18-
Nomad servers. This feature does not replace mTLS.
18+
Nomad servers.
1919

2020
Introduce Nomad clients to the cluster with JWT tokens. Configure Nomad servers
2121
with introduction enforcement levels that dictate how clients join the cluster.
2222
This approach results in logs and metrics to detail introduction violations.
2323
Once registered, Nomad clients are now provided with an identity token, used for
2424
RPC communication which is periodically renewed.
2525

26+
The client node introduction and identity feature is like multi-factor
27+
authentication for your Nomad clusters. It does not replace mTLS but adds
28+
a second layer of security to prevent an unauthorized client from joining a
29+
Nomad cluster.
30+
31+
Each layer answers a distinct question.
32+
33+
- Networking: Can the client reach the server?
34+
- mTLS: Does the client have valid certificates for the cluster?
35+
- Client introduction token: Does the client have a valid token to join the
36+
cluster?
37+
38+
Using a client introduction token gives you the added benefit of additional control over misconfigured clients trying to join the cluster. You can specify node names, node pools, and TTLs for the tokens you generate.
39+
2640
#### Relevant documentation
2741

2842
- [Client node identity concepts](/nomad/docs/architecture/cluster/node-identity)

0 commit comments

Comments
 (0)