Awesome Nomad › DevOps tools

mxab/nacp

⭐ 52 Go added to this list on 2024-12-11 repository created 2023-02-11

NACP (Nomad Admission Control Proxy) is a proxy server designed to sit in front of the HashiCorp Nomad API, enabling advanced validation and mutation of Nomad job data before it reaches the Nomad server. It intercepts API calls related to job operations such as planning, registering, and validating jobs, which are already transformed from HCL to JSON format. The proxy performs two main functions: mutation and validation of job data. For mutation, NACP supports two methods: embedded Open Policy Agent (OPA) rules and webhook mutators. The OPA mutator uses OPA's policy engine to generate JSONPatch objects that modify the job data, and it can also return errors and warnings. Webhook mutators send job data to external endpoints, expecting JSONPatch responses to apply changes, along with any errors or warnings. This flexibility allows users to define custom logic for modifying job specifications dynamically. Validation is similarly handled through OPA rules or webhooks. The OPA validator checks job data against defined policies and returns lists of errors and warnings if any violations are found. Webhook validators send job data to configured endpoints and expect error and warning lists in response. This ensures that only jobs meeting organizational policies and standards are accepted by Nomad. NACP supports TLS configuration for secure communication and can be configured to connect to Nomad's API securely. It also integrates with image signature validation tools like Notation, either through a dedicated validator or via OPA functions, enhancing security by verifying container images used in jobs. The project includes examples and detailed configuration options for setting up mutators, validators, and the proxy server itself. It is inspired by the internal Nomad Admission Controller and extends its capabilities by providing a flexible, policy-driven admission control mechanism for Nomad job submissions. Keywords: Nomad, admission controller, proxy, job validation, job mutation, Open Policy Agent, OPA, webhook, JSONPatch, job data, TLS, image signature validation, Notation, policy enforcement, job admission, job mutation, job validation, Nomad API, secure communication.

https://github.com/mxab/nacp

admission-controllerdevsecopsimage-signature-validationjob-admissionjob-datajob-mutationjob-validationjsonpatchnomadnomad-apinotarynotationopaopen-policy-agentpolicy-enforcementproxysecure-communicationtlswebhook