Backport of Verify TLS certificate on endpoints that are used between agents only into release/1.2.x #12624
Add this suggestion to a batch that can be applied as a single commit.
This suggestion is invalid because no changes were made to the code.
Suggestions cannot be applied while the pull request is closed.
Suggestions cannot be applied while viewing a subset of changes.
Only one suggestion per line can be applied in a batch.
Add this suggestion to a batch that can be applied as a single commit.
Applying suggestions on deleted lines is not supported.
You must change the existing code in this line in order to create a valid suggestion.
Outdated suggestions cannot be applied.
This suggestion has been applied or marked resolved.
Suggestions cannot be applied from pending reviews.
Suggestions cannot be applied on multi-line comments.
Suggestions cannot be applied while the pull request is queued to merge.
Suggestion cannot be applied right now. Please check back later.
Backport
This PR is auto-generated from #11956 to be assessed for backporting due to the inclusion of the label backport/1.2.x.
WARNING automatic cherry-pick of commits failed. Commits will require human attention.
The below text is copied from the body of the original PR.
There are different types of endpoints in Nomad, and different types use different mechanism to validate and authenticate requests.
The most common endpoints are called by end-users via the HTTP API and get translated to an RPC request. They are authenticated using ACL tokens.
Another type of endpoint is used by Raft and are called between servers. This process doesn't have ACL tokens involved, so requests are validated by checking the mTLS certificates, when available.
Finally, there are endpoints that are called by agents directly via RPC, either
client -> server
orserver -> server
. These also don't use ACL tokens, so there was no explicit validation.This PRs adds a check to these agent to agent endpoints similar to Raft's, using the mTLS certificate, if available.