identity Block

The identity block allows a task access to its Workload Identity via an environment variable or file. By default Nomad will create an identity for all workloads, but it is not exposed to a task.

The following will expose the Workload Identity as an environment variable and file to the task:

job "docs" {
  group "example" {
    task "api" {

      identity {
        env  = true
        file = true
      }

      # ...
    }
  }
}

identity Parameters

• env (bool: false) - If true the workload identity will be available in the task's NOMAD_TOKEN environment variable.
• file (bool: false) - If true the workload identity will be available in the task's filesystem via the path secrets/nomad_token. If the task.user parameter is set, the token file will only be readable by that user. Otherwise the file is readable by everyone but is protected by parent directory permissions.