From efeeead0fe450ec5b16b06619119521235d41154 Mon Sep 17 00:00:00 2001
From: Mathias Magnusson <mathias@magnusson.space>
Date: Fri, 13 Dec 2024 21:51:08 +0100
Subject: [PATCH] give human policy access to variables

---
 nomad.tf | 7 +++++++
 1 file changed, 7 insertions(+)

diff --git a/nomad.tf b/nomad.tf
index a495b8a..093403c 100644
--- a/nomad.tf
+++ b/nomad.tf
@@ -85,6 +85,13 @@ resource "nomad_acl_policy" "manage_jobs" {
   description = "Can manage jobs in the ${each.value} namespace"
   rules_hcl   = <<HCL
     namespace "${each.value}" {
+      variables {
+        # These can be read anyway by execing into a job and echoing env variables,
+        # though perhaps write access could be more restricted.
+        path "nomad/jobs/*" {
+          capabilities = ["read", "write"]
+        }
+      }
       policy = "write"
     }
   HCL