Enable Transport Encryption for Nomad

Enable Gossip Encryption for Nomad

Nomad server's gossip protocol that is used to communicate membership and liveness information can be encrypted with symmetric keys. Enabling gossip encryption requires you to set an encryption key when starting the Nomad server. The key can be set via the encrypt parameter or with the -encrypt command line option. The key must be a base64-encoded string of sixteen random bytes. The same encryption key should be used on every server in a region.

»Generate an encryption key

The Nomad CLI includes a operator keygen command for generating a new secure gossip encryption key.

$ nomad operator keygen
cg8StVXbQJ0gPvMd9o7yrg==

Alternatively, you can use any method that can create 16 random bytes encoded in base64.

$ openssl rand -base64 16
raZjciP8vikXng2S5X0m9w==
$ dd if=/dev/urandom bs=16 count=1 status=none | base64
LsuYyj93KVfT3pAJPMMCgA==

»Configure the server to use the key

Put the same generated key into every server's configuration file or command line arguments:

server {
  enabled = true

  # Self-elect, should be 3 or 5 for production. This is only for single node
  # clusters which are strictly for development/demo.
  bootstrap_expect = 1

  # Encrypt gossip communication
  encrypt = "cg8StVXbQJ0gPvMd9o7yrg=="
}

»Restart the server to enable encryption

You can perform a rolling restart of the Nomad process on each of your server nodes to enable encryption. Restart your servers one at a time in order to maintain a quorum of nodes on one side or the other of this soft partition.

Once all of the nodes have been restarted all gossip traffic will be encrypted between all of your server nodes.

»Next steps

If you would like to learn more technical information about Nomad's gossip protocol, consult the Serf library documentation.