ACL policy interpolation

[tgross]

If the variables.path label in ACL policies supported templates, we could allow finer-grained control over access to secrets. This will only be especially useful once Nomad has expanded the work on Workload Identity

Example:

namespace "example" {
  variables {

    # full access to user-specific secrets
    path "user/{{ .token.name }}" {
      capabilities = ["write", "read", "destroy", "list"]
    }

    # list-only access for everything else
    path "*" {
      capabilities = ["list"]
    }

  }
}

[mikenomitch]

Somewhat related? - https://developer.hashicorp.com/consul/docs/security/acl/acl-roles#service-identities

[tgross]

Also related: #15875