agent: warn on unauthenticated server join request

[tgross]

Using the API to join a new server agent via the nomad server join command is currently protected by Serf gossip encryption. Only once the agents are joined in the Serf cluster does mTLS come into play. Although both encryption types have been long-published to be required for secure configuration, we intend to make authentication mandatory for the server join API in a near-future version of Nomad (likely 2.1.0).

Add a warning to the request logs, to the API response, and to the command line when attempting to server join without an agent:write ACL. The warning doesn't specifically refer to this policy just in case we want to invent a new fine-grained capability by the time we remove anonymous access.

Ref: https://hashicorp.atlassian.net/browse/NMD-1507
Ref: https://hashicorp.atlassian.net/browse/SECVULN-44064

Testing & Reproduction steps

In addition to unit tests:

# unauthenticated
$ nomad server members
Error querying servers: Unexpected response code: 403 (Permission denied)

$ nomad server join 192.168.1.194:4668
Joined 1 servers successfully but got warning: anonymous server join is deprecated and will be removed in a future version of Nomad

# bootstrap ACLs so we can see the results
$ cat token | nomad acl bootstrap -
$ export NOMAD_TOKEN=$(cat token)

$ nomad server members
Name            Address        Port  Status  Leader  Raft Version  Build      Datacenter  Region
server0.philly  192.168.1.194  4648  alive   false   3             2.0.4-dev  dc1         philly
server1.philly  192.168.1.194  4658  alive   false   3             2.0.4-dev  dc1         philly
server2.philly  192.168.1.194  4668  alive   true    3             2.0.4-dev  dc1         philly

Contributor Checklist

• Changelog Entry done
• Testing see above
• Documentation will be covered by https://hashicorp.atlassian.net/browse/NMD-1506
• LLM Usage n/a

Reviewer Checklist

• Backport Labels note this will be backported to 2.0.x only because the breaking change will obviously not be backported either
• Commit Type Ensure the correct merge method is selected which should be "squash and merge"
  in the majority of situations. The main exceptions are long-lived feature branches or merges where
  history should be preserved.
• Enterprise PRs If this is an enterprise only PR, please add any required changelog entry
  within the public repository.

• If a change needs to be reverted, we will roll out an update to the code within 7 days.

Changes to Security Controls

Are there any changes to security controls (access controls, encryption, logging) in this pull request? If so, explain.

[gulducat]

LGTM. I do kinda wonder how many workflows out there lean on the status quo, even just by happenstance.

[schmichael]

Thanks Tim!

I do kinda wonder how many workflows out there lean on the status quo, even just by happenstance.

We have to assume lots because we just didn't care before. Being lax is great for usability, and this operation is particularly nice to be able to perform unauthenticated because it's probably either being done by automation or a panicked operator. It's never really part of a "normal" workflow where the service or user would be expected to have a token already.

All we can do is add warnings and document document document though. Despite not technically a problem for properly secured clusters, authed-everywhere is the right destination to move toward.