Repository: hashicorp/nomad
File: nomad/structs/config/vault.go (Go)

Code before:

	// TLSServerName, if set, is used to set the SNI host when connecting via TLS.
	TLSServerName string `mapstructure:"tls_server_name"`

	// Servers-only fields.

	// DefaultIdentity is the default workload identity configuration used when
	// a job has a `vault` block but no `identity` named "vault_<name>", where
	// <name> matches this block `name` parameter.
	DefaultIdentity *WorkloadIdentityConfig `mapstructure:"default_identity"`

	// Token is used by the Vault Transit Keyring implementation only. It was
	// previously used by the now removed Nomad server derive child token
	// workflow.
	Token string `mapstructure:"token"`
}

// DefaultVaultConfig returns the canonical defaults for the Nomad
// `vault` configuration.
func DefaultVaultConfig() *VaultConfig {
	return &VaultConfig{
		Name:                "default",
		Addr:                "https://vault.service.consul:8200",
		JWTAuthBackendPath:  "jwt-nomad",
		ConnectionRetryIntv: DefaultVaultConnectRetryIntv,
		TLSSkipVerify:       pointer.Of(false),
	}
}

// IsEnabled returns whether the config enables Vault integration
func (c *VaultConfig) IsEnabled() bool {
	if c == nil {
		return false
	}
	return c.Enabled != nil && *c.Enabled
}

// Merge merges two Vault configurations together.
func (c *VaultConfig) Merge(b *VaultConfig) *VaultConfig {
	result := *c

	if b.Name != "" {
		result.Name = b.Name
	}
	if b.Enabled != nil {
		result.Enabled = b.Enabled
	}
	if b.Role != "" {
		result.Role = b.Role
	}


Review comment (suggestion):
This change is probably debatable but we specify in the docs this will default to false.  I figured defensively setting this here may not be a bad idea.

Code after:

	// TLSServerName, if set, is used to set the SNI host when connecting via TLS.
	TLSServerName string `mapstructure:"tls_server_name"`

	// Servers-only fields.

	// DefaultIdentity is the default workload identity configuration used when
	// a job has a `vault` block but no `identity` named "vault_<name>", where
	// <name> matches this block `name` parameter.
	DefaultIdentity *WorkloadIdentityConfig `mapstructure:"default_identity"`

	// Token is used by the Vault Transit Keyring implementation only. It was
	// previously used by the now removed Nomad server derive child token
	// workflow.
	Token string `mapstructure:"token"`
}

// DefaultVaultConfig returns the canonical defaults for the Nomad
// `vault` configuration.
func DefaultVaultConfig() *VaultConfig {
	return &VaultConfig{
		Name:                "default",
		Addr:                "https://vault.service.consul:8200",
		JWTAuthBackendPath:  "jwt-nomad",
		ConnectionRetryIntv: DefaultVaultConnectRetryIntv,
	}
}

// IsEnabled returns whether the config enables Vault integration
func (c *VaultConfig) IsEnabled() bool {
	if c == nil {
		return false
	}
	return c.Enabled != nil && *c.Enabled
}

// Merge merges two Vault configurations together.
func (c *VaultConfig) Merge(b *VaultConfig) *VaultConfig {
	result := *c

	if b.Name != "" {
		result.Name = b.Name
	}
	if b.Enabled != nil {
		result.Enabled = b.Enabled
	}
	if b.Role != "" {
		result.Role = b.Role
	}

	if b.Namespace != "" {