Nomad

This role deploys a new Nomad instance. It can deploy Nomad as a server or client, depending on the host's group name.

Prerequisites

  • An existing Vault instance to save gossip key and provision TLS certs
  • An existing consul-template instance to rotate TLS certs
  • Nomad installed
  • Ansible auth certificate on localhost to access Vault

Setup

For encryption, the role creates consul-template templates for:

  • Nomad's gossip key. A new key is added with nomad operator gossip keyring generate if it does not already exist
  • Nomad TLS certs from Vault PKI
  • Vault token for Vault integration

Variables

VariableDescriptionTypeDefault
nomad_config_dirConfiguration directorystring/etc/nomad.d
nomad_data_dirData directorystring/opt/nomad
nomad_tls_dirTLS files directorystring${nomad_data_dir}/tls
consul_template_config_dirconsul-template configuration filestring/etc/consul-template
nomad_register_consulRegister Nomad as a Consul servicebooltrue
nomad_vault_integrationSets up Vault integration in server nodebooltrue
nomad_serverStart Nomad in server modebooltrue
nomad_bootstrap_expect(server only) The expected number of servers in a clusternumber1
nomad_clientStart Nomad in client modeboolfalse
nomad_server_ip(client only) Server's IP addressstring-
nomad_vault_addrVault server API address to usestringhttps://localhost:8200
nomad_common_nameNomad node certificate common_namestringserver.global.nomad
nomad_alt_namesNomad's TLS certificate alt namesstringnomad.service.consul
nomad_ip_sansNomad's TLS certificate IP SANsstring127.0.0.1
cni_plugin_versionCNI plugins versionstring1.3.0

Notes

  • nomad_server and nomad_agent are mutually exclusive and cannot be both true.
  • nomad_bootstrap_expect must be the same value in all Nomad servers. If the key is not present in the server, that server instance will not attempt to bootstrap the cluster.
  • An existing Nomad server must be running and reachable at nomad_server_ip when nomad_agent is true.
  • The default value of nomad_common_name is server.global.nomad or client.global.nomad depending on whether nomad is started in server or client mode.