diff options
Diffstat (limited to 'fdio.infra.ansible/roles/nomad')
7 files changed, 49 insertions, 37 deletions
diff --git a/fdio.infra.ansible/roles/nomad/defaults/main.yaml b/fdio.infra.ansible/roles/nomad/defaults/main.yaml index 864890c11e..da9a872f83 100644 --- a/fdio.infra.ansible/roles/nomad/defaults/main.yaml +++ b/fdio.infra.ansible/roles/nomad/defaults/main.yaml @@ -3,14 +3,10 @@ # Inst - Prerequisites. packages: "{{ packages_base + packages_by_distro[ansible_distribution | lower] + packages_by_arch[ansible_machine] }}" - packages_base: - - "cgroup-bin" - "curl" - "git" - - "libcgroup1" - "unzip" - - "htop" packages_by_distro: ubuntu: - [] @@ -20,7 +16,7 @@ packages_by_arch: x86_64: - [] -# Inst - Download Nomad. +# Inst - Nomad Map. nomad_architecture_map: amd64: "amd64" x86_64: "amd64" @@ -29,7 +25,7 @@ nomad_architecture_map: 32-bit: "386" 64-bit: "amd64" nomad_architecture: "{{ nomad_architecture_map[ansible_architecture] }}" -nomad_version: "0.12.0" +nomad_version: "1.0.4" nomad_pkg: "nomad_{{ nomad_version }}_linux_{{ nomad_architecture }}.zip" nomad_zip_url: "https://releases.hashicorp.com/nomad/{{ nomad_version }}/{{ nomad_pkg }}" @@ -49,10 +45,7 @@ nomad_restart_handler_state: "restarted" # Conf - User and group. nomad_group: "nomad" nomad_group_state: "present" -nomad_manage_group: true -nomad_manage_user: true nomad_user: "nomad" -nomad_user_groups: [ docker, nomad, root ] nomad_user_state: "present" # Conf - base.hcl @@ -71,14 +64,16 @@ nomad_cert_file: "{{ nomad_ssl_dir }}/nomad.pem" nomad_http: false nomad_key_file: "{{ nomad_ssl_dir }}/nomad-key.pem" nomad_rpc: false +nomad_verify_https_client: false +nomad_verify_server_hostname: false # Conf - client.hcl nomad_certificates: - - src: "{{ vault_nomad_ca_file }}" + - src: "{{ file_nomad_ca_pem }}" dest: "{{ nomad_ca_file }}" - - src: "{{ vault_nomad_cert_file }}" + - src: "{{ file_nomad_client_pem }}" dest: "{{ nomad_cert_file }}" - - src: "{{ vault_nomad_key_file }}" + - src: "{{ file_nomad_client_key_pem }}" dest: "{{ nomad_key_file }}" nomad_node_class: "" nomad_no_host_uuid: true @@ -97,7 +92,6 @@ nomad_collection_interval: 60s nomad_use_node_name: false nomad_publish_allocation_metrics: true nomad_publish_node_metrics: true -nomad_backwards_compatible_metrics: false nomad_telemetry_provider_parameters: prometheus_metrics: true diff --git a/fdio.infra.ansible/roles/nomad/handlers/main.yaml b/fdio.infra.ansible/roles/nomad/handlers/main.yaml index f0bcee9142..8ef4d80353 100644 --- a/fdio.infra.ansible/roles/nomad/handlers/main.yaml +++ b/fdio.infra.ansible/roles/nomad/handlers/main.yaml @@ -7,4 +7,3 @@ enabled: true name: "nomad" state: "{{ nomad_restart_handler_state }}" - diff --git a/fdio.infra.ansible/roles/nomad/meta/main.yaml b/fdio.infra.ansible/roles/nomad/meta/main.yaml index 9fc40d9ae1..7036087739 100644 --- a/fdio.infra.ansible/roles/nomad/meta/main.yaml +++ b/fdio.infra.ansible/roles/nomad/meta/main.yaml @@ -1,9 +1,23 @@ --- # file: roles/nomad/meta/main.yaml -# desc: Install nomad from stable branch and configure service. +# desc: Install nomad from repo and configure service. # inst: Nomad # conf: ? # info: 1.0 - added role dependencies: [ docker ] + +galaxy_info: + role_name: nomad + author: fd.io + description: Hashicorp Nomad. + company: none + license: "license (Apache)" + min_ansible_version: 2.9 + platforms: + - name: Ubuntu + versions: + - focal + galaxy_tags: + - nomad diff --git a/fdio.infra.ansible/roles/nomad/tasks/main.yaml b/fdio.infra.ansible/roles/nomad/tasks/main.yaml index 54e80513b8..63025a6ead 100644 --- a/fdio.infra.ansible/roles/nomad/tasks/main.yaml +++ b/fdio.infra.ansible/roles/nomad/tasks/main.yaml @@ -3,7 +3,7 @@ - name: Inst - Update Package Cache (APT) apt: - update_cache: yes + update_cache: true cache_valid_time: 3600 when: - ansible_distribution|lower == 'ubuntu' @@ -20,9 +20,7 @@ - name: Conf - Add Nomad Group group: name: "{{ nomad_group }}" - state: "{{ nomad_group_state }}" - when: - - nomad_manage_group | bool + state: "{{ nomad_user_state }}" tags: - nomad-conf-user @@ -30,11 +28,8 @@ user: name: "{{ nomad_user }}" group: "{{ nomad_group }}" - groups: "{{ nomad_user_groups }}" - state: "{{ nomad_user_state }}" + state: "{{ nomad_group_state }}" system: true - when: - - nomad_manage_user | bool tags: - nomad-conf-user @@ -186,7 +181,9 @@ owner: "root" group: "root" mode: 0644 -# notify: -# - "Restart Nomad" + notify: + - "Restart Nomad" tags: - nomad-conf + +- meta: flush_handlers diff --git a/fdio.infra.ansible/roles/nomad/templates/nomad_systemd.service.j2 b/fdio.infra.ansible/roles/nomad/templates/nomad_systemd.service.j2 index 2a87c65063..61f07df5b6 100644 --- a/fdio.infra.ansible/roles/nomad/templates/nomad_systemd.service.j2 +++ b/fdio.infra.ansible/roles/nomad/templates/nomad_systemd.service.j2 @@ -1,21 +1,28 @@ [Unit] -Description=Nomad Service -Documentation=https://www.nomadproject.io/docs/ +Description=Nomad +Documentation=https://nomadproject.io/docs/ Wants=network-online.target After=network-online.target +# When using Nomad with Consul it is not necessary to start Consul first. These +# lines start Consul before Nomad as an optimization to avoid Nomad logging +# that Consul is unavailable at startup. +#Wants=consul.service +#After=consul.service + [Service] -# TODO: Decrease privilege -ExecReload=/bin/kill -SIGHUP $MAINPID -ExecStart={{ nomad_bin_dir }}/nomad agent -config={{ nomad_config_dir }} -KillSignal=SIGTERM +ExecReload=/bin/kill -HUP $MAINPID +ExecStart={{ nomad_bin_dir }}/nomad agent -config {{ nomad_config_dir }} +KillMode=process +KillSignal=SIGINT LimitNOFILE=infinity LimitNPROC=infinity Restart=on-failure -RestartSec=1 -User=root -Group=root -Environment="GOMAXPROCS=2" +RestartSec=2 +StartLimitBurst=3 +StartLimitInterval=10 +TasksMax=infinity +OOMScoreAdjust=-1000 [Install] -WantedBy=multi-user.target +WantedBy=multi-user.target
\ No newline at end of file diff --git a/fdio.infra.ansible/roles/nomad/templates/telemetry.hcl.j2 b/fdio.infra.ansible/roles/nomad/templates/telemetry.hcl.j2 index 256c6999e9..7b62f76976 100644 --- a/fdio.infra.ansible/roles/nomad/templates/telemetry.hcl.j2 +++ b/fdio.infra.ansible/roles/nomad/templates/telemetry.hcl.j2 @@ -16,5 +16,4 @@ telemetry { use_node_name = {{ nomad_use_node_name | bool | lower }} publish_allocation_metrics = {{ nomad_publish_allocation_metrics | bool | lower }} publish_node_metrics = {{ nomad_publish_node_metrics | bool | lower }} - backwards_compatible_metrics = {{ nomad_backwards_compatible_metrics | bool | lower }} } diff --git a/fdio.infra.ansible/roles/nomad/templates/tls.hcl.j2 b/fdio.infra.ansible/roles/nomad/templates/tls.hcl.j2 index 650765f1b1..46dc1fe6b1 100644 --- a/fdio.infra.ansible/roles/nomad/templates/tls.hcl.j2 +++ b/fdio.infra.ansible/roles/nomad/templates/tls.hcl.j2 @@ -5,6 +5,8 @@ tls { http = {{ nomad_http | bool | lower }} rpc = {{ nomad_rpc | bool | lower }} + verify_server_hostname = {{ nomad_verify_server_hostname | bool | lower }} + verify_https_client = {{ nomad_verify_https_client | bool | lower }} ca_file = "{{ nomad_ca_file }}" cert_file = "{{ nomad_cert_file }}" key_file = "{{ nomad_key_file }}" |