deployNomadJob analog to deployTerraform

[blaggacao]

1. https://www.nomadproject.io/docs/commands/job/plan
2. https://www.nomadproject.io/docs/commands/job/run

Anything I need to know before getting my hands dirty?

[kamadorueda]

Anything I need to know before getting my hands dirty?

You can inspire on: #616
I'll be adding docs soon

if nomad has a custom authorization/configuration, making a secretsForNomadFromEnv can help you reuse code

[kamadorueda]

Does nomad will be running Makes jobs? or arbitrary jobs?

computeOnXXX is meant for running a makes command on XXX provider,

if nomad's plan and run are more like terraform, then testNomad (plan) and deployNomad (run) are more meaningful

[kamadorueda]

In any case, thanks for contributing this feature!
you can implement it as it best suits your needs today

if in the future someone else (or even us) want to use it,
then they/we will contribute the generalizations

[blaggacao]

Looks like there can also be parametrization with:

• https://www.nomadproject.io/docs/commands/job/dispatch

[blaggacao]

computeOnXXX that might come in handy once terraform needs to talk to remote APIs that are only accessible from within a deployment: eg. database engine seeding, rabbitMQ seeding, kv-store seeding

[blaggacao]

I'm on this one.

As for the modules & related to #619 :

• The entire hashicorp stack can consume json wherever hcl is accepted
• Hence we can define jobs & (above all) job trees per namespace with nix
• Hence, I'm musing about some sort of "wrapper" module that can auto-create a makes job-tree off a specifically shaped & nested input attrs.

{
  dev = { backend = {}; frontend = {}; ... };
  staging = {};
  prod = {};
}

producing ...

/deploy/dev/backend
/deploy/dev/frontend
...

[blaggacao]

And here is another gotcha, to manage consul (config) & vault (secrets) declarative, nomad does not have the same primitives as k8s.

• app config & app secrets (k8s ConfigMap & Secret) can be handled with terraform & the consul & vault provider (secrets coming from sops).
  • terraforming secrets is highly sensitive as they would be stored in clear text in the state file
  • tentative solution: handle state files in vault — maybe the vault provider doesn't strictly need to persist a statefile, though → tempfile & cleanup
• app initialization such as create database user, rabbit mq user, etc. (no equivalent in k8s — usually done by the entry-point) can be handled via terraform but only after the jobs have been applied and the services are running.
• to proxy into the protected network to reach those (not necessarily public) endpoints, something like https://www.boundaryproject.io/ might be useful

[dsalaza4]

@blaggacao Are you currently using this builtin?

[blaggacao]

Nope, we can close this. 🤝