Update to 2022-09-06 18:00

roles/nomad/templates/agent_cert.tpl.j2

@@ -1,8 +1,8 @@
-[[ with secret "{{ nomad_vault_tls.pki.path }}/issue/{{ nomad_vault_tls.pki.role }}" "common_name={{ (nomad_conf.server.enabled) | ternary('server', 'client') }}-{{ ansible_fqdn | regex_replace('\\.', '-') }}.{{ nomad_conf.region | default('global') }}.nomad" "ttl={{ nomad_vault_tls.pki.ttl }}" "alt_names=localhost,{{ (nomad_conf.server.enabled) | ternary('server', 'client') }}.{{ nomad_conf.region | default('global') }}.nomad{% if nomad_conf.server.enabled and nomad_conf.client.enabled %},client.{{ nomad_conf.region | default('global') }}.nomad{% endif %}{% if consul_conf is defined %},nomad{{ nomad_conf.server.enabled | ternary('', '-client') }}.service.{{ consul_conf.domain | default('consul') }}{% endif %}" ]]
+[[ with secret "{{ nomad_vault_secrets.pki.path }}/issue/{{ nomad_vault_secrets.pki.role }}" "common_name={{ (nomad_conf.server.enabled) | ternary('server', 'client') }}-{{ ansible_fqdn | regex_replace('\\.', '-') }}.{{ nomad_conf.region | default('global') }}.nomad" "alt_names=localhost,{{ (nomad_conf.server.enabled) | ternary('server', 'client') }}.{{ nomad_conf.region | default('global') }}.nomad{% if nomad_conf.server.enabled and nomad_conf.client.enabled %},client.{{ nomad_conf.region | default('global') }}.nomad{% endif %}{% if consul_conf is defined %},nomad{{ nomad_conf.server.enabled | ternary('', '-client') }}.service.{{ consul_conf.domain | default('consul') }}{% endif %}"{% if nomad_vault_secrets.pki.ttl is defined %} "ttl={{ nomad_vault_secrets.pki.ttl }}"{% endif %} ]]
 [[ .Data.{{ item.what }} ]]
 [[ end ]]
 {% if item.what == 'certificate' %}
-[[ with secret "{{ nomad_vault_tls.pki.path }}/cert/ca" ]]
+[[ with secret "{{ nomad_vault_secrets.pki.path }}/cert/ca" ]]
 [[ .Data.certificate ]]
 [[ end ]]
 {% endif %}

roles/nomad/templates/cli_cert.tpl.j2

@@ -1,3 +1,3 @@
-[[ with secret "{{ nomad_vault_tls.pki.path }}/issue/{{ nomad_vault_tls.pki.role }}" "ttl={{ nomad_vault_tls.pki.ttl }}" "common_name=cli-{{ ansible_fqdn | regex_replace('\\.', '-') }}.{{ nomad_conf.region | default('global') }}.nomad" ]]
+[[ with secret "{{ nomad_vault_secrets.pki.path }}/issue/{{ nomad_vault_secrets.pki.role }}" "common_name=cli-{{ ansible_fqdn | regex_replace('\\.', '-') }}.{{ nomad_conf.region | default('global') }}.nomad" ]]
 [[ .Data.{{ item.what }} ]]
 [[ end ]]

roles/nomad/templates/consul-template-nomad.service.j2

@@ -3,11 +3,13 @@ Description="HashiCorp consul-template"
 Documentation=https://github.com/hashicorp/consul-template
 Requires=network-online.target
 After=network-online.target
+Before=nomad.service
 ConditionFileNotEmpty={{ nomad_root_dir }}/consul-template/consul-template.hcl
 
 [Service]
 Type=simple
 ExecStart=/usr/local/bin/consul-template -config={{ nomad_root_dir }}/consul-template/consul-template.hcl
+SuccessExitStatus=12
 ExecReload=/bin/kill --signal HUP $MAINPID
 KillSignal=SIGINT
 Restart=on-failure

roles/nomad/templates/consul-template.hcl.j2

@@ -1,9 +1,12 @@
 vault {
-  address      = "{{ nomad_vault_tls.address }}"
-  token        = "{{ nomad_vault_tls.token }}"
+  address      = "{{ nomad_vault_secrets.vault_address }}"
+  token        = "{{ nomad_vault_secrets.vault_token }}"
   unwrap_token = false
 }
 
+# Sleep 10 sec before sending nomad service a reload to prevent it from crashing as
+# Nomad doesn't support getting a reload while it's still initializing
+{% if nomad_vault_secrets.pki.enabled %}
 template {
   source          = "{{ nomad_root_dir }}/consul-template/agent.crt.tpl"
   left_delimiter  = "[["
@@ -11,7 +14,7 @@ template {
   destination     = "{{ nomad_conf.tls.cert_file }}"
   perms           = 0644
   exec {
-    command = "systemctl reload nomad"
+    command = "sh -c 'sleep 10 && systemctl reload nomad || true'"
   }
 }
 
@@ -22,7 +25,7 @@ template {
   destination     = "{{ nomad_conf.tls.key_file }}"
   perms           = 0640
   exec {
-    command = ["sh", "-c", "chgrp {{ nomad_user }} {{ nomad_conf.tls.key_file }} && systemctl reload nomad"]
+    command = ["sh", "-c", "chgrp {{ nomad_user }} {{ nomad_conf.tls.key_file }} && sleep 10 && systemctl reload nomad || true"]
   }
 }
 
@@ -33,7 +36,7 @@ template {
   destination     = "{{ nomad_conf.tls.ca_file }}"
   perms           = 0644
   exec {
-    command = "systemctl reload nomad"
+    command = "sh -c 'sleep 10 && systemctl reload nomad || true'"
   }
 }
 
@@ -53,13 +56,18 @@ template {
   perms           = 0640
 }
 {% endif %}
+{% endif %}
 
-{% if nomad_conf.client.enabled and nomad_conf.consul.ssl %}
+
+{% if nomad_vault_secrets.consul_pki.enabled and nomad_conf.client.enabled and nomad_conf.consul.ssl %}
 template {
   source          = "{{ nomad_root_dir }}/consul-template/consul.crt.tpl"
   left_delimiter  = "[["
   right_delimiter = "]]"
   destination     = "{{ nomad_conf.consul.cert_file }}"
+  exec {
+    command = "sh -c 'sleep 10 && systemctl reload nomad || true'"
+  }
 }
 
 template {
@@ -68,6 +76,9 @@ template {
   right_delimiter = "]]"
   destination     = "{{ nomad_conf.consul.key_file }}"
   perms           = 0640
+  exec {
+    command = "sh -c 'sleep 10 && systemctl reload nomad || true'"
+  }
 }
 
 template {
@@ -77,8 +88,8 @@ template {
   destination     = "{{ nomad_conf.consul.ca_file }}"
   perms           = 0644
   exec {
-    command = "systemctl reload nomad"
+    command = "sh -c 'sleep 10 && systemctl reload nomad || true'"
   }
 }
-
 {% endif %}
+

roles/nomad/templates/consul_cert.tpl.j2

@@ -1,8 +1,8 @@
-[[ with secret "{{ nomad_vault_tls.consul_pki.path }}/issue/{{ nomad_vault_tls.consul_pki.role }}" "common_name={{ ansible_fqdn | regex_replace('\\.', '-') }}.{{ (consul_conf is defined and consul_conf.domain is defined) | ternary(consul_conf.domain, 'consul') }}" "ttl={{ nomad_vault_tls.consul_pki.ttl }}" ]]
+[[ with secret "{{ nomad_vault_secrets.consul_pki.path }}/issue/{{ nomad_vault_secrets.consul_pki.role }}" "common_name={{ ansible_fqdn | regex_replace('\\.', '-') }}.{{ (consul_conf is defined and consul_conf.domain is defined) | ternary(consul_conf.domain, 'consul') }}"{% if nomad_vault_secrets.consul_pki.ttl is defined %} "ttl={{ nomad_vault_secrets.consul_pki.ttl }}"{% endif %} ]]
 [[ .Data.{{ item.what }} ]]
 [[ end ]]
 {% if item.what == 'issuing_ca' %}
-[[ with secret "{{ nomad_vault_tls.root_pki.path }}/cert/ca" ]]
+[[ with secret "{{ nomad_vault_secrets.consul_pki.root_path }}/cert/ca" ]]
 [[ .Data.certificate ]]
 [[ end ]]
 {% endif %}

roles/nomad/templates/nomad.hcl.j2

@@ -210,11 +210,20 @@ vault {
   {{ key }} = {{ nomad_conf.vault[key] | ternary('true', 'false') }}
 {% endif %}
 {% endfor %}
+{% if nomad_conf.server.enabled %}
 {% for key in ['address', 'create_from_role', 'task_token_ttl', 'ca_file', 'ca_path', 'cert_file', 'key_file', 'namespace', 'tls_server_name', 'token'] %}
 {% if nomad_conf.vault[key] is defined %}
   {{ key }} = "{{ nomad_conf.vault[key] }}"
 {% endif %}
 {% endfor %}
+{% elif nomad_conf.client.enabled and not nomad_conf.server.enabled %}
+{% for key in ['address', 'ca_file', 'ca_path', 'cert_file', 'key_file', 'namespace', 'tls_server_name'] %}
+{% if nomad_conf.vault[key] is defined %}
+  {{ key }} = "{{ nomad_conf.vault[key] }}"
+{% endif %}
+{% endfor %}
+
+{% endif %}
 }
 
 tls {

roles/nomad/templates/pre-backup.j2

@@ -6,7 +6,7 @@ set -eo pipefail
 NOMAD_ADDR=https://localhost:{{ nomad_services.http.port }} \
 NOMAD_CACERT={{ nomad_conf.tls.ca_file }} \
 {% endif %}
-{% if nomad_vault_tls.enabled %}
+{% if nomad_vault_secrets.pki.enabled %}
 NOMAD_CLIENT_CERT={{ nomad_root_dir }}/tls/cli.crt \
 NOMAD_CLIENT_KEY={{ nomad_root_dir }}/tls/cli.key \
 {% endif %}

roles/nomad/templates/profile.sh.j2

@@ -1,7 +1,7 @@
 {% if nomad_conf.tls.http and nomad_conf.server.enabled %}
 export NOMAD_ADDR=https://localhost:{{ nomad_services.http.port }}
 export NOMAD_CACERT={{ nomad_conf.tls.ca_file }}
-{% if nomad_vault_tls.enabled %}
+{% if nomad_vault_secrets.pki.enabled %}
 export NOMAD_CLIENT_CERT={{ nomad_root_dir }}/tls/cli.crt
 export NOMAD_CLIENT_KEY={{ nomad_root_dir }}/tls/cli.key
 export NOMAD_TLS_SERVER_NAME=server.{{ nomad_conf.region | default('global') }}.nomad