Update to 2022-08-06 13:00

roles/nomad/defaults/main.yml

@@ -10,9 +10,11 @@ nomad_archive_sha256: d908811cebe2a8373e93c4ad3d09af5c706241878ff3f21ee0f182b4ec
 # List of plugins to install
 nomad_plugins:
   podman:
-    version: 0.4.0
     archive_url: https://releases.hashicorp.com/nomad-driver-podman/0.4.0/nomad-driver-podman_0.4.0_linux_amd64.zip
     sha256: f905f9c38db8cec1542b92f69233488d5bf94e30fe9a0fae9ac03b30c1e2cfea
+  containerd:
+    archive_url: https://github.com/Roblox/nomad-driver-containerd/releases/download/v0.9.3/containerd-driver
+    sha256: 7bbeda63a5e05724c8f8c6d05790fbc175acc89e4309c13839afc9716d4b39c2
 
 # Root dir where Nomad will be installed
 nomad_root_dir: /opt/nomad
@@ -102,6 +104,10 @@ nomad_base_conf:
         enabled: False
       podman:
         enabled: False # Note on EL8, it cannot be used with docker as there are package conflicts, see https://bugs.centos.org/view.php?id=16892
+      containerd-driver:
+        enabled: False
+        containerd_runtime: io.containerd.runc.v2
+        allow_privileged: True
 
   # Server related settings
   server:
@@ -161,6 +167,10 @@ nomad_base_services:
     proto: [tcp,udp]
     src_ip: []
     # advertise: x.x.x.x
+  dynamic:
+    port: 20000:32000
+    proto: [tcp,udp]
+    src_ip: []
 nomad_extra_services: {}
 nomad_host_services: {}
 nomad_services: "{{ nomad_base_services | combine(nomad_extra_services, recursive=True) | combine(nomad_host_services, recursive=True) }}"

roles/nomad/meta/main.yml

@@ -1,6 +1,8 @@
 ---
 
 dependencies:
+  - role: repo_docker
+    when: nomad_conf.client.enabled and nomad_conf.client.task_drivers['containerd-driver'].enabled # with containerd, we just configure the repo and install containerd.io
   - role: docker
     when: nomad_conf.client.enabled and nomad_conf.client.task_drivers.docker.enabled
   - role: cni_plugins

roles/nomad/tasks/cleanup.yml

@@ -6,3 +6,9 @@
     - "{{ nomad_root_dir }}/tmp/nomad_{{ nomad_version }}_linux_amd64.zip"
     - "{{ nomad_root_dir }}/tmp/nomad"
   tags: nomad
+
+- name: Remove temporary plugin files
+  file: path={{ item.dest }} state=absent
+  loop: "{{ nomad_plugin_dl.results }}"
+  when: nomad_plugin_dl is defined and nomad_plugin_dl.results is defined and item.dest is defined
+  tags: nomad

roles/nomad/tasks/install.yml

@@ -62,8 +62,27 @@
         dest: "{{ nomad_root_dir }}/plugins/"
         remote_src: True
       loop: "{{ nomad_plugin_dl.results }}"
+      when: item.dest | basename | splitext | last in ['.zip','.tgz', '.txz', '.tar.gz', '.tar.xz']
       notify: restart nomad
 
+    - name: Copy nomad plugins
+      copy:
+        src: "{{ item.dest }}"
+        dest: "{{ nomad_root_dir }}/plugins/"
+        remote_src: True
+      loop: "{{ nomad_plugin_dl.results }}"
+      when: item.dest | basename | splitext | last not in ['.zip','.tgz', '.txz', '.tar.gz', '.tar.xz']
+      notify: restart nomad
+
+    - name: List installed plugins
+      command: ls {{ nomad_root_dir }}/plugins/
+      register: nomad_installed_plugins
+      changed_when: False
+
+    - name: Set permissions on plugins
+      file: path={{ nomad_root_dir }}/plugins/{{ item }} owner=root group=root mode=755
+      loop: "{{ nomad_installed_plugins.stdout_lines }}"
+
   tags: nomad
 
 # Nomad looks for the qemu-system-x86_64 bin in $PATH

roles/nomad/templates/nomad.hcl.j2

@@ -18,7 +18,7 @@ name = {{ nomad_conf.name }}
 disable_update_check = true
 
 advertise {
-{% for service in nomad_services.keys() | list %}
+{% for service in ['http', 'rpc', 'serf' ] %}
 {% if nomad_services[service].advertise is defined %}
   {{ service }} = {{ nomad_services[service].advertise }}
 {% endif %}
@@ -26,7 +26,7 @@ advertise {
 }
 
 ports {
-{% for service in nomad_services.keys() | list %}
+{% for service in ['http', 'rpc', 'serf' ] %}
   {{ service }} = {{ nomad_services[service].port }}
 {% endfor %}
 }
@@ -118,6 +118,17 @@ plugin "raw_exec" {
   }
 }
 {% endif %}
+
+{% if 'containerd-driver' in nomad_enabled_task_drivers %}
+plugin "containerd-driver" {
+  config {
+    enabled = true
+    containerd_runtime = "{{ nomad_conf.client.task_drivers['containerd-driver'].containerd_runtime }}"
+    allow_privileged = {{ nomad_conf.client.task_drivers['containerd-driver'].allow_privileged | ternary('true', 'false') }}
+  }
+}
+{% endif %}
+
 {% endif %}
 {% else %}
 client {

roles/nomad/vars/RedHat-8.yml

@@ -8,3 +8,5 @@ nomad_task_driver_packages:
   podman:
     - podman
     - podman-docker
+  containerd-driver:
+    - containerd.io