hashicorp / hashicorp/nomad

raise an error if group has Consul namespace set for non-Enterprise cluster

Open
#14,810 3 comments 0 reactions 0 assignees View on GitHub
stage/needs-discussion theme/consul theme/enterprise type/enhancement
Dominant language
Go
Stars
17k
Forks
2.1k
Avg merge
1d 9h
Merged PRs (30d)
105

Description

### Nomad version
Output from `nomad version`
1.3.5

### Operating system and Environment details
Ubuntu 22

### Issue
If you have a Group with the following definition:
```
group {
consul { namespace = var.some_namespace }
service "generator-plugin" {}
service "generator-execution-sidecar" {}
}
```
I would expect every instance of this group to exist in a different namespace (at least in Enterprise).
However: My cluster isn't enterprise yet, but Nomad happily accepts this job and then dumps these services into the only (default) namespace.
![image](https://user-images.githubusercontent.com/69007229/194118946-7427b08f-9f95-4edd-9171-afc540d06051.png)
This causes an unexpected round-robin situation.

When using the Consul CLI it gives you a pretty harsh error if you try to do anything namespace-related; I'd hope that Nomad's interface with this would try to do the same.
```
consul catalog services -namespace default
Error listing services: Unexpected response code: 400 (Bad request: Invalid query parameter: "ns" - Namespaces are a Consul Enterprise feature)
```

### Reproduction steps
Deploy the same Group multiple times with different `consul { namespace = }` values on a Nomad cluster with non-enterprise Consul.

#### Expected Result
Explicit failure - refusal to deploy the job, perhaps?

#### Actual Result
They all get silently dumped in the `default` namespace

### Job file (if appropriate)
I wouldn't suggest trying this one yourself, way too many prerequisites, but I discovered this with https://github.com/grapl-security/grapl/pull/2026/files#diff-47f0314c3995de007f9d705f4ea0b1f681b482df1f5fa3618ac8a11613599a19

Contributor guide

No contributing guide indexed for this repository

Research direction

Start by tracing how Nomad validates and deploys the group consul namespace setting for jobs targeting a non-Enterprise Consul cluster. Reproduce the shown group configuration with different namespace values, then verify that deployment fails explicitly instead of silently placing services in the default namespace.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
backend
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.