hashicorp / hashicorp/nomad

Prestart / Init task continues to render templates

Open
#15,419 1 comment 0 reactions 0 assignees View on GitHub
stage/accepted theme/task lifecycle type/bug
Dominant language
Go
Stars
17k
Forks
2.1k
Avg merge
1d 9h
Merged PRs (30d)
105

Description

- Nomad v1.4.3
- Ubuntu 22.04.1 LTS (Linux 5.15.0-53-generic)

When a given init/prestart task completes successfully, it appears that any `template` defintions for that task with Vault secrets are continually updated--even beyond the lifetime of the prestart task.

The expected behavior is that, once a task concludes, all templates associated with it are no longer updated.

Here's an example job file that demonstrates the issue:

```
job "my-job" {
datacenters = ["default"]

group "primary" {
count = 1

task "main" {
driver = "exec"

config {
command = "sleep"
args = ["infinity"]
}
}

task "init" {
driver = "exec"

lifecycle { hook = "prestart" } # init task, once it exits, the template shouldn't be re-rendered

vault { policies = [ "vault-policy-here" ] }

config {
command = "echo" # arbitrary command; typically much more happening here
args = ["done"]
}

# new secret.txt file is re-rendered every few minutes even after completion of init (prestart) task
template {
change_mode = "noop"
destination = "${NOMAD_SECRETS_DIR}/secret.txt"
data = <<-EOT
{{- with secret "gcp/my-service-account/my-reader/token" -}}
{{ .Data.token }}
{{- end -}}
EOT
}
}
}
}
```

Contributor guide

No contributing guide indexed for this repository

Research direction

Start with the provided Nomad job example and trace how prestart task completion interacts with template rendering and Vault-backed updates. Done means templates associated with a completed prestart task are no longer re-rendered; no source files or tests are named in the issue.

Written by the indexing model from the issue text.

Assessment

Tech stack
go
Domain
infrastructure
Issue type
Bug
Difficulty
4/5
Estimated time
3-5 days
Activity status
Stale
Clarity
Mostly clear
Newbie friendliness
35/100

Get new issues in your inbox

A short digest of beginner-friendly GitHub issues.