Prestart / Init task continues to render templates
- Dominant language
- Go
- Stars
- 17k
- Forks
- 2.1k
- Avg merge
- 1d 9h
- Merged PRs (30d)
- 105
Description
- Nomad v1.4.3
- Ubuntu 22.04.1 LTS (Linux 5.15.0-53-generic)
When a given init/prestart task completes successfully, it appears that any `template` defintions for that task with Vault secrets are continually updated--even beyond the lifetime of the prestart task.
The expected behavior is that, once a task concludes, all templates associated with it are no longer updated.
Here's an example job file that demonstrates the issue:
```
job "my-job" {
datacenters = ["default"]
group "primary" {
count = 1
task "main" {
driver = "exec"
config {
command = "sleep"
args = ["infinity"]
}
}
task "init" {
driver = "exec"
lifecycle { hook = "prestart" } # init task, once it exits, the template shouldn't be re-rendered
vault { policies = [ "vault-policy-here" ] }
config {
command = "echo" # arbitrary command; typically much more happening here
args = ["done"]
}
# new secret.txt file is re-rendered every few minutes even after completion of init (prestart) task
template {
change_mode = "noop"
destination = "${NOMAD_SECRETS_DIR}/secret.txt"
data = <<-EOT
{{- with secret "gcp/my-service-account/my-reader/token" -}}
{{ .Data.token }}
{{- end -}}
EOT
}
}
}
}
```
Contributor guide
No contributing guide indexed for this repository
Research direction
Start with the provided Nomad job example and trace how prestart task completion interacts with template rendering and Vault-backed updates. Done means templates associated with a completed prestart task are no longer re-rendered; no source files or tests are named in the issue.
Written by the indexing model from the issue text.
Assessment
- Tech stack
- go
- Domain
- infrastructure
- Issue type
- Bug
- Difficulty
- 4/5
- Estimated time
- 3-5 days
- Activity status
- Stale
- Clarity
- Mostly clear
- Newbie friendliness
- 35/100