[IND-369] TFE FDO on Nomad

[kkavish]

This is a pack to run TFE Flexible Deployment Option on Nomad.

It will take as an input the details of Nomad cluster already running and then try to start Terraform Enterprise container on it.

Please confirm the following if submitting a new pack:

New Pack Checklist

• The README includes any information necessary to run the application that is not encoded in the pack itself.
• The pack renders properly with nomad-pack render <NAME>
• The pack plans properly with nomad-pack plan <NAME>
• The pack runs properly with nomad-pack runs <NAME>
• If applicable, a screenshot of the running application is attached to the PR.
• The default variable values result in a syntactically valid pack.
• Non-default variables values have been tested. Conditional code paths in the template have been tested, and confirmed to render/plan properly.
• If applicable, the pack includes constraints necessary to run the pack safely (I.E. a linux-only constraint for applications that require linux).

Some screens:

[srahul3]

Added few comments for better user experience.

[rashmiachar86]

This is required for Optum customer who is looking for Nomad support for TFE. Please do the needful !

[tgross]

Hi @kkavish! I've left a bunch of comments but the major design issue I see here is the authentication to Nomad. If we're publishing a Pack for a service that talks to Nomad, we absolutely should be using the Task API and appropriate ACLs for it.

[kkavish]

Hi @kkavish! I've left a bunch of comments but the major design issue I see here is the authentication to Nomad. If we're publishing a Pack for a service that talks to Nomad, we absolutely should be using the Task API and appropriate ACLs for it.

@tgross We are using the Nomad SDK with appropriate ACLs while interacting with Nomad inside TFE task. For ACLs, please search for identity stanza in packs/tfe_fdo_nomad/templates/tfe.nomad.tpl. We have also provided the sample permissions for users inside Readme.md.

If you meant to update the job definition to use unix.sock we can do a spike on it before GA and update. Note, that this is beta.

[kkavish]

Thanks @tgross!