templates: rewrite despite no content change if owner / group configured #14768
Comments
|
Issue brought up in discussion: https://discuss.hashicorp.com/t/uid-gid-ownership-of-template-output-in-nomad-secrets-dir-for-postgres/37239/6 |
|
Hi @harningt! I was able to reproduce this on the current HEAD of the I'm going to keep this issue open here in Nomad so that we have a place to point folks who get caught by this and so that we can track getting the fix from CT merged into Nomad as well. Sorry I don't have an immediate answer for you @harningt but I'll keep this issue updated with progress. Here's what I did to reproduce on Nomad. Run Vault in dev mode. Configure the CLI with Use the following for Nomad's Run the following job: jobspecjob "example" {
datacenters = ["dc1"]
group "group" {
network {
mode = "bridge"
port "www" {
to = 8001
}
}
task "task" {
driver = "docker"
config {
image = "busybox:1"
command = "httpd"
args = ["-v", "-f", "-p", "8001", "-h", "/local"]
ports = ["www"]
}
vault {
policies = ["default"]
}
template {
destination = "${NOMAD_TASK_DIR}/index.html"
uid = "55500000"
data = <<EOL
{{ with secret "secret/data/example" }}{{ .Data.content }}{{ end }}
EOL
}
resources {
cpu = 128
memory = 128
}
}
}
}The template renders, but a few minutes later the task restarts and I get the following in the logs: I ran this a couple times and the window of time varies but seems to always be on the order of minutes but less than 5min, because that's the CT sleep timeout. Next I ran the same job but with the I did some "printf debugging" and it looks like the event we're getting from consul-template is the one we normally use to detect a change, so as far as I could tell Nomad is behaving correctly based on the event we're getting from CT. And then I tried to reproduce with consul-template alone and was able to reproduce it there. |
tgross
added
stage/accepted
|
@harningt in the meanwhile, see the workaround described here: hashicorp/consul-template#1651 (comment) |
tgross
added
theme/dependencies
|
Consul-Template 0.29.5 was just released with the fix. We're in a very short merge-freeze window for Nomad 1.4.0 GA but once that's shipped we'll be able to get our CT dependency updated and I'd expect the fix to go out in the next regular version of Nomad (which will probably be |
|
Can confirm the workaround works :) Wish I had thought of that workaround when I was digging in the code. |
|
I'm going to lock this issue because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active issues. |
Nomad version
Nomad v1.3.5 (1359c25)
Operating system and Environment details
Fedora Linux clients and servers.
User Namespace configured docker instance as the primary use case.
Issue
Adjusting the ownership / group of templates (so they are owned by the namespaced user vs "nobody") results in the template being re-rendered + update trigger every 3-5 minutes despite no content changes.
Reproduction steps
Expected Result
change_modeaction is run on contents changeActual Result
change_modeaction is run every 3-5 minutesJob file (if appropriate)
Reduced to bare minimum
Nomad Server logs (if appropriate)
Nomad Client logs (if appropriate)
The text was updated successfully, but these errors were encountered: