Notes from setting up Nomad

Brian Hicks, June 17, 2024

A couple people have asked me for my impressions of Nomad. I used it a little bit back before 1.0, but haven't touched it for ~8 years so I'm going in with relatively fresh eyes.

The "stack" here is Vault, Consul, and Nomad. Here's a snippet of what they do:

I tried to get as much as possible configured declaratively (either with Nix or Terraform) and I think I've mostly succeeded, although secrets management needs a little bit of cleanup (maybe with agenix?)

Here's a collection of impressions in no particular order:

The one thing that makes me feel annoyed about this setup is the somewhat arbitrary line that gets drawn between the "community" (free) and enterprise versions of all the software. For example, you can set up OIDC login for Nomad in the community edition, but that's a paid feature in Consul.

There are also a few features that I'd be willing to pay a reasonable small-business-sized fee to access, but not a "contact us for enterprise pricing" fee. The biggest one is resource quotas: I can set up namespacing within Nomad, but all namespaces can run whatever they'd like with no limit. I'd like to restrict that, just to limit the blast radius if I mess something up or my continuous delivery API keys get leaked and some cryptominer decides to set up shop in my cluster. I kinda get why it's an enterprise feature (since it essentially segments Nomad into per-team resource pools) but I'd still like it.

Other than that, I have very few drawbacks about using Nomad. The BSL/IBM stuff coming up is the biggest thing, but I think I've got a good amount of time before post-acquisition shenanigans would make me want to switch.

If you'd like me to email you when I have a new post, sign up below and I'll do exactly that!

If you just have questions about this, or anything I write, please feel free to email me!