The upcoming 0.10 release of Nomad brings many exciting network-oriented features to the product. In this session, you will learn how you can use Nomad, including these new features with Consul Connect, to provide secure communication and service mesh capabilities to your applications.

1. Copyright © 2019 HashiCorp
Service Mesh with
Consul Connect and
Nomad 0.10

2. $> whoami
Nick Ethier
he/him
@nickethier
SWE - Nomad Core
Embarrassing Dad
Hobby Farmer

4. Service to Sidecar
Tasks of an allocation are co-located but don’t have a
secure means to communicate between each other
Networking
Problems
Service to Service
Continues to be solved well by Consul integration
External to Service
Many people are using tools such as Traefik and
Fabio to solve this

5. Sidecar Pattern

6. Shared Network Namespace
Coming in 0.10

7. Network
Stanza
CODE EDITOR
job “backend-api” {
group “api” {
network {
mode = “bridge”
port “web” {
static = 443
to = 443
}
}
task “api” { … }
}
}

8. Network Modes
host
▪ Host network stack
▪ No port mapping
bridge
▪ Shared network stack
▪ Virtual interface to host
bridge
▪ Egress NAT rules
▪ Ingress port mapping
none
▪ Shared network stack
▪ No egress/ingress
▪ Loopback only

9. Port Stanza
CODE EDITOR
job “backend-api” {
group “api” {
network {
mode = “bridge”
port “web” {
static = 80
to = 8080
}
}
task “api” { … }
}
}

10. Port Mapping
bridge
172.26.66.1:8080
10.103.2.44:80
172.26.66.2 172.26.66.3

11. Service
Stanza
CODE EDITOR
job “backend-api” {
group “api” {
network { … }
service {
name = "backend-api"
port = "web"
check {
type = "tcp"
port = "web"
interval = "10s"
timeout = "2s"
}
}
task “api” { … }
}

12. Works
Across
Drivers
CODE EDITOR
job “backend-api” {
group “api” {
network { … }
task “api” {
driver = “exec”
...
}
task “worker” {
driver = “docker”
...
}
}
}

13. Full 0.9 Backwards Compatibility

15. Service to Service Communication
Options:
▪ DNS
▪ Template Stanza
▪ Native Integration
▪ Integrated proxy (Traefik,
Fabio, etc)

16. Service Segmentation

17. Service Segmentation

18. Service to Service Communication

19. Consul Connect
▪ Service Access Graph
▪ Certificate Authority
▪ Supports Native Integration

20. Sidecar Pattern

21. Connect
Stanza
CODE EDITOR
job “redis” {
group “redis” {
network { ... }
service {
name = "redis"
port = "6379"
connect {
sidecar_service { }
}
}
task “redis” { … }
}
}

22. Nomad Proxy Task

23. Upstreams
Stanza
CODE EDITOR
service {
name = "api"
port = "8080"
connect {
sidecar_service {
proxy {
upstreams {
destination_name = "redis"
local_bind_port = 6379
}
}
}
}
}

24. TERMINAL
$> env | grep UPSTREAM
NOMAD_UPSTREAM_IP_redis=127.0.0.1
NOMAD_UPSTREAM_PORT_redis=6379
NOMAD_UPSTREAM_ADDR_redis=127.0.0.1:6379
New
Environment
Variables

25. Dashboard API
Nomad Connect Demo
Nomad Nomad

27. Advanced Networking Requirements
What if you need something more advanced?
▪ Baremetal
▪ Overlay Networking

28. What is CNI?
Nomad Client
Alloc
CNI Plugin
{
"name": "mynet",
"type": "bridge",
"bridge": "mynet0",
"isDefaultGateway": true,
"ipMasq": true,
"ipam": {
"type": "host-local",
"subnet": "10.10.0.0/16"
}
}
mynet.json

29. CNI Plugins
https://github.com/containernetworking/plugins
Ipam: adds addresses
▪ host-local
▪ dhcp
Main: adds interfaces
▪ bridge
▪ host-device
▪ ipvlan
▪ loopback
▪ macvlan
▪ ptp
▪ vlan
Meta: other plugins
▪ bandwidth
▪ firewall
▪ flannel
▪ portmap
▪ sbr
▪ tuning

30. Example Network Integrations

31. Consul Connect Gateways on Nomad
task "gateway" {
driver = "raw_exec"
config {
command = "consul"
args = [
"connect", "envoy", "-mesh-gateway", "-register",
"-address", ":20443", "-wan-address",
"1.2.3.4:20443", "--", "-l", "debug"
]
}
}
gateway.nomad

32. L7 Possibilities in Future Nomad
kind = "service-splitter"
name = "billing-api"
splits = [
{
weight = 10
serviceSubset = "canary"
},
{
weight = 90
serviceSubset = "v1"
},
]
gateway.nomad
kind = "service-resolver"
name = "web"
connect_timeout = "15s"
failover = {
"*" = {
datacenters = ["dc3", "dc4"]
}
}
gateway.nomad

33. All Open Source
nomadproject.io

34. Thank You
hello@hashicorp.com
www.hashicorp.com
34