Governance for Multiple Teams Sharing a Nomad Cluster

Copyright © 2020 HashiCorp
Governance for
Multiple Teams
Sharing a Nomad
Cluster
Roger Berlind
Technology Specialist
HashiCorp

Brief overview of Nomad
Key Nomad multitenancy features that allow teams to
share clusters
Demo of public, hands-on Instruqt track that you can
run yourself
Information about a hands-on "Introduction to
Nomad" workshop we're delivering on May 20, 2020
Q & A
Agenda

Nomad Overview

Nomad is an easy-to-use and flexible
Workload Orchestrator that enables
organizations to automate the
deployment of containerized and non-
containerized applications in private and
public clouds.
What is Nomad?

A Single Workflow Across Multiple Clouds

Simple Deployment with a Single Binary

Nomad Increases Density and Reduces Costs

▪ Ease of Use
– Easy for Developers to run Apps and Operators to manage
▪ Workload Flexibility
– Supports Docker and Legacy Apps on Linux & Windows
▪ Scalability
– Federation of Clusters Across Multiple Regions and Clouds
▪ Synergy with Other HashiCorp Solutions
– Integration with Vault for Secrets
– Integration with Consul for Service Discovery & Configuration
Why Do Companies Use Nomad?

A Nomad Case Study

Key Nomad
MultiTenancy
Features

• Token-based
authentication
• Capability-based
authorization
• Centrally managed
policies
• Policies and global
tokens are replicated
across clusters
Nomad ACL System
11

▪ Namespaces allow a single multi-region Nomad deployment to
be shared by many teams without conflict.
▪ Jobs in different namespaces can have the same name.
▪ ACL policies restrict which users can run jobs in namespaces.
▪ Namespaces are automatically replicated across federated
clusters.
Nomad Namespaces

▪ Resource Quotas restrict the aggregate resources that each
namespace can use.
▪ They prevent one team or user from adversely impacting other
teams and users.
▪ ACL policies restrict who can change resource quotas.
▪ Resource quotas can be defined for each region or applied
globally.
Nomad Resource Quotas

 Sentinel expresses Policy as Code.
 In Nomad, Sentinel can restrict jobs and the drivers they use.
 Sentinel policies are applied to submitted/updated jobs after
the ACL system determines that a user is allowed to submit them.
 Sentinel policies are automatically replicated across clusters.
Nomad Sentinel Policies
14

Demo

▪ We have 1 Nomad Server with 3 Nomad Clients in GCP.
▪ We have 2 Teams: dev and qa.
– Each team has its own namespace and resource quota.
– Alice is a developer on the dev team with an ACL token.
– Bob is an engineer on the qa team with an ACL token.
– Charlie is an infrastructure manager allowed to override violations
of soft-mandatory Sentinel policies in all namespaces.
▪ We have 3 Sentinel policies that restrict jobs.
▪ We will see what happens when the Alice, Bob, and Charlie try
to run different jobs in different namespaces.
Demo Overview

▪ The demo is implemented in a public Instruqt track:
– https://play.instruqt.com/hashicorp/tracks/nomad-governance
▪ You can run this track yourself to see how Nomad Enterprise
would allow your teams to safely share Nomad clusters.
▪ Full Demo Flow:
1. Configure Nomad namespaces and resource quotas.
2. Create Nomad ACL policies and tokens.
3. Create Sentinel policies.
4. Run Nomad jobs restricted by ACLs and Sentinel policies.
5. Run Nomad jobs restricted by resource quotas.
▪ We'll give a shorter version today, starting at step 4.
Demo Implementation

Some Links and
Q & A

▪ A blog post about the demo that will have the webinar
recording is here:
– Governance for Multiple Teams Sharing a Nomad Cluster
▪ Instruqt track that let's you run this demo yourself:
– https://play.instruqt.com/hashicorp/tracks/nomad-governance
▪ Other Nomad Instruqt Tracks can be found here:
https://play.instruqt.com/hashicorp/topics/nomad-workshops
Some Links

▪ If you would like to learn more about Nomad, please
register for the Nomad Hands-On Workshop that we will be
delivering on May 20, 2020.
▪ Workshop Topics:
– Nomad Concepts and Architecture
– Interacting with Nomad
– Nomad Jobs and Drivers
– Running Nomad Clusters and Jobs
– Monitoring Nomad Jobs
▪ You'll find a registration link here:
– https://events.hashicorp.com/workshops/nomad-may20
Nomad Hands-On Workshop

Governance for Multiple Teams Sharing a Nomad Cluster

More Related Content

What's hot (6)

Similar to Governance for Multiple Teams Sharing a Nomad Cluster (20)

More from Mitchell Pronschinske (20)

Recently uploaded (20)

Governance for Multiple Teams Sharing a Nomad Cluster