Refactor Nomad Cluster Setup

[Ranjandas]

This is a combination of multiple PRs (#23, #24, #25)

In addition to the PRs, here are two additional changes:

• Install CNI Plugins to support connect-enabled jobs
• Update the Nomad User ACL policy to have alloc-exec permission.

---

23

The Ubuntu Xenial image is not available anymore officially from Canonical on AWS (except the Pro versions).

The following changes were introduced as part of the AMI change:

• Switch to the latest LTS release (22.04/jammy)
• Switch to using the ip command instead of ifconfig (deprecated)

• Introduced a system-resolved drop-in for Consul DNS access and stopped Consul from listening on port 53. This is because systemd-resolved already binds to port 53, and Consul won't start.

  The drop-in configuration also listens on the Docker bridge IP so that Nomad tasks can resolve Consul DNS names by overriding DNS by pointing to the Docker bridge IP

• Explicitly added the universe repository without which jq and redis-tools installation were failing

In addition, packer {} block was added so that packer init installs the required plugins for the build to work.

Fixes the following issues:

• https://github.com/hashicorp/learn-nomad-cluster-setup/issues/20
• https://github.com/hashicorp/learn-nomad-cluster-setup/issues/15
• https://github.com/hashicorp/learn-nomad-cluster-setup/issues/13

---

24

Update the anonymous token policy so that the Consul DNS resolution works out of the box.

---

25

• Updated Nomad, Consul, Vault and Consul-Template versions to their latest
• Switched from binary installation to native Linux packages (Apt)
• Removed systemd unit files for those that already have it as part of the package
• Added zone_pattern for retry_join for faster discovery in GCP

[EugenKon]

Great job, man! Can you review submit-job capability? It looks like there should be write policy to be ably to submit, but I am not familiar with Nomad's ACL. Related: https://github.com/hashicorp/learn-nomad-cluster-setup/issues/28

[david-yu]

@tunzor Could you take over the PR from here and help get this PR merged? Thank you!

[tunzor]

@Ranjandas I figured out a way around updating the anonymous policy by adding the agent token to the Consul client configuration but couldn't add the suggestions to this PR so I opened another one that includes your other changes.

Can you double check PR #29 and make sure it's complete? I've tested it and DNS lookups work as they should but feel free to test it out if you like.

[tunzor]

Closing this PR as the changes have been merged as part of #29, thank you very much for your contributions!