Nomad VS Rundeck

20k+ nodes and 200k+ allocs. To be fair, Kubernetes cannot support this large of a cluster.

Most of my issues with it aren't related to the scale though. I wasn't involved in the operations of the cluster, I was just a user of Nomad trying to run a few thousand stateful allocs. Without custom resources and custom controllers, managing stateful services was a pain in the ass. Critical bugs would also often take years to get fixed. I had lots of fun getting paged in the middle of the night because 2 allocs would suddenly decide they now have the same index (https://github.com/hashicorp/nomad/issues/10727)

https://github.com/hashicorp/nomad/blob/v1.6.0/website/conte... seems to have existed since before the license rug-pull. However I'm open to there being some miscommunication because https://developer.hashicorp.com/nomad/docs/glossary doesn't mention the word "control" and the word "host" could mean any number of things in this context

Nomad: The Oasis in Our Infrastructure Desert

> I should have just used on-disk mode from the start, but only now know better.

Yeah, I saw the recent post about reducing rqlite disk space usage. Using the on-disk sqlite as both the FSM and the Raft snapshot makes a lot of sense here. I'm curious whether you've had concerns about write amplification though? Because we have only the periodic Raft snapshots and the FSM is in-memory, during high write volumes we're only really hammering disk with the Raft logs.

> Do you find it in the field much with Nomad? I've managed to introduce new Raft Entry types very infrequently during rqlite's 10-years of development, only once did someone hit it in the field with rqlite.

My understanding is that rqlite Raft entries are mostly SQL statements (is that right?). Where Nomad is somewhat different (and probably closer to the OP) is that the Raft entries are application-level entries. For entries that are commands like "stop this job"[0] upgrades are simple.

The tricky entries are where the entry is "upsert this large deeply-nested object that I've serialized", like the Job or Node (where the workloads run). The typical bug here is you've added a field way down in the guts of one of these objects that's a pointer to a new struct. When old versions deserialize the message they ignore the new field and that's easy to reason about. But if the leader is still on an old version and the new code deserializes the old object, you need to make sure you're not missing any nil pointer checks. Without sum types enforced at compile time (i.e. Option/Maybe), we have to catch all these via code review and a lot of tedious upgrade testing.

> it requires discipline on the part of the end-users too.

Oh for sure. Nomad runs into some commercial realities here around how much discipline we can demand from end-users. =)

[0] https://github.com/hashicorp/nomad/blob/v1.8.2/nomad/fsm.go#...

However, Mesos has a steeper learning curve compared to Kubernetes and may require more expertise to manage effectively. For those seeking a simpler but less feature-rich alternative, HashiCorp's Nomad is worth considering.

Just wanting to understand the definition of Open Source you are using here, considering that you can see and download the source here:

https://github.com/hashicorp/nomad

Are you maybe referring to their Enterprise offering?

Even though this article will be focused on Kubernetes I want to mention that there are multiple container orchestration platforms such as Mesos, Docker Swarm, OpenShift, Rancher, Hashicorp Nomad, etc.

I don't use it myself, but I think rundeck might be what you're looking for

Have a look at rundeck.org

Not possible at this moment, please suggest that here.

Hi, that's an odd issue (never happened on my env, but reported here), you can try this or this.

If you want a web panel, I believe you could achieve that with Rundeck.

I found this info here and here.

Changing default SCM SSH authentication to SSHJ: The SCM integration now uses SSHJ for SSH authentication by default (previously JSCH). GitHub has tightened up their SSH key requirements and now requires SSH-RSA 2 keys. The new default for ssh-keygen via OpenSSH is not supported by JSCH.

Firstly, I tried Rundeck and Apache Airflow. They are complete overkill for what I want to do. Then I found Cronicle which is light enough, besides it can pull double duty as a general purpose scheduler.

Yesterday we posted a Security Advisory to Github for a critical vulnerability in Rundeck Community and Rundeck Enterprise Docker images, versions 4.0 and earlier. Those Docker images contained a pre-generated SSH key pair in the default file path. If that key was used to configure SSH access to hosts, they would allow access to anyone with the exposed private key.