Improve bridge networking story with Connect Native tasks

[shoenig]

Nomad v0.12.0 introduces support for running Connect Native tasks, but basically recommends the use of host networking due to the necessity of the Connect Native Application being able to reach the Consul agent associated with the Nomad Client agent. With no extra configuration, attempting to use bridge networking will result in connectivity errors such as

2020-06-24T21:15:00.879Z [ERROR] connect.watch: Watch errored: service=uuid-api type=connect_leaf error="Get "http://127.0.0.1:8500/v1/agent/connect/ca/leaf/uuid-api": dial tcp 127.0.0.1:8500: connect: connection refused" retry=5s

It is possible to plumb around the network namespace created for bridge networking, for example using Consul's support for creating a Unix socket address listener and Nomad's host volume mounts:

consul agent config

addresses {
  http = "127.0.0.1 unix:///tmp/consul/consul.socket"
}

nomad agent config

client {
  host_volume "consul" {
    path = "/tmp/consul"
    read_only = false
  }
}

nomad job config

group "group" {
  network {
    mode = "bridge"
  }

  volume "consul" {
    type      = "host"
    read_only = false
    source    = "consul"
  }

  task "task" {
    volume_mount {
      volume      = "consul"
      destination = "/consul"
    }

    env {
      CONSUL_HTTP_ADDR = "unix:///consul/consul.socket"
    }
  }
}

However manually volume mounting a unix socket into each task isn't a great user experience. Similar to the way the grpc_sock hook works for the Envoy -> xDS Consul bidirectional unix socket, we could look into establishing a Consul HTTP proxy over unix socket for native tasks managed by the Nomad Client agent.

[github-actions]

I'm going to lock this issue because it has been closed for 120 days ⏳. This helps our maintainers find and focus on the active issues.
If you have found a problem that seems similar to this, please open a new issue and complete the issue template so we can capture all the details necessary to investigate further.