Nomad Integration with Vault

Applications orchestrated by Nomad rarely run without secrets. They connect to databases, call APIs, and read queues, and every one of those connections needs a credential that must never be hardcoded, baked into an image, or shared forever.

In this lab you integrate Nomad with Vault using the current Workload Identity (JWT) flow, then use it to hand a web application short-lived, dynamically generated PostgreSQL credentials that no human ever sees.

You will:

• Verify a 1-server, 2-client Nomad, Consul, and Vault cluster
• Configure Vault's JWT auth method to trust Nomad's JWKS endpoint
• Create a Vault JWT auth role that binds Nomad workload identity claims to a policy
• Enable the Vault integration on the Nomad server with the Workload Identity vault block
• Deploy a PostgreSQL database with a Nomad job
• Configure Vault's database secrets engine to mint dynamic PostgreSQL users
• Deploy a web application whose template stanza pulls dynamic database credentials from Vault

Nomad finds the active Vault server through Consul DNS at active.vault.service.consul, completing the Nomad, Consul, and Vault stack.