Resolving Error: 'Unsuitable value: value must be known' while Running a Nomad Job with Local 'File' Option in the Template Block – HashiCorp Help Center

Introduction

Problem

Getting Unsuitable value type; Unsuitable value: value must be known error when trying to modify and/or /stop-run a job when there is the “file” option in job “template” block (like below).

...
  template {
        data        = file("/User1/Desktop/Nomad_Repros/nomad_workload_identity/consul-service-info.tpl")
        destination = "local/consul-info.txt"
      }
...

Cause

With following sample batch job file.

batch job

job "consul-info" {
  type = "batch"
  group "consul-info" {
    task "consul-info" {
      driver = "docker"
      consul {}
      config {
        image   = "busybox:1.36"
        command = "/bin/sh"
        args    = ["-c", "exit 0"]
      }
      template {
        data        = file("/User1/Desktop/Nomad_Repros/nomad_workload_identity/consul-service-info.tpl")
        destination = "local/consul-info.txt"
      }
    }
  }
}

data file content having tpl syntax

Consul Services:
{{- range services}}
  * {{.Name}}{{end}}
Consul KV for "httpd/config":
{{- range ls "httpd/config"}}
  * {{.Key}}: {{.Value}}{{end}}

You might see the following error message while passing local file option in template block.

Could Not Start Job
Failed to parse job: input.hcl:18,24-29: Error in function call; Call to function "file" failed: filesystem function disabled. input.hcl:18,24-29: Unsuitable value type; Unsuitable value: value must be known

Same is the case, even if user tries to re-run the job from CLI with some modified file path in job.

user1@GJ9F6YC4M5 nomad_workload_identity % nomad alloc fs "$(nomad job allocs -t '{{with index . 0}}{{.ID}}{{end}}' 'consul-info')" 'consul-info/local/consul-info.txt'
Unexpected response code: 404 (stat /private/tmp/NomadClient478401246/aa90787d-c06d-f5ac-2715-25bc8f80ffc7/consul-info/local/consul-info.txt: no such file or directory)

Above behavior and error message is expected with the local file option.

Where would the file function get the data from in this case? As there is no access to the local file-system from the web browser and it would be profoundly dangerous to use the server that is parsing the job to attempt to pull data from the local filesystem to populate the template, the file function is disabled in the server-side parse endpoint.

Overview of possible solutions (if applicable)

Solutions:

In order to configure the file option in template block, the user should instead host the file data needed in some place web accessible to the cluster (like s3, local server, etc) and use the artifact stanza instead.

Ref. template Block - Job Specification | Nomad | HashiCorp Developer

The user could also use Nomad variables for cases where he isn't attempting to bring in the template source itself.

Ref. template Block - Job Specification | Nomad | HashiCorp Developer

Any job element must be accessible to the client that will be running it. The file function cheats by inlining the contents as part of converting the jobspec to its JSON representation.

Outcome

With above solutions, the user would be able to pass the file content to the job template block and it should be able to pick the changes on the restart/stop-start while keeping the data/changes intact.

Additional Information

HCL in UI: filesystem function disabled · Issue #19648 · hashicorp/nomad