Expose static_secret_render_interval from consul-template

[the-maldridge]

Proposal

Nomad leverages consul-template, which results in a great ability to pull secrets out of vault. Unfortunately, there are some limitations when doing this with Consul KVv2. To work around a limitation in vault, I'd like to be able to specify the static_secret_render_interval token per template in order to define a maximum level of staleness that I can accept for static secrets. For context, please see hashicorp/vault#6274.

Use-cases

Void Linux stores TLS certificates from LetsEncrypt in vault, and when these certificates are renewed, nomad doesn't re-render the templates to update the keys/certs that nginx has access to.

Attempted Solutions

Asking the vault folks first to see if there's something I can do to work around this. Otherwise I now have google calendar entries to remind me to go restart certain nomad jobs every 2 months.

[shoenig]

Hi @the-maldridge static_secret_render_intervalconfiguration is a part of vault, so we would first need to plumb something similar into consul-template, which is the library Nomad uses for rendering templates. I think hashicorp/consul-template#1646 is kind of asking for the same thing.