Repository: hashicorp/nomad
File: nomad/job_endpoint_hooks.go (Go)

Code before:
		numaTaskGroups.Empty() && bridgeNetworkingTaskGroups.Empty() &&
		transparentProxyTaskGroups.Empty() &&
		taskScheduleTaskGroups.Empty() &&
		len(secretBlocks) == 0 {
		return j, nil, nil
	}

	// Iterate through all the task groups within the job and add any required
	// constraints. When adding new implicit constraints, they should go inside
	// this single loop, with a new constraintMatcher if needed.
	for _, tg := range j.TaskGroups {
		// If the task group utilises Vault, run the mutator.
		vaultTasks := lang.MapKeys(vaultBlocks[tg.Name])
		sort.Strings(vaultTasks)
		for _, vaultTask := range vaultTasks {
			vaultBlock := vaultBlocks[tg.Name][vaultTask]
			mutateConstraint(constraintMatcherLeft, tg, vaultConstraintFn(vaultBlock))
		}

		secretTasks := lang.MapKeys(secretBlocks[tg.Name])
		for _, secretTask := range secretTasks {
			secretBlock := secretBlocks[tg.Name][secretTask]
			for _, secret := range secretBlock {
				mutateConstraint(constraintMatcherLeft, tg, secretsConstraintFn(secret))
			}
		}

		// If the task group utilizes NUMA resources, run the mutator.
		if numaTaskGroups.Contains(tg.Name) {
			mutateConstraint(constraintMatcherFull, tg, numaVersionConstraint)
			mutateConstraint(constraintMatcherFull, tg, numaKernelConstraint)
		}

		// Check whether the task group is using signals. In the case that it
		// is, we flatten the signals and build a constraint, then run the
		// mutator.
		if tgSignals, ok := signals[tg.Name]; ok {
			required := helper.UniqueMapSliceValues(tgSignals)
			sigConstraint := getSignalConstraint(required)
			mutateConstraint(constraintMatcherFull, tg, sigConstraint)
		}

		// If the task group utilises Nomad service discovery, run the mutator.
		if nativeServiceDisco.Basic.Contains(tg.Name) {
			mutateConstraint(constraintMatcherFull, tg, nativeServiceDiscoveryConstraint)
		}

		// If the task group utilizes NSD checks, run the mutator.
		if nativeServiceDisco.Checks.Contains(tg.Name) {
			mutateConstraint(constraintMatcherFull, tg, nativeServiceDiscoveryChecksConstraint)
		}

Review comment (security):
The `j.Secrets()` method produces a map of job -> group -> task, so if we have multiple tasks with the same secret provider (or even multiple secrets within the same task), don't we end up with multiple identical constraint blocks defined in a task group?

For purposes of the constraint, I think we can flatten that whole map down to a `map[string][]string` (a map of group names to the list of providers). That's not what's being done for `j.Vault()`, but I think that method is as complicated as it is because it's used elsewhere too.

Code after:
		numaTaskGroups.Empty() && bridgeNetworkingTaskGroups.Empty() &&
		transparentProxyTaskGroups.Empty() &&
		taskScheduleTaskGroups.Empty() &&
		len(secretBlocks) == 0 {
		return j, nil, nil
	}

	// Iterate through all the task groups within the job and add any required
	// constraints. When adding new implicit constraints, they should go inside
	// this single loop, with a new constraintMatcher if needed.
	for _, tg := range j.TaskGroups {
		// If the task group utilises Vault, run the mutator.
		vaultTasks := lang.MapKeys(vaultBlocks[tg.Name])
		sort.Strings(vaultTasks)
		for _, vaultTask := range vaultTasks {
			vaultBlock := vaultBlocks[tg.Name][vaultTask]
			mutateConstraint(constraintMatcherLeft, tg, vaultConstraintFn(vaultBlock))
		}

		for _, secretProviders := range secretBlocks {
			for _, provider := range secretProviders {
				mutateConstraint(constraintMatcherLeft, tg, secretsConstraintFn(provider))
			}
		}

		// If the task group utilizes NUMA resources, run the mutator.
		if numaTaskGroups.Contains(tg.Name) {
			mutateConstraint(constraintMatcherFull, tg, numaVersionConstraint)
			mutateConstraint(constraintMatcherFull, tg, numaKernelConstraint)
		}

		// Check whether the task group is using signals. In the case that it
		// is, we flatten the signals and build a constraint, then run the
		// mutator.
		if tgSignals, ok := signals[tg.Name]; ok {
			required := helper.UniqueMapSliceValues(tgSignals)
			sigConstraint := getSignalConstraint(required)
			mutateConstraint(constraintMatcherFull, tg, sigConstraint)
		}

		// If the task group utilises Nomad service discovery, run the mutator.
		if nativeServiceDisco.Basic.Contains(tg.Name) {
			mutateConstraint(constraintMatcherFull, tg, nativeServiceDiscoveryConstraint)
		}

		// If the task group utilizes NSD checks, run the mutator.
		if nativeServiceDisco.Checks.Contains(tg.Name) {
			mutateConstraint(constraintMatcherFull, tg, nativeServiceDiscoveryChecksConstraint)
		}

		// If the task group utilises Consul service discovery, run the mutator.