K.C. Wong

@dadgar: Put it another way, `consul` is not meant to take action on the outcome of these checks, but `nomad` is.

Why do you need to put `node.class` constraints on all your Job/TaskGroup? That means a Job/TaskGroup can only run on "bar" or "foo", never either. Is that your intention?

Or `${node.class} != "bar"`. It sounds like you want something as a config at the Nomad client level, restricting it to only allow tasks with the constraint `${node.class} == "bar"`

I think the topic of certificate rotation is much broader than Raft and orderers. Certificates are used for both TLS communication and MSP identity service. From the brief mention in...