Merge branch 'main' into deps/switch_to_hashicorp_cli

.changelog/11810.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+client: expose network namespace bridge/cni configuration values as task env vars
+```

.changelog/12319.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+scheduler: Fixed a bug where rescheduled allocations that could not be placed would later ignore their reschedule policy limits
+```

.changelog/15473.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+networking: Inject constraints on CNI plugins when using bridge networking
+```

.changelog/16437.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+cli: `acl token create` will now emit a warning if the token has a policy that does not yet exist
+```

.changelog/16753.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+consul/connect: Added support for TLS configuration, headers configuration, and request limit configuration to ingress service block
+```

.changelog/18292.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Added a new UI block to job spec in order to provide description and links in the Web UI
+```

.changelog/18372.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+cli: `operator snapshot inspect` now includes details of data in snapshot
+```

.changelog/18532.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+cli: Added support for updating the roles for an ACL token
+```

.changelog/18876.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+quota (Enterprise): Fixed a bug where a task's resource core count was not translated to CPU MHz and checked against its quota when performing a job plan
+```

.changelog/18925.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+cli: Added -json option on job status command
+```

.changelog/19560.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+server: Fix server not waiting for workers to submit nacks for dequeued evaluations before shutting down
+```

.changelog/19566.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+auth: Added new optional OIDCDisableUserInfo setting for OIDC auth provider
+```

.changelog/19605.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+core: Ensure job HCL submission data is persisted and restored during the FSM snapshot process
+```

.changelog/19609.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+state: Fixed a bug where purged jobs would not get new deployments
+```

.changelog/19652.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+server: Fix panic when validating non-service reschedule block
+```

.changelog/19665.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+consul: Added support for Consul Enterprise admin partitions
+```

.changelog/19670.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+drivers: Enable configuring a raw_exec task to not have an upper memory limit
+```

.changelog/19677.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+acl: Fixed auth method hashing which meant changing some fields would be silently ignored
+```

.changelog/19689.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+vault: Fixed a bug that could cause errors during leadership transition when migrating to the new JWT and workload identity authentication workflow
+```

.changelog/19691.txt

@@ -0,0 +1,7 @@
+```release-note:improvement
+vault: Add `allow_token_expiration` field to allow Vault tokens to expire without renewal for short-lived tasks
+```
+
+```release-note:improvement
+vault: Nomad clients will no longer attempt to renew Vault tokens that cannot be renewed
+```

.changelog/19709.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+build: update to go 1.21.6
+```

.changelog/19720.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+cli: Add new option `nomad setup vault -check` to help cluster operators migrate to workload identities for Vault
+```

.changelog/19787.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+connect: Fixed envoy sidecars being unable to restart after node reboots
+```

.changelog/19818.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+driver/java: Ensure the OOM killed response is populated when the task exits
+```

.changelog/19829.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+driver/rawexec: Ensure the OOM killed response is populated when the task exits
+```

.changelog/19830.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+driver/qemu: Ensure the OOM killed response is populated when the task exits
+```

.changelog/19839.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+client/volumes: Add a mount volume level option for selinux tags on volumes
+```

.changelog/19851.txt

@@ -0,0 +1,3 @@
+```release-note:security
+deps: Updated runc to 1.1.12 to address CVE-2024-21626
+```

.changelog/19876.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+cli: Fix return code when `nomad job run` succeeds after a blocked eval
+```

.changelog/19878.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fix an issue where a same-named task from a different group could be selected when the user clicks Exec from a task group page where multiple allocations would be valid
+```

.changelog/19887.txt

@@ -0,0 +1,3 @@
+```release-note:security
+migration: Fixed a bug where archives used for migration were not checked for symlinks that escaped the allocation directory
+```

.changelog/19888.txt

@@ -0,0 +1,3 @@
+```release-note:security
+template: Fixed a bug where symlinks could force templates to read and write to arbitrary locations (CVE-2024-1329)
+```

.changelog/19892.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+cli: Fixed a bug where the `nomad tls ca create` command failed when the `-domain` was used without other values
+```

.changelog/19903.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+api: emit `JobDeregistered` event when job is deregistered with `purge`
+```

.changelog/19915.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+client: Prevent client from starting if cgroup initialization fails
+```

.changelog/19925.txt

@@ -0,0 +1,3 @@
+```release-note:security
+windows: Remove `LazyDLL` calls for system modules to harden Nomad against attacks from the host
+```

.changelog/19932.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+exec: Fixed a bug in `alloc exec` where closing websocket streams could cause a panic
+```

.changelog/19933.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+scheduler: Fixed a bug that caused blocked evaluations due to port conflict to not have a reason explaining why the evaluation was blocked
+```

.changelog/19935.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+client: Ensure the value for CPU shares are within the allowed range
+```

.changelog/19969.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+fingerprint: Added a fingerprint for Consul DNS address and port
+```

.changelog/19972.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+client: Fixed a bug where corrupt client state could panic the client
+```

.changelog/19985.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Prompt a user before they close an exec window to prevent accidental close-browser-tab shortcuts that overlap with terminal ones
+```

.changelog/19986.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+server: Prevent NPE when service lacks identity
+```

.changelog/19989.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Improve error and warning messages for invalid variable and job template paths/names
+```

.changelog/19990.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+connect: Fixed a bug where `expose` blocks would not appear in `job plan` diff output
+```

.changelog/20007.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+cni: Fixed a bug where DNS set by CNI plugins was not provided to task drivers
+```

.changelog/20029.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+server: Add new options for reconcilation in case of disconnected nodes
+```

.changelog/20047.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fixed an issue where keynav would not trigger evaluation sidebar expand
+```

.changelog/20049.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+cli: Fixed a bug where the `nomad job restart` command could crash if the job type was not present in a response from the server
+```

.changelog/20066.txt

@@ -0,0 +1,3 @@
+```release-note:security
+build: Update to go1.22 to address Go standard library vulnerabilities CVE-2024-24783, CVE-2023-45290, and CVE-2024-24785.
+```

.changelog/20073.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+drivers: add posibility to restrict user and group for exec and rawexec
+```

.changelog/20100.txt

@@ -0,0 +1,3 @@
+```release-note:security
+deps: Upgrade protobuf library to 1.33.0 to avoid scan alerts for CVE-2024-24786, which Nomad is not vulnerable to
+```

.changelog/20126.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+artifact: Added support for downloading artifacts without validating the TLS certificate
+```

.changelog/20130.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+api: new /v1/jobs/statuses endpoint collates details about jobs' allocs and latest deployment, intended for use in the updated UI jobs index page
+```

.changelog/20153.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+autopilot: add Enterprise health information to autopilot API
+```

.changelog/20156.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+autopilot: Added `operator autopilot health` command to review Autopilot health data
+```

.changelog/20165.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+template: Fixed a bug where a partial `client.template` block would cause defaults for unspecified fields to be ignored
+```

.changelog/20166.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+agent: allow configuration of in-memory telemetry sink
+```

.changelog/20167.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+consul/connect: Added support for destination partition in `upstream` block
+```

.changelog/20173.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+deps: Update msgpack to v2
+```

.changelog/20189.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+cni: Fixed a regression where default DNS set by `dockerd` or other task drivers was not respected
+```

.changelog/20206.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+cli: Fixed a bug where `operator debug` did not respect the `-pprof-interval` flag and would take only one profile
+```

.changelog/20218.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Show the namespace in the web UI exec command hint
+```

.changelog/20219.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+cli: Collect only one heap profile per `operator debug` interval
+```

.changelog/20220.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+namespace/node pool: Fixed a bug where the `-region` flag would not be respected for namespace and node pool updates if ACLs were disabled
+```

.changelog/20234.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+deps: Updated consul-template dependency to 0.37.4 to fix a resource leak
+```

.changelog/20235.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: When you re-bind keyboard shortcuts they now correctly show up in shift-held hints
+```

.changelog/20261.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+api: Fixed a bug where `AllocDirStats` field was missing from Read Stats client API
+```

.changelog/20276.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+docker: Fixed a bug where cpuset would not be updated on cgroup v2 systems using cgroupfs
+```

.changelog/20294.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+docker: Fixed a bug where cpuset cgroup would not be updated on cgroup v1 systems
+```

.changelog/20315.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+func: Allow custom paths to be added the the getter landlock
+```

.changelog/20317.txt

@@ -0,0 +1,7 @@
+```release-note:bug
+drain: Fixed a bug where Workload Identity tokens could not be used to drain a node
+```
+
+```release-note:bug
+state: Fixed a bug where restarting a server could fail if the Raft logs include a drain update that used a now-expired token
+```

.changelog/20324.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+config: Fixed a bug where IPv6 addresses were not accepted without ports for `client.servers` blocks
+```

.changelog/20329.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+metrics: Added tracking of enqueue and dequeue times of evaluations to the broker
+```

.changelog/20344.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+consul: Fixed a bug where services with interpolation would not get correctly signed Workload Identities
+```

.changelog/20346.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+scheduler: Record exhausted node metrics for devices when preemption fails to find an allocation to evict
+```

.changelog/20348.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+deployments: Fixed a goroutine leak when jobs are purged
+```

.changelog/20383.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fix an issue where the job status box would error if an allocation had no task events
+```

.changelog/20389.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+deps: Updated `docker` dependency to 26.0.1
+```

.changelog/20391.txt

@@ -0,0 +1,3 @@
+```release-note:security
+artifact: Updated `go-getter` dependency to v1.7.4 to address CVE-2024-3817
+```

.changelog/20408.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fix a bug where the UI would prompt a user to promote a deployment with unplaced canaries
+```

.changelog/20452.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Overhaul of the Jobs Index list page, with live updates, more informative statuses, filter expressions, and pagination
+```

.changelog/20479.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+cli: Fix handling of scaling jobs which don't generate evals
+```

.changelog/20481.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+driver/rawexec: Allow specifying custom cgroups
+```

.changelog/20483.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Added a UI for creating, editing and deleting Sentinel Policies
+```

.changelog/20500.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+client: terminate old exec task processes before starting new ones, to avoid accidentally leaving running processes in case of an error
+```

.changelog/20510.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+core: Do not create evaluations within batch deregister endpoint during job garbage collection
+```

.changelog/20518.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+cli: Add `-jwks-ca-file` argument to `setup consul/vault` commands
+```

.changelog/20519.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+consul: provide tasks that have Consul tokens the CONSUL_HTTP_TOKEN environment variable
+```

.changelog/20522.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+structs: Fix job canonicalization for array type fields
+```

.changelog/20528.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+agent: Added support for systemd readiness notifications
+```

.changelog/20532.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+csi: Fixed a bug where volumes in different namespaces but the same ID would fail to stage on the same client
+```

.changelog/20539.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Added token.name information to the top nav for ease of operator debugging
+```

.changelog/20543.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+client: Fix unallocated CPU metric calculation when client reserved CPU is set
+```

.changelog/20550.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+csi: Fixed a bug where concurrent mount and unmount operations could unstage volumes needed by another allocation
+```

.changelog/20551.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+csi: Added support for wildcard namespace to `plugin status` command
+```

.changelog/20553.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+core: Fix multiple incorrect type conversion for potential overflows
+```