Backport of allocrunner: prevent panic on network manager into release/1.4.x

.changelog/12916.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+event_stream: fixed a bug where dynamic port values would fail to serialize in the event stream
+```

.changelog/13845.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+api: Fixed a nil pointer dereference when periodic jobs are missing their periodic spec
+```

.changelog/14002.txt

@@ -0,0 +1,5 @@
+```release-note:improvement
+template: Expose per-template configuration for `error_on_missing_key`. This allows jobspec authors to specify that a
+template should fail if it references a struct or map key that does not exist. The default value is false and should be
+fully backward compatible.
+```

.changelog/14296.txt

@@ -0,0 +1,4 @@
+```release-note:improvement
+cli: Added tls command to enable creating Certificate Authority and Self signed TLS certificates.
+There are two sub commands `tls ca` and `tls cert` that are helpers when creating certificates.
+```

.changelog/14300.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+scheduler: Allow jobs not requiring network resources even when no network is fingerprinted
+```

.changelog/14348.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+drain: Fixed a bug where drains would complete based on the server status and not the client status of an allocation
+```

.changelog/14519.txt

@@ -1,3 +1,3 @@
 ```release-note:bug
-rpc: check for spec changes in all regions when registering multiregion jobs
+rpc (Enterprise): check for spec changes in all regions when registering multiregion jobs
 ```

.changelog/14615.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+client: Fixed a bug where network fingerprinters were not reloaded when the client configuration was reloaded with SIGHUP
+```

.changelog/14621.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+scheduler: when multiple evaluations are pending for the same job, evaluate the latest and cancel the intermediaries on success
+```

.changelog/14631.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+cli: Added `-id-prefix-template` option to `nomad job dispatch`
+```

.changelog/14651.txt

@@ -1,3 +1,3 @@
-```release-note:deprecation
+```release-note:breaking-change
 cli: `eval status -json` no longer supports listing all evals in JSON. Use `eval list -json`.
 ```

.changelog/14659.txt

@@ -1,3 +1,3 @@
 ```release-note:bug
-scheduler: Fixed bug where the scheduler would treat multiregion jobs as paused for job types that don't use deployments
+scheduler (Enterprise): Fixed bug where the scheduler would treat multiregion jobs as paused for job types that don't use deployments
 ```

.changelog/14742.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+client: re-enable nss-based user lookups
+```

.changelog/14747.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: allow users to upload files by click or drag in the web ui
+```

.changelog/14749.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+template: Fixed a bug where the `splay` timeout was not being applied when `change_mode` was set to `script`.
+```

.changelog/14779.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+cli: add nomad fmt to the CLI
+```

.changelog/14798.txt

@@ -0,0 +1,3 @@
+```release-note:bug-fix
+ui:  always show ports on allocations page
+```

.changelog/14814.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fixed line charts to update x-axis (time) where relevant
+```

.changelog/14821.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+keyring: Fixed a panic that can occur during upgrades to 1.4.0 when initializing the keyring
+```

.changelog/14832.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fixes an issue where service tags would bleed past the edge of the screen
+```

.changelog/14833.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Adds a "Pack" tag and logo on the jobs list index when appropriate
+```

.changelog/14851.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+exec: Allow running commands from mounted host volumes
+```

.changelog/14864.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+services: Fixed a regression where check task validation stopped allowing some configurations
+```

.changelog/14868.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+servicedisco: Fixed a bug where job using checks could land on incompatible client
+```

.changelog/14875.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+docker: improve memory usage for docker_logger
+```

.changelog/14901.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+keyring: Fixed a bug where keyring initialization is blocked by un-upgraded federated regions
+```

.changelog/14908.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+acl: Ensure all federated servers meet v.1.4.0 minimum before ACL roles can be written
+```

.changelog/14912.txt

@@ -0,0 +1,9 @@
+```release-note:bug
+variables: Fixed a bug where Nomad version checking was not enforced for writing to variables
+```
+```release-note:bug
+acl: Fixed a bug where Nomad version checking for one-time tokens was enforced across regions
+```
+```release-note:bug
+scheduler: Fixed a bug where version checking for disconnected clients handling was enforced across regions
+```

.changelog/14913.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: adds searching and filtering to the topology page
+```

.changelog/14917.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+consul: Fixed a bug where services continuously re-registered
+```

.changelog/14922.txt

@@ -0,0 +1,7 @@
+```release-note:bug
+client: Resolve ACL roles within client ACL cache
+```
+
+```release-note:bug
+client: Check ACL token expiry when resolving token within ACL cache
+```

.changelog/14923.txt

@@ -0,0 +1,11 @@
+```release-note:bug
+event stream: Resolve ACL roles within ACL tokens
+```
+
+```release-note:bug
+event stream: Check ACL token expiry when resolving tokens
+```
+
+```release-note:improvement
+event stream: Added ACL role topic with create and delete types
+```

.changelog/14924.txt

@@ -0,0 +1,4 @@
+```release-note:bug
+nomad native service discovery: Ensure all local servers meet v.1.3.0 minimum before service registrations can be written
+```
+

.changelog/14944.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+consul: atomically register checks on initial service registration
+```

.changelog/14982.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+acl: Callers should be able to read policies linked via roles to the token used
+```

.changelog/14983.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+deps: update go-memdb for goroutine leak fix
+```

.changelog/14987.txt

@@ -0,0 +1,15 @@
+```release-note:bug
+keyring: Fixed a bug where the root keyring replicator's rate limiting would be skipped if the keyring replication exceeded the burst rate.
+```
+
+```release-note:bug
+keyring: Fixed a bug where root keyring replication could make incorrectly stale queries and exit early if those queries did not return the expected key.
+```
+
+```release-note:bug
+keyring: Fixed a bug where root keyring initialization could occur before the raft FSM on the leader was verified to be up-to-date.
+```
+
+```release-note:bug
+keyring: Fixed a bug where if a key is rotated immediately following a leader election, plans that are in-flight may get signed before the new leader has the key. Allow for a short timeout-and-retry to avoid rejecting plans.
+```

.changelog/14992.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+cli: prevent a panic when the Nomad API returns an error while collecting a debug bundle
+```

.changelog/15009.txt

@@ -0,0 +1,7 @@
+```release-note:bug
+keyring: Fixed a bug where root keyring garbage collection configuration values were not respected.
+```
+
+```release-note:bug
+keyring: Fixed a bug where `nomad system gc` forced a root keyring rotation.
+```

.changelog/15012.txt

@@ -0,0 +1,7 @@
+```release-note:security
+variables: Fixed a bug where non-sensitive variable metadata (paths and raft indexes) was exposed via the template `nomadVarList` function to other jobs in the same namespace.
+```
+
+```release-note:bug
+variables: Fixed a bug where getting empty results from listing variables resulted in a permission denied error.
+```

.changelog/15013.txt

@@ -0,0 +1,3 @@
+```release-note:security
+event stream: Fixed a bug where ACL token expiration was not checked when emitting events
+```

.changelog/15021.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+deps: Update hashicorp/raft to v1.3.11; fixes unstable leadership on server removal
+```

.changelog/15027.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+client: Fixed a bug where Nomad could not detect cores on recent RHEL systems
+```

.changelog/15034.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+keyring: Removed root key garbage collection to avoid orphaned workload identities
+```

.changelog/15045.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+deps: Update hashicorp/consul-template to 90370e07bf621811826b803fb633dadbfb4cf287; fixes template rerendering issues when only user or group set
+```

.changelog/15068.txt

@@ -0,0 +1,7 @@
+```release-note:bug
+scheduler: Fixed a bug that prevented disconnected allocations to be updated after they reconnect.
+```
+
+```release-note:bug
+scheduler: Prevent unnecessary placements when disconnected allocations reconnect.
+```

.changelog/15078.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+deps: Updated github.com/docker/cli from 20.10.18+incompatible to 20.10.21+incompatible
+```

.changelog/15081.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+deps: Updated github.com/aws/aws-sdk-go from 1.44.84 to 1.44.126
+```

.changelog/15092.txt

@@ -0,0 +1,7 @@
+```release-note:bug
+keyring: Fixed a bug where a missing key would prevent any further replication.
+```
+
+```release-note:bug
+keyring: Re-enabled keyring garbage collection after fixing a bug where keys would be garbage collected even if they were used to sign a live allocation's workload identity.
+```

.changelog/15096.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+drivers: pass missing `propagation_mode` configuration for volume mounts to external plugins
+```

.changelog/15097.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+core: Ensure no leakage of evaluations for batch jobs. Prior to this change allocations and evaluations for batch jobs were never garbage collected until the batch job was explicitly stopped. The new `batch_eval_gc_threshold` server configuration controls how often they are collected. The default threshold is `24h`.
+```

.changelog/15101.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+csi: Fixed race condition that can cause a panic when volume is garbage collected
+```

.changelog/15102.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+variables: Fixed a bug where a long-running rekey could hit the nack timeout
+```

.changelog/15117.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+cli: Improved performance of eval delete with large filter sets
+```

.changelog/15121.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+wi: Fixed a bug where clients running pre-1.4.0 allocations would erase the token used to query service registrations after upgrade
+```

.changelog/15125.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+device: Fixed a bug where device plugins would not fingerprint on startup
+```

.changelog/15134.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+cleanup: fixed missing timer.Reset for plan queue stat emitter
+```

.changelog/15140.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+client: prevent allocations from failing on client reconnect by retrying RPC requests when no servers are available yet
+```

.changelog/15146.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fixed a bug where the task log sidebar would close and re-open if the parent job state changed
+```

.changelog/15147.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+api: Added an API for counting evaluations that match a filter
+```

.changelog/15180.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+drivers: Fixed a bug where one goroutine was leaked per task
+```

.changelog/15192.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+template: Fixed a bug where template could cause agent panic on startup
+```

.changelog/15214.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+client: fixed a bug where non-`docker` tasks with network isolation would leak network namespaces and iptables rules if the client was restarted while they were running
+```

.changelog/15215.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+client: Fixed a bug where tasks would restart without waiting for interval
+```

.changelog/15227.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+keyring: Fixed a bug where replication would stop after snapshot restores
+```

.changelog/15252.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+api: Ensure all request body decode errors return a 400 status code
+```

.changelog/15262.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+cli: Added `-wait` flag to `deployment status` for use with `-monitor` mode
+```

.changelog/15290.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+autopilot: Fixed a bug where autopilot would try to fetch raft stats from other regions
+```

.changelog/15309.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+fingerprint: Ensure Nomad can correctly fingerprint Consul gRPC where the Consul agent is running v1.14.0 or greater
+```

.changelog/15324.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: add consul connect service upstream and on-update info to the service sidebar
+```

.changelog/15325.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+scheduler (Enterprise): Fixed a bug that prevented new allocations from multiregion jobs to be placed in situations where other regions are not involved, such as node updates.
+```

.changelog/15337.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+check: Add support for sending custom host header
+```

.changelog/15363.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Made task rows in Allocation tables look more aligned with their parent
+```

.changelog/15372.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+csi: Fixed a bug where volumes in non-default namespaces could not be scheduled for system or sysbatch jobs
+```

.changelog/15382.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+cli: corrected typos in ACL role create/delete CLI commands
+```

.changelog/15402.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+deps: Update google.golang.org/grpc to v1.51.0
+```

.changelog/15407.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+client: detect and cleanup leaked iptables rules
+```

.changelog/15411.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+consul: Fixed a bug where services would continuously re-register when using ipv6
+```

.changelog/15452.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+fingerprint: Detect CNI plugins and set versions as node attributes
+```

.changelog/15454.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fixed a bug where the exec window would not maintain namespace upon refresh
+```

.changelog/15455.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+scheduler: allow using device IDs in `affinity` and `constraint`
+```

.changelog/15458.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: The web UI will now show canary_tags of services anyplace we would normally show tags.
+```

.changelog/15477.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+client: Fixed a bug where allocation cleanup hooks would not run
+```