Merge branch 'hashicorp:main' into ui-logs-disabled-message

.changelog/11572.txt

@@ -1,5 +1,5 @@
 ```release-note:breaking-change
-raft: The default raft protocol version is now 3 so you must follow the [Upgrading to Raft Protocol 3](https://www.nomadproject.io/docs/upgrade#upgrading-to-raft-protocol-3) guide when upgrading an existing cluster to Nomad 1.3.0. Downgrading the raft protocol version is not supported.
+raft: The default raft protocol version is now 3 so you must follow the [Upgrading to Raft Protocol 3](https://developer.hashicorp.com/nomad/docs/upgrade#upgrading-to-raft-protocol-3) guide when upgrading an existing cluster to Nomad 1.3.0. Downgrading the raft protocol version is not supported.
 ```
 
 ```release-note:improvement

.changelog/15617.txt

@@ -0,0 +1,3 @@
+```release-note:feature
+**Workload Identity for Vault:** Jobs can now use workload identity to authenticate to Vault.
+```

.changelog/15618.txt

@@ -0,0 +1,3 @@
+```release-note:feature
+**Workload Identity for Consul:** Jobs can now use workload identity to authenticate to Consul.
+```

.changelog/16638.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+client: remove incomplete allocation entries from client state database during client restarts
+```

.changelog/16867.txt

@@ -0,0 +1,3 @@
+```release-note:feature
+**Reschedule on Lost**: Adds the ability to prevent tasks on down nodes from being rescheduled
+```

.changelog/18035.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+api: Add JWKS HTTP API endpoint
+```

.changelog/18123.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+identity: Add support for multiple workload identities
+```

.changelog/18262.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+identity: Support jwt expiration and rotation
+```

.changelog/18371.txt

@@ -0,0 +1,7 @@
+```release-note:breaking-change
+client: the `unique.cgroup.mountpoint` node attribute has been removed
+```
+
+```release-note:breaking-change
+client: the `unique.cgroup.version` node attribute has been renamed to `os.cgroups.version`
+```

.changelog/18463.txt

@@ -1,3 +1,3 @@
-```release-note:feature
+```release-note:improvement
 cli: Add `-prune` flag to `nomad operator force-leave` command
 ```

.changelog/18516.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+consul: uses token namespace to fetch policies for verification
+```

.changelog/18562.txt

@@ -0,0 +1,7 @@
+```release-note:improvement
+deps: bumped `shirou/gopsutil` to v3.23.9
+```
+
+```release-note:improvement
+client: add support for NetBSD clients
+```

.changelog/18681.txt

@@ -0,0 +1,3 @@
+```release-note:feature
+**NUMA aware scheduling**: Nomad Enterprise now supports optimized scheduling on NUMA hardware
+```

.changelog/18691.txt

@@ -0,0 +1,3 @@
+```release-note:feature
+**Workload Identity IDP:** Nomad's workload identities may now be used with third parties that support JWT or OIDC IDPs such as the AWS IAM OIDC Provider.
+```

.changelog/18745.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+config: Add `go-netaddrs` support to `server_join.retry_join`
+```

.changelog/18754.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+variables: Fixed a bug where poststop tasks were not allowed access to Variables
+```

.changelog/18794.txt

@@ -1,3 +1,3 @@
-```release-note:improvement
-actions: introduces the action concept to jobspecs, the web UI, CLI and API
+```release-note:feature
+**Job Actions**: Introduces the action concept to jobspecs, the web UI, CLI and API. Operators can now define actions that Nomad users can execute against running allocations.
 ```

.changelog/18832.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+cli: ensure HCL env vars are added to the job submission object in the `job run` command
+```

.changelog/18835.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+metrics: Fixed a bug where CPU counters could report errors for negative values
+```

.changelog/18836.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+cli: Added support for prefix ID matching and wildcard namespaces to `service info` command
+```

.changelog/18838.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+scheduler (Enterprise): auto-unblock evals with associated quotas when node resources are freed up
+```

.changelog/18843.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+client/fingerprint: The `cpu.numcores.power` node attribute has been renamed to `cpu.numcores.performance` on Apple Silicon nodes
+```

.changelog/18873.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+scheduler: Ensure duplicate allocation indexes are tracked and fixed when performing job updates
+```

.changelog/18882.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+identity: default to RS256 for new workload ids
+```

.changelog/18901.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+cli: Add file prediction for operator raft/snapshot commands
+```

.changelog/18943.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+identity: Implement `change_mode` and `change_signal` for workload identities
+```

.changelog/18961.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+cli: Added help text to `acl bootstrap` about reading the initial token from a file
+```

.changelog/18967.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+core: Fix incorrect submit time for stopped jobs
+```

.changelog/18972.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+client: Fixed a bug where client API calls would fail incorrectly with permission denied errors when using ACL tokens with dangling policies
+```

.changelog/18985.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+vault: Fixed an issue that could cause Nomad to attempt to renew a Vault token that is already expired
+```

.changelog/18996.txt

@@ -0,0 +1,7 @@
+```release-note:improvement
+cli: Added identities, networks, and volumes to the output of the `operator client-state` command
+```
+
+```release-note:bug
+cli: Fixed a bug where the `operator client-state` command would crash if it reads an allocation without a task state
+```

.changelog/19004.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+core: Honor job's namespace when checking `distinct_hosts` feasibility
+```

.changelog/19013.txt

@@ -0,0 +1,3 @@
+```release-note:security
+build: Update to go1.21.4 to resolve Windows path validation CVE in Go
+```

.changelog/19037.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: nicer comment styles in UI example jobs
+```

.changelog/19051.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: for system and sysbatch jobs, now show client name on hover in job panel
+```

.changelog/19101.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+scheduler: Added a new configuration to avoid rescheduling allocations if a nodes misses one or more heartbits
+```

.changelog/19104.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+consul: constraint for minimum version of Consul increased to 1.8.0
+```

.changelog/19115.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+api: Fix panic in `Allocation.Stub` method when `Job` is unset
+```

.changelog/19135.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+sso: Allow adding a token name format to auth methods which can be used to generate token names when signing in via SSO
+```

.changelog/19139.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fixed an issue where purging a job with a namespace did not process correctly
+```

.changelog/19147.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+cli: Fixed the `nomad job restart` command to create replacements for batch and system jobs and to prevent sysbatch jobs from being rescheduled since they never create replacements
+```

.changelog/19153.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Added a new example template with Task Actions
+```

.changelog/19154.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+cli: Fixed a panic when the `nomad job restart` command received an interrupt signal while waiting for an answer
+```

.changelog/19155.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+cli: Fixed a bug that caused the `nomad job restart` command to miscount the allocations to restart
+```

.changelog/19172.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+agent: Correct websocket status code handling
+```

.changelog/19176.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+cgroupslib: Consider CGroups OFF when essential controllers are missing
+```

.changelog/19189.txt

@@ -0,0 +1,3 @@
+```release-note:deprecation
+config: Loading plugins from `plugin_dir` without a `plugin` configuration block is deprecated
+```

.changelog/19220.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: fix an issue where starting a stopped job with default-less variables would not retain those variables when done via the job page start button in the web ui
+```

.changelog/19225.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: show plan output warnings alongside placement failures and dry-run info when running a job through the web ui
+```

.changelog/19268.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+vault: Fixed a bug where poststop tasks would not get a Vault token
+```

.changelog/19320.txt

@@ -0,0 +1,3 @@
+```release-note:security
+build: Update to go1.21.5 to resolve Windows path validation CVE in Go
+```

.changelog/19332.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: make the exec window look nicer on mobile screens
+```

.changelog/19334.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+connect: Fixed a bug where deployments would not wait for Connect sidecar task health checks to pass
+```

.changelog/19336.txt

@@ -0,0 +1,7 @@
+```release-note:improvement
+consul: Added support for failures_before_warning and failures_before_critical in Nomad agent services
+```
+
+```release-note:improvement
+consul: Added support for failures_before_warning in Consul service checks
+```

.changelog/19349.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+cli: Fixed a bug that caused the `nomad agent` command to ignore the `VAULT_TOKEN` and `VAULT_NAMESPACE` environment variables
+```

.changelog/19350.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+keyring: Fixed a bug where RSA keys were not replicated to followers
+```

.changelog/19374.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+metrics: Revert upgrade of `go-metrics` to fix an issue where metrics from dependencies, such as raft, were no longer emitted
+```

.changelog/19377.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: dont allow new jobspec download until template is populated, and remove group count from jobs index
+```

.changelog/19383.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+client: Fix a panic in building CPU topology when inaccurate CPU data is provided
+```

.changelog/19415.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+audit (Enterprise): Added ACL token role links to audit log auth objects
+```

.changelog/19423.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+cli: Fix a bug in the `var put` command which prevented combining items as CLI arguments and other parameters as flags
+```

.changelog/19425.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+auth: Fixed a bug where `tls.verify_server_hostname=false` was not respected, leading to authentication failures between Nomad agents
+```

.changelog/19432.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fixed an issue where Accessor ID was masked by default when editing a token
+```

.changelog/19439.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+vault: Fixed a bug that caused `template` blocks to ignore Nomad configuration for Vault and use the default address of `https://127.0.0.1:8200` when the job does not have a `vault` block defined
+```

.changelog/19441.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+csi: Added validation to `csi_plugin` blocks to prevent `stage_publish_base_dir` from being a subdirectory of `mount_dir`
+```

.changelog/19449.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+consul (Enterprise): Fixed a bug where implicit Consul constraints were not specific to non-default Consul clusters
+```

.changelog/19452.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: when an Action has long output, anchor to the latest messages
+```

.changelog/19457.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+client: Fixed a bug where clients are unable to detect CPU topology in certain conditions
+```

.changelog/19458.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+core: Fixed a bug where linux nodes with no reservable cores would panic the scheduler
+```

.changelog/19483.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+namespaces: Failed delete calls no longer return success codes
+```

.changelog/19485.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+consul: Add fingerprint for Consul Enterprise admin partitions
+```

.changelog/19490.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+client: Fixed a bug where where the environment variable / file for the Consul token weren't written.
+```

.changelog/19496.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Added a copy button on Action output
+```

.changelog/5311.txt

@@ -0,0 +1,3 @@
+```release-note:feature
+**Multiple Vault and Consul Clusters:** Nomad Enterprise can now use multiple Vault or Consul clusters. Each task or service can be registered with a different Consul cluster and each task can obtain secrets from a different Vault cluster.
+```

.github/ISSUE_TEMPLATE/bug_report.md

@@ -9,7 +9,7 @@ Hi there,
 
 Thank you for opening an issue. Please note that we try to keep the Nomad issue
 tracker reserved for bug reports and feature requests. For general usage
-questions, please see: https://www.nomadproject.io/community
+questions, please see: https://developer.hashicorp.com/nomad/community
 
 -->
 

.github/ISSUE_TEMPLATE/feature_request.md

@@ -9,7 +9,7 @@ Hi there,
 
 Thank you for opening an issue. Please note that we try to keep the Nomad issue
 tracker reserved for bug reports and feature requests. For general usage
-questions, please see: https://www.nomadproject.io/community
+questions, please see: https://developer.hashicorp.com/nomad/community
 
 -->
 

.github/workflows/test-e2e.yml

@@ -35,7 +35,7 @@ on:
       - 'website/**'
 
 jobs:
-  test-e2e:
+  test-e2e-vault:
     runs-on: ${{ endsWith(github.repository, '-enterprise') && fromJSON('["self-hosted", "ondemand", "linux"]') || 'ubuntu-latest' }}
     steps:
       - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
@@ -51,6 +51,22 @@ jobs:
       - name: Vault Compatability
         run: make integration-test
       - run: make e2e-test
+
+  test-e2e-consul:
+    runs-on: 'ubuntu-22.04' # this job requires sudo, so not currently suitable for self-hosted runners
+    steps:
+      - uses: actions/checkout@c85c95e3d7251135ab7dc9ce3241c5835cc595a9 # v3.5.3
+      - name: Git config token
+        if: endsWith(github.repository, '-enterprise')
+        run: git config --global url.'https://${{ secrets.ELEVATED_GITHUB_TOKEN }}@github.com'.insteadOf 'https://github.com'
+      - uses: hashicorp/setup-golang@v1
+      - name: Consul Compatability
+        run: |
+          make deps
+          sudo make cni
+          sudo sed -i 's!Defaults!#Defaults!g' /etc/sudoers
+          sudo -E env "PATH=$PATH" make integration-test-consul
+
 permissions:
   contents: read
   id-token: write