Project: Nomad (Orchestration & Management / Scheduling & Orchestration)
File: CHANGELOG.md

IMPROVEMENTS: agent: Added support for systemd readiness notifications ] api: new /v1/jobs/statuses endpoint collates details about jobs' allocs and latest deployment, intended for use in the updated UI jobs index page ] artifact: Added support for downloading artifacts without validating the TLS certificate ] autopilot: Added `operator autopilot health` command to review Autopilot health data ] cli: Add `-jwks-ca-file` argument to `setup consul/vault` commands ] client/volumes: Add a mount volume level option for selinux tags on volumes ] consul: provide tasks that have Consul tokens the CONSULHTTPTOKEN environment variable ] core: Do not create evaluations within batch deregister endpoint during job garbage collection ] deps: Update msgpack to v2 ] deps: Updated `docker` dependency to 26.0.1 ] func: Allow custom paths to be added the the getter landlock ] metrics: Added tracking of enqueue and dequeue times of evaluations to the broker ] networking: Inject constraints on CNI plugins when using bridge networking ] scheduler: Added a new configuration to avoid rescheduling allocations if a nodes misses one or more heartbits ] server: Add new options for reconcilation in case of disconnected nodes ] ui: Added a copy button on Action output ] ui: Improve error and warning messages for invalid variable and job template paths/names ] ui: Overhaul of the Jobs Index list page, with live updates, more informative statuses, filter expressions, and pagination ] ui: Prompt a user before they close an exec window to prevent accidental close-browser-tab shortcuts that overlap with terminal ones ] ui: Replaced single-line variable value fields with multi-line textarea blocks ] ui: Updated the style of components in the Variables web ui ] ui: change the State filter on clients page to split out eligibility and drain status ] BUG FIXES: cli: Fix handling of scaling jobs which don't generate evals ] quota (Enterprise): Fixed a bug where quota usage would not be freed if a job was purged ui: Fix a bug where the UI would prompt a user to promote a deployment with unplaced canaries ] ui: Fixed an issue where keynav would not trigger evaluation sidebar expand ] ui: Show the namespace in the web UI exec command hint ] SECURITY: artifact: Updated `go-getter` dependency to v1.7.4 to address CVE-2024-3817 ] IMPROVEMENTS: autopilot: add Enterprise health information to autopilot API ] cli: Collect only one heap profile per `operator debug` interval ] consul/connect: Added support for TLS configuration, headers configuration, and request limit configuration to ingress service block ] consul/connect: Added support for destination partition in `upstream` block ] scheduler: Record exhausted node metrics for devices when preemption fails to find an allocation to evict ] ui: When you re-bind keyboard shortcuts they now correctly show up in shift-held hints ] BUG FIXES: agent: allow configuration of in-memory telemetry sink ] api: Fixed a bug where `AllocDirStats` field was missing from Read Stats client API ] cli: Fixed a bug where `operator debug` did not respect the `-pprof-interval` flag and would take only one profile ] cni: Fixed a regression where default DNS set by `dockerd` or other task drivers was not respected ] config: Fixed a bug where IPv6 addresses were not accepted without ports for `client.servers` blocks ] consul: Fixed a bug where services with interpolation would not get correctly signed Workload Identities ] deployments: Fixed a goroutine leak when jobs are purged ] deps: Updated consul-template dependency to

to fix a resource leak ] docker: Fixed a bug where cpuset cgroup would not be updated on cgroup v1 systems ] docker: Fixed a bug where cpuset would not be updated on cgroup v2 systems using cgroupfs ] drain: Fixed a bug where Workload Identity tokens could not be used to drain a node ] namespace/node pool: Fixed a bug where the `-region` flag would not be respected for namespace and node pool updates if ACLs were disabled ] state: Fixed a bug where restarting a server could fail if the Raft logs include a drain update that used a now-expired token ] template: Fixed a bug where a partial `client.template` block would cause defaults for unspecified fields to be ignored ] ui: Fix an issue where the job status box would error if an allocation had no task events ] SECURITY: build: Update to go1.22 to address Go standard library vulnerabilities CVE-2024-24783, CVE-2023-45290, and CVE-2024-24785. ] deps: Upgrade protobuf library to 1.33.0 to avoid scan alerts for CVE-2024-24786, which Nomad is not vulnerable to ] IMPROVEMENTS: cli: Added -json option on job status command ] fingerprint: Added a fingerprint for Consul DNS address and port ] BUG FIXES: cli: Fixed a bug where the `nomad job restart` command could crash if the job type was not present in a response from the server ] client: Fixed a bug where corrupt client state could panic the client ] cni: Fixed a bug where DNS set by CNI plugins was not provided to task drivers ] connect: Fixed a bug where `expose` blocks would not appear in `job plan` diff output ] server: Prevent NPE when service lacks identity ] SECURITY: windows: Remove `LazyDLL` calls for system modules to harden Nomad against attacks from the host ] IMPROVEMENTS: api: emit `JobDeregistered` event when job is deregistered with `purge` ] BUG FIXES: cli: Fix return code when `nomad job run` succeeds after a blocked eval ] cli: Fixed a bug where the `nomad tls ca create` command failed when the `-domain` was used without other values ] client: Ensure the value for CPU shares are within the allowed range ] client: Prevent client from starting if cgroup initialization fails ] connect: Fixed envoy sidecars being unable to restart after node reboots ] driver/java: Ensure the OOM killed response is populated when the task exits ] driver/qemu: Ensure the OOM killed response is populated when the task exits ] driver/rawexec: Ensure the OOM killed response is populated when the task exits ] exec: Fixed a bug in `alloc exec` where closing websocket streams could cause a panic ] scheduler: Fixed a bug that caused blocked evaluations due to port conflict to not have a reason explaining why the evaluation was blocked ] ui: Fix an issue where a same-named task from a different group could be selected when the user clicks Exec from a task group page where multiple allocations would be valid ] SECURITY: deps: Updated runc to 1.1.12 to address CVE-2024-21626 ] migration: Fixed a bug where archives used for migration were not checked for symlinks that escaped the allocation directory ] template: Fixed a bug where symlinks could force templates to read and write to arbitrary locations (CVE-2024-1329) ] IMPROVEMENTS: build: update to go

] cgroupslib: Consider CGroups OFF when essential controllers are missing ] cli: Add new option `nomad setup vault -check` to help cluster operators migrate to workload identities for Vault ] consul: Add fingerprint for Consul Enterprise admin partitions ] consul: Added support for Consul Enterprise admin partitions ] consul: Added support for failuresbeforewarning and failuresbeforecritical in Nomad agent services ] consul: Added support for failuresbeforewarning in Consul service checks ] drivers/exec: Added support for OOM detection in exec driver ] drivers: Enable configuring a raw_exec task to not have an upper memory limit ] identity: Added vault_role to JWT workload identity claims if specified in jobspec ] ui: Added group name to allocation tooltips on job status panel ] ui: Adds a warning message to pages in the Web UI when logs are disabled ] ui: Hide token secret upon successful login ] ui: when an Action has long output, anchor to the latest messages ] vault: Add `allowtokenexpiration` field to allow Vault tokens to expire without renewal for short-lived tasks ] vault: Nomad clients will no longer attempt to renew Vault tokens that cannot be renewed ] BUG FIXES: acl: Fixed a bug where 1.5 and 1.6 clients could not access Nomad Variables and Services via templates ] acl: Fixed auth method hashing which meant changing some fields would be silently ignored ] auth: Added new optional OIDCDisableUserInfo setting for OIDC auth provider ] client: Fixed a bug where where the environment variable / file for the Consul token weren't written. ] consul (Enterprise): Fixed a bug where the group/task Consul cluster was assigned "default" when unset instead of the namespace-governed value core: Ensure job HCL submission data is persisted and restored during the FSM snapshot process ] namespaces: Failed delete calls no longer return success codes ] rawexec: Fixed a bug where oomscoreadj would be inherited from Nomad client ] server: Fix panic when validating non-service reschedule block ] server: Fix server not waiting for workers to submit nacks for dequeued evaluations before shutting down ] state: Fixed a bug where purged jobs would not get new deployments ] ui: Fix rendering of allocations table for jobs that don't have actions ] vault: Fixed a bug that could cause errors during leadership transition when migrating to the new JWT and workload identity authentication workflow ] vault: Fixed a bug where `allowunauthenticated` was enforced when a `defaultidentity` was set ] FEATURES: Reschedule on Lost*: Adds the ability to prevent tasks on down nodes from being rescheduled ] IMPROVEMENTS: audit (Enterprise): Added ACL token role links to audit log auth objects ] ui: Added a new example template with Task Actions ] ui: dont allow new jobspec download until template is populated, and remove group count from jobs index ] ui: make the exec window look nicer on mobile screens ] BUG FIXES: auth: Fixed a bug where `tls.verifyserverhostname=false` was not respected, leading to authentication failures between Nomad agents ] cli: Fix a bug in the `var put` command which prevented combining items as CLI arguments and other parameters as flags ] client: Fix a panic in building CPU topology when inaccurate CPU data is provided ] client: Fixed a bug where clients are unable to detect CPU topology in certain conditions ] consul (Enterprise): Fixed a bug where implicit Consul constraints were not specific to non-default Consul clusters ] consul: uses token namespace to fetch policies for verification ] core: Fixed a bug where linux nodes with no reservable cores would panic the scheduler ] csi: Added validation to `csiplugin` blocks to prevent `stagepublishbasedir` from being a subdirectory of `mount_dir` ] metrics: Revert upgrade of `go-metrics` to fix an issue where metrics from dependencies, such as raft, were no longer emitted ] ui: Fixed an issue where Accessor ID was masked by default when editing a token ] vault: Fixed a bug that caused `template` blocks to ignore Nomad configuration for Vault and use the default address of

when the job does not have a `vault` block defined ] BUG FIXES: cli: Fixed a bug that caused the `nomad agent` command to ignore the `VAULTTOKEN` and `VAULTNAMESPACE` environment variables ] client: remove incomplete allocation entries from client state database during client restarts ] connect: Fixed a bug where deployments would not wait for Connect sidecar task health checks to pass ] keyring: Fixed a bug where RSA keys were not replicated to followers ] FEATURES: Job Actions*: Introduces the action concept to jobspecs, the web UI, CLI and API. Operators can now define actions that Nomad users can execute against running allocations. ] Multiple Vault and Consul Clusters:* Nomad Enterprise can now use multiple Vault or Consul clusters. Each task or service can be registered with a different Consul cluster and each task can obtain secrets from a different Vault cluster. ] NUMA aware scheduling*: Nomad Enterprise now supports optimized scheduling on NUMA hardware ] Workload Identity IDP:* Nomad's workload identities may now be used with third parties that support JWT or OIDC IDPs such as the AWS IAM OIDC Provider. ] Workload Identity for Consul:* Jobs can now use workload identity to authenticate to Consul. ] Workload Identity for Vault:* Jobs can now use workload identity to authenticate to Vault. ] BREAKING CHANGES: client/fingerprint: The `cpu.numcores.power` node attribute has been renamed to `cpu.numcores.performance` on Apple Silicon nodes ] client: the `unique.cgroup.mountpoint` node attribute has been removed ] client: the `unique.cgroup.version` node attribute has been renamed to `os.cgroups.version` ] core: Honor job's namespace when checking `distinct_hosts` feasibility ] SECURITY: build: Update to go1.21.4 to resolve Windows path validation CVE in Go ] build: Update to go1.21.5 to resolve Windows path validation CVE in Go ] IMPROVEMENTS: api: Add JWKS HTTP API endpoint ] api: Added support for Unix domain sockets ] build (Enterprise): Support building s390x binaries. ] cli: Add file prediction for operator raft/snapshot commands ] cli: Added help text to `acl bootstrap` about reading the initial token from a file ] cli: Added identities, networks, and volumes to the output of the `operator client-state` command ] cli: Added support for prefix ID matching and wildcard namespaces to `service info` command ] client: add support for NetBSD clients ] client: enable detection of numa topology ] config: Add `go-netaddrs` support to `serverjoin.retryjoin` ] consul: constraint for minimum version of Consul increased to 1.8.0 ] deps: bumped `shirou/gopsutil` to v3.23.9 ] fingerprint: clients now backoff after successfully fingerprinting Consul ] identity: Add support for multiple workload identities ] identity: Implement `changemode` and `changesignal` for workload identities ] identity: Support jwt expiration and rotation ] identity: default to RS256 for new workload ids ] sentinel (Enterprise): Add existing job information to Sentinel when available. ] server: Added transfer-leadership API and CLI ] sso: Allow adding a token name format to auth methods which can be used to generate token names when signing in via SSO ] ui: color-code node and server status cells ] ui: for system and sysbatch jobs, now show client name on hover in job panel ] ui: nicer comment styles in UI example jobs ] ui: show plan output warnings alongside placement failures and dry-run info when running a job through the web ui ] ui: simplify presentation of task event times (10m2.230948s bceomes 10m2s etc.) ] vars: Added a locking feature for Nomad Variables ] DEPRECATIONS: config: Loading plugins from `plugin_dir` without a `plugin` configuration block is deprecated ] BUG FIXES: agent: Correct websocket status code handling ] api: Fix panic in

method when `Job` is unset ] cli: Fixed a bug that caused the `nomad job restart` command to miscount the allocations to restart ] cli: Fixed a bug where the `operator client-state` command would crash if it reads an allocation without a task state ] cli: Fixed a panic when the `nomad job restart` command received an interrupt signal while waiting for an answer ] cli: Fixed the `nomad job restart` command to create replacements for batch and system jobs and to prevent sysbatch jobs from being rescheduled since they never create replacements ] client: Fixed a bug where client API calls would fail incorrectly with permission denied errors when using ACL tokens with dangling policies ] core: Fix incorrect submit time for stopped jobs ] ui: Fixed an issue where purging a job with a namespace did not process correctly ] ui: fix an issue where starting a stopped job with default-less variables would not retain those variables when done via the job page start button in the web ui ] ui: fix the job auto-linked variable path name when user lacks variable write permissions ] variables: Fixed a bug where poststop tasks were not allowed access to Variables ] vault: Fixed a bug where poststop tasks would not get a Vault token ] vault: Fixed an issue that could cause Nomad to attempt to renew a Vault token that is already expired ] SECURITY: artifact: Updated go-getter dependency to v1.7.4 to address CVE-2024-3817 [GH-20391] BUG FIXES: api: Fixed a bug where AllocDirStats field was missing from Read Stats client API [GH-20261] cli: Fixed a bug where operator debug did not respect the -pprof-interval flag and would take only one profile [GH-20206] cni: Fixed a regression where default DNS set by dockerd or other task drivers was not respected [GH-20189] config: Fixed a bug where IPv6 addresses were not accepted without ports for client.servers blocks [GH-20324] deployments: Fixed a goroutine leak when jobs are purged [GH-20348] deps: Updated consul-template dependency to 0.37.4 to fix a resource leak [GH-20234] drain: Fixed a bug where Workload Identity tokens could not be used to drain a node [GH-20317] namespace/node pool: Fixed a bug where the -region flag would not be respected for namespace and node pool updates if ACLs were disabled [GH-20220] state: Fixed a bug where restarting a server could fail if the Raft logs include a drain update that used a now-expired token [GH-20317] template: Fixed a bug where a partial client.template block would cause defaults for unspecified fields to be ignored [GH-20165] ui: Fix an issue where the job status box would error if an allocation had no task events [GH-20383] SECURITY: build: Update to go1.22 to address Go standard library vulnerabilities CVE-2024-24783, CVE-2023-45290, and CVE-2024-24785. ] deps: Upgrade protobuf library to

to avoid scan alerts for CVE-2024-24786, which Nomad is not vulnerable to ] BUG FIXES: cli: Fixed a bug where the `nomad job restart` command could crash if the job type was not present in a response from the server ] client: Fixed a bug where corrupt client state could panic the client ] cni: Fixed a bug where DNS set by CNI plugins was not provided to task drivers ] connect: Fixed a bug where `expose` blocks would not appear in `job plan` diff output ] SECURITY: windows: Remove `LazyDLL` calls for system modules to harden Nomad against attacks from the host ] BUG FIXES: cli: Fix return code when `nomad job run` succeeds after a blocked eval ] cli: Fixed a bug where the `nomad tls ca create` command failed when the `-domain` was used without other values ] connect: Fixed envoy sidecars being unable to restart after node reboots ] exec: Fixed a bug in `alloc exec` where closing websocket streams could cause a panic ] scheduler: Fixed a bug that caused blocked evaluations due to port conflict to not have a reason explaining why the evaluation was blocked ] ui: Fix an issue where a same-named task from a different group could be selected when the user clicks Exec from a task group page where multiple allocations would be valid ] SECURITY: deps: Updated runc to 1.1.12 to address CVE-2024-21626 ] migration: Fixed a bug where archives used for migration were not checked for symlinks that escaped the allocation directory ] template: Fixed a bug where symlinks could force templates to read and write to arbitrary locations (CVE-2024-1329) ] IMPROVEMENTS: build: update to go 1.21.6 ] BUG FIXES: acl: Fixed auth method hashing which meant changing some fields would be silently ignored ] auth: Added new optional OIDCDisableUserInfo setting for OIDC auth provider ] core: Ensure job HCL submission data is persisted and restored during the FSM snapshot process ] namespaces: Failed delete calls no longer return success codes ] server: Fix server not waiting for workers to submit nacks for dequeued evaluations before shutting down ] state: Fixed a bug where purged jobs would not get new deployments ] BUG FIXES: cli: Fix a bug in the `var put` command which prevented combining items as CLI arguments and other parameters as flags ] client: remove incomplete allocation entries from client state database during client restarts ] connect: Fixed a bug where deployments would not wait for Connect sidecar task health checks to pass ] consul: uses token namespace to fetch policies for verification ] csi: Added validation to `csiplugin` blocks to prevent `stagepublishbasedir` from being a subdirectory of `mount_dir` ] metrics: Revert upgrade of `go-metrics` to fix an issue where metrics from dependencies, such as raft, were no longer emitted ] BREAKING CHANGES: core: Honor job's namespace when checking `distinct_hosts` feasibility ] SECURITY: build: Update to go1.21.4 to resolve Windows path validation CVE in Go ] build: Update to go1.21.5 to resolve Windows path validation CVE in Go ] IMPROVEMENTS: cli: Add file prediction for operator raft/snapshot commands ] ui: color-code node and server status cells ] ui: show plan output warnings alongside placement failures and dry-run info when running a job through the web ui ] BUG FIXES: agent: Correct websocket status code handling ] api: Fix panic in

method when `Job` is unset ] cli: Fixed a bug that caused the `nomad job restart` command to miscount the allocations to restart ] cli: Fixed a panic when the `nomad job restart` command received an interrupt signal while waiting for an answer ] cli: Fixed the `nomad job restart` command to create replacements for batch and system jobs and to prevent sysbatch jobs from being rescheduled since they never create replacements ] client: Fixed a bug where client API calls would fail incorrectly with permission denied errors when using ACL tokens with dangling policies ] core: Fix incorrect submit time for stopped jobs ] ui: Fixed an issue where purging a job with a namespace did not process correctly ] ui: fix an issue where starting a stopped job with default-less variables would not retain those variables when done via the job page start button in the web ui ] ui: fix the job auto-linked variable path name when user lacks variable write permissions ] variables: Fixed a bug where poststop tasks were not allowed access to Variables ] vault: Fixed a bug where poststop tasks would not get a Vault token ] vault: Fixed an issue that could cause Nomad to attempt to renew a Vault token that is already expired ] SECURITY: build: Update to Go 1.21.3 ] IMPROVEMENTS: agent: Added config option to enable file and line log detail ] api: Added support for the `logincludelocation` query parameter within the `/v1/agent/monitor` HTTP endpoint ] cli: Add `-prune` flag to `nomad operator force-leave` command ] cli: Added `log-include-location` flag to the `monitor` command ] cli: Added `log-include-location` flag to the `operator debug` command ] csi: add ability to expand the size of volumes for plugins that support it ] template: reduce memory usage associated with communicating with the Nomad API ] ui: observe a token's roles' rules in the UI and add an interface for managing tokens, roles, and policies ] BUG FIXES: build: Add `timetzdata` Go build tag on Windows binaries to embed time zone data so periodic jobs are able to specify a time zone value on Windows environments ] cli: Fixed an unexpected behavior of the `nomad acl token update` command that could cause a management token to be downgraded to client on update ] cli: Use same offset when following single or multiple alloc logs ] cli: ensure HCL env vars are added to the job submission object in the `job run` command ] client: ensure null dynamic node metadata values are removed from memory ] client: prevent tasks from starting without the prestart hooks running ] metrics: Fixed a bug where CPU counters could report errors for negative values ] scaling: Unblock blocking queries to /v1/job/{job-id}/scale if the job goes away ] scheduler (Enterprise): auto-unblock evals with associated quotas when node resources are freed up ] scheduler: Ensure duplicate allocation indexes are tracked and fixed when performing job updates ] server: Fixed a bug where Raft server configuration parameters were not correctly merged ] services: use interpolated address when performing nomad service health checks ] ui: using start/stop from the job page in the UI will no longer fail when the job lacks HCL submission data ] IMPROVEMENTS: build: Update to Go 1.21.0 ] cli: support wildcard namespaces in alloc subcommands when the `-job` flag is used ] config: Added an option to configure how many historic versions of jobs are retained in the state store ] consul/connect: Added support for `DestinationPeer`, `DestinationType`, `LocalBindSocketPath`, and `LocalBindSocketMode` in upstream block ] jobspec: Add 'crons' field for multiple `cron` expressions ] jobspec: Add new parameter `render_templates` for `restart` block to allow explicit re-render of templates on task

The default value is `false` and is fully backward compatible ] jobspec: add `node_pool` as a valid field ] raft: remove use of deprecated Leader func ] status: go-getter failure reason now shown in `alloc status` ] ui: Added configurable content security policy header ] ui: adds a new Variables page to all job pages ] ui: adds keyboard commands for pagination on lists using ] ui: sort variable key/values alphabetically by key when editing ] ui: trim variable path names before saving ] BUG FIXES: acl: Fixed a bug where ACL tokens linked to ACL roles containing duplicate policies would cause erronous permission denined responses ] cli: Add missing help message for the `-consul-namespace` flag in the `nomad job run` command ] cli: Fix panic in `alloc logs` command when receiving empty stdout or stderr log frames ] cli: Fixed a bug that prevented CSI volumes in namespaces other than `default` from being displayed in the `nomad node status -verbose` output ] cli: Snapshot name is required in `volume snapshot create` command ] client: Fixed a bug where the state of poststop tasks could be corrupted by client gc ] client: Ignore stale server updates to prevent GCing allocations that should be running ] client: return 404 instead of 500 when trying to access logs and files from allocations that have been garbage collected ] core: Fixed a bug where exponential backoff could result in excessive CPU usage ] csi: fixed a bug that could case a panic when deleting volumes ] fingerprint: fix 'default' alias not being added to interface specified by network_interface ] jobspec: Add diff for Task Group scaling block ] migration: Fixed a bug where previous alloc logs were destroyed when migrating ephemeral_disk on the same client ] scheduler: Fixed a bug where device IDs were not correctly filtered in constraints ] services: Add validation message when `tlsskipverify` is set to `true` on a Nomad service ] ui: maintain HCL2 jobspec when using Start Job in the web ui ] ui: search results are no longer overridden by sorting preferences on the jobs index page ] IMPROVEMENTS: cli: Display volume namespace on `nomad volume status` and `nomad node status` output ] cpustats: Use config "cputotalcompute" (if set) for all CPU statistics ] metrics: Add `allocs.memory.maxallocated` to report the value of tasks' `memorymax` resource value ] ui: added a button to copy variable path to clipboard ] ui: adds a keyboard shortcut for Create Variable ] ui: if a job is remotely purged while you're actively on it, it will let you know and re-route you to the index page ] ui: indicate that nomad/jobs as a variable path is auto-accessible by all nomad jobs ] BUG FIXES: core: Fixed a bug where namespaces were not canonicalized on snapshot restore, resulting in potential nil access panic ] csi: Fixed a bug in sending concurrent requests to CSI controller plugins by serializing them per plugin ] csi: Fixed a bug where CSI controller requests could be sent to unhealthy plugins ] csi: Fixed a bug where CSI controller requests could not be sent to controllers on nodes ineligible for scheduling ] services: Fixed a bug that prevented passing query parameters in Nomad native service discovery HTTP health check paths ] ui: Fixed a bug that could cause an error when accessing a region running versions of Nomad prior to 1.6.0 ] ui: Fixed a bug that prevented nodes from being filtered by the "Ineligible" and "Draining" state filters ] ui: Fixed error handling for cross-region requests when the receiving region does not implement the endpoint being requested ] FEATURES: Node Pools*: Allow cluster operators to partition Nomad clients and control which jobs are allowed to run in each pool. ] BREAKING CHANGES: acl: Job evaluate endpoint now requires `submit-job` instead of `read-job` capability ] SECURITY: acl: Fixed a bug where a namespace ACL policy without label was applied to an unexpected namespace. ] search: Fixed a bug where ACL did not filter plugin and variable names in search

] sentinel (Enterprise): Fixed a bug where ACL tokens could be exfiltrated via Sentinel logs ] IMPROVEMENTS: agent: Display server node ID in agent configuration at startup ] api: enable support for storing original job source ] api: return a structured error for unexpected responses ] build: Publish official Docker images with the Nomad CLI ] checks: Added support for Consul check field tlsservername ] cli: Add `-quiet` flag to `nomad var init` command ] cli: Add check for missing host volume `path` in `nomad config validate` command ] cli: Add leader status to output of `nomad server members -json` ] cli: Add the ability to customize the details of the CA when running `nomad tls ca create` ] cli: Sort output by Node name of the command `nomad operator raft list-peers` ] cli: `job plan` help text for running the plan now includes the `-namespace` flag ] client: check kernel module in `/sys/module` to help with WSL2 bridge networking ] client: de-duplicate allocation client status updates and prevent allocation client status updates from being sent until clients have first synchronized with the server ] client: prioritize allocation updates to reduce Raft and RPC load ] cni: Ensure to setup CNI addresses in deterministic order ] connect: Auto detect when to use podman for connect sidecar proxies ] connect: do not restrict automatic envoy versioning to docker driver ] connect: use full docker.io prefixed name for envoy image references ] deploymentwatcher: Allow deployments to fail early when running out of reschedule attempts ] deps: Updated Vault SDK to 0.9.0 ] deps: Updated consul-template to v0.31.0 ] deps: update docker to 23.0.3 ] deps: update github.com/hashicorp/raft from 1.3.11 to 1.5.0 ] deps: update go.etcd.io/bbolt from 1.3.6 to 1.3.7 ] docker: Add `group_add` configuration ] docker: Added option for labeling container with parent job ID of periodic/dispatch jobs ] drivers: Add `DisableLogCollection` to task driver capabilities interface ] metrics: add "totaltickscount" counter for allocs/host CPU usage ] runtime: Added 'os.build' attribute to node fingerprint on windows os ] ui: Added a new Job Status Panel that helps show allocation status throughout a deployment and in steady state ] ui: Adds a Download as .nomad.hcl button to jobspec editing in the UI ] ui: Job status and deployment redesign ] ui: Restyles "toast" notifications in the web UI with the Helios Design System ] ui: add tooltips to the node and datacenter labels in the Topology page ] ui: adds a toggle and localStorage property to Word Wrap logs and job definitions ] ui: adds keyboard nav for switching between regions by pressing "r 1", "r 2", etc. ] ui: affix page header to the top of the browser window to handle browser extension push-down gracefully ] ui: change token input type from text to password ] ui: remove namespace, type, and priority columns from child job table ] vault: Add new configuration `disable_file` to prevent access to the Vault token by tasks that use `image` filesystem isolation ] DEPRECATIONS: envoy: remove support for envoy fallback image ] BUG FIXES: api: Fixed a bug that caused a panic when calling the `Jobs().Plan()` function with a job missing an ID ] api: add missing constant for unknown allocation status ] api: add missing field NetworkStatus for Allocation ] cgroups: Fixed a bug removing all DevicesSets when alloc is created/removed ] cli: Fix a panic in the `nomad job restart` command when monitoring replacement allocations ] cli: Output error messages during deployment monitoring ] client: Fixed a bug where Nomad incorrectly wrote to memory swappiness cgroup on old kernels ] client: Fixed a bug where agent would panic during drain incurred by shutdown ] client: fixed a bug that prevented Nomad from fingerprinting Consul 1.13.8 correctly ] consul: Fixed a bug where Nomad would repeatedly try to revoke successfully revoked SI tokens ] core: Fix panic around client deregistration and pending heartbeats ] core: fixed a bug that caused job validation to fail when a task with `killtimeout` was placed inside a group with

set to 0 ] csi: Fixed a bug where CSI volumes would fail to restore during client restarts ] docker: Fixed a bug where network pause container would not be removed after node restart ] drivers/docker: Fixed a bug where long-running docker operations would incorrectly timeout ] identity: Fixed a bug where workload identities for periodic and dispatch jobs would not have access to their parent job's ACL policy ] replication: Fix a potential panic when a non-authoritative region is upgraded and a server with the new version becomes the leader. ] scheduler: Fixed a panic when a node has only one configured dynamic port ] tls: Fixed a bug where the `nomad tls cert` command did not create certificates with the correct SANs for them to work with non default domain and region names. ] ui: dont show a service as healthy when its parent allocation stops running ] ui: fix a mirage-only issue where our mock token logs repeated unnecessarily ] ui: fixed a handful of UX-related bugs during variable editing ] ui: fixes an issue where the allocations table on child (periodic, parameterized) job pages wouldn't update when accessed via their parent ] ui: preserve newlines when displaying shown variables in non-json mode ] SECURITY: artifact: Updated go-getter dependency to v1.7.4 to address CVE-2024-3817 [GH-20391] BUG FIXES: api: Fixed a bug where AllocDirStats field was missing from Read Stats client API [GH-20261] cli: Fixed a bug where operator debug did not respect the -pprof-interval flag and would take only one profile [GH-20206] cni: Fixed a regression where default DNS set by dockerd or other task drivers was not respected [GH-20189] config: Fixed a bug where IPv6 addresses were not accepted without ports for client.servers blocks [GH-20324] deployments: Fixed a goroutine leak when jobs are purged [GH-20348] deps: Updated consul-template dependency to 0.37.4 to fix a resource leak [GH-20234] drain: Fixed a bug where Workload Identity tokens could not be used to drain a node [GH-20317] state: Fixed a bug where restarting a server could fail if the Raft logs include a drain update that used a now-expired token [GH-20317] template: Fixed a bug where a partial client.template block would cause defaults for unspecified fields to be ignored [GH-20165] SECURITY: build: Update to go1.22 to address Go standard library vulnerabilities CVE-2024-24783, CVE-2023-45290, and CVE-2024-24785. ] deps: Upgrade protobuf library to 1.33.0 to avoid scan alerts for CVE-2024-24786, which Nomad is not vulnerable to ] BUG FIXES: cli: Fixed a bug where the `nomad job restart` command could crash if the job type was not present in a response from the server ] client: Fixed a bug where corrupt client state could panic the client ] cni: Fixed a bug where DNS set by CNI plugins was not provided to task drivers ] connect: Fixed a bug where `expose` blocks would not appear in `job plan` diff output ] SECURITY: windows: Remove `LazyDLL` calls for system modules to harden Nomad against attacks from the host ] BUG FIXES: cli: Fix return code when `nomad job run` succeeds after a blocked eval ] connect: Fixed envoy sidecars being unable to restart after node reboots ] exec: Fixed a bug in `alloc exec` where closing websocket streams could cause a panic ] scheduler: Fixed a bug that caused blocked evaluations due to port conflict to not have a reason explaining why the evaluation was blocked ] ui: Fix an issue where a same-named task from a different group could be selected when the user clicks Exec from a task group page where multiple allocations would be valid ] SECURITY: deps: Updated runc to 1.1.12 to address CVE-2024-21626 ] migration: Fixed a bug where archives used for migration were not checked for symlinks that escaped the allocation directory ] template: Fixed a bug where symlinks could force templates to read and write to arbitrary locations (CVE-2024-1329) ] IMPROVEMENTS: build: update to go

] BUG FIXES: acl: Fixed auth method hashing which meant changing some fields would be silently ignored ] auth: Added new optional OIDCDisableUserInfo setting for OIDC auth provider ] namespaces: Failed delete calls no longer return success codes ] server: Fix server not waiting for workers to submit nacks for dequeued evaluations before shutting down ] state: Fixed a bug where purged jobs would not get new deployments ] BUG FIXES: cli: Fix a bug in the `var put` command which prevented combining items as CLI arguments and other parameters as flags ] client: remove incomplete allocation entries from client state database during client restarts ] connect: Fixed a bug where deployments would not wait for Connect sidecar task health checks to pass ] consul: uses token namespace to fetch policies for verification ] csi: Added validation to `csiplugin` blocks to prevent `stagepublishbasedir` from being a subdirectory of `mount_dir` ] metrics: Revert upgrade of `go-metrics` to fix an issue where metrics from dependencies, such as raft, were no longer emitted ] BREAKING CHANGES: core: Honor job's namespace when checking `distinct_hosts` feasibility ] SECURITY: build: Update to go1.21.5 to resolve Windows path validation CVE in Go ] BUG FIXES: agent: Correct websocket status code handling ] api: Fix panic in `Allocation.Stub` method when `Job` is unset ] cli: Fixed a panic when the `nomad job restart` command received an interrupt signal while waiting for an answer ] cli: Fixed the `nomad job restart` command to create replacements for batch and system jobs and to prevent sysbatch jobs from being rescheduled since they never create replacements ] client: Fixed a bug where client API calls would fail incorrectly with permission denied errors when using ACL tokens with dangling policies ] core: Fix incorrect submit time for stopped jobs ] ui: Fixed an issue where purging a job with a namespace did not process correctly ] variables: Fixed a bug where poststop tasks were not allowed access to Variables ] vault: Fixed a bug where poststop tasks would not get a Vault token ] vault: Fixed an issue that could cause Nomad to attempt to renew a Vault token that is already expired ] SECURITY: build: Update to Go 1.21.3 ] BUG FIXES: build: Add `timetzdata` Go build tag on Windows binaries to embed time zone data so periodic jobs are able to specify a time zone value on Windows environments ] cli: Fixed an unexpected behavior of the `nomad acl token update` command that could cause a management token to be downgraded to client on update ] client: ensure null dynamic node metadata values are removed from memory ] client: prevent tasks from starting without the prestart hooks running ] csi: check controller plugin health early during volume register/create ] metrics: Fixed a bug where CPU counters could report errors for negative values ] scaling: Unblock blocking queries to /v1/job/{job-id}/scale if the job goes away ] scheduler (Enterprise): auto-unblock evals with associated quotas when node resources are freed up ] scheduler: Ensure duplicate allocation indexes are tracked and fixed when performing job updates ] services: use interpolated address when performing nomad service health checks ] IMPROVEMENTS: build: Update to Go

] raft: remove use of deprecated Leader func ] BUG FIXES: acl: Fixed a bug where ACL tokens linked to ACL roles containing duplicate policies would cause erronous permission denined responses ] cli: Add missing help message for the `-consul-namespace` flag in the `nomad job run` command ] cli: Fix panic in `alloc logs` command when receiving empty stdout or stderr log frames ] cli: Fixed a bug that prevented CSI volumes in namespaces other than `default` from being displayed in the `nomad node status -verbose` output ] cli: Snapshot name is required in `volume snapshot create` command ] client: Fixed a bug where the state of poststop tasks could be corrupted by client gc ] client: Ignore stale server updates to prevent GCing allocations that should be running ] client: return 404 instead of 500 when trying to access logs and files from allocations that have been garbage collected ] core: Fixed a bug where exponential backoff could result in excessive CPU usage ] csi: fixed a bug that could case a panic when deleting volumes ] fingerprint: fix 'default' alias not being added to interface specified by network_interface ] jobspec: Add diff for Task Group scaling block ] migration: Fixed a bug where previous alloc logs were destroyed when migrating ephemeral_disk on the same client ] scheduler: Fixed a bug where device IDs were not correctly filtered in constraints ] services: Add validation message when `tlsskipverify` is set to `true` on a Nomad service ] IMPROVEMENTS: cpustats: Use config "cputotalcompute" (if set) for all CPU statistics ] BUG FIXES: csi: Fixed a bug in sending concurrent requests to CSI controller plugins by serializing them per plugin ] csi: Fixed a bug where CSI controller requests could be sent to unhealthy plugins ] csi: Fixed a bug where CSI controller requests could not be sent to controllers on nodes ineligible for scheduling ] services: Fixed a bug that prevented passing query parameters in Nomad native service discovery HTTP health check paths ] ui: Fixed a bug that prevented nodes from being filtered by the "Ineligible" and "Draining" state filters ] ui: Fixed error handling for cross-region requests when the receiving region does not implement the endpoint being requested ] SECURITY: acl: Fixed a bug where a namespace ACL policy without label was applied to an unexpected namespace. ] search: Fixed a bug where ACL did not filter plugin and variable names in search endpoint. ] sentinel (Enterprise): Fixed a bug where ACL tokens could be exfiltrated via Sentinel logs ] IMPROVEMENTS: cli: Add `-quiet` flag to `nomad var init` command ] cli: Add check for missing host volume `path` in `nomad config validate` command ] client: check kernel module in `/sys/module` to help with WSL2 bridge networking ] cni: Ensure to setup CNI addresses in deterministic order ] deps: Updated Vault SDK to 0.9.0 ] deps: update docker to 23.0.3 ] docker: Add `group_add` configuration ] ui: adds keyboard nav for switching between regions by pressing "r 1", "r 2", etc. ] BUG FIXES: api: Fixed a bug that caused a panic when calling the `Jobs().Plan()` function with a job missing an ID ] api: add missing constant for unknown allocation status ] api: add missing field NetworkStatus for Allocation ] cgroups: Fixed a bug removing all DevicesSets when alloc is created/removed ] cli: Fix a panic in the `nomad job restart` command when monitoring replacement allocations ] cli: Output error messages during deployment monitoring ] client: Fixed a bug where Nomad incorrectly wrote to memory swappiness cgroup on old kernels ] client: Fixed a bug where agent would panic during drain incurred by shutdown ] client: fixed a bug that prevented Nomad from fingerprinting Consul 1.13.8 correctly ] consul: Fixed a bug where Nomad would repeatedly try to revoke successfully revoked SI tokens ] core: Fix panic around client deregistration and pending heartbeats ] core: fixed a bug that caused job validation to fail when a task with `killtimeout` was placed inside a group with

set to 0 ] csi: Fixed a bug where CSI volumes would fail to restore during client restarts ] docker: Fixed a bug where network pause container would not be removed after node restart ] drivers/docker: Fixed a bug where long-running docker operations would incorrectly timeout ] identity: Fixed a bug where workload identities for periodic and dispatch jobs would not have access to their parent job's ACL policy ] replication: Fix a potential panic when a non-authoritative region is upgraded and a server with the new version becomes the leader. ] scheduler: Fixed a bug that could cause replacements for failed allocations to be placed in the wrong datacenter during a canary deployment ] scheduler: Fixed a panic when a node has only one configured dynamic port ] tls: Fixed a bug where the `nomad tls cert` command did not create certificates with the correct SANs for them to work with non default domain and region names. ] ui: dont show a service as healthy when its parent allocation stops running ] ui: fixed a handful of UX-related bugs during variable editing ] IMPROVEMENTS: core: Prevent `task.killtimeout` being greater than `update.progressdeadline` ] BUG FIXES: bug: Corrected status description and modification time for canceled evaluations ] build: Linux packages now have vendor label and set the default label to HashiCorp. This fix is implemented for any future releases, but will not be updated for historical releases ] client: Fixed a bug where restarting a terminal allocation turns it into a zombie where allocation and task hooks will run unexpectedly ] client: clean up resources upon failure to restore task during client restart ] logs: Fixed a bug where disabling log collection would prevent Windows tasks from starting ] scale: Fixed a bug where evals could be created with the wrong type ] scheduler: Fixed a bug where implicit `spread` targets were treated as separate targets for scoring ] scheduler: Fixed a bug where scores for spread scheduling could be -Inf ] services: Fixed a bug preventing group service deregistrations after alloc restarts ] BUG FIXES: logging: Fixed a bug where alloc logs would not be collected after an upgrade to 1.5.4 ] BREAKING CHANGES: artifact: environment variables no longer inherited by default from Nomad client ] IMPROVEMENTS: acl: New auth-method type: JWT ] build: Update from Go 1.20.3 to Go 1.20.4 ] cli: Added new `nomad job restart` command to restart all allocations for a job ] cli: stream both stdout and stderr logs by default when following an allocation ] client/fingerprint: detect fastest cpu core during cpu performance fallback ] client: Added `drainonshutdown` configuration ] connect: Added support for meta field on sidecar service block ] dependency: update runc to 1.1.5 ] driver/docker: Default `devices.containerpath` to

like Docker's CLI ] ephemeral disk: migrate=true now implies sticky=true ] fingerprint/cpu: correctly fingerprint P/E cores of Apple Silicon chips ] jobspec: Added option for disabling task log collection in the `logs` block ] license: show Terminated field in `license get` command ] ui: Added copy-to-clipboard buttons to server and client pages ] ui: added new keyboard commands for job start, stop, exec, and client metadata ] BUG FIXES: api: Fixed filtering on maps with missing keys ] cli: Fix panic on job plan when -diff=false ] client: Fix CNI plugin version fingerprint when output includes protocol version ] client: Fix address for ports in IPv6 networks ] client: Fixed a bug where restarting proxy sidecar tasks failed ] client: Prevent a panic when an allocation has a legacy task-level bridge network and uses a driver that does not create a network namespace ] client: Remove setting attributes when spawning the getter child ] core: the deployment's list endpoint now supports look up by prefix using the wildcard for namespace ] csi: gracefully recover tasks that use csi node plugins ] docker: Fixed a bug where plugin config values were ignored ] drain: Fixed a bug where drains would complete based on the server status and not the client status of an allocation ] driver/exec: Fixed a bug where `capdrop` and `capadd` would not expand capabilities ] fix: Added "/usr/libexec" to the landlocked directories the getter has access to ] scale: Do not allow scale requests for jobs of type system ] scheduler: Fix reconciliation of reconnecting allocs when the replacement allocations are not running ] scheduler: honor false value for distinct_hosts constraint ] server: Added verification of cron jobs already running before forcing new evals right after leader change ] ui: Fix a visual bug where evaluation response wasn't scrollable in the Web UI. ] SECURITY: acl: Fixed a bug where unauthenticated HTTP API requests through the client could bypass ACL policy checking ] ] build: update to Go 1.20.3 to prevent denial of service attack via malicious HTTP headers ] BREAKING CHANGES: cli: nomad login no longer requires -type flag, since auth method names are globally unique. ] IMPROVEMENTS: agent: trim leading and trailing spaces when parsing `X-Nomad-Token` header ] build: Update to go1.20.2 ] cli: Added `-json` and `-t` flag to `namespace status` command ] cli: Added `-json` and `-t` flag to `quota status` command ] cli: Added `-json` and `-t` flag to `server members` command ] cli: Added `-json` flag to `quota inspect` command ] scheduler: remove most uses of reflection for task comparisons ] BUG FIXES: artifact: Fixed a bug where artifact downloading failed when using git-ssh ] cli: nomad login no longer ignores default auth method if they are present. ] client: Fixed a bug where artifact downloading failed on hardened nodes ] client: Fixed a bug where clients using Consul discovery to join the cluster would get permission denied errors ] client: Fixed a bug where cpuset initialization fails after Client restart ] core: Fixed a bug where Dynamic Node Metadata requests could crash servers ] plugin: Add missing fields to `TaskConfig` so they can be accessed by external task drivers ] services: Fixed a bug where a service would be deregistered twice ] BREAKING CHANGES: api: job register and register requests from API clients older than version 0.12.1 will not longer emit an evaluation ] SECURITY: variables: Fixed a bug where a workload identity without any workload-associated policies was treated as a management token ] variables: Fixed a bug where a workload-associated policy with a deny capability was ignored for the workload's own variables ] IMPROVEMENTS: cli: Add job prefix match to the `nomad job dispatch`, `nomad job eval`, `nomad job scale`, and `nomad job scaling-events` commands ] cli: Add support for the wildcard namespace `` to the `nomad job dispatch`, `nomad job eval`, `nomad job scale`, and `nomad job scaling-events` commands ] cli: Added `-json` and `-t` flag to `alloc checks` command ] env/ec2: update cpu metadata ] DEPRECATIONS: api: The `Restart()`, `Stop()`, and `Signal()` methods in the `Allocations` struct will have their signatures modified in Nomad 1.6.0 ] api: The `RestartAllTasks()` method in the `Allocations` struct will be removed in Nomad 1.6.0 ] BUG FIXES: api: Fix

method to properly set the request `LastIndex` and `RequestTime` in the response ] cli: Fixed a bug where the `-json` and `-t` flags were not respected on the `acl binding-rule info` command ] client: Don't emit shutdown delay task event when the shutdown operation is configured to skip the delay ] client: Fixed a bug that prevented allocations with interpolated values in Consul services from being marked as healthy ] client: Fixed a bug where clients used the serf advertise address to connect to servers when using Consul auto-discovery ] docker: Fixed a bug where pause containers would be erroneously removed ] scheduler: Fixed a bug where allocs of system jobs with wildcard datacenters would be destructively updated ] scheduler: Fixed a bug where collisions in dynamic port offerings would result in spurious plan-for-node-rejected errors ] server: Fixed a bug where deregistering a job that was already garbage collected would create a new evaluation ] server: Fixed a bug where node updates that produced errors from service discovery or CSI plugin updates were not logged ] server: Fixed a bug where the `system reconcile summaries` command and API would not return any scheduler-related errors ] service: Fixed a bug where attaching a policy to a job would prevent workload identities for the job from reading the service registration API ] ui: fixed an issue where system/sysbatch jobs with wildcard datacenters (like ] ui: fixed outbound link to outage recovery on error page ] FEATURES: Dynamic Node Metadata*: Allow users and tasks to update Node metadata via an API ] SSO via OIDC*: Allow users to authenticate with Nomad via OIDC providers ] BREAKING CHANGES: cli: The deprecated gossip keyring commands `nomad operator keyring`, `nomad keyring`, `nomad operator keygen`, and `nomad keygen` have been removed. Use the `nomad operator gossip keyring` commands to manage the gossip keyring ] config: the `datacenter` field for agent configuration no longer accepts the `` character as part of the datacenter name ] core: Ensure no leakage of evaluations for batch jobs. Prior to this change allocations and evaluations for batch jobs were never garbage collected until the batch job was explicitly stopped. The new `batchevalgc_threshold` server configuration controls how often they are collected. The default threshold is `24h`. ] metrics: The metric `nomad.nomad.broker.totalblocked` has been renamed to `nomad.nomad.broker.totalpending` to reduce confusion with the `nomad.blockedeval.totalblocked` metric. ] artifact: Environment variables are no longer inherited by default from the Nomad client ] artifact: File size and count limits are now applied by default to artifact downloads ] SECURITY: build: Update to go1.20.1 ] IMPROVEMENTS: acl: refactor ACL cache based on golang-lru/v2 ] agent: Allow configurable range of Job priorities ] api: improved error returned from AllocFS.Logs when response is not JSON ] artifact: Provide mitigations against unbounded artifact decompression ] build: Added hyper-v isolation mode for docker on Windows ] build: Update to go1.20 ] cli: Add `-json` and `-t` flag to `nomad acl token create` command ] cli: Added `-wait` flag to `deployment status` for use with `-monitor` mode ] cli: Added sprig function support for `-t` templates ] cli: Added tls command to enable creating Certificate Authority and Self signed TLS certificates. There are two sub commands `tls ca` and `tls cert` that are helpers when creating certificates. ] cli: Warn when variable key includes characters that require the use of the `index` function in templates ] cli: `nomad job stop` can be used to stop multiple jobs concurrently. ] cli: add a nomad operator client state command ] cli: multi-line `nomad version` output, add BuildDate ] cli: we now recommend .nomad.hcl extension for job files, so `job init` creates

] client/fingerprint/storage: Added config options disktotalmb and diskfreemb to override detected disk space ] client: Add option to enable hairpinMode on Nomad bridge ] client: Added a TaskEvent when task shutdown is waiting on shutdown_delay ] client: Log task events at INFO log level ] client: added http api access for tasks via unix socket ] client: detect and cleanup leaked iptables rules ] client: execute artifact downloads in sandbox process ] consul/connect: Adds support for proxy upstream opaque config ] consul: add client configuration for grpccafile ] core: Eliminate deprecated practice of seeding rand package ] core: Non-client nodes will now skip loading plugins ] csi: Added server configuration for `csivolumeclaimgcinterval` ] deps: Update github.com/containerd/containerd from 1.6.6 to 1.6.12 ] deps: Update github.com/docker/docker from 20.10.21+incompatible to 20.10.23+incompatible ] deps: Update github.com/fsouza/go-dockerclient from 1.8.2 to 1.9.0 ] deps: Update google.golang.org/grpc from 1.48.0 to 1.50.1 ] deps: Update google.golang.org/grpc to v1.51.0 ] docs: link to an envoy troubleshooting doc when envoy bootstrap fails ] env/ec2: update cpu metadata ] fingerprint: Detect CNI plugins and set versions as node attributes ] identity: Add identity jobspec block for exposing workload identity to tasks ] identity: Allow workloads to use RPCs associated with HTTP API ] jobspec: the `datacenters` field now accepts wildcards ] metrics: Added metrics for rate of RPC requests ] scheduler: allow using device IDs in `affinity` and `constraint` ] server: Added raft snapshot arguments to server config ] server: Certain raft configuration elements can now be reloaded without restarting the server ] services: Set Nomad's User-Agent by default on HTTP checks in Nomad services ] ui, cli: Adds Job Templates to the "Run Job" Web UI and makes them accessible via new flags on nomad job init ] ui: Add a button for expanding the Task sidebar to full width ] ui: Added a Policy Editor interface for management tokens ] ui: Added a ui.label block to agent config, letting operators set a visual label and color for their Nomad instance ] ui: Made task rows in Allocation tables look more aligned with their parent ] ui: Show events alongside logs in the Task sidebar ] ui: The web UI now provides a Token Management interface for management users on policy pages ] ui: The web UI will now show canary_tags of services anyplace we would normally show tags. ] ui: Warn when variable key includes characters that require the use of the `index` function in templates ] ui: give users a notification if their token is going to expire within the next 10 minutes ] ui: redirect users to Sign In should their tokens ever come back expired or not-found ] users: Added a cache for OS user lookups ] variables: Increased maximum size to 64KiB ] vault: configure Nomad User-Agent on vault clients ] volumes: Allow `peralloc` to be used with hostvolumes ] DEPRECATIONS: api: Deprecated ErrVariableNotFound in favor of ErrVariablePathNotFound to correctly represent an error type ] api: Deprecated Variables.GetItems in favor of Variables.GetVariableItems to avoid returning a pointer to a map ] api: The connect `ConsulExposeConfig.Path` field is deprecated in favor of `ConsulExposeConfig.Paths` ] api: The connect `ConsulProxy.ExposeConfig` field is deprecated in favor of `ConsulProxy.Expose` ] BUG FIXES: acl: Fixed a bug in token creation which failed to parse expiration TTLs correctly ] acl: Fixed a bug where creating/updating a policy which was invalid would return a 404 status code, not a 400 ] agent: Make agent syslog log level follow log_level config ] api: Added missing node states to NodeStatus constants ] api: Fix stale querystring parameter value as boolean ] api: Fixed a bug where

would panic if variable did not exist ] api: Fixed a bug where exposeConfig field was not provided correctly when getting the jobs via the API ] api: Fixed a nil pointer dereference when periodic jobs are missing their periodic spec ] cgutil: handle panic coming from runc helper method ] check: Add support for sending custom host header ] cli: Fix unbolded header `Device Group Attributes` ] cli: Fixed a bug where `nomad fmt -check` would overwrite the file being checked ] cli: Fixed a bug where plans for periodic jobs would return exit code 1 when the job was already register ] cli: Fixed a panic in `deployment status` when rollback deployments are slow to appear ] cli: `var put`: when second arg is an @-reference, check extension for format ] cli: corrected typos in ACL role create/delete CLI commands ] cli: fix nomad fmt -check flag not returning error code ] client: Fixed a bug where allocation cleanup hooks would not run ] connect: ingress http/2/grpc listeners may exclude hosts ] consul: Fixed a bug where acceptable service identity on Consul token was not accepted ] consul: Fixed a bug where consul token was not respected when reverting a job ] consul: Fixed a bug where services would continuously re-register when using ipv6 ] consul: correctly interpret missing consul checks as unhealthy ] core: enforce strict ordering that node status updates are recorded after allocation updates for reconnecting clients ] csi: Fixed a bug where a crashing plugin could panic the Nomad client ] csi: Fixed a bug where secrets that include '=' were incorrectly rejected ] csi: Fixed a bug where volumes in non-default namespaces could not be scheduled for system or sysbatch jobs ] csi: Fixed potential state store corruption when garbage collecting CSI volume claims or checking whether it's safe to force-deregister a volume ] docker: Fixed a bug where images referenced by multiple tags would not be GC'd ] docker: Fixed a bug where infraimage did not get allocid label ] docker: configure restart policy for bridge network pause container ] docker: disable driver when running as non-root on cgv2 hosts ] eval broker: Fixed a bug where the cancelable eval reaper used an incorrect lock when getting the set of cancelable evals from the broker ] event stream: Fixed a bug where undefined ACL policies on the request's ACL would result in incorrect authentication errors ] fix: Add the missing option propagationmode for volumemount ] parser: Fixed a panic in the job spec parser when a variable validation block was missing its condition ] scheduler (Enterprise): Fixed a bug that prevented new allocations from multiregion jobs to be placed in situations where other regions are not involved, such as node updates. ] server: Fixed a bug where rejoinafterleave config was not being respected ] services: Fixed a bug where check_restart on nomad services on tasks failed with incorrect CheckIDs ] services: Fixed a bug where services would fail to register if task initially fails ] template: Fixed a bug that caused the chage script to fail to run ] template: Fixed a bug where the template runner's Nomad token would be erased by in-place updates to a task ] ui: Fix allocation memory chart to display the same value as the CLI ] ui: Fix navigation to pages for jobs that are not in the default namespace ] ui: Fixed a bug where the exec window would not maintain namespace upon refresh ] ui: Scale down logger height in the UI when the sidebar container also has task events ] volumes: Fixed