backport of commit 24e01ef

.changelog/11791.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+hcl: added support for using the `filebase64` function in jobspecs
+```

.changelog/11864.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+qemu: Added option to configure `drive_interface`
+```

.changelog/12520.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+bootstrap: Added option to allow for an operator generated bootstrap token to be passed to the `acl bootstrap` command
+```

.changelog/12534.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+api: support Authorization Bearer header in lieu of X-Nomad-Token header
+```

.changelog/12800.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+qemu: add support for guest agent socket
+```

.changelog/12817.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+client: Fixed a bug where network.dns block was not interpolated
+```

.changelog/12862.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+api: enable setting `?choose` parameter when querying services
+```

.changelog/12925.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fixed a bug that prevented the UI task exec functionality to work from behind a reverse proxy.
+```

.changelog/12953.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+consul: Reduce load on Consul leader server by allowing stale results when listing namespaces.
+```

.changelog/12955.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+core: On node updates skip creating evaluations for jobs not in the node's datacenter.
+```

.changelog/12961.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+agent: emit a warning message if the agent starts with `bootstrap_expect` set to an even number.
+```

.changelog/12962.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+agent: fixed a panic on startup when the `server.protocol_version` config parameter was set
+```

.changelog/13008.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+volumes: Fixed a bug where additions, updates, or removals of host volumes or CSI volumes were not treated as destructive updates
+```

.changelog/13012.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: fixed a bug where links to jobs with "@" in their name would mis-identify namespace and 404
+```

.changelog/13041.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+client: added more fault tolerant defaults for template configuration
+```

.changelog/13044.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+cli: update default redis and use nomad service discovery
+```

.changelog/13045.txt

@@ -0,0 +1,7 @@
+```release-note:improvement
+cli: Added `scheduler get-config` and `scheduler set-config` commands to the operator CLI
+```
+
+```release-note:improvement
+core: Added the ability to pause and un-pause the eval broker and blocked eval broker
+```

.changelog/13055.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+lifecycle: fixed a bug where sidecar tasks were not being stopped last
+```

.changelog/13057.txt

@@ -0,0 +1,3 @@
+```release-note:security
+A vulnerability was identified in the go-getter library that Nomad uses for its artifacts such that a specially crafted Nomad jobspec can be used for privilege escalation onto client agent hosts. [CVE-2022-30324](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30324)
+```

.changelog/13058.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+docker: Fixed a bug where cgroups-v1 parent was being set
+```

.changelog/13065.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+api: Fixed a bug where Consul token was not respected for job revert API
+```

.changelog/13070.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+cli: Fixed a bug where job validate did not respect vault token or namespace
+```

.changelog/13076.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+agent: logs are no longer buffered at startup when logging in JSON format
+```

.changelog/13103.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+cli: warn destructive update only when count is greater than 1
+```

.changelog/13104.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+core: Fixed a bug where blocked eval resources were incorrectly computed
+```

.changelog/13125.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+connect: Added missing ability of setting Connect upstream destination namespace
+```

.changelog/13182.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+fingerprint: add support for detecting kernel architecture of clients. (attribute: `kernel.arch`)
+```

.changelog/13184.txt

@@ -0,0 +1,3 @@
+```release-note:improvements
+consul/connect: Allow configuring tls settings for ingress.
+```

.changelog/13205.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+core: Fixed a bug where an evicted batch job would not be rescheduled
+```

.changelog/13265.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+driver/docker: Eliminate excess Docker registry pulls for the `infra_image` when it already exists locally.
+```

.changelog/13274.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+csi: Fixed a scheduler bug where failed feasibility checks would return early and prevent processing additional nodes
+```

.changelog/13301.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+csi: Fixed a bug where volume claims on lost or garbage collected nodes could not be freed
+```

.changelog/13340.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+csi: Fixed a regression where a timeout was introduced that prevented some plugins from running by marking them as unhealthy after 30s by introducing a configurable `health_timeout` field
+```

.changelog/13359.txt

@@ -0,0 +1,3 @@
+```release-note:improvements
+api: Added `NewSysbatchJob` helper function to create a base sysbatch job object
+```

.changelog/13364.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+cli: Fixed a bug where the evaluation ID was not returned from `job revert` when the `-detach` flag was used
+``

.changelog/13405.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+cli: Fixed remaining bugs where the evaluation ID was not printed when the `-detach` flag was passed
+``

.changelog/13407.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+core: Fixed a bug where the plan applier could deadlock if leader's state lagged behind plan's creation index for more than 5 seconds.
+```

.changelog/13421.txt

@@ -0,0 +1,7 @@
+```release-note:improvement
+core: automatically mark clients with recurring plan rejections as ineligible
+```
+
+```release-note:improvement
+metrics: emit `nomad.nomad.plan.rejection_tracker.node_score` metric for the number of times a node had a plan rejection within the past time window
+```

.changelog/13428.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+cni: Fixed a bug where loopback address was not set for all drivers
+```

.changelog/13446.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+csi: Fixed a bug where CSI hook validation would fail if all tasks didn't support CSI.
+``

.changelog/13472.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+cli: `operator debug` now outputs current leader to debug bundle
+```

.changelog/13473.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fixed a bug where dispatched children of parameterized jobs wouldn't display metadata or payloads
+``

.changelog/13491.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+deps: Updated `github.com/hashicorp/go-discover` to latest to allow setting the AWS endpoint definition
+```

.changelog/13492.txt

@@ -0,0 +1,7 @@
+```release-note:improvement
+cli: Added `delete` command to the eval CLI
+```
+
+```release-note:improvement
+agent: Added delete support to the eval HTTP API
+```

.changelog/13493.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+client: Fixed a problem calculating a services namespace
+```

.changelog/13530.txt

@@ -0,0 +1,7 @@
+```release-note:bug
+api: Fix listing evaluations with the wildcard namespace and an ACL token
+```
+
+```release-note:bug
+ui: Fix a bug that prevented viewing the details of an evaluation in a non-default namespace
+```

.changelog/13551.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+state: Fix listing evaluations from all namespaces
+```

.changelog/13581.txt

@@ -0,0 +1,7 @@
+```release-note:improvement
+cli: display namespace and node ID in the `eval list` command and when `eval status` matches multiple evals
+```
+
+```release-note:improvement
+cli: always display job ID and namespace in the `eval status` command
+```

.changelog/13588.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fixed an issue where editing or running a job with a namespace via the UI would throw a 404 on redirect.
+```

.changelog/13608.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+api: refactor ACL check when using the all namespaces wildcard in the job and alloc list endpoints
+```

.changelog/13621.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+api: HTTP server now returns a 429 error code when hitting the connection limit
+```

.changelog/13626.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+client: Fixed a bug where max_kill_timeout client config was ignored
+```

.changelog/13651.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+core: Fixed a bug where reserved ports on multiple node networks would be treated as a collision. `client.reserved.reserved_ports` is now merged into each `host_network`'s reserved ports instead of being treated as a collision.
+```

.changelog/13656.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+cli: Fixed a bug in the names of the `node drain` and `node status` sub-commands
+```

.changelog/13658.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+cli: `operator snapshot state` supports `-filter` expressions and avoids writing large temporary files
+```

.changelog/13659.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Allow running jobs from a namespace-limited token
+```

.changelog/13670.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fixed a bug where task memory was reported as zero on systems using cgroups v2
+```

.changelog/13679.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Namespace filter query paramters are now isolated by route
+```

.changelog/13737.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+acl: Fixed a bug where the timestamp for expiring one-time tokens was not deterministic between servers
+```

.changelog/13755.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+template: Templates support new uid/gid parameter pair
+```

.changelog/13786.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+metrics: Fixed a bug where blocked evals with no class produced no dc:class scope metrics
+```

.changelog/13865.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Add missing breadcrumb in the Evaluations page.
+```

.changelog/13866.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Reorder and apply the same style to the Evaluations list page filters to match the Job list page.
+```

.changelog/13869.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+servicedisco: Fixed a bug where non-unique services would escape job validation
+```

.changelog/13880.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+namespaces: Fixed a bug that allowed deleting a namespace that contained a CSI volume
+```

.changelog/13907.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+template: Expose consul-template configuration options at the client level for `nomad_retry`.
+```

.changelog/13919.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+csi: Add `stage_publish_base_dir` field to `csi_plugin` block to support plugins that require a specific staging/publishing directory for mounts
+```

.changelog/13971.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+qemu: use shorter socket file names to reduce the chance of hitting the max path length
+```

.changelog/13972.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+template: add script change_mode that allows scripts to be executed on template change
+```

.changelog/14000.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+qemu: restore the monitor socket path when restoring a QEMU task.
+```

.changelog/14001.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+deployments: Fixed a bug that prevented auto-approval if canaries were marked as unhealthy during deployment
+```

.changelog/14065.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+cli: Fixed a bug where job validation requeset was not sent to leader
+```

.changelog/14069.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+cli: Fixed a bug where the memory usage reported by Allocation Resource Utilization is zero on systems using cgroups v2
+```

.changelog/14071.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Display different message when trying to exec into a job with no task running.
+```

.changelog/14088.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+cli: Fixed a bug where vault token not respected in plan command
+```

.changelog/14089.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+driver/docker: Added config option to disable container healthcheck
+```

.changelog/14115.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Removes duplicate breadcrumb header when navigating from child job back to parent.
+```

.changelog/14127.txt

@@ -0,0 +1,7 @@
+```release-note:improvement
+client: add option to restart all tasks of an allocation, regardless of lifecycle type or state.
+```
+
+```release-note:improvement
+client: only start poststop tasks after poststart tasks are done.
+```

.changelog/14132.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+build: update to go1.19
+```

.changelog/14138.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: add general keyboard navigation to the Nomad UI
+```

.changelog/14145.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+api: cleanup whitespace from failed api response body
+```

.changelog/14171.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+sentinel: add the ability to reference the namespace and Nomad acl token in policies
+```

.changelog/14203.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+template: Fixed a bug where job templates would use `uid` and `gid` 0 after upgrading to Nomad 1.3.3, causing tasks to fail with the error `failed looking up user: managing file ownership is not supported on Windows`.
+```

.changelog/14223.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Add button to restart all tasks in an allocation.
+```

.changelog/14224.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fixed a bug that caused the allocation details page to display the stats bar chart even if the task was pending.
+```

.changelog/14230.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+client: Fixed a bug where cpuset initialization would not work on first agent startup
+```

.changelog/14248.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+client: Fixed a bug where user lookups would hang or panic
+```

.changelog/14297.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+client/logmon: fixed a bug where logmon cannot find nomad executable
+```

.changelog/14298.txt

@@ -0,0 +1,7 @@
+```release-note:bug
+vault: Fixed a bug where changing the Vault configuration `namespace` field was not detected as a change during server configuration reload.
+```
+
+```release-note:bug
+vault: Fixed a bug where Vault clients were recreated when the server configuration was reloaded, even if there were no changes to the Vault configuration.
+```

.changelog/14333.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+cli: Fixed a bug where forcing a periodic job would fail if the job ID prefix-matched other periodic jobs
+```