backport of commit 816e27c

.release/ci.hcl

@@ -37,7 +37,7 @@ event "prepare" {
   }
 
   notification {
-    on = "always"
+    on = "fail"
   }
 }
 

api/agent.go

@@ -113,7 +113,7 @@ func (a *Agent) Region() (string, error) {
 
 // Join is used to instruct a server node to join another server
 // via the gossip protocol. Multiple addresses may be specified.
-// We attempt to join all the hosts in the list. Returns the
+// We attempt to join all of the hosts in the list. Returns the
 // number of nodes successfully joined and any error. If one or
 // more nodes have a successful result, no error is returned.
 func (a *Agent) Join(addrs ...string) (int, error) {

api/agent_test.go

@@ -1,15 +1,13 @@
 package api
 
 import (
-	"fmt"
 	"sort"
 	"strings"
 	"testing"
 	"time"
 
 	"github.com/hashicorp/nomad/api/internal/testutil"
 	"github.com/shoenig/test/must"
-	"github.com/shoenig/test/wait"
 )
 
 func TestAgent_Self(t *testing.T) {
@@ -112,43 +110,7 @@ func TestAgent_ForceLeave(t *testing.T) {
 	err := a.ForceLeave("nope")
 	must.NoError(t, err)
 
-	// Force-leave on an existing node
-	_, s2 := makeClient(t, nil, func(c *testutil.TestServerConfig) {
-		c.Server.BootstrapExpect = 0
-	})
-	defer s2.Stop()
-	// Create a new node to join
-	n, err := a.Join(s2.SerfAddr)
-	must.NoError(t, err)
-	must.One(t, n)
-
-	membersBefore, err := a.MembersOpts(&QueryOptions{})
-	must.Eq(t, membersBefore.Members[1].Status, "alive")
-
-	err = a.ForceLeave(membersBefore.Members[1].Name)
-	must.NoError(t, err)
-
-	time.Sleep(3 * time.Second)
-
-	f := func() error {
-		membersAfter, err := a.MembersOpts(&QueryOptions{})
-		if err != nil {
-			return err
-		}
-		for _, node := range membersAfter.Members {
-			if node.Name == membersBefore.Members[1].Name {
-				if node.Status != "leaving" {
-					return fmt.Errorf("node did not leave")
-				}
-			}
-		}
-		return nil
-	}
-	must.Wait(t, wait.InitialSuccess(
-		wait.ErrorFunc(f),
-		wait.Timeout(3*time.Second),
-		wait.Gap(100*time.Millisecond),
-	))
+	// TODO: test force-leave on an existing node
 }
 
 func (a *AgentMember) String() string {

api/nodes.go

@@ -35,7 +35,7 @@ func (c *Client) Nodes() *Nodes {
 	return &Nodes{client: c}
 }
 
-// List is used to list out all the nodes
+// List is used to list out all of the nodes
 func (n *Nodes) List(q *QueryOptions) ([]*NodeListStub, *QueryMeta, error) {
 	var resp NodeIndexSort
 	qm, err := n.client.query("/v1/nodes", &resp, q)

client/allocrunner/taskrunner/artifact_hook_test.go

@@ -160,7 +160,6 @@ func TestTaskRunner_ArtifactHook_PartialDone(t *testing.T) {
 // TestTaskRunner_ArtifactHook_ConcurrentDownloadSuccess asserts that the artifact hook
 // download multiple files concurrently. this is a successful test without any errors.
 func TestTaskRunner_ArtifactHook_ConcurrentDownloadSuccess(t *testing.T) {
-	ci.SkipTestWithoutRootAccess(t)
 	t.Parallel()
 
 	me := &mockEmitter{}

client/allocrunner/taskrunner/task_runner_test.go

@@ -1729,7 +1729,6 @@ func TestTaskRunner_DeriveToken_Unrecoverable(t *testing.T) {
 // TestTaskRunner_Download_RawExec asserts that downloaded artifacts may be
 // executed in a driver without filesystem isolation.
 func TestTaskRunner_Download_RawExec(t *testing.T) {
-	ci.SkipTestWithoutRootAccess(t)
 	ci.Parallel(t)
 
 	ts := httptest.NewServer(http.FileServer(http.Dir(filepath.Dir("."))))

command/agent/testagent.go

@@ -340,7 +340,6 @@ func (a *TestAgent) pickRandomPorts(c *Config) {
 // TestConfig returns a unique default configuration for testing an agent.
 func (a *TestAgent) config() *Config {
 	conf := DevConfig(nil)
-	conf.Version.BuildDate = time.Now()
 
 	// Customize the server configuration
 	config := nomad.DefaultConfig()

command/job_eval.go

@@ -23,11 +23,9 @@ Usage: nomad job eval [options] <job_id>
   operators to force the scheduler to create new allocations under certain
   scenarios.
 
-  When ACLs are enabled, this command requires a token with the 'submit-job'
+  When ACLs are enabled, this command requires a token with the 'read-job'
   capability for the job's namespace. The 'list-jobs' capability is required to
-  run the command with a job prefix instead of the exact job ID. The 'read-job'
-  capability is required to monitor the resulting evaluation when -detach is
-  not used.
+  run the command with a job prefix instead of the exact job ID.
 
 General Options:
 

command/job_eval_test.go

@@ -156,7 +156,7 @@ func TestJobEvalCommand_ACL(t *testing.T) {
 			expectedErr: api.PermissionDeniedErrorContent,
 		},
 		{
-			name: "missing submit-job",
+			name: "missing read-job",
 			aclPolicy: `
 namespace "default" {
 	capabilities = ["list-jobs"]
@@ -165,48 +165,29 @@ namespace "default" {
 			expectedErr: api.PermissionDeniedErrorContent,
 		},
 		{
-			name: "submit-job allowed but can't monitor eval without read-job",
+			name: "read-job allowed",
 			aclPolicy: `
 namespace "default" {
-	capabilities = ["submit-job"]
+	capabilities = ["read-job"]
 }
 `,
-			expectedErr: "No evaluation with id",
 		},
 		{
-			name: "submit-job allowed and can monitor eval with read-job",
-			aclPolicy: `
-namespace "default" {
-	capabilities = ["read-job", "submit-job"]
-}
-`,
-		},
-		{
-			name:      "job prefix requires list-jobs",
+			name:      "job prefix requires list-job",
 			jobPrefix: true,
 			aclPolicy: `
 namespace "default" {
-	capabilities = ["submit-job"]
+	capabilities = ["read-job"]
 }
 `,
 			expectedErr: "job not found",
 		},
 		{
-			name:      "job prefix works with list-jobs but can't monitor eval without read-job",
-			jobPrefix: true,
-			aclPolicy: `
-namespace "default" {
-	capabilities = ["list-jobs", "submit-job"]
-}
-`,
-			expectedErr: "No evaluation with id",
-		},
-		{
-			name:      "job prefix works with list-jobs and can monitor eval with read-job",
+			name:      "job prefix works with list-job",
 			jobPrefix: true,
 			aclPolicy: `
 namespace "default" {
-	capabilities = ["read-job", "list-jobs", "submit-job"]
+	capabilities = ["read-job", "list-jobs"]
 }
 `,
 		},

command/job_plan.go

@@ -262,10 +262,6 @@ func (c *JobPlanCommand) Run(args []string) int {
 		runArgs.WriteString(fmt.Sprintf("-var-file=%q ", varFile))
 	}
 
-	if c.namespace != "" {
-		runArgs.WriteString(fmt.Sprintf("-namespace=%q ", c.namespace))
-	}
-
 	exitCode := c.outputPlannedJob(job, resp, diff, verbose)
 	c.Ui.Output(c.Colorize().Color(formatJobModifyIndex(resp.JobModifyIndex, runArgs.String(), path)))
 	return exitCode

command/operator_raft_list.go

@@ -2,7 +2,6 @@ package command
 
 import (
 	"fmt"
-	"sort"
 	"strings"
 
 	"github.com/hashicorp/nomad/api"
@@ -85,10 +84,6 @@ func (c *OperatorRaftListCommand) Run(args []string) int {
 
 	// Format it as a nice table.
 	result := []string{"Node|ID|Address|State|Voter|RaftProtocol"}
-	sort.Slice(reply.Servers, func(i, j int) bool {
-		return reply.Servers[i].Node < reply.Servers[j].Node
-	})
-
 	for _, s := range reply.Servers {
 		state := "follower"
 		if s.Leader {