backport of commit 7a4f0af

.changelog/17280.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+api: add missing field NetworkStatus for Allocation
+```

.changelog/17652.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+scheduler: Fixed a bug that could cause replacements for failed allocations to be placed in the wrong datacenter during a canary deployment
+```

.changelog/17766.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+cni: Ensure to setup CNI addresses in deterministic order
+```

.changelog/17847.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+consul: Fixed a bug where Nomad would repeatedly try to revoke successfully revoked SI tokens
+```

.git-blame-ignore-revs

@@ -1,5 +1,2 @@
 # This commit just fixes some typos and isn't useful
 b0a20b4dc965a38b0c843f47c16685ccad7439da
-
-# giant copywrite headers commit
-f005448366ed3e796a2f22696d8c063dff4677f8

.github/actions/setup-js/action.yml

@@ -0,0 +1,34 @@
+name: setup-js
+description: install node and yarn, and run yarn install
+inputs:
+  node-version:
+    description: 'node version'
+    # https://github.com/ember-cli/ember-cli/blob/master/docs/node-support.md
+    # package.json has ember-cli at version ~3.28.5 currently
+    default: '16'
+runs:
+  using: composite
+  steps:
+    - name: Install yarn
+      run: |-
+        # install yarn if not present
+        yarn --version && exit
+        # note: can't `npm install -g` on self-hosted runners
+        npm install yarn --no-package-lock --no-save
+        cd node_modules/.bin
+          ./yarn --version
+          echo "$PWD" >> "$GITHUB_PATH"
+      working-directory: /tmp
+      shell: bash
+    # enforce node version (self-hosted default is not necessarily what we want)
+    # after yarn, so we can use yarn for cache.
+    - name: Setup node
+      uses: actions/setup-node@64ed1c7eab4cce3362f8c340dee64e5eaeef8f7c # v3
+      with:
+        node-version: ${{ inputs.node-version }}
+        cache: yarn
+        cache-dependency-path: ui/yarn.lock
+    - name: Yarn install
+      run: yarn install --frozen-lockfile
+      working-directory: ui
+      shell: bash

.github/actions/vault-secrets/action.yml

@@ -0,0 +1,23 @@
+name: vault-secrets
+description: 'pull secrets from CI Vault into environment vars'
+inputs:
+  paths:
+    description: 'vault-action secrets input'
+    required: true
+runs:
+  using: composite
+  steps:
+    - name: Authenticate to Vault
+      if: endsWith(github.repository, '-enterprise')
+      id: vault-auth
+      run: vault-auth
+      shell: bash
+    - name: Retrieve Vault-hosted Secrets
+      if: endsWith(github.repository, '-enterprise')
+      id: vault
+      uses: hashicorp/vault-action@v2.4.3
+      with:
+        url: ${{ steps.vault-auth.outputs.addr }}
+        caCertificate: ${{ steps.vault-auth.outputs.ca_certificate }}
+        token: ${{ steps.vault-auth.outputs.token }}
+        secrets: ${{ inputs.paths }}

.github/workflows/backport.yml

@@ -31,12 +31,18 @@ jobs:
           # Enabling this option increased the number of backport failures.
           BACKPORT_MERGE_COMMIT: false
           GITHUB_TOKEN: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
+
   handle-failure:
     needs:
       - backport
     if: always() && needs.backport.result == 'failure'
-    runs-on: ubuntu-latest
+    runs-on: ${{ endsWith(github.repository, '-enterprise') && fromJSON('["self-hosted", "ondemand", "linux"]') || 'ubuntu-latest' }}
     steps:
+      - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
+      - uses: ./.github/actions/vault-secrets
+        with:
+          paths: |-
+            kv/data/teams/nomad/slack-webhooks feed-nomad | SLACK_FEED_NOMAD ;
       - name: Send slack notification on failure
         uses: slackapi/slack-github-action@007b2c3c751a190b6f0f040e47ed024deaa72844 # v1.23.0
         with:
@@ -69,8 +75,8 @@ jobs:
               ]
             }
         env:
-          SLACK_WEBHOOK_URL: ${{ secrets.BACKPORT_ASSISTANT_FAILURE_SLACK }}
+          SLACK_WEBHOOK_URL: ${{ env.SLACK_FEED_NOMAD || secrets.BACKPORT_ASSISTANT_FAILURE_SLACK }}
           SLACK_WEBHOOK_TYPE: INCOMING_WEBHOOK
 permissions:
   contents: read
-
+  id-token: write

.github/workflows/build.yml

@@ -80,7 +80,7 @@ jobs:
     strategy:
       matrix:
         goos: [windows]
-        goarch: ["amd64"]
+        goarch: ["386", "amd64"]
       fail-fast: true
 
     name: Go ${{ needs.get-go-version.outputs.go-version }} ${{ matrix.goos }} ${{ matrix.goarch }} build
@@ -118,6 +118,7 @@ jobs:
           GO_TAGS: ${{ env.GO_TAGS }}
           CGO_ENABLED: 1
         run: |
+          go clean -cache
           make pkg/${{ matrix.goos }}_${{ matrix.goarch }}.zip
           mv pkg/${{ matrix.goos }}_${{ matrix.goarch }}.zip ${{ env.PKG_NAME }}_${{ needs.get-product-version.outputs.product-version }}_${{ matrix.goos }}_${{ matrix.goarch }}.zip
       - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
@@ -131,7 +132,7 @@ jobs:
     strategy:
       matrix:
         goos: [linux]
-        goarch: ["arm", "arm64", "amd64"]
+        goarch: ["arm", "arm64", "386", "amd64"]
       fail-fast: true
 
     name: Go ${{ needs.get-go-version.outputs.go-version }} ${{ matrix.goos }} ${{ matrix.goarch }} build
@@ -166,7 +167,12 @@ jobs:
         run: |
           sudo apt-get update
           sudo apt-get install -y software-properties-common
+          sudo dpkg --add-architecture i386
           sudo apt-get update
+          sudo apt-get install -y \
+            libc6-dev-i386 \
+            libpcre3-dev \
+            linux-libc-dev:i386
           sudo apt-get install -y \
             binutils-aarch64-linux-gnu \
             binutils-arm-linux-gnueabihf \
@@ -189,6 +195,7 @@ jobs:
           GO_TAGS: ${{ env.GO_TAGS }}
           CGO_ENABLED: 1
         run: |
+          go clean -cache
           make pkg/${{ matrix.goos }}_${{ matrix.goarch }}.zip
           mv pkg/${{ matrix.goos }}_${{ matrix.goarch }}.zip ${{ env.PKG_NAME }}_${{ needs.get-product-version.outputs.product-version }}_${{ matrix.goos }}_${{ matrix.goarch }}.zip
       - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
@@ -231,7 +238,7 @@ jobs:
 
   build-darwin:
     needs: [get-go-version, get-product-version]
-    runs-on: macos-latest
+    runs-on: ${{ endsWith(github.repository, '-enterprise') && fromJSON('["self-hosted", "ondemand", "macos"]') || 'macos-latest' }}
     strategy:
       matrix:
         goos: [darwin]
@@ -245,6 +252,14 @@ jobs:
         with:
           ref: ${{ github.event.inputs.build-ref }}
 
+      - uses: ./.github/actions/vault-secrets
+        with:
+          paths: |-
+            kv/data/github/hashicorp/nomad-enterprise/gha ELEVATED_GITHUB_TOKEN ;
+      - name: Git config token
+        if: endsWith(github.repository, '-enterprise')
+        run: git config --global url.'https://${{ env.ELEVATED_GITHUB_TOKEN }}@github.com'.insteadOf 'https://github.com'
+
       - name: Setup go
         uses: actions/setup-go@4d34df0c2316fe8122ab82dc22947d607c0c91f9 # v4.0.0
         with:
@@ -274,6 +289,7 @@ jobs:
           GO_TAGS: "${{ env.GO_TAGS }} netcgo"
           CGO_ENABLED: 1
         run: |
+          go clean -cache
           make pkg/${{ matrix.goos }}_${{ matrix.goarch }}.zip
           mv pkg/${{ matrix.goos }}_${{ matrix.goarch }}.zip ${{ env.PKG_NAME }}_${{ needs.get-product-version.outputs.product-version }}_${{ matrix.goos }}_${{ matrix.goarch }}.zip
       - uses: actions/upload-artifact@0b7f8abb1508181956e8e162db84b466c27e18ce # v3.1.2
@@ -321,3 +337,4 @@ jobs:
 
 permissions:
   contents: read
+  id-token: write

.github/workflows/checks.yaml

@@ -20,12 +20,20 @@ on:
 
 jobs:
   checks:
-    runs-on: ubuntu-22.04
-    timeout-minutes: 10
+    # largest available self-hosted disk for extra iops because linting is io-intensive
+    runs-on: ${{ endsWith(github.repository, '-enterprise') && fromJSON('["self-hosted", "ondemand", "linux", "disk_gb=255"]') || 'ubuntu-22.04' }}
+    timeout-minutes: 15
     steps:
       - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
         with:
           fetch-depth: 0 # needs tags for checkproto
+      - uses: ./.github/actions/vault-secrets
+        with:
+          paths: |-
+            kv/data/github/hashicorp/nomad-enterprise/gha ELEVATED_GITHUB_TOKEN ;
+      - name: Git config token
+        if: endsWith(github.repository, '-enterprise')
+        run: git config --global url.'https://${{ env.ELEVATED_GITHUB_TOKEN }}@github.com'.insteadOf 'https://github.com'
       - uses: hashicorp/setup-golang@v1
       - name: Run make check
         run: |
@@ -34,3 +42,4 @@ jobs:
           make check
 permissions:
   contents: read
+  id-token: write

.github/workflows/release.yml

@@ -23,7 +23,7 @@ env:
 
 jobs:
   prepare-release:
-    runs-on: ubuntu-20.04
+    runs-on: ${{ endsWith(github.repository, '-enterprise') && fromJSON('["self-hosted", "ondemand", "linux"]') || 'ubuntu-20.04' }}
     outputs:
       build-ref: ${{ steps.commit-change-push.outputs.build-ref }}
     steps:
@@ -53,11 +53,15 @@ jobs:
             exit 1
           fi
       - uses: actions/checkout@8e5e7e5ab8b370d6c329ec480221332ada57f0ab # v3.5.2
-      - name: Setup Git
+      - uses: ./.github/actions/vault-secrets
+        with:
+          paths: |-
+            kv/data/github/hashicorp/nomad-enterprise/gha ELEVATED_GITHUB_TOKEN ;
+      - name: Git config token
+        if: endsWith(github.repository, '-enterprise')
+        run: git config --global url.'https://${{ env.ELEVATED_GITHUB_TOKEN }}@github.com'.insteadOf 'https://github.com'
+      - name: Git config user/name
         run: |-
-          if [ -n "${{ secrets.ELEVATED_GITHUB_TOKEN }}" ]; then
-            git config --global url."https://${{ secrets.ELEVATED_GITHUB_TOKEN }}:@github.com/".insteadOf "https://github.com"
-          fi
           git config --global user.email "github-team-nomad-core@hashicorp.com"
           git config --global user.name "hc-github-team-nomad-core"
 
@@ -141,7 +145,7 @@ jobs:
       - name: Invoke build workflow
         id: invoke-build
         env:
-          GH_TOKEN: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
+          GH_TOKEN: ${{ env.ELEVATED_GITHUB_TOKEN || secrets.ELEVATED_GITHUB_TOKEN }}
         run: |
           gh workflow run build.yml --ref ${{ github.ref_name }} --field build-ref=${{ steps.commit-change-push.outputs.build-ref }} --field make-prerelease=false
 
@@ -205,3 +209,4 @@ jobs:
 
 permissions:
   contents: write
+  id-token: write