Nomad - v1.6.0

1.6.0 (July 18, 2023)

FEATURES:

• Node Pools: Allow cluster operators to partition Nomad clients and control which jobs are allowed to run in each pool. [GH-11041]

BREAKING CHANGES:

• acl: Job evaluate endpoint now requires submit-job instead of read-job capability [GH-16463]

SECURITY:

• acl: Fixed a bug where a namespace ACL policy without label was applied to an unexpected namespace. CVE-2023-3072 [GH-17908]
• search: Fixed a bug where ACL did not filter plugin and variable names in search endpoint. CVE-2023-3300 [GH-17906]
• sentinel (Enterprise): Fixed a bug where ACL tokens could be exfiltrated via Sentinel logs CVE-2023-3299 [GH-17907]

IMPROVEMENTS:

• agent: Display server node ID in agent configuration at startup [GH-17084]
• api: enable support for storing original job source [GH-16763]
• api: return a structured error for unexpected responses [GH-16743]
• build: Publish official Docker images with the Nomad CLI [GH-17017]
• checks: Added support for Consul check field tls_server_name [GH-17334]
• cli: Add -quiet flag to nomad var init command [GH-17526]
• cli: Add check for missing host volume path in nomad config validate command [GH-17393]
• cli: Add leader status to output of nomad server members -json [GH-17138]
• cli: Add the ability to customize the details of the CA when running nomad tls ca create [GH-17309]
• cli: Sort output by Node name of the command nomad operator raft list-peers [GH-16221]
• cli: job plan help text for running the plan now includes the -namespace flag [GH-16243]
• client: check kernel module in /sys/module to help with WSL2 bridge networking [GH-17306]
• client: de-duplicate allocation client status updates and prevent allocation client status updates from being sent until clients have first synchronized with the server [GH-17074]
• client: prioritize allocation updates to reduce Raft and RPC load [GH-17354]
• cni: Ensure to setup CNI addresses in deterministic order [GH-17766]
• connect: Auto detect when to use podman for connect sidecar proxies [GH-17065]
• connect: do not restrict automatic envoy versioning to docker driver [GH-17041]
• connect: use full docker.io prefixed name for envoy image references [GH-17045]
• deploymentwatcher: Allow deployments to fail early when running out of reschedule attempts [GH-17341]
• deps: Updated Vault SDK to 0.9.0 [GH-17281]
• deps: Updated consul-template to v0.31.0 [GH-16908]
• deps: update docker to 23.0.3 [GH-16862]
• deps: update github.com/hashicorp/raft from 1.3.11 to 1.5.0 [GH-17421]
• deps: update go.etcd.io/bbolt from 1.3.6 to 1.3.7 [GH-16228]
• docker: Add group_add configuration [GH-17313]
• docker: Added option for labeling container with parent job ID of periodic/dispatch jobs [GH-17843]
• drivers: Add DisableLogCollection to task driver capabilities interface [GH-17196]
• metrics: add "total_ticks_count" counter for allocs/host CPU usage [GH-17579]
• runtime: Added 'os.build' attribute to node fingerprint on windows os [GH-17576]
• ui: Added a new Job Status Panel that helps show allocation status throughout a deployment and in steady state [GH-16134]
• ui: Adds a Download as .nomad.hcl button to jobspec editing in the UI [GH-17752]
• ui: Job status and deployment redesign [GH-16932]
• ui: Restyles "toast" notifications in the web UI with the Helios Design System [GH-16099]
• ui: add tooltips to the node and datacenter labels in the Topology page [GH-17647]
• ui: adds a toggle and localStorage property to Word Wrap logs and job definitions [GH-17754]
• ui: adds keyboard nav for switching between regions by pressing "r 1", "r 2", etc. [GH-17169]
• ui: affix page header to the top of the browser window to handle browser extension push-down gracefully [GH-17783]
• ui: change token input type from text to password [GH-17345]
• ui: remove namespace, type, and priority columns from child job table [GH-17645]
• vault: Add new configuration disable_file to prevent access to the Vault token by tasks that use image filesystem isolation [GH-13343]

DEPRECATIONS:

• envoy: remove support for envoy fallback image [GH-17044]

BUG FIXES:

• api: Fixed a bug that caused a panic when calling the Jobs().Plan() function with a job missing an ID [GH-17689]
• api: add missing constant for unknown allocation status [GH-17726]
• api: add missing field NetworkStatus for Allocation [GH-17280]
• cgroups: Fixed a bug removing all DevicesSets when alloc is created/removed [GH-17535]
• cli: Fix a panic in the nomad job restart command when monitoring replacement allocations [GH-17346]
• cli: Output error messages during deployment monitoring [GH-17348]
• client: Fixed a bug where Nomad incorrectly wrote to memory swappiness cgroup on old kernels [GH-17625]
• client: Fixed a bug where agent would panic during drain incurred by shutdown [GH-17450]
• client: fixed a bug that prevented Nomad from fingerprinting Consul 1.13.8 correctly [GH-17349]
• consul: Fixed a bug where Nomad would repeatedly try to revoke successfully revoked SI tokens [GH-17847]
• core: Fix panic around client deregistration and pending heartbeats [GH-17316]
• core: fixed a bug that caused job validation to fail when a task with kill_timeout was placed inside a group with update.progress_deadline set to 0 [GH-17342]
• csi: Fixed a bug where CSI volumes would fail to restore during client restarts [GH-17840]
• docker: Fixed a bug where network pause container would not be removed after node restart [GH-17455]
• drivers/docker: Fixed a bug where long-running docker operations would incorrectly timeout [GH-17731]
• identity: Fixed a bug where workload identities for periodic and dispatch jobs would not have access to their parent job's ACL policy [GH-17018]
• replication: Fix a potential panic when a non-authoritative region is upgraded and a server with the new version becomes the leader. [GH-17476]
• scheduler: Fixed a panic when a node has only one configured dynamic port [GH-17619]
• tls: Fixed a bug where the nomad tls cert command did not create certificates with the correct SANs for them to work with non default domain and region names. [GH-16959]
• ui: dont show a service as healthy when its parent allocation stops running [GH-17465]
• ui: fix a mirage-only issue where our mock token logs repeated unnecessarily [GH-17010]
• ui: fixed a handful of UX-related bugs during variable editing [GH-17319]
• ui: fixes an issue where the allocations table on child (periodic, parameterized) job pages wouldn't update when accessed via their parent [GH-17214]
• ui: preserve newlines when displaying shown variables in non-json mode [GH-17343]