HashiCorp Nomad

SECURITY: - dynamic host volumes: Fixed a bug where users with host-volume-delete in one namespace could delete claims from another namespace [GH-28205] IMPROVEMENTS: - cli: Add a -kv-path flag to nomad setup vault to configure the Vault KV mount used by the generated workload policy [GH-28183] - cli: Added -json and -t options to the operator autopilot get-config command. [GH-27991] - client: Add tunable for Vault default lease duration on templates for paths without leases. [GH-28199] - consul: Allow service, template, and connect blocks to fallback to the Nomad client agent's Consul token if workload identity is unavailable [GH-28106] - driver: Added optional Init function for task driver plugins [GH-28104] - driver: Added optional Shutdown function for task driver plugins [GH-28102] - scheduler: Stop failed allocations first when downscaling a task group [GH-27971] DEPRECATIONS: - agent: Unauthenticated server join via the CLI or API is deprecated. [GH-28176] BUG FIXES: - api: allow using WI tokens on plan endpoint [GH-28139] - cli: Fixed a bug where complex HCL variables passed via -var flag could not be edited in the web UI [GH-28138] - client: Fixed a bug where a client could panic after an alloc is GC'd [GH-28185] - docker: Enforce allowed_modes or allow_privileged requirement to set host namespace modes in task [GH-28190] - dynamic host volumes: Fixed a bug where allocations claiming host volumes with the per_alloc flag would not prevent the volume from being deleted [GH-28198] - metrics: expired metrics are now periodically cleared from the Prometheus sink even if no collection occurs [GH-28170] - scheduler: Fixed a bug where a node could be marked feasible for a task group requesting multiple host volumes when a satisfied sticky volume request short-circuited the checks for the remaining requests [GH-28097] - scheduler: Fixed a bug where setting sticky on a static host volume could fail the evaluation instead of being rejected during feasibility checking [GH-28097] - scheduler: keep draining batch alloc counted when node is re-enabled [GH-28018] - task runner: Improve the memory management for secrets [GH-28140] - ui: Fixed a bug where jobs that share a ModifyIndex (for example, several jobs rescheduled in a single Raft transaction after a node failure) were omitted from the jobs page and the /v1/jobs/statuses endpoint [GH-28132] - ui: fixes an issue where streaming task logs would error [GH-28137]