Merge branch 'main' into job-start

.changelog/23671.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+cli: Added synopsis for `operator root` and `operator gossip` command
+```

.changelog/23956.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+networking: Added an option to ignore static port collisions when scheduling, for programs that use the SO_REUSEPORT unix socket option
+```

.changelog/23964.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+metrics: introduce client config to include alloc metadata as part of the base labels
+```

.changelog/23966.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+docker: Use official docker SDK instead of a 3rd party client
+```

.changelog/23977.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+keyring: Stored wrapped data encryption keys in Raft
+```

.changelog/24007.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+bug: Allow client template config block to be parsed when using json config
+```

.changelog/24023.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+cli: Added redaction options to operator snapshot commands
+```

.changelog/24029.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+raft: Bump raft to v1.7.1 which includes pre-vote. This should make servers more stable after network partitions
+```

.changelog/24038.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+identity: Added filepath parameter to identity block for persisting workload identities
+```

.changelog/24052.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+task: adds node.pool attribute to interpretable values in task env
+```

.changelog/24054.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+cli: Fixed a bug in job status command where -t would act as though -json was also set
+```

.changelog/24055.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+jobs: Added Version Tags to job versions, to prevent them from being garbage collected and allow for diffs
+```

.changelog/24057.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+template: Fixed a panic on client restart when using change_mode=script
+```

.changelog/24058.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+deps: Upgraded yamux to v0.1.2 to fix a bug where RPC connections could deadlock
+```

.changelog/24065.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+scaling: Fixed a bug where scaling policies would not get created during job submission unless namespace field was set in jobspec
+```

.changelog/24073.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fixes an issue where variables paths would not let namespaced users write variables unless they also had wildcard namespace variable write permissions
+```

.changelog/24125.txt

@@ -0,0 +1,3 @@
+```release-note:security
+security: Fixed a bug in client FS API where the check to prevent reads from the secrets dir could be bypassed on case-insensitive file systems
+```

.changelog/24127.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+state: Fixed a bug where compatibility updates for node topology for nodes older than 1.7.0 were not being correctly applied
+```

.changelog/24157.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+getter: Added option to chown artifact(s) to task user
+```

.changelog/24162.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fix an issue where a dropdown on the variables page would appear underneath table headers
+```

.changelog/24165.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+scheduler: fixes reconnecting allocations not getting picked correctly when replacements failed
+```

.changelog/24166.txt

@@ -0,0 +1,7 @@
+```release-note:bug
+consul: Fixed a bug where broken Consul ACL tokens could block registration and deregistration of services and checks
+```
+
+```release-note:bug
+consul: Fixed a bug where service deregistration could fail because Consul ACL tokens were revoked during allocation GC
+```

.changelog/24169.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+fingerprint gce: fingerprint preemptibility
+```

.changelog/24202.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+docker: Fixed a bug where alloc exec with stdin would hang
+```

.changelog/24214.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+windows: Fixed a bug where a crashed executor would orphan task processes
+```

.changelog/24215.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+docker: Fix incorrect auth parsing for private registries
+```

.changelog/24229.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+docker: Fixed a bug where task CPU stats were reported incorrectly
+```

.changelog/24232.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+cli: Updated example job specifications in nomad job init
+```

.changelog/24237.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+docker: Always negotiate API version when initializing clients
+```

.changelog/24240.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Put a max-width on token name so it doesn't collide with the search box in the top nav
+```

.changelog/24241.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+heartbeat: Fixed a bug where failed nodes would not be marked down
+```

.changelog/24244.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+docker: Fixed a bug where alloc exec could leak a goroutine
+```

.changelog/24265.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+deps: Fixed a bug where restarting Nomad could cause an unrelated process with the same PID as a failed executor to be killed
+```

.changelog/24272.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+cli: Corrected an ordering mistake in job tag unset help text
+```

.github/dependabot.yml

@@ -1,3 +1,6 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: BUSL-1.1
+
 version: 2
 updates:
   - package-ecosystem: gomod
@@ -37,3 +40,13 @@ updates:
     labels:
       - "theme/dependencies"
       - "theme/website"
+  - package-ecosystem: github-actions
+    open-pull-requests-limit: 5
+    directory: /
+    labels:
+      - "theme/dependencies"
+      - "theme/ci"
+    schedule:
+      interval: "weekly"
+      day: "sunday"
+      time: "09:00"

.github/scan.hcl

@@ -0,0 +1,55 @@
+# Copyright (c) HashiCorp, Inc.
+# SPDX-License-Identifier: BUSL-1.1
+
+# Configuration for security scanner.
+# Run on PRs and pushes to `main` and `release/**` branches.
+# See .github/workflows/security-scan.yml for CI config.
+
+# To run manually, install scanner and then run `scan repository .`
+
+# Scan results are triaged via the GitHub Security tab for this repo.
+# See `security-scanner` docs for more information on how to add `triage` config
+# for specific results or to exclude paths.
+
+# This file controls scanning the repository only, not release artifacts. See
+# .release/security-scan.hcl for the scanner config for release artifacts, which
+# will block releases.
+
+repository {
+  go_modules             = true
+  npm                    = true
+  osv                    = true
+  go_stdlib_version_file = ".go-version"
+
+  secrets {
+    all               = true
+    skip_path_strings = ["/website/content/"]
+  }
+
+  github_actions {
+    pinned_hashes = true
+  }
+
+  dependabot {
+    required     = true
+    check_config = true
+  }
+
+  dockerfile {
+    pinned_hashes = true
+    curl_bash     = true
+  }
+
+  # Triage items that are _safe_ to ignore here. Note that this list should be
+  # periodically cleaned up to remove items that are no longer found by the scanner.
+  triage {
+    suppress {
+      paths = [
+        "ui/tests/*",
+        "internal/testing/*",
+        "testutil/*",
+        "website/content/*",
+      ]
+    }
+  }
+}

.github/workflows/actionlint.yml

@@ -10,6 +10,6 @@ jobs:
   actionlint:
     runs-on: ubuntu-latest
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
       - name: "Check workflow files"
         uses: docker://docker.mirror.hashicorp.services/rhysd/actionlint:latest

.github/workflows/backport.yml

@@ -48,15 +48,15 @@ jobs:
       - backport
       - backport-ent
     if: always() && (needs.backport.result == 'failure' || needs.backport-ent.result == 'failure')
-    runs-on: ${{ endsWith(github.repository, '-enterprise') && fromJSON('["self-hosted", "ondemand", "linux"]') || 'ubuntu-latest' }}
+    runs-on: ${{ endsWith(github.repository, '-enterprise') && fromJSON('["self-hosted", "ondemand", "linux", "type=m7a.2xlarge;m6a.2xlarge"]') || 'ubuntu-latest' }}
     steps:
-      - uses: actions/checkout@692973e3d937129bcbf40652eb9f2f61becf3332 # v4.1.7
+      - uses: actions/checkout@eef61447b9ff4aafe5dcd4e0bbf5d482be7e7871 # v4.2.1
       - uses: ./.github/actions/vault-secrets
         with:
           paths: |-
             kv/data/teams/nomad/slack-webhooks feed-nomad | SLACK_FEED_NOMAD ;
       - name: Send slack notification on failure
-        uses: slackapi/slack-github-action@70cd7be8e40a46e8b0eced40b0de447bdb42f68e # v1.26.0
+        uses: slackapi/slack-github-action@37ebaef184d7626c5f204ab8d3baff4262dd30f0 # v1.27.0
         with:
           payload: |
             {