backport 13205 to 1.2.x

.changelog/11878.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+core: Fixed auto-promotion of canaries in jobs with at least one task group without canaries.
+```

.changelog/11889.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+build: upgrade and speedup circleci configuration
+```

.changelog/11896.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fix the link target for CSI volumes on the task detail page
+```

.changelog/11927.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+jobspec: Fixed a bug where connect sidecar resources were ignored when using HCL1
+```

.changelog/11944.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+core: prevent malformed plans from crashing leader
+```

.changelog/11945.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+Fixed a bug where successful poststart tasks were marked as unhealthy
+```

.changelog/11956.txt

@@ -0,0 +1,3 @@
+```release-note:security
+server: validate mTLS certificate names on agent to agent endpoints
+```

.changelog/11980.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: fix the unit for the task row memory usage metric
+```

.changelog/11983.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+cleanup: prevent leaks from time.After
+```

.changelog/12044.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+config: Fixed a bug where the `reservable_cores` setting was not respected
+```

.changelog/12050.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+csi: provide `CSI_ENDPOINT` environment variable to plugin tasks
+```

.changelog/12051.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+csi: fixed a bug where `volume detach`, `volume deregister`, and `volume status` commands did not accept an exact ID if multiple volumes matched the prefix
+```

.changelog/12057.txt

@@ -0,0 +1,7 @@
+```release-note:bug
+csi: Fixed a bug where the plugin instance manager would not retry the initial gRPC connection to plugins
+```
+
+```release-note:bug
+csi: Fixed a bug where the plugin supervisor would not restart the task if it failed to connect to the plugin
+```

.changelog/12112.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+csi: Fixed a bug where the maximum number of volume claims was incorrectly enforced when an allocation claims a volume
+```

.changelog/12113.txt

@@ -0,0 +1,7 @@
+```release-note:bug
+csi: Fixed a bug where allocations with volume claims would fail their first placement after a reschedule
+```
+
+```release-note:bug
+csi: Fixed a bug where allocations with volume claims would fail to restore after a client restart
+```

.changelog/12114.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+csi: Fixed a bug where purging a job with a missing plugin would fail
+```

.changelog/12178.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+csi: Fixed a bug where fields were missing from the Read Volume API response
+```

.changelog/12184.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+api: Apply prefix filter when querying CSI volumes in all namespaces
+```

.changelog/12194.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+csi: Fixed a bug where `plugin status` commands could choose the incorrect plugin if a plugin with a name that matched the same prefix existed.
+```

.changelog/12195.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+csi: Fixed a bug where creating snapshots required a plugin ID instead of falling back to the volume's plugin ID
+```

.changelog/12197.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+csi: Fixed a bug where `volume snapshot list` did not correctly filter by plugin IDs. The `-plugin` parameter is required.
+```

.changelog/12264.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+scheduler: fixed a bug where in-place updates on ineligible nodes would be ignored
+```

.changelog/12337.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+csi: Fixed a bug where single-use access modes were not enforced during validation
+```

.changelog/12350.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+csi: Fixed a bug where garbage collected nodes would block releasing a volume
+```

.changelog/12352.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+csi: Fixed a bug where volume snapshot timestamps were always zero values
+```

.changelog/12359.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+csi: Fixed a bug where plugins written in NodeJS could fail to fingerprint
+```

.changelog/12553.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+csi: Fixed bug where accessing plugins was subject to a data race
+```

.changelog/12573.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+csi: Fixed a bug where per-alloc volumes used the incorrect ID when querying for `alloc status -verbose`
+```

.changelog/12593.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+client: Fixed a bug where clients that retry blocking queries would not reset the correct blocking duration
+```

.changelog/12752.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+csi: Fixed a bug where plugins would not restart if they failed any time after a client restart
+```

.changelog/12774.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+csi: Fixed a bug where plugin configuration updates were not considered destructive
+```

.changelog/12779.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+client: Fixed a bug that could prevent a preempting alloc from ever starting.
+```

.changelog/12817.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+client: Fixed a bug where network.dns block was not interpolated
+```

.changelog/13008.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+volumes: Fixed a bug where additions, updates, or removals of host volumes or CSI volumes were not treated as destructive updates
+```

.changelog/13057.txt

@@ -0,0 +1,3 @@
+```release-note:security
+A vulnerability was identified in the go-getter library that Nomad uses for its artifacts such that a specially crafted Nomad jobspec can be used for privilege escalation onto client agent hosts. [CVE-2022-30324](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-30324)
+```

.changelog/13104.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+core: Fixed a bug where blocked eval resources were incorrectly computed
+```

.changelog/13205.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+core: Fixed a bug where an evicted batch job would not be rescheduled
+```

.circleci/config.yml

@@ -3,15 +3,12 @@ version: 2.1
 references:
   # environment specific references - aim to avoid conflicts
   go-machine-image: &go_machine_image
-    circleci/classic:201808-01
-  go-machine-recent-image: &go_machine_recent_image
-    ubuntu-1604:201903-01
+    ubuntu-2004:202111-02
   go-windows-image: &go_windows_image
     windows-server-2019-vs2019:stable
 
   # common references
   common_envs: &common_envs
-    GOMAXPROCS: 1
     NOMAD_SLOW_TEST: 1
     GOTESTSUM_JUNITFILE: /tmp/test-reports/results.xml
     GOTESTSUM_JSONFILE: /tmp/test-reports/testjsonfile.json
@@ -161,43 +158,6 @@ commands:
             fi
 
 jobs:
-  website-docker-image:
-    docker:
-      - image: docker.mirror.hashicorp.services/circleci/buildpack-deps
-    shell: /usr/bin/env bash -euo pipefail -c
-    steps:
-      - checkout
-      - run:
-          name: Skip building if nothing changed
-          command: |
-            # There is an edge case that would cause an issue here - if dependencies are updated to an exact copy
-            # of a previous version, for example if packge-lock.json is reverted, we need to manually push the new
-            # image to the "latest" tag
-            # Ignore job if running an enterprise build
-            IMAGE_TAG=$(cat website/Dockerfile website/package-lock.json | sha256sum | awk '{print $1;}')
-            echo "Using $IMAGE_TAG"
-
-            if  [ "$CIRCLE_REPOSITORY_URL" != "git@github.com:hashicorp/nomad.git" ]; then
-              echo "Not Nomad OSS Repo, not building website docker image"
-              circleci-agent step halt
-            elif curl https://hub.docker.com/v2/repositories/hashicorp/nomad-website/tags/$IMAGE_TAG -fsL > /dev/null; then
-              echo "Dependencies have not changed, not building a new website docker image."
-              circleci-agent step halt
-            fi
-
-      - setup_remote_docker
-      - run:
-          name: Build Docker Image
-          command: |
-            IMAGE_TAG=$(cat website/Dockerfile website/package-lock.json | sha256sum | awk '{print $1;}')
-            echo "Using $IMAGE_TAG"
-
-            cd website/
-            docker build -t hashicorp/nomad-website:$IMAGE_TAG .
-            docker tag hashicorp/nomad-website:$IMAGE_TAG hashicorp/nomad-website:latest
-            docker login -u $WEBSITE_DOCKER_USER -p $WEBSITE_DOCKER_PASS
-            docker push hashicorp/nomad-website
-
   test-windows:
     executor: go-windows
 
@@ -289,7 +249,7 @@ jobs:
         default: ""
       executor:
         type: string
-        default: "go-machine-recent"
+        default: "go-machine"
       goarch:
         type: string
         default: "amd64"
@@ -492,27 +452,12 @@ jobs:
       - store_artifacts:
           path: /tmp/ui-assets
           destination: /ui-assets
-  algolia_index:
-    docker:
-      - image: docker.mirror.hashicorp.services/node:14
-    steps:
-      - checkout
-      - run:
-          name: Push content to Algolia Index
-          command: |
-            if  [ "$CIRCLE_REPOSITORY_URL" != "git@github.com:hashicorp/nomad.git" ]; then
-              echo "Not Nomad OSS Repo, not indexing Algolia"
-              exit 0
-            fi
-
-            cd website/
-            npm install
-            node scripts/index_search_content.js
 executors:
   go:
     working_directory: /go/src/github.com/hashicorp/nomad
     docker:
-      - image: docker.mirror.hashicorp.services/golang:1.17.5
+      - image: docker.mirror.hashicorp.services/golang:1.17.9
+    resource_class: medium
     environment:
       <<: *common_envs
       GOPATH: /go
@@ -521,18 +466,10 @@ executors:
     working_directory: ~/go/src/github.com/hashicorp/nomad
     machine:
       image: *go_machine_image
+      resource_class: large
     environment: &machine_env
       <<: *common_envs
-      GOPATH: /home/circleci/go
-      GOLANG_VERSION: 1.17.5
-
-  # uses a more recent image with unattended upgrades disabled properly
-  # but seems to break docker builds
-  go-machine-recent:
-    working_directory: ~/go/src/github.com/hashicorp/nomad
-    machine:
-      image: *go_machine_recent_image
-    environment: *machine_env
+      GOLANG_VERSION: 1.17.9
 
   go-macos:
     working_directory: ~/go/src/github.com/hashicorp/nomad
@@ -541,7 +478,7 @@ executors:
     environment:
       <<: *common_envs
       GOPATH: /Users/distiller/go
-      GOLANG_VERSION: 1.17.5
+      GOLANG_VERSION: 1.17.9
 
   go-windows:
     machine:
@@ -553,8 +490,8 @@ executors:
       GOPATH: c:\gopath
       GOBIN: c:\gopath\bin
       GOTESTSUM_PATH: c:\tmp\test-reports
-      GOLANG_VERSION: 1.17.5
-      GOTESTSUM_VERSION: 0.4.2
+      GOLANG_VERSION: 1.17.9
+      GOTESTSUM_VERSION: 1.7.0
       VAULT_VERSION: 1.4.1
 
 workflows:
@@ -567,7 +504,6 @@ workflows:
             branches:
               ignore:
                 - stable-website
-                - /^.-ui\b.*/
 
       - lint-go:
           # check branches are almost all the backend branches
@@ -636,9 +572,6 @@ workflows:
       - test-machine:
           name: "test-docker"
           test_packages: "./drivers/docker"
-          # docker is misbehaving in docker-machine-recent image
-          # and we get unexpected failures
-          # e.g. https://circleci.com/gh/hashicorp/nomad/3854
           executor: go-machine
           filters: *backend_test_branches_filter
       - test-machine:
@@ -656,20 +589,3 @@ workflows:
           test_packages: "./client/fingerprint"
           goarch: "386"
           filters: *backend_test_branches_filter
-  website:
-    when:
-      equal: [ "https://github.com/hashicorp/nomad", << pipeline.project.git_url >> ]
-    jobs:
-      - website-docker-image:
-          context: static-sites
-          filters:
-            branches:
-              only:
-                - main
-
-      - algolia_index:
-          context: static-sites
-          filters:
-            branches:
-              only:
-                - stable-website