Merge pull request #1579 from crazy-max/update-nomad

vendor: update to github.com/hashicorp/nomad/api v1.11.1

go.mod

@@ -20,7 +20,7 @@ require (
 	github.com/eclipse/paho.mqtt.golang v1.5.1
 	github.com/go-gomail/gomail v0.0.0-20160411212932-81ebce5c23df
 	github.com/go-playground/validator/v10 v10.30.0
-	github.com/hashicorp/nomad/api v0.0.0-20250812204832-62b195aaa535 // v1.10.4
+	github.com/hashicorp/nomad/api v0.0.0-20251209201056-5b76eb053561 // v1.11.1
 	github.com/jedib0t/go-pretty/v6 v6.7.7
 	github.com/matcornic/hermes/v2 v2.1.0
 	github.com/microcosm-cc/bluemonday v1.0.27
@@ -90,7 +90,7 @@ require (
 	github.com/gorilla/css v1.0.1 // indirect
 	github.com/gorilla/mux v1.8.1 // indirect
 	github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 // indirect
-	github.com/hashicorp/cronexpr v1.1.2 // indirect
+	github.com/hashicorp/cronexpr v1.1.3 // indirect
 	github.com/hashicorp/errwrap v1.1.0 // indirect
 	github.com/hashicorp/go-cleanhttp v0.5.2 // indirect
 	github.com/hashicorp/go-multierror v1.1.1 // indirect

go.sum

@@ -166,8 +166,8 @@ github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674 h1:JeSE6pjso5T
 github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674/go.mod h1:r4w70xmWCQKmi1ONH4KIaBptdivuRPyosB9RmPlGEwA=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2 h1:8Tjv8EJ+pM1xP8mK6egEbD1OgnVTyacbefKhmbLhIhU=
 github.com/grpc-ecosystem/grpc-gateway/v2 v2.27.2/go.mod h1:pkJQ2tZHJ0aFOVEEot6oZmaVEZcRme73eIFmhiVuRWs=
-github.com/hashicorp/cronexpr v1.1.2 h1:wG/ZYIKT+RT3QkOdgYc+xsKWVRgnxJ1OJtjjy84fJ9A=
-github.com/hashicorp/cronexpr v1.1.2/go.mod h1:P4wA0KBl9C5q2hABiMO7cp6jcIg96CDh1Efb3g1PWA4=
+github.com/hashicorp/cronexpr v1.1.3 h1:rl5IkxXN2m681EfivTlccqIryzYJSXRGRNa0xeG7NA4=
+github.com/hashicorp/cronexpr v1.1.3/go.mod h1:P4wA0KBl9C5q2hABiMO7cp6jcIg96CDh1Efb3g1PWA4=
 github.com/hashicorp/errwrap v1.0.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
 github.com/hashicorp/errwrap v1.1.0 h1:OxrOeh75EUXMY8TBjag2fzXGZ40LB6IKw45YeGUDY2I=
 github.com/hashicorp/errwrap v1.1.0/go.mod h1:YH+1FKiLXxHSkmPseP+kNlulaMuP3n2brvKWEqk/Jc4=
@@ -177,8 +177,8 @@ github.com/hashicorp/go-multierror v1.1.1 h1:H5DkEtf6CXdFp0N0Em5UCwQpXMWke8IA0+l
 github.com/hashicorp/go-multierror v1.1.1/go.mod h1:iw975J/qwKPdAO1clOe2L8331t/9/fmwbPZ6JB6eMoM=
 github.com/hashicorp/go-rootcerts v1.0.2 h1:jzhAVGtqPKbwpyCPELlgNWhE1znq+qwJtW5Oi2viEzc=
 github.com/hashicorp/go-rootcerts v1.0.2/go.mod h1:pqUvnprVnM5bf7AOirdbb01K4ccR319Vf4pU3K5EGc8=
-github.com/hashicorp/nomad/api v0.0.0-20250812204832-62b195aaa535 h1:DZhOjjH4Gf6TOQYCDYwWzmnY9/jKeUWnaKEdAybhnEM=
-github.com/hashicorp/nomad/api v0.0.0-20250812204832-62b195aaa535/go.mod h1:y4olHzVXiQolzyk6QD/gqJxQTnnchlTf/QtczFFKwOI=
+github.com/hashicorp/nomad/api v0.0.0-20251209201056-5b76eb053561 h1:AjcmZgtf3Z0l+hCyPDHDo15pcLglj2ToRqXLrJIrvXk=
+github.com/hashicorp/nomad/api v0.0.0-20251209201056-5b76eb053561/go.mod h1:sldFTIgs+FsUeKU3LwVjviAIuksxD8TzDOn02MYwslE=
 github.com/hexops/gotextdiff v1.0.3 h1:gitA9+qJrrTCsiCl7+kh75nPqQt1cx4ZkudSTLoUqJM=
 github.com/hexops/gotextdiff v1.0.3/go.mod h1:pSWU5MAI3yDq+fZBTazCSJysOMbxWL1BSow5/V2vxeg=
 github.com/hinshun/vt10x v0.0.0-20220119200601-820417d04eec h1:qv2VnGeEQHchGaZ/u7lxST/RaJw+cv273q79D81Xbog=
@@ -313,8 +313,8 @@ github.com/rs/zerolog v1.34.0/go.mod h1:bJsvje4Z08ROH4Nhs5iH600c3IkWhwp44iRc54W6
 github.com/russross/blackfriday/v2 v2.0.1/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
 github.com/russross/blackfriday/v2 v2.1.0 h1:JIOH55/0cWyOuilr9/qlrm0BSXldqnqwMsf35Ld67mk=
 github.com/russross/blackfriday/v2 v2.1.0/go.mod h1:+Rmxgy9KzJVeS9/2gXHxylqXiyQDYRxCVz55jmeOWTM=
-github.com/shoenig/test v1.12.1 h1:mLHfnMv7gmhhP44WrvT+nKSxKkPDiNkIuHGdIGI9RLU=
-github.com/shoenig/test v1.12.1/go.mod h1:UxJ6u/x2v/TNs/LoLxBNJRV9DiwBBKYxXSyczsBHFoI=
+github.com/shoenig/test v1.12.2 h1:ZVT8NeIUwGWpZcKaepPmFMoNQ3sVpxvqUh/MAqwFiJI=
+github.com/shoenig/test v1.12.2/go.mod h1:UxJ6u/x2v/TNs/LoLxBNJRV9DiwBBKYxXSyczsBHFoI=
 github.com/shurcooL/sanitized_anchor_name v1.0.0/go.mod h1:1NzhyTcUVG4SuEtjjoZeVRXNmyL/1OwPU0+IJeTBvfc=
 github.com/sirupsen/logrus v1.9.3 h1:dueUQJ1C2q9oE3F7wvmSGAaVtTmUizReu6fjN8uqzbQ=
 github.com/sirupsen/logrus v1.9.3/go.mod h1:naHLuLoDiP4jHNo9R0sCBMtWGeIprob74mVsIT4qYEQ=

vendor/github.com/hashicorp/cronexpr/CODEOWNERS

@@ -0,0 +1 @@
+* @hashicorp/nomad-eng

vendor/github.com/hashicorp/nomad/api/acl.go

@@ -1232,6 +1232,8 @@ type ACLOIDCCompleteAuthRequest struct {
 	State       string
 	Code        string
 
+	Iss string
+
 	// RedirectURI is the URL that authorization should redirect to. This is a
 	// required parameter.
 	RedirectURI string
@@ -1246,3 +1248,54 @@ type ACLLoginRequest struct {
 	// LoginToken is the token used to login. This is a required parameter.
 	LoginToken string
 }
+
+// ACLIdentity is used to query the ACL identity endpoints.
+type ACLIdentity struct {
+	client *Client
+}
+
+// ACLIdentity returns a new handle on the ACL identity API client.
+func (c *Client) ACLIdentity() *ACLIdentity {
+	return &ACLIdentity{client: c}
+}
+
+// CreateClientIntroductionToken is the API endpoint used to generate a JWT
+// token to be used for introducing a new client node into the cluster.
+func (a *ACLIdentity) CreateClientIntroductionToken(
+	req *ACLIdentityClientIntroductionTokenRequest,
+	writeOpts *WriteOptions) (*ACLIdentityClientIntroductionTokenResponse, *WriteMeta, error) {
+
+	var resp ACLIdentityClientIntroductionTokenResponse
+	wm, err := a.client.put("/v1/acl/identity/client-introduction-token", req, &resp, writeOpts)
+	if err != nil {
+		return nil, nil, err
+	}
+	return &resp, wm, nil
+}
+
+// ACLIdentityClientIntroductionTokenRequest is the request object used within
+// the ACL client introduction API request. This is used to generate a JWT token
+// that can be used to register a new client node into the cluster.
+type ACLIdentityClientIntroductionTokenRequest struct {
+
+	// TTL is the requested TTL for the identity token. This is an optional
+	// parameter and if not set, defaults to the server defined default TTL.
+	TTL time.Duration
+
+	// NodeName is the name of the node that is being introduced. This is added
+	// to the token as a claim when present, but is optional.
+	NodeName string
+
+	// NodePool is the name of the node pool that this node belongs to. This is
+	// an optional parameter, and if not set, defaults to "default".
+	NodePool string
+}
+
+// ACLIdentityClientIntroductionTokenResponse is the response object used within
+// the ACL client introduction HTTP endpoint.
+type ACLIdentityClientIntroductionTokenResponse struct {
+
+	// JWT is the signed identity token that can be used as an introduction
+	// token for a new client node to register with the Nomad cluster.
+	JWT string
+}

vendor/github.com/hashicorp/nomad/api/allocations.go

@@ -185,24 +185,10 @@ func (a *Allocations) RestartAllTasks(alloc *Allocation, q *QueryOptions) error
 // Note: for cluster topologies where API consumers don't have network access to
 // Nomad clients, set api.ClientConnTimeout to a small value (ex 1ms) to avoid
 // long pauses on this API call.
-//
-// BREAKING: This method will have the following signature in 1.6.0
-// func (a *Allocations) Stop(allocID string, w *WriteOptions) (*AllocStopResponse, error) {
 func (a *Allocations) Stop(alloc *Allocation, q *QueryOptions) (*AllocStopResponse, error) {
-	// COMPAT: Remove in 1.6.0
-	var w *WriteOptions
-	if q != nil {
-		w = &WriteOptions{
-			Region:    q.Region,
-			Namespace: q.Namespace,
-			AuthToken: q.AuthToken,
-			Headers:   q.Headers,
-			ctx:       q.ctx,
-		}
-	}
-
 	var resp AllocStopResponse
-	wm, err := a.client.put("/v1/allocation/"+alloc.ID+"/stop", nil, &resp, w)
+
+	wm, err := a.client.putQuery("/v1/allocation/"+alloc.ID+"/stop", nil, &resp, q)
 	if wm != nil {
 		resp.LastIndex = wm.LastIndex
 		resp.RequestTime = wm.RequestTime
@@ -590,6 +576,18 @@ type DesiredTransition struct {
 	// Reschedule is used to indicate that this allocation is eligible to be
 	// rescheduled.
 	Reschedule *bool
+
+	// ForceReschedule is used to indicate that this allocation must be
+	// rescheduled.
+	ForceReschedule *bool
+
+	// NoShutdownDelay is used to indicate any configured shutdown delay
+	// should be ignored.
+	NoShutdownDelay *bool
+
+	// MigrateDisablePlacement is used to indicate that this allocation
+	// should not be placed during migration.
+	MigrateDisablePlacement *bool
 }
 
 // ShouldMigrate returns whether the transition object dictates a migration.
@@ -597,6 +595,27 @@ func (d DesiredTransition) ShouldMigrate() bool {
 	return d.Migrate != nil && *d.Migrate
 }
 
+// ShouldReschedule returns whether the transition object dictates a reschedule.
+func (d DesiredTransition) ShouldReschedule() bool {
+	return d.Reschedule != nil && *d.Reschedule
+}
+
+// ShouldIgnoreShutdownDelay returns whether the transition object dictates
+// ignoring the configured shutdown delay.
+func (d DesiredTransition) ShouldIgnoreShutdownDelay() bool {
+	return d.NoShutdownDelay != nil && *d.NoShutdownDelay
+}
+
+// ShouldForceReschedule returns whether the transition object dictates a forced reschedule.
+func (d DesiredTransition) ShouldForceReschedule() bool {
+	return d.ForceReschedule != nil && *d.ForceReschedule
+}
+
+// ShouldDisableMigrationPlacement returns whether the transition object dictates placement during migration
+func (d DesiredTransition) ShouldDisableMigrationPlacement() bool {
+	return d.MigrateDisablePlacement != nil && *d.MigrateDisablePlacement
+}
+
 // ExecStreamingIOOperation represents a stream write operation: either appending data or close (exclusively)
 type ExecStreamingIOOperation struct {
 	Data  []byte `json:"data,omitempty"`

vendor/github.com/hashicorp/nomad/api/consul.go

@@ -116,6 +116,7 @@ type SidecarTask struct {
 	ShutdownDelay *time.Duration         `mapstructure:"shutdown_delay" hcl:"shutdown_delay,optional"`
 	KillSignal    string                 `mapstructure:"kill_signal" hcl:"kill_signal,optional"`
 	VolumeMounts  []*VolumeMount         `hcl:"volume_mount,block"`
+	Identities    []*WorkloadIdentity    `hcl:"identity,block"`
 }
 
 func (st *SidecarTask) Canonicalize() {

vendor/github.com/hashicorp/nomad/api/csi.go

@@ -503,6 +503,7 @@ type CSIVolumeRegisterRequest struct {
 type CSIVolumeRegisterResponse struct {
 	Volumes  []*CSIVolume
 	Warnings string
+	QueryMeta
 }
 
 type CSIVolumeDeregisterRequest struct {

vendor/github.com/hashicorp/nomad/api/evaluations.go

@@ -46,7 +46,7 @@ func (e *Evaluations) Count(q *QueryOptions) (*EvalCountResponse, *QueryMeta, er
 // Info is used to query a single evaluation by its ID.
 func (e *Evaluations) Info(evalID string, q *QueryOptions) (*Evaluation, *QueryMeta, error) {
 	var resp Evaluation
-	qm, err := e.client.query("/v1/evaluation/"+evalID, &resp, q)
+	qm, err := e.client.query("/v1/evaluation/"+evalID+"?related=true", &resp, q)
 	if err != nil {
 		return nil, nil, err
 	}
@@ -116,6 +116,7 @@ type Evaluation struct {
 	BlockedEval          string
 	RelatedEvals         []*EvaluationStub
 	FailedTGAllocs       map[string]*AllocationMetric
+	PlanAnnotations      *PlanAnnotations
 	ClassEligibility     map[string]bool
 	EscapedComputedClass bool
 	QuotaLimitReached    string

vendor/github.com/hashicorp/nomad/api/event_stream.go

@@ -181,6 +181,10 @@ func (e *EventStream) Stream(ctx context.Context, topics map[Topic][]string, ind
 
 	// Build topic query params
 	for topic, keys := range topics {
+		if len(keys) == 0 {
+			r.params.Add("topic", fmt.Sprintf("%s", topic))
+			continue
+		}
 		for _, k := range keys {
 			r.params.Add("topic", fmt.Sprintf("%s:%s", topic, k))
 		}

vendor/github.com/hashicorp/nomad/api/jobs.go

@@ -120,12 +120,13 @@ func (j *Jobs) Validate(job *Job, q *WriteOptions) (*JobValidateResponse, *Write
 
 // RegisterOptions is used to pass through job registration parameters
 type RegisterOptions struct {
-	EnforceIndex   bool
-	ModifyIndex    uint64
-	PolicyOverride bool
-	PreserveCounts bool
-	EvalPriority   int
-	Submission     *JobSubmission
+	EnforceIndex      bool
+	ModifyIndex       uint64
+	PolicyOverride    bool
+	PreserveCounts    bool
+	PreserveResources bool
+	EvalPriority      int
+	Submission        *JobSubmission
 }
 
 // Register is used to register a new job. It returns the ID
@@ -152,6 +153,7 @@ func (j *Jobs) RegisterOpts(job *Job, opts *RegisterOptions, q *WriteOptions) (*
 		}
 		req.PolicyOverride = opts.PolicyOverride
 		req.PreserveCounts = opts.PreserveCounts
+		req.PreserveResources = opts.PreserveResources
 		req.EvalPriority = opts.EvalPriority
 		req.Submission = opts.Submission
 	}
@@ -1227,7 +1229,7 @@ func (j *Job) Canonicalize() {
 	}
 	if j.Update != nil {
 		j.Update.Canonicalize()
-	} else if *j.Type == JobTypeService {
+	} else if *j.Type == JobTypeService || *j.Type == JobTypeSystem {
 		j.Update = DefaultUpdateStrategy()
 	}
 	if j.Multiregion != nil {
@@ -1486,10 +1488,11 @@ type JobRegisterRequest struct {
 	// If EnforceIndex is set then the job will only be registered if the passed
 	// JobModifyIndex matches the current Jobs index. If the index is zero, the
 	// register only occurs if the job is new.
-	EnforceIndex   bool   `json:",omitempty"`
-	JobModifyIndex uint64 `json:",omitempty"`
-	PolicyOverride bool   `json:",omitempty"`
-	PreserveCounts bool   `json:",omitempty"`
+	EnforceIndex      bool   `json:",omitempty"`
+	JobModifyIndex    uint64 `json:",omitempty"`
+	PolicyOverride    bool   `json:",omitempty"`
+	PreserveCounts    bool   `json:",omitempty"`
+	PreserveResources bool   `json:",omitempty"`
 
 	// EvalPriority is an optional priority to use on any evaluation created as
 	// a result on this job registration. This value must be between 1-100
@@ -1596,6 +1599,10 @@ type DesiredUpdates struct {
 	DestructiveUpdate uint64
 	Canary            uint64
 	Preemptions       uint64
+	Disconnect        uint64
+	Reconnect         uint64
+	RescheduleNow     uint64
+	RescheduleLater   uint64
 }
 
 type JobDispatchRequest struct {

vendor/github.com/hashicorp/nomad/api/keyring.go

@@ -43,10 +43,10 @@ type RootKeyState string
 
 const (
 	RootKeyStateInactive     RootKeyState = "inactive"
-	RootKeyStateActive                    = "active"
-	RootKeyStateRekeying                  = "rekeying"
-	RootKeyStateDeprecated                = "deprecated"
-	RootKeyStatePrepublished              = "prepublished"
+	RootKeyStateActive       RootKeyState = "active"
+	RootKeyStateRekeying     RootKeyState = "rekeying"
+	RootKeyStateDeprecated   RootKeyState = "deprecated"
+	RootKeyStatePrepublished RootKeyState = "prepublished"
 )
 
 // List lists all the keyring metadata

vendor/github.com/hashicorp/nomad/api/node_identity.go

@@ -0,0 +1,73 @@
+// Copyright (c) HashiCorp, Inc.
+// SPDX-License-Identifier: MPL-2.0
+
+package api
+
+// NodeIdentityGetRequest represents the request to retrieve the node identity
+// claims for a specific node.
+type NodeIdentityGetRequest struct {
+	NodeID string
+}
+
+// NodeIdentityGetResponse represents the response containing the node identity
+// claims.
+type NodeIdentityGetResponse struct {
+	Claims map[string]any
+}
+
+type NodeIdentityRenewRequest struct {
+	NodeID string
+}
+
+type NodeIdentityRenewResponse struct{}
+
+type NodeIdentity struct {
+	client *Client
+}
+
+func (n *Nodes) Identity() *NodeIdentity {
+	return &NodeIdentity{client: n.client}
+}
+
+// Get retrieves the node identity claims for the node specified within the
+// request object.
+//
+// The request uses query options to control the forwarding behavior of the
+// request only. Parameters such as Filter, WaitTime, and WaitIndex are not used
+// and ignored.
+func (n *NodeIdentity) Get(req *NodeIdentityGetRequest, qo *QueryOptions) (*NodeIdentityGetResponse, error) {
+
+	if qo == nil {
+		qo = &QueryOptions{}
+	}
+
+	if qo.Params == nil {
+		qo.Params = make(map[string]string)
+	}
+
+	if req.NodeID != "" {
+		qo.Params["node_id"] = req.NodeID
+	}
+
+	var out NodeIdentityGetResponse
+
+	if _, err := n.client.query("/v1/client/identity", &out, qo); err != nil {
+		return nil, err
+	}
+	return &out, nil
+}
+
+// Renew instructs the node to request a new identity from the server at its
+// next heartbeat.
+//
+// The request uses query options to control the forwarding behavior of the
+// request only. Parameters such as Filter, WaitTime, and WaitIndex are not used
+// and ignored.
+func (n *NodeIdentity) Renew(req *NodeIdentityRenewRequest, qo *QueryOptions) (*NodeIdentityRenewResponse, error) {
+	var out NodeIdentityRenewResponse
+	_, err := n.client.postQuery("/v1/client/identity/renew", req, &out, qo)
+	if err != nil {
+		return nil, err
+	}
+	return &out, nil
+}

vendor/github.com/hashicorp/nomad/api/node_pools.go

@@ -4,9 +4,11 @@
 package api
 
 import (
+	"encoding/json"
 	"errors"
 	"fmt"
 	"net/url"
+	"time"
 )
 
 const (
@@ -118,11 +120,59 @@ type NodePool struct {
 	Name                   string                          `hcl:"name,label"`
 	Description            string                          `hcl:"description,optional"`
 	Meta                   map[string]string               `hcl:"meta,block"`
+	NodeIdentityTTL        time.Duration                   `hcl:"node_identity_ttl,optional"`
 	SchedulerConfiguration *NodePoolSchedulerConfiguration `hcl:"scheduler_config,block"`
 	CreateIndex            uint64
 	ModifyIndex            uint64
 }
 
+// MarshalJSON implements the json.Marshaler interface and allows
+// NodePool.NodeIdentityTTL to be marshaled correctly.
+func (n *NodePool) MarshalJSON() ([]byte, error) {
+	type Alias NodePool
+	exported := &struct {
+		NodeIdentityTTL string
+		*Alias
+	}{
+		NodeIdentityTTL: n.NodeIdentityTTL.String(),
+		Alias:           (*Alias)(n),
+	}
+	if n.NodeIdentityTTL == 0 {
+		exported.NodeIdentityTTL = ""
+	}
+	return json.Marshal(exported)
+}
+
+// UnmarshalJSON implements the json.Unmarshaler interface and allows
+// NodePool.NodeIdentityTTL to be unmarshalled correctly.
+func (n *NodePool) UnmarshalJSON(data []byte) (err error) {
+	type Alias NodePool
+	aux := &struct {
+		NodeIdentityTTL any
+		*Alias
+	}{
+		Alias: (*Alias)(n),
+	}
+
+	if err = json.Unmarshal(data, &aux); err != nil {
+		return err
+	}
+	if aux.NodeIdentityTTL != nil {
+		switch v := aux.NodeIdentityTTL.(type) {
+		case string:
+			if v != "" {
+				if n.NodeIdentityTTL, err = time.ParseDuration(v); err != nil {
+					return err
+				}
+			}
+		case float64:
+			n.NodeIdentityTTL = time.Duration(v)
+		}
+
+	}
+	return nil
+}
+
 // NodePoolSchedulerConfiguration is used to serialize the scheduler
 // configuration of a node pool.
 type NodePoolSchedulerConfiguration struct {

vendor/github.com/hashicorp/nomad/api/nodes.go

@@ -542,14 +542,19 @@ type DrainMetadata struct {
 
 // Node is used to deserialize a node entry.
 type Node struct {
-	ID                    string
-	Datacenter            string
-	Name                  string
-	HTTPAddr              string
-	TLSEnabled            bool
-	Attributes            map[string]string
-	Resources             *Resources
-	Reserved              *Resources
+	ID         string
+	Datacenter string
+	Name       string
+	HTTPAddr   string
+	TLSEnabled bool
+	Attributes map[string]string
+
+	// DEPRECATED: will be removed in Nomad 1.12.0. Use NodeResources.
+	Resources *Resources
+
+	// DEPRECATED: will be removed in Nomad 1.12.0. Use ReservedResources.
+	Reserved *Resources
+
 	NodeResources         *NodeResources
 	ReservedResources     *NodeReservedResources
 	Links                 map[string]string

vendor/github.com/hashicorp/nomad/api/tasks.go

@@ -202,6 +202,9 @@ func (r *ReschedulePolicy) Merge(rp *ReschedulePolicy) {
 }
 
 func (r *ReschedulePolicy) Canonicalize(jobType string) {
+	if r == nil {
+		return
+	}
 	dp := NewDefaultReschedulePolicy(jobType)
 	if r.Interval == nil {
 		r.Interval = dp.Interval
@@ -282,20 +285,12 @@ func NewDefaultReschedulePolicy(jobType string) *ReschedulePolicy {
 			Unlimited: pointerOf(false),
 		}
 
-	case "system":
-		dp = &ReschedulePolicy{
-			Attempts:      pointerOf(0),
-			Interval:      pointerOf(time.Duration(0)),
-			Delay:         pointerOf(time.Duration(0)),
-			DelayFunction: pointerOf(""),
-			MaxDelay:      pointerOf(time.Duration(0)),
-			Unlimited:     pointerOf(false),
-		}
-
 	default:
 		// GH-7203: it is possible an unknown job type is passed to this
 		// function and we need to ensure a non-nil object is returned so that
 		// the canonicalization runs without panicking.
+		// This also applies to batch/sysbatch jobs, which do not reschedule;
+		// we still want to return a safe object.
 		dp = &ReschedulePolicy{
 			Attempts:      pointerOf(0),
 			Interval:      pointerOf(time.Duration(0)),
@@ -583,13 +578,10 @@ func (g *TaskGroup) Canonicalize(job *Job) {
 		jobReschedule := job.Reschedule.Copy()
 		g.ReschedulePolicy = jobReschedule
 	}
-	// Only use default reschedule policy for non system jobs
-	if g.ReschedulePolicy == nil && *job.Type != "system" {
+	if g.ReschedulePolicy == nil && *job.Type != JobTypeSysbatch && *job.Type != JobTypeSystem {
 		g.ReschedulePolicy = NewDefaultReschedulePolicy(*job.Type)
 	}
-	if g.ReschedulePolicy != nil {
-		g.ReschedulePolicy.Canonicalize(*job.Type)
-	}
+	g.ReschedulePolicy.Canonicalize(*job.Type)
 
 	// Merge the migrate strategy from the job
 	if jm, tm := job.Migrate != nil, g.Migrate != nil; jm && tm {
@@ -794,6 +786,7 @@ type Task struct {
 	KillSignal      string                 `mapstructure:"kill_signal" hcl:"kill_signal,optional"`
 	Kind            string                 `hcl:"kind,optional"`
 	ScalingPolicies []*ScalingPolicy       `hcl:"scaling,block"`
+	Secrets         []*Secret              `hcl:"secret,block"`
 
 	// Identity is the default Nomad Workload Identity and will be added to
 	// Identities with the name "default"
@@ -833,6 +826,9 @@ func (t *Task) Canonicalize(tg *TaskGroup, job *Job) {
 	for _, tmpl := range t.Templates {
 		tmpl.Canonicalize()
 	}
+	for _, s := range t.Secrets {
+		s.Canonicalize()
+	}
 	for _, s := range t.Services {
 		s.Canonicalize(t, tg, job)
 	}
@@ -1050,6 +1046,24 @@ func (v *Vault) Canonicalize() {
 	}
 }
 
+type Secret struct {
+	Name     string            `hcl:"name,label"`
+	Provider string            `hcl:"provider,optional"`
+	Path     string            `hcl:"path,optional"`
+	Config   map[string]any    `hcl:"config,block"`
+	Env      map[string]string `hcl:"env,block"`
+}
+
+func (s *Secret) Canonicalize() {
+	if len(s.Config) == 0 {
+		s.Config = nil
+	}
+
+	if len(s.Env) == 0 {
+		s.Env = nil
+	}
+}
+
 // NewTask creates and initializes a new Task.
 func NewTask(name, driver string) *Task {
 	return &Task{

vendor/modules.txt

@@ -226,7 +226,7 @@ github.com/gorilla/mux
 # github.com/gorilla/websocket v1.5.4-0.20250319132907-e064f32e3674
 ## explicit; go 1.20
 github.com/gorilla/websocket
-# github.com/hashicorp/cronexpr v1.1.2
+# github.com/hashicorp/cronexpr v1.1.3
 ## explicit
 github.com/hashicorp/cronexpr
 # github.com/hashicorp/errwrap v1.1.0
@@ -241,7 +241,7 @@ github.com/hashicorp/go-multierror
 # github.com/hashicorp/go-rootcerts v1.0.2
 ## explicit; go 1.12
 github.com/hashicorp/go-rootcerts
-# github.com/hashicorp/nomad/api v0.0.0-20250812204832-62b195aaa535
+# github.com/hashicorp/nomad/api v0.0.0-20251209201056-5b76eb053561
 ## explicit; go 1.20
 github.com/hashicorp/nomad/api
 github.com/hashicorp/nomad/api/contexts