Nomad v2.0.7 Release Notes: What Changed and How to Upgrade

Introduction

HashiCorp released Nomad v2.0.7, a patch release focused on bug fixes and a few small improvements. There is no prior known version tracked for this series on this site, so this article covers everything listed in the v2.0.7 release notes relevant to operators running Nomad clusters. Full notes: https://github.com/hashicorp/nomad/releases/tag/v2.0.7

What Is New

Improvements

• Native service discovery: wildcard namespace workload identity. The default workload identity policy now allows wildcard namespace queries for Nomad native services (GH-28534). This matters for jobs that query services across namespaces using the default workload identity instead of a custom ACL policy. Example of a service block relying on native service discovery that benefits from this default:

job "web" {
  group "web" {
    service {
      name     = "web-frontend"
      provider = "nomad"
      port     = "http"
 
      check {
        type     = "http"
        path     = "/healthz"
        interval = "10s"
        timeout  = "2s"
      }
    }
  }
}

• Dependency bumps. buf upgraded to 1.72.0, protoc-gen-go to 1.36.6, and protoc-gen-go-grpc to 1.5.1 (GH-28525). This is a build/codegen dependency change; it does not affect runtime HCL or the API surface directly, but is worth noting if you build Nomad from source or vendor its proto definitions.

• UI accessibility fixes. Color contrast issues in the web UI were fixed (GH-28022). No action needed, purely a UI improvement.

Bug Fixes

Several fixes affect cluster correctness and should be considered priority upgrades for federated or ACL-enabled deployments:

• Federation replication fixes (GH-28552). Multiple bugs are fixed in this single PR: an invalid replication token could previously delete namespaces or node pools in a federated follower region, namespaces and node pools could stop replicating between federated regions, and blocking queries would not unblock when a node pool was added automatically by node registration. If you run Nomad federation across regions, this is the most important fix in the release.

• API: job statuses error over HTTP/2 with empty request body (GH-28541). Fixes a regression that affected clients making job status requests over HTTP/2 without a body.

• Client: shutdown_delay skipped on task restart (GH-25289). Previously, restarting a task could bypass the configured shutdown_delay, which matters for graceful connection draining:

task "api" {
  driver = "docker"
 
  config {
    image = "example/api:latest"
  }
 
  shutdown_delay = "10s"
}

• Core: re-submitting unchanged job with a different ACL token no longer creates a spurious new job version and deployment (GH-26810). This prevents noisy deployment history when CI pipelines re-plan/re-run jobs with rotated tokens.

• Deployments: system job updates after a failed deployment now correctly trigger a new deployment instead of silently not updating (GH-28545).

• Docker: image_pull_timeout over 5 minutes was not being respected; it now is (GH-28543):

config {
  image              = "example/large-image:latest"
  image_pull_timeout = "10m"
}

• Identity: expired node identities are now correctly recreated by clients instead of clients getting stuck (GH-28566).

Upgrade Steps

Nomad is distributed as a standalone binary, not a Terraform provider, so there is no required_providers block to update. Upgrade the server and client binaries directly.

# Check current version
nomad version
 
# Download and install v2.0.7 (example using the HashiCorp release archive)
curl -LO https://releases.hashicorp.com/nomad/2.0.7/nomad_2.0.7_linux_amd64.zip
unzip nomad_2.0.7_linux_amd64.zip
sudo mv nomad /usr/local/bin/nomad

If you manage Nomad infrastructure with Terraform (e.g. provisioning the binary or service via the nomad provider or user_data scripts), bump any pinned version references:

# Example: Terraform variable pinning the Nomad binary version in a provisioning script
variable "nomad_version" {
  type    = string
  default = "2.0.7"
}

Follow HashiCorp's standard rolling upgrade order: upgrade server leaders/followers first, then clients, one node at a time, confirming cluster health between each step.

terraform init -upgrade
terraform plan

Verify

After upgrading each node:

nomad version
# Should report: Nomad v2.0.7
 
nomad server members
nomad node status

For federated clusters, confirm replication is healthy across regions:

nomad namespace list -region=<follower-region>
nomad node pool list -region=<follower-region>

Conclusion

Nomad v2.0.7 is a maintenance release. The standout fix is the set of federation replication bugs (GH-28552) affecting namespaces and node pools in multi-region clusters, which operators running federated Nomad should prioritize. The wildcard namespace workload identity default (GH-28534) simplifies native service discovery ACLs for new deployments. All other changes are routine bug fixes with no breaking changes or deprecations called out in the release notes.