github.com/hashicorp/consul/api

BREAKING CHANGES:

• connect: Disallow wildcard as name for service-defaults. [GH-10069]
• connect: avoid encoding listener info in ingress and terminating gateway listener stats names. [GH-10404]
• licensing: (Enterprise Only) Consul Enterprise 1.10 has removed API driven licensing of servers in favor of license loading via configuration. The PUT and DELETE methods on the /v1/operator/license endpoint will now return 405s, the consul license put and consul license reset CLI commands have been removed and the LicensePut and LicenseReset methods in the API client have been altered to always return an error. [GH-10211]
• licensing: (Enterprise Only) Consul Enterprise client agents now require a valid non-anonymous ACL token for retrieving their license from the servers. Additionally client agents rely on the value of the start_join and retry_join configurations for determining the servers to query for the license. Therefore one must be set to use license auto-retrieval. [GH-10248]
• licensing: (Enterprise Only) Consul Enterprise has removed support for temporary licensing. All server agents must have a valid license at startup and client agents must have a license at startup or be able to retrieve one from the servers. [GH-10248]

FEATURES:

• checks: add H2 ping health checks. [GH-8431]
• cli: Add additional flags to the consul connect redirect-traffic command to allow excluding inbound and outbound ports, outbound CIDRs, and additional user IDs from traffic redirection. [GH-10134]
• cli: Add new consul connect redirect-traffic command for applying traffic redirection rules when Transparent Proxy is enabled. [GH-9910]
• cli: Add prefix option to kv import command [GH-9792]
• cli: Automatically exclude ports from envoy_prometheus_bind_addr, envoy_stats_bind_addr, and ListenerPort from Expose config from inbound traffic redirection rules if proxy-id flag is provided to the consul connect redirect-traffic command. [GH-10134]
• cli: snapshot inspect command provides KV usage breakdown [GH-9098]
• cli: snapshot inspect command supports JSON output [GH-9006]
• connect: Add local_request_timeout_ms to allow configuring the Envoy request timeout on local_app [GH-9554]
• connect: add support for unix domain sockets addresses for service upstreams and downstreams [GH-9981]
• connect: add toggle to globally disable wildcard outbound network access when transparent proxy is enabled [GH-9973]
• connect: generate upstream service labels for terminating gateway listener stats. [GH-10404]
• sdk: Add new iptables package for applying traffic redirection rules with iptables. [GH-9910]
• sdk: Allow excluding inbound and outbound ports, outbound CIDRs, and additional user IDs from traffic redirection in the iptables package. [GH-10134]
• ui: Add Unix Domain Socket support [GH-10287]
• ui: Create a collapsible notices component for the Topology tab [GH-10270]
• ui: Read-only ACL Auth Methods view [GH-9617]
• ui: Transparent Proxy - Service mesh visualization updates [GH-10002]
• xds: emit a labeled gauge of connected xDS streams by version [GH-10243]
• xds: exclusively support the Incremental xDS protocol when using xDS v3 [GH-9855]

IMPROVEMENTS:

• acl: extend the auth-methods list endpoint to include MaxTokenTTL and TokenLocality fields. [GH-9741]
• acl: use the presence of a management policy in the state store as a sign that we already migrated to v2 acls [GH-9505]
• agent: Save exposed Envoy ports to the agent's state when Expose.Checks is true in proxy's configuration. [GH-10173]
• api: Add ExposedPort to the health check API resource. [GH-10173]
• api: Enable setting query options on agent endpoints. [GH-9903]
• api: The Content-Type header is now always set when a body is present in a request. [GH-10204]
• cli: snapshot inspect command can now inspect raw snapshots from a server's data dir. [GH-10089]
• cli: the consul connect envoy --envoy_statsd_url flag will now resolve the $HOST_IP environment variable, as part of a full url. [GH-8564]
• command: Exclude exposed Envoy ports from traffic redirection when providing -proxy-id and Expose.Checks is set. [GH-10173]
• connect: Add support for transparently proxying traffic through Envoy. [experimental] [GH-9894]
• connect: Allow per-upstream configuration to be set in service-defaults. [experimental] [GH-9872]
• connect: Ensures passthrough tproxy cluster is created even when mesh config doesn't exist. [GH-10301]
• connect: Support dialing individual service IP addresses through transparent proxies. [GH-10329]
• connect: The builtin connect proxy no longer advertises support for h2 via ALPN. [GH-4466]. [GH-9920]
• connect: Update the service mesh visualization to account for transparent proxies. [GH-10016]
• connect: adds new flags prometheus-backend-port and prometheus-scrape-port to consul connect envoy to support envoy_prometheus_bind_addr pointing to the merged metrics port when using Consul Connect on K8s. [GH-9768]
• connect: allow exposing duplicate HTTP paths through a proxy instance. [GH-10394]
• connect: rename cluster config entry to mesh. [GH-10127]
• connect: restrict transparent proxy mode to only match on the tagged virtual IP address. [GH-10162]
• connect: update supported envoy versions to 1.18.2, 1.17.2, 1.16.3, 1.15.4 [GH-10101]
• connect: update supported envoy versions to 1.18.3, 1.17.3, 1.16.4, and 1.15.5 [GH-10231]
• debug: capture a single stream of logs, and single pprof profile and trace for the whole duration [GH-10279]
• grpc: move gRPC INFO logs to be emitted as TRACE logs from Consul [GH-10395]
• licensing: (Enterprise Only) Consul Enterprise has gained the consul license inspect CLI command for inspecting a license without applying it..
• licensing: (Enterprise Only) Consul Enterprise has gained the ability to autoload a license via configuration. This can be specified with the license_path configuration, the CONSUL_LICENSE environment variable or the CONSUL_LICENSE_PATH environment variable [GH-10210]
• licensing: (Enterprise Only) Consul Enterprise has gained the ability update its license via a configuration reload. The same environment variables and configurations will be used to determine the new license. [GH-10267]
• monitoring: optimize the monitoring endpoint to avoid losing logs when under high load. [GH-10368]
• raft: allow reloading of raft trailing logs and snapshot timing to allow recovery from some replication failure modes. telemetry: add metrics and documentation for monitoring for replication issues. [GH-10129]
• streaming: change use_streaming_backend to default to true so that streaming is used by default when it is supported. [GH-10149]
• ui: Add 'optional route segments' and move namespaces to use them [GH-10212]
• ui: Adding a notice about how TransparentProxy mode affects the Upstreams list at the top of tab view [GH-10136]
• ui: Improve loader centering with new side navigation [GH-10181]
• ui: Move to a sidebar based main navigation [GH-9553]
• ui: Show a message to explain that health checks may be out of date if the serf health check is in a critical state [GH-10194]
• ui: Updating the wording for the banner and the popover for a service with an upstream that is not explicitly defined. [GH-10133]
• ui: Use older (~2016) native ES6 features to reduce transpilation and UI JS payload [GH-9729]
• ui: add permanently visible indicator when ACLs are disabled [GH-9864]
• ui: improve accessibility of modal dialogs [GH-9819]
• ui: restrict the viewing/editing of certain UI elements based on the users ACL token [GH-9687]
• ui: updates the ui with the new consul brand assets [GH-10081]
• xds: add support for envoy 1.17.0 [GH-9658]
• xds: default to speaking xDS v3, but allow for v2 to be spoken upon request [GH-9658]
• xds: ensure that all envoyproxy/go-control-plane protobuf symbols are linked into the final binary [GH-10131]
• xds: remove deprecated usages of xDS and drop support for envoy 1.13.x [GH-9602]

BUG FIXES:

• checks: add TLSServerName field to allow setting the TLS server name for HTTPS health checks. [GH-9475]
• config: Fixed a bug where rpc_max_conns_per_client could not be changed by reloading the config. [GH-8696]
• connect: Fix bug that prevented transparent proxies from working when mesh config restricted routing to catalog destinations. [GH-10365]
• memberlist: fixes a couple bugs which allowed malformed input to cause a crash in a Consul client or server. [GH-10161]
• monitor: fix monitor to produce json format logs when requested [GH-10358]
• proxycfg: Ensure that endpoints for explicit upstreams in other datacenters are watched in transparent mode. [GH-10391]
• proxycfg: avoid panic when transparent proxy upstream is added and then removed. [GH-10423]
• streaming: fixes a bug that would cause context cancellation errors when a cache entry expired while requests were active. [GH-10112]
• streaming: lookup in health properly handle case-sensitivity and perform filtering based on tags and node-meta [GH-9703]
• telemetry: fixes a bug with Prometheus metrics where Gauges and Summaries were incorrectly being expired. [GH-10161]
• ui: Adding conditional to prevent Service Mesh from breaking when there are no Upstreams [GH-10122]
• ui: Fix text searching through upstream instances. [GH-10151]
• ui: Update conditional for topology empty state [GH-10124]
• ui: ensure proxy instance API requests perform blocking queries correctly [GH-10039]
• xds: (beta-only) ensure that dependent xDS resources are reconfigured during primary type warming [GH-10381]

NOTES:

• legal: (Enterprise only) Enterprise binary downloads will now include a copy of the EULA and Terms of Evaluation in the zip archive

FEATURES:

• ui: add copyable IDs to the Role and Policy views [GH-9296]

IMPROVEMENTS:

• cli: (Enterprise only) A new -read-replica flag can now be used to enable running a server as a read only replica. Previously this was enabled with the now deprecated -non-voting-server flag. [GH-9191]
• config: (Enterprise only) A new read_replica configuration setting can now be used to enable running a server as a read only replica. Previously this was enabled with the now deprecated non_voting_server setting. [GH-9191]

DEPRECATIONS:

• cli: (Enterprise only) The -non-voting-server flag is deprecated in favor of the new -read-replica flag. The -non-voting-server flag is still present along side the new flag but it will be removed in a future release. [GH-9191]
• config: (Enterprise only) The non_voting_server configuration setting is deprecated in favor of the new read_replica setting. The non_voting_server configuration setting is still present but will be removed in a future release. [GH-9191]
• gossip: (Enterprise only) Read replicas now advertise themselves by setting the read_replica tag. The old nonvoter tag is still present but is deprecated and will be removed in a future release. [GH-9191]
• server: (Enterprise only) Addition of the nonvoter tag to the service registration made for read replicas is deprecated in favor of the new tag name of read_replica. Both are present in the registration but the nonvoter tag will be completely removed in a future release. [GH-9191]

BUG FIXES:

• agent: prevent duplicate services and check registrations from being synced to servers. [GH-9284]
• connect: fixes a case when updating the CA config in a secondary datacenter to correctly trigger the creation of a new intermediate certificate [GH-9009]
• connect: only unset the active root in a secondary datacenter when a new one is replacing it [GH-9318]
• namespaces: (Enterprise only) Prevent stalling of replication in secondary datacenters due to conflicts between the namespace replicator and other replicators. [GH-9271]
• streaming: ensure the order of results provided by /health/service/:serviceName is consistent with and without streaming enabled [GH-9247]

BREAKING CHANGES:

• agent: The enable_central_service_config option now defaults to true. [GH-8746]
• connect: Switch the default gateway port from 443 to 8443 to avoid assumption of Envoy running as root. [GH-9113]
• connect: Update Envoy metrics names and labels for proxy listeners so that attributes like datacenter and namespace can be extracted. [GH-9207]
• connect: intention destinations can no longer be reassigned [GH-8834]
• raft: Raft protocol v2 is no longer supported. If currently using protocol v2 then an intermediate upgrade to a version supporting both v2 and v3 protocols will be necessary (1.0.0 - 1.8.x). Note that the Raft protocol configured with the raft_protocol setting and the Consul RPC protocol configured with the protocol setting and output by the consul version command are distinct and supported Consul RPC protocol versions are not altered. [GH-9103]
• sentinel: (Consul Enterprise only) update to v0.16.0, which replaces whitelist and blacklist with allowlist and denylist
• server: (Enterprise only) Pre-existing intentions defined with non-existent destination namespaces were non-functional and are erased during the upgrade process. This should not matter as these intentions had nothing to enforce. [GH-9186]
• server: (OSS only) Pre-existing intentions defined with either a source or destination namespace value that is not "default" are rewritten or deleted during the upgrade process. Wildcards first attempt to downgrade to "default" unless an intention already exists, otherwise these non-functional intentions are deleted. [GH-9186]
• xds: Drop support for Envoy versions 1.12.0, 1.12.1, 1.12.2, and 1.13.0, due to a lack of support for url_path in RBAC. [GH-8839]

SECURITY:

• Fix Consul Enterprise Namespace Config Entry Replication DoS. Previously an operator with service:write ACL permissions in a Consul Enterprise cluster could write a malicious config entry that caused infinite raft writes due to issues with the namespace replication logic. [CVE-2020-25201] [GH-9024]
• Increase the permissions to read from the /connect/ca/configuration endpoint to operator:write. Previously Connect CA configuration, including the private key, set via this endpoint could be read back by an operator with operator:read privileges. CVE-2020-28053 [GH-9240]

FEATURES:

• agent: Add a new RPC endpoint for streaming cluster state change events to clients.
• agent: Allow client agents to be configured with an advertised reconnect timeout to control how long until the nodes are reaped by others in the cluster. [GH-8781]
• agent: moved ui config options to a new ui_config stanza in agent configuration and added new options to display service metrics in the UI. [GH-8694]
• agent: return the default ACL policy to callers as a header [GH-9101]
• autopilot: A new /v1/operator/autopilot/state HTTP API was created to give greater visibility into what autopilot is doing and how it has classified all the servers it is tracking. [GH-9103]
• autopilot: Added a new consul operator autopilot state command to retrieve and view the Autopilot state from consul. [GH-9142]
• cli: update snapshot inspect command to provide more detailed snapshot data [GH-8787]
• connect: support defining intentions using layer 7 criteria [GH-8839]
• telemetry: add initialization and definition for non-expiring key metrics in Prometheus [GH-9088]
• telemetry: track node and service counts and emit them as metrics [GH-8603]
• ui: If Prometheus is being used for monitoring the sidecars, the topology view can be configured to display overview metrics for the services. [GH-8858]
• ui: Services using Connect with Envoy sidecars have a topology tab in the UI showing their upstream and downstream services. [GH-8788]
• xds: use envoy's rbac filter to handle intentions entirely within envoy [GH-8569]

IMPROVEMENTS:

• agent: Return HTTP 429 when connections per clients limit (limits.http_max_conns_per_client) has been reached. [GH-8221]
• agent: add path_allowlist config option to restrict metrics proxy queries [GH-9059]
• agent: allow the /v1/connect/intentions/match endpoint to use the agent cache [GH-8875]
• agent: protect the metrics proxy behind ACLs [GH-9099]
• api: The v1/connect/ca/roots endpoint now accepts a pem=true query parameter and will return a PEM encoded certificate chain of all the certificates that would normally be in the JSON version of the response. [GH-8774]
• api: support GetMeta() and GetNamespace() on all config entry kinds [GH-8764]
• autopilot: (Enterprise Only) Autopilot now supports using both Redundancy Zones and Automated Upgrades together. [GH-9103]
• checks: add health status to the failure message when gRPC healthchecks fail. [GH-8726]
• chore: Update to Go 1.15 with mitigation for golang/go#42138 [GH-9036]
• command: remove conditional envoy bootstrap generation for versions <=1.10.0 since those are not supported [GH-8855]
• connect: The Vault provider will now automatically renew the lease of the token used, if supported. [GH-8560]
• connect: add support for specifying load balancing policy in service-resolver [GH-8585]
• connect: intentions are now managed as a new config entry kind "service-intentions" [GH-8834]
• raft: Update raft to v1.2.0 to prevent non-voters from becoming eligible for leader elections and adding peer id as metric label to reduce cardinality in metric names [GH-8822]
• server: (Consul Enterprise only) ensure that we also shutdown network segment serf instances on server shutdown [GH-8786]
• server: break up Intention.Apply monolithic method [GH-9007]
• server: create new memdb table for storing system metadata [GH-8703]
• server: make sure that the various replication loggers use consistent logging [GH-8745]
• server: remove config entry CAS in legacy intention API bridge code [GH-9151]
• snapshot agent: Deregister critical snapshotting TTL check if leadership is transferred.
• telemetry: All metrics should be present and available to prometheus scrapers when Consul starts. If any non-deprecated metrics are missing please submit an issue with its name. [GH-9198]
• telemetry: add config flag telemetry { disable_compat_1.9 = (true|false) } to disable deprecated metrics in 1.9 [GH-8877]
• telemetry: add counter consul.api.http with labels for each HTTP path and method. This is intended to replace consul.http... [GH-8877]
• ui: Add the Upstreams and Exposed Paths tabs for services in mesh [GH-9141]
• ui: Moves the Proxy health checks to be displayed with the Service health check under the Health Checks tab [GH-9141]
• ui: Upstream and downstream services in the topology tab will show a visual indication if a deny intention or intention with L7 policies is configured. [GH-8846]
• ui: add dashboard_url_template config option for external dashboard links [GH-9002]

DEPRECATIONS:

• Go 1.15 has dropped support for 32-bit binaries for Darwin, so darwin_386 builds will not be available for any 1.9.x+ releases. [GH-9036]
• agent: ui, ui_dir and ui_content_path are now deprecated for use in agent configuration files. Use ui_config.{enabled, dir, content_path} instead. The command arguments -ui, -ui-dir, and -ui-content-path remain supported. [GH-8694]
• telemetry: The measurements in all of the consul.http... prefixed metrics have been migrated to consul.api.http. consul.http... prefixed metrics will be removed in a future version of Consul. [GH-8877]
• telemetry: the disable_compat_1.9 config will cover more metrics deprecations in future 1.9 point releases. These metrics will be emitted twice for backwards compatibility - if the flag is true, only the new metric name will be written. [GH-9181]

BUG FIXES:

• agent: make the json/hcl decoding of ConnectProxyConfig fully work with CamelCase and snake_case [GH-8741]
• agent: when enable_central_service_config is enabled ensure agent reload doesn't revert check state to critical [GH-8747]
• api: Fixed a bug where the Check.GRPCUseTLS field could not be set using snake case. [GH-8771]
• api: Fixed a bug where additional headers configured with http_config.response_headers would not be served on index and error pages [GH-8694]
• autopilot: (Enterprise Only) Previously servers in other zones would not be promoted when all servers in a second zone had failed. Now the actual behavior matches the docs and autopilot will promote a healthy non-voter from any zone to replace failure of an entire zone. [GH-9103]
• autopilot: Prevent panic when requesting the autopilot health immediately after a leader is elected. [GH-9204]
• command: when generating envoy bootstrap configs use the datacenter returned from the agent services endpoint [GH-9229]
• connect: Fixed an issue where the Vault intermediate was not renewed in the primary datacenter. [GH-8784]
• connect: fix Vault provider not respecting IntermediateCertTTL [GH-8646]
• connect: fix connect sidecars registered via the API not being automatically deregistered with their parent service after an agent restart by persisting the LocallyRegisteredAsSidecar property. [GH-8924]
• connect: use stronger validation that ingress gateways have compatible protocols defined for their upstreams [GH-8470]
• license: (Enterprise only) Fixed an issue where the UI would see Namespaces and SSO as licensed when they were not.
• license: (Enterprise only) Fixed an issue where warnings about Namespaces being unlicensed would be emitted erroneously.
• namespace: (Enterprise Only) Fixed a bug that could case snapshot restoration to fail when it contained a namespace marked for deletion while still containing other resources in that namespace. [GH-9156]
• namespace: (Enterprise Only) Fixed an issue where namespaced services and checks were not being deleted when the containing namespace was deleted.
• raft: (Enterprise only) properly update consul server meta non_voter for non-voting Enterprise Consul servers [GH-8731]
• server: skip deleted and deleting namespaces when migrating intentions to config entries [GH-9186]
• telemetry: fixed a bug that caused logs to be flooded with [WARN] agent.router: Non-server in server-only area [GH-8685]
• ui: show correct datacenter for gateways [GH-8704]

FEATURES:

• acl: Added ACL Node Identities for easier creation of Consul Agent tokens. [GH-7970]
• agent: Added Consul client agent automatic configuration utilizing JWTs for authorizing the request to generate ACL tokens, TLS certificates and retrieval of the gossip encryption key. [GH-8003], [GH-8035], [GH-8086], [GH-8148], [GH-8157], [GH-8159], [GH-8193], [GH-8253], [GH-8301], [GH-8360], [GH-8362], [GH-8363], [GH-8364], [GH-8409]

IMPROVEMENTS:

• acl: allow auth methods created in the primary datacenter to optionally create global tokens [GH-7899]
• agent: Allow to restrict servers that can join a given Serf Consul cluster. [GH-7628]
• agent: new configuration options allow ratelimiting of the agent-cache: cache.entry_fetch_rate and cache.entry_fetch_max_burst. [GH-8226]
• api: Added methods to allow passing query options to leader and peers endpoints to mirror HTTP API [GH-8395]
• auto_config: when configuring auto_config, connect is turned on automatically [GH-8433]
• connect: various changes to make namespaces for intentions work more like for other subsystems [GH-8194]
• connect: Append port number to expected ingress hosts [GH-8190]
• connect: add support for envoy 1.15.0 and drop support for 1.11.x [GH-8424]
• connect: support Envoy v1.14.4, v1.13.4, v1.12.6 [GH-8216]
• dns: Improve RCODE of response when query targets a non-existent datacenter. [GH-8102],[GH-8218]
• version: The version CLI subcommand was altered to always show the git revision the binary was built from on the second line of output. Additionally the command gained a -format flag with the option now of outputting the version information in JSON form. NOTE This change has the potential to break any parsing done by users of the version commands output. In many cases nothing will need to be done but it is possible depending on how the output is parsed. [GH-8268]

BUGFIXES:

• agent: Fixed a bug where Consul could crash when verify_outgoing was set to true but no client certificate was used. [GH-8211]
• agent: Fixed an issue with lock contention during RPCs when under load while using the Prometheus metrics sink. [GH-8372]
• auto_encrypt: Fixed an issue where auto encrypt certificate signing wasn't using the connect signing rate limiter. [GH-8211]
• auto_encrypt: Fixed several issues around retrieving the first TLS certificate where it would have the wrong CN and SANs. This was being masked by a second bug (also fixed) causing that certificate to immediately be discarded with a second certificate request being made afterwards. [GH-8211]
• auto_encrypt: Fixed an issue that caused auto encrypt certificates to not be updated properly if the agents token was changed and the old token was deleted. [GH-8311]
• autopilot: (Consul Enterprise only) Fixed an issue where using autopilot with redundancy zones wouldn't demote extra voters in a zone to match the "one voter per zone" desired state when rebalancing.
• connect: fix crash that would result if a mesh or terminating gateway's upstream has a hostname as an address and no healthy service instances available. [GH-8158]
• connect: Fixed issue where specifying a prometheus bind address would cause ingress gateways to fail to start up [GH-8371]
• gossip: Avoid issue where two unique leave events for the same node could lead to infinite rebroadcast storms [GH-8343]
• router: Mark its own cluster as healthy when rebalancing. [GH-8406]
• snapshot: (Consul Enterprise only) Fixed a regression when using Azure blob storage.
• xds: version sniff envoy and switch regular expressions from 'regex' to 'safe_regex' on newer envoy versions [GH-8222]

BREAKING CHANGES:

• acl: Remove deprecated acl_enforce_version_8 option [GH-7991]

FEATURES:

• Terminating Gateway: Envoy can now be run as a gateway to enable services in a Consul service mesh to connect to external services through their local proxy. Terminating gateways unlock several of the benefits of a service mesh in the cases where a sidecar proxy cannot be deployed alongside services such as legacy applications or managed cloud databases.

• Ingress Gateway: Envoy can now be run as a gateway to ingress traffic into the Consul service mesh, enabling a more incremental transition for applications.

• WAN Federation over Mesh Gateways: Allows Consul datacenters to federate by forwarding WAN gossip and RPC traffic through Mesh Gateways rather than requiring the servers to be exposed to the WAN directly.

• JSON Web Token (JWT) Auth Method: Allows exchanging a signed JWT from a trusted external identity provider for a Consul ACL token.

• Single Sign-On (SSO) [Enterprise]: Lets an operator configure Consul to use an external OpenID Connect (OIDC) provider to automatically handle the lifecycle of creating, distributing and managing ACL tokens for performing CLI operations or accessing the UI.

• Audit Logging [Enterprise]: Adds instrumentation to record a trail of events (both attempted and authorized) by users of Consul’s HTTP API for purposes of regulatory compliance.

• acl: add DisplayName field to auth methods [GH-7769]

• acl: add MaxTokenTTL field to auth methods [GH-7779]

• agent/xds: add support for configuring passive health checks [GH-7713]

• cli: Add -config flag to "acl authmethod update/create" [GH-7776]

• serf: allow to restrict servers that can join a given Serf Consul cluster. [GH-7628]

• ui: Help menu to provide further documentation/learn links [GH-7310]

• ui: (Consul Enterprise only) SSO support [GH-7742] [GH-7771] [GH-7790]

• ui: Support for termininating and ingress gateways [GH-7858] [GH-7865]

IMPROVEMENTS:

• acl: change authmethod.Validator to take a logger [GH-7758]
• agent: show warning when enable_script_checks is enabled without safety net [GH-7437]
• api: Added filtering support to the v1/connect/intentions endpoint. [GH-7478]
• auto_encrypt: add validations for auto_encrypt.{tls,allow_tls} [GH-7704]
• build: switched to compile with Go 1.14.1 [GH-7481]
• config: validate system limits against limits.http_max_conns_per_client [GH-7434]
• connect: support envoy 1.12.3, 1.13.1, and 1.14.1. Envoy 1.10 is no longer officially supported. [GH-7380],[GH-7624]
• connect: add DNSSAN and IPSAN to cache key for ConnectCALeafRequest [GH-7597]
• connect: Added a new expose CLI command for ingress gateways [GH-8099]
• license: (Consul Enterprise only) Update licensing to align with the current modules licensing structure.
• logging: catch problems with the log destination earlier by creating the file immediately [GH-7469]
• proxycfg: support path exposed with non-HTTP2 protocol [GH-7510]
• tls: remove old ciphers [GH-7282]
• ui: Show the last 8 characters of AccessorIDs in listing views [GH-7327]
• ui: Make all tabs within the UI linkable/bookmarkable and include in history [GH-7592]
• ui: Redesign of all service pages [GH-7605] [GH-7632] [GH-7655] [GH-7683]
• ui: Show intentions per individual service [GH-7615]
• ui: Improved login/logout flow [GH-7790]
• ui: Revert search to search as you type, add sort control for the service listing page [GH-7489]
• ui: Omit proxy services from the service listing view and mark services as being proxied [GH-7820]
• ui: Display proxies in a proxy info tab with the service instance detail page [GH-7745]
• ui: Add live updates/blocking queries to gateway listings [GH-7967]
• ui: Improved 'empty states' [GH-7940]
• ui: Add ability to sort services based on health [GH-7989]
• ui: Add explanatory tooltip panels for gateway services [GH-8048]
• ui: Reduce discovery-chain log errors [GH-8065]

BUGFIXES:

• agent: (Consul Enterprise only) Fixed several bugs related to Network Area and Network Segment compatibility with other features caused by incorrectly doing version or serf tag checking. [GH-7491]
• agent: rewrite checks with proxy address, not local service address [GH-7518]
• agent: Preserve ModifyIndex for unchanged entry in KV transaciton [GH-7832]
• agent: use default resolver scheme for gRPC dialing [GH-7617]
• cache: Fix go routine leak in the agent cache which could cause increasing memory usage. [GH-8092]
• cli: enable TLS when CONSUL_HTTP_ADDR has an https scheme [GH-7608]
• connect: Internal refactoring to allow Connect proxy config to contain lists of structured configuration [GH-7963][GH-7964]
• license: (Consul Enterprise only) Fixed a bug that would cause a license reset request to only be applied on the leader server.
• sdk: Fix race condition in freeport [GH-7567]
• server: strip local ACL tokens from RPCs during forwarding if crossing datacenters [GH-7419]
• ui: Quote service names when filtering intentions to prevent 500 errors when accessing a service [GH-7896] [GH-7888]
• ui: Miscellaneous amends for Safari and Firefox [GH-7904] [GH-7907]
• ui: Ensure a value is always passed to CONSUL_SSO_ENABLED [GH-7913]

NOTES:

• cli: Our Windows 32-bit and 64-bit executables for this version and up will be signed with a HashiCorp certificate. Windows users will no longer see a warning about an "unknown publisher" when running our software.

• cli: Our darwin releases for this version and up will be signed and notarized according to Apple's requirements.

Prior to this release, MacOS 10.15+ users attempting to run our software may see the error: "'consul' cannot be opened because the developer cannot be verified." This error affected all MacOS 10.15+ users who downloaded our software directly via web browsers, and was caused by changes to Apple's third-party software requirements.

MacOS 10.15+ users should plan to upgrade to 1.7.0+.

SECURITY:

• dns: Updated miekg/dns dependency to fix a memory leak and CVE-2019-19794. [GH-6984], [GH-7252]
• updated to compile with [Go 1.12.16] which includes a fix for CVE-2020-0601 on windows [GH-7153]

BREAKING CHANGES:

• http: The HTTP API no longer accepts JSON fields that are unknown to it. Instead errors will be returned with 400 status codes [GH-6874]
• dns: PTR record queries now return answers that contain the Consul datacenter as a label between service and the domain. [GH-6909]
• agent: The ACL requirement for the agent/force-leave endpoint is now operator:write rather than agent:write. [GH-7033]
• logging: Switch over to using go-hclog and allow emitting either structured or unstructured logs. This changes the log format quite a bit and could break any log parsing users may have in place. [GH-1249][GH-7130]
• intentions: Change the ACL requirement and enforcement for wildcard rules. Previously this would look for an ACL rule that would grant access to the service/intention *. Now, in order to write a wildcard intention requires write access to all intentions and reading a wildcard intention requires read access to any intention that would match. Additionally intention listing and reading allow access if the requester can read either side of the intention whereas before it only allowed it for permissions on the destination side. [GH-7028]
• telemetry: consul.rpc.query has changed to only measure the start of srv.blockingQuery() calls. In certain rare cases where there are lots of idempotent updates this will cause the metric to report lower than before. The counter should now provides more meaningful behavior that maps to the rate of client-initiated requests. [GH-7224]

FEATURES:

• Namespaces (Consul Enterprise only) This version adds namespacing to Consul. Namespaces help reduce operational challenges by removing restrictions around uniqueness of resource names across distinct teams, and enable operators to provide self-service through delegation of administrative privileges. Namespace support was added to:
  • ACLs
  • Key/Value Store
  • Sessions
  • Catalog
  • Connect
  • UI [GH6639]
• agent: Add Cloud Auto-join support for Tencent Cloud [GH-6818]
• connect: Added a new CA provider allowing Connect certificates to be managed by AWS ACM Private CA.
• connect: Allow configuration of upstream connection limits in Envoy [GH-6829]
• ui: Adds UI support for Exposed Checks [GH6575]
• ui: Visualisation of the Discovery Chain [GH6746]

IMPROVEMENTS:

• acl: Use constant time comparison when checking for the ACL agent master token. [GH-6943]
• acl: Add accessorID of token when ops are denied by ACL system [GH-7117]
• agent: default the primary_datacenter to the datacenter if not configured [GH-7111]
• agent: configurable MaxQueryTime and DefaultQueryTime [GH-3777]
• agent: do not deregister service checks twice [GH-6168]
• agent: remove service sidecars in cleanupRegistration [GH-7022]
• agent: setup grpc server with auto_encrypt certs and add -https-port [GH-7086
• agent: some check types now support configuring a number of consecutive failure and success before the check status is updated in the catalog. [GH-5739]
• agent: clients should only attempt to remove pruned nodes once per call [GH-6591]
• agent: Consul HTTP checks can now send a configurable body in the request. [GH-6602]
• agent: increase watchLimit to 8192. [GH-7200]
• api: A new /v1/catalog/node-services/:node endpoint was added that mirrors the existing /v1/catalog/node/:node endpoint but has a response structure that contains a slice of services instead of a map of service ids to services. This new endpoint allows retrieving all services in all namespaces for a node. [GH-7115]
• api: add option to set TLS options in-memory for API client [GH-7093]
• api: add replace-existing-checks param to the api package [GH-7136]
• auto_encrypt: set dns and ip san for k8s and provide configuration [GH-6944]
• cli: improve the file safety of 'consul tls' subcommands [GH-7186]
• cli: give feedback to CLI user on forceleave command if node does not exist [GH-6841]
• connect: Envoy's whole stats endpoint can now be exposed to allow integrations like DataDog agent [GH-7070]
• connect: check if intermediate cert needs to be renewed. [GH-6835]
• connect: Allow inlining of the TLS certificate in the Envoy configuration. [GH-6360]
• dns: Improvement to enable dual stack IPv4/IPv6 addressing of services and lookup via DNS [GH-6531]
• lock: consul lock will now receive shutdown signals during the lock-acquisition process. [GH-5909]
• raft: increase raft notify buffer [GH-6863]
• raft: update raft to v1.1.2 [GH-7079]
• router: do not surface left servers [GH-6420]
• rpc: log method when a server/server RPC call fails [GH-4548]
• sentinel: (Consul Enterprise only) The Sentinel framework was upgraded to v0.13.0. See the Sentinel Release Notes for more information.
• telemetry: Added consul.rpc.queries_blocking gauge to measure the current number of in-flight blocking queries. [GH-7224]
• ui: Discovery chain improvements for clarifying the default router [GH-7222]
• ui: Added unique browser titles to each page [GH-7118]
• ui: Add live updates/blocking queries to the Intention listing page [GH-7161]
• ui: Use more consistent icons with other HashiCorp products in the UI [GH-6851]
• ui: Improvements to the Discovery Chain visualisation in respect to redirects [GH-7036]
• ui: Improvement keyboard navigation of the main menu [GH-7090]
• ui: New row confirmation dialogs [GH-7007]
• ui: Various visual CSS amends and alterations [GH6495] [[GH6881]](https://github.com/hashicorp/consul/
• ui: Hides the Routing tab for a service proxy [GH-7195]
• ui: Add ability to search nodes listing page with IP Address [GH-7204]
• xds: mesh gateway CDS requests are now allowed to receive an empty CDS reply [GH-6787]
• xds: Verified integration test suite with Envoy 1.12.2 & 1.13.0 [GH-6947]
• agent: Added ACL token for Consul managed service providers [GH-7218]

BUGFIXES:

• agent: fix watch event behavior [GH-5265]
• agent: ensure node info sync and full sync [GH-7189]
• autopilot: Fixed dead server removal condition to use correct failure tolerance. [GH-4017]
• cli: services register command now correctly registers an unamed healthcheck [GH-6800]
• cli: remove -dev from consul version in ARM builds in the 1.6.2 release [GH-6875]
• cli: ui_content_path config option fix [GH-6601]
• config: Fixed a bug that caused some config parsing to be case-sensitive: [GH-7191]
• connect: CAs can now use RSA keys correctly to sign EC leafs [GH-6638]
• connect: derive connect certificate serial numbers from a memdb index instead of the provider table max index [GH-7011]
• connect: ensure that updates to the secondary root CA configuration use the correct signing key ID values for comparison [GH-7012]
• connect: use correct subject key id for leaf certificates. [GH-7091]
• log: handle discard all logfiles properly [GH-6945]
• state: restore a few more service-kind index updates so blocking in ServiceDump works in more cases [GH-6948]
• tls: fix behavior related to auto_encrypt and verify_incoming (#6899) [GH-6811]
• ui: Ensure the main navigation menu is closed on click [GH-7164]
• ui: Ensure KV flags are passed through to Consul on update [GH-7216]
• ui: Fix positioning of active icon in main navigation menu [GH-7233]
• ui: Ensure the Namespace property is sent to Consul in OSS [GH-7238]
• ui: Remove the Policy/Service Identity selector from namespace policy form [GH-7124]
• ui: Fix positioning of active icon in the selected menu item [GH-7148]
• ui: Discovery-Chain: Improve parsing of redirects [GH-7174]
• ui: Fix styling of ‘duplicate intention’ error message [GH6936]

SECURITY:

• Updated to compile with Go 1.12.8 which mitigates CVE-2019-9512 and CVE-2019-9514 for the builtin HTTP server [GH-6319]
• Updated the google.golang.org/grpc dependency to v1.23.0 to mitigate CVE-2019-9512, CVE-2019-9514, and CVE-2019-9515 for the gRPC server. [GH-6320]

BREAKING CHANGES:

• connect: remove deprecated managed proxies and ProxyDestination config [GH-6220]

FEATURES:

• Connect Envoy Supports L7 Routing: Additional configuration entry types service-router, service-resolver, and service-splitter, allow for configuring Envoy sidecars to enable reliability and deployment patterns at L7 such as HTTP path-based routing, traffic shifting, and advanced failover capabilities. For more information see the L7 traffic management docs.
• Mesh Gateways: Envoy can now be run as a gateway to route Connect traffic across datacenters using SNI headers, allowing connectivty across platforms and clouds and other complex network topologies. Read more in the mesh gateway docs.
• Intention & CA Replication: In order to enable connecitivty for services across datacenters, Connect intentions are now replicated and the Connect CA cross-signs from the primary_datacenter. This feature was previously part of Consul Enterprise.
• agent: add local-only parameter to operator/keyring list requests to force queries to only hit local servers. [GH-6279]
• connect: expose an API endpoint to compile the discovery chain [GH-6248]
• connect: generate the full SNI names for discovery targets in the compiler rather than in the xds package [GH-6340]
• connect: introduce ExternalSNI field on service-defaults [GH-6324]
• xds: allow http match criteria to be applied to routes on services using grpc protocols [GH-6149]

IMPROVEMENTS:

• agent: Added tagged addressing to services similar to the already present Node tagged addressing [GH-5965]
• agent: health checks: change long timeout behavior to use to user-configured timeout value [GH-6094]
• api: Display allowed HTTP CIDR information nicely [GH-6029]
• api: Update filtering language to include substring and regular expression matching on string values [GH-6190]
• connect: added a new -bind-address cli option for envoy to create a mapping of the desired bind addresses to use instead of the default rules or tagged addresses [GH-6107]
• connect: allow L7 routers to match on http methods [GH-6164]
• connect: change router syntax for matching query parameters to resemble the syntax for matching paths and headers for consistency. [GH-6163]
• connect: detect and prevent circular discovery chain references [GH-6246]
• connect: ensure time.Duration fields retain their human readable forms in the API [GH-6348]
• connect: reconcile how upstream configuration works with discovery chains [GH-6225]
• connect: rework how the service resolver subset OnlyPassing flag works [GH-6173]
• connect: simplify the compiled discovery chain data structures [GH-6242]
• connect: validate and test more of the L7 config entries [GH-6156]
• gossip: increase size of gossip key generated by keygen to 32 bytes and document support for AES 256 [GH-6244]
• license (enterprise): Added license endpoint support to the API client [GH-6268]
• xds: improve how envoy metrics are emitted [GH-6312]
• xds: Verified integration test suite with Envoy 1.11.1 [GH-6347]

BUG FIXES:

• acl: Fixed a bug that could prevent transition from legacy ACL mode to new ACL mode [GH-6332
• agent: blocking central config RPCs iterations should not interfere with each other [GH-6316]
• agent: fix an issue that could cause a panic while transferring leadership due to replication [GH-6104]
• api: Fix a bug where the service tagged addresses were not being returned through the v1/agent/service/:service api. [GH-6299]
• api: un-deprecate api.DecodeConfigEntry [GH-6278]
• auto_encrypt: use server-port [GH-6287]
• autopilot: update to also remove failed nodes from WAN gossip pool [GH-6028]
• cli: ensure that the json form of config entries can be submitted with 'consul config write' [GH-6290]
• cli: Fixed bindable IP detection with the connect envoy command. [GH-6238]
• config: Ensure that all config entry writes are transparently forwarded to the primary datacneter. [GH-6327]
• connect: allow 'envoy_cluster_json' escape hatch to continue to function [GH-6378]
• connect: allow mesh gateways to use central config [GH-6302]
• connect: ensure intention replication continues to work when the replication ACL token changes [GH-6288]
• connect: ensure local dc connections do not use the gateway [GH-6085]
• connect: fix bug in service-resolver redirects if the destination uses a default resolver [GH-6122]
• connect: Fixed a bug that would prevent CA replication/initializing in a secondary DC from working when ACLs were enabled. [GH-6192]
• connect : Fixed a regression that broken xds endpoint generation for prepared query upstreams. [GH-6236]
• connect: fix failover through a mesh gateway to a remote datacenter [GH-6259]
• connect: resolve issue where MeshGatewayConfig could be returned empty [GH-6093]
• connect: updating a service-defaults config entry should leave an unset protocol alone [GH-6342]
• connect: validate upstreams and prevent duplicates [GH-6224]
• server: if inserting bootstrap config entries fails don't silence the errors [GH-6256]
• snapshot: fix TCP half-close implementation for TLS connections [GH-6216]

KNOWN ISSUES

• auto_encrypt: clients with auto_encrypt enabled won't be able to start because of [GH-6391]. There is a fix, but it came too late and we couldn't include it in the release. It will be part of 1.6.1 and we recommend that if you are using auto_encrypt you postpone the update.

SECURITY:

• connect: Envoy versions lower than 1.9.1 are vulnerable to CVE-2019-9900 and CVE-2019-9901. Both are related to HTTP request parsing and so only affect Consul Connect users if they have configured HTTP routing rules via the "escape hatch". We recommend Envoy 1.9.1 be used. Note that while we officially deprecate support for older version of Envoy in 1.5.0, we recommend using Envoy 1.9.1 with all previous versions of Consul Connect too (back to 1.3.0 where Envoy support was introduced).

BREAKING CHANGES:

• /watch: (note this only affects downstream programs importing /watch package as a library not the watch feature in Consul) The watch package was moved from github.com/hashicorp/consul/watch to github.com/hashicorp/consul/api/watch to live in the API module. This was necessary after updating the repo to use Go modules or else various other bugs cropped up. The watch package API has not changed so projects depending on it should need to only update the import statement to get their code functioning again. [GH-5664]
• ui: Legacy UI has been removed. Setting the CONSUL_UI_LEGACY environment variable to 1 or true will no longer revert to serving the old UI. [GH-5643]

FEATURES:

• Connect Envoy Supports L7 Observability: We introduce features that allow configuring Envoy sidecars to emit metrics and tracing at L7 (http, http2, grpc supported). For more information see the Envoy Integration docs.
• Centralized Configuration: Enables central configuration of some service and proxy defaults. For more information see the Configuration Entries docs
• api: Implement data filtering for some endpoints using a new filtering language. [GH-5579]
• snapshot agent (Consul Enterprise): Added support for saving snapshots to Azure Blob Storage.
• acl: tokens can be created with an optional expiration time [GH-5353]
• acl: tokens can now be assigned an optional set of service identities [GH-5390]
• acl: tokens can now be assigned to roles [GH-5514]
• acl: adding support for kubernetes auth provider login [GH-5600]
• ui: Template-able Dashboard links for Service detail pages [GH-5704] [GH-5777]
• ui: support for ACL Roles [GH-5635]

IMPROVEMENTS:

• cli: allow to add ip addresses as Subject Alternative Names when creating certificates with consul tls cert create [GH-5602]
• dns: Allow for hot-reload of many DNS configurations. [GH-4875]
• agent: config is now read if json or hcl is set as the config-format or the extension is either json or hcl [GH-5723]
• acl: Allow setting token accessor ids and secret ids during token creation. [GH-4977]
• ui: Service Instances page redesign and further visibility of Connect Proxies [GH-5326]
• ui: Blocking Query support / live updates for Services and Nodes, requires enabling per user via the UI Settings area [GH-5070] [GH-5267]
• ui: Finer grained searching for the Service listing page [GH-5507]
• ui: Add proxy icons to proxy services and instances where appropriate [GH-5463]

BUG FIXES:

• api: fix panic in 'consul acl set-agent-token' [GH-5533]
• api: fix issue in the transaction API where the health check definition struct wasn't being deserialized properly [GH-5553]
• acl: memdb filter of tokens-by-policy was inverted [GH-5575]
• acl: Fix legacy rules translation for JSON based rules. [GH-5493]
• agent: Fixed a bug causing RPC errors when the discovery_max_stale time was exceeded. [GH-4673]
• agent: Fix an issue with registering health checks for an agent service where the service name would be missing. [GH-5705]
• connect: fix an issue where Envoy would fail to bootstrap if some upstreams were unavailable [GH-5499]
• connect: fix an issue where health checks on proxies might be missed by watchers of /health/service/:service API [GH-5506]
• connect: fix a race condition that could leave proxies with no configuration for long periods on startup [GH-5793]
• logger: fix an issue where the log-file option was not respecting the log-level [GH-4778]
• catalog: fix an issue where renaming nodes could cause registration instability [GH-5518]
• network areas (Consul Enterprise): Fixed an issue that could cause a lock to be held unnecessarily causing other operations to hang.