github.com/hashicorp/consul

SECURITY:

• ci: Upgrade to Go 1.16.12 to address CVE-2021-44716 [GH-11806]
• namespaces: (Enterprise only) Creating or editing namespaces that include default ACL policies or ACL roles now requires acl:write permission in the default namespace. This change fixes CVE-2021-41805.

BUG FIXES:

• snapshot: (Enterprise only) fixed a bug where the snapshot agent would ignore the license_path setting in config files
• ui: Fixes an issue where under some circumstances after logging we present the data loaded previous to you logging in. [GH-11681]
• ui: Include Service.Namespace into available variables for dashboard_url_templates [GH-11640]

SECURITY:

• namespaces: (Enterprise only) Creating or editing namespaces that include default ACL policies or ACL roles now requires acl:write permission in the default namespace. This change fixes CVE-2021-41805.

IMPROVEMENTS:

• ci: Artifact builds will now only run on merges to the release branches or to main [GH-11417]
• ci: The Linux packages are now available for all supported Linux architectures including arm, arm64, 386, and amd64 [GH-11417]
• ci: The Linux packaging service configs and pre/post install scripts are now available under [.release/linux] [GH-11417]

BUG FIXES:

• acl: fixes the fallback behaviour of down_policy with setting extend-cache/async-cache when the token is not cached. [GH-11136]
• raft: Consul leaders will attempt to transfer leadership to another server as part of gracefully leaving the cluster. [GH-11242]
• rpc: only attempt to authorize the DNSName in the client cert when verify_incoming_rpc=true [GH-11255]
• server: (Enterprise only) Ensure that servers leave network segments when leaving other gossip pools
• ui: Fixed styling of Role delete confirmation button with the Token edit page [GH-11297]
• xds: fixes a bug where replacing a mesh gateway node used for WAN federation (with another that has a different IP) could leave gateways in the other DC unable to re-establish the connection [GH-11522]

FEATURES:

• sso/oidc: (Enterprise only) Add support for providing acr_values in OIDC auth flow [GH-11026]

IMPROVEMENTS:

• audit-logging: (Enterprise Only) Audit logs will now include select HTTP headers in each logs payload. Those headers are: Forwarded, Via, X-Forwarded-For, X-Forwarded-Host and X-Forwarded-Proto. [GH-11107]

BUG FIXES:

• tls: consider presented intermediates during server connection tls handshake. [GH-10964]
• ui: (Enterprise Only) Fixes a visual issue where namespaces would "double up" in the Source/Destination select menu when creating/editing intentions [GH-11102]

KNOWN ISSUES:

• tls: The fix for CVE-2021-37219 introduced an issue that could prevent TLS certificate validation when intermediate CA certificates used to sign server certificates are transmitted in the TLS session but are not present in all Consul server's configured CA certificates. This has the effect of preventing Raft RPCs between the affected servers. As a work around until the next patch releases, ensure that all intermediate CA certificates are present in all Consul server configurations prior to using certificates that they have signed.

SECURITY:

• rpc: authorize raft requests CVE-2021-37219 [GH-10933]

IMPROVEMENTS:

• areas: (Enterprise only) Add 15s timeout to opening streams over pooled connections.
• areas: (Enterprise only) Apply backpressure to area gossip packet ingestion when more than 512 packets are waiting to be ingested.
• areas: (Enterprise only) Make implementation of WriteToAddress non-blocking to avoid slowing down memberlist's packetListen routine.
• deps: update to gogo/protobuf v1.3.2 [GH-10813]

BUG FIXES:

• acl: fixes a bug that prevented the default user token from being used to authorize service registration for connect proxies. [GH-10824]
• ca: fixed a bug when ca provider fail and provider state is stuck in INITIALIZING state. [GH-10630]
• ca: report an error when setting the ca config fail because of an index check. [GH-10657]
• cli: Ensure the metrics endpoint is accessible when Envoy is configured to use a non-default admin bind address. [GH-10757]
• cli: Fix a bug which prevented initializing a watch when using a namespaced token. [GH-10795]
• connect: proxy upstreams inherit namespace from service if none are defined. [GH-10688]
• dns: fixes a bug with edns truncation where the response could exceed the size limit in some cases. [GH-10009]
• txn: fixes Txn.Apply to properly authorize service registrations. [GH-10798]

SECURITY:

• xds: ensure envoy verifies the subject alternative name for upstreams CVE-2021-32574 [GH-10621]

BUG FIXES:

• ca: Fixed a bug that returned a malformed certificate chain when the certificate did not having a trailing newline. [GH-10411]

IMPROVEMENTS:

• debug: capture a single stream of logs, and single pprof profile and trace for the whole duration [GH-10279]
• licensing: (Enterprise Only) In order to have forward compatibility with Consul Enterprise v1.10, the ability to parse licenses from the configuration or environment has been added. This can be specified with the license_path configuration, the CONSUL_LICENSE environment variable or the CONSUL_LICENSE_PATH environment variable. On server agents this configuration will be ignored. Client agents and the snapshot agent will use the configured license instead of automatically retrieving one. [GH-10442]
• monitoring: optimize the monitoring endpoint to avoid losing logs when under high load. [GH-10368]

BUG FIXES:

• license: (Enterprise only) Fixed an issue that would cause client agents on versions before 1.10 to not be able to retrieve the license from a 1.10+ server. [GH-10432]
• monitor: fix monitor to produce json format logs when requested [GH-10358]

BUG FIXES:

• agent: fix logging output by removing leading whitespace from every log line [GH-10338]
• cli: removes the need to set debug_enabled=true to collect debug data from the CLI. Now the CLI behaves the same way as the API and accepts either an ACL token with operator:read, or debug_enabled=true. [GH-10273]
• envoy: fixes a bug where a large envoy config could cause the consul connect envoy command to deadlock when attempting to start envoy. [GH-10324]
• namespaces: (Enterprise only) fixes a problem where the logs would contain many warnings about namespaces not being licensed.

IMPROVEMENTS:

• areas: (Enterprise only) Use server agent's gossip_wan config when setting memberlist configuration for network areas. Previously they used memberlists WAN defaults.
• cli: added a -force-without-cross-signing flag to the ca set-config command. connect/ca: The ForceWithoutCrossSigning field will now work as expected for CA providers that support cross signing. [GH-9672]
• connect: update supported envoy versions to 1.14.7, 1.13.7, 1.12.7, 1.11.2 [GH-10106]
• telemetry: Add new metrics for status of secondary datacenter replication. [GH-10073]

BUG FIXES:

• agent: ensure we hash the non-deprecated upstream fields on ServiceConfigRequest [GH-10240]
• api: include the default value of raft settings in the output of /v1/agent/self [GH-8812]
• areas: (Enterprise only) Revert to the 10s dial timeout used before connection pooling was introduced in 1.7.3.
• areas: (Enterprise only) Selectively merge gossip_wan config for network areas to avoid attempting to enable gossip encryption where it was not intended or necessary.
• local: agents will no longer persist the default user token along with a service or check. [GH-10188]
• server: ensure that central service config flattening properly resets the state each time [GH-10239]

SECURITY:

• Add content-type headers to raw KV responses to prevent XSS attacks CVE-2020-25864 [GH-10023]
• audit-logging: Parse endpoint URL to prevent requests from bypassing the audit log CVE-2021-28156

BUG FIXES:

• areas: Fixes a bug which would prevent newer servers in a network areas from connecting to servers running a version of Consul prior to 1.7.3.
• audit-logging: (Enterprise only) Fixed an issue that resulted in usage of the agent master token or managed service provider tokens from being resolved properly. [GH-10013]
• command: when generating envoy bootstrap configs to stdout do not mix informational logs into the json [GH-9980]
• config: correct config key from advertise_addr_ipv6 to advertise_addr_wan_ipv6 [GH-9851]
• snapshot: fixes a bug that would cause snapshots to be missing all but the first ACL Auth Method. [GH-10025]

IMPROVEMENTS:

• cli: Add new -cluster-id and common-name to consul tls ca create to support creating a CA for Consul Connect. [GH-9585]
• connect: if the token given to the vault provider returns no data avoid a panic [GH-9806]
• connect: update supported envoy point releases to 1.14.6, 1.13.7, 1.12.7, 1.11.2 [GH-9739]
• license: (Enterprise only) Temporary client license duration was increased from 30m to 6h.
• server: use the presense of stored federation state data as a sign that we already activated the federation state feature flag [GH-9519]
• xds: only try to create an ipv6 expose checks listener if ipv6 is supported by the kernel [GH-9765]

BUG FIXES:

• api: Remove trailing periods from the gateway internal HTTP API endpoint [GH-9752]
• cache: Prevent spamming the logs for days when a cached request encounters an "ACL not found" error. [GH-9738]
• connect: connect CA Roots in the primary datacenter should use a SigningKeyID derived from their local intermediate [GH-9428]
• proxycfg: avoid potential deadlock in delivering proxy snapshot to watchers. [GH-9689]
• server: When wan federating via mesh gateways after initial federation default to using the local mesh gateways unless the heuristic indicates a bypass is required. [GH-9528]
• server: When wan federating via mesh gateways only do heuristic primary DC bypass on the leader. [GH-9366]
• xds: deduplicate mesh gateway listeners by address in a stable way to prevent some LDS churn [GH-9650]
• xds: prevent LDS flaps in mesh gateways due to unstable datacenter lists; also prevent some flaps in terminating gateways as well [GH-9651]

BUG FIXES:

• connect: Fixed a bug in the AWS PCA Connect CA provider that could cause the intermediate PKI path to be deleted after reconfiguring the CA [GH-9498]
• connect: Fixed a bug in the Vault Connect CA provider that could cause the intermediate PKI path to be deleted after reconfiguring the CA [GH-9498]
• connect: Fixed an issue that would prevent updating the Connect CA configuration if the CA provider didn't complete initialization previously. [GH-9498]
• leader: Fixed a bug that could cause Connect CA initialization failures from allowing leader establishment to complete resulting in potentially infinite leader elections. [GH-9498]
• rpc: Prevent misleading RPC error claiming the lack of a leader when Raft is ok but there are issues with client agents gossiping with the leader. [GH-9487]
• ui: ensure namespace is used for node API requests [GH-9488]

BUG FIXES:

• acl: global tokens created by auth methods now correctly replicate to secondary datacenters [GH-9351]
• connect: fixes a case when updating the CA config in a secondary datacenter to correctly trigger the creation of a new intermediate certificate [GH-9009]
• connect: only unset the active root in a secondary datacenter when a new one is replacing it [GH-9318]
• license: (Enterprise only) Fixed an issue where the UI would see Namespaces and SSO as licensed when they were not.
• license: (Enterprise only) Fixed an issue where warnings about Namespaces being unlicensed would be emitted erroneously.
• namespace: (Enterprise Only) Fixed a bug that could case snapshot restoration to fail when it contained a namespace marked for deletion while still containing other resources in that namespace. [GH-9156]
• namespace: (Enterprise Only) Fixed an issue where namespaced services and checks were not being deleted when the containing namespace was deleted.
• namespaces: (Enterprise only) Prevent stalling of replication in secondary datacenters due to conflicts between the namespace replicator and other replicators. [GH-9271]

SECURITY:

• Increase the permissions to read from the /connect/ca/configuration endpoint to operator:write. Previously Connect CA configuration, including the private key, set via this endpoint could be read back by an operator with operator:read privileges. CVE-2020-28053 [GH-9240]

SECURITY:

• Fix Consul Enterprise Namespace Config Entry Replication DoS. Previously an operator with service:write ACL permissions in a Consul Enterprise cluster could write a malicious config entry that caused infinite raft writes due to issues with the namespace replication logic. [CVE-2020-25201] [GH-9024]

IMPROVEMENTS:

• api: The v1/connect/ca/roots endpoint now accepts a pem=true query parameter and will return a PEM encoded certificate chain of all the certificates that would normally be in the JSON version of the response. [GH-8774]
• connect: The Vault provider will now automatically renew the lease of the token used, if supported. [GH-8560]
• connect: update supported envoy releases to 1.14.5, 1.13.6, 1.12.7, 1.11.2 for 1.8.x [GH-8999]

BUG FIXES:

• agent: when enable_central_service_config is enabled ensure agent reload doesn't revert check state to critical [GH-8747]
• connect: Fixed an issue where the Vault intermediate was not renewed in the primary datacenter. [GH-8784]
• connect: fix Vault provider not respecting IntermediateCertTTL [GH-8646]
• connect: fix connect sidecars registered via the API not being automatically deregistered with their parent service after an agent restart by persisting the LocallyRegisteredAsSidecar property. [GH-8924]
• fixed a bug that caused logs to be flooded with [WARN] agent.router: Non-server in server-only area [GH-8685]
• ui: show correct datacenter for gateways [GH-8704]

FEATURES:

• agent: expose the list of supported envoy versions on /v1/agent/self [GH-8545]
• cache: Config parameters for cache throttling are now reloaded automatically on agent reload. Restarting the agent is not needed anymore. [GH-8552]
• connect: all config entries pick up a meta field [GH-8596]

IMPROVEMENTS:

• api: Added ACLMode method to the AgentMember type to determine what ACL mode the agent is operating in. [GH-8575]
• api: Added IsConsulServer method to the AgentMember type to easily determine whether the agent is a server. [GH-8575]
• api: Added constants for common tag keys and values in the Tags field of the AgentMember struct. [GH-8575]
• api: Allow for the client to use TLS over a Unix domain socket. [GH-8602]
• api: GET v1/operator/keyring also lists primary keys. [GH-8522]
• connect: Add support for http2 and grpc to ingress gateways [GH-8458]
• serf: update to v0.9.4 which supports primary keys in the ListKeys operation. [GH-8522]

BUGFIXES:

• connect: use stronger validation that ingress gateways have compatible protocols defined for their upstreams [GH-8494]
• agent: ensure that we normalize bootstrapped config entries [GH-8547]
• api: Fixed a panic caused by an api request with Connect=null [GH-8537]
• connect: connect envoy command now respects the -ca-path flag [GH-8606]
• connect: fix bug in preventing some namespaced config entry modifications [GH-8601]
• connect: fix renewing secondary intermediate certificates [GH-8588]
• ui: fixed a bug related to in-folder KV creation [GH-8613]

BUGFIXES:

• catalog: fixed a bug where nodes, services, and checks would not be restored with the correct Create/ModifyIndex when restoring from a snapshot [GH-8485]
• vendor: update github.com/armon/go-metrics to v0.3.4 to mitigate a potential panic when emitting Prometheus metrics at an interval longer than the metric expiry time [GH-8478]
• connect: (Consul Enterprise only) Fixed a regression that prevented mesh gateways from routing to services in their local datacenter that reside outside of the default namespace.

• auto_config: Fixed an issue where auto-config could be enabled in secondary DCs without enabling token replication when ACLs were enabled. [GH-8451]
• xds: revert setting set_node_on_first_message_only to true when generating envoy bootstrap config [GH-8440]

FEATURES:

• acl: Added ACL Node Identities for easier creation of Consul Agent tokens. [GH-7970]
• agent: Added Consul client agent automatic configuration utilizing JWTs for authorizing the request to generate ACL tokens, TLS certificates and retrieval of the gossip encryption key. [GH-8003], [GH-8035], [GH-8086], [GH-8148], [GH-8157], [GH-8159], [GH-8193], [GH-8253], [GH-8301], [GH-8360], [GH-8362], [GH-8363], [GH-8364], [GH-8409]

IMPROVEMENTS:

• acl: allow auth methods created in the primary datacenter to optionally create global tokens [GH-7899]
• agent: Allow to restrict servers that can join a given Serf Consul cluster. [GH-7628]
• agent: new configuration options allow ratelimiting of the agent-cache: cache.entry_fetch_rate and cache.entry_fetch_max_burst. [GH-8226]
• api: Added methods to allow passing query options to leader and peers endpoints to mirror HTTP API [GH-8395]
• auto_config: when configuring auto_config, connect is turned on automatically [GH-8433]
• connect: various changes to make namespaces for intentions work more like for other subsystems [GH-8194]
• connect: Append port number to expected ingress hosts [GH-8190]
• connect: add support for envoy 1.15.0 and drop support for 1.11.x [GH-8424]
• connect: support Envoy v1.14.4, v1.13.4, v1.12.6 [GH-8216]
• dns: Improve RCODE of response when query targets a non-existent datacenter. [GH-8102],[GH-8218]
• version: The version CLI subcommand was altered to always show the git revision the binary was built from on the second line of output. Additionally the command gained a -format flag with the option now of outputting the version information in JSON form. NOTE This change has the potential to break any parsing done by users of the version commands output. In many cases nothing will need to be done but it is possible depending on how the output is parsed. [GH-8268]

BUGFIXES:

• agent: Fixed a bug where Consul could crash when verify_outgoing was set to true but no client certificate was used. [GH-8211]
• agent: Fixed an issue with lock contention during RPCs when under load while using the Prometheus metrics sink. [GH-8372]
• auto_encrypt: Fixed an issue where auto encrypt certificate signing wasn't using the connect signing rate limiter. [GH-8211]
• auto_encrypt: Fixed several issues around retrieving the first TLS certificate where it would have the wrong CN and SANs. This was being masked by a second bug (also fixed) causing that certificate to immediately be discarded with a second certificate request being made afterwards. [GH-8211]
• auto_encrypt: Fixed an issue that caused auto encrypt certificates to not be updated properly if the agents token was changed and the old token was deleted. [GH-8311]
• autopilot: (Consul Enterprise only) Fixed an issue where using autopilot with redundancy zones wouldn't demote extra voters in a zone to match the "one voter per zone" desired state when rebalancing.
• connect: fix crash that would result if a mesh or terminating gateway's upstream has a hostname as an address and no healthy service instances available. [GH-8158]
• connect: Fixed issue where specifying a prometheus bind address would cause ingress gateways to fail to start up [GH-8371]
• gossip: Avoid issue where two unique leave events for the same node could lead to infinite rebroadcast storms [GH-8343]
• router: Mark its own cluster as healthy when rebalancing. [GH-8406]
• snapshot: (Consul Enterprise only) Fixed a regression when using Azure blob storage.
• xds: version sniff envoy and switch regular expressions from 'regex' to 'safe_regex' on newer envoy versions [GH-8222]

BREAKING CHANGES:

• acl: Remove deprecated acl_enforce_version_8 option [GH-7991]

FEATURES:

• Terminating Gateway: Envoy can now be run as a gateway to enable services in a Consul service mesh to connect to external services through their local proxy. Terminating gateways unlock several of the benefits of a service mesh in the cases where a sidecar proxy cannot be deployed alongside services such as legacy applications or managed cloud databases.

• Ingress Gateway: Envoy can now be run as a gateway to ingress traffic into the Consul service mesh, enabling a more incremental transition for applications.

• WAN Federation over Mesh Gateways: Allows Consul datacenters to federate by forwarding WAN gossip and RPC traffic through Mesh Gateways rather than requiring the servers to be exposed to the WAN directly.

• JSON Web Token (JWT) Auth Method: Allows exchanging a signed JWT from a trusted external identity provider for a Consul ACL token.

• Single Sign-On (SSO) [Enterprise]: Lets an operator configure Consul to use an external OpenID Connect (OIDC) provider to automatically handle the lifecycle of creating, distributing and managing ACL tokens for performing CLI operations or accessing the UI.

• Audit Logging [Enterprise]: Adds instrumentation to record a trail of events (both attempted and authorized) by users of Consul’s HTTP API for purposes of regulatory compliance.

• acl: add DisplayName field to auth methods [GH-7769]

• acl: add MaxTokenTTL field to auth methods [GH-7779]

• agent/xds: add support for configuring passive health checks [GH-7713]

• cli: Add -config flag to "acl authmethod update/create" [GH-7776]

• serf: allow to restrict servers that can join a given Serf Consul cluster. [GH-7628]

• ui: Help menu to provide further documentation/learn links [GH-7310]

• ui: (Consul Enterprise only) SSO support [GH-7742] [GH-7771] [GH-7790]

• ui: Support for termininating and ingress gateways [GH-7858] [GH-7865]

IMPROVEMENTS:

• acl: change authmethod.Validator to take a logger [GH-7758]
• agent: show warning when enable_script_checks is enabled without safety net [GH-7437]
• api: Added filtering support to the v1/connect/intentions endpoint. [GH-7478]
• auto_encrypt: add validations for auto_encrypt.{tls,allow_tls} [GH-7704]
• build: switched to compile with Go 1.14.1 [GH-7481]
• config: validate system limits against limits.http_max_conns_per_client [GH-7434]
• connect: support envoy 1.12.3, 1.13.1, and 1.14.1. Envoy 1.10 is no longer officially supported. [GH-7380],[GH-7624]
• connect: add DNSSAN and IPSAN to cache key for ConnectCALeafRequest [GH-7597]
• connect: Added a new expose CLI command for ingress gateways [GH-8099]
• license: (Consul Enterprise only) Update licensing to align with the current modules licensing structure.
• logging: catch problems with the log destination earlier by creating the file immediately [GH-7469]
• proxycfg: support path exposed with non-HTTP2 protocol [GH-7510]
• tls: remove old ciphers [GH-7282]
• ui: Show the last 8 characters of AccessorIDs in listing views [GH-7327]
• ui: Make all tabs within the UI linkable/bookmarkable and include in history [GH-7592]
• ui: Redesign of all service pages [GH-7605] [GH-7632] [GH-7655] [GH-7683]
• ui: Show intentions per individual service [GH-7615]
• ui: Improved login/logout flow [GH-7790]
• ui: Revert search to search as you type, add sort control for the service listing page [GH-7489]
• ui: Omit proxy services from the service listing view and mark services as being proxied [GH-7820]
• ui: Display proxies in a proxy info tab with the service instance detail page [GH-7745]
• ui: Add live updates/blocking queries to gateway listings [GH-7967]
• ui: Improved 'empty states' [GH-7940]
• ui: Add ability to sort services based on health [GH-7989]
• ui: Add explanatory tooltip panels for gateway services [GH-8048]
• ui: Reduce discovery-chain log errors [GH-8065]

BUGFIXES:

• agent: (Consul Enterprise only) Fixed several bugs related to Network Area and Network Segment compatibility with other features caused by incorrectly doing version or serf tag checking. [GH-7491]
• agent: rewrite checks with proxy address, not local service address [GH-7518]
• agent: Preserve ModifyIndex for unchanged entry in KV transaciton [GH-7832]
• agent: use default resolver scheme for gRPC dialing [GH-7617]
• cache: Fix go routine leak in the agent cache which could cause increasing memory usage. [GH-8092]
• cli: enable TLS when CONSUL_HTTP_ADDR has an https scheme [GH-7608]
• connect: Internal refactoring to allow Connect proxy config to contain lists of structured configuration [GH-7963][GH-7964]
• license: (Consul Enterprise only) Fixed a bug that would cause a license reset request to only be applied on the leader server.
• sdk: Fix race condition in freeport [GH-7567]
• server: strip local ACL tokens from RPCs during forwarding if crossing datacenters [GH-7419]
• ui: Quote service names when filtering intentions to prevent 500 errors when accessing a service [GH-7896] [GH-7888]
• ui: Miscellaneous amends for Safari and Firefox [GH-7904] [GH-7907]
• ui: Ensure a value is always passed to CONSUL_SSO_ENABLED [GH-7913]

SECURITY:

• Add content-type headers to raw KV responses to prevent XSS attacks CVE-2020-25864 [GH-10023]

BUG FIXES:

• command: when generating envoy bootstrap configs to stdout do not mix informational logs into the json [GH-9980]
• config: correct config key from advertise_addr_ipv6 to advertise_addr_wan_ipv6 [GH-9851]
• snapshot: fixes a bug that would cause snapshots to be missing all but the first ACL Auth Method. [GH-10025]

IMPROVEMENTS:

• connect: update supported envoy point releases to 1.13.7, 1.12.7, 1.11.2, 1.10.0 [GH-9740]
• license: (Enterprise only) Temporary client license duration was increased from 30m to 6h.
• xds: only try to create an ipv6 expose checks listener if ipv6 is supported by the kernel [GH-9765]

BUG FIXES:

• cache: Prevent spamming the logs for days when a cached request encounters an "ACL not found" error. [GH-9738]
• connect: connect CA Roots in the primary datacenter should use a SigningKeyID derived from their local intermediate [GH-9428]
• xds: deduplicate mesh gateway listeners by address in a stable way to prevent some LDS churn [GH-9650]
• xds: prevent LDS flaps in mesh gateways due to unstable datacenter lists; also prevent some flaps in terminating gateways as well [GH-9651]

BUG FIXES:

• rpc: Prevent misleading RPC error claiming the lack of a leader when Raft is ok but there are issues with client agents gossiping with the leader. [GH-9487]
• ui: ensure namespace is used for node API requests [GH-9488]

BUG FIXES:

• license: (Enterprise only) Fixed an issue where warnings about Namespaces being unlicensed would be emitted erroneously.
• namespace: (Enterprise Only) Fixed a bug that could case snapshot restoration to fail when it contained a namespace marked for deletion while still containing other resources in that namespace. [GH-9156]
• namespace: (Enterprise Only) Fixed an issue where namespaced services and checks were not being deleted when the containing namespace was deleted.
• namespaces: (Enterprise only) Prevent stalling of replication in secondary datacenters due to conflicts between the namespace replicator and other replicators. [GH-9271]

SECURITY:

• Increase the permissions to read from the /connect/ca/configuration endpoint to operator:write. Previously Connect CA configuration, including the private key, set via this endpoint could be read back by an operator with operator:read privileges. CVE-2020-28053 [GH-9240]

SECURITY:

• Fix Consul Enterprise Namespace Config Entry Replication DoS. Previously an operator with service:write ACL permissions in a Consul Enterprise cluster could write a malicious config entry that caused infinite raft writes due to issues with the namespace replication logic. [CVE-2020-25201] (https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25201) [GH-9024]

IMPROVEMENTS:

• connect: update supported envoy releases to 1.13.6, 1.12.7, 1.11.2, 1.10.0 for 1.7.x [GH-9000]

BUG FIXES:

• agent: when enable_central_service_config is enabled ensure agent reload doesn't revert check state to critical [GH-8747]

FEATURES:

• agent: expose the list of supported envoy versions on /v1/agent/self [GH-8545]

BUG FIXES:

• connect: fix bug in preventing some namespaced config entry modifications [GH-8601]
• api: fixed a panic caused by an api request with Connect=null [GH-8537]

BUGFIXES:

• catalog: fixed a bug where nodes, services, and checks would not be restored with the correct Create/ModifyIndex when restoring from a snapshot [GH-8486]
• vendor: update github.com/armon/go-metrics to v0.3.4 to mitigate a potential panic when emitting Prometheus metrics at an interval longer than the metric expiry time [GH-8478]

BUG FIXES:

• xds: revert setting set_node_on_first_message_only to true when generating envoy bootstrap config [GH-8441]
• telemetry: fix for a lock contention issue with the go-metrics Prometheus sink that could cause performance issues [GH-8372]
• telemetry: fix for a lock contention issue with the go-metrics Dogstatsd sink that could cause performance issues [GH-8372]

BUG FIXES:

• agent: Fixed an issue with lock contention during RPCs when under load while using the Prometheus metrics sink. [GH-8372]
• gossip: Avoid issue where two unique leave events for the same node could lead to infinite rebroadcast storms [GH-8353]
• snapshot: (Consul Enterprise only) Fixed a regression when using Azure blob storage.
• Return a service splitter's weight or a zero [GH-8355]

SECURITY:

• Adding an option http_config.use_cache to disable agent caching for http endpoints, because Consul’s DNS and HTTP API expose a caching feature susceptible to DoS. CVE-2020-13250 [GH-8023]
• Propagate and enforce changes to legacy ACL tokens rules in secondary data centers. CVE-2020-12797 [GH-8047]
• Only resolve local acl token in the datacenter it belongs to. CVE-2020-13170 [GH-8068]
• Requiring service:write permissions, a service-router entry without a destination no longer crashes Consul servers. CVE-2020-12758 [GH-7783]

BUG FIXES:

• acl: Fixed an issue where legacy management tokens could not be used in secondary datacenters. [GH-7908]
• agent: Fixed a race condition that could cause an agent to crash when first starting. [GH-7955]
• connect: ensure proxy-defaults protocol is used for upstreams [GH-7938]
• connect: setup intermediate_pki_path on secondary when using vault [GH-8001]

IMPROVEMENTS:

• acl: (Consul Enterprise only) - Disable the ACL.Bootstrap RPC endpoints when managed service provider tokens are in use. [GH-7614]
• acl: (Consul Enterprise only) - Consul agents will now use the first managed service provider token for the agents token when any are present.
• acl: Added a v1/acl/policy/name/:name HTTP endpoint to read a policy by name. [GH-6615]
• acl: Added JSON format output to all of the ACL CLI commands. [GH-7141]
• agent/xds: Update mesh gateway to use the service resolver connect timeout when configured [GH-6370]
• cli: Log "newer version available" message at INFO level [GH-7457]
• config: Consul Enterprise specific configuration are now parseable in OSS but will emit warnings about them not being used. [GH-7714
• network areas: (Consul Enterprise only) - Network areas are using memberlist with TCP and for every message a new connection was established. Now the connections multiplexed with yamux, which means that way fewer connections are created.
• network segments: (Consul Enterprise only) - The segment configuration is no longer stored in serf node tags. There is now an RPC endpoint for the same information, which means that the number of network segment is no longer limited by node meta tag size.
• snapshot agent: (Consul Enterprise only) - Azure has different environments, of which it was only possible to use the public one so far. A new flag was added so that every other environment can be used as well, like Azure China.

BUGFIXES:

• agent: don't let left nodes hold onto their node-id [GH-7775]
• agent: (Consul Enterprise only) Fixed several bugs related to Network Area ann Network Segment compatibility with other features caused by incorrectly doing version or serf tag checking. [GH-7491]
• cli: ensure that 'snapshot save' is fsync safe and also only writes to the requested file on success [GH-7698]
• cli: fix usage of gzip.Reader to better detect corrupt snapshots during save/restore [GH-7697]
• connect: Fix panic when validating a service-router config entry with no destination [GH-7783]
• namespace: (Consul Enterprise only) Fixed several bugs where results from multiple namespaces would be returned when only a single namespace was being queried when the token making the request had permissions to see all of them.
• snapshot agent (Consul Enterprise only): Ensure snapshots persisted with the local backend are fsync safe and also only writes to the requested file on success.
• snapshot agent (Consul Enterprise only): Verify integrity of snapshots locally before storing with the configured backend.
• ui: Ensure blocking queries are used in the service instance page instead of polling [GH-7543]
• ui: Fix a refreshing/rescrolling issue for the healthcheck listings [GH-7550] [GH-7365]
• ui: Fix token duplication action bug [GH-7552]
• ui: Lazily detect HTTP protocol along with a fallback for non-detection [GH-7644] [GH-7643]
• ui: Ensure KV names using 'special' terms within the default namespace are editable when the URL doesn't include the default namespace [GH-7734]
• xds: Fix flapping of mesh gateway connect-service watches [GH-7575]

IMPROVEMENTS:

• agent: add option to configure max request length for /v1/txn endpoint [GH-7388]
• build: bump the expected go language version of the main module to 1.13 [GH-7429]
• agent: add http_config.response header to the UI headers [GH-7369]
• agent: Added documentation and error messages related to kv_max_value_size option [GH-7405]]
• agent: Take Prometheus MIME-type header into account [GH-7371]]

BUGFIXES:

• acl: Updated token resolution so managed service provider token applies to all endpoints. [GH-7431]
• agent: Fixed error output when agent crashes early [GH-7411]
• agent: Handle bars in node names when displaying lists in CLI like consul members [GH-6652]]
• agent: Avoid discarding health check status on consul reload [GH-7345]]
• network areas: (Consul Enterprise only) - Fixed compatibility issues with network areas and v1.4.0+ ACLs as well as network areas and namespaces. The issue was that secondary datacenters connected to the primary via a network area were not properly detecting that the primary DC supported those other features.
• sessions: Fixed backwards incompatibility with 1.6.x and earlier [GH-7395][GH-7399]
• sessions: Fixed backwards incompatibility with 1.6.x and earlier [GH-7395][GH-7398]
• ui: Fixed a DOM refreshing bug on the node detail page which forced an scroll reset [GH-7365][GH-7377]
• ui: Fix blocking query requests for the coordinates API requests [GH-7378]
• ui: Enable recovery from an unreachable datacenter [GH-7404]

IMPROVEMENTS:

• agent: sensible keyring error [GH-7272]
• agent: add server raft.{last,applied}_index gauges [GH-6694]
• build: Switched to compile with Go 1.13.7 [GH-7262]
• config: increase http_max_conns_per_client default to 200 [GH-7289]
• tls: support TLS 1.3 [GH-7325]

BUGFIXES:

• acl: (Consul Enterprise only) Fixed an issue that prevented remote policy and role resolution from working when namespace policy or role defaults were configured.
• dns: Fixed an issue that could cause the DNS server to consume excessive CPU resources when trying to parse IPv6 recursor addresses: [GH-6120]
• dns: Fixed an issue that caused Consul to setup a root zone handler when no alt_domain was configured. [GH-7323]
• sessions: Fixed an issue that was causing deletions of a non-existent session to return a 500 when ACLs were enabled. [GH-6840]
• xds: Fix envoy retryOn behavior when multiple behaviors are configured [GH-7280]
• xds: Mesh Gateway fixes to prevent configuring extra clusters and for properly handling a service-resolvers default subset. [GH-7294]
• ui: Gracefully cope with errors in discovery-chain when connect is disabled [GH-7291]