github.com/hashicorp/consul

FEATURES:

• agent: New Cloud Auto-join provider: Kubernetes (K8S) [GH-4635]
• http: Added support for "Authorization: Bearer" head in addition to the X-Consul-Token header. [GH-4483]
• dns: Added a way to specify SRV weights for each service instance to allow weighted DNS load-balancing. [GH-4198]
• dns: Include EDNS-ECS options in EDNS responses where appropriate: see RFC 7871 [GH-4647]
• ui: Add markers/icons for external sources [GH-4640]

IMPROVEMENTS:

• ui: Switch to fullscreen layout for lists and detail, left aligned forms [GH-4435]
• connect: TLS certificate readiness now performs x509 certificate verification to determine whether the cert is usable. [GH-4540]
• ui: The syntax highlighting/code editor is now on by default [GH-4651]
• ui: Fallback to showing Node.Address if Service.Address is not set [GH-4579]
• gossip: Improvements to Serf and memberlist improving gossip stability on very large clusters (over 35k tested) [GH-4511]

BUG FIXES:

• agent: Avoid returning empty data on startup of a non-leader server [GH-4554]
• agent: Fixed a panic when serf_wan port was -1 but a reconnect_timeout_wan value was set. [GH-4515]
• agent: Fixed a problem where errors regarding DNS server creation where never shown. [GH-4578]
• agent: Start with invalid http configuration again, even though the build-in proxy for connect won't start in that case. [GH-4655]
• catalog: Allow renaming nodes with IDs. [GH-3974],[GH-4413],[GH-4415]
• dns: Fixes a bug with the DNS recursor, where we would not move onto the next provided recursor if we encounter a SERVFAIL or REFUSED status. [GH-4461]
• server: Fixed a memory leak in blocking queries against /event/list. [GH-4482]
• server: Fixed an issue where autopilot health checking could mistakenly mark healthy servers as failed, causing a non-voting server to be promoted unnecessarily. [GH-4528]
• snapshot: Fixed a bug where node metadata wasn't being included in or restored from the snapshots. [GH-4524]
• connect: Fixed a bug where managed proxy instances registered for instances with different name and ID and with restrictive ACL would not be allowed. [GH-4619]
• connect: Fixed a bug where built-in CA state was not correctly restored from a snapshot [GH-4535]
• connect: Fixed a bug where Checks with deregister_critical_service_after would deregister the service but not remove the managed proxy [GH-4649]
• connect: Fixed a bug that would output an error about pruning CAs every hour on the leader and might cause some CA configurations not to be pruned correctly [GH-4669]
• raft: Update raft vendoring to pull in a fix for a potential memory leak. [GH-4539]
• license: (Consul Enterprise) Fix an issue with the license not being reloaded from snapshots.
• license: (Consul Enterprise) Fix an issue with encoding/decoding of the license package type from the /v1/operator/license endpoint.
• cli: Correctly exit with error code 1 when failing to list DCs with the catalog command [GH-4583]
• ui: Improve layout on screens of a large portrait orientation [GH-4564]
• ui: Various browser layout bugs for various vendors/setups [GH-4608] [GH-4613] [GH-4615]

SECURITY:

• acl: Fixed an issue where writes operations on the Keyring and Operator were being allowed with a default allow policy even when explicitly denied in the policy. [GH-4378]

FEATURES:

• Alias Checks: Alias checks allow a service or node to alias the health status of another service or node in the cluster. [PR-4320]
• agent: New Cloud Auto-join providers: vSphere and Packet.net. [GH-4412]
• cli: Added -serf-wan-port, -serf-lan-port, and -server-port flags to CLI for cases where these can't be specified in config files and -hcl is too cumbersome. [GH-4353]
• connect: The TTL of leaf (service) certificates in Connect is now configurable. [GH-4400]

IMPROVEMENTS:

• proxy: With -register flag, heartbeat failures will only log once service registration succeeds. [GH-4314]
• http: 1.0.3 introduced rejection of non-printable chars in HTTP URLs due to a security vulnerability. Some users who had keys written with an older version which are now dissallowed were unable to delete them. A new config option disable_http_unprintable_char_filter is added to allow those users to remove the offending keys. Leaving this new option set long term is strongly discouraged as it bypasses filtering necessary to prevent some known vulnerabilities. [GH-4442]
• agent: Allow for advanced configuration of some gossip related parameters. [GH-4058]
• agent: Make some Gossip tuneables configurable via the config file [GH-4444]
• ui: Included searching on .Tags when using the freetext search field. [GH-4383]
• ui: Service.ID's are now shown in the Service detail page and (only if it is different from the service name) the Node Detail > [Services] tab. [GH-4387]

BUG FIXES:

• acl/connect: Fix an issue that was causing managed proxies not to work when ACLs were enabled. [GH-4441]
• connect: Fix issue with managed proxies and watches attempting to use a client addr that is 0.0.0.0 or :: [GH-4403]
• connect: Allow Native and Unmanaged proxy configurations via config file [GH-4443]
• connect: Fix bug causing 100% CPU on agent when Connect is disabled but a proxy is still running [GH-4421]
• proxy: Don't restart proxies setup in a config file when Consul restarts [GH-4407]
• ui: Display the Service.IP address instead of the Node.IP address in the Service detail view. [GH-4410]
• ui: Watch for trailing slash stripping 301 redirects and forward the user to the correct location. [GH-4373]
• connect: Fixed an issue in the connect native HTTP client where it failed to resolve service names. [GH-4392]