All Versions
200
Latest Version
Avg Release Cycle
70 days
Latest Release
19 days ago

Changelog History
Page 8

  • v1.9.7 Changes

    June 21, 2021

    👌 IMPROVEMENTS:

    • 🔊 debug: capture a single stream of logs, and single pprof profile and trace for the whole duration [GH-10279]
    • licensing: (Enterprise Only) In order to have forward compatibility with Consul Enterprise v1.10, the ability to parse licenses from the configuration or environment has been added. This can be specified with the license_path configuration, the CONSUL_LICENSE environment variable or the CONSUL_LICENSE_PATH environment variable. On server agents this configuration will be ignored. Client agents and the snapshot agent will use the configured license instead of automatically retrieving one. [GH-10441]
    • ⚡️ monitoring: optimize the monitoring endpoint to avoid losing logs when under high load. [GH-10368]

    🐛 BUG FIXES:

    • license: (Enterprise only) Fixed an issue that would cause client agents on versions before 1.10 to not be able to retrieve the license from a 1.10+ server. [GH-10432]
    • 🔊 monitor: fix monitor to produce json format logs when requested [GH-10358]

  • v1.9.6 Changes

    June 04, 2021

    👌 IMPROVEMENTS:

    • acl: Give more descriptive error if auth method not found. [GH-10163]
    • areas: (Enterprise only) Use server agent's gossip_wan config when setting memberlist configuration for network areas. Previously they used memberlists WAN defaults.
    • cli: added a -force-without-cross-signing flag to the ca set-config command. 👍 connect/ca: The ForceWithoutCrossSigning field will now work as expected for CA providers that support cross signing. [GH-9672]
    • ⚡️ connect: update supported envoy versions to 1.16.3, 1.15.4, 1.14.7, 1.13.7 [GH-10105]
    • ⚡️ connect: update supported envoy versions to 1.16.4, 1.15.5, 1.14.6, and 1.13.7 [GH-10232]
    • telemetry: Add new metrics for status of secondary datacenter replication. [GH-10073]
    • telemetry: The usage data in the metrics API now includes cluster member counts, reporting clients on a per segment basis. [GH-10340]
    • 💻 ui: Added CRD popover 'informed action' for intentions managed by CRDs [GH-10100]
    • 🔒 ui: Added humanized formatting to lock session durations [GH-10062]
    • 💻 ui: Only show a partial list of intention permissions, with the option to show all [GH-10174]
    • ⚡️ ui: updates the ui with the new consul brand assets [GH-10090]

    🐛 BUG FIXES:

    • 🗄 agent: ensure we hash the non-deprecated upstream fields on ServiceConfigRequest [GH-10240]
    • 🌲 agent: fix logging output by removing leading whitespace from every log line [GH-10338]
    • 0️⃣ api: include the default value of raft settings in the output of /v1/agent/self [GH-8812]
    • areas: (Enterprise only) Revert to the 10s dial timeout used before connection pooling was introduced in 1.7.3.
    • areas: (Enterprise only) Selectively merge gossip_wan config for network areas to avoid attempting to enable gossip encryption where it was not intended or necessary.
    • autopilot: (Enterprise only) Fixed an issue where autopilot could cause a new leader to demote the wrong voter when redundancy zones are in use and the previous leader failed. [GH-10306]
    • 🚚 cli: removes the need to set debug_enabled=true to collect debug data from the CLI. Now the CLI behaves the same way as the API and accepts either an ACL token with operator:read, or debug_enabled=true. [GH-10273]
    • cli: snapshot inspect command would panic on invalid input. [GH-10091]
    • 🛠 envoy: fixes a bug where a large envoy config could cause the consul connect envoy command to deadlock when attempting to start envoy. [GH-10324]
    • http: fix a bug that caused the X-Consul-Effective-Consistency header to be missing on request for service health [GH-10189]
    • 0️⃣ local: agents will no longer persist the default user token along with a service or check. [GH-10188]
    • namespaces: (Enterprise only) fixes a problem where the logs would contain many warnings about namespaces not being licensed.
    • server: ensure that central service config flattening properly resets the state each time [GH-10239]
    • 🔒 ui: Add conditionals to lock sessions tab [GH-10121]
    • 💻 ui: De-duplicate tags in rendered tag listings [GH-10186]
    • 💻 ui: Don't render a DOM element for empty namespace descriptions [GH-10157]
    • 💻 ui: Reflect the change of Session API response shape for Checks in post 1.7 Consul [GH-10225]
    • 🚚 ui: Removes the extra rendering of namespace in service upstream list [GH-10152]

  • v1.9.5 Changes

    April 15, 2021

    🔒 SECURITY:

    • ➕ Add content-type headers to raw KV responses to prevent XSS attacks CVE-2020-25864 [GH-10023]
    • 📜 audit-logging: Parse endpoint URL to prevent requests from bypassing the audit log CVE-2021-28156

    👌 IMPROVEMENTS:

    • 📜 api: AutopilotServerHelath now handles the 429 status code returned by the v1/operator/autopilot/health endpoint and still returned the parsed reply which will indicate server healthiness [GH-8599]
    • 0️⃣ client: when a client agent is attempting to dereigster a service, anddoes not have access to the ACL token used to register a service, attempt to use the agent token instead of the default user token. If no agent token is set, fall back to the default user token. [GH-9683]
    • connect: Automatically rewrite the Host header for Terminating Gateway HTTP services [GH-9042]
    • 🔒 ui: support stricter content security policies [GH-9847]

    🐛 BUG FIXES:

    • api: ensure v1/health/ingress/:service endpoint works properly when streaming is enabled [GH-9967]
    • 🛠 areas: Fixes a bug which would prevent newer servers in a network areas from connecting to servers running a version of Consul prior to 1.7.3.
    • 🛠 audit-logging: (Enterprise only) Fixed an issue that resulted in usage of the agent master token or managed service provider tokens from being resolved properly. [GH-10013]
    • cache: fix a bug in the client agent cache where streaming could potentially leak resources. [GH-9978]. [GH-9978]
    • cache: fix a bug in the client agent cache where streaming would disconnect every 20 minutes and cause delivery delays. [GH-9979]. [GH-9979]
    • 🔊 command: when generating envoy bootstrap configs to stdout do not mix informational logs into the json [GH-9980]
    • ➕ config: correct config key from advertise_addr_ipv6 to advertise_addr_wan_ipv6 [GH-9851]
    • 🔊 http: fix a bug in Consul Enterprise that would cause the UI to believe namespaces were supported, resulting in warning logs and incorrect UI behaviour. [GH-9923]
    • 🛠 snapshot: fixes a bug that would cause snapshots to be missing all but the first ACL Auth Method. [GH-10025]
    • 💻 ui: Fix intention form cancel button [GH-9901]

  • v1.9.4 Changes

    March 04, 2021

    👌 IMPROVEMENTS:

    • connect: if the token given to the vault provider returns no data avoid a panic [GH-9806]
    • 🚀 connect: update supported envoy point releases to 1.16.2, 1.15.3, 1.14.6, 1.13.7 [GH-9737]
    • 👍 xds: only try to create an ipv6 expose checks listener if ipv6 is supported by the kernel [GH-9765]

    🐛 BUG FIXES:

    • 🚚 api: Remove trailing periods from the gateway internal HTTP API endpoint [GH-9752]
    • 🔊 cache: Prevent spamming the logs for days when a cached request encounters an "ACL not found" error. [GH-9738]
    • connect: connect CA Roots in the primary datacenter should use a SigningKeyID derived from their local intermediate [GH-9428]
    • proxycfg: avoid potential deadlock in delivering proxy snapshot to watchers. [GH-9689]
    • ⚠ replication: Correctly log all replication warnings that should not be suppressed [GH-9320]
    • 🛠 streaming: fixes a bug caused by caching an incorrect snapshot, that would cause clients to error until the cache expired. [GH-9772]
    • 💻 ui: Exclude proxies when showing the total number of instances on a node. [GH-9749]
    • 💻 ui: Fixed a bug in older browsers relating to String.replaceAll and fieldset w/flexbox usage [GH-9715]
    • xds: deduplicate mesh gateway listeners by address in a stable way to prevent some LDS churn [GH-9650]
    • xds: prevent LDS flaps in mesh gateways due to unstable datacenter lists; also prevent some flaps in terminating gateways as well [GH-9651]

  • v1.9.3 Changes

    February 01, 2021

    🔋 FEATURES:

    • 💻 ui: Add additional search/filter status pills for viewing and removing current filters in listing views [GH-9442]

    👌 IMPROVEMENTS:

    • 👍 cli: Add new -cluster-id and common-name to consul tls ca create to support creating a CA for Consul Connect. [GH-9585]
    • license: (Enterprise only) Temporary client license duration was increased from 30m to 6h.
    • server: (Enterprise Only) Validate source namespaces in service-intentions config entries. [GH-9527]
    • server: use the presence of stored federation state data as a sign that we already activated the federation state feature flag [GH-9519]

    🐛 BUG FIXES:

    • 🛠 autopilot: Fixed a bug that would cause snapshot restoration to stop autopilot on the leader. [GH-9626]
    • 0️⃣ server: When wan federating via mesh gateways after initial federation default to using the local mesh gateways unless the heuristic indicates a bypass is required. [GH-9528]
    • server: When wan federating via mesh gateways only do heuristic primary DC bypass on the leader. [GH-9366]
    • 💻 ui: Fixed a bug that would cause missing or duplicate service instance healthcheck listings. [GH-9660]

  • v1.9.2 Changes

    January 20, 2021

    🔋 FEATURES:

    • agent: add config flag MaxHeaderBytes to control the maximum size of the http header per client request. [GH-9067]
    • 🔧 cli: The consul intention command now has a new list subcommand to allow the listing of configured intentions. It also supports the -namespace= option. [GH-9468]

    👌 IMPROVEMENTS:

    • server: deletions of intentions by name using the intention API is now idempotent [GH-9278]
    • ⚠ streaming: display a warning on agent(s) when incompatible streaming parameters are used [GH-9530]
    • ✅ ui: Various accessibility scan test improvements [GH-9485]

    🗄 DEPRECATIONS:

    • api: the tag, node-meta, and passing query parameters for various health and catalog 🗄 endpoints are now deprecated. The filter query parameter should be used as a replacement 🚚 for all of the deprecated fields. The deprecated query parameters will be removed in a future 🔖 version of Consul. [GH-9262]

    🐛 BUG FIXES:

    • 🔊 client: Help added in Prometheus in relases 1.9.0 does not generate warnings anymore in logs [GH-9510]
    • client: properly set GRPC over RPC magic numbers when encryption was not set or partially set in the cluster with streaming enabled [GH-9512]
    • 🛠 connect: Fixed a bug in the AWS PCA Connect CA provider that could cause the intermediate PKI path to be deleted after reconfiguring the CA [GH-9498]
    • 🛠 connect: Fixed a bug in the Vault Connect CA provider that could cause the intermediate PKI path to be deleted after reconfiguring the CA [GH-9498]
    • ⚡️ connect: Fixed an issue that would prevent updating the Connect CA configuration if the CA provider didn't complete initialization previously. [GH-9498]
    • 🛠 leader: Fixed a bug that could cause Connect CA initialization failures from allowing leader establishment to complete resulting in potentially infinite leader elections. [GH-9498]
    • rpc: Prevent misleading RPC error claiming the lack of a leader when Raft is ok but there are issues with client agents gossiping with the leader. [GH-9487]
    • 🛠 server: Fixes a server panic introduced in 1.9.0 where Connect service mesh is being used. Node de-registration could panic if it hosted services with multiple upstreams. [GH-9589]
    • state: fix computation of usage metrics to account for various places that can modify multiple services in a single transaction. [GH-9440]
    • 💻 ui: Display LockDelay in nanoseconds as a temporary fix to the formatting [GH-9594]
    • 💻 ui: Fix an issue where registering an ingress-gateway with no central config would result in a JS error due to the API reponse returning null [GH-9593]
    • 💻 ui: Fixes an issue where clicking backwards and forwards between a service instance can result in a 404 error [GH-9524]
    • 📇 ui: Fixes an issue where intention description or metadata could be overwritten if saved from the topology view. [GH-9513]
    • 💻 ui: Fixes an issue with setting -ui-content-path flag/config [GH-9569]
    • 💻 ui: ensure namespace is used for node API requests [GH-9410]
    • 💻 ui: request intention listing with ns=* parameter to retrieve all intentions across namespaces [GH-9432]

  • v1.9.1 Changes

    December 11, 2020

    1.9.1 (December 11, 2020)

    🔋 FEATURES:

    • 💻 ui: add copyable IDs to the Role and Policy views [GH-9296]

    👌 IMPROVEMENTS:

    • cli: (Enterprise only) A new -read-replica flag can now be used to enable running a server as a read only replica. Previously this was enabled with the now deprecated -non-voting-server flag. [GH-9191]
    • config: (Enterprise only) A new read_replica configuration setting can now be used to enable running a server as a read only replica. Previously this was enabled with the now deprecated non_voting_server setting. [GH-9191]

    🗄 DEPRECATIONS:

    • cli: (Enterprise only) The -non-voting-server flag is deprecated in favor of the new -read-replica flag. The -non-voting-server flag is still present along side the new flag but it will be removed in a future release. [GH-9191]
    • config: (Enterprise only) The non_voting_server configuration setting is deprecated in favor of the new read_replica setting. The non_voting_server configuration setting is still present but will be removed in a future release. [GH-9191]
    • gossip: (Enterprise only) Read replicas now advertise themselves by setting the read_replica tag. The old nonvoter tag is still present but is deprecated and will be removed in a future release. [GH-9191]
    • server: (Enterprise only) Addition of the nonvoter tag to the service registration made for read replicas is deprecated in favor of the new tag name of read_replica. Both are present in the registration but the nonvoter tag will be completely removed in a future release. [GH-9191]

    🐛 BUG FIXES:

    • 🔀 agent: prevent duplicate services and check registrations from being synced to servers. [GH-9284]
    • ⚡️ connect: fixes a case when updating the CA config in a secondary datacenter to correctly trigger the creation of a new intermediate certificate [GH-9009]
    • connect: only unset the active root in a secondary datacenter when a new one is replacing it [GH-9318]
    • namespaces: (Enterprise only) Prevent stalling of replication in secondary datacenters due to conflicts between the namespace replicator and other replicators. [GH-9271]
    • streaming: ensure the order of results provided by /health/service/:serviceName is consistent with and without streaming enabled [GH-9247]

  • v1.9.0 Changes

    November 24, 2020

    💥 BREAKING CHANGES:

    • agent: The enable_central_service_config option now defaults to true. [GH-8746]
    • 0️⃣ connect: Switch the default gateway port from 443 to 8443 to avoid assumption of Envoy running as root. [GH-9113]
    • ⚡️ connect: Update Envoy metrics names and labels for proxy listeners so that attributes like datacenter and namespace can be extracted. [GH-9207]
    • connect: intention destinations can no longer be reassigned [GH-8834]
    • ⬆️ raft: Raft protocol v2 is no longer supported. If currently using protocol v2 then an intermediate upgrade to a version supporting both v2 and v3 protocols will be necessary (1.0.0 - 1.8.x). Note that the Raft protocol configured with the raft_protocol setting and the Consul RPC protocol configured with the protocol setting and output by the consul version command are distinct and supported Consul RPC protocol versions are not altered. [GH-9103]
    • sentinel: (Consul Enterprise only) update to v0.16.0, which replaces whitelist and blacklist with allowlist and denylist
    • server: (Enterprise only) Pre-existing intentions defined with non-existent destination namespaces were non-functional and are erased during ⬆️ the upgrade process. This should not matter as these intentions had nothing to enforce. [GH-9186]
    • server: (OSS only) Pre-existing intentions defined with either a source or 0️⃣ destination namespace value that is not "default" are rewritten or deleted ⬇️ during the upgrade process. Wildcards first attempt to downgrade to "default" unless an intention already exists, otherwise these non-functional intentions are deleted. [GH-9186]
    • 👍 xds: Drop support for Envoy versions 1.12.0, 1.12.1, 1.12.2, and 1.13.0, due to a lack of support for url_path in RBAC. [GH-8839]

    🔒 SECURITY:

    • 🛠 Fix Consul Enterprise Namespace Config Entry Replication DoS. Previously an operator with service:write ACL permissions in a Consul Enterprise cluster could write a malicious config entry that caused infinite raft writes due to issues with the namespace replication logic. [CVE-2020-25201] [GH-9024]
    • 🔧 Increase the permissions to read from the /connect/ca/configuration endpoint to operator:write. Previously Connect CA configuration, including the private key, set via this endpoint could be read back by an operator with operator:read privileges. CVE-2020-28053 [GH-9240]

    🔋 FEATURES:

    • agent: Add a new RPC endpoint for streaming cluster state change events to clients.
    • 🔧 agent: Allow client agents to be configured with an advertised reconnect timeout to control how long until the nodes are reaped by others in the cluster. [GH-8781]
    • 🔧 agent: moved ui config options to a new ui_config stanza in agent configuration and added new options to display service metrics in the UI. [GH-8694]
    • 0️⃣ agent: return the default ACL policy to callers as a header [GH-9101]
    • autopilot: A new /v1/operator/autopilot/state HTTP API was created to give greater visibility into what autopilot is doing and how it has classified all the servers it is tracking. [GH-9103]
    • autopilot: Added a new consul operator autopilot state command to retrieve and view the Autopilot state from consul. [GH-9142]
    • ⚡️ cli: update snapshot inspect command to provide more detailed snapshot data [GH-8787]
    • 👍 connect: support defining intentions using layer 7 criteria [GH-8839]
    • telemetry: add initialization and definition for non-expiring key metrics in Prometheus [GH-9088]
    • telemetry: track node and service counts and emit them as metrics [GH-8603]
    • 🔧 ui: If Prometheus is being used for monitoring the sidecars, the topology view can be configured to display overview metrics for the services. [GH-8858]
    • 💻 ui: Services using Connect with Envoy sidecars have a topology tab in the UI showing their upstream and downstream services. [GH-8788]
    • xds: use envoy's rbac filter to handle intentions entirely within envoy [GH-8569]

    👌 IMPROVEMENTS:

    • agent: Return HTTP 429 when connections per clients limit (limits.http_max_conns_per_client) has been reached. [GH-8221]
    • agent: add path_allowlist config option to restrict metrics proxy queries [GH-9059]
    • agent: allow the /v1/connect/intentions/match endpoint to use the agent cache [GH-8875]
    • agent: protect the metrics proxy behind ACLs [GH-9099]
    • api: The v1/connect/ca/roots endpoint now accepts a pem=true query parameter and will return a PEM encoded certificate chain of all the certificates that would normally be in the JSON version of the response. [GH-8774]
    • 👍 api: support GetMeta() and GetNamespace() on all config entry kinds [GH-8764]
    • autopilot: (Enterprise Only) Autopilot now supports using both Redundancy Zones and Automated Upgrades together. [GH-9103]
    • checks: add health status to the failure message when gRPC healthchecks fail. [GH-8726]
    • ⚡️ chore: Update to Go 1.15 with mitigation for golang/go#42138 [GH-9036]
    • 🚚 command: remove conditional envoy bootstrap generation for versions <=1.10.0 since those are not supported [GH-8855]
    • 👍 connect: The Vault provider will now automatically renew the lease of the token used, if supported. [GH-8560]
    • 👍 connect: add support for specifying load balancing policy in service-resolver [GH-8585]
    • connect: intentions are now managed as a new config entry kind "service-intentions" [GH-8834]
    • ⚡️ raft: Update raft to v1.2.0 to prevent non-voters from becoming eligible for leader elections and adding peer id as metric label to reduce cardinality in metric names [GH-8822]
    • server: (Consul Enterprise only) ensure that we also shutdown network segment serf instances on server shutdown [GH-8786]
    • server: break up Intention.Apply monolithic method [GH-9007]
    • 📇 server: create new memdb table for storing system metadata [GH-8703]
    • 🌲 server: make sure that the various replication loggers use consistent logging [GH-8745]
    • 🚚 server: remove config entry CAS in legacy intention API bridge code [GH-9151]
    • 🚑 snapshot agent: Deregister critical snapshotting TTL check if leadership is transferred.
    • 🗄 telemetry: All metrics should be present and available to prometheus scrapers when Consul starts. If any non-deprecated metrics are missing please submit an issue with its name. [GH-9198]
    • telemetry: add config flag telemetry { disable_compat_1.9 = (true|false) } to disable deprecated metrics in 1.9 [GH-8877]
    • telemetry: add counter consul.api.http with labels for each HTTP path and method. This is intended to replace consul.http... [GH-8877]
    • 💻 ui: Add the Upstreams and Exposed Paths tabs for services in mesh [GH-9141]
    • 🚚 ui: Moves the Proxy health checks to be displayed with the Service health check under the Health Checks tab [GH-9141]
    • 🔧 ui: Upstream and downstream services in the topology tab will show a visual indication if a deny intention or intention with L7 policies is configured. [GH-8846]
    • ui: add dashboard_url_template config option for external dashboard links [GH-9002]

    🗄 DEPRECATIONS:

    • 🚀 Go 1.15 has dropped support for 32-bit binaries for Darwin, so darwin_386 builds will not be available for any 1.9.x+ releases. [GH-9036]
    • 💻 agent: ui, ui_dir and ui_content_path are now deprecated for use in agent configuration files. Use ui_config.{enabled, dir, content_path} instead. The command arguments -ui, -ui-dir, and -ui-content-path remain supported. [GH-8694]
    • 🚚 telemetry: The measurements in all of the consul.http... prefixed metrics have been migrated to consul.api.http. consul.http... prefixed metrics will be removed in a future version of Consul. [GH-8877]
    • telemetry: the disable_compat_1.9 config will cover more metrics deprecations in future 1.9 point releases. These metrics will be emitted twice for backwards compatibility - if the flag is true, only the new metric name will be written. [GH-9181]

    🐛 BUG FIXES:

    • agent: make the json/hcl decoding of ConnectProxyConfig fully work with CamelCase and snake_case [GH-8741]
    • agent: when enable_central_service_config is enabled ensure agent reload doesn't revert check state to critical [GH-8747]
    • 🛠 api: Fixed a bug where the Check.GRPCUseTLS field could not be set using snake case. [GH-8771]
    • api: Fixed a bug where additional headers configured with http_config.response_headers would not be served on index and error pages [GH-8694]
    • autopilot: (Enterprise Only) Previously servers in other zones would not be promoted when all servers in a second zone had failed. Now the actual behavior matches the docs and autopilot will promote a healthy non-voter from any zone to replace failure of an entire zone. [GH-9103]
    • autopilot: Prevent panic when requesting the autopilot health immediately after a leader is elected. [GH-9204]
    • command: when generating envoy bootstrap configs use the datacenter returned from the agent services endpoint [GH-9229]
    • 🛠 connect: Fixed an issue where the Vault intermediate was not renewed in the primary datacenter. [GH-8784]
    • connect: fix Vault provider not respecting IntermediateCertTTL [GH-8646]
    • connect: fix connect sidecars registered via the API not being automatically deregistered with their parent service after an agent restart by persisting the LocallyRegisteredAsSidecar property. [GH-8924]
    • connect: use stronger validation that ingress gateways have compatible protocols defined for their upstreams [GH-8470]
    • 👀 license: (Enterprise only) Fixed an issue where the UI would see Namespaces and SSO as licensed when they were not.
    • license: (Enterprise only) Fixed an issue where warnings about Namespaces being unlicensed would be emitted erroneously.
    • namespace: (Enterprise Only) Fixed a bug that could case snapshot restoration to fail when it contained a namespace marked for deletion while still containing other resources in that namespace. [GH-9156]
    • namespace: (Enterprise Only) Fixed an issue where namespaced services and checks were not being deleted when the containing namespace was deleted.
    • ⚡️ raft: (Enterprise only) properly update consul server meta non_voter for non-voting Enterprise Consul servers [GH-8731]
    • server: skip deleted and deleting namespaces when migrating intentions to config entries [GH-9186]
    • 🔊 telemetry: fixed a bug that caused logs to be flooded with [WARN] agent.router: Non-server in server-only area [GH-8685]
    • 💻 ui: show correct datacenter for gateways [GH-8704]

  • v1.9.0-rc1 Changes

    November 17, 2020

    1.9.0-rc1 (November 17, 2020)

    💥 BREAKING CHANGES:

    • ⚡️ connect: Update Envoy metrics names and labels for proxy listeners so that attributes like datacenter and namespace can be extracted. [GH-9207]
    • server: (Enterprise only) Pre-existing intentions defined with
      non-existent destination namespaces were non-functional and are erased during
      ⬆️ the upgrade process. This should not matter as these intentions had nothing to
      enforce. [GH-9186]
    • server: (OSS only) Pre-existing intentions defined with either a source or
      0️⃣ destination namespace value that is not "default" are rewritten or deleted
      ⬇️ during the upgrade process. Wildcards first attempt to downgrade to "default"
      unless an intention already exists, otherwise these non-functional intentions
      are deleted. [GH-9186]

    🔋 FEATURES:

    • 0️⃣ agent: return the default ACL policy to callers as a header [GH-9101]
    • autopilot: Added a new consul operator autopilot state command to retrieve and view the Autopilot state from consul. [GH-9142]

    👌 IMPROVEMENTS:

    • 🗄 agent: All metrics should be present and available to prometheus scrapers when Consul starts. If any non-deprecated metrics are missing please submit an issue with its name. [GH-9198]
    • server: break up Intention.Apply monolithic method [GH-9007]
    • 🚚 server: remove config entry CAS in legacy intention API bridge code [GH-9151]
    • 💻 ui: Add the Upstreams and Exposed Paths tabs for services in mesh [GH-9141]
    • 🚚 ui: Moves the Proxy health checks to be displayed with the Service health check under the Health Checks tab [GH-9141]

    🗄 DEPRECATIONS:

    • telemetry: the disable_compat_1.9 config will cover more metrics deprecations in future 1.9 point releases. These metrics will be emitted twice for backwards compatibility - if the flag is true, only the new metric name will be written. [GH-9181]

    🐛 BUG FIXES:

    • autopilot: Prevent panic when requesting the autopilot health immediately after a leader is elected. [GH-9204]
    • license: (Enterprise only) Fixed an issue where warnings about Namespaces being unlicensed would be emitted erroneously.
    • namespace: (Enterprise Only) Fixed a bug that could case snapshot restoration to fail when it contained a namespace marked for deletion while still containing other resources in that namespace. [GH-9156]
    • namespace: (Enterprise Only) Fixed an issue where namespaced services and checks were not being deleted when the containing namespace was deleted.
    • server: skip deleted and deleting namespaces when migrating intentions to config entries [GH-9186]

  • v1.9.0-beta3 Changes

    November 10, 2020

    1.9.0-beta3 (November 10, 2020)

    💥 BREAKING CHANGES:

    • 0️⃣ connect: Switch the default gateway port from 443 to 8443 to avoid assumption of Envoy running as root. [GH-9113]
    • ⬆️ raft: Raft protocol v2 is no longer supported. If currently using protocol v2 then an intermediate upgrade to a version supporting both v2 and v3 protocols will be necessary (1.0.0 - 1.8.x). Note that the Raft protocol configured with the raft_protocol setting and the Consul RPC protocol configured with the protocol setting and output by the consul version command are distinct and supported Consul RPC protocol versions are not altered. [GH-9103]

    🔋 FEATURES:

    • autopilot: A new /v1/operator/autopilot/state HTTP API was created to give greater visibility into what autopilot is doing and how it has classified all the servers it is tracking. [GH-9103]

    👌 IMPROVEMENTS:

    • autopilot: (Enterprise Only) Autopilot now supports using both Redundancy Zones and Automated Upgrades together. [GH-9103]
    • ⚡️ chore: update to Go 1.14.11 with mitigation for golang/go#42138 [GH-9119]

    🐛 BUG FIXES:

    • autopilot: (Enterprise Only) Previously servers in other zones would not be promoted when all servers in a second zone had failed. Now the actual behavior matches the docs and autopilot will promote a healthy non-voter from any zone to replace failure of an entire zone. [GH-9103]