« Changelog History


consul v1.9.0 Release Notes

Release Date: 2020-11-24 // over 3 years ago

  • 💥 BREAKING CHANGES:

    • agent: The enable_central_service_config option now defaults to true. [GH-8746]
    • 0️⃣ connect: Switch the default gateway port from 443 to 8443 to avoid assumption of Envoy running as root. [GH-9113]
    • ⚡️ connect: Update Envoy metrics names and labels for proxy listeners so that attributes like datacenter and namespace can be extracted. [GH-9207]
    • connect: intention destinations can no longer be reassigned [GH-8834]
    • ⬆️ raft: Raft protocol v2 is no longer supported. If currently using protocol v2 then an intermediate upgrade to a version supporting both v2 and v3 protocols will be necessary (1.0.0 - 1.8.x). Note that the Raft protocol configured with the raft_protocol setting and the Consul RPC protocol configured with the protocol setting and output by the consul version command are distinct and supported Consul RPC protocol versions are not altered. [GH-9103]
    • sentinel: (Consul Enterprise only) update to v0.16.0, which replaces whitelist and blacklist with allowlist and denylist
    • server: (Enterprise only) Pre-existing intentions defined with non-existent destination namespaces were non-functional and are erased during ⬆️ the upgrade process. This should not matter as these intentions had nothing to enforce. [GH-9186]
    • server: (OSS only) Pre-existing intentions defined with either a source or 0️⃣ destination namespace value that is not "default" are rewritten or deleted ⬇️ during the upgrade process. Wildcards first attempt to downgrade to "default" unless an intention already exists, otherwise these non-functional intentions are deleted. [GH-9186]
    • 👍 xds: Drop support for Envoy versions 1.12.0, 1.12.1, 1.12.2, and 1.13.0, due to a lack of support for url_path in RBAC. [GH-8839]

    🔒 SECURITY:

    • 🛠 Fix Consul Enterprise Namespace Config Entry Replication DoS. Previously an operator with service:write ACL permissions in a Consul Enterprise cluster could write a malicious config entry that caused infinite raft writes due to issues with the namespace replication logic. [CVE-2020-25201] [GH-9024]
    • 🔧 Increase the permissions to read from the /connect/ca/configuration endpoint to operator:write. Previously Connect CA configuration, including the private key, set via this endpoint could be read back by an operator with operator:read privileges. CVE-2020-28053 [GH-9240]

    🔋 FEATURES:

    • agent: Add a new RPC endpoint for streaming cluster state change events to clients.
    • 🔧 agent: Allow client agents to be configured with an advertised reconnect timeout to control how long until the nodes are reaped by others in the cluster. [GH-8781]
    • 🔧 agent: moved ui config options to a new ui_config stanza in agent configuration and added new options to display service metrics in the UI. [GH-8694]
    • 0️⃣ agent: return the default ACL policy to callers as a header [GH-9101]
    • autopilot: A new /v1/operator/autopilot/state HTTP API was created to give greater visibility into what autopilot is doing and how it has classified all the servers it is tracking. [GH-9103]
    • autopilot: Added a new consul operator autopilot state command to retrieve and view the Autopilot state from consul. [GH-9142]
    • ⚡️ cli: update snapshot inspect command to provide more detailed snapshot data [GH-8787]
    • 👍 connect: support defining intentions using layer 7 criteria [GH-8839]
    • telemetry: add initialization and definition for non-expiring key metrics in Prometheus [GH-9088]
    • telemetry: track node and service counts and emit them as metrics [GH-8603]
    • 🔧 ui: If Prometheus is being used for monitoring the sidecars, the topology view can be configured to display overview metrics for the services. [GH-8858]
    • 💻 ui: Services using Connect with Envoy sidecars have a topology tab in the UI showing their upstream and downstream services. [GH-8788]
    • xds: use envoy's rbac filter to handle intentions entirely within envoy [GH-8569]

    👌 IMPROVEMENTS:

    • agent: Return HTTP 429 when connections per clients limit (limits.http_max_conns_per_client) has been reached. [GH-8221]
    • agent: add path_allowlist config option to restrict metrics proxy queries [GH-9059]
    • agent: allow the /v1/connect/intentions/match endpoint to use the agent cache [GH-8875]
    • agent: protect the metrics proxy behind ACLs [GH-9099]
    • api: The v1/connect/ca/roots endpoint now accepts a pem=true query parameter and will return a PEM encoded certificate chain of all the certificates that would normally be in the JSON version of the response. [GH-8774]
    • 👍 api: support GetMeta() and GetNamespace() on all config entry kinds [GH-8764]
    • autopilot: (Enterprise Only) Autopilot now supports using both Redundancy Zones and Automated Upgrades together. [GH-9103]
    • checks: add health status to the failure message when gRPC healthchecks fail. [GH-8726]
    • ⚡️ chore: Update to Go 1.15 with mitigation for golang/go#42138 [GH-9036]
    • 🚚 command: remove conditional envoy bootstrap generation for versions <=1.10.0 since those are not supported [GH-8855]
    • 👍 connect: The Vault provider will now automatically renew the lease of the token used, if supported. [GH-8560]
    • 👍 connect: add support for specifying load balancing policy in service-resolver [GH-8585]
    • connect: intentions are now managed as a new config entry kind "service-intentions" [GH-8834]
    • ⚡️ raft: Update raft to v1.2.0 to prevent non-voters from becoming eligible for leader elections and adding peer id as metric label to reduce cardinality in metric names [GH-8822]
    • server: (Consul Enterprise only) ensure that we also shutdown network segment serf instances on server shutdown [GH-8786]
    • server: break up Intention.Apply monolithic method [GH-9007]
    • 📇 server: create new memdb table for storing system metadata [GH-8703]
    • 🌲 server: make sure that the various replication loggers use consistent logging [GH-8745]
    • 🚚 server: remove config entry CAS in legacy intention API bridge code [GH-9151]
    • 🚑 snapshot agent: Deregister critical snapshotting TTL check if leadership is transferred.
    • 🗄 telemetry: All metrics should be present and available to prometheus scrapers when Consul starts. If any non-deprecated metrics are missing please submit an issue with its name. [GH-9198]
    • telemetry: add config flag telemetry { disable_compat_1.9 = (true|false) } to disable deprecated metrics in 1.9 [GH-8877]
    • telemetry: add counter consul.api.http with labels for each HTTP path and method. This is intended to replace consul.http... [GH-8877]
    • 💻 ui: Add the Upstreams and Exposed Paths tabs for services in mesh [GH-9141]
    • 🚚 ui: Moves the Proxy health checks to be displayed with the Service health check under the Health Checks tab [GH-9141]
    • 🔧 ui: Upstream and downstream services in the topology tab will show a visual indication if a deny intention or intention with L7 policies is configured. [GH-8846]
    • ui: add dashboard_url_template config option for external dashboard links [GH-9002]

    🗄 DEPRECATIONS:

    • 🚀 Go 1.15 has dropped support for 32-bit binaries for Darwin, so darwin_386 builds will not be available for any 1.9.x+ releases. [GH-9036]
    • 💻 agent: ui, ui_dir and ui_content_path are now deprecated for use in agent configuration files. Use ui_config.{enabled, dir, content_path} instead. The command arguments -ui, -ui-dir, and -ui-content-path remain supported. [GH-8694]
    • 🚚 telemetry: The measurements in all of the consul.http... prefixed metrics have been migrated to consul.api.http. consul.http... prefixed metrics will be removed in a future version of Consul. [GH-8877]
    • telemetry: the disable_compat_1.9 config will cover more metrics deprecations in future 1.9 point releases. These metrics will be emitted twice for backwards compatibility - if the flag is true, only the new metric name will be written. [GH-9181]

    🐛 BUG FIXES:

    • agent: make the json/hcl decoding of ConnectProxyConfig fully work with CamelCase and snake_case [GH-8741]
    • agent: when enable_central_service_config is enabled ensure agent reload doesn't revert check state to critical [GH-8747]
    • 🛠 api: Fixed a bug where the Check.GRPCUseTLS field could not be set using snake case. [GH-8771]
    • api: Fixed a bug where additional headers configured with http_config.response_headers would not be served on index and error pages [GH-8694]
    • autopilot: (Enterprise Only) Previously servers in other zones would not be promoted when all servers in a second zone had failed. Now the actual behavior matches the docs and autopilot will promote a healthy non-voter from any zone to replace failure of an entire zone. [GH-9103]
    • autopilot: Prevent panic when requesting the autopilot health immediately after a leader is elected. [GH-9204]
    • command: when generating envoy bootstrap configs use the datacenter returned from the agent services endpoint [GH-9229]
    • 🛠 connect: Fixed an issue where the Vault intermediate was not renewed in the primary datacenter. [GH-8784]
    • connect: fix Vault provider not respecting IntermediateCertTTL [GH-8646]
    • connect: fix connect sidecars registered via the API not being automatically deregistered with their parent service after an agent restart by persisting the LocallyRegisteredAsSidecar property. [GH-8924]
    • connect: use stronger validation that ingress gateways have compatible protocols defined for their upstreams [GH-8470]
    • 👀 license: (Enterprise only) Fixed an issue where the UI would see Namespaces and SSO as licensed when they were not.
    • license: (Enterprise only) Fixed an issue where warnings about Namespaces being unlicensed would be emitted erroneously.
    • namespace: (Enterprise Only) Fixed a bug that could case snapshot restoration to fail when it contained a namespace marked for deletion while still containing other resources in that namespace. [GH-9156]
    • namespace: (Enterprise Only) Fixed an issue where namespaced services and checks were not being deleted when the containing namespace was deleted.
    • ⚡️ raft: (Enterprise only) properly update consul server meta non_voter for non-voting Enterprise Consul servers [GH-8731]
    • server: skip deleted and deleting namespaces when migrating intentions to config entries [GH-9186]
    • 🔊 telemetry: fixed a bug that caused logs to be flooded with [WARN] agent.router: Non-server in server-only area [GH-8685]
    • 💻 ui: show correct datacenter for gateways [GH-8704]