All Versions
202
Latest Version
Avg Release Cycle
65 days
Latest Release
3 days ago

Changelog History
Page 9

  • v1.9.0-rc1 Changes

    November 17, 2020

    1.9.0-rc1 (November 17, 2020)

    💥 BREAKING CHANGES:

    • ⚡️ connect: Update Envoy metrics names and labels for proxy listeners so that attributes like datacenter and namespace can be extracted. [GH-9207]
    • server: (Enterprise only) Pre-existing intentions defined with
      non-existent destination namespaces were non-functional and are erased during
      ⬆️ the upgrade process. This should not matter as these intentions had nothing to
      enforce. [GH-9186]
    • server: (OSS only) Pre-existing intentions defined with either a source or
      0️⃣ destination namespace value that is not "default" are rewritten or deleted
      ⬇️ during the upgrade process. Wildcards first attempt to downgrade to "default"
      unless an intention already exists, otherwise these non-functional intentions
      are deleted. [GH-9186]

    🔋 FEATURES:

    • 0️⃣ agent: return the default ACL policy to callers as a header [GH-9101]
    • autopilot: Added a new consul operator autopilot state command to retrieve and view the Autopilot state from consul. [GH-9142]

    👌 IMPROVEMENTS:

    • 🗄 agent: All metrics should be present and available to prometheus scrapers when Consul starts. If any non-deprecated metrics are missing please submit an issue with its name. [GH-9198]
    • server: break up Intention.Apply monolithic method [GH-9007]
    • 🚚 server: remove config entry CAS in legacy intention API bridge code [GH-9151]
    • 💻 ui: Add the Upstreams and Exposed Paths tabs for services in mesh [GH-9141]
    • 🚚 ui: Moves the Proxy health checks to be displayed with the Service health check under the Health Checks tab [GH-9141]

    🗄 DEPRECATIONS:

    • telemetry: the disable_compat_1.9 config will cover more metrics deprecations in future 1.9 point releases. These metrics will be emitted twice for backwards compatibility - if the flag is true, only the new metric name will be written. [GH-9181]

    🐛 BUG FIXES:

    • autopilot: Prevent panic when requesting the autopilot health immediately after a leader is elected. [GH-9204]
    • license: (Enterprise only) Fixed an issue where warnings about Namespaces being unlicensed would be emitted erroneously.
    • namespace: (Enterprise Only) Fixed a bug that could case snapshot restoration to fail when it contained a namespace marked for deletion while still containing other resources in that namespace. [GH-9156]
    • namespace: (Enterprise Only) Fixed an issue where namespaced services and checks were not being deleted when the containing namespace was deleted.
    • server: skip deleted and deleting namespaces when migrating intentions to config entries [GH-9186]

  • v1.9.0-beta3 Changes

    November 10, 2020

    1.9.0-beta3 (November 10, 2020)

    💥 BREAKING CHANGES:

    • 0️⃣ connect: Switch the default gateway port from 443 to 8443 to avoid assumption of Envoy running as root. [GH-9113]
    • ⬆️ raft: Raft protocol v2 is no longer supported. If currently using protocol v2 then an intermediate upgrade to a version supporting both v2 and v3 protocols will be necessary (1.0.0 - 1.8.x). Note that the Raft protocol configured with the raft_protocol setting and the Consul RPC protocol configured with the protocol setting and output by the consul version command are distinct and supported Consul RPC protocol versions are not altered. [GH-9103]

    🔋 FEATURES:

    • autopilot: A new /v1/operator/autopilot/state HTTP API was created to give greater visibility into what autopilot is doing and how it has classified all the servers it is tracking. [GH-9103]

    👌 IMPROVEMENTS:

    • autopilot: (Enterprise Only) Autopilot now supports using both Redundancy Zones and Automated Upgrades together. [GH-9103]
    • ⚡️ chore: update to Go 1.14.11 with mitigation for golang/go#42138 [GH-9119]

    🐛 BUG FIXES:

    • autopilot: (Enterprise Only) Previously servers in other zones would not be promoted when all servers in a second zone had failed. Now the actual behavior matches the docs and autopilot will promote a healthy non-voter from any zone to replace failure of an entire zone. [GH-9103]

  • v1.9.0-beta2 Changes

    November 07, 2020

    1.9.0-beta2 (November 07, 2020)

    💥 BREAKING CHANGES:

    • sentinel: (Consul Enterprise only) update to v0.16.0, which replaces whitelist and blacklist with allowlist and denylist

    🔒 SECURITY:

    • 🛠 Fix Consul Enterprise Namespace Config Entry Replication DoS. Previously an operator with service:write ACL permissions in a Consul Enterprise cluster could write a malicious config entry that caused infinite raft writes due to issues with the namespace replication logic. [CVE-2020-25201] [GH-9024]

    🔋 FEATURES:

    • agent: Add a new RPC endpoint for streaming cluster state change events to clients.
    • telemetry: add initialization and definition for non-expiring key metrics in Prometheus [GH-9088]

    👌 IMPROVEMENTS:

    • agent: add path_allowlist config option to restrict metrics proxy queries [GH-9059]
    • agent: protect the metrics proxy behind ACLs [GH-9099]
    • ui: add dashboard_url_template config option for external dashboard links [GH-9002]

    🐛 BUG FIXES:

    • 🛠 api: Fixed a bug where the Check.GRPCUseTLS field could not be set using snake case. [GH-8771]
    • connect: fix connect sidecars registered via the API not being automatically deregistered with their parent service after an agent restart by persisting the LocallyRegisteredAsSidecar property. [GH-8924]
    • 💻 ui: hide metrics for ingress gateways until full support can be implemented [GH-9081]
    • 💻 ui: only show topology tab for services that exist [GH-9008]

  • v1.9.0-beta1 Changes

    October 12, 2020

    1.9.0-beta1 (October 12, 2020)

    💥 BREAKING CHANGES:

    • agent: The enable_central_service_config option now defaults to true. [GH-8746]
    • connect: intention destinations can no longer be renamed [GH-8834]
    • 👍 xds: Drop support for Envoy versions 1.12.0, 1.12.1, 1.12.2, and 1.13.0, due to a lack of support for url_path in RBAC. [GH-8839]

    🔋 FEATURES:

    • 🔧 agent: Allow client agents to be configured with an advertised reconnect timeout to control how long until the nodes are reaped by others in the cluster. [GH-8781]
    • 🔧 agent: moved ui config options to a new ui_config stanza in agent configuration and added new options to display service metrics in the UI. [GH-8694]
    • ⚡️ cli: update snapshot inspect command to provide more detailed snapshot data [GH-8787]
    • connect: intentions are now managed as a new config entry kind "service-intentions" [GH-8834]
    • 👍 connect: support defining intentions using layer 7 criteria [GH-8839]
    • 📇 server: create new memdb table for storing system metadata [GH-8703]
    • telemetry: track node and service counts and emit them as metrics [GH-8603]
    • 🔧 ui: If Prometheus is being used for monitoring the sidecars, the topology view can be configured to display overview metrics for the services. [GH-8858]
    • 💻 ui: Services using Connect with Envoy sidecars have a topology tab in the UI showing their upstream and downstream services. [GH-8788]
    • xds: use envoy's rbac filter to handle intentions entirely within envoy [GH-8569]

    👌 IMPROVEMENTS:

    • agent: Return HTTP 429 when connections per clients limit (limits.http_max_conns_per_client) has been reached GH-7527. [GH-8221]
    • agent: add config flag telemetry { disable_compat_1.9 = (true|false) } to disable deprecated metrics in 1.9 [GH-8877]
    • agent: add counter consul.api.http with labels for each HTTP path and method. This is intended to replace consul.http... [GH-8877]
    • agent: allow the /v1/connect/intentions/match endpoint to use the agent cache [GH-8875]
    • api: The v1/connect/ca/roots endpoint now accepts a pem=true query parameter and will return a PEM encoded certificate chain of
      all the certificates that would normally be in the JSON version of the response. [GH-8774]
    • 👍 api: support GetMeta() and GetNamespace() on all config entry kinds [GH-8764]
    • checks: add health status to the failure message when gRPC healthchecks fail. [GH-8726]
    • 🚚 command: remove conditional envoy bootstrap generation for versions <=1.10.0 since those are not supported [GH-8855]
    • 👍 connect: The Vault provider will now automatically renew the lease of the token used, if supported. [GH-8560]
    • 👍 connect: add support for specifying load balancing policy in service-resolver [GH-8585]
    • ⚡️ deps: Update raft to v1.2.0 to prevent non-voters from becoming eligible for leader elections and adding peer id as metric label to reduce cardinality in metric names [GH-8822]
    • server: (Consul Enterprise only) ensure that we also shutdown network segment serf instances on server shutdown [GH-8786]
    • 🌲 server: make sure that the various replication loggers use consistent logging [GH-8745]
    • 🚑 snapshot agent: Deregister critical snapshotting TTL check if leadership is transferred.
    • 🔧 ui: Upstream and downstream services in the topology tab will show a visual indication if a deny intention or intention with L7 policies is configured. [GH-8846]

    🗄 DEPRECATIONS:

    • 🚚 agent: The measurements in all of the consul.http... prefixed metrics have been migrated to consul.api.http. consul.http... prefixed metrics will be removed in a future version of Consul. [GH-8877]
    • 💻 agent: ui, ui_dir and ui_content_path are now deprecated for use in agent configuration files. Use ui_config.{enable, dir, content_path} instead. The command arguments -ui, -ui-dir, and -ui-content-path remain supported. [GH-8694]

    🐛 BUG FIXES:

    • agent: make the json/hcl decoding of ConnectProxyConfig fully work with CamelCase and snake_case [GH-8741]
    • agent: when enable_central_service_config is enabled ensure agent reload doesn't revert check state to critical [GH-8747]
    • 🛠 connect: Fixed an issue where the Vault intermediate was not renewed in the primary datacenter. [GH-8784]
    • connect: fix Vault provider not respecting IntermediateCertTTL [GH-8646]
    • connect: use stronger validation that ingress gateways have compatible protocols defined for their upstreams [GH-8470]
    • 🛠 fixed a bug that caused logs to be flooded with [WARN] agent.router: Non-server in server-only area [GH-8685]
    • 👀 license: (Enterprise only) Fixed an issue where the UI would see Namespaces and SSO as licensed when they were not.
    • ⚡️ raft: (Enterprise only) properly update consul server meta non_voter for non-voting Enterprise Consul servers [GH-8731]
    • 💻 ui: show correct datacenter for gateways [GH-8704]

  • v1.8.19 Changes

    December 15, 2021

    🔒 SECURITY:

  • v1.8.18 Changes

    December 13, 2021

    🔒 SECURITY:

    • ⬆️ ci: Upgrade to Go 1.16.12 to address CVE-2021-44716 [GH-11806]
    • namespaces: (Enterprise only) Creating or editing namespaces that include default ACL policies or ACL roles now requires acl:write permission in the default namespace. This change fixes CVE-2021-41805.

    🐛 BUG FIXES:

    • snapshot: (Enterprise only) fixed a bug where the snapshot agent would ignore the license_path setting in config files
    • 💻 ui: Fixes an issue where under some circumstances after logging we present the 🌲 data loaded previous to you logging in. [GH-11681]
    • ui: Include Service.Namespace into available variables for dashboard_url_templates [GH-11640]

  • v1.8.17 Changes

    November 11, 2021

    🔒 SECURITY:

    • namespaces: (Enterprise only) Creating or editing namespaces that include default ACL policies or ACL roles now requires acl:write permission in the default namespace. This change fixes CVE-2021-41805.

    👌 IMPROVEMENTS:

    • 🚀 ci: Artifact builds will now only run on merges to the release branches or to main [GH-11417]
    • 🐧 ci: The Linux packages are now available for all supported Linux architectures including arm, arm64, 386, and amd64 [GH-11417]
    • 🚀 ci: The Linux packaging service configs and pre/post install scripts are now available under [.release/linux] [GH-11417]

    🐛 BUG FIXES:

    • 🛠 acl: fixes the fallback behaviour of down_policy with setting extend-cache/async-cache when the token is not cached. [GH-11136]
    • raft: Consul leaders will attempt to transfer leadership to another server as part of gracefully leaving the cluster. [GH-11242]
    • rpc: only attempt to authorize the DNSName in the client cert when verify_incoming_rpc=true [GH-11255]
    • server: (Enterprise only) Ensure that servers leave network segments when leaving other gossip pools
    • 💻 ui: Fixed styling of Role delete confirmation button with the Token edit page [GH-11297]
    • 🛠 xds: fixes a bug where replacing a mesh gateway node used for WAN federation (with another that has a different IP) could leave gateways in the other DC unable to re-establish the connection [GH-11522]

  • v1.8.16 Changes

    September 27, 2021

    🔋 FEATURES:

    • sso/oidc: (Enterprise only) Add support for providing acr_values in OIDC auth flow [GH-11026]

    👌 IMPROVEMENTS:

    • audit-logging: (Enterprise Only) Audit logs will now include select HTTP headers in each logs payload. Those headers are: Forwarded, Via, X-Forwarded-For, X-Forwarded-Host and X-Forwarded-Proto. [GH-11107]

    🐛 BUG FIXES:

    • tls: consider presented intermediates during server connection tls handshake. [GH-10964]
    • ui: (Enterprise Only) Fixes a visual issue where namespaces would "double up" in the Source/Destination select menu when creating/editing intentions [GH-11102]

  • v1.8.15 Changes

    August 27, 2021

    KNOWN ISSUES:

    • 🚀 tls: The fix for CVE-2021-37219 introduced an issue that could prevent TLS certificate validation when intermediate CA certificates used to sign server certificates are transmitted in the TLS session but are not present in all Consul server's configured CA certificates. This has the effect of preventing Raft RPCs between the affected servers. As a work around until the next patch releases, ensure that all intermediate CA certificates are present in all Consul server configurations prior to using certificates that they have signed.

    🔒 SECURITY:

    👌 IMPROVEMENTS:

    • areas: (Enterprise only) Add 15s timeout to opening streams over pooled connections.
    • areas: (Enterprise only) Apply backpressure to area gossip packet ingestion when more than 512 packets are waiting to be ingested.
    • areas: (Enterprise only) Make implementation of WriteToAddress non-blocking to avoid slowing down memberlist's packetListen routine.
    • ⚡️ deps: update to gogo/protobuf v1.3.2 [GH-10813]

    🐛 BUG FIXES:

    • 0️⃣ acl: fixes a bug that prevented the default user token from being used to authorize service registration for connect proxies. [GH-10824]
    • 🛠 ca: fixed a bug when ca provider fail and provider state is stuck in INITIALIZING state. [GH-10630]
    • ca: report an error when setting the ca config fail because of an index check. [GH-10657]
    • 🔧 cli: Ensure the metrics endpoint is accessible when Envoy is configured to use 0️⃣ a non-default admin bind address. [GH-10757]
    • cli: Fix a bug which prevented initializing a watch when using a namespaced token. [GH-10795]
    • connect: proxy upstreams inherit namespace from service if none are defined. [GH-10688]
    • 🛠 dns: fixes a bug with edns truncation where the response could exceed the size limit in some cases. [GH-10009]
    • 🛠 txn: fixes Txn.Apply to properly authorize service registrations. [GH-10798]

  • v1.8.14 Changes

    July 15, 2021

    🔒 SECURITY:

    🐛 BUG FIXES:

    • 🛠 ca: Fixed a bug that returned a malformed certificate chain when the certificate did not having a trailing newline. [GH-10411]