hashicorp/consul v1.9.0

on GitHub

1.9.0 (November 24, 2020)

BREAKING CHANGES:

• agent: The enable_central_service_config option now defaults to true. [GH-8746]
• connect: Switch the default gateway port from 443 to 8443 to avoid assumption of Envoy running as root. [GH-9113]
• connect: Update Envoy metrics names and labels for proxy listeners so that attributes like datacenter and namespace can be extracted. [GH-9207]
• connect: intention destinations can no longer be reassigned [GH-8834]
• raft: Raft protocol v2 is no longer supported. If currently using protocol v2 then an intermediate upgrade to a version supporting both v2 and v3 protocols will be necessary (1.0.0 - 1.8.x). Note that the Raft protocol configured with the raft_protocol setting and the Consul RPC protocol configured with the protocol setting and output by the consul version command are distinct and supported Consul RPC protocol versions are not altered. [GH-9103]
• sentinel: (Consul Enterprise only) update to v0.16.0, which replaces whitelist and blacklist with allowlist and denylist
• server: (Enterprise only) Pre-existing intentions defined with
  non-existent destination namespaces were non-functional and are erased during
  the upgrade process. This should not matter as these intentions had nothing to
  enforce. [GH-9186]
• server: (OSS only) Pre-existing intentions defined with either a source or
  destination namespace value that is not "default" are rewritten or deleted
  during the upgrade process. Wildcards first attempt to downgrade to "default"
  unless an intention already exists, otherwise these non-functional intentions
  are deleted. [GH-9186]
• xds: Drop support for Envoy versions 1.12.0, 1.12.1, 1.12.2, and 1.13.0, due to a lack of support for url_path in RBAC. [GH-8839]

SECURITY:

• Fix Consul Enterprise Namespace Config Entry Replication DoS. Previously an operator with service:write ACL permissions in a Consul Enterprise cluster could write a malicious config entry that caused infinite raft writes due to issues with the namespace replication logic. [CVE-2020-25201] [GH-9024]
• Increase the permissions to read from the /connect/ca/configuration endpoint to operator:write. Previously Connect CA configuration, including the private key, set via this endpoint could be read back by an operator with operator:read privileges. CVE-2020-28053 [GH-9240]

FEATURES:

• agent: Add a new RPC endpoint for streaming cluster state change events to clients.
• agent: Allow client agents to be configured with an advertised reconnect timeout to control how long until the nodes are reaped by others in the cluster. [GH-8781]
• agent: moved ui config options to a new ui_config stanza in agent configuration and added new options to display service metrics in the UI. [GH-8694]
• agent: return the default ACL policy to callers as a header [GH-9101]
• autopilot: A new /v1/operator/autopilot/state HTTP API was created to give greater visibility into what autopilot is doing and how it has classified all the servers it is tracking. [GH-9103]
• autopilot: Added a new consul operator autopilot state command to retrieve and view the Autopilot state from consul. [GH-9142]
• cli: update snapshot inspect command to provide more detailed snapshot data [GH-8787]
• connect: support defining intentions using layer 7 criteria [GH-8839]
• telemetry: add initialization and definition for non-expiring key metrics in Prometheus [GH-9088]
• telemetry: track node and service counts and emit them as metrics [GH-8603]
• ui: If Prometheus is being used for monitoring the sidecars, the topology view can be configured to display overview metrics for the services. [GH-8858]
• ui: Services using Connect with Envoy sidecars have a topology tab in the UI showing their upstream and downstream services. [GH-8788]
• xds: use envoy's rbac filter to handle intentions entirely within envoy [GH-8569]

IMPROVEMENTS:

• agent: Return HTTP 429 when connections per clients limit (limits.http_max_conns_per_client) has been reached. [GH-8221]
• agent: add path_allowlist config option to restrict metrics proxy queries [GH-9059]
• agent: allow the /v1/connect/intentions/match endpoint to use the agent cache [GH-8875]
• agent: protect the metrics proxy behind ACLs [GH-9099]
• api: The v1/connect/ca/roots endpoint now accepts a pem=true query parameter and will return a PEM encoded certificate chain of all the certificates that would normally be in the JSON version of the response. [GH-8774]
• api: support GetMeta() and GetNamespace() on all config entry kinds [GH-8764]
• autopilot: (Enterprise Only) Autopilot now supports using both Redundancy Zones and Automated Upgrades together. [GH-9103]
• checks: add health status to the failure message when gRPC healthchecks fail. [GH-8726]
• chore: Update to Go 1.15 with mitigation for golang/go#42138 [GH-9036]
• command: remove conditional envoy bootstrap generation for versions <=1.10.0 since those are not supported [GH-8855]
• connect: The Vault provider will now automatically renew the lease of the token used, if supported. [GH-8560]
• connect: add support for specifying load balancing policy in service-resolver [GH-8585]
• connect: intentions are now managed as a new config entry kind "service-intentions" [GH-8834]
• raft: Update raft to v1.2.0 to prevent non-voters from becoming eligible for leader elections and adding peer id as metric label to reduce cardinality in metric names [GH-8822]
• server: (Consul Enterprise only) ensure that we also shutdown network segment serf instances on server shutdown [GH-8786]
• server: break up Intention.Apply monolithic method [GH-9007]
• server: create new memdb table for storing system metadata [GH-8703]
• server: make sure that the various replication loggers use consistent logging [GH-8745]
• server: remove config entry CAS in legacy intention API bridge code [GH-9151]
• snapshot agent: Deregister critical snapshotting TTL check if leadership is transferred.
• telemetry: All metrics should be present and available to prometheus scrapers when Consul starts. If any non-deprecated metrics are missing please submit an issue with its name. [GH-9198]
• telemetry: add config flag telemetry { disable_compat_1.9 = (true|false) } to disable deprecated metrics in 1.9 [GH-8877]
• telemetry: add counter consul.api.http with labels for each HTTP path and method. This is intended to replace consul.http... [GH-8877]
• ui: Add the Upstreams and Exposed Paths tabs for services in mesh [GH-9141]
• ui: Moves the Proxy health checks to be displayed with the Service health check under the Health Checks tab [GH-9141]
• ui: Upstream and downstream services in the topology tab will show a visual indication if a deny intention or intention with L7 policies is configured. [GH-8846]
• ui: add dashboard_url_template config option for external dashboard links [GH-9002]

DEPRECATIONS:

• Go 1.15 has dropped support for 32-bit binaries for Darwin, so darwin_386 builds will not be available for any 1.9.x+ releases. [GH-9036]
• agent: ui, ui_dir and ui_content_path are now deprecated for use in agent configuration files. Use ui_config.{enable, dir, content_path} instead. The command arguments -ui, -ui-dir, and -ui-content-path remain supported. [GH-8694]
• telemetry: The measurements in all of the consul.http... prefixed metrics have been migrated to consul.api.http. consul.http... prefixed metrics will be removed in a future version of Consul. [GH-8877]
• telemetry: the disable_compat_1.9 config will cover more metrics deprecations in future 1.9 point releases. These metrics will be emitted twice for backwards compatibility - if the flag is true, only the new metric name will be written. [GH-9181]

BUG FIXES:

• agent: make the json/hcl decoding of ConnectProxyConfig fully work with CamelCase and snake_case [GH-8741]
• agent: when enable_central_service_config is enabled ensure agent reload doesn't revert check state to critical [GH-8747]
• api: Fixed a bug where the Check.GRPCUseTLS field could not be set using snake case. [GH-8771]
• autopilot: (Enterprise Only) Previously servers in other zones would not be promoted when all servers in a second zone had failed. Now the actual behavior matches the docs and autopilot will promote a healthy non-voter from any zone to replace failure of an entire zone. [GH-9103]
• autopilot: Prevent panic when requesting the autopilot health immediately after a leader is elected. [GH-9204]
• command: when generating envoy bootstrap configs use the datacenter returned from the agent services endpoint [GH-9229]
• connect: Fixed an issue where the Vault intermediate was not renewed in the primary datacenter. [GH-8784]
• connect: fix Vault provider not respecting IntermediateCertTTL [GH-8646]
• connect: fix connect sidecars registered via the API not being automatically deregistered with their parent service after an agent restart by persisting the LocallyRegisteredAsSidecar property. [GH-8924]
• connect: use stronger validation that ingress gateways have compatible protocols defined for their upstreams [GH-8470]
• license: (Enterprise only) Fixed an issue where the UI would see Namespaces and SSO as licensed when they were not.
• license: (Enterprise only) Fixed an issue where warnings about Namespaces being unlicensed would be emitted erroneously.
• namespace: (Enterprise Only) Fixed a bug that could case snapshot restoration to fail when it contained a namespace marked for deletion while still containing other resources in that namespace. [GH-9156]
• namespace: (Enterprise Only) Fixed an issue where namespaced services and checks were not being deleted when the containing namespace was deleted.
• raft: (Enterprise only) properly update consul server meta non_voter for non-voting Enterprise Consul servers [GH-8731]
• server: skip deleted and deleting namespaces when migrating intentions to config entries [GH-9186]
• telemetry: fixed a bug that caused logs to be flooded with [WARN] agent.router: Non-server in server-only area [GH-8685]
• ui: show correct datacenter for gateways [GH-8704]