backport of commit 3944380

.changelog/13782.txt

@@ -0,0 +1,3 @@
+```release-note:feature
+deps: update to latest go-discover to provide ECS auto-discover capabilities.
+```

.changelog/14244.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+client: add support for RemoveEmptyTags in Prepared Queries templates.
+```

.changelog/14340.txt

@@ -0,0 +1,4 @@
+```release-note:feature
+connect: Add local_idle_timeout_ms to allow configuring the Envoy route idle timeout on local_app
+connect: Add IdleTimeout to service-router to allow configuring the Envoy route idle timeout
+```

.changelog/14437.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+acl: Added option to allow for an operator-generated bootstrap token to be passed to the `acl bootstrap` command.
+```

.changelog/14465.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+dns: support RFC 2782 SRV lookups for prepared queries using format `_<query id or name>._tcp.query[.<datacenter>].<domain>`.
+```

.changelog/15107.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+cli: fatal error if config file does not have HCL or JSON extension, instead of warn and skip
+```

.changelog/15253.txt

@@ -1,3 +1,3 @@
 ```release-note:bug
-connect: Fixed issue where using Vault 1.11+ as CA provider would eventually break Intermediate CAs [[GH-15217](https://github.com/hashicorp/consul/issues/15217)]
+connect: Fixed issue where using Vault 1.11+ as CA provider would eventually break Intermediate CAs in primary datacenters. A separate fix is needed to address the same issue in secondary datacenters. [[GH-15217](https://github.com/hashicorp/consul/issues/15217)]
 ```

.changelog/15274.txt

@@ -0,0 +1,3 @@
+```release-note: bug
+cli: fix ACL token processing unexpected precedence
+```

.changelog/15346.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+acl: relax permissions on the `WatchServers`, `WatchRoots` and `GetSupportedDataplaneFeatures` gRPC endpoints to accept *any* valid ACL token
+```

.changelog/15423.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+sdk: Fix SDK testutil backwards compatibility by only configuring grpc_tls port for new Consul versions.
+```

.changelog/15466.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+cli: Fix issue where `consul connect envoy` incorrectly uses the HTTPS API configuration for xDS connections.
+```

.changelog/15503.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+peering: fix the limit of replication gRPC message; set to 8MB
+```

.changelog/15525.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ca: Fixed issue where using Vault as Connect CA with Vault-managed policies would error on start-up if the intermediate PKI mount existed but was empty
+```

.changelog/15541.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+agent: Fixed issue where blocking queries with short waits could timeout on the client
+```

.changelog/15555.txt

@@ -0,0 +1,3 @@
+```release-note:feature
+ui: Add field for fallback server addresses to peer token generation form 
+```

.changelog/15596.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+dns: Add support for cluster peering `.service` and `.node` DNS queries.
+```

.changelog/15598.txt

@@ -0,0 +1,4 @@
+```release-note:breaking-change
+config: Deprecate `-join`, `-join-wan`, `start_join`, and `start_join_wan`.
+These options are now aliases of `-retry-join`, `-retry-join-wan`, `retry_join`, and `retry_join_wan`, respectively.
+```

.changelog/15610.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+acl: avoid debug log spam in secondary datacenter servers due to management token not being initialized.
+```

.changelog/15614.txt

@@ -0,0 +1,7 @@
+```release-note:feature
+config-entry(ingress-gateway): support outlier detection (passive health check) for upstream cluster
+```
+
+```release-note:breaking-change
+ingress-gateway: upstream cluster will have empty outlier_detection if passive health check is unspecified
+```

.changelog/15615.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+peering: better represent non-passing states during peer check flattening
+```

.changelog/15654.txt

@@ -0,0 +1,3 @@
+```release-note:feature
+cli: Adds new command - `consul services export` - for exporting a service to a peer or partition
+```

.changelog/15659.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+connect: Add support for ConsulResolver to specifies a filter expression
+```

.changelog/15661.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+connect: Fixed issue where using Vault 1.11+ as CA provider in a secondary datacenter would eventually break Intermediate CAs
+```

.changelog/15669.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+connect: ensure all vault connect CA tests use limited privilege tokens
+```

.changelog/15690.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+connect: Fix peering failovers ignoring local mesh gateway configuration.
+```

.changelog/15697.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+peering: Newly created peering connections must use only lowercase characters in the `name` field. Existing peerings with uppercase characters will not be modified, but they may encounter issues in various circumstances. To maintain forward compatibility and avoid issues, it is recommended to destroy and re-create any invalid peering connections so that they do not have a name containing uppercase characters.
+```

.changelog/15701.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+grpc: Use new balancer implementation to reduce periodic WARN logs when shuffling servers.
+```

.changelog/15705.txt

@@ -0,0 +1,3 @@
+```release-note:security
+Upgrade to use Go 1.19.4. This resolves a vulnerability where restricted files can be read on Windows. [CVE-2022-41720](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41720)
+```

.changelog/15710.txt

@@ -0,0 +1,4 @@
+```release-note:breaking-change
+xds: Remove the `connect.enable_serverless_plugin` agent configuration option. Now 
+Lambda integration is enabled by default.
+```

.changelog/15737.txt

@@ -0,0 +1,4 @@
+```release-note:security
+Upgrades `golang.org/x/net` to prevent a denial of service by excessive memory usage caused by HTTP2 requests. [CVE-2022-41717](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2022-41717)
+```
+

.changelog/15760.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+connect: Fix issue where DialedDirectly configuration was not used by Consul Dataplane.
+```

.changelog/15769.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+agent: Fix assignment of error when auto-reloading cert and key file changes.
+```

.changelog/15789.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+xds: fix bug where sessions for locally-managed services could fail with "this server has too many xDS streams open"
+```

.changelog/15794.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+cli: connect envoy command errors if grpc ports are not open
+```

.changelog/15817.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+extensions: Refactor Lambda integration to get configured with the Envoy extensions field on service-defaults configuration entries.
+```

.changelog/15818.txt

@@ -0,0 +1,6 @@
+```release-note:enhancement
+connect: for early awareness of Envoy incompatibilities, when using the `consul connect envoy` command the Envoy version will now be checked for compatibility. If incompatible Consul will error and exit.
+```
+```release-note:breaking-change
+connect: Consul will now error and exit when using the `consul connect envoy` command if the Envoy version is incompatible. To ignore this check use flag `--ignore-envoy-compatibility`
+```

.changelog/15828.txt

@@ -0,0 +1,4 @@
+```release-note:feature
+acl: Add new `acl.tokens.config_file_registration` config field which specifies the token used
+to register services and checks that are defined in config files.
+```

.changelog/15833.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+connect: Fix issue where service-resolver protocol checks incorrectly errored for failover peer targets.
+```

.changelog/15864.txt

@@ -0,0 +1,3 @@
+```release-note:feature
+connect: adds support for Envoy [access logging](https://developer.hashicorp.com/consul/docs/connect/observability/access-logs). Access logging can be enabled using the [`proxy-defaults`](https://developer.hashicorp.com/consul/docs/connect/config-entries/proxy-defaults#accesslogs) config entry.
+```

.changelog/15865.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+connect: Fix issue where watches on upstream failover peer targets did not always query the correct data.
+```

.changelog/15866.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+agent: Fix issue where the agent cache would incorrectly mark protobuf objects as updated.
+```

.changelog/15884.txt

@@ -0,0 +1,3 @@
+```release-note:feature
+acl: anonymous token is logged as 'anonymous token' instead of its accessor ID
+```

.changelog/15892.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+grpc: client agents will switch server on error, and automatically retry on `RESOURCE_EXHAUSTED` responses
+```

.changelog/15906.txt

@@ -0,0 +1,7 @@
+```release-note:feature
+xds: Add a built-in Envoy extension that inserts Lua HTTP filters.
+```
+
+```release-note:feature
+xds: Insert originator service identity into Envoy's dynamic metadata under the `consul` namespace.
+```

.changelog/15913.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+cli: Fix issue where `consul connect envoy` was unable to configure TLS over unix-sockets to gRPC.
+```

.changelog/15922.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+acl: remove all functionality and references for legacy acl policies.
+```

.changelog/15947.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+acl: remove all acl migration functionality and references to the legacy acl system.
+```

.changelog/15956.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+connect: Add `peer` field to service-defaults upstream overrides. The addition of this field makes it possible to apply upstream overrides only to peer services. Prior to this change, overrides would be applied based on matching the `namespace` and `name` fields only, which means users could not have different configuration for local versus peer services. With this change, peer upstreams are only affected if the `peer` field matches the destination peer name.
+```

.changelog/15967.txt

@@ -0,0 +1,9 @@
+```release-note:improvement
+connect: Warn if ACLs are enabled but a token is not provided to envoy
+```
+
+```release-note:improvement
+telemetry: Added a `consul.xds.server.streamsUnauthenticated` metric to track 
+the number of active xDS streams handled by the server that are unauthenticated
+because ACLs are not enabled or ACL tokens were missing.
+````

.changelog/15970.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ca: support Vault agent auto-auth config for Vault CA provider using AWS/GCP authentication.
+```

.changelog/15979.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+envoy: add `MaxEjectionPercent` and `BaseEjectionTime` to passive health check configs.
+```

.changelog/15987.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+api: Enable setting query options on agent force-leave endpoint.
+```

.changelog/15988.txt

@@ -0,0 +1,3 @@
+```release-note:improvements
+cli: Added a flag, `-enable-config-gen-logging`, to the `connect envoy` command to display log messages when generating the bootstrap config.
+```

.changelog/16000.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+connect: Fix configuration merging for transparent proxy upstreams. Proxy-defaults and service-defaults config entries were not correctly merged for implicit upstreams in transparent proxy mode and would result in some configuration not being applied. To avoid issues when upgrading, ensure that any proxy-defaults or service-defaults have correct configuration for upstreams, since all fields will now be properly used to configure proxies.
+```

.changelog/16009.txt

@@ -0,0 +1,3 @@
+```release-note:deprecation
+acl: Deprecate the `token` query parameter and warn when it is used for authentication.
+```

.changelog/16015.txt

@@ -0,0 +1,3 @@
+```release-note:feature
+connect: add flags `envoy-ready-bind-port` and `envoy-ready-bind-address` to the `consul connect envoy` command that allows configuration of readiness probe on proxy for any service kind.
+```

.changelog/16024.txt

@@ -0,0 +1,4 @@
+```release-note:improvement
+partitiion: **(Consul Enterprise only)** when loading service from on-disk config file or sending API request to agent endpoint,
+if the partition is unspecified, consul will default the partition in the request to agent's partition
+```

.changelog/16044.txt

@@ -0,0 +1,3 @@
+```release-note:deprecation
+cli: The `-id` flag on acl token operations has been changed to `-accessor-id` for clarity in documentation. The `-id` flag will continue to work, but operators should use `-accessor-id` in the future.
+```

.changelog/16097.txt

@@ -0,0 +1,3 @@
+```release-note:bug-fix
+agent: Only use the `agent` token for internal deregistration of checks and services during anti-entropy syncing. The service token specified in the `token` field of the check or service definition is no longer used for deregistration. This fixes an issue where the agent failed to ever deregister a service or check if the service token was deleted.
+```

.changelog/16105.txt

@@ -0,0 +1,11 @@
+```release-note:breaking-change
+acl errors: Delete and get requests now return descriptive errors when the specified resource cannot be found. Other ACL request errors provide more information about when a resource is missing. Add error for when the ACL system has not been bootstrapped.
+1. Delete Token/Policy/AuthMethod/Role/BindingRule endpoints now return 404 when the resource cannot be found.
+  - New error formats: "Requested * does not exist: ACL not found", "* not found in namespace $NAMESPACE: ACL not found"
+3. Read Token/Policy/Role endpoints now return 404 when the resource cannot be found.
+  - New error format: "Cannot find * to delete"
+4. Logout now returns a 401 error when the supplied token cannot be found
+  - New error format: "Supplied token does not exist"
+5. Token Self endpoint now returns 404 when the token cannot be found.
+  - New error format: "Supplied token does not exist"
+```

.changelog/16176.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+raft: Added experimental `wal` backend for log storage.
+```

.changelog/16204.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Update sidebar width to 280px
+```

.changelog/16205.txt

@@ -0,0 +1,3 @@
+```release-note:feature
+command: Adds the `operator usage instances` subcommand for displaying total services, connect service instances and billable service instances in the local datacenter or globally.
+```

.changelog/16224.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ca: support Vault agent auto-auth config for Vault CA provider using AliCloud authentication.
+```

.changelog/16227.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: update Ember version to 3.27;
+```

.changelog/16230.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+peering: Fix issue where secondary wan-federated datacenters could not be used as peering acceptors.
+```

.changelog/16251.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: update from <button> and <a> to design-system-components button <Hds::Button>
+```

.changelog/16257.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+peering: Fix issue where mesh gateways would use the wrong address when contacting a remote peer with the same datacenter name.
+```

.changelog/16259.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ca: support Vault agent auto-auth config for Vault CA provider using AppRole authentication.
+```

.changelog/16262.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ca: support Vault agent auto-auth config for Vault CA provider using Kubernetes authentication.
+```

.changelog/16263.txt

@@ -0,0 +1,4 @@
+```release-note:security
+Upgrade to use Go 1.20.1. 
+This resolves vulnerabilities [CVE-2022-41724](https://go.dev/issue/58001) in `crypto/tls` and [CVE-2022-41723](https://go.dev/issue/57855) in `net/http`.
+```

.changelog/16266.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ca: support Vault agent auto-auth config for Vault CA provider using JWT authentication.
+```

.changelog/16274.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+connect: Bump Envoy 1.22.5 to 1.22.7, 1.23.2 to 1.23.4, 1.24.0 to 1.24.2, add 1.25.1, remove 1.21.5
+```

.changelog/16284.txt

@@ -0,0 +1,3 @@
+```release-note:feature
+cli: adds new CLI commands `consul troubleshoot upstreams` and `consul troubleshoot proxy` to troubleshoot Consul's service mesh configuration and network issues.
+```

.changelog/16288.txt

@@ -0,0 +1,8 @@
+```release-note:deprecation
+cli: Deprecate the `-merge-policies` and `-merge-roles` flags from the `consul token update` command in favor of: `-append-policy-id`, `-append-policy-name`, `-append-role-name`, and `-append-role-id`.
+```
+
+```release-note:improvement
+cli: added `-append-policy-id`, `-append-policy-name`, `-append-role-name`, and `-append-role-id` flags to the `consul token update` command.
+These flags allow updates to a token's policies/roles without having to override them completely.  
+```

.changelog/16292.txt

@@ -0,0 +1,3 @@
+```release-note:feature
+server: added server side RPC requests global read/write rate-limiter.
+```

.changelog/16298.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ca: support Vault agent auto-auth config for Vault CA provider using Azure MSI authentication.
+```

.changelog/16301.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+agent configuration: Fix issue of using unix socket when https is used.
+```

.changelog/16339.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+peering: Fix bug where services were incorrectly imported as connect-enabled.
+```

.changelog/16358.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+container: Upgrade container image to use to Alpine 3.17.
+```

.changelog/16369.txt

@@ -0,0 +1,3 @@
+```release-note:feature
+**API Gateway (Beta)** This version adds support for API gateway on VMs. API gateway provides a highly-configurable ingress for requests coming into a Consul network. For more information, refer to the [API gateway](https://developer.hashicorp.com/consul/docs/connect/gateways/api-gateway) documentation.
+```

.changelog/16412.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Update alerts to Hds::Alert component
+```

.changelog/16428.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: fixes ui tests run on CI
+```

.changelog/16444.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fix issue with lists and filters not rendering properly
+```