From 77050a2c8615c60fed7a1b3b49d81de9e057a619 Mon Sep 17 00:00:00 2001 From: Tobias Birkefeld Date: Wed, 31 May 2023 16:15:05 +0000 Subject: [PATCH] backport of commit 498693f24f4899a70ecca9586928355669558d10 --- .changelog/15654.txt | 3 + .changelog/16845.txt | 3 + .changelog/17055.txt | 3 + .changelog/17075.txt | 3 + .changelog/17317.txt | 3 - .changelog/17483.txt | 3 + .changelog/17546.txt | 3 + .changelog/17566.txt | 3 + .changelog/17577.txt | 3 + .changelog/17581.txt | 3 + .changelog/17609.txt | 4 + .changelog/17631.txt | 3 + .changelog/4633.txt | 3 + .changelog/5102.txt | 3 + .changelog/_5517.txt | 3 + .changelog/_5614.txt | 4 + .changelog/_5669.txt | 3 + .changelog/_5740.txt | 3 + .changelog/_5750.txt | 3 + .changelog/_5805.txt | 3 + .../workflows/check-legacy-links-format.yml | 20 - .github/workflows/test-integrations.yml | 4 +- .gitignore | 2 + .golangci.yml | 5 + .../usr/lib/systemd/system/consul.service | 1 + CHANGELOG.md | 125 + GNUmakefile | 61 +- agent/agent.go | 41 +- agent/agent_endpoint.go | 11 +- agent/agent_endpoint_test.go | 75 +- agent/agent_oss.go | 4 + agent/agent_test.go | 41 +- agent/auto-config/auto_config_test.go | 22 +- agent/auto-config/auto_encrypt_test.go | 14 +- agent/auto-config/config.go | 20 +- agent/auto-config/mock_test.go | 105 +- agent/auto-config/tls.go | 21 +- agent/cache-types/connect_ca_leaf.go | 774 ------ agent/cache-types/connect_ca_leaf_oss.go | 11 - agent/cache-types/connect_ca_leaf_test.go | 1178 -------- agent/cache-types/norace_test.go | 9 - agent/cache-types/race_test.go | 9 - agent/config/builder.go | 1 + agent/config/config.go | 6 +- agent/config/default.go | 3 + agent/config/runtime.go | 3 + agent/config/runtime_test.go | 2 + .../TestRuntimeConfig_Sanitize.golden | 1 + agent/config/testdata/full-config.hcl | 3 + agent/config/testdata/full-config.json | 17 +- agent/consul/acl_endpoint_test.go | 4 +- agent/consul/client_test.go | 2 +- agent/consul/discoverychain/compile.go | 22 +- agent/consul/discoverychain/compile_test.go | 1 + agent/consul/discoverychain/gateway.go | 7 + agent/consul/discoverychain/gateway_test.go | 112 + agent/consul/fsm/snapshot_test.go | 42 +- agent/consul/gateways/controller_gateways.go | 16 +- agent/consul/leader.go | 2 + agent/consul/leader_peering_test.go | 2 +- agent/consul/merge_test.go | 2 + .../consul/multilimiter/multilimiter_test.go | 2 +- agent/consul/options.go | 2 + agent/consul/prepared_query_endpoint_test.go | 15 +- agent/consul/rate/handler.go | 6 +- agent/consul/server.go | 16 +- agent/consul/servercert/manager.go | 33 +- agent/consul/servercert/manager_test.go | 48 +- agent/consul/state/catalog.go | 15 +- agent/consul/state/config_entry.go | 41 +- agent/consul/state/intention.go | 2 +- agent/consul/state/intention_test.go | 8 +- agent/consul/state/state_store_test.go | 19 +- agent/consul/state/usage.go | 1 + agent/consul/state/usage_test.go | 15 +- .../usagemetrics/usagemetrics_oss_test.go | 68 +- agent/dns_test.go | 6 +- .../builtin/ext-authz/ext_authz.go | 21 +- .../builtin/ext-authz/structs.go | 23 +- .../builtin/http/localratelimit/ratelimit.go | 9 +- .../http/localratelimit/ratelimit_test.go | 24 + agent/envoyextensions/builtin/lua/lua.go | 5 +- agent/envoyextensions/builtin/lua/lua_test.go | 9 + .../property-override/property_override.go | 26 +- .../property_override_test.go | 45 +- .../property-override/structpatcher_test.go | 5 +- .../envoyextensions/registered_extensions.go | 21 +- .../registered_extensions_test.go | 24 + .../dataplane/get_supported_features_test.go | 3 + .../services/peerstream/stream_test.go | 18 +- agent/grpc-internal/resolver/resolver.go | 2 +- agent/grpc-internal/resolver/resolver_test.go | 3 +- .../testutil/testservice/simple.pb.go | 2 +- agent/leafcert/cached_roots.go | 47 + agent/leafcert/cert.go | 133 + agent/leafcert/generate.go | 362 +++ agent/leafcert/leafcert.go | 556 ++++ agent/leafcert/leafcert_test.go | 1133 ++++++++ agent/leafcert/roots.go | 152 + agent/leafcert/signer_netrpc.go | 35 + agent/leafcert/signer_test.go | 243 ++ agent/leafcert/structs.go | 103 + agent/leafcert/structs_test.go | 79 + agent/leafcert/util.go | 63 + agent/leafcert/util_test.go | 133 + agent/leafcert/watch.go | 160 ++ agent/local/state.go | 21 +- agent/local/state_test.go | 20 +- agent/operator_endpoint_oss_test.go | 1 + agent/proxycfg-glue/glue.go | 21 +- agent/proxycfg-glue/leafcerts.go | 25 + agent/proxycfg/api_gateway.go | 4 +- agent/proxycfg/connect_proxy.go | 6 +- agent/proxycfg/data_sources.go | 3 +- agent/proxycfg/ingress_gateway.go | 4 +- agent/proxycfg/manager_test.go | 6 +- agent/proxycfg/mesh_gateway.go | 3 +- agent/proxycfg/snapshot.go | 15 +- agent/proxycfg/state_test.go | 8 +- agent/proxycfg/terminating_gateway.go | 4 +- agent/proxycfg/testing.go | 7 +- agent/proxycfg/testing_tproxy.go | 5 +- agent/rpc/middleware/rate_limit_mappings.go | 5 + agent/setup.go | 57 +- agent/structs/discovery_chain.go | 26 +- agent/structs/envoy_extension.go | 16 +- agent/structs/structs.deepcopy.go | 8 +- agent/structs/structs_filtering_test.go | 10 + agent/structs/testing_catalog.go | 8 + agent/xds/delta.go | 158 +- agent/xds/delta_envoy_extender_oss_test.go | 64 +- agent/xds/delta_test.go | 108 + agent/xds/resources_test.go | 19 +- agent/xds/routes.go | 12 - ...es-to-local-upstreams-tproxy.latest.golden | 315 +++ ...-consul-constraint-violation.latest.golden | 127 + ...h-envoy-constraint-violation.latest.golden | 127 + ...es-to-local-upstreams-tproxy.latest.golden | 163 ++ ...-consul-constraint-violation.latest.golden | 75 + ...h-envoy-constraint-violation.latest.golden | 75 + ...uthz-http-local-grpc-service.latest.golden | 31 +- ...uthz-http-local-http-service.latest.golden | 3 + ...z-http-upstream-grpc-service.latest.golden | 3 +- ...z-http-upstream-http-service.latest.golden | 3 +- ...authz-tcp-local-grpc-service.latest.golden | 16 +- ...es-to-local-upstreams-tproxy.latest.golden | 339 +++ ...-consul-constraint-violation.latest.golden | 265 ++ ...h-envoy-constraint-violation.latest.golden | 265 ++ ...es-to-local-upstreams-tproxy.latest.golden | 85 + ...-consul-constraint-violation.latest.golden | 5 + ...h-envoy-constraint-violation.latest.golden | 5 + ...route-and-inline-certificate.latest.golden | 51 +- agent/xds/z_xds_packages.go | 66 +- api/api_test.go | 16 + api/config_entry.go | 8 +- api/config_entry_rate_limit_ip.go | 36 +- api/go.mod | 46 +- api/go.sum | 171 +- api/operator_usage_test.go | 1 + .../scripts/envoy-library-references.sh | 7 +- command/agent/agent.go | 3 + command/connect/envoy/bootstrap_tpl.go | 2 - ..._ADDR-with-https-scheme-enables-tls.golden | 2 - ...tps-scheme-does-not-affect-grpc-tls.golden | 2 - .../envoy/testdata/access-log-path.golden | 2 - .../access-logs-enabled-custom.golden | 2 - .../envoy/testdata/access-logs-enabled.golden | 2 - .../testdata/acl-enabled-and-token.golden | 2 - .../testdata/acl-enabled-but-no-token.golden | 2 - ...AIN-and-CONSUL_GRPC_ADDR-TLS-is-tls.golden | 2 - ...and-CONSUL_GRPC_ADDR-PLAIN-is-plain.golden | 2 - .../envoy/testdata/defaults-nodemeta.golden | 2 - .../connect/envoy/testdata/defaults.golden | 2 - .../deprecated-grpc-addr-config.golden | 2 - .../testdata/envoy-readiness-probe.golden | 2 - .../envoy/testdata/existing-ca-file.golden | 2 - .../envoy/testdata/existing-ca-path.golden | 2 - .../envoy/testdata/extra_-multiple.golden | 2 - .../envoy/testdata/extra_-single.golden | 2 - .../envoy/testdata/grpc-addr-env.golden | 2 - .../envoy/testdata/grpc-addr-flag.golden | 2 - .../testdata/grpc-addr-unix-with-tls.golden | 2 - .../envoy/testdata/grpc-addr-unix.golden | 2 - .../testdata/grpc-tls-addr-config.golden | 2 - .../ingress-gateway-address-specified.golden | 2 - .../ingress-gateway-no-auto-register.golden | 2 - .../testdata/ingress-gateway-nodemeta.golden | 2 - ...-register-with-service-and-proxy-id.golden | 2 - ...ister-with-service-without-proxy-id.golden | 2 - .../envoy/testdata/ingress-gateway.golden | 2 - .../prometheus-metrics-tls-ca-file.golden | 2 - .../prometheus-metrics-tls-ca-path.golden | 2 - .../envoy/testdata/prometheus-metrics.golden | 2 - .../testdata/stats-config-override.golden | 2 - .../envoy/testdata/telemetry-collector.golden | 2 - .../connect/envoy/testdata/token-arg.golden | 2 - .../connect/envoy/testdata/token-env.golden | 2 - .../envoy/testdata/token-file-arg.golden | 2 - .../envoy/testdata/token-file-env.golden | 2 - .../envoy/testdata/xds-addr-config.golden | 2 - .../testdata/zipkin-tracing-config.golden | 2 - command/flags/http.go | 4 + command/registry.go | 4 +- command/services/export/export.go | 260 ++ command/services/export/export_test.go | 152 + .../extensioncommon/basic_envoy_extender.go | 66 +- .../upstream_envoy_extender.go | 6 +- envoyextensions/go.mod | 47 +- envoyextensions/go.sum | 215 +- envoyextensions/xdscommon/envoy_versioning.go | 4 +- .../xdscommon/envoy_versioning_test.go | 9 +- envoyextensions/xdscommon/proxysupport.go | 8 +- go.mod | 110 +- go.sum | 189 +- .../v1alpha1/api-service.json | 37 + .../v1alpha1/api-workload-1-health.json | 33 + .../v1alpha1/api-workload-1.json | 46 + .../v1alpha1/api-workload-10-health.json | 33 + .../v1alpha1/api-workload-10.json | 46 + .../v1alpha1/api-workload-11-health.json | 33 + .../v1alpha1/api-workload-11.json | 46 + .../v1alpha1/api-workload-12-health.json | 33 + .../v1alpha1/api-workload-12.json | 46 + .../v1alpha1/api-workload-13-health.json | 33 + .../v1alpha1/api-workload-13.json | 46 + .../v1alpha1/api-workload-14-health.json | 33 + .../v1alpha1/api-workload-14.json | 46 + .../v1alpha1/api-workload-15-health.json | 33 + .../v1alpha1/api-workload-15.json | 46 + .../v1alpha1/api-workload-16-health.json | 33 + .../v1alpha1/api-workload-16.json | 46 + .../v1alpha1/api-workload-17-health.json | 33 + .../v1alpha1/api-workload-17.json | 45 + .../v1alpha1/api-workload-18-health.json | 33 + .../v1alpha1/api-workload-18.json | 45 + .../v1alpha1/api-workload-19-health.json | 33 + .../v1alpha1/api-workload-19.json | 45 + .../v1alpha1/api-workload-2-health.json | 33 + .../v1alpha1/api-workload-2.json | 46 + .../v1alpha1/api-workload-20-health.json | 33 + .../v1alpha1/api-workload-20.json | 45 + .../v1alpha1/api-workload-3-health.json | 33 + .../v1alpha1/api-workload-3.json | 46 + .../v1alpha1/api-workload-4-health.json | 33 + .../v1alpha1/api-workload-4.json | 46 + .../v1alpha1/api-workload-5-health.json | 33 + .../v1alpha1/api-workload-5.json | 46 + .../v1alpha1/api-workload-6-health.json | 33 + .../v1alpha1/api-workload-6.json | 46 + .../v1alpha1/api-workload-7-health.json | 33 + .../v1alpha1/api-workload-7.json | 46 + .../v1alpha1/api-workload-8-health.json | 33 + .../v1alpha1/api-workload-8.json | 46 + .../v1alpha1/api-workload-9-health.json | 33 + .../v1alpha1/api-workload-9.json | 46 + .../v1alpha1/foo-service-endpoints.json | 47 + .../v1alpha1/foo-service.json | 24 + .../v1alpha1/grpc-api-service.json | 42 + .../v1alpha1/http-api-service.json | 29 + .../v1alpha1/node-1-health.json | 33 + .../v1alpha1/node-1.json | 27 + .../v1alpha1/node-2-health.json | 33 + .../v1alpha1/node-2.json | 27 + .../v1alpha1/node-3-health.json | 33 + .../v1alpha1/node-3.json | 27 + .../v1alpha1/node-4-health.json | 33 + .../v1alpha1/node-4.json | 27 + internal/catalog/catalogtest/run_test.go | 39 + .../catalogtest/test_integration_v1alpha1.go | 707 +++++ internal/catalog/exports.go | 2 + .../controllers/endpoints/controller.go | 384 +++ .../controllers/endpoints/controller_test.go | 709 +++++ .../endpoints/reconciliation_data.go | 177 ++ .../endpoints/reconciliation_data_test.go | 260 ++ .../internal/controllers/endpoints/status.go | 33 + .../controllers/nodehealth/controller.go | 14 +- .../internal/controllers/nodehealth/status.go | 42 + .../catalog/internal/controllers/register.go | 3 + .../controllers/workloadhealth/controller.go | 32 +- .../controllers/workloadhealth/status.go | 125 + .../selectiontracker/selection_tracker.go | 163 ++ .../selection_tracker_test.go | 275 ++ internal/catalog/internal/types/errors.go | 9 + .../catalog/internal/types/errors_test.go | 4 + .../catalog/internal/types/health_status.go | 2 +- .../internal/types/health_status_test.go | 4 +- internal/catalog/internal/types/service.go | 2 +- .../internal/types/service_endpoints.go | 40 +- .../catalog/internal/types/service_test.go | 12 + .../errInvalidEndpointsOwnerName.golden | 1 + internal/controller/api.go | 40 - internal/controller/api_test.go | 74 - internal/controller/dependency_mappers.go | 58 + .../controller/dependency_mappers_test.go | 137 + internal/radix/doc.go | 4 + internal/radix/radix.go | 568 ++++ internal/radix/radix_test.go | 408 +++ internal/resource/errors.go | 18 +- internal/resource/errors_test.go | 2 +- internal/resource/resourcetest/builder.go | 26 +- internal/resource/resourcetest/client.go | 218 ++ internal/resource/resourcetest/fs.go | 40 + internal/resource/resourcetest/require.go | 62 + internal/resource/resourcetest/testing.go | 17 + internal/tools/proto-gen-rpc-glue/e2e/go.mod | 5 +- internal/tools/proto-gen-rpc-glue/e2e/go.sum | 1 - internal/tools/proto-gen-rpc-glue/go.mod | 11 +- internal/tools/proto-gen-rpc-glue/go.sum | 34 +- .../tools/protoc-gen-consul-rate-limit/go.mod | 4 +- .../tools/protoc-gen-consul-rate-limit/go.sum | 8 +- .../protoc-gen-consul-rate-limit/main.go | 51 +- .../annotations/ratelimit/ratelimit.pb.go | 2 +- proto-public/go.mod | 27 +- proto-public/go.sum | 133 +- proto-public/pbacl/acl.pb.go | 2 +- proto-public/pbcatalog/v1alpha1/dns.pb.go | 2 +- proto-public/pbcatalog/v1alpha1/health.pb.go | 2 +- proto-public/pbcatalog/v1alpha1/node.pb.go | 2 +- .../pbcatalog/v1alpha1/protocol.pb.go | 2 +- .../pbcatalog/v1alpha1/selector.pb.go | 2 +- proto-public/pbcatalog/v1alpha1/service.pb.go | 2 +- .../v1alpha1/service_endpoints.pb.go | 2 +- proto-public/pbcatalog/v1alpha1/vip.pb.go | 2 +- .../pbcatalog/v1alpha1/workload.pb.go | 14 +- proto-public/pbconnectca/ca.pb.go | 2 +- proto-public/pbdataplane/dataplane.pb.go | 2 +- proto-public/pbdns/dns.pb.go | 2 +- proto-public/pbmesh/v1alpha1/connection.pb.go | 2 +- proto-public/pbmesh/v1alpha1/expose.pb.go | 2 +- proto-public/pbmesh/v1alpha1/proxy.pb.go | 18 +- proto-public/pbmesh/v1alpha1/routing.pb.go | 2 +- proto-public/pbmesh/v1alpha1/upstreams.pb.go | 2 +- proto-public/pbresource/resource.pb.go | 2 +- .../pbserverdiscovery/serverdiscovery.pb.go | 2 +- proto/private/pbacl/acl.pb.go | 2 +- proto/private/pbautoconf/auto_config.pb.go | 2 +- proto/private/pbcommon/common.gen.go | 4 + proto/private/pbcommon/common.pb.go | 84 +- proto/private/pbcommon/common.proto | 2 + proto/private/pbcommon/convert_pbstruct.go | 16 +- proto/private/pbconfig/config.pb.go | 10 +- .../private/pbconfigentry/config_entry.pb.go | 2 +- proto/private/pbconnect/connect.pb.go | 2 +- proto/private/pbdemo/v1/demo.pb.go | 2 +- proto/private/pbdemo/v2/demo.pb.go | 2 +- proto/private/pboperator/operator.pb.go | 2 +- proto/private/pbpeering/peering.pb.go | 2 +- proto/private/pbpeerstream/peerstream.pb.go | 2 +- proto/private/pbservice/healthcheck.pb.go | 2 +- proto/private/pbservice/node.pb.go | 2 +- proto/private/pbservice/service.pb.go | 2 +- proto/private/pbstatus/status.pb.go | 2 +- proto/private/pbstorage/raft.pb.go | 2 +- proto/private/pbsubscribe/subscribe.pb.go | 2 +- sdk/go.mod | 29 +- sdk/go.sum | 84 +- sdk/testutil/retry/retry.go | 4 + sdk/testutil/server.go | 6 + .../envoy/case-property-override/capture.sh | 8 + .../case-property-override/service_s1.hcl | 23 + .../case-property-override/service_s2.hcl | 8 + .../case-property-override/service_s3.hcl | 8 + .../envoy/case-property-override/setup.sh | 76 + .../envoy/case-property-override/vars.sh | 6 + .../envoy/case-property-override/verify.bats | 36 + test/integration/connect/envoy/helpers.bash | 7 + .../connect/envoy/test-sds-server/go.mod | 12 +- .../connect/envoy/test-sds-server/go.sum | 2476 ++++++++++++++++- .../connect/envoy/test-sds-server/sds.go | 7 +- test/integration/consul-container/go.mod | 19 +- test/integration/consul-container/go.sum | 34 +- .../consul-container/libs/cluster/agent.go | 2 + .../libs/cluster/container.go | 4 + tlsutil/config_test.go | 2 + troubleshoot/go.mod | 47 +- troubleshoot/go.sum | 371 ++- troubleshoot/proxy/z_xds_packages.go | 66 +- version/version.go | 4 + website/content/api-docs/config.mdx | 1 + .../content/api-docs/connect/intentions.mdx | 4 +- website/content/commands/config/list.mdx | 10 + .../docs/agent/config/config-files.mdx | 7 +- website/content/docs/agent/config/index.mdx | 1 + website/content/docs/agent/limits/index.mdx | 49 +- .../limits/set-global-traffic-rate-limits.mdx | 114 - .../limits/{ => usage}/init-rate-limits.mdx | 9 +- .../usage/limit-request-rates-from-ips.mdx | 72 + .../limits/usage/monitor-rate-limits.mdx | 77 + .../usage/set-global-traffic-rate-limits.mdx | 62 + website/content/docs/agent/telemetry.mdx | 58 +- .../api-gateway/configuration/gateway.mdx | 2 +- website/content/docs/api-gateway/install.mdx | 94 +- .../content/docs/api-gateway/tech-specs.mdx | 45 +- website/content/docs/api-gateway/upgrades.mdx | 99 +- .../docs/connect/cluster-peering/index.mdx | 3 + .../usage/create-sameness-groups.mdx | 301 ++ .../usage/establish-cluster-peering.mdx | 2 +- .../control-plane-request-limit.mdx | 230 ++ .../config-entries/exported-services.mdx | 5 +- .../docs/connect/config-entries/index.mdx | 2 + .../connect/config-entries/jwt-provider.mdx | 973 +++++++ .../docs/connect/config-entries/mesh.mdx | 8 +- .../connect/config-entries/proxy-defaults.mdx | 17 + .../connect/config-entries/sameness-group.mdx | 375 +++ .../config-entries/service-defaults.mdx | 39 +- .../config-entries/service-intentions.mdx | 140 +- .../config-entries/terminating-gateway.mdx | 3 - .../content/docs/connect/failover/index.mdx | 45 + .../connect/intentions/jwt-authorization.mdx | 80 + .../content/docs/connect/l7-traffic/index.mdx | 132 +- .../configuration/ext-authz.mdx | 726 +++++ .../configuration/property-override.mdx | 272 ++ .../envoy-extensions/configuration/wasm.mdx | 484 ++++ .../proxies/envoy-extensions/index.mdx | 23 +- .../envoy-extensions/usage/ext-authz.mdx | 147 + .../proxies/envoy-extensions/usage/lua.mdx | 35 +- .../usage/property-override.mdx | 205 ++ .../proxies/envoy-extensions/usage/wasm.mdx | 191 ++ .../content/docs/connect/proxies/envoy.mdx | 2 +- website/content/docs/enterprise/fips.mdx | 127 + website/content/docs/enterprise/index.mdx | 10 + .../license/utilization-reporting.mdx | 168 ++ website/content/docs/k8s/compatibility.mdx | 2 +- .../usage/create-sameness-groups.mdx | 290 ++ .../usage/establish-peering.mdx | 2 + website/content/docs/k8s/connect/index.mdx | 71 +- .../k8s/connect/onboarding-tproxy-mode.mdx | 295 ++ .../enable-transparent-proxy.mdx} | 76 +- .../k8s/connect/transparent-proxy/index.mdx | 47 + website/content/docs/k8s/crds/index.mdx | 1 + website/content/docs/k8s/helm.mdx | 226 +- .../docs/k8s/l7-traffic/failover-tproxy.mdx | 124 + .../l7-traffic/route-to-virtual-services.mdx | 122 + .../docs/release-notes/consul/v1_13_x.mdx | 4 +- .../docs/release-notes/consul/v1_16_x.mdx | 58 + .../services/discovery/dns-configuration.mdx | 24 +- .../docs/upgrading/upgrade-specific.mdx | 10 +- .../partials/envoy_ext_rule_matcher.mdx | 9 + website/data/docs-nav-data.json | 198 +- website/redirects.js | 16 + 440 files changed, 24143 insertions(+), 4120 deletions(-) create mode 100644 .changelog/15654.txt create mode 100644 .changelog/16845.txt create mode 100644 .changelog/17055.txt create mode 100644 .changelog/17075.txt delete mode 100644 .changelog/17317.txt create mode 100644 .changelog/17483.txt create mode 100644 .changelog/17546.txt create mode 100644 .changelog/17566.txt create mode 100644 .changelog/17577.txt create mode 100644 .changelog/17581.txt create mode 100644 .changelog/17609.txt create mode 100644 .changelog/17631.txt create mode 100644 .changelog/4633.txt create mode 100644 .changelog/5102.txt create mode 100644 .changelog/_5517.txt create mode 100644 .changelog/_5614.txt create mode 100644 .changelog/_5669.txt create mode 100644 .changelog/_5740.txt create mode 100644 .changelog/_5750.txt create mode 100644 .changelog/_5805.txt delete mode 100644 .github/workflows/check-legacy-links-format.yml delete mode 100644 agent/cache-types/connect_ca_leaf.go delete mode 100644 agent/cache-types/connect_ca_leaf_oss.go delete mode 100644 agent/cache-types/connect_ca_leaf_test.go delete mode 100644 agent/cache-types/norace_test.go delete mode 100644 agent/cache-types/race_test.go create mode 100644 agent/leafcert/cached_roots.go create mode 100644 agent/leafcert/cert.go create mode 100644 agent/leafcert/generate.go create mode 100644 agent/leafcert/leafcert.go create mode 100644 agent/leafcert/leafcert_test.go create mode 100644 agent/leafcert/roots.go create mode 100644 agent/leafcert/signer_netrpc.go create mode 100644 agent/leafcert/signer_test.go create mode 100644 agent/leafcert/structs.go create mode 100644 agent/leafcert/structs_test.go create mode 100644 agent/leafcert/util.go create mode 100644 agent/leafcert/util_test.go create mode 100644 agent/leafcert/watch.go create mode 100644 agent/proxycfg-glue/leafcerts.go create mode 100644 agent/xds/testdata/builtin_extension/clusters/lua-outbound-applies-to-local-upstreams-tproxy.latest.golden create mode 100644 agent/xds/testdata/builtin_extension/clusters/lua-outbound-doesnt-apply-to-local-upstreams-with-consul-constraint-violation.latest.golden create mode 100644 agent/xds/testdata/builtin_extension/clusters/lua-outbound-doesnt-apply-to-local-upstreams-with-envoy-constraint-violation.latest.golden create mode 100644 agent/xds/testdata/builtin_extension/endpoints/lua-outbound-applies-to-local-upstreams-tproxy.latest.golden create mode 100644 agent/xds/testdata/builtin_extension/endpoints/lua-outbound-doesnt-apply-to-local-upstreams-with-consul-constraint-violation.latest.golden create mode 100644 agent/xds/testdata/builtin_extension/endpoints/lua-outbound-doesnt-apply-to-local-upstreams-with-envoy-constraint-violation.latest.golden create mode 100644 agent/xds/testdata/builtin_extension/listeners/lua-outbound-applies-to-local-upstreams-tproxy.latest.golden create mode 100644 agent/xds/testdata/builtin_extension/listeners/lua-outbound-doesnt-apply-to-local-upstreams-with-consul-constraint-violation.latest.golden create mode 100644 agent/xds/testdata/builtin_extension/listeners/lua-outbound-doesnt-apply-to-local-upstreams-with-envoy-constraint-violation.latest.golden create mode 100644 agent/xds/testdata/builtin_extension/routes/lua-outbound-applies-to-local-upstreams-tproxy.latest.golden create mode 100644 agent/xds/testdata/builtin_extension/routes/lua-outbound-doesnt-apply-to-local-upstreams-with-consul-constraint-violation.latest.golden create mode 100644 agent/xds/testdata/builtin_extension/routes/lua-outbound-doesnt-apply-to-local-upstreams-with-envoy-constraint-violation.latest.golden create mode 100644 command/services/export/export.go create mode 100644 command/services/export/export_test.go create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/api-service.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/api-workload-1-health.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/api-workload-1.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/api-workload-10-health.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/api-workload-10.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/api-workload-11-health.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/api-workload-11.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/api-workload-12-health.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/api-workload-12.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/api-workload-13-health.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/api-workload-13.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/api-workload-14-health.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/api-workload-14.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/api-workload-15-health.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/api-workload-15.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/api-workload-16-health.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/api-workload-16.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/api-workload-17-health.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/api-workload-17.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/api-workload-18-health.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/api-workload-18.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/api-workload-19-health.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/api-workload-19.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/api-workload-2-health.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/api-workload-2.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/api-workload-20-health.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/api-workload-20.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/api-workload-3-health.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/api-workload-3.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/api-workload-4-health.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/api-workload-4.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/api-workload-5-health.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/api-workload-5.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/api-workload-6-health.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/api-workload-6.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/api-workload-7-health.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/api-workload-7.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/api-workload-8-health.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/api-workload-8.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/api-workload-9-health.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/api-workload-9.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/foo-service-endpoints.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/foo-service.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/grpc-api-service.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/http-api-service.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/node-1-health.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/node-1.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/node-2-health.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/node-2.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/node-3-health.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/node-3.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/node-4-health.json create mode 100644 internal/catalog/catalogtest/integration_test_data/v1alpha1/node-4.json create mode 100644 internal/catalog/catalogtest/run_test.go create mode 100644 internal/catalog/catalogtest/test_integration_v1alpha1.go create mode 100644 internal/catalog/internal/controllers/endpoints/controller.go create mode 100644 internal/catalog/internal/controllers/endpoints/controller_test.go create mode 100644 internal/catalog/internal/controllers/endpoints/reconciliation_data.go create mode 100644 internal/catalog/internal/controllers/endpoints/reconciliation_data_test.go create mode 100644 internal/catalog/internal/controllers/endpoints/status.go create mode 100644 internal/catalog/internal/mappers/selectiontracker/selection_tracker.go create mode 100644 internal/catalog/internal/mappers/selectiontracker/selection_tracker_test.go create mode 100644 internal/catalog/internal/types/testdata/errInvalidEndpointsOwnerName.golden create mode 100644 internal/controller/dependency_mappers.go create mode 100644 internal/controller/dependency_mappers_test.go create mode 100644 internal/radix/doc.go create mode 100644 internal/radix/radix.go create mode 100644 internal/radix/radix_test.go create mode 100644 internal/resource/resourcetest/client.go create mode 100644 internal/resource/resourcetest/fs.go create mode 100644 internal/resource/resourcetest/require.go create mode 100644 internal/resource/resourcetest/testing.go create mode 100644 test/integration/connect/envoy/case-property-override/capture.sh create mode 100644 test/integration/connect/envoy/case-property-override/service_s1.hcl create mode 100644 test/integration/connect/envoy/case-property-override/service_s2.hcl create mode 100644 test/integration/connect/envoy/case-property-override/service_s3.hcl create mode 100644 test/integration/connect/envoy/case-property-override/setup.sh create mode 100644 test/integration/connect/envoy/case-property-override/vars.sh create mode 100644 test/integration/connect/envoy/case-property-override/verify.bats delete mode 100644 website/content/docs/agent/limits/set-global-traffic-rate-limits.mdx rename website/content/docs/agent/limits/{ => usage}/init-rate-limits.mdx (68%) create mode 100644 website/content/docs/agent/limits/usage/limit-request-rates-from-ips.mdx create mode 100644 website/content/docs/agent/limits/usage/monitor-rate-limits.mdx create mode 100644 website/content/docs/agent/limits/usage/set-global-traffic-rate-limits.mdx create mode 100644 website/content/docs/connect/cluster-peering/usage/create-sameness-groups.mdx create mode 100644 website/content/docs/connect/config-entries/control-plane-request-limit.mdx create mode 100644 website/content/docs/connect/config-entries/jwt-provider.mdx create mode 100644 website/content/docs/connect/config-entries/sameness-group.mdx create mode 100644 website/content/docs/connect/failover/index.mdx create mode 100644 website/content/docs/connect/intentions/jwt-authorization.mdx create mode 100644 website/content/docs/connect/proxies/envoy-extensions/configuration/ext-authz.mdx create mode 100644 website/content/docs/connect/proxies/envoy-extensions/configuration/property-override.mdx create mode 100644 website/content/docs/connect/proxies/envoy-extensions/configuration/wasm.mdx create mode 100644 website/content/docs/connect/proxies/envoy-extensions/usage/ext-authz.mdx create mode 100644 website/content/docs/connect/proxies/envoy-extensions/usage/property-override.mdx create mode 100644 website/content/docs/connect/proxies/envoy-extensions/usage/wasm.mdx create mode 100644 website/content/docs/enterprise/fips.mdx create mode 100644 website/content/docs/enterprise/license/utilization-reporting.mdx create mode 100644 website/content/docs/k8s/connect/cluster-peering/usage/create-sameness-groups.mdx create mode 100644 website/content/docs/k8s/connect/onboarding-tproxy-mode.mdx rename website/content/docs/{connect/transparent-proxy.mdx => k8s/connect/transparent-proxy/enable-transparent-proxy.mdx} (81%) create mode 100644 website/content/docs/k8s/connect/transparent-proxy/index.mdx create mode 100644 website/content/docs/k8s/l7-traffic/failover-tproxy.mdx create mode 100644 website/content/docs/k8s/l7-traffic/route-to-virtual-services.mdx create mode 100644 website/content/docs/release-notes/consul/v1_16_x.mdx create mode 100644 website/content/partials/envoy_ext_rule_matcher.mdx diff --git a/.changelog/15654.txt b/.changelog/15654.txt new file mode 100644 index 0000000000000..169191377ba3b --- /dev/null +++ b/.changelog/15654.txt @@ -0,0 +1,3 @@ +```release-note:feature +cli: Adds new command - `consul services export` - for exporting a service to a peer or partition +``` diff --git a/.changelog/16845.txt b/.changelog/16845.txt new file mode 100644 index 0000000000000..7181e319e3aeb --- /dev/null +++ b/.changelog/16845.txt @@ -0,0 +1,3 @@ +```release-note:improvement +systemd: set service type to notify. +``` diff --git a/.changelog/17055.txt b/.changelog/17055.txt new file mode 100644 index 0000000000000..9300c41121999 --- /dev/null +++ b/.changelog/17055.txt @@ -0,0 +1,3 @@ +```release-note:bug +gateways: Fix an bug where targeting a virtual service defined by a service-resolver was broken for HTTPRoutes. +``` diff --git a/.changelog/17075.txt b/.changelog/17075.txt new file mode 100644 index 0000000000000..1c882fabbddd3 --- /dev/null +++ b/.changelog/17075.txt @@ -0,0 +1,3 @@ +```release-note:improvement +agent: remove agent cache dependency from service mesh leaf certificate management +``` diff --git a/.changelog/17317.txt b/.changelog/17317.txt deleted file mode 100644 index 76c86a0a28eb0..0000000000000 --- a/.changelog/17317.txt +++ /dev/null @@ -1,3 +0,0 @@ -```release-note:bug -connect: fix a bug with Envoy potentially starting with incomplete configuration by not waiting enough for initial xDS configuration. -``` diff --git a/.changelog/17483.txt b/.changelog/17483.txt new file mode 100644 index 0000000000000..26c81dbe4cdf7 --- /dev/null +++ b/.changelog/17483.txt @@ -0,0 +1,3 @@ +```release-note:bug +peering: Fix a bug that caused server agents to continue cleaning up peering resources even after loss of leadership. +``` diff --git a/.changelog/17546.txt b/.changelog/17546.txt new file mode 100644 index 0000000000000..6f4025553986c --- /dev/null +++ b/.changelog/17546.txt @@ -0,0 +1,3 @@ +```release-note:improvement +connect: update supported envoy versions to 1.23.10, 1.24.8, 1.25.7, 1.26.2 +``` diff --git a/.changelog/17566.txt b/.changelog/17566.txt new file mode 100644 index 0000000000000..f15718bd7601c --- /dev/null +++ b/.changelog/17566.txt @@ -0,0 +1,3 @@ +```release-note:bug +xds: Fixed a bug where modifying ACLs on a token being actively used for an xDS connection caused all xDS updates to fail. +``` diff --git a/.changelog/17577.txt b/.changelog/17577.txt new file mode 100644 index 0000000000000..3699d52611223 --- /dev/null +++ b/.changelog/17577.txt @@ -0,0 +1,3 @@ +```release-note:improvement +fix metric names in /docs/agent/telemetry +``` \ No newline at end of file diff --git a/.changelog/17581.txt b/.changelog/17581.txt new file mode 100644 index 0000000000000..9277dbcd3ef18 --- /dev/null +++ b/.changelog/17581.txt @@ -0,0 +1,3 @@ +```release-note:bug +gateways: **(Enterprise only)** Fixed a bug in API gateways where gateway configuration objects in non-default partitions did not reconcile properly. +``` diff --git a/.changelog/17609.txt b/.changelog/17609.txt new file mode 100644 index 0000000000000..cbace1f8c7d26 --- /dev/null +++ b/.changelog/17609.txt @@ -0,0 +1,4 @@ +```release-note:bug +gateways: Fixed a bug in API gateways where binding a route that only targets a service imported from a peer results +in the programmed gateway having no routes. +``` diff --git a/.changelog/17631.txt b/.changelog/17631.txt new file mode 100644 index 0000000000000..b24b7461ec6ef --- /dev/null +++ b/.changelog/17631.txt @@ -0,0 +1,3 @@ +```release-note:bug +gateways: Fixed a bug where API gateways were not being taken into account in determining xDS rate limits. +``` diff --git a/.changelog/4633.txt b/.changelog/4633.txt new file mode 100644 index 0000000000000..ffacfccced2a4 --- /dev/null +++ b/.changelog/4633.txt @@ -0,0 +1,3 @@ +```release-note:feature +server: **(Enterprise Only)** added server side RPC requests IP based read/write rate-limiter. +``` diff --git a/.changelog/5102.txt b/.changelog/5102.txt new file mode 100644 index 0000000000000..97d8c7bf8bf12 --- /dev/null +++ b/.changelog/5102.txt @@ -0,0 +1,3 @@ +```release-note:feature +server: **(Enterprise Only)** allow automatic license utilization reporting. +``` \ No newline at end of file diff --git a/.changelog/_5517.txt b/.changelog/_5517.txt new file mode 100644 index 0000000000000..5152a6ff78f73 --- /dev/null +++ b/.changelog/_5517.txt @@ -0,0 +1,3 @@ +```release-note:bug +namespaces: **(Enterprise only)** fixes a bug where agent health checks stop syncing for all services on a node if the namespace of any service has been removed from the server. +``` diff --git a/.changelog/_5614.txt b/.changelog/_5614.txt new file mode 100644 index 0000000000000..9951b9111875c --- /dev/null +++ b/.changelog/_5614.txt @@ -0,0 +1,4 @@ +```release-note:bug +namespaces: **(Enterprise only)** fixes a bug where namespaces are stuck in a deferred deletion state indefinitely under some conditions. +Also fixes the Consul query metadata present in the HTTP headers of the namespace read and list endpoints. +``` diff --git a/.changelog/_5669.txt b/.changelog/_5669.txt new file mode 100644 index 0000000000000..6528460e69bda --- /dev/null +++ b/.changelog/_5669.txt @@ -0,0 +1,3 @@ +```release-note:improvement +audit-logging: **(Enterprise only)** enable error response and request body logging +``` \ No newline at end of file diff --git a/.changelog/_5740.txt b/.changelog/_5740.txt new file mode 100644 index 0000000000000..4f1d6f6448f3f --- /dev/null +++ b/.changelog/_5740.txt @@ -0,0 +1,3 @@ +```release-note:feature +api: (Enterprise only) Add `POST /v1/operator/audit-hash` endpoint to calculate the hash of the data used by the audit log hash function and salt. +``` \ No newline at end of file diff --git a/.changelog/_5750.txt b/.changelog/_5750.txt new file mode 100644 index 0000000000000..027753c721565 --- /dev/null +++ b/.changelog/_5750.txt @@ -0,0 +1,3 @@ +```release-note:feature +cli: (Enterprise only) Add a new `consul operator audit hash` command to retrieve and compare the hash of the data used by the audit log hash function and salt. +``` \ No newline at end of file diff --git a/.changelog/_5805.txt b/.changelog/_5805.txt new file mode 100644 index 0000000000000..786effc310258 --- /dev/null +++ b/.changelog/_5805.txt @@ -0,0 +1,3 @@ +```release-note:security +audit-logging: **(Enterprise only)** limit `v1/operator/audit-hash` endpoint to ACL token with `operator:read` privileges. +``` \ No newline at end of file diff --git a/.github/workflows/check-legacy-links-format.yml b/.github/workflows/check-legacy-links-format.yml deleted file mode 100644 index 85dbb0e70f2e0..0000000000000 --- a/.github/workflows/check-legacy-links-format.yml +++ /dev/null @@ -1,20 +0,0 @@ -# Copyright (c) HashiCorp, Inc. -# SPDX-License-Identifier: MPL-2.0 - -name: Legacy Link Format Checker - -on: - push: - paths: - - "website/content/**/*.mdx" - - "website/data/*-nav-data.json" - -jobs: - check-links: - uses: hashicorp/dev-portal/.github/workflows/docs-content-check-legacy-links-format.yml@475289345d312552b745224b46895f51cc5fc490 - with: - repo-owner: "hashicorp" - repo-name: "consul" - commit-sha: ${{ github.sha }} - mdx-directory: "website/content" - nav-data-directory: "website/data" diff --git a/.github/workflows/test-integrations.yml b/.github/workflows/test-integrations.yml index 260044aee8bb5..38b6a44cbe018 100644 --- a/.github/workflows/test-integrations.yml +++ b/.github/workflows/test-integrations.yml @@ -239,7 +239,7 @@ jobs: # this is further going to multiplied in envoy-integration tests by the # other dimensions in the matrix. Currently TOTAL_RUNNERS would be # multiplied by 8 based on these values: - # envoy-version: ["1.23.8", "1.24.6", "1.25.4", "1.26.0"] + # envoy-version: ["1.23.10", "1.24.8", "1.25.7", "1.26.2"] # xds-target: ["server", "client"] TOTAL_RUNNERS: 4 JQ_SLICER: '[ inputs ] | [_nwise(length / $runnercount | floor)]' @@ -273,7 +273,7 @@ jobs: strategy: fail-fast: false matrix: - envoy-version: ["1.23.8", "1.24.6", "1.25.4", "1.26.0"] + envoy-version: ["1.23.10", "1.24.8", "1.25.7", "1.26.2"] xds-target: ["server", "client"] test-cases: ${{ fromJSON(needs.generate-envoy-job-matrices.outputs.envoy-matrix) }} env: diff --git a/.gitignore b/.gitignore index 9bb786209cbd5..a48d19b74cc22 100644 --- a/.gitignore +++ b/.gitignore @@ -66,3 +66,5 @@ override.tf.json # Ignore CLI configuration files .terraformrc terraform.rc +/go.work +/go.work.sum diff --git a/.golangci.yml b/.golangci.yml index 245f04d7a9551..bac9b716a3b4e 100644 --- a/.golangci.yml +++ b/.golangci.yml @@ -88,6 +88,9 @@ linters-settings: - github.com/hashicorp/go-msgpack: recommendations: - github.com/hashicorp/consul-net-rpc/go-msgpack + - github.com/golang/protobuf: + recommendations: + - google.golang.org/protobuf depguard: list-type: denylist @@ -101,7 +104,9 @@ linters-settings: # Default: [] packages-with-error-message: - net/rpc: "only use forked copy in github.com/hashicorp/consul-net-rpc/net/rpc" + - github.com/golang/protobuf: "only use google.golang.org/protobuf" run: timeout: 10m concurrency: 4 + skip-dirs-use-default: false diff --git a/.release/linux/package/usr/lib/systemd/system/consul.service b/.release/linux/package/usr/lib/systemd/system/consul.service index 1bbf51a7a1023..65eca696e1a12 100644 --- a/.release/linux/package/usr/lib/systemd/system/consul.service +++ b/.release/linux/package/usr/lib/systemd/system/consul.service @@ -6,6 +6,7 @@ After=network-online.target ConditionFileNotEmpty=/etc/consul.d/consul.hcl [Service] +Type=notify EnvironmentFile=-/etc/consul.d/consul.env User=consul Group=consul diff --git a/CHANGELOG.md b/CHANGELOG.md index bd3379535aae8..ef4edc700404a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,128 @@ +## 1.16.0-rc1 (June 12, 2023) + +BREAKING CHANGES: + +* api: The `/v1/health/connect/` and `/v1/health/ingress/` endpoints now immediately return 403 "Permission Denied" errors whenever a token with insufficient `service:read` permissions is provided. Prior to this change, the endpoints returned a success code with an empty result list when a token with insufficient permissions was provided. [[GH-17424](https://github.com/hashicorp/consul/issues/17424)] +* peering: Removed deprecated backward-compatibility behavior. +Upstream overrides in service-defaults will now only apply to peer upstreams when the `peer` field is provided. +Visit the 1.16.x [upgrade instructions](https://developer.hashicorp.com/consul/docs/upgrading/upgrade-specific) for more information. [[GH-16957](https://github.com/hashicorp/consul/issues/16957)] + +SECURITY: + +* audit-logging: **(Enterprise only)** limit `v1/operator/audit-hash` endpoint to ACL token with `operator:read` privileges. + +FEATURES: + +* api: (Enterprise only) Add `POST /v1/operator/audit-hash` endpoint to calculate the hash of the data used by the audit log hash function and salt. +* cli: (Enterprise only) Add a new `consul operator audit hash` command to retrieve and compare the hash of the data used by the audit log hash function and salt. +* cli: Adds new command - `consul services export` - for exporting a service to a peer or partition [[GH-15654](https://github.com/hashicorp/consul/issues/15654)] +* connect: **(Consul Enterprise only)** Implement order-by-locality failover. +* mesh: Add new permissive mTLS mode that allows sidecar proxies to forward incoming traffic unmodified to the application. This adds `AllowEnablingPermissiveMutualTLS` setting to the mesh config entry and the `MutualTLSMode` setting to proxy-defaults and service-defaults. [[GH-17035](https://github.com/hashicorp/consul/issues/17035)] +* mesh: Support configuring JWT authentication in Envoy. [[GH-17452](https://github.com/hashicorp/consul/issues/17452)] +* server: **(Enterprise Only)** added server side RPC requests IP based read/write rate-limiter. [[GH-4633](https://github.com/hashicorp/consul/issues/4633)] +* server: **(Enterprise Only)** allow automatic license utilization reporting. [[GH-5102](https://github.com/hashicorp/consul/issues/5102)] +* server: added server side RPC requests global read/write rate-limiter. [[GH-16292](https://github.com/hashicorp/consul/issues/16292)] +* xds: Add `property-override` built-in Envoy extension that directly patches Envoy resources. [[GH-17487](https://github.com/hashicorp/consul/issues/17487)] +* xds: Add a built-in Envoy extension that inserts External Authorization (ext_authz) network and HTTP filters. [[GH-17495](https://github.com/hashicorp/consul/issues/17495)] +* xds: Add a built-in Envoy extension that inserts Wasm HTTP filters. [[GH-16877](https://github.com/hashicorp/consul/issues/16877)] +* xds: Add a built-in Envoy extension that inserts Wasm network filters. [[GH-17505](https://github.com/hashicorp/consul/issues/17505)] + +IMPROVEMENTS: + +* * api: Support filtering for config entries. [[GH-17183](https://github.com/hashicorp/consul/issues/17183)] +* * cli: Add `-filter` option to `consul config list` for filtering config entries. [[GH-17183](https://github.com/hashicorp/consul/issues/17183)] +* api: Enable setting query options on agent force-leave endpoint. [[GH-15987](https://github.com/hashicorp/consul/issues/15987)] +* audit-logging: (Enterprise only) enable error response and request body logging [[GH-5669](https://github.com/hashicorp/consul/issues/5669)] +* audit-logging: **(Enterprise only)** enable error response and request body logging +* ca: automatically set up Vault's auto-tidy setting for tidy_expired_issuers when using Vault as a CA provider. [[GH-17138](https://github.com/hashicorp/consul/issues/17138)] +* ca: support Vault agent auto-auth config for Vault CA provider using AliCloud authentication. [[GH-16224](https://github.com/hashicorp/consul/issues/16224)] +* ca: support Vault agent auto-auth config for Vault CA provider using AppRole authentication. [[GH-16259](https://github.com/hashicorp/consul/issues/16259)] +* ca: support Vault agent auto-auth config for Vault CA provider using Azure MSI authentication. [[GH-16298](https://github.com/hashicorp/consul/issues/16298)] +* ca: support Vault agent auto-auth config for Vault CA provider using JWT authentication. [[GH-16266](https://github.com/hashicorp/consul/issues/16266)] +* ca: support Vault agent auto-auth config for Vault CA provider using Kubernetes authentication. [[GH-16262](https://github.com/hashicorp/consul/issues/16262)] +* command: Adds ACL enabled to status output on agent startup. [[GH-17086](https://github.com/hashicorp/consul/issues/17086)] +* command: Allow creating ACL Token TTL with greater than 24 hours with the -expires-ttl flag. [[GH-17066](https://github.com/hashicorp/consul/issues/17066)] +* connect: **(Enterprise Only)** Add support for specifying "Partition" and "Namespace" in Prepared Queries failover rules. +* connect: update supported envoy versions to 1.23.10, 1.24.8, 1.25.7, 1.26.2 [[GH-17546](https://github.com/hashicorp/consul/issues/17546)] +* connect: update supported envoy versions to 1.23.8, 1.24.6, 1.25.4, 1.26.0 [[GH-5200](https://github.com/hashicorp/consul/issues/5200)] +* fix metric names in /docs/agent/telemetry [[GH-17577](https://github.com/hashicorp/consul/issues/17577)] +* gateway: Change status condition reason for invalid certificate on a listener from "Accepted" to "ResolvedRefs". [[GH-17115](https://github.com/hashicorp/consul/issues/17115)] +* http: accept query parameters `datacenter`, `ap` (enterprise-only), and `namespace` (enterprise-only). Both short-hand and long-hand forms of these query params are now supported via the HTTP API (dc/datacenter, ap/partition, ns/namespace). [[GH-17525](https://github.com/hashicorp/consul/issues/17525)] +* systemd: set service type to notify. [[GH-16845](https://github.com/hashicorp/consul/issues/16845)] +* ui: Update alerts to Hds::Alert component [[GH-16412](https://github.com/hashicorp/consul/issues/16412)] +* ui: Update to use Hds::Toast component to show notifications [[GH-16519](https://github.com/hashicorp/consul/issues/16519)] +* ui: update from