Merge branch 'main' into docs-envoy-proxy-breaks-when-enabling-tls

.changelog/10009.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+dns: fixes a bug with edns truncation where the response could exceed the size limit in some cases.
+```

.changelog/10330.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+connect/ca: ensure edits to the key type/bits for the connect builtin CA will regenerate the roots
+```

.changelog/10331.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+connect/ca: require new vault mount points when updating the key type/bits for the vault connect CA provider
+```

.changelog/10399.txt

@@ -0,0 +1,4 @@
+```release-note:improvement
+debug: Add a new /v1/agent/metrics/stream API endpoint for streaming of metrics
+```
+

.changelog/10411.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ca: Fixed a bug that returned a malformed certificate chain when the certificate did not having a trailing newline.
+```

.changelog/10500.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+check root and intermediate CA expiry before using it to sign a leaf certificate.
+```

.changelog/10503.txt

@@ -0,0 +1,4 @@
+```release-note:bug
+ui: Use the token's namespace instead of the default namespace when not
+specifying a namespace in the URL
+```

.changelog/10504.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+telemetry: added metrics to track certificates expiry.
+```

.changelog/10515.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+agent: fix a panic on 32-bit platforms caused by misaligned struct fields used with sync/atomic.
+```

.changelog/10535.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Send service name down to Stats to properly call endpoint for Upstreams and Downstreams metrics
+```

.changelog/10546.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+acl: Return secret ID when listing tokens if accessor has `acl:write`
+```

.changelog/10552.txt

@@ -0,0 +1,3 @@
+```release-note:deprecation
+connect/ca: remove the `RotationPeriod` field from the Consul CA provider, it was not used for anything.
+```

.changelog/10559.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+api: Fix default values used for optional fields in autopilot configuration update (POST to `/v1/operator/autopilot/configuration`) [[GH-10558](https://github.com/hashicorp/consul/issues/10558)]
+```

.changelog/10564.txt

@@ -0,0 +1,6 @@
+```release-note:feature
+cli: allow running `redirect-traffic` command in a provided Linux namespace.
+```
+```release-note:feature
+sdk: allow applying `iptables` rules in a provided Linux namespace.
+```

.changelog/10569.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Ensure in-folder KVs are created in the correct folder
+```

.changelog/10572.txt

@@ -0,0 +1,3 @@
+```release-note:feature
+config: add agent config flag for enterprise clients to indicate they wish to join a particular partition
+```

.changelog/10588.txt

@@ -0,0 +1,4 @@
+```release-note:deprecation
+config: the `ports.grpc` and `addresses.grpc` configuration settings have been renamed to `ports.xds` and `addresses.xds` to better match their function.
+```
+

.changelog/10598.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+acls: Show AuthMethodNamespace when reading/listing ACL tokens
+```

.changelog/10604.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Show ACLs disabled page at Tokens page instead of 403 error when ACLs are disabled
+```

.changelog/10605.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fix KV editor syntax highlighting
+```

.changelog/10608.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: **(Enterprise only)** Ensure permissions are checked based on the actively selected namespace
+```

.changelog/10611.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+config: add `dns_config.recursor_strategy` flag to control the order which DNS recursors are queried
+```

.changelog/10612.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+acl: replication routine to report the last error message.
+```

.changelog/10619.txt

@@ -0,0 +1,3 @@
+```release-note:security
+xds: ensure single L7 deny intention with default deny policy does not result in allow action [CVE-2021-36213](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-36213)
+```

.changelog/10621.txt

@@ -0,0 +1,3 @@
+```release-note:security
+xds: ensure envoy verifies the subject alternative name for upstreams [CVE-2021-32574](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-32574)
+```

.changelog/10630.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ca: fixed a bug when ca provider fail and provider state is stuck in `INITIALIZING` state.
+```

.changelog/10647.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+connect: fix crash that would result from multiple instances of a service resolving service config on a single agent.
+```

.changelog/10657.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ca: report an error when setting the ca config fail because of an index check.
+```

.changelog/10688.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+connect: proxy upstreams inherit namespace from service if none are defined.
+```

.changelog/10689.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+proxycfg: log correlation IDs for the proxy configuration snapshot's blocking queries.
+```

.changelog/10691.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+api: Enable setting query options on agent health and maintenance endpoints.
+```

.changelog/10706.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fix dropdown option duplication in the new intentions form
+```

.changelog/10707.txt

@@ -0,0 +1,6 @@
+```release-note:bug
+streaming: set the default wait timeout for health queries
+```
+```release-note:bug
+http: log cancelled requests as such at the INFO level, instead of logging them as errored requests.
+```

.changelog/10717.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+checks: Add Interval and Timeout to API response.
+```

.changelog/10732.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+config: **(Enterprise Only)** Allow specifying permission mode for audit logs.
+```

.changelog/10735.txt

@@ -0,0 +1,3 @@
+```release-note:feature
+ui: Adds a copy button to each composite row in tokens list page, if Secret ID returns an actual ID
+```

.changelog/10767.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fix Health Checks in K/V form Lock Sessions Info section
+```

.changelog/10768.txt

@@ -0,0 +1,4 @@
+```release-note:improvement
+telemetry: add a new `agent.tls.cert.expiry` metric for tracking when the Agent TLS certificate expires.
+```
+

.changelog/10769.txt

@@ -0,0 +1,3 @@
+```release-note:feature
+ui: Add UI support to use Vault as an external source for a service
+```

.changelog/10795.txt

@@ -0,0 +1,4 @@
+```release-note:bug
+cli: Fix a bug which prevented initializing a watch when using a namespaced
+token.
+```