Skip to content

v1.14.0
Compare
Choose a tag to compare
@hc-github-team-es-release-engineering hc-github-team-es-release-engineering released this 15 Nov 17:45
v1.14.0
fdfdddb

1.14.0 (November 15, 2022)

BREAKING CHANGES:

  • config: Add new ports.grpc_tls configuration option.
    Introduce a new port to better separate TLS config from the existing ports.grpc config.
    The new ports.grpc_tls only supports TLS encrypted communication.
    The existing ports.grpc now only supports plain-text communication. [GH-15339]
  • config: update 1.14 config defaults: Enable peering and connect by default. [GH-15302]
  • config: update 1.14 config defaults: Set gRPC TLS port default value to 8503 [GH-15302]
  • connect: Removes support for Envoy 1.20 [GH-15093]
  • peering: Rename PeerName to Peer on prepared queries and exported services. [GH-14854]
  • xds: Convert service mesh failover to use Envoy's aggregate clusters. This
    changes the names of some Envoy dynamic HTTP metrics. [GH-14178]

SECURITY:

  • Ensure that data imported from peers is filtered by ACLs at the UI Nodes/Services endpoints CVE-2022-3920 [GH-15356]

FEATURES:

  • DNS-proxy support via gRPC request. [GH-14811]
  • cli: Add -node-name flag to redirect-traffic command to support running in environments without client agents. [GH-14933]
  • cli: Add -consul-dns-port flag to the consul connect redirect-traffic command to allow forwarding DNS traffic to a specific Consul DNS port. [GH-15050]
  • connect: Add Envoy connection balancing configuration fields. [GH-14616]
  • grpc: Added metrics for external gRPC server. Added server_type=internal|external label to gRPC metrics. [GH-14922]
  • http: Add new get-or-empty operation to the txn api. Refer to the API docs for more information. [GH-14474]
  • peering: Add mesh gateway local mode support for cluster peering. [GH-14817]
  • peering: Add support for stale queries for trust bundle lookups [GH-14724]
  • peering: Add support to failover to services running on cluster peers. [GH-14396]
  • peering: Add support to redirect to services running on cluster peers with service resolvers. [GH-14445]
  • peering: Ensure un-exported services get deleted even if the un-export happens while cluster peering replication is down. [GH-14797]
  • peering: add support for routine peering control-plane traffic through mesh gateways [GH-14981]
  • sdk: Configure iptables to forward DNS traffic to a specific DNS port. [GH-15050]
  • telemetry: emit memberlist size metrics and broadcast queue depth metric. [GH-14873]
  • ui: Added support for central config merging [GH-14604]
  • ui: Create peerings detail page [GH-14947]
  • ui: Detect a TokenSecretID cookie and passthrough to localStorage [GH-14495]
  • ui: Display notice banner on nodes index page if synthetic nodes are being filtered. [GH-14971]
  • ui: Filter agentless (synthetic) nodes from the nodes list page. [GH-14970]
  • ui: Filter out node health checks on agentless service instances [GH-14986]
  • ui: Remove node meta on service instances when using agentless and consolidate external-source labels on service instances page if they all match. [GH-14921]
  • ui: Removed reference to node name on service instance page when using agentless [GH-14903]
  • ui: Use withCredentials for all HTTP API requests [GH-14343]
  • xds: servers will limit the number of concurrent xDS streams they can handle to balance the load across all servers [GH-14397]

IMPROVEMENTS:

  • peering: Add peering datacenter and partition to initial handshake. [GH-14889]
  • xds: Added a rate limiter to the delivery of proxy config updates, to prevent updates to "global" resources such as wildcard intentions from overwhelming servers (see: xds.update_max_per_second config field) [GH-14960]
  • xds: Removed a bottleneck in Envoy config generation, enabling a higher number of dataplanes per server [GH-14934]
  • agent/hcp: add initial HashiCorp Cloud Platform integration [GH-14723]
  • agent: Added configuration option cloud.scada_address. [GH-14936]
  • api: Add filtering support to Catalog's List Services (v1/catalog/services) [GH-11742]
  • api: Increase max number of operations inside a transaction for requests to /v1/txn (128) [GH-14599]
  • auto-config: Relax the validation on auto-config JWT authorization to allow non-whitespace, non-quote characters in node names. [GH-15370]
  • config-entry: Validate that service-resolver Failovers and Redirects only
    specify Partition and Namespace on Consul Enterprise. This prevents scenarios
    where OSS Consul would save service-resolvers that require Consul Enterprise. [GH-14162]
  • connect: Add Envoy 1.24.0 to support matrix [GH-15093]
  • connect: Bump Envoy 1.20 to 1.20.7, 1.21 to 1.21.5 and 1.22 to 1.22.5 [GH-14831]
  • connect: service-router destinations have gained a RetryOn field for specifying the conditions when Envoy should retry requests beyond specific status codes and generic connection failure which already exists. [GH-12890]
  • dns/peering: (Enterprise Only) Support addresses in the formats <servicename>.virtual.<namespace>.ns.<partition>.ap.<peername>.peer.consul and <servicename>.virtual.<partition>.ap.<peername>.peer.consul. This longer form address that allows specifying .peer would need to be used for tproxy DNS requests made within non-default partitions for imported services.
  • dns: (Enterprise Only) All enterprise locality labels are now optional in DNS lookups. For example, service lookups support the following format: [<tag>.]<service>.service[.<namespace>.ns][.<partition>.ap][.<datacenter>.dc]<domain>. [GH-14679]
  • integ test: fix flakiness due to test condition from retry app endoint [GH-15233]
  • metrics: Service RPC calls less than 1ms are now emitted as a decimal number. [GH-12905]
  • peering: adds an internally managed server certificate for automatic TLS between servers in peer clusters. [GH-14556]
  • peering: require TLS for peering connections using server cert signed by Connect CA [GH-14796]
  • peering: return information about the health of the peering when the leader is queried to read a peering. [GH-14747]
  • raft: Allow nonVoter to initiate an election to avoid having an election infinite loop when a Voter is converted to NonVoter [GH-14897]
  • raft: Cap maximum grpc wait time when heartbeating to heartbeatTimeout/2 [GH-14897]
  • raft: Fix a race condition where the snapshot file is closed without being opened [GH-14897]
  • telemetry: Added a consul.xds.server.streamStart metric to measure time taken to first generate xDS resources for an xDS stream. [GH-14957]
  • ui: Improve guidance around topology visualisation [GH-14527]
  • xds: Set max_ejection_percent on Envoy's outlier detection to 100% for peered services. [GH-14373]

BUG FIXES:

  • checks: Do not set interval as timeout value [GH-14619]
  • checks: If set, use proxy address for automatically added sidecar check instead of service address. [GH-14433]
  • cli: Fix Consul kv CLI 'GET' flags 'keys' and 'recurse' to be set together [GH-13493]
  • connect: Fix issue where mesh-gateway settings were not properly inherited from configuration entries. [GH-15186]
  • connect: fixed bug where endpoint updates for new xDS clusters could block for 15s before being sent to Envoy. [GH-15083]
  • connect: strip port from DNS SANs for ingress gateway leaf certificate to avoid an invalid hostname error when using the Vault provider. [GH-15320]
  • debug: fixed bug that caused consul debug CLI to error on ACL-disabled clusters [GH-15155]
  • deps: update go-memdb, fixing goroutine leak [GH-15010] [GH-15068]
  • grpc: Merge proxy-defaults and service-defaults in GetEnvoyBootstrapParams response. [GH-14869]
  • metrics: Add duplicate metrics that have only a single "consul_" prefix for all existing metrics with double ("consul_consul_") prefix, with the intent to standardize on single prefixes. [GH-14475]
  • namespace: (Enterprise Only) Fixed a bug where a client may incorrectly log that namespaces were not enabled in the local datacenter
  • peering: Fix a bug that resulted in /v1/agent/metrics returning an error. [GH-15178]
  • peering: fix nil pointer in calling handleUpdateService [GH-15160]
  • peering: fix the error of wan address isn't taken by the peering token. [GH-15065]
  • peering: when wan address is set, peering stream should use the wan address. [GH-15108]
  • proxycfg(mesh-gateway): Fix issue where deregistered services are not removed from mesh-gateway clusters. [GH-15272]
  • server: fix goroutine/memory leaks in the xDS subsystem (these were present regardless of whether or not xDS was in-use) [GH-14916]
  • server: fixes the error trying to source proxy configuration for http checks, in case of proxies using consul-dataplane. [GH-14924]
  • xds: Central service configuration (proxy-defaults and service-defaults) is now correctly applied to Consul Dataplane proxies [GH-14962]

NOTES:

  • deps: Upgrade to use Go 1.19.2 [GH-15090]
Assets 2
Loading