kvs: Fixed a bug where query options were not being applied to KVS.Get RPC operations. [GH-13344]
1.13.2 (September 20, 2022)
BREAKING CHANGES:
ca: If using Vault as the service mesh CA provider, the Vault policy used by Consul now requires the update capability on the intermediate PKI's tune mount configuration endpoint, such as /sys/mounts/connect_inter/tune. The breaking nature of this change will be resolved in an upcoming 1.13 patch release. Refer to upgrade guidance for more information.
SECURITY:
auto-config: Added input validation for auto-config JWT authorization checks. Prior to this change, it was possible for malicious actors to construct requests which incorrectly pass custom JWT claim validation for the AutoConfig.InitialConfiguration endpoint. Now, only a subset of characters are allowed for the input before evaluating the bexpr. [GH-14577]
connect: Added URI length checks to ConnectCA CSR requests. Prior to this change, it was possible for a malicious actor to designate multiple SAN URI values in a call to the ConnectCA.Sign endpoint. The endpoint now only allows for exactly one SAN URI to be specified. [GH-14579]
FEATURES:
cli: Adds new subcommands for peering workflows. Refer to the CLI docs for more information. [GH-14423]
connect: Server address changes are streamed to peers [GH-14285]
service-defaults: Added support for local_request_timeout_ms and
local_connect_timeout_ms in servicedefaults config entry [GH-14395]
IMPROVEMENTS:
connect: Bump latest Envoy to 1.23.1 in test matrix [GH-14573]
connect: expose new tracing configuration on envoy [GH-13998]
envoy: adds additional Envoy outlier ejection parameters to passive health check configurations. [GH-14238]
metrics: add labels of segment, partition, network area, network (lan or wan) to serf and memberlist metrics [GH-14161]
peering: Validate peering tokens for server name conflicts [GH-14563]
snapshot agent: (Enterprise only) Add support for path-based addressing when using s3 backend.
ui: Reuse connections for requests to /v1/internal/ui/metrics-proxy/ [GH-14521]
BUG FIXES:
agent: Fixes an issue where an agent that fails to start due to bad addresses won't clean up any existing listeners [GH-14081]
api: Fix a breaking change caused by renaming QueryDatacenterOptions to
QueryFailoverOptions. This adds QueryDatacenterOptions back as an alias to
QueryFailoverOptions and marks it as deprecated. [GH-14378]
ca: Fixed a bug with the Vault CA provider where the intermediate PKI mount and leaf cert role were not being updated when the CA configuration was changed. [GH-14516]
cli: When launching a sidecar proxy with consul connect envoy or consul connect proxy, the -sidecar-for service ID argument is now treated as case-insensitive. [GH-14034]
connect: Fix issue where auto_config and auto_encrypt could unintentionally enable TLS for gRPC xDS connections. [GH-14269]
connect: Fixed a bug where old root CAs would be removed from the primary datacenter after switching providers and restarting the cluster. [GH-14598]
connect: Fixed an issue where intermediate certificates could build up in the root CA because they were never being pruned after expiring. [GH-14429]
connect: Fixed some spurious issues during peering establishment when a follower is dialed [GH-14119]
envoy: validate name before deleting proxy default configurations. [GH-14290]
peering: Fix issue preventing deletion and recreation of peerings in TERMINATED state. [GH-14364]
rpc: Adds max jitter to client deadlines to prevent i/o deadline errors on blocking queries [GH-14233]
tls: undo breaking change that prevented setting TLS for gRPC when using config flags available in Consul v1.11. [GH-14668]
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Bumps github.com/hashicorp/consul/api from 1.15.2 to 1.15.3.
Changelog
Sourced from github.com/hashicorp/consul/api's changelog.
... (truncated)
Commits
19a8c37Uncomment api go.mod replace.b29e589Stage 1.13.3b8e4378backport of commit a548634862b3ec7a0e6aa4b4ad4b271056351158 (#15058)9de04efbackport of commit d122108992b6facf4ad02931772c09e96ab53237 (#15049)d4a20c2Merge pull request #15040 from hashicorp/backport/kisunji/NET-1092/evenly-das...8e72969Fix importsddf010dRemove unused methods from template262760aRefactor client RPC timeouts (#14965)9206f89Backport of test: possibly fix flaky TestEnvoy/case-ingress-gateway-multiple-...10f9d8ebackport of commit 52957fcb179026c5fa82f84076fe4f5a6d5c4287 (#15031)Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)