api: The /v1/health/connect/ and /v1/health/ingress/ endpoints now immediately return 403 "Permission Denied" errors whenever a token with insufficient service:read permissions is provided. Prior to this change, the endpoints returned a success code with an empty result list when a token with insufficient permissions was provided. [GH-17424]
peering: Removed deprecated backward-compatibility behavior.
Upstream overrides in service-defaults will now only apply to peer upstreams when the peer field is provided.
Visit the 1.16.x upgrade instructions for more information. [GH-16957]
SECURITY:
Bump Dockerfile base image to alpine:3.18. [GH-17719]
audit-logging: (Enterprise only) limit v1/operator/audit-hash endpoint to ACL token with operator:read privileges.
FEATURES:
api: (Enterprise only) Add POST /v1/operator/audit-hash endpoint to calculate the hash of the data used by the audit log hash function and salt.
cli: (Enterprise only) Add a new consul operator audit hash command to retrieve and compare the hash of the data used by the audit log hash function and salt.
cli: Adds new command - consul services export - for exporting a service to a peer or partition [GH-15654]
connect: (Consul Enterprise only) Implement order-by-locality failover.
mesh: Add new permissive mTLS mode that allows sidecar proxies to forward incoming traffic unmodified to the application. This adds AllowEnablingPermissiveMutualTLS setting to the mesh config entry and the MutualTLSMode setting to proxy-defaults and service-defaults. [GH-17035]
mesh: Support configuring JWT authentication in Envoy. [GH-17452]
server: (Enterprise Only) added server side RPC requests IP based read/write rate-limiter. [GH-4633]
api: The /v1/health/connect/ and /v1/health/ingress/ endpoints now immediately return 403 "Permission Denied" errors whenever a token with insufficient service:read permissions is provided. Prior to this change, the endpoints returned a success code with an empty result list when a token with insufficient permissions was provided. [GH-17424]
peering: Removed deprecated backward-compatibility behavior.
Upstream overrides in service-defaults will now only apply to peer upstreams when the peer field is provided.
Visit the 1.16.x upgrade instructions for more information. [GH-16957]
SECURITY:
Bump Dockerfile base image to alpine:3.18. [GH-17719]
audit-logging: (Enterprise only) limit v1/operator/audit-hash endpoint to ACL token with operator:read privileges.
FEATURES:
api: (Enterprise only) Add POST /v1/operator/audit-hash endpoint to calculate the hash of the data used by the audit log hash function and salt.
cli: (Enterprise only) Add a new consul operator audit hash command to retrieve and compare the hash of the data used by the audit log hash function and salt.
cli: Adds new command - consul services export - for exporting a service to a peer or partition [GH-15654]
connect: (Consul Enterprise only) Implement order-by-locality failover.
mesh: Add new permissive mTLS mode that allows sidecar proxies to forward incoming traffic unmodified to the application. This adds AllowEnablingPermissiveMutualTLS setting to the mesh config entry and the MutualTLSMode setting to proxy-defaults and service-defaults. [GH-17035]
mesh: Support configuring JWT authentication in Envoy. [GH-17452]
server: (Enterprise Only) added server side RPC requests IP based read/write rate-limiter. [GH-4633]
Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.
Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR:
- `@dependabot rebase` will rebase this PR
- `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it
- `@dependabot merge` will merge this PR after your CI passes on it
- `@dependabot squash and merge` will squash and merge this PR after your CI passes on it
- `@dependabot cancel merge` will cancel a previously requested merge and block automerging
- `@dependabot reopen` will reopen this PR if it is closed
- `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
- `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
- `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)
Bumps github.com/hashicorp/consul/api from 1.15.2 to 1.23.0.
Release notes
Sourced from github.com/hashicorp/consul/api's releases.
... (truncated)
Changelog
Sourced from github.com/hashicorp/consul/api's changelog.
... (truncated)
Commits
c070438
api release 1.23.0dc58b45
Backport of Update submodules to latest following 1.16.0 into release/1.16.x ...ec0072c
Backport of [NET-4865] security: Update Go version to 1.20.6 into release/1.1...18db062
Backport of Improve XDS test coverage: JWT auth edition into release/1.16.x (...f9482b6
Backport of [NET-4865] Bump golang.org/x/net to 0.12.0 into release/1.16.x (#...edda4f8
[NET-3700] addomitempty
to api prepared query targets (#18184)453052c
Fix typo on docs telemetry page (#18185)409becb
Backport of docs - remove Sentinel from enterprise features list into release...9b3bbcc
Backport of Add FIPS reference to consul enterprise docs into release/1.16.x ...113dc42
Backport of [NET-4792] Add integrations tests for jwt-auth into release/1.16....Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting
@dependabot rebase
.Dependabot commands and options
You can trigger Dependabot actions by commenting on this PR: - `@dependabot rebase` will rebase this PR - `@dependabot recreate` will recreate this PR, overwriting any edits that have been made to it - `@dependabot merge` will merge this PR after your CI passes on it - `@dependabot squash and merge` will squash and merge this PR after your CI passes on it - `@dependabot cancel merge` will cancel a previously requested merge and block automerging - `@dependabot reopen` will reopen this PR if it is closed - `@dependabot close` will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually - `@dependabot ignore this major version` will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this minor version` will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself) - `@dependabot ignore this dependency` will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)