Merge pull request #1 from hashicorp/main

update version

.changelog/10002.txt

@@ -0,0 +1,3 @@
+```release-note:feature
+ui: Transparent Proxy - Service mesh visualization updates
+```

.changelog/10009.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+dns: fixes a bug with edns truncation where the response could exceed the size limit in some cases.
+```

.changelog/10013.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+audit-logging: (Enterprise only) Fixed an issue that resulted in usage of the agent master token or managed service provider tokens from being resolved properly.
+```

.changelog/10016.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+connect: Update the service mesh visualization to account for transparent proxies.
+```

.changelog/10023.txt

@@ -0,0 +1,3 @@
+```release-note:security
+Add content-type headers to raw KV responses to prevent XSS attacks [CVE-2020-25864](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2020-25864)
+```

.changelog/10025.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+snapshot: fixes a bug that would cause snapshots to be missing all but the first ACL Auth Method.
+```

.changelog/10039.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: ensure proxy instance API requests perform blocking queries correctly
+```

.changelog/10062.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Added humanized formatting to lock session durations
+```

.changelog/10069.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+connect: Disallow wildcard as name for service-defaults. 
+```

.changelog/10073.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+telemetry: Add new metrics for status of secondary datacenter replication.
+```

.changelog/10081.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: updates the ui with the new consul brand assets
+```

.changelog/10089.txt

@@ -0,0 +1,4 @@
+```release-note:improvement
+cli: snapshot inspect command can now inspect raw snapshots from a server's data
+dir.
+```

.changelog/10091.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+cli: snapshot inspect command would panic on invalid input.
+```

.changelog/10100.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Added CRD popover 'informed action' for intentions managed by CRDs
+```

.changelog/10101.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+connect: update supported envoy versions to 1.18.2, 1.17.2, 1.16.3, 1.15.4
+```

.changelog/10112.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+streaming: fixes a bug that would cause context cancellation errors when a cache entry expired while requests were active.
+```

.changelog/10121.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Add conditionals to lock sessions tab
+```

.changelog/10122.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Adding conditional to prevent Service Mesh from breaking when there are no Upstreams
+```

.changelog/10124.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Update conditional for topology empty state
+```

.changelog/10127.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+connect: rename cluster config entry to mesh.
+```

.changelog/10129.txt

@@ -0,0 +1,4 @@
+```release-note:improvement
+raft: allow reloading of raft trailing logs and snapshot timing to allow recovery from some [replication failure modes](https://github.com/hashicorp/consul/issues/9609).
+telemetry: add metrics and documentation for [monitoring for replication issues](https://consul.io/docs/agent/telemetry#raft-replication-capacity-issues).
+```

.changelog/10131.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+xds: ensure that all envoyproxy/go-control-plane protobuf symbols are linked into the final binary
+```

.changelog/10133.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Updating the wording for the banner and the popover for a service with an upstream that is not explicitly defined.
+```

.changelog/10134.txt

@@ -0,0 +1,11 @@
+```release-note:feature
+cli: Add additional flags to the `consul connect redirect-traffic` command to allow excluding inbound and outbound ports,
+outbound CIDRs, and additional user IDs from traffic redirection.
+```
+```release-note:feature
+cli: Automatically exclude ports from `envoy_prometheus_bind_addr`, `envoy_stats_bind_addr`, and `ListenerPort` from `Expose` config
+from inbound traffic redirection rules if `proxy-id` flag is provided to the `consul connect redirect-traffic` command.
+```
+```release-note:feature
+sdk: Allow excluding inbound and outbound ports, outbound CIDRs, and additional user IDs from traffic redirection in the `iptables` package.
+```

.changelog/10136.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Adding a notice about how TransparentProxy mode affects the Upstreams list at the top of tab view
+```

.changelog/10149.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+streaming: change `use_streaming_backend` to default to true so that streaming is used by default when it is supported.
+```

.changelog/10151.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fix text searching through upstream instances.
+```

.changelog/10152.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Removes the extra rendering of namespace in service upstream list
+```

.changelog/10157.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Don't render a DOM element for empty namespace descriptions
+```

.changelog/10161.txt

@@ -0,0 +1,9 @@
+```release-note:bug
+memberlist: fixes a couple bugs which allowed malformed input to cause a crash in a Consul
+client or server.
+```
+
+```release-note:bug
+telemetry: fixes a bug with Prometheus metrics where Gauges and Summaries were incorrectly
+being expired.
+```

.changelog/10162.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+connect: restrict transparent proxy mode to only match on the tagged virtual IP address.
+```

.changelog/10163.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+acl: Give more descriptive error if auth method not found.
+```

.changelog/10173.txt

@@ -0,0 +1,9 @@
+```release-note:improvement
+agent: Save exposed Envoy ports to the agent's state when `Expose.Checks` is true in proxy's configuration.
+```
+```release-note:improvement
+api: Add `ExposedPort` to the health check API resource.
+```
+```release-note:improvement
+command: Exclude exposed Envoy ports from traffic redirection when providing `-proxy-id` and `Expose.Checks` is set.
+```

.changelog/10174.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Only show a partial list of intention permissions, with the option to show all
+```

.changelog/10181.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Improve loader centering with new side navigation
+```

.changelog/10186.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: De-duplicate tags in rendered tag listings
+```

.changelog/10188.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+local: agents will no longer persist the default user token along with a service or check.
+```

.changelog/10189.txt

@@ -0,0 +1,4 @@
+```release-note:bug
+http: fix a bug that caused the `X-Consul-Effective-Consistency` header to be missing on
+request for service health
+```

.changelog/10194.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Show a message to explain that health checks may be out of date if the serf health check is in a critical state
+```

.changelog/10204.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+api: The `Content-Type` header is now always set when a body is present in a request.
+```

.changelog/10210.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+licensing: **(Enterprise Only)** Consul Enterprise has gained the ability to autoload a license via configuration. This can be specified with the `license_path` configuration, the `CONSUL_LICENSE` environment variable or the `CONSUL_LICENSE_PATH` environment variable
+```

.changelog/10211.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+licensing: **(Enterprise Only)** Consul Enterprise 1.10 has removed API driven licensing of servers in favor of license loading via configuration. The `PUT` and `DELETE` methods on the `/v1/operator/license` endpoint will now return 405s, the `consul license put` and `consul license reset` CLI commands have been removed and the `LicensePut` and `LicenseReset` methods in the API client have been altered to always return an error.
+```

.changelog/10212.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Add 'optional route segments' and move namespaces to use them
+```

.changelog/10225.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Reflect the change of Session API response shape for Checks in post 1.7 Consul 
+```

.changelog/10231.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+connect: update supported envoy versions to 1.18.3, 1.17.3, 1.16.4, and 1.15.5
+```

.changelog/10239.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+server: ensure that central service config flattening properly resets the state each time
+```

.changelog/10240.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+agent: ensure we hash the non-deprecated upstream fields on ServiceConfigRequest
+```

.changelog/10243.txt

@@ -0,0 +1,3 @@
+```release-note:feature
+xds: emit a labeled gauge of connected xDS streams by version
+```

.changelog/10248.txt

@@ -0,0 +1,7 @@
+```release-note:breaking-change
+licensing: **(Enterprise Only)** Consul Enterprise has removed support for temporary licensing. All server agents must have a valid license at startup and client agents must have a license at startup or be able to retrieve one from the servers.
+```
+
+```release-note:breaking-change
+licensing: **(Enterprise Only)** Consul Enterprise client agents now require a valid non-anonymous ACL token for retrieving their license from the servers. Additionally client agents rely on the value of the `start_join` and `retry_join` configurations for determining the servers to query for the license. Therefore one must be set to use license auto-retrieval.
+```

.changelog/10267.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+licensing: **(Enterprise Only)** Consul Enterprise has gained the ability update its license via a configuration reload. The same environment variables and configurations will be used to determine the new license.
+```

.changelog/10270.txt

@@ -0,0 +1,3 @@
+```release-note:feature
+ui: Create a collapsible notices component for the Topology tab
+```

.changelog/10273.txt

@@ -0,0 +1,5 @@
+```release-note:bug
+cli: removes the need to set debug_enabled=true to collect debug data from the CLI. Now
+the CLI behaves the same way as the API and accepts either an ACL token with operator:read, or
+debug_enabled=true.
+```

.changelog/10279.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+debug: capture a single stream of logs, and single pprof profile and trace for the whole duration 
+```

.changelog/10287.txt

@@ -0,0 +1,3 @@
+```release-note:feature
+ui: Add Unix Domain Socket support
+```

.changelog/10298.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Move all CSS icons to use standard CSS custom properties rather than SASS variables
+```

.changelog/10299.txt

@@ -0,0 +1,4 @@
+```release-note:bug
+use the MaxQueryTime instead of RPCHoldTimeout for blocking RPC queries 
+ [[GH-8978](https://github.com/hashicorp/consul/pull/8978)].
+```

.changelog/10301.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+connect: Ensures passthrough tproxy cluster is created even when mesh config doesn't exist.
+```

.changelog/10306.txt

@@ -0,0 +1,4 @@
+```release-note:bug
+autopilot: **(Enterprise only)** Fixed an issue where autopilot could cause a new leader to demote the wrong voter when redundancy zones are in use and the previous leader failed.
+```
+

.changelog/10324.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+envoy: fixes a bug where a large envoy config could cause the `consul connect envoy` command to deadlock when attempting to start envoy.
+```

.changelog/10329.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+connect: Support dialing individual service IP addresses through transparent proxies.
+```

.changelog/10330.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+connect/ca: ensure edits to the key type/bits for the connect builtin CA will regenerate the roots
+```

.changelog/10331.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+connect/ca: require new vault mount points when updating the key type/bits for the vault connect CA provider
+```

.changelog/10338.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+agent: fix logging output by removing leading whitespace from every log line
+```

.changelog/10340.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+telemetry: The usage data in the `metrics` API now includes cluster member counts, reporting clients on a per segment basis.
+```

.changelog/10358.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+monitor: fix monitor to produce json format logs when requested
+```

.changelog/10365.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+connect: Fix bug that prevented transparent proxies from working when mesh config restricted routing to catalog destinations.
+```

.changelog/10368.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+monitoring: optimize the monitoring endpoint to avoid losing logs when under high load.
+```

.changelog/10381.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+xds: (beta-only) ensure that dependent xDS resources are reconfigured during primary type warming
+```

.changelog/10391.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+proxycfg: Ensure that endpoints for explicit upstreams in other datacenters are watched in transparent mode.
+```

.changelog/10394.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+connect: allow exposing duplicate HTTP paths through a proxy instance.
+```

.changelog/10395.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+grpc: move gRPC INFO logs to be emitted as TRACE logs from Consul
+```

.changelog/10399.txt

@@ -0,0 +1,4 @@
+```release-note:improvement
+debug: Add a new /v1/agent/metrics/stream API endpoint for streaming of metrics
+```
+

.changelog/10401.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+dns: return an empty answer when asked for an addr dns with type other then A and AAAA.
+```

.changelog/10404.txt

@@ -0,0 +1,8 @@
+```release-note:feature
+connect: generate upstream service labels for terminating gateway listener stats.
+```
+
+```release-note:breaking-change
+connect: avoid encoding listener info in ingress and terminating gateway listener stats names.
+```
+

.changelog/10411.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ca: Fixed a bug that returned a malformed certificate chain when the certificate did not having a trailing newline.
+```

.changelog/10423.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+proxycfg: avoid panic when transparent proxy upstream is added and then removed.
+```

.changelog/10424.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+connect/ca: cease including the common name field in generated x509 non-CA certificates
+```

.changelog/10475.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+structs: prevent service-defaults upstream configs from using wildcard names or namespaces
+```

.changelog/10486.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+connect/proxy: fixes logic bug preventing builtin/native proxy from starting upstream listeners
+```

.changelog/10490.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+checks: fixes the default ServerName used with TLS health checks.
+```

.changelog/10500.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+check root and intermediate CA expiry before using it to sign a leaf certificate.
+```

.changelog/10503.txt

@@ -0,0 +1,4 @@
+```release-note:bug
+ui: Use the token's namespace instead of the default namespace when not
+specifying a namespace in the URL
+```

.changelog/10504.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+telemetry: added metrics to track certificates expiry.
+```

.changelog/10514.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+streaming: fix a bug that was preventing streaming from being enabled.
+```

.changelog/10515.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+agent: fix a panic on 32-bit platforms caused by misaligned struct fields used with sync/atomic.
+```