From 751e11b84edb36aaafc606cbb86b5a473ca595ae Mon Sep 17 00:00:00 2001 From: Hariram Sankaran <56744845+ramramhariram@users.noreply.github.com> Date: Mon, 12 Jun 2023 15:46:37 +0000 Subject: [PATCH] backport of commit 9ec2b3807aaa86f6af0a938d348f4649f83f51fb --- ...t-1.16.x.yaml => nightly-test-1.12.x.yaml} | 6 +- CHANGELOG.md | 67 ++ agent/agent_endpoint.go | 10 +- agent/agent_endpoint_test.go | 6 +- .../builtin/http/localratelimit/ratelimit.go | 5 +- .../http/localratelimit/ratelimit_test.go | 24 + agent/envoyextensions/builtin/lua/lua.go | 5 +- agent/envoyextensions/builtin/lua/lua_test.go | 9 + .../property-override/property_override.go | 3 + .../property_override_test.go | 2 +- agent/proxycfg/mesh_gateway.go | 1 + agent/xds/resources_test.go | 13 + agent/xds/routes.go | 12 - ...route-and-inline-certificate.latest.golden | 51 +- api/go.mod | 2 +- api/go.sum | 2 + command/agent/agent.go | 3 + envoyextensions/go.mod | 6 +- envoyextensions/go.sum | 16 +- go.mod | 10 +- test/integration/consul-container/go.mod | 6 +- troubleshoot/go.mod | 5 +- troubleshoot/go.sum | 12 +- version/VERSION | 2 +- .../docs/agent/config/config-files.mdx | 4 + website/content/docs/agent/config/index.mdx | 1 + website/content/docs/agent/limits/index.mdx | 49 +- .../limits/set-global-traffic-rate-limits.mdx | 114 --- .../limits/{ => usage}/init-rate-limits.mdx | 9 +- .../usage/limit-request-rates-from-ips.mdx | 66 ++ .../limits/usage/monitor-rate-limits.mdx | 77 ++ .../usage/set-global-traffic-rate-limits.mdx | 62 ++ .../control-plane-request-limit.mdx | 224 ++++++ .../configuration/ext-authz.mdx | 726 ++++++++++++++++++ .../configuration/property-override.mdx | 273 +++++++ .../envoy-extensions/configuration/wasm.mdx | 484 ++++++++++++ .../proxies/envoy-extensions/index.mdx | 23 +- .../envoy-extensions/usage/ext-authz.mdx | 147 ++++ .../usage/property-override.mdx | 203 +++++ .../proxies/envoy-extensions/usage/wasm.mdx | 191 +++++ .../license/utilization-reporting.mdx | 168 ++++ .../partials/envoy_ext_rule_matcher.mdx | 9 + website/data/docs-nav-data.json | 93 ++- 43 files changed, 2970 insertions(+), 231 deletions(-) rename .github/workflows/{nightly-test-1.16.x.yaml => nightly-test-1.12.x.yaml} (98%) delete mode 100644 website/content/docs/agent/limits/set-global-traffic-rate-limits.mdx rename website/content/docs/agent/limits/{ => usage}/init-rate-limits.mdx (68%) create mode 100644 website/content/docs/agent/limits/usage/limit-request-rates-from-ips.mdx create mode 100644 website/content/docs/agent/limits/usage/monitor-rate-limits.mdx create mode 100644 website/content/docs/agent/limits/usage/set-global-traffic-rate-limits.mdx create mode 100644 website/content/docs/connect/config-entries/control-plane-request-limit.mdx create mode 100644 website/content/docs/connect/proxies/envoy-extensions/configuration/ext-authz.mdx create mode 100644 website/content/docs/connect/proxies/envoy-extensions/configuration/property-override.mdx create mode 100644 website/content/docs/connect/proxies/envoy-extensions/configuration/wasm.mdx create mode 100644 website/content/docs/connect/proxies/envoy-extensions/usage/ext-authz.mdx create mode 100644 website/content/docs/connect/proxies/envoy-extensions/usage/property-override.mdx create mode 100644 website/content/docs/connect/proxies/envoy-extensions/usage/wasm.mdx create mode 100644 website/content/docs/enterprise/license/utilization-reporting.mdx create mode 100644 website/content/partials/envoy_ext_rule_matcher.mdx diff --git a/.github/workflows/nightly-test-1.16.x.yaml b/.github/workflows/nightly-test-1.12.x.yaml similarity index 98% rename from .github/workflows/nightly-test-1.16.x.yaml rename to .github/workflows/nightly-test-1.12.x.yaml index c30ed6811c2b8..0f016075e261a 100644 --- a/.github/workflows/nightly-test-1.16.x.yaml +++ b/.github/workflows/nightly-test-1.12.x.yaml @@ -1,7 +1,7 @@ # Copyright (c) HashiCorp, Inc. # SPDX-License-Identifier: MPL-2.0 -name: Nightly Test 1.16.x +name: Nightly Test 1.12.x on: schedule: - cron: '0 4 * * *' @@ -9,8 +9,8 @@ on: env: EMBER_PARTITION_TOTAL: 4 # Has to be changed in tandem with the matrix.partition - BRANCH: "release/1.16.x" - BRANCH_NAME: "release-1.16.x" # Used for naming artifacts + BRANCH: "release/1.12.x" + BRANCH_NAME: "release-1.12.x" # Used for naming artifacts jobs: frontend-test-workspace-node: diff --git a/CHANGELOG.md b/CHANGELOG.md index ee1dccacc139b..ef4edc700404a 100644 --- a/CHANGELOG.md +++ b/CHANGELOG.md @@ -1,3 +1,70 @@ +## 1.16.0-rc1 (June 12, 2023) + +BREAKING CHANGES: + +* api: The `/v1/health/connect/` and `/v1/health/ingress/` endpoints now immediately return 403 "Permission Denied" errors whenever a token with insufficient `service:read` permissions is provided. Prior to this change, the endpoints returned a success code with an empty result list when a token with insufficient permissions was provided. [[GH-17424](https://github.com/hashicorp/consul/issues/17424)] +* peering: Removed deprecated backward-compatibility behavior. +Upstream overrides in service-defaults will now only apply to peer upstreams when the `peer` field is provided. +Visit the 1.16.x [upgrade instructions](https://developer.hashicorp.com/consul/docs/upgrading/upgrade-specific) for more information. [[GH-16957](https://github.com/hashicorp/consul/issues/16957)] + +SECURITY: + +* audit-logging: **(Enterprise only)** limit `v1/operator/audit-hash` endpoint to ACL token with `operator:read` privileges. + +FEATURES: + +* api: (Enterprise only) Add `POST /v1/operator/audit-hash` endpoint to calculate the hash of the data used by the audit log hash function and salt. +* cli: (Enterprise only) Add a new `consul operator audit hash` command to retrieve and compare the hash of the data used by the audit log hash function and salt. +* cli: Adds new command - `consul services export` - for exporting a service to a peer or partition [[GH-15654](https://github.com/hashicorp/consul/issues/15654)] +* connect: **(Consul Enterprise only)** Implement order-by-locality failover. +* mesh: Add new permissive mTLS mode that allows sidecar proxies to forward incoming traffic unmodified to the application. This adds `AllowEnablingPermissiveMutualTLS` setting to the mesh config entry and the `MutualTLSMode` setting to proxy-defaults and service-defaults. [[GH-17035](https://github.com/hashicorp/consul/issues/17035)] +* mesh: Support configuring JWT authentication in Envoy. [[GH-17452](https://github.com/hashicorp/consul/issues/17452)] +* server: **(Enterprise Only)** added server side RPC requests IP based read/write rate-limiter. [[GH-4633](https://github.com/hashicorp/consul/issues/4633)] +* server: **(Enterprise Only)** allow automatic license utilization reporting. [[GH-5102](https://github.com/hashicorp/consul/issues/5102)] +* server: added server side RPC requests global read/write rate-limiter. [[GH-16292](https://github.com/hashicorp/consul/issues/16292)] +* xds: Add `property-override` built-in Envoy extension that directly patches Envoy resources. [[GH-17487](https://github.com/hashicorp/consul/issues/17487)] +* xds: Add a built-in Envoy extension that inserts External Authorization (ext_authz) network and HTTP filters. [[GH-17495](https://github.com/hashicorp/consul/issues/17495)] +* xds: Add a built-in Envoy extension that inserts Wasm HTTP filters. [[GH-16877](https://github.com/hashicorp/consul/issues/16877)] +* xds: Add a built-in Envoy extension that inserts Wasm network filters. [[GH-17505](https://github.com/hashicorp/consul/issues/17505)] + +IMPROVEMENTS: + +* * api: Support filtering for config entries. [[GH-17183](https://github.com/hashicorp/consul/issues/17183)] +* * cli: Add `-filter` option to `consul config list` for filtering config entries. [[GH-17183](https://github.com/hashicorp/consul/issues/17183)] +* api: Enable setting query options on agent force-leave endpoint. [[GH-15987](https://github.com/hashicorp/consul/issues/15987)] +* audit-logging: (Enterprise only) enable error response and request body logging [[GH-5669](https://github.com/hashicorp/consul/issues/5669)] +* audit-logging: **(Enterprise only)** enable error response and request body logging +* ca: automatically set up Vault's auto-tidy setting for tidy_expired_issuers when using Vault as a CA provider. [[GH-17138](https://github.com/hashicorp/consul/issues/17138)] +* ca: support Vault agent auto-auth config for Vault CA provider using AliCloud authentication. [[GH-16224](https://github.com/hashicorp/consul/issues/16224)] +* ca: support Vault agent auto-auth config for Vault CA provider using AppRole authentication. [[GH-16259](https://github.com/hashicorp/consul/issues/16259)] +* ca: support Vault agent auto-auth config for Vault CA provider using Azure MSI authentication. [[GH-16298](https://github.com/hashicorp/consul/issues/16298)] +* ca: support Vault agent auto-auth config for Vault CA provider using JWT authentication. [[GH-16266](https://github.com/hashicorp/consul/issues/16266)] +* ca: support Vault agent auto-auth config for Vault CA provider using Kubernetes authentication. [[GH-16262](https://github.com/hashicorp/consul/issues/16262)] +* command: Adds ACL enabled to status output on agent startup. [[GH-17086](https://github.com/hashicorp/consul/issues/17086)] +* command: Allow creating ACL Token TTL with greater than 24 hours with the -expires-ttl flag. [[GH-17066](https://github.com/hashicorp/consul/issues/17066)] +* connect: **(Enterprise Only)** Add support for specifying "Partition" and "Namespace" in Prepared Queries failover rules. +* connect: update supported envoy versions to 1.23.10, 1.24.8, 1.25.7, 1.26.2 [[GH-17546](https://github.com/hashicorp/consul/issues/17546)] +* connect: update supported envoy versions to 1.23.8, 1.24.6, 1.25.4, 1.26.0 [[GH-5200](https://github.com/hashicorp/consul/issues/5200)] +* fix metric names in /docs/agent/telemetry [[GH-17577](https://github.com/hashicorp/consul/issues/17577)] +* gateway: Change status condition reason for invalid certificate on a listener from "Accepted" to "ResolvedRefs". [[GH-17115](https://github.com/hashicorp/consul/issues/17115)] +* http: accept query parameters `datacenter`, `ap` (enterprise-only), and `namespace` (enterprise-only). Both short-hand and long-hand forms of these query params are now supported via the HTTP API (dc/datacenter, ap/partition, ns/namespace). [[GH-17525](https://github.com/hashicorp/consul/issues/17525)] +* systemd: set service type to notify. [[GH-16845](https://github.com/hashicorp/consul/issues/16845)] +* ui: Update alerts to Hds::Alert component [[GH-16412](https://github.com/hashicorp/consul/issues/16412)] +* ui: Update to use Hds::Toast component to show notifications [[GH-16519](https://github.com/hashicorp/consul/issues/16519)] +* ui: update from