consul v1.13.2 Release Notes

Release Date: 2022-09-20 // over 1 year ago

    • ๐Ÿš€ ca: If using Vault as the service mesh CA provider, the Vault policy used by Consul now requires the update capability on the intermediate PKI's tune mount configuration endpoint, such as /sys/mounts/connect_inter/tune. The breaking nature of this change will be resolved in an upcoming 1.13 patch release. Refer to upgrade guidance for more information.

    ๐Ÿ”’ SECURITY:

    • auto-config: Added input validation for auto-config JWT authorization checks. Prior to this change, it was possible for malicious actors to construct requests which incorrectly pass custom JWT claim validation for the AutoConfig.InitialConfiguration endpoint. Now, only a subset of characters are allowed for the input before evaluating the bexpr. [GH-14577]
    • connect: Added URI length checks to ConnectCA CSR requests. Prior to this change, it was possible for a malicious actor to designate multiple SAN URI values in a call to the ConnectCA.Sign endpoint. The endpoint now only allows for exactly one SAN URI to be specified. [GH-14579]

    ๐Ÿ”‹ FEATURES:

    • ๐Ÿ“„ cli: Adds new subcommands for peering workflows. Refer to the CLI docs for more information. [GH-14423]
    • connect: Server address changes are streamed to peers [GH-14285]
    • service-defaults: Added support for local_request_timeout_ms and local_connect_timeout_ms in servicedefaults config entry [GH-14395]


    • โœ… connect: Bump latest Envoy to 1.23.1 in test matrix [GH-14573]
    • ๐Ÿ”ง connect: expose new tracing configuration on envoy [GH-13998]
    • ๐Ÿ”ง envoy: adds additional Envoy outlier ejection parameters to passive health check configurations. [GH-14238]
    • metrics: add labels of segment, partition, network area, network (lan or wan) to serf and memberlist metrics [GH-14161]
    • peering: Validate peering tokens for server name conflicts [GH-14563]
    • snapshot agent: (Enterprise only) Add support for path-based addressing when using s3 backend.
    • ๐Ÿ’ป ui: Reuse connections for requests to /v1/internal/ui/metrics-proxy/ [GH-14521]

    ๐Ÿ› BUG FIXES:

    • ๐Ÿ›  agent: Fixes an issue where an agent that fails to start due to bad addresses won't clean up any existing listeners [GH-14081]
    • api: Fix a breaking change caused by renaming QueryDatacenterOptions to QueryFailoverOptions. This adds QueryDatacenterOptions back as an alias to ๐Ÿ—„ QueryFailoverOptions and marks it as deprecated. [GH-14378]
    • โšก๏ธ ca: Fixed a bug with the Vault CA provider where the intermediate PKI mount and leaf cert role were not being updated when the CA configuration was changed. [GH-14516]
    • cli: When launching a sidecar proxy with consul connect envoy or consul connect proxy, the -sidecar-for service ID argument is now treated as case-insensitive. [GH-14034]
    • connect: Fix issue where auto_config and auto_encrypt could unintentionally enable TLS for gRPC xDS connections. [GH-14269]
    • ๐Ÿšš connect: Fixed a bug where old root CAs would be removed from the primary datacenter after switching providers and restarting the cluster. [GH-14598]
    • ๐Ÿ— connect: Fixed an issue where intermediate certificates could build up in the root CA because they were never being pruned after expiring. [GH-14429]
    • ๐Ÿ›  connect: Fixed some spurious issues during peering establishment when a follower is dialed [GH-14119]
    • ๐Ÿ”ง envoy: validate name before deleting proxy default configurations. [GH-14290]
    • peering: Fix issue preventing deletion and recreation of peerings in TERMINATED state. [GH-14364]
    • rpc: Adds max jitter to client deadlines to prevent i/o deadline errors on blocking queries [GH-14233]
    • tls: undo breaking change that prevented setting TLS for gRPC when using config flags available in Consul v1.11. [GH-14668]
    • ๐Ÿšš ui: Removed Overview page from HCP instalations [GH-14606]

Previous changes from v1.13.1

  • ๐Ÿ› BUG FIXES:

    • ๐Ÿ›  agent: Fixed a compatibility issue when restoring snapshots from pre-1.13.0 versions of Consul [GH-14107] [GH-14149]
    • ๐Ÿ›  connect: Fixed some spurious issues during peering establishment when a follower is dialed [GH-14119]