Merge branch 'main' into fly

.changelog/10894.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+api: Improve error message if service or health check not found by stating that the entity must be referred to by ID, not name
+```

.changelog/10895.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+grpc, xds: improved reliability of grpc and xds servers by adding recovery-middleware to return and log error in case of panic.
+```

.changelog/11335.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+api: URL-encode/decode resource names for v1/agent endpoints in API
+```

.changelog/11507.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+version: Improved performance of the version.GetHumanVersion function by 50% on memory allocation.
+```

.changelog/11569.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+api: responses that contain only a partial subset of results, due to filtering by ACL policies, may now include an `X-Consul-Results-Filtered-By-ACLs` header
+```

.changelog/11576.txt

@@ -0,0 +1,3 @@
+```release-note:feature
+ingress: allow setting TLS min version and cipher suites in ingress gateway config entries
+```

.changelog/11645.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+types: add TLSVersion and TLSCipherSuite
+```

.changelog/11665.txt

@@ -0,0 +1,3 @@
+```release-note:deprecation
+config: `acl.tokens.master` has been renamed to `acl.tokens.initial_management`, and `acl.tokens.agent_master` has been renamed to `acl.tokens.agent_recovery` - the old field names are now deprecated and will be removed in a future major release
+```

.changelog/11669.txt

@@ -0,0 +1,6 @@
+```release-note:deprecation
+api: `/v1/agent/token/agent_master` is deprecated and will be removed in a future major release - use `/v1/agent/token/agent_recovery` instead
+```
+```release-note:breaking-change
+cli: `consul acl set-agent-token master` has been replaced with `consul acl set-agent-token recovery`
+```

.changelog/11670.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fix visual issue with slight table header overflow
+```

.changelog/11671.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ca: fixes a bug that caused the intermediate cert used to sign leaf certs to be missing from the /connect/ca/roots API response when the Vault provider was used.
+```

.changelog/11672.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ca: fixes a bug that caused the SigningKeyID to be wrong in the primary DC, when the Vault provider is used, after a CA config creates a new root.
+```

.changelog/11693.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ca: fixes a bug that caused non blocking leaf cert queries to return the same cached response regardless of ca rotation or leaf cert expiry
+```

.changelog/11720.txt

@@ -0,0 +1,11 @@
+```release-note:improvement
+raft: Use bbolt instead of the legacy boltdb implementation
+```
+
+```release-note:improvement
+raft: Emit boltdb related performance metrics
+```
+
+```release-note:improvement
+raft: Added a configuration to disable boltdb freelist syncing
+```

.changelog/11722.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+agent: add variation of force-leave that exclusively works on the WAN
+```

.changelog/11724.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+connect: Consul will now generate a unique virtual IP for each connect-enabled service (this will also differ across namespace/partition in Enterprise).
+```

.changelog/11725.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+dns: Added a `virtual` endpoint for querying the assigned virtual IP for a service.
+```

.changelog/11744.txt

@@ -0,0 +1,3 @@
+```release-note:note
+Renamed the `agent_master` field to `agent_recovery` in the `acl-tokens.json` file in which tokens are persisted on-disk (when `acl.enable_token_persistence` is enabled)
+```

.changelog/11748.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+areas: **(Enterprise only)** make the gRPC server tracker network area aware
+```

.changelog/11767.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Ensure we show a readonly designed page for readonly intentions
+```

.changelog/11774.txt

@@ -0,0 +1,4 @@
+```release-note:bug
+ui: Differentiate between Service Meta and Node Meta when choosing search fields
+in Service Instance listings
+```

.changelog/11781.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+cli: when creating a private key, save the file with mode 0600 so that only the user has read permission.
+```

.changelog/11791.txt

@@ -0,0 +1,3 @@
+```release-note:bugfix
+ui: Change partitions to expect [] from the listing API
+```

.changelog/11799.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ci: Upgrade to use Go 1.17.5
+```

.changelog/11801.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+ui: Change partition URL segment prefix from `-` to `_` 
+```

.changelog/11803.txt

@@ -0,0 +1,3 @@
+```release-note:feature
+ui: Adds visible Consul version information
+```

.changelog/11804.txt

@@ -0,0 +1,4 @@
+```release-note:bugfix
+ui: Don't offer to save an intention with a source/destinatiojn wildcard
+partition
+```

.changelog/11818.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+http: when a URL path is not found, include a message with the 404 status code to help the user understand why (e.g., HTTP API endpoint path not prefixed with /v1/)
+```

.changelog/11820.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+http: when a user attempts to access the UI but can't because it's disabled, explain this and how to fix it
+```

.changelog/11824.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+proxycfg: ensure all of the watches are canceled if they are cancelable
+```

.changelog/11826.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+connect: fix race causing xDS generation to lock up when discovery chains are tracked for services that are no longer upstreams.
+```

.changelog/11827.txt

@@ -0,0 +1,3 @@
+```release-note:breaking-change
+sdk: several changes to the testutil configuration structs (removed `ACLMasterToken`, renamed `Master` to `InitialManagement`, and `AgentMaster` to `AgentRecovery`)
+```

.changelog/11850.txt

@@ -0,0 +1,3 @@
+```release-note:bugfix
+ui: Fixes an issue with the version footer wandering when scrolling
+```

.changelog/11854.txt

@@ -0,0 +1,3 @@
+```release-note:security
+ci: Upgrade golang.org/x/net to address [CVE-2021-44716](https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2021-44716)
+```

.changelog/11855.txt

@@ -0,0 +1,4 @@
+```release-note:feature
+Admin Partitions (Consul Enterprise only) This version adds admin partitions, a new entity defining administrative and networking boundaries within a Consul deployment. For more information refer to the
+ [Admin Partition](https://www.consul.io/docs/enterprise/admin-partitions) documentation.
+```

.changelog/11868.txt

@@ -0,0 +1,5 @@
+```release-note:bug
+ui: Fix an issue where attempting to delete a policy from the policy detail page when
+attached to a token would result in the delete button disappearing and no
+deletion being attempted
+```

.changelog/11891.txt

@@ -0,0 +1,4 @@
+```release-note:bug
+ui: Fixes an issue where once a 403 page is displayed in some circumstances its
+diffcult to click back to where you where before receiving a 403
+```

.changelog/11892.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Ensure a login buttons appear for some error states, plus text amends
+```

.changelog/11895.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+connect: update Envoy supported version of 1.20 to 1.20.1
+```

.changelog/11903.txt

@@ -0,0 +1,4 @@
+```release-note:bug
+ui: Fixes a bug where proxy service health checks would sometimes not appear
+until refresh
+```

.changelog/11905.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Prevent disconnection notice appearing with auth change on certain pages
+```

.changelog/11918.txt

@@ -0,0 +1,6 @@
+```release-note:bug
+config: include all config errors in the error message, previously some could be hidden.
+```
+```release-note:bug
+snapshot: the `snapshot save` command now saves the snapshot with read permission for only the current user.
+```

.changelog/11924.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+xds: fix a deadlock when the snapshot channel already have a snapshot to be consumed.
+```

.changelog/11926.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+cli: Display assigned node identities in output of `consul acl token list`.
+```

.changelog/11931.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fixes a bug with URL decoding within KV area
+```

.changelog/11937.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fixes an issue saving intentions when editing per service intentions
+```

.changelog/11940.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ Mutate `NodeService` struct properly to avoid a data race.
+```

.changelog/11950.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+api: Return 404 when de-registering a non-existent check
+```

.changelog/11956.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ci: Enable security scanning for CRT
+```

.changelog/11958.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+Upgrade to raft `1.3.3` which fixes a bug where a read replica node can trigger a raft election and become a leader.
+```

.changelog/11959.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fixes a visual issue with some border colors
+```

.changelog/11960.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+windows: Fixes a bug with empty log files when Consul is run as a Windows Service
+```

.changelog/11968.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Temporarily remove KV pre-flight check for KV list permissions
+```

.changelog/11979.txt

@@ -0,0 +1,4 @@
+```release-note:bug
+ui: Ensure partition query parameter is passed through to all OIDC related API
+requests
+```

.changelog/11985.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+ui: Added a notice for non-primary intention creation
+```

.changelog/12042.txt

@@ -0,0 +1,4 @@
+```release-note:bug
+memberlist: fixes a bug which prevented members from joining a cluster with
+large amounts of churn [[GH-253](https://github.com/hashicorp/memberlist/issues/253)]
+```

.changelog/12049.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+connect: Add support for connecting to services behind a terminating gateway when using a transparent proxy.
+```

.changelog/12057.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+serf: update serf v0.9.7, complete the leave process if broadcasting leave timeout.
+```

.changelog/12080.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+streaming: Improved performance when the server is handling many concurrent subscriptions and has a high number of CPU cores
+```

.changelog/12081.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: Fixed a bug with creating multiple nested KVs in one interaction
+```

.changelog/12098.txt

@@ -0,0 +1,3 @@
+```release-note:feature
+ui: Support connect-native services in the Topology view.
+```

.changelog/12110.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+rpc: improve blocking queries for items that do not exist, by continuing to block until they exist (or the timeout).
+```

.changelog/12126.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+sdk: Add support for `Partition` and `RetryJoin` to the TestServerConfig struct.
+```

.changelog/12166.txt

@@ -0,0 +1,3 @@
+```release-note:deprecation
+acl: The `consul.acl.ResolveTokenToIdentity` metric is no longer reported. The values that were previous reported as part of this metric will now be part of the `consul.acl.ResolveToken` metric.
+```

.changelog/12174.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+xds: fix for delta xDS reconnect bug in LDS/CDS
+```

.changelog/12176.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+systemd: Support starting/stopping the systemd service for linux packages when the optional EnvironmentFile does not exist.
+```

.changelog/12195.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+xds: prevents tight loop where the Consul client agent would repeatedly re-send config that Envoy has rejected.
+```

.changelog/12209.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+ui: Use @hashicorp/flight icons for all our icons.
+```

.changelog/12223.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+connect: fixes bug where passthrough addressses for transparent proxies dialed directly weren't being cleaned up.
+```