Consul 1.7.0-beta3 Released!

mkeeler · January 24, 2020, 6:07pm

Hello everyone,

We have released Consul 1.7.0-beta3. This release contains a number of bug fixes and enhancements from the previous beta including:

Namespace support for Connect (Consul Enterprise only)
DNS improvements for dual stack IPv4/IPv6 support

There are also a couple potentially breaking changes regarding ACL enforcement.

The v1/agent/force-leave HTTP endpoint now requires operator:write privileges instead of agent:write
Write operations on intentions using wildcards require having a prefix matching rule that grants unlimited write access to intentions and there must be no other rule that would override with less access.
Read operations on intentions are now allowed if the token used has read privileges on intentions for either the source or destination of the intention.
Read operations on an intention with wildcards is allowed if the token would grant read privileges to any matching resource. Previously it required having an ACL rule with the literal * rule segment.

Please see the complete changelog for details on the release:

github.com

hashicorp/consul/blob/v1.7.0-beta3/CHANGELOG.md

## Unreleased

BREAKING CHANGES:

* agent: The ACL requirement for the [agent/force-leave endpoint](https://www.consul.io/api/agent.html#force-leave-and-shutdown) is now `operator:write` rather than `agent:write`. [[GH-7033](https://github.com/hashicorp/consul/pull/7033)]
* intentions: Change the ACL requirement and enforcement for wildcard rules. Previously this would look for an ACL rule that would grant access to the service/intention `*`. Now, in order to write a wildcard intention requires write access to all intentions and reading a wildcard intention requires read access to any intention that would match. Additionally intention listing and reading allow access if the requester can read either side of the intention whereas before it only allowed it for permissions on the destination side. [[GH-7028](https://github.com/hashicorp/consul/pull/7028)]

FEATURES:

* acl: **(Consul Enterprise only)** auth methods defined in the `default` namespace gained the ability to create tokens in alternate namespaces. This capability was implemented for all existing auth methods.
* connect: **(Consul Enterprise only)** Namespaces are now fully functional with Connect and Configuration Entries.

IMPROVEMENTS:

* agent: default the primary_datacenter to the datacenter if not configured [[GH-7111](https://github.com/hashicorp/consul/issues/7111)]
* agent: configurable `MaxQueryTime` and `DefaultQueryTime` [[GH-3777](https://github.com/hashicorp/consul/pull/3777)]
* agent: do not deregister service checks twice [[GH-6168](https://github.com/hashicorp/consul/pull/6168)]
* agent: remove service sidecars in `cleanupRegistration` [[GH-7022](https://github.com/hashicorp/consul/pull/7022)]
* agent: setup grpc server with auto_encrypt certs and add `-https-port` [[GH-7086](https://github.com/hashicorp/consul/pull/7086)
* api: A new `/v1/catalog/node-services/:node` endpoint was added that mirrors the existing `/v1/catalog/node/:node` endpoint but has a response structure that contains a slice of services instead of a map of service ids to services. This new endpoint allow retrieving all services in all namespaces for a node. [[GH-7115](https://github.com/hashicorp/consul/pull/7115)]

This file has been truncated. show original

The release binaries can be downloaded here:

https://releases.hashicorp.com/consul/1.7.0-beta3/

– The Consul Team