This release is created to share the Consul Enterprise changelog and notify consumers of availability. The attached source and assets do not include Consul Enterprise code and should not be used in place of official Docker images or binaries.
SECURITY:
mitchellh/mapstructure to go-viper/mapstructure to v2 to address CVE-2025-52893. [GH-22581]FEATURES:
max_request_headers_kb to configure maximum header size for requests from downstream to upstream [GH-22604]max_request_headers_kb to configure maximum header size for requests from downstream to upstream in API Gateway config and proxy-defaults [GH-22679]max_request_headers_kb to configure maximum header size for requests from downstream to upstream in Mesh Gateway via service-defaults and proxy-defaults [GH-22722]max_request_headers_kb to configure maximum header size for requests from downstream to upstream in Terminating Gateway service-defaults and proxy-defaults [GH-22680]BUG FIXES:
This release is created to share the Consul Enterprise changelog and notify consumers of availability. The attached source and assets do not include Consul Enterprise code and should not be used in place of official Docker images or binaries.
SECURITY:
IMPROVEMENTS:
BUG FIXES:
This release is created to share the Consul Enterprise changelog and notify consumers of availability. The attached source and assets do not include Consul Enterprise code and should not be used in place of official Docker images or binaries.
Enterprise LTS: Consul Enterprise 1.18 is a Long-Term Support (LTS) release.
SECURITY:
This release is created to share the Consul Enterprise changelog and notify consumers of availability. The attached source and assets do not include Consul Enterprise code and should not be used in place of official Docker images or binaries.
Enterprise LTS: Consul Enterprise 1.18 is a Long-Term Support (LTS) release.
SECURITY:
IMPROVEMENTS:
datacenter resulting in non-generation of X.509 certificates when using external CA for agent TLS communication. [GH-22382]BUG FIXES:
This release is created to share the Consul Enterprise changelog and notify consumers of availability. The attached source and assets do not include Consul Enterprise code and should not be used in place of official Docker images or binaries.
BREAKING CHANGES:
telemetry.disable_hostname when determining whether to prefix gauge-type metrics with the hostname of the Consul agent. Previously, if only the default metric sink was enabled, this configuration was ignored and always treated as true, even though its default value is false. [GH-20312]SECURITY:
golang.org/x/crypto to v0.17.0 to address CVE-2023-48795. [GH-20023]FEATURES:
v2dns in the experiments agent config to enable.
It will automatically be enabled when using the resource-apis (Catalog v2) experiment.
The new DNS implementation will be the default in Consul 1.19.
See the Consul 1.18.x Release Notes for deprecated DNS features. [GH-20643]IMPROVEMENTS:
envoy.config.core.v3.HeaderValueOption.append. [GH-20078]envoy.config.route.v3.HeaderMatcher.safe_regex_match and envoy.type.matcher.v3.RegexMatcher.google_re2. [GH-20013]BUG FIXES:
This release is created to share the Consul Enterprise changelog and notify consumers of availability. The attached source and assets do not include Consul Enterprise code and should not be used in place of official Docker images or binaries.
BREAKING CHANGES:
SECURITY:
golang.org/x/net to v0.17.0 to address CVE-2023-39325
/ CVE-2023-44487(x/net/http2). [GH-19225]net/http). [GH-19225]google.golang.org/grpc to 1.56.3.
This resolves vulnerability CVE-2023-44487. [GH-19414]FEATURE PREVIEW: Catalog v2
This release provides the ability to preview Consul's v2 Catalog and Resource API if enabled. The new model supports multi-port application deployments with only a single Envoy proxy. Note that the v1 and v2 catalogs are not cross compatible, and not all Consul features are available within this v2 feature preview. See the v2 Catalog and Resource API documentation for more information. The v2 Catalog and Resources API should be considered a feature preview within this release and should not be used in production environments.
Limitations
Significant Pull Requests
FEATURES:
acl.tokens.dns config field which specifies the token used implicitly during dns checks. [GH-17936]bind-var flag to consul acl binding-rule for templated policy variables. [GH-18719]consul acl templated-policy commands to read, list and preview templated policies. [GH-18816]IMPROVEMENTS:
CheckRegisterOpts to Agent API [GH-18943]Token field to ServiceRegisterOpts type in Agent API [GH-18983]-templated-policy, -templated-policy-file, -replace-templated-policy, -append-templated-policy, -replace-templated-policy-file, -append-templated-policy-file and -var flags for creating or updating tokens/roles. [GH-18708]tls.defaults.verify_server_hostname configuration option. This specifies the default value for any interfaces that support the verify_server_hostname option. [GH-17155]BUG FIXES:
/v1/catalog/services endpoint [GH-18322]performance.grpc_keepalive_timeout and performance.grpc_keepalive_interval now exist to allow for configuration on how often these dead connections will be cleaned up. [GH-19339]This release is created to share the Consul Enterprise changelog and notify consumers of availability. The attached source and assets do not include Consul Enterprise code and should not be used in place of official Docker images or binaries.
BREAKING CHANGES:
/v1/health/connect/ and /v1/health/ingress/ endpoints now immediately return 403 "Permission Denied" errors whenever a token with insufficient service:read permissions is provided. Prior to this change, the endpoints returned a success code with an empty result list when a token with insufficient permissions was provided. [GH-17424]peer field is provided.
Visit the 1.16.x upgrade instructions for more information. [GH-16957]SECURITY:
alpine:3.18. [GH-17719]v1/operator/audit-hash endpoint to ACL token with operator:read privileges.FEATURES:
POST /v1/operator/audit-hash endpoint to calculate the hash of the data used by the audit log hash function and salt.consul operator audit hash command to retrieve and compare the hash of the data used by the audit log hash function and salt.consul services export - for exporting a service to a peer or partition [GH-15654]AllowEnablingPermissiveMutualTLS setting to the mesh config entry and the MutualTLSMode setting to proxy-defaults and service-defaults. [GH-17035]property-override built-in Envoy extension that directly patches Envoy resources. [GH-17487]IMPROVEMENTS:
-filter option to consul config list for filtering config entries. [GH-17183]datacenter, ap (enterprise-only), and namespace (enterprise-only). Both short-hand and long-hand forms of these query params are now supported via the HTTP API (dc/datacenter, ap/partition, ns/namespace). [GH-17525]BUG FIXES:
This release is created to share the Consul Enterprise changelog and notify consumers of availability. The attached source and assets do not include Consul Enterprise code and should not be used in place of official Docker images or binaries.
Full Changelog: https://github.com/hashicorp/consul-enterprise/compare/v1.15.18+ent...v1.15.19+ent
This release is created to share the Consul Enterprise changelog and notify consumers of availability. The attached source and assets do not include Consul Enterprise code and should not be used in place of official Docker images or binaries.
BREAKING CHANGES:
-join, -join-wan, start_join, and start_join_wan.
These options are now aliases of -retry-join, -retry-join-wan, retry_join, and retry_join_wan, respectively. [GH-15598]peer field to service-defaults upstream overrides. The addition of this field makes it possible to apply upstream overrides only to peer services. Prior to this change, overrides would be applied based on matching the namespace and name fields only, which means users could not have different configuration for local versus peer services. With this change, peer upstreams are only affected if the peer field matches the destination peer name. [GH-15956]consul connect envoy command if the Envoy version is incompatible. To ignore this check use flag --ignore-envoy-compatibility [GH-15818]connect.enable_serverless_plugin agent configuration option. Now
Lambda integration is enabled by default. [GH-15710]SECURITY:
crypto/tls and CVE-2022-41723 in net/http. [GH-16263]FEATURES:
acl.tokens.config_file_registration config field which specifies the token used
to register services and checks that are defined in config files. [GH-15828]consul troubleshoot upstreams and consul troubleshoot proxy to troubleshoot Consul's service mesh configuration and network issues. [GH-16284]operator usage instances subcommand for displaying total services, connect service instances and billable service instances in the local datacenter or globally. [GH-16205]proxy-defaults config entry. [GH-15864]consul namespace. [GH-15906]IMPROVEMENTS:
consul connect envoy command the Envoy version will now be checked for compatibility. If incompatible Consul will error and exit. [GH-15818]RESOURCE_EXHAUSTED responses [GH-15892]acl bootstrap command. [GH-14437]_<query id or name>._tcp.query[.<datacenter>].<domain>. [GH-14465]wal backend for log storage. [GH-16176]consul.xds.server.streamsUnauthenticated metric to track
the number of active xDS streams handled by the server that are unauthenticated
because ACLs are not enabled or ACL tokens were missing. [GH-15967]DEPRECATIONS:
token query parameter and warn when it is used for authentication. [GH-16009]-id flag on acl token operations has been changed to -accessor-id for clarity in documentation. The -id flag will continue to work, but operators should use -accessor-id in the future. [GH-16044]BUG FIXES:
This release is created to share the Consul Enterprise changelog and notify consumers of availability. The attached source and assets do not include Consul Enterprise code and should not be used in place of official Docker images or binaries.
BREAKING CHANGES:
ports.grpc_tls configuration option.
Introduce a new port to better separate TLS config from the existing ports.grpc config.
The new ports.grpc_tls only supports TLS encrypted communication.
The existing ports.grpc now only supports plain-text communication. [GH-15339]peering and connect by default. [GH-15302]PeerName to Peer on prepared queries and exported services. [GH-14854]SECURITY:
FEATURES:
-consul-dns-port flag to the consul connect redirect-traffic command to allow forwarding DNS traffic to a specific Consul DNS port. [GH-15050]server_type=internal|external label to gRPC metrics. [GH-14922]get-or-empty operation to the txn api. Refer to the API docs for more information. [GH-14474]iptables to forward DNS traffic to a specific DNS port. [GH-15050]IMPROVEMENTS:
xds.update_max_per_second config field) [GH-14960]Failovers and Redirects only
specify Partition and Namespace on Consul Enterprise. This prevents scenarios
where OSS Consul would save service-resolvers that require Consul Enterprise. [GH-14162]RetryOn field for specifying the conditions when Envoy should retry requests beyond specific status codes and generic connection failure which already exists. [GH-12890]<servicename>.virtual.<namespace>.ns.<partition>.ap.<peername>.peer.consul and <servicename>.virtual.<partition>.ap.<peername>.peer.consul. This longer form address that allows specifying .peer would need to be used for tproxy DNS requests made within non-default partitions for imported services.[<tag>.]<service>.service[.<namespace>.ns][.<partition>.ap][.<datacenter>.dc]<domain>. [GH-14679]consul.xds.server.streamStart metric to measure time taken to first generate xDS resources for an xDS stream. [GH-14957]max_ejection_percent on Envoy's outlier detection to 100% for peered services. [GH-14373]BUG FIXES:
NOTES:
This release is created to share the Consul Enterprise changelog and notify consumers of availability. The attached source and assets do not include Consul Enterprise code and should not be used in place of official Docker images or binaries.
BREAKING CHANGES:
telemetry { disable_compat_1.9 = (true|false) } has been removed. Before upgrading you should remove this flag from your config if the flag is being used. [GH-13532]FEATURES:
consul version commands
to report this. Agent also reports build date in log on startup. [GH-13357]Sign [GH-12787]destination field to the service-default config entry that allows routing egress traffic
through a terminating gateway in transparent proxy mode without modifying the catalog. [GH-13613]ingress-gateway, mesh, service-intentions and service-resolver config entry events. [GH-13658]IMPROVEMENTS:
merge-central-config query parameter support added to /catalog/node-services/:node-name API, to view a fully resolved service definition (especially when not written into the catalog that way). [GH-13450]merge-central-config query parameter support added to /catalog/node-services/:node-name API, to view a fully resolved service definition (especially when not written into the catalog that way). [GH-2046]merge-central-config query parameter support added to some catalog and health endpoints to view a fully resolved service definition (especially when not written into the catalog that way). [GH-13001]consul connect envoy command.
Adds the -prometheus-ca-file, -prometheus-ca-path, -prometheus-cert-file and -prometheus-key-file flags. [GH-13481]max_inbound_connections setting to service-defaults for limiting the number of concurrent inbound connections to each service instance. [GH-13143]consul.raft.thread.main.saturation and consul.raft.thread.fsm.saturation metrics to measure approximate saturation of the Raft goroutines [GH-12865]BUG FIXES:
acl token read is used with the -self and -expanded flags, return an error instead of panicking [GH-13787]This release is created to share the Consul Enterprise changelog and notify consumers of availability. The attached source and assets do not include Consul Enterprise code and should not be used in place of official Docker images or binaries.
BREAKING CHANGES:
ACLMasterToken, renamed Master to InitialManagement, and AgentMaster to AgentRecovery) [GH-11827]consul.http... metrics can still be enabled by setting disable_compat_1.9 = false. However, we will remove these metrics in 1.13. [GH-12675]FEATURES:
WatchRoots [GH-12678]token read command now supports the -expanded flag to display detailed role and policy information for the token. [GH-12670]auto-reload-config CLI flag or auto_reload_config config option. [GH-12329]Meta is returned with the response to the ConfigEntry.ResolveServiceConfig RPC. [GH-12529]tls stanza [GH-12504]IMPROVEMENTS:
STSRegion field was removed from the auth method config. [GH-12774]autopilot.healthy and autopilot.failure_tolerance metrics are now
regularly emitted by all servers. [GH-12617]consul.raft.boltdb.writeCapacity metric was added and indicates a theoretical number of writes/second that can be performed to Consul. [GH-12646]Partition and RetryJoin to the TestServerConfig struct. [GH-12126]leader label to consul.rpc.server.call and optional target_datacenter, locality,
allow_stale, and blocking optional labels. [GH-12727]DEPRECATIONS:
consul.acl.ResolveTokenToIdentity metric is no longer reported. The values that were previous reported as part of this metric will now be part of the consul.acl.ResolveToken metric. [GH-12166]cert_file, key_file, ca_file, ca_path, tls_min_version, tls_cipher_suites, verify_incoming, verify_incoming_rpc, verify_incoming_https, verify_outgoing and verify_server_hostname at the top-level is now deprecated, use the tls stanza instead [GH-12504]BUG FIXES:
NOTES:
This release is created to share the Consul Enterprise changelog and notify consumers of availability. The attached source and assets do not include Consul Enterprise code and should not be used in place of official Docker images or binaries.
BREAKING CHANGES:
consul acl set-agent-token master has been replaced with consul acl set-agent-token recovery [GH-11669]SECURITY:
acl:write permission in the default namespace. This change fixes CVE-2021-41805.FEATURES:
IMPROVEMENTS:
-cas and -modify-index flags to the consul config delete command to support Check-And-Set (CAS) deletion of config entries [GH-11419]dns_config.recursor_strategy flag to control the order which DNS recursors are queried [GH-10611]virtual endpoint for querying the assigned virtual IP for a service. [GH-11725]agent.tls.cert.expiry metric for tracking when the Agent TLS certificate expires. [GH-10768]mesh.active-root-ca.expiry metric for tracking when the root certificate expires. [GH-9924]DEPRECATIONS:
/v1/agent/token/agent_master is deprecated and will be removed in a future major release - use /v1/agent/token/agent_recovery instead [GH-11669]acl.tokens.master has been renamed to acl.tokens.initial_management, and acl.tokens.agent_master has been renamed to acl.tokens.agent_recovery - the old field names are now deprecated and will be removed in a future major release [GH-11665]tls_cipher_suites will no longer be honored, and tls_prefer_server_cipher_suites is now ignored. [GH-11364]BUG FIXES:
/v1/operator/autopilot/configuration) [GH-10558] [GH-10559]license_path setting in config filesService.Namespace into available variables for dashboard_url_templates [GH-11640]NOTES:
agent_master field to agent_recovery in the acl-tokens.json file in which tokens are persisted on-disk (when acl.enable_token_persistence is enabled) [GH-11744]This release is created to share the Consul Enterprise changelog and notify consumers of availability. The attached source and assets do not include Consul Enterprise code and should not be used in place of official Docker images or binaries.
SECURITY:
IMPROVEMENTS:
BUG FIXES:
This release is created to share the Consul Enterprise changelog and notify consumers of availability. The attached source and assets do not include Consul Enterprise code and should not be used in place of official Docker images or binaries.
SECURITY:
FEATURES:
IMPROVEMENTS:
consul operator utilization [-today-only] [-message] [-y] to generate a bundle with census utilization snapshot. Main flow is implemented in consul-enterprise
http: Added a new API Handler for /v1/operator/utilization. Core functionality to be implemented in consul-enterprise
agent: Always enabled census metrics collection with configurable option to export it to Hashicorp Reporting [GH-22843]reopen() calls with direct property assignment and subclassing to resolve Ember component reopen deprecation warnings [GH-22971]BUG FIXES:
consul operator utilization --help to show only available options without extra parameters. [GH-22912]SECURITY:
golang.org/x/crypto from v0.42.0 to v0.44.0. This resolves GO-2025-4116IMPROVEMENTS:
reopen() calls with direct property assignment and subclassing to resolve Ember component reopen deprecation warnings [GH-22971]BUG FIXES:
SECURITY:
FEATURES:
IMPROVEMENTS:
consul operator utilization [-today-only] [-message] [-y] to generate a bundle with census utilization snapshot. Main flow is implemented in consul-enterprise
http: Added a new API Handler for /v1/operator/utilization. Core functionality to be implemented in consul-enterprise
agent: Always enabled census metrics collection with configurable option to export it to Hashicorp Reporting [GH-22843]snapshot agent now supports authenticating to Azure Blob Storage using Azure Managed Service Identities (MSI). [GH-11171]BUG FIXES:
consul operator utilization --help to show only available options without extra parameters. [GH-22912]SECURITY:
BUG FIXES:
consul operator utilization --help to show only available options without extra parameters. [GH-22912]SECURITY:
FEATURES:
IMPROVEMENTS:
consul operator utilization [-today-only] [-message] [-y] to generate a bundle with census utilization snapshot. Main flow is implemented in consul-enterprise
http: Added a new API Handler for /v1/operator/utilization. Core functionality to be implemented in consul-enterprise
agent: Always enabled census metrics collection with configurable option to export it to Hashicorp Reporting [GH-22843]snapshot agent now supports authenticating to Azure Blob Storage using Azure Managed Service Identities (MSI). [GH-11171]BUG FIXES:
SECURITY:
mitchellh/mapstructure to go-viper/mapstructure to v2 to address CVE-2025-52893. [GH-22581]FEATURES:
max_request_headers_kb to configure maximum header size for requests from downstream to upstream [GH-22604]max_request_headers_kb to configure maximum header size for requests from downstream to upstream in API Gateway config and proxy-defaults [GH-22679]max_request_headers_kb to configure maximum header size for requests from downstream to upstream in Mesh Gateway via service-defaults and proxy-defaults [GH-22722]max_request_headers_kb to configure maximum header size for requests from downstream to upstream in Terminating Gateway service-defaults and proxy-defaults [GH-22680]IMPROVEMENTS:
BUG FIXES: