Sourced from github.com/hashicorp/consul/api's releases.

v1.15.0

1.15.0 (February 23, 2023)

BREAKING CHANGES:

• acl errors: Delete and get requests now return descriptive errors when the specified resource cannot be found. Other ACL request errors provide more information about when a resource is missing. Add error for when the ACL system has not been bootstrapped.
  • Delete Token/Policy/AuthMethod/Role/BindingRule endpoints now return 404 when the resource cannot be found.
    • New error formats: "Requested * does not exist: ACL not found", "* not found in namespace $NAMESPACE: ACL not found"
  • Read Token/Policy/Role endpoints now return 404 when the resource cannot be found.
    • New error format: "Cannot find * to delete"
  • Logout now returns a 401 error when the supplied token cannot be found
    • New error format: "Supplied token does not exist"
  • Token Self endpoint now returns 404 when the token cannot be found.
    • New error format: "Supplied token does not exist" [GH-16105]
• acl: remove all acl migration functionality and references to the legacy acl system. [GH-15947]
• acl: remove all functionality and references for legacy acl policies. [GH-15922]
• config: Deprecate -join, -join-wan, start_join, and start_join_wan. These options are now aliases of -retry-join, -retry-join-wan, retry_join, and retry_join_wan, respectively. [GH-15598]
• connect: Add peer field to service-defaults upstream overrides. The addition of this field makes it possible to apply upstream overrides only to peer services. Prior to this change, overrides would be applied based on matching the namespace and name fields only, which means users could not have different configuration for local versus peer services. With this change, peer upstreams are only affected if the peer field matches the destination peer name. [GH-15956]
• connect: Consul will now error and exit when using the consul connect envoy command if the Envoy version is incompatible. To ignore this check use flag --ignore-envoy-compatibility [GH-15818]
• extensions: Refactor Lambda integration to get configured with the Envoy extensions field on service-defaults configuration entries. [GH-15817]
• ingress-gateway: upstream cluster will have empty outlier_detection if passive health check is unspecified [GH-15614]
• xds: Remove the connect.enable_serverless_plugin agent configuration option. Now Lambda integration is enabled by default. [GH-15710]

SECURITY:

• Upgrade to use Go 1.20.1. This resolves vulnerabilities CVE-2022-41724 in crypto/tls and CVE-2022-41723 in net/http. [GH-16263]

FEATURES:

• API Gateway (Beta) This version adds support for API gateway on VMs. API gateway provides a highly-configurable ingress for requests coming into a Consul network. For more information, refer to the API gateway documentation. [GH-16369]
• acl: Add new acl.tokens.config_file_registration config field which specifies the token used to register services and checks that are defined in config files. [GH-15828]
• acl: anonymous token is logged as 'anonymous token' instead of its accessor ID [GH-15884]
• cli: adds new CLI commands consul troubleshoot upstreams and consul troubleshoot proxy to troubleshoot Consul's service mesh configuration and network issues. [GH-16284]
• command: Adds the operator usage instances subcommand for displaying total services, connect service instances and billable service instances in the local datacenter or globally. [GH-16205]
• config-entry(ingress-gateway): support outlier detection (passive health check) for upstream cluster [GH-15614]
• connect: adds support for Envoy access logging. Access logging can be enabled using the proxy-defaults config entry. [GH-15864]
• xds: Add a built-in Envoy extension that inserts Lua HTTP filters. [GH-15906]
• xds: Insert originator service identity into Envoy's dynamic metadata under the consul namespace. [GH-15906]

IMPROVEMENTS:

• connect: for early awareness of Envoy incompatibilities, when using the consul connect envoy command the Envoy version will now be checked for compatibility. If incompatible Consul will error and exit. [GH-15818]
• grpc: client agents will switch server on error, and automatically retry on RESOURCE_EXHAUSTED responses [GH-15892]
• raft: add an operator api endpoint and a command to initiate raft leadership transfer. [GH-14132]
• acl: Added option to allow for an operator-generated bootstrap token to be passed to the acl bootstrap command. [GH-14437]
• agent: Give better error when client specifies wrong datacenter when auto-encrypt is enabled. [GH-14832]

... (truncated)

Sourced from github.com/hashicorp/consul/api's changelog.

1.15.0 (February 23, 2023)

BREAKING CHANGES:

• acl errors: Delete and get requests now return descriptive errors when the specified resource cannot be found. Other ACL request errors provide more information about when a resource is missing. Add error for when the ACL system has not been bootstrapped.
  • Delete Token/Policy/AuthMethod/Role/BindingRule endpoints now return 404 when the resource cannot be found.
    • New error formats: "Requested * does not exist: ACL not found", "* not found in namespace $NAMESPACE: ACL not found"
  • Read Token/Policy/Role endpoints now return 404 when the resource cannot be found.
    • New error format: "Cannot find * to delete"
  • Logout now returns a 401 error when the supplied token cannot be found
    • New error format: "Supplied token does not exist"
  • Token Self endpoint now returns 404 when the token cannot be found.
    • New error format: "Supplied token does not exist" [GH-16105]
• acl: remove all acl migration functionality and references to the legacy acl system. [GH-15947]
• acl: remove all functionality and references for legacy acl policies. [GH-15922]
• config: Deprecate -join, -join-wan, start_join, and start_join_wan. These options are now aliases of -retry-join, -retry-join-wan, retry_join, and retry_join_wan, respectively. [GH-15598]
• connect: Add peer field to service-defaults upstream overrides. The addition of this field makes it possible to apply upstream overrides only to peer services. Prior to this change, overrides would be applied based on matching the namespace and name fields only, which means users could not have different configuration for local versus peer services. With this change, peer upstreams are only affected if the peer field matches the destination peer name. [GH-15956]
• connect: Consul will now error and exit when using the consul connect envoy command if the Envoy version is incompatible. To ignore this check use flag --ignore-envoy-compatibility [GH-15818]
• extensions: Refactor Lambda integration to get configured with the Envoy extensions field on service-defaults configuration entries. [GH-15817]
• ingress-gateway: upstream cluster will have empty outlier_detection if passive health check is unspecified [GH-15614]
• xds: Remove the connect.enable_serverless_plugin agent configuration option. Now Lambda integration is enabled by default. [GH-15710]

SECURITY:

• Upgrade to use Go 1.20.1. This resolves vulnerabilities CVE-2022-41724 in crypto/tls and CVE-2022-41723 in net/http. [GH-16263]

FEATURES:

• API Gateway (Beta) This version adds support for API gateway on VMs. API gateway provides a highly-configurable ingress for requests coming into a Consul network. For more information, refer to the API gateway documentation. [GH-16369]
• acl: Add new acl.tokens.config_file_registration config field which specifies the token used to register services and checks that are defined in config files. [GH-15828]
• acl: anonymous token is logged as 'anonymous token' instead of its accessor ID [GH-15884]
• cli: adds new CLI commands consul troubleshoot upstreams and consul troubleshoot proxy to troubleshoot Consul's service mesh configuration and network issues. [GH-16284]
• command: Adds the operator usage instances subcommand for displaying total services, connect service instances and billable service instances in the local datacenter or globally. [GH-16205]
• config-entry(ingress-gateway): support outlier detection (passive health check) for upstream cluster [GH-15614]
• connect: adds support for Envoy access logging. Access logging can be enabled using the proxy-defaults config entry. [GH-15864]
• xds: Add a built-in Envoy extension that inserts Lua HTTP filters. [GH-15906]
• xds: Insert originator service identity into Envoy's dynamic metadata under the consul namespace. [GH-15906]

IMPROVEMENTS:

• connect: for early awareness of Envoy incompatibilities, when using the consul connect envoy command the Envoy version will now be checked for compatibility. If incompatible Consul will error and exit. [GH-15818]
• grpc: client agents will switch server on error, and automatically retry on RESOURCE_EXHAUSTED responses [GH-15892]
• raft: add an operator api endpoint and a command to initiate raft leadership transfer. [GH-14132]
• acl: Added option to allow for an operator-generated bootstrap token to be passed to the acl bootstrap command. [GH-14437]
• agent: Give better error when client specifies wrong datacenter when auto-encrypt is enabled. [GH-14832]
• api: updated the go module directive to 1.18. [GH-15297]

... (truncated)

• fd6998e revert go mod changes
• e18b5e2 fix api incompatibility
• f6bceb1 update root go mod and go tidy
• cc57dbd update changelog and version
• 1abd87a bump api and envoyextension in troubleshoot module
• e9426da bump api version in envoyextension submodule
• 1cacf08 bump sdk version
• 983a1b8 backport of commit 1180908144b4afd26c3546d2ab43d34e135a029c (#16389)
• a618065 Backport of Add docs for usage endpoint and command into release/1.15.x (#16382)
• 2fb0a2f Backport of Add docs for usage endpoint and command into release/1.15.x (#16383)
• Additional commits viewable in compare view

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)