build(deps): bump github.com/hashicorp/consul/api from 1.3.0 to 1.9.1

[dependabot]

Bumps github.com/hashicorp/consul/api from 1.3.0 to 1.9.1.

Release notes

Sourced from github.com/hashicorp/consul/api's releases.

v1.9.1

1.9.1 (December 11, 2020)

FEATURES:

• ui: add copyable IDs to the Role and Policy views [GH-9296]

IMPROVEMENTS:

• cli: (Enterprise only) A new -read-replica flag can now be used to enable running a server as a read only replica. Previously this was enabled with the now deprecated -non-voting-server flag. [GH-9191]
• config: (Enterprise only) A new read_replica configuration setting can now be used to enable running a server as a read only replica. Previously this was enabled with the now deprecated non_voting_server setting. [GH-9191]

DEPRECATIONS:

• cli: (Enterprise only) The -non-voting-server flag is deprecated in favor of the new -read-replica flag. The -non-voting-server flag is still present along side the new flag but it will be removed in a future release. [GH-9191]
• config: (Enterprise only) The non_voting_server configuration setting is deprecated in favor of the new read_replica setting. The non_voting_server configuration setting is still present but will be removed in a future release. [GH-9191]
• gossip: (Enterprise only) Read replicas now advertise themselves by setting the read_replica tag. The old nonvoter tag is still present but is deprecated and will be removed in a future release. [GH-9191]
• server: (Enterprise only) Addition of the nonvoter tag to the service registration made for read replicas is deprecated in favor of the new tag name of read_replica. Both are present in the registration but the nonvoter tag will be completely removed in a future release. [GH-9191]

BUG FIXES:

• agent: prevent duplicate services and check registrations from being synced to servers. [GH-9284]
• connect: fixes a case when updating the CA config in a secondary datacenter to correctly trigger the creation of a new intermediate certificate [GH-9009]
• connect: only unset the active root in a secondary datacenter when a new one is replacing it [GH-9318]
• namespaces: (Enterprise only) Prevent stalling of replication in secondary datacenters due to conflicts between the namespace replicator and other replicators. [GH-9271]
• streaming: ensure the order of results provided by /health/service/:serviceName is consistent with and without streaming enabled [GH-9247]

v1.9.0

1.9.0 (November 24, 2020)

BREAKING CHANGES:

• agent: The enable_central_service_config option now defaults to true. [GH-8746]
• connect: Switch the default gateway port from 443 to 8443 to avoid assumption of Envoy running as root. [GH-9113]
• connect: Update Envoy metrics names and labels for proxy listeners so that attributes like datacenter and namespace can be extracted. [GH-9207]
• connect: intention destinations can no longer be reassigned [GH-8834]
• raft: Raft protocol v2 is no longer supported. If currently using protocol v2 then an intermediate upgrade to a version supporting both v2 and v3 protocols will be necessary (1.0.0 - 1.8.x). Note that the Raft protocol configured with the raft_protocol setting and the Consul RPC protocol configured with the protocol setting and output by the consul version command are distinct and supported Consul RPC protocol versions are not altered. [GH-9103]
• sentinel: (Consul Enterprise only) update to v0.16.0, which replaces whitelist and blacklist with allowlist and denylist
• server: (Enterprise only) Pre-existing intentions defined with non-existent destination namespaces were non-functional and are erased during the upgrade process. This should not matter as these intentions had nothing to enforce. [GH-9186]
• server: (OSS only) Pre-existing intentions defined with either a source or destination namespace value that is not "default" are rewritten or deleted during the upgrade process. Wildcards first attempt to downgrade to "default" unless an intention already exists, otherwise these non-functional intentions are deleted. [GH-9186]
• xds: Drop support for Envoy versions 1.12.0, 1.12.1, 1.12.2, and 1.13.0, due to a lack of support for url_path in RBAC. [GH-8839]

SECURITY:

... (truncated)

Changelog

Sourced from github.com/hashicorp/consul/api's changelog.

1.9.1 (December 11, 2020)

FEATURES:

• ui: add copyable IDs to the Role and Policy views [GH-9296]

IMPROVEMENTS:

• cli: (Enterprise only) A new -read-replica flag can now be used to enable running a server as a read only replica. Previously this was enabled with the now deprecated -non-voting-server flag. [GH-9191]
• config: (Enterprise only) A new read_replica configuration setting can now be used to enable running a server as a read only replica. Previously this was enabled with the now deprecated non_voting_server setting. [GH-9191]

DEPRECATIONS:

• cli: (Enterprise only) The -non-voting-server flag is deprecated in favor of the new -read-replica flag. The -non-voting-server flag is still present along side the new flag but it will be removed in a future release. [GH-9191]
• config: (Enterprise only) The non_voting_server configuration setting is deprecated in favor of the new read_replica setting. The non_voting_server configuration setting is still present but will be removed in a future release. [GH-9191]
• gossip: (Enterprise only) Read replicas now advertise themselves by setting the read_replica tag. The old nonvoter tag is still present but is deprecated and will be removed in a future release. [GH-9191]
• server: (Enterprise only) Addition of the nonvoter tag to the service registration made for read replicas is deprecated in favor of the new tag name of read_replica. Both are present in the registration but the nonvoter tag will be completely removed in a future release. [GH-9191]

BUG FIXES:

• agent: prevent duplicate services and check registrations from being synced to servers. [GH-9284]
• connect: fixes a case when updating the CA config in a secondary datacenter to correctly trigger the creation of a new intermediate certificate [GH-9009]
• connect: only unset the active root in a secondary datacenter when a new one is replacing it [GH-9318]
• namespaces: (Enterprise only) Prevent stalling of replication in secondary datacenters due to conflicts between the namespace replicator and other replicators. [GH-9271]
• streaming: ensure the order of results provided by /health/service/:serviceName is consistent with and without streaming enabled [GH-9247]

1.9.0 (November 24, 2020)

BREAKING CHANGES:

• agent: The enable_central_service_config option now defaults to true. [GH-8746]
• connect: Switch the default gateway port from 443 to 8443 to avoid assumption of Envoy running as root. [GH-9113]
• connect: Update Envoy metrics names and labels for proxy listeners so that attributes like datacenter and namespace can be extracted. [GH-9207]
• connect: intention destinations can no longer be reassigned [GH-8834]
• raft: Raft protocol v2 is no longer supported. If currently using protocol v2 then an intermediate upgrade to a version supporting both v2 and v3 protocols will be necessary (1.0.0 - 1.8.x). Note that the Raft protocol configured with the raft_protocol setting and the Consul RPC protocol configured with the protocol setting and output by the consul version command are distinct and supported Consul RPC protocol versions are not altered. [GH-9103]
• sentinel: (Consul Enterprise only) update to v0.16.0, which replaces whitelist and blacklist with allowlist and denylist
• server: (Enterprise only) Pre-existing intentions defined with non-existent destination namespaces were non-functional and are erased during the upgrade process. This should not matter as these intentions had nothing to enforce. [GH-9186]
• server: (OSS only) Pre-existing intentions defined with either a source or destination namespace value that is not "default" are rewritten or deleted during the upgrade process. Wildcards first attempt to downgrade to "default" unless an intention already exists, otherwise these non-functional intentions are deleted. [GH-9186]
• xds: Drop support for Envoy versions 1.12.0, 1.12.1, 1.12.2, and 1.13.0, due to a lack of support for url_path in RBAC. [GH-8839]

SECURITY:

• Fix Consul Enterprise Namespace Config Entry Replication DoS. Previously an operator with service:write ACL permissions in a Consul Enterprise cluster could write a malicious config entry that caused infinite raft writes due to issues with the namespace replication logic. [CVE-2020-25201] [GH-9024]

... (truncated)

Commits

• ca5c389 Release v1.9.1
• 8b9b803 update bindata_assetfs.go
• 2de4374 deps: consul/api v1.8.1
• 334a29e changelog: add unreleased entries for v1.9.1
• a042b74 Filter API Docs (#9202)
• aa03e99 acl: global tokens created by auth methods now correctly replicate to seconda...
• 5511e6b [Website] Update alert banner (#9361)
• 49741f0 ui: Use pill/badge components for intention filter options (#9357)
• e1d133a ui: Remove old style 'filterable' searching (#9356)
• 8d27915 ui: Update UI README (#9346)
• Additional commits viewable in compare view

You can trigger a rebase of this PR by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[tklauser]

@dependabot rebase

[tklauser]

test-me-please

Job 'Cilium-PR-K8s-1.20-kernel-4.19' failed and has not been observed before, so may be related to your PR:

Click to show.

Test Name

K8sDatapathConfig Host firewall With VXLAN and endpoint routes

Failure Output

FAIL: Failed to reach 192.168.36.11:80 from testclient-67s8s

If it is a flake, comment /mlh new-flake Cilium-PR-K8s-1.20-kernel-4.19 so I can create a new GitHub issue to track it.

[aanm]

@dependabot rebase

[aanm]

test-me-please