Skip to content

v2.1.0

Latest
Latest

Choose a tag to compare

View all tags
@hc-github-team-es-release-engineering hc-github-team-es-release-engineering released this 22 Oct 15:41
v2.1.0
8cccd9f
This commit was created on GitHub.com and signed with GitHub’s verified signature.
GPG key ID: B5690EEEBB952194
Verified
Learn about vigilant mode.

2.1.0 (October 20, 2026)

SECURITY:

  • Pin docker/login-action to a commit hash to fix high-severity code-scanning alerts for missing pinned commit hashes in GitHub Actions workflows. [GH-1272]
  • Update the go-discover build stage to v1.5.0, removing the github.com/Azure/go-autorest/autorest/adal dependency (weak/legacy cryptographic algorithms) in favor of modern Azure SDK credential libraries. [GH-1306]
  • Upgrade golang.org/x/net to v0.60.0 to address security vulnerabilities. [GH-1322]
  • Upgrade go version to 1.26.10 to address security vulnerability GO-2026-6809 in crypto/x509. [GH-1353]
  • Update application and container dependencies, including patched Debian Bookworm OpenSSL libraries in the container image. [GH-1314]

FEATURES:

  • dns-proxy: Triage DNS queries before forwarding so virtual Consul DNS queries can be resolved by Envoy when possible. Forward .virtual.*.consul queries to Envoy's inline DNS listener and external domains to Envoy's egress DNS listener, falling back to Consul when Envoy cannot answer or is unavailable. Adds listener health backoff handling to avoid repeatedly forwarding to unhealthy Envoy listeners. [GH-1177]
  • oauth: Add an optional local credential broker (-credential-broker-bind-addr, -credential-broker-refresh-fraction) that fetches DEKs via WorkloadKeyService.FetchKey and serves GetKey on a pod-local UDS so consul-obo-outbound is not an SDS client. Unix peer credentials (SO_PEERCRED / LOCAL_PEERCRED) must match the dataplane UID. The bind address must be a unix socket; listen failures abort dataplane startup. [GH-1294]
  • telemetry: -telemetry-prom-service-metrics-url may now be passed multiple times, allowing metrics from more than one service port to be scraped and merged. The DP_TELEMETRY_PROM_SERVICE_METRICS_URL environment variable continues to work and may be supplemented with DP_TELEMETRY_PROM_SERVICE_METRICS_URL{1,9}. [GH-1295]

IMPROVEMENTS:

  • Update Envoy version to 1.39.1 [GH-1305]
  • Updated integration test with nftables from iptables. [GH-1218]
  • ci: Increased the stale PR automation windows to 90 days before marking a pull request stale and 60 days before closing it. [GH-1197]
  • Update github.com/hashicorp/consul/proto-public to v0.9.0. [GH-1345]

BUG FIXES:

  • dns-proxy: Fill unspecified namespace, partition and datacenter tokens of virtual FQDNs from the source proxy's own defaults, as the Consul server does, instead of from the upstream identities advertised through CDS. Remove the upstream index and the CDS cluster tap that supported it. [GH-1328]
  • dns-proxy: Do not strip the .service label from <svc>.service.virtual.consul queries, since the Consul server does not accept it; such names are now forwarded to Consul. Fall back to Consul when Envoy's DNS listener returns a non-success response such as NXDOMAIN, without backing off the listener. [GH-1328] [GH-1333]
  • Disable Envoy's shared c-ares DNS resolver (envoy.restart_features.shared_cares_dns_resolver) in the bootstrap configuration to prevent Envoy crashes in the egress_dns listener under concurrent external DNS lookups when localized-dns is enabled with server recursors. [GH-1343]
Assets 2
Loading