Bump github.com/hashicorp/consul/api from 1.15.2 to 1.21.0

[dependabot]

Bumps github.com/hashicorp/consul/api from 1.15.2 to 1.21.0.

Release notes

Sourced from github.com/hashicorp/consul/api's releases.

v1.16.0-rc1

1.16.0-rc1 (June 12, 2023)

BREAKING CHANGES:

• api: The /v1/health/connect/ and /v1/health/ingress/ endpoints now immediately return 403 "Permission Denied" errors whenever a token with insufficient service:read permissions is provided. Prior to this change, the endpoints returned a success code with an empty result list when a token with insufficient permissions was provided. [GH-17424]
• peering: Removed deprecated backward-compatibility behavior. Upstream overrides in service-defaults will now only apply to peer upstreams when the peer field is provided. Visit the 1.16.x upgrade instructions for more information. [GH-16957]

SECURITY:

• audit-logging: (Enterprise only) limit v1/operator/audit-hash endpoint to ACL token with operator:read privileges.

FEATURES:

• api: (Enterprise only) Add POST /v1/operator/audit-hash endpoint to calculate the hash of the data used by the audit log hash function and salt.
• cli: (Enterprise only) Add a new consul operator audit hash command to retrieve and compare the hash of the data used by the audit log hash function and salt.
• cli: Adds new command - consul services export - for exporting a service to a peer or partition [GH-15654]
• connect: (Consul Enterprise only) Implement order-by-locality failover.
• mesh: Add new permissive mTLS mode that allows sidecar proxies to forward incoming traffic unmodified to the application. This adds AllowEnablingPermissiveMutualTLS setting to the mesh config entry and the MutualTLSMode setting to proxy-defaults and service-defaults. [GH-17035]
• mesh: Support configuring JWT authentication in Envoy. [GH-17452]
• server: (Enterprise Only) added server side RPC requests IP based read/write rate-limiter. [GH-4633]
• server: (Enterprise Only) allow automatic license utilization reporting. [GH-5102]
• server: added server side RPC requests global read/write rate-limiter. [GH-16292]
• xds: Add property-override built-in Envoy extension that directly patches Envoy resources. [GH-17487]
• xds: Add a built-in Envoy extension that inserts External Authorization (ext_authz) network and HTTP filters. [GH-17495]
• xds: Add a built-in Envoy extension that inserts Wasm HTTP filters. [GH-16877]
• xds: Add a built-in Envoy extension that inserts Wasm network filters. [GH-17505]

IMPROVEMENTS:

• api: Support filtering for config entries. [GH-17183]
• cli: Add -filter option to consul config list for filtering config entries. [GH-17183]
• api: Enable setting query options on agent force-leave endpoint. [GH-15987]
• audit-logging: (Enterprise only) enable error response and request body logging [GH-5669]
• audit-logging: (Enterprise only) enable error response and request body logging
• ca: automatically set up Vault's auto-tidy setting for tidy_expired_issuers when using Vault as a CA provider. [GH-17138]
• ca: support Vault agent auto-auth config for Vault CA provider using AliCloud authentication. [GH-16224]
• ca: support Vault agent auto-auth config for Vault CA provider using AppRole authentication. [GH-16259]
• ca: support Vault agent auto-auth config for Vault CA provider using Azure MSI authentication. [GH-16298]
• ca: support Vault agent auto-auth config for Vault CA provider using JWT authentication. [GH-16266]
• ca: support Vault agent auto-auth config for Vault CA provider using Kubernetes authentication. [GH-16262]
• command: Adds ACL enabled to status output on agent startup. [GH-17086]
• command: Allow creating ACL Token TTL with greater than 24 hours with the -expires-ttl flag. [GH-17066]
• connect: (Enterprise Only) Add support for specifying "Partition" and "Namespace" in Prepared Queries failover rules.
• connect: update supported envoy versions to 1.23.10, 1.24.8, 1.25.7, 1.26.2 [GH-17546]
• connect: update supported envoy versions to 1.23.8, 1.24.6, 1.25.4, 1.26.0 [GH-5200]
• fix metric names in /docs/agent/telemetry [GH-17577]
• gateway: Change status condition reason for invalid certificate on a listener from "Accepted" to "ResolvedRefs". [GH-17115]

... (truncated)

Changelog

Sourced from github.com/hashicorp/consul/api's changelog.

1.16.0-rc1 (June 12, 2023)

BREAKING CHANGES:

• api: The /v1/health/connect/ and /v1/health/ingress/ endpoints now immediately return 403 "Permission Denied" errors whenever a token with insufficient service:read permissions is provided. Prior to this change, the endpoints returned a success code with an empty result list when a token with insufficient permissions was provided. [GH-17424]
• peering: Removed deprecated backward-compatibility behavior. Upstream overrides in service-defaults will now only apply to peer upstreams when the peer field is provided. Visit the 1.16.x upgrade instructions for more information. [GH-16957]

SECURITY:

• audit-logging: (Enterprise only) limit v1/operator/audit-hash endpoint to ACL token with operator:read privileges.

FEATURES:

• api: (Enterprise only) Add POST /v1/operator/audit-hash endpoint to calculate the hash of the data used by the audit log hash function and salt.
• cli: (Enterprise only) Add a new consul operator audit hash command to retrieve and compare the hash of the data used by the audit log hash function and salt.
• cli: Adds new command - consul services export - for exporting a service to a peer or partition [GH-15654]
• connect: (Consul Enterprise only) Implement order-by-locality failover.
• mesh: Add new permissive mTLS mode that allows sidecar proxies to forward incoming traffic unmodified to the application. This adds AllowEnablingPermissiveMutualTLS setting to the mesh config entry and the MutualTLSMode setting to proxy-defaults and service-defaults. [GH-17035]
• mesh: Support configuring JWT authentication in Envoy. [GH-17452]
• server: (Enterprise Only) added server side RPC requests IP based read/write rate-limiter. [GH-4633]
• server: (Enterprise Only) allow automatic license utilization reporting. [GH-5102]
• server: added server side RPC requests global read/write rate-limiter. [GH-16292]
• xds: Add property-override built-in Envoy extension that directly patches Envoy resources. [GH-17487]
• xds: Add a built-in Envoy extension that inserts External Authorization (ext_authz) network and HTTP filters. [GH-17495]
• xds: Add a built-in Envoy extension that inserts Wasm HTTP filters. [GH-16877]
• xds: Add a built-in Envoy extension that inserts Wasm network filters. [GH-17505]

IMPROVEMENTS:

• • api: Support filtering for config entries. [GH-17183]
• • cli: Add -filter option to consul config list for filtering config entries. [GH-17183]
• api: Enable setting query options on agent force-leave endpoint. [GH-15987]
• audit-logging: (Enterprise only) enable error response and request body logging [GH-5669]
• audit-logging: (Enterprise only) enable error response and request body logging
• ca: automatically set up Vault's auto-tidy setting for tidy_expired_issuers when using Vault as a CA provider. [GH-17138]
• ca: support Vault agent auto-auth config for Vault CA provider using AliCloud authentication. [GH-16224]
• ca: support Vault agent auto-auth config for Vault CA provider using AppRole authentication. [GH-16259]
• ca: support Vault agent auto-auth config for Vault CA provider using Azure MSI authentication. [GH-16298]
• ca: support Vault agent auto-auth config for Vault CA provider using JWT authentication. [GH-16266]
• ca: support Vault agent auto-auth config for Vault CA provider using Kubernetes authentication. [GH-16262]
• command: Adds ACL enabled to status output on agent startup. [GH-17086]
• command: Allow creating ACL Token TTL with greater than 24 hours with the -expires-ttl flag. [GH-17066]
• connect: (Enterprise Only) Add support for specifying "Partition" and "Namespace" in Prepared Queries failover rules.
• connect: update supported envoy versions to 1.23.10, 1.24.8, 1.25.7, 1.26.2 [GH-17546]
• connect: update supported envoy versions to 1.23.8, 1.24.6, 1.25.4, 1.26.0 [GH-5200]
• fix metric names in /docs/agent/telemetry [GH-17577]
• gateway: Change status condition reason for invalid certificate on a listener from "Accepted" to "ResolvedRefs". [GH-17115]
• http: accept query parameters datacenter, ap (enterprise-only), and namespace (enterprise-only). Both short-hand and long-hand forms of these query params are now supported via the HTTP API (dc/datacenter, ap/partition, ns/namespace). [GH-17525]

... (truncated)

Commits

• f3b1433 backport of commit cd05b8b921d967f3dde0331cc7d70dc0a3804a4b (#17543)
• aca09d2 Manual backport 1.15.x of Avoid panic applying TProxy Envoy extensions (#17539)
• 7d94518 Backport of [API Gateway] Fix use of virtual resolvers in HTTPRoutes into rel...
• f9d3f8a Backport of hoststats: add package for collecting host statistics including c...
• d991db5 backport of commit 65d5aeaaac207e134a6ab2f0742e8d5a34c90154 (#17531)
• fe5a963 backport of commit 94998bec4bad67d29efb2cbcd95ac9c827908d23 (#17518)
• 1330cc0 backport of commit 87e1f041781a18b55b0841febd53db7c8cc7257f (#17516)
• c0ee120 backport of commit 2d9ed7c43e0b1e33c56a39fb1d6ba66751cab66f (#17510)
• 4bd3ed9 HCP Telemetry Feature (#17460) (#17502)
• d60e96f Backport of perf: Remove expensive reflection from raft/mesh hot path into re...
• Additional commits viewable in compare view

Dependabot will resolve any conflicts with this PR as long as you don't alter it yourself. You can also trigger a rebase manually by commenting @dependabot rebase.

---

Dependabot commands and options

You can trigger Dependabot actions by commenting on this PR:

• @dependabot rebase will rebase this PR
• @dependabot recreate will recreate this PR, overwriting any edits that have been made to it
• @dependabot merge will merge this PR after your CI passes on it
• @dependabot squash and merge will squash and merge this PR after your CI passes on it
• @dependabot cancel merge will cancel a previously requested merge and block automerging
• @dependabot reopen will reopen this PR if it is closed
• @dependabot close will close this PR and stop Dependabot recreating it. You can achieve the same result by closing it manually
• @dependabot ignore this major version will close this PR and stop Dependabot creating any more for this major version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this minor version will close this PR and stop Dependabot creating any more for this minor version (unless you reopen the PR or upgrade to it yourself)
• @dependabot ignore this dependency will close this PR and stop Dependabot creating any more for this dependency (unless you reopen the PR or upgrade to it yourself)

[dependabot]

Superseded by #316.