Merge branch 'main' into openshift-ci

Author: sarahalsmiller

Diff for: .changelog/3874.txt

@@ -0,0 +1,3 @@
+```release-note:sync-catalog
+Add Endpoint health state to registered consul service
+```

Diff for: .changelog/4212.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+sync-catalog: expose prometheus scrape metrics on sync-catalog pods
+```

Diff for: .changelog/4224.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+terminating-gateways: Fix bug where namespace field was not correctly set on ACL policies if using the `Registration` CRD with the service's namespace unset.
+```

Diff for: .changelog/4227.txt

@@ -0,0 +1,4 @@
+```release-note:bug
+openshift: order SecurityContextConstraint volumes alphabetically to match OpenShift behavior.
+This ensures that diff detection tools like ArgoCD consider the source and reconciled resources to be identical.
+```

Diff for: .changelog/4244.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+helm: Kubernetes v1.30 is now supported. Minimum tested version of Kubernetes is now v1.27.
+```

Diff for: .changelog/4247.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+api-gateway: fix nil pointer deref bug when the section name in a gateway policy is not specified
+```

Diff for: .changelog/4255.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+sync-catalog: Enable the user to purge the registered services by passing parent node and necessary filters.
+```

Diff for: .changelog/4256.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+config-entry: add validate_clusters to mesh config entry
+```

Diff for: .changelog/4266.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+sync-catalog: fix infinite retry loop when the catalog fails to connect to consul-server during the sync process
+```

Diff for: .changelog/4277.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+control-plane: add missing `$HOST_IP` environment variable to consul-dataplane sidecar containers
+```

Diff for: .changelog/4287.txt

@@ -0,0 +1,7 @@
+```release-note:enhancement
+docker: update go-discover binary
+```
+
+```release-note:enhancement
+docker: update ubi base image to `ubi9-minimal:9.4`.
+```

Diff for: .changelog/4300.txt

@@ -0,0 +1,3 @@
+```release-note:enhancement
+dns-proxy: add the ability to deploy a DNS proxy within the kubernetes cluster that forwards DNS requests to the consul server and can be configured with an ACL token and make partition aware DNS requests.
+```

Diff for: .changelog/4307.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+connect-inject: remove unnecessary resource permissions from connect-inject ClusterRole
+```

Diff for: .changelog/4313.txt

@@ -0,0 +1,4 @@
+```release-note:security
+Upgrade Go to use 1.22.7. This addresses CVE 
+[CVE-2024-34155](https://nvd.nist.gov/vuln/detail/CVE-2024-34155)
+```

Diff for: .changelog/4315.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+helm: fix issue where the API Gateway GatewayClassConfig tolerations can not be parsed by the Helm chart.
+```

Diff for: .changelog/4316.txt

@@ -0,0 +1,5 @@
+```release-note:bug
+api-gateway: `global.imagePullSecrets` are now configured on the `ServiceAccount` for `Gateways`.
+
+Note: the referenced image pull Secret(s) must be present in the same namespace the `Gateway` is deployed to.
+```

Diff for: .changelog/4333.txt

@@ -0,0 +1,3 @@
+```release-note:improvement
+helm: Exclude gke namespaces from being connect-injected when the connect-inject: default: true value is set.
+```

Diff for: .github/CODEOWNERS

@@ -0,0 +1,3 @@
+# Helm Docs Review
+
+/charts/consul/values.yaml @hashicorp/consul-docs

Diff for: .github/scripts/check_skip_ci.sh

@@ -40,6 +40,7 @@ jobs:
           - check-name: acceptance-cni
           - check-name: acceptance-tproxy
           - check-name: Unit test helm templates
+          - check-name: Unit test helm gen
           - check-name: Unit test enterprise control plane
           - check-name: Unit test control plane
           - check-name: Unit test cli

Diff for: .github/workflows/pr.yml

@@ -12,13 +12,58 @@ jobs:
     runs-on: ubuntu-latest
     name: Check whether to skip build and tests
     outputs:
-      skip-ci: ${{ steps.check-changed-files.outputs.skip-ci }}
-    env:
-      SKIP_CHECK_BRANCH: ${{ github.head_ref || github.ref_name }}
+      skip-ci: ${{ steps.maybe-skip-ci.outputs.skip-ci }}
     steps:
+      # We only allow use of conditional skip in two scenarios:
+      #   1. PRs
+      #   2. Pushes (merges) to protected branches (`main`, `release/**`)
+      #
+      # The second scenario is the only place we can be sure that checking just the
+      # latest change on the branch is sufficient. In PRs, we need to check _all_ commits.
+      # The ability to do this is ultimately determined by the triggers of the calling
+      # workflow, since `base_ref` (the target branch of a PR) is only available in
+      # `pull_request` events, not `push`.
+      - name: Error if conditional check is not allowed
+        if: ${{ !github.base_ref && !github.ref_protected }}
+        run: |
+          echo "Conditional skip requires a PR event with 'base_ref' or 'push' to a protected branch."
+          echo "github.base_ref: ${{ github.base_ref }}"
+          echo "github.ref_protected: ${{ github.ref_protected }}"
+          echo "github.ref_name: ${{ github.ref_name }}"
+          echo "Check the triggers of the calling workflow to ensure that these requirements are met."
+          exit 1
       - uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
         with:
           fetch-depth: 0
-      - name: Check changed files
-        id: check-changed-files
-        run: ./.github/scripts/check_skip_ci.sh
+      - name: Check for skippable file changes
+        id: changed-files
+        uses: tj-actions/changed-files@e9772d140489982e0e3704fea5ee93d536f1e275 # v45.0.1
+        with:
+          # This is a multi-line YAML string with one match pattern per line.
+          # Do not use quotes around values, as it's not supported.
+          # See https://github.com/tj-actions/changed-files/blob/main/README.md#inputs-%EF%B8%8F
+          # for usage, options, and more details on match syntax.
+          files: |
+            .github/workflows/reusable-conditional-skip.yml
+            LICENSE
+            .copywrite.hcl
+            .gitignore
+            **.md
+            assets/**
+            .changelog/**
+      - name: Print changed files
+        env:
+          SKIPPABLE_CHANGED_FILES: ${{ steps.changed-files.outputs.all_changed_files }}
+          NON_SKIPPABLE_FILES: ${{ steps.changed-files.outputs.other_changed_files }}
+        run: |
+          echo "Skippable changed files:"
+          for file in ${SKIPPABLE_CHANGED_FILES}; do echo "  $file"; done
+          echo
+          echo "Non-skippable files:"
+          for file in ${NON_SKIPPABLE_FILES}; do echo "  $file"; done
+      - name: Skip tests and build if only skippable files changed
+        id: maybe-skip-ci
+        if: ${{ steps.changed-files.outputs.only_changed == 'true' }}
+        run: |
+          echo "Skipping tests and build because only skippable files changed"
+          echo "skip-ci=true" >> $GITHUB_OUTPUT

Diff for: .github/workflows/reusable-conditional-skip.yml

@@ -1,3 +1,5 @@
+# This job runs a non-blocking informational security scan on the repository.
+# For release-blocking security scans, see .release/security-scan.hcl.
 name: Security Scan
 
 on:
@@ -9,20 +11,21 @@ on:
     branches:
       - main
       - release/**
+    # paths-ignore only works for non-required checks.
+    # Jobs that are required for merge must use reusable-conditional-skip.yml.
+    paths-ignore:
+      - 'assets/**'
+      - '.changelog/**'
 
 # cancel existing runs of the same workflow on the same ref
 concurrency:
   group: ${{ github.workflow }}-${{ github.head_ref || github.ref }}
   cancel-in-progress: true
 
 jobs:
-  conditional-skip:
-    uses: ./.github/workflows/reusable-conditional-skip.yml
 
   get-go-version:
     # Cascades down to test jobs
-    needs: [ conditional-skip ]
-    if: needs.conditional-skip.outputs.skip-ci != 'true'
     uses: ./.github/workflows/reusable-get-go-version.yml
 
   scan:
@@ -46,7 +49,7 @@ jobs:
         uses: actions/checkout@0ad4b8fadaa221de15dcec353f45205ec38ea70b # v4.1.4
         with:
           repository: hashicorp/security-scanner
-          token: ${{ secrets.HASHIBOT_PRODSEC_GITHUB_TOKEN }}
+          token: ${{ secrets.PRODSEC_SCANNER_READ_ONLY }}
           path: security-scanner
           ref: main
 

Diff for: .github/workflows/security-scan.yml

@@ -0,0 +1,28 @@
+# Dispatch to the consul-k8s-workflows with a weekly cron
+#
+# A separate file is needed for each release because the cron schedules are different for each release.
+name: weekly-acceptance-1-6-x
+on:
+  schedule:
+    # * is a special character in YAML so you have to quote this string
+    # Run weekly on Friday at 3AM UTC/11PM EST/8PM PST
+   - cron:  '0 3 * * 6'
+
+# these should be the only settings that you will ever need to change
+env:
+  BRANCH: "release/1.6.x"
+  CONTEXT: "weekly"
+
+jobs:
+  cloud:
+    name: cloud
+    runs-on: ubuntu-latest
+    steps:
+    - uses: benc-uk/workflow-dispatch@25b02cc069be46d637e8fe2f1e8484008e9e9609 # v1.2.3
+      name: cloud
+      with:
+        workflow: cloud.yml
+        repo: hashicorp/consul-k8s-workflows
+        ref: main
+        token: ${{ secrets.ELEVATED_GITHUB_TOKEN }}
+        inputs: '{ "context":"${{ env.CONTEXT }}", "repository":"${{ github.repository }}", "branch":"${{ env.BRANCH }}", "sha":"${{ github.sha }}", "token":"${{ secrets.ELEVATED_GITHUB_TOKEN }}" }'

Diff for: .github/workflows/weekly-acceptance-1-6-x.yml

@@ -11,3 +11,4 @@ pkg/
 .vscode
 .bob/
 control-plane/cni/cni
+acceptance/tests/consul-dns/coredns-custom.yaml

Diff for: .gitignore

@@ -1 +1 @@
-1.22.5
+1.22.7