This release introduces the first optional add-on `tracing`, added th…

…rough the

new add-on model!

The existing optional `tracing` components Jaeger and OpenCensus can now be
installed as add-on components.

There will be more information to come about the new add-on model, but please
refer to the details of [linkerd#3955](linkerd#3955) for how to get started.

* CLI
  * Added the `linkerd diagnostics` command to get metrics only from the
    control plane, excluding metrics from the data plane proxies (thanks
    @srv-twry!)
  * Added the `linkerd install --prometheus-image` option for installing a
    custom Prometheus image (thanks @christyjacob4!)
  * Fixed an issue with `linkerd upgrade` where changes to the `Namespace`
    object were ignored (thanks @supra08!)
* Controller
  * Added the `tracing` add-on which installs Jaeger and OpenCensus as add-on
    components (thanks @Pothulapati!!)
* Proxy
  * Increased the inbound router's default capacity from 100 to 10k to
    accommodate environments that have a high cardinality of virtual hosts
    served by a single pod
* Web UI
  * Fixed styling in the CallToAction banner (thanks @aliariff!)

Update gcloud configs for the chart_deploy job - Part 2 (linkerd#4087)

stable-2.7.0 (linkerd#4019)

## stable-2.7.0

This release adds support for integrating Linkerd's PKI with an external
certificate issuer such as [`cert-manager`] as well as streamlining the
certificate rotation process in general. For more details about cert-manager
and certificate rotation, see the
[docs](https://linkerd.io/2/tasks/use_external_certs/). This release also
includes performance improvements to the dashboard, reduced memory usage of the
proxy, various improvements to the Helm chart, and much much more.

To install this release, run: `curl https://run.linkerd.io/install | sh`

**Upgrade notes**: This release includes breaking changes to our Helm charts.
Please see the [upgrade instructions](https://linkerd.io/2/tasks/upgrade/#upgrade-notice-stable-270).

**Special thanks to**: @alenkacz, @bmcstdio, @daxmc99, @droidnoob, @ereslibre,
@javaducky, @joakimr-axis, @JohannesEH, @KIVagant, @mayankshah1607,
@Pothulapati, and @StupidScience!

**Full release notes**:

* CLI
  * Updated the mTLS trust anchor checks to eliminate false positives caused by
    extra trailing spaces
  * Reduced the severity level of the Linkerd version checks, so that they
    don't fail when the external version endpoint is unreachable
    (thanks @mayankshah1607!)
  * Added a new `tap` APIService check to aid with uncovering Kubernetes API
    aggregatation layer issues (thanks @droidnoob!)
  * Introduced CNI checks to confirm the CNI plugin is installed and ready;
    this is done through `linkerd check --pre --linkerd-cni-enabled` before
    installation and `linkerd check` after installation if the CNI plugin is
    present
  * Added support for the `--as-group` flag so that users can impersonate
    groups for Kubernetes operations (thanks @mayankshah1607!)
  * Added HA specific checks to `linkerd check` to ensure that the `kube-system`
    namespace has the `config.linkerd.io/admission-webhooks:disabled`
    label set
  * Fixed a problem causing the presence of unnecessary empty fields in
    generated resource definitions (thanks @mayankshah1607)
  * Added the ability to pass both port numbers and port ranges to
    `--skip-inbound-ports` and `--skip-outbound-ports` (thanks to @javaducky!)
  * Increased the comprehensiveness of `linkerd check --pre`
  * Added TLS certificate validation to `check` and `upgrade` commands
  * Added support for injecting CronJobs and ReplicaSets, as well as the ability
    to use them as targets in the CLI subcommands
  * Introduced the new flags `--identity-issuer-certificate-file`,
    `--identity-issuer-key-file` and `identity-trust-anchors-file` to `linkerd
    upgrade` to support trust anchor and issuer certificate rotation
  * Added a check that ensures using `--namespace` and `--all-namespaces`
    results in an error as they are mutually exclusive
  * Added a `Dashboard.Replicas` parameter to the Linkerd Helm chart to allow
    configuring the number of dashboard replicas (thanks @KIVagant!)
  * Removed redundant service profile check (thanks @alenkacz!)
  * Updated `uninject` command to work with namespace resources
    (thanks @mayankshah1607!)
  * Added a new `--identity-external-issuer` flag to `linkerd install` that
    configures Linkerd to use certificates issued by an external certificate
    issuer (such as `cert-manager`)
  * Added support for injecting a namespace to `linkerd inject` (thanks
    @mayankshah1607!)
  * Added checks to `linkerd check --preinstall` ensuring Kubernetes Secrets
    can be created and accessed
  * Fixed `linkerd tap` sometimes displaying incorrect pod names for unmeshed
    IPs that match multiple running pods
  * Made `linkerd install --ignore-cluster` and `--skip-checks` faster
  * Fixed a bug causing `linkerd upgrade` to fail when used with
  `--from-manifest`
  * Made `--cluster-domain` an install-only flag (thanks @bmcstdio!)
  * Updated `check` to ensure that proxy trust anchors match configuration
       (thanks @ereslibre!)
  * Added condition to the `linkerd stat` command that requires a window size
    of at least 15 seconds to work properly with Prometheus
* Controller
  * Fixed an issue where an override of the Docker registry was not being
    applied to debug containers (thanks @javaducky!)
  * Added check for the Subject Alternate Name attributes to the API server
    when access restrictions have been enabled (thanks @javaducky!)
  * Added support for arbitrary pod labels so that users can leverage the
    Linkerd provided Prometheus instance to scrape for their own labels
    (thanks @daxmc99!)
  * Fixed an issue with CNI config parsing
  * Fixed a race condition in the `linkerd-web` service
  * Updated Prometheus to 2.15.2 (thanks @Pothulapati)
  * Increased minimum kubernetes version to 1.13.0
  * Added support for pod ip and service cluster ip lookups in the destination 
    service
  * Added recommended kubernetes labels to control-plane
  * Added the `--wait-before-exit-seconds` flag to linkerd inject for the proxy 
    sidecar to delay the start of its shutdown process (a huge commit from 
    @KIVagant, thanks!)
  * Added a pre-sign check to the identity service 
  * Fixed inject failures for pods with security context capabilities
  * Added `conntrack` to the `debug` container to help with connection tracking
    debugging
  * Fixed a bug in `tap` where mismatch cluster domain and trust domain caused
    `tap` to hang
  * Fixed an issue in the `identity` RBAC resource which caused start up errors
    in k8s 1.6 (thanks @Pothulapati!)
  * Added support for using trust anchors from an external certificate issuer
    (such as `cert-mananger`) to the `linkerd-identity` service
  * Added support for headless services (thanks @JohannesEH!)
* Helm
  * **Breaking change**: Renamed `noInitContainer` parameter to `cniEnabled`
  * **Breaking Change** Updated Helm charts to follow best practices (thanks
    @Pothulapati and @javaducky!)
  * Fixed an issue with `helm install` where the lists of ignored inbound and
    outbound ports would not be reflected
  * Fixed the `linkerd-cni` Helm chart not setting proper namespace annotations
    and labels
  * Fixed certificate issuance lifetime not being set when installing through
    Helm
  * Updated the helm build to retain previous releases
  * Moved CNI template into its own Helm chart
* Proxy
  * Fixed an issue that could cause the OpenCensus exporter to stall
  * Improved error classification and error responses for gRPC services
  * Fixed a bug where the proxy could stop receiving service discovery updates,
    resulting in 503 errors
  * Improved debug/error logging to include detailed contextual information
  * Fixed a bug in the proxy's logging subsystem that could cause the proxy to
    consume memory until the process is OOM killed, especially when the proxy was
    configured to log diagnostic information
  * Updated proxy dependencies to address RUSTSEC-2019-0033, RUSTSEC-2019-0034,
    and RUSTSEC-2020-02
* Web UI
  * Fixed an error when refreshing an already open dashboard when the Linkerd
    version has changed
  * Increased the speed of the dashboard by pausing network activity when the 
    dashboard is not visible to the user
  * Added support for CronJobs and ReplicaSets, including new Grafana dashboards
    for them
  * Added `linkerd check` to the dashboard in the `/controlplane` view
  * Added request and response headers to the `tap` expanded view in the
    dashboard
  * Added filter to namespace select button
  * Improved how empty tables are displayed
  * Added `Host:` header validation to the `linkerd-web` service, to protect
    against DNS rebinding attacks
  * Made the dashboard sidebar component responsive
  * Changed the navigation bar color to the one used on the [Linkerd](https://linkerd.io/) website
* Internal
  * Added validation to incoming sidecar injection requests that ensures
    the value of `linkerd.io/inject` is either `enabled` or `disabled`
    (thanks @mayankshah1607)
  * Upgraded the Prometheus Go client library to v1.2.1 (thanks @daxmc99!)
  * Fixed an issue causing `tap`, `injector` and `sp-validator` to use 
    old certificates after `helm upgrade` due to not being restarted
  * Fixed incomplete Swagger definition of the tap api, causing benign
    error logging in the kube-apiserver
  * Removed the destination container from the linkerd-controller deployment as
    it now runs in the linkerd-destination deployment
  * Allowed the control plane to be injected with the `debug` container
  * Updated proxy image build script to support HTTP proxy options
    (thanks @joakimr-axis!)
  * Updated the CLI `doc` command to auto-generate documentation for the proxy
    configuration annotations (thanks @StupidScience!)
  * Added new `--trace-collector` and `--trace-collector-svc-account` flags to
    `linkerd inject` that configures the OpenCensus trace collector used by
    proxies in the injected workload (thanks @Pothulapati!)
  * Added a new `--control-plane-tracing` flag to `linkerd install` that enables
    distributed tracing in the control plane (thanks @Pothulapati!)
  * Added distributed tracing support to the control plane (thanks
    @Pothulapati!)

[`cert-manager`]: https://github.com/jetstack/cert-manager

Signed-off-by: Alex Leong <alex@buoyant.io>

edge-20.2.1 (linkerd#4012)

This edge release is a release candidate for `stable-2.7` and fixes an issue
where the proxy could consume inappropriate amounts of memory.

* Proxy
  * Fixed a bug in the proxy's logging subsystem that could cause the proxy to
    consume memory until the process is OOMKilled, especially when the proxy was
    configured to log diagnostic information
  * Fixed properly emitting `grpc-status` headers when signaling proxy errors to
    gRPC clients
* Internal
  * Updated to Rust 1.40
  * Updated certain proxy dependencies to address RUSTSEC-2019-0033,
    RUSTSEC-2019-0034, and RUSTSEC-2020-02

Signed-off-by: Alex Leong <alex@buoyant.io>

Added change log of edge-20.1.4 (linkerd#3986)

Signed-off-by: Ivan Sim <ivan@buoyant.io>

Update edge-20.1.3 release changes (linkerd#3971)

# edge-20.1.3

An update to the Helm charts has caused a **breaking change** for users who
have installed Linkerd using Helm. In order to make the purpose of the
`NoInitContainer` parameter more explicit, it has been renamed to `CniEnabled`.

* CLI
  * Introduced `linkerd check --pre --linkerd-cni-enabled`, used when the CNI
    plugin is used, to check it has been properly installed before proceeding
    with the control plane installation
  * Added support for the `--as-group` flag so that users can impersonate
    groups for Kubernetes operations (thanks @mayankshah160!)
* Controller
  * Fixed an issue where an override of the Docker registry was not being
    applied to debug containers (thanks @javaducky!)
  * Added check for the Subject Alternate Name attributes to the API server
    when access restrictions have been enabled (thanks @javaducky!)
  * Added support for arbitrary pod labels so that users can leverage the
    Linkerd provided Prometheus instance to scrape for their own labels
    (thanks @daxmc99!)
  * Fixed an issue with CNI config parsing
* Helm
  * **Breaking change**: Renamed `NoInitContainer` parameter to `CniEnabled`
  * Fixed an issue with `helm install` where the lists of ignored inbound and
    outbound ports would not be reflected

Signed-off-by: Kevin Leimkuhler <kevin@kleimkuhler.com>

edge-20.1.2 (linkerd#3931)

## edge-20.1.2

* CLI
  * Added HA specific checks to `linkerd check` to ensure that the `kube-system`
    namespace has the `config.linkerd.io/admission-webhooks:disabled`
    label set
  * Fixed a problem causing the presence of unnecessary empty fields in
    generated resource definitions (thanks @mayankshah1607)
* Proxy
  * Fixed an issue that could cause the OpenCensus exporter to stall
* Internal
  * Added validation to incoming sidecar injection requests that ensures
    the value of `linkerd.io/inject` is either `enabled` or `disabled`
    (thanks @mayankshah1607)

Signed-off-by: Zahari Dichev <zaharidichev@gmail.com>

This edge release includes experimental improvements to the Linkerd p…

…roxy's

request buffering and backpressure infrastructure.

Additionally, we've fixed several bugs when installing Linkerd with Helm,
updated the CLI to allow using both port numbers _and_ port ranges with the
`--skip-inbound-ports` and `--skip-outbound-ports`  flags, and fixed a dashboard
error that can occur if the dashboard is open in a browser while updating Linkerd.

**Note**: The `linkerd-proxy` version included with this release is more
experimental than usual. We'd love your help testing, but be aware that there
might be stability issues.

* CLI
  * Added the ability to pass both port numbers and port ranges to
    `--skip-inbound-ports` and `--skip-outbound-ports` (thanks to @javaducky!)
* Controller
  * Fixed a race condition in the `linkerd-web` service
  * Updated Prometheus to 2.15.2 (thanks @Pothulapati)
* Web UI
  * Fixed an error when refreshing an already open dashboard when the Linkerd
    version has changed
* Proxy
  * Internal changes to the proxy's request buffering and backpressure
    infrastructure
* Helm
  * Fixed the `linkerd-cni` Helm chart not setting proper namespace annotations
    and labels
  * Fixed certificate issuance lifetime not being set when installing through
    Helm
  * More improvements to Helm best practices (thanks to @Pothulapati!)

Changes for edge-19.12.3 (linkerd#3857)

* Changes for edge-19.12.3

Signed-off-by: Charles Pretzer <charles@buoyant.io>

* CHANGES.md updates based on feedback

Signed-off-by: Charles Pretzer <charles@buoyant.io>

* Fix flag name

Signed-off-by: Charles Pretzer <charles@buoyant.io>

stable-2.6.1

Signed-off-by: Alex Leong <alex@buoyant.io>