backport of commit fbdeaf2

.changelog/16647.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+raft_logstore: Fixes a bug where restoring a snapshot when using the experimental WAL storage backend causes a panic.
+```

.changelog/16649.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+gateways: Adds validation to ensure the API Gateway has a listener defined when created
+```

.changelog/16651.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+gateway: **(Enterprise only)** Fix bug where namespace/partition would fail to unmarshal.
+```

.changelog/16660.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+ui: fix PUT token request with adding missed AccessorID property to requestBody
+```

.changelog/16661.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+gateways: Fixes a bug API gateways using HTTP listeners were taking upwards of 15 seconds to get configured over xDS.
+```

.changelog/16675.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+peering: Fixes a bug where the importing partition was not added to peered failover targets, which causes issues when the importing partition is a non-default partition.
+```

.changelog/16700.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+audit-logging: (Enterprise only) Fix a bug where `/agent/monitor` and `/agent/metrics` endpoints return a `Streaming not supported` error when audit logs are enabled. This also fixes the delay receiving logs when running `consul monitor` against an agent with audit logs enabled.
+```

.changelog/16729.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+peering: Fix issue resulting in prepared query failover to cluster peers never un-failing over.
+```

.changelog/_16677.txt

@@ -0,0 +1,3 @@
+```release-note:bug
+gateway: **(Enterprise only)** Fix bug where routes defined in a different namespace than a gateway would fail to register. [[GH-16677](https://github.com/hashicorp/consul/pull/16677)].
+```

.circleci/config.yml

@@ -6,10 +6,6 @@ parameters:
     type: string
     default: ""
     description: "Commit to run load tests against"
-  trigger-load-test:
-    type: boolean
-    default: false
-    description: "Boolean whether to run the load test workflow"
 
 references:
   paths:
@@ -36,9 +32,6 @@ references:
     - "1.11.6"
     - "1.10.9"
     - "1.9.10"
-  consul-versions: &consul_versions
-    - "1.14"
-    - "1.15"
   images:
     # When updating the Go version, remember to also update the versions in the
     # workflows section for go-test-lib jobs.
@@ -890,7 +883,7 @@ jobs:
               -p=4 \
               -timeout=30m \
               -json \
-              `go list ./... | grep -v upgrade` \
+              ./... \
               --target-image consul \
               --target-version local \
               --latest-image consul \
@@ -909,84 +902,6 @@ jobs:
           path: *TEST_RESULTS_DIR
       - run: *notify-slack-failure
 
-  upgrade-integration-test:
-      machine:
-        image: *UBUNTU_CI_IMAGE
-        docker_layer_caching: true
-      parallelism: 3
-      resource_class: large
-      parameters:
-        consul-version:
-          type: enum
-          enum: *consul_versions
-      environment:
-        CONSUL_VERSION: << parameters.consul-version >>
-      steps:
-        - checkout
-        # Get go binary from workspace
-        - attach_workspace:
-            at: .
-        # Build the consul:local image from the already built binary
-        - run:
-            command: |
-              sudo rm -rf /usr/local/go
-              wget https://dl.google.com/go/go${GO_VERSION}.linux-amd64.tar.gz
-              sudo tar -C /usr/local -xzvf go${GO_VERSION}.linux-amd64.tar.gz
-            environment:
-              <<: *ENVIRONMENT
-        - run: *install-gotestsum
-        - run: docker build -t consul:local -f ./build-support/docker/Consul-Dev.dockerfile .
-        - run:
-            name: Upgrade Integration Tests
-            command: |
-              mkdir -p /tmp/test-results/
-              cd ./test/integration/consul-container
-              docker run --rm consul:local consul version
-              gotestsum \
-                --raw-command \
-                --format=short-verbose \
-                --debug \
-                --rerun-fails=3 \
-                --packages="./..." \
-                -- \
-                go test \
-                -p=4 \
-                -tags "${GOTAGS}" \
-                -timeout=30m \
-                -json \
-                ./.../upgrade/ \
-                --target-image consul \
-                --target-version local \
-                --latest-image consul \
-                --latest-version $CONSUL_VERSION
-              ls -lrt
-            environment:
-              # this is needed because of incompatibility between RYUK container and circleci
-              GOTESTSUM_JUNITFILE: /tmp/test-results/results.xml
-              GOTESTSUM_FORMAT: standard-verbose
-              COMPOSE_INTERACTIVE_NO_CLI: 1
-              # tput complains if this isn't set to something.
-              TERM: ansi
-        - store_test_results:
-            path: *TEST_RESULTS_DIR
-        - store_artifacts:
-            path: *TEST_RESULTS_DIR
-        - run: *notify-slack-failure
-
-  # Lints all *.dockerfile but don't fail at this time
-  dockerfile-lint:
-    docker:
-      - image: docker.mirror.hashicorp.services/hadolint/hadolint:latest-debian
-    steps:
-      - run: apt-get -qq update; apt-get -y install git # the hadolint container doesn't have git
-      - checkout
-      - run:
-          name: Dockefile lint
-          command: |
-            for file in $(find . -type f -name *.dockerfile); do
-              hadolint $file || true
-            done
-
   envoy-integration-test: &ENVOY_TESTS
     machine:
       image: *UBUNTU_CI_IMAGE
@@ -1073,78 +988,6 @@ jobs:
           path: *TEST_RESULTS_DIR
       - run: *notify-slack-failure
 
-  # Run load tests against a commit
-  load-test:
-    docker:
-      - image: hashicorp/terraform:latest
-    environment:
-      AWS_DEFAULT_REGION: us-east-2
-      BUCKET: consul-ci-load-tests
-      BASH_ENV: /etc/profile
-    shell: /bin/sh -leo pipefail
-    steps:
-      - checkout
-      - run: apk add jq curl bash
-      - run:
-          name: export load-test credentials
-          command: |
-            echo "export AWS_ACCESS_KEY_ID=$AWS_ACCESS_KEY_ID_LOAD_TEST" >> $BASH_ENV
-            echo "export AWS_SECRET_ACCESS_KEY=$AWS_SECRET_ACCESS_KEY_LOAD_TEST" >> $BASH_ENV
-      - run:
-          name: export role arn
-          command: |
-            echo "export TF_VAR_role_arn=$ROLE_ARN_LOAD_TEST" >> $BASH_ENV
-      - run:
-          name: setup TF_VARs
-          command: |
-            # if pipeline.parameters.commit="" it was not triggered/set through the API
-            # so we use the latest commit from _this_ branch. This is the case for nightly tests.
-            if [ "<< pipeline.parameters.commit >>" = "" ]; then
-              LOCAL_COMMIT_SHA=$(git rev-parse HEAD)
-            else
-              LOCAL_COMMIT_SHA="<< pipeline.parameters.commit >>"
-            fi
-            echo "export LOCAL_COMMIT_SHA=${LOCAL_COMMIT_SHA}" >> $BASH_ENV
-            git checkout ${LOCAL_COMMIT_SHA}
-
-            short_ref=$(git rev-parse --short ${LOCAL_COMMIT_SHA})
-            echo "export TF_VAR_ami_owners=$LOAD_TEST_AMI_OWNERS" >> $BASH_ENV
-            echo "export TF_VAR_vpc_name=$short_ref" >> $BASH_ENV
-            echo "export TF_VAR_cluster_name=$short_ref" >> $BASH_ENV
-            echo "export TF_VAR_consul_download_url=https://${S3_ARTIFACT_BUCKET}.s3.${AWS_DEFAULT_REGION}.amazonaws.com/${S3_ARTIFACT_PATH}/${LOCAL_COMMIT_SHA}.zip" >> $BASH_ENV
-      - run:
-          name: wait for dev build from test-integrations workflow
-          command: |
-            echo "curl-ing https://${S3_ARTIFACT_BUCKET}.s3.${AWS_DEFAULT_REGION}.amazonaws.com/${S3_ARTIFACT_PATH}/${LOCAL_COMMIT_SHA}.zip"
-            until [ $SECONDS -ge 300 ] && exit 1; do
-              curl -o /dev/null --fail --silent "https://${S3_ARTIFACT_BUCKET}.s3.${AWS_DEFAULT_REGION}.amazonaws.com/${S3_ARTIFACT_PATH}/${LOCAL_COMMIT_SHA}.zip" && exit
-              echo -n "."
-              sleep 2
-            done
-      - run:
-          working_directory: .circleci/terraform/load-test
-          name: terraform init
-          command: |
-            short_ref=$(git rev-parse --short HEAD)
-            echo "Testing commit id: $short_ref"
-            terraform init \
-            -backend-config="bucket=${BUCKET}" \
-            -backend-config="key=${LOCAL_COMMIT_SHA}" \
-            -backend-config="region=${AWS_DEFAULT_REGION}" \
-            -backend-config="role_arn=${ROLE_ARN_LOAD_TEST}"
-      - run:
-          working_directory: .circleci/terraform/load-test
-          name: run terraform apply
-          command: |
-            terraform apply -auto-approve
-      - run:
-          working_directory: .circleci/terraform/load-test
-          when: always
-          name: terraform destroy
-          command: |
-            for i in $(seq 1 5); do terraform destroy -auto-approve && s=0 && break || s=$? && sleep 20; done; (exit $s)
-      - run: *notify-slack-failure
-
   # The noop job is a used as a very fast job in the verify-ci workflow because every workflow
   # requires at least one job. It does nothing.
   noop:
@@ -1161,7 +1004,6 @@ workflows:
     jobs: [noop]
 
   go-tests:
-    unless: << pipeline.parameters.trigger-load-test >>
     jobs:
       - check-go-mod: &filter-ignore-non-go-branches
           filters:
@@ -1224,7 +1066,6 @@ workflows:
       - go-test-32bit: *filter-ignore-non-go-branches
       - noop
   build-distros:
-    unless: << pipeline.parameters.trigger-load-test >>
     jobs:
       - check-go-mod: *filter-ignore-non-go-branches
       - build-386: &require-check-go-mod
@@ -1256,7 +1097,6 @@ workflows:
           context: consul-ci
       - noop
   test-integrations:
-    unless: << pipeline.parameters.trigger-load-test >>
     jobs:
       - dev-build: *filter-ignore-non-go-branches
       - dev-upload-s3: &dev-upload
@@ -1291,16 +1131,8 @@ workflows:
       - compatibility-integration-test:
           requires:
             - dev-build
-      - upgrade-integration-test:
-          requires:
-            - dev-build
-          matrix:
-            parameters:
-              consul-version: *consul_versions
-
       - noop
   frontend:
-    unless: << pipeline.parameters.trigger-load-test >>
     jobs:
       - frontend-cache:
           filters:
@@ -1333,19 +1165,3 @@ workflows:
           requires:
             - ember-build-ent
       - noop
-
-  load-test:
-    when: << pipeline.parameters.trigger-load-test >>
-    jobs:
-      - load-test
-
-  nightly-jobs:
-    triggers:
-      - schedule:
-          cron: "0 4 * * *" # 4AM UTC <> 12AM EST <> 9PM PST should have no impact
-          filters:
-            branches:
-              only:
-                - main
-    jobs:
-      - load-test

.github/CONTRIBUTING.md

@@ -162,7 +162,8 @@ When you're ready to submit a pull request:
    | --- | --- |
    | `pr/no-changelog` | This PR does not have an intended changelog entry |
    | `pr/no-metrics-test` | This PR does not require any testing for metrics |
-   | `backport/1.12.x` | Backport the changes in this PR to the targeted release branch. Consult the [Consul Release Notes](https://www.consul.io/docs/release-notes) page to view active releases. Website documentation merged to the latest release branch is deployed immediately |
+   | `backport/stable-website` | This PR contains documentation changes that are ready to be deployed immediately. Changes will also automatically get backported to the latest release branch |
+   | `backport/1.12.x` | Backport the changes in this PR to the targeted release branch. Consult the [Consul Release Notes](https://www.consul.io/docs/release-notes) page to view active releases. |
    Other labels may automatically be added by the Github Action CI.
 7. After you submit, the Consul maintainers team needs time to carefully review your
    contribution and ensure it is production-ready, considering factors such as: security,