Add advanced autopilot features

api/operator.go

@@ -93,6 +93,15 @@ type AutopilotConfiguration struct {
 	// applicable with Raft protocol version 3 or higher.
 	ServerStabilizationTime *ReadableDuration
 
+	// (Enterprise-only) RedundancyZoneTag is the node tag to use for separating
+	// servers into zones for redundancy. If left blank, this feature will be disabled.
+	RedundancyZoneTag string
+
+	// (Enterprise-only) DisableUpgradeMigration will disable Autopilot's upgrade migration
+	// strategy of waiting until enough newer-versioned servers have been added to the
+	// cluster before promoting them to voters.
+	DisableUpgradeMigration bool
+
 	// CreateIndex holds the index corresponding the creation of this configuration.
 	// This is a read-only field.
 	CreateIndex uint64
@@ -118,6 +127,12 @@ type ServerHealth struct {
 	// The status of the SerfHealth check for the server.
 	SerfStatus string
 
+	// Version is the Consul version of the server.
+	Version string
+
+	// Leader is whether this server is currently the leader.
+	Leader bool
+
 	// LastContact is the time since this node's last contact with the leader.
 	LastContact *ReadableDuration
 

command/agent/agent.go

@@ -428,6 +428,15 @@ func (a *Agent) consulConfig() *consul.Config {
 	if a.config.Autopilot.ServerStabilizationTime != nil {
 		base.AutopilotConfig.ServerStabilizationTime = *a.config.Autopilot.ServerStabilizationTime
 	}
+	if a.config.NonVotingServer {
+		base.NonVoter = a.config.NonVotingServer
+	}
+	if a.config.Autopilot.RedundancyZoneTag != "" {
+		base.AutopilotConfig.RedundancyZoneTag = a.config.Autopilot.RedundancyZoneTag
+	}
+	if a.config.Autopilot.DisableUpgradeMigration != nil {
+		base.AutopilotConfig.DisableUpgradeMigration = *a.config.Autopilot.DisableUpgradeMigration
+	}
 
 	// Format the build string
 	revision := a.config.Revision

command/agent/agent_test.go

@@ -20,6 +20,7 @@ import (
 	"github.com/hashicorp/consul/logger"
 	"github.com/hashicorp/consul/testutil"
 	"github.com/hashicorp/consul/types"
+	"github.com/hashicorp/consul/version"
 	"github.com/hashicorp/go-uuid"
 	"github.com/hashicorp/raft"
 )
@@ -37,13 +38,17 @@ const (
 	numPortsPerIndex
 )
 
+func init() {
+	version.Version = "0.8.0"
+}
+
 var offset uint64 = basePortNumber
 
 func nextConfig() *Config {
 	idx := int(atomic.AddUint64(&offset, numPortsPerIndex))
 	conf := DefaultConfig()
 
-	conf.Version = "a.b"
+	conf.Version = version.Version
 	conf.VersionPrerelease = "c.d"
 	conf.AdvertiseAddr = "127.0.0.1"
 	conf.Bootstrap = true

command/agent/command.go

@@ -109,6 +109,10 @@ func (c *Command) readConfig() *Config {
 	f.StringVar(&cmdConfig.EncryptKey, "encrypt", "", "Provides the gossip encryption key.")
 
 	f.BoolVar(&cmdConfig.Server, "server", false, "Switches agent to server mode.")
+	f.BoolVar(&cmdConfig.NonVotingServer, "non-voting-server", false,
+		"(Enterprise-only) This flag is used to make the server not participate in the Raft quorum, "+
+			"and have it only receive the data replication stream. This can be used to add read scalability "+
+			"to a cluster in cases where a high volume of reads to servers are needed.")
 	f.BoolVar(&cmdConfig.Bootstrap, "bootstrap", false, "Sets server to bootstrap mode.")
 	f.IntVar(&cmdConfig.BootstrapExpect, "bootstrap-expect", 0, "Sets server to expect bootstrap mode.")
 	f.StringVar(&cmdConfig.Domain, "domain", "", "Domain to use for DNS interface.")

command/agent/command_test.go

@@ -12,6 +12,7 @@ import (
 
 	"github.com/hashicorp/consul/command/base"
 	"github.com/hashicorp/consul/testutil"
+	"github.com/hashicorp/consul/version"
 	"github.com/mitchellh/cli"
 )
 
@@ -70,6 +71,7 @@ func TestRetryJoin(t *testing.T) {
 	}()
 
 	cmd := &Command{
+		Version:    version.Version,
 		ShutdownCh: shutdownCh,
 		Command:    baseCommand(new(cli.MockUi)),
 	}

command/agent/config.go

@@ -280,6 +280,15 @@ type Autopilot struct {
 	// applicable with Raft protocol version 3 or higher.
 	ServerStabilizationTime    *time.Duration `mapstructure:"-" json:"-"`
 	ServerStabilizationTimeRaw string         `mapstructure:"server_stabilization_time"`
+
+	// (Enterprise-only) RedundancyZoneTag is the Meta tag to use for separating servers
+	// into zones for redundancy. If left blank, this feature will be disabled.
+	RedundancyZoneTag string `mapstructure:"redundancy_zone_tag"`
+
+	// (Enterprise-only) DisableUpgradeMigration will disable Autopilot's upgrade migration
+	// strategy of waiting until enough newer-versioned servers have been added to the
+	// cluster before promoting them to voters.
+	DisableUpgradeMigration *bool `mapstructure:"disable_upgrade_migration"`
 }
 
 // Config is the configuration that can be set for an Agent.
@@ -306,6 +315,10 @@ type Config struct {
 	// in leader election, etc.
 	Server bool `mapstructure:"server"`
 
+	// (Enterprise-only) NonVotingServer is whether this server will act as a non-voting member
+	// of the cluster to help provide read scalability.
+	NonVotingServer bool `mapstructure:"non_voting_server"`
+
 	// Datacenter is the datacenter this node is in. Defaults to dc1
 	Datacenter string `mapstructure:"datacenter"`
 
@@ -1378,6 +1391,9 @@ func MergeConfig(a, b *Config) *Config {
 	if b.Server == true {
 		result.Server = b.Server
 	}
+	if b.NonVotingServer == true {
+		result.NonVotingServer = b.NonVotingServer
+	}
 	if b.LeaveOnTerm != nil {
 		result.LeaveOnTerm = b.LeaveOnTerm
 	}
@@ -1396,6 +1412,12 @@ func MergeConfig(a, b *Config) *Config {
 	if b.Autopilot.ServerStabilizationTime != nil {
 		result.Autopilot.ServerStabilizationTime = b.Autopilot.ServerStabilizationTime
 	}
+	if b.Autopilot.RedundancyZoneTag != "" {
+		result.Autopilot.RedundancyZoneTag = b.Autopilot.RedundancyZoneTag
+	}
+	if b.Autopilot.DisableUpgradeMigration != nil {
+		result.Autopilot.DisableUpgradeMigration = b.Autopilot.DisableUpgradeMigration
+	}
 	if b.Telemetry.DisableHostname == true {
 		result.Telemetry.DisableHostname = true
 	}

command/agent/config_test.go

@@ -1107,7 +1107,9 @@ func TestDecodeConfig_Autopilot(t *testing.T) {
 	  "cleanup_dead_servers": true,
 	  "last_contact_threshold": "100ms",
 	  "max_trailing_logs": 10,
-	  "server_stabilization_time": "10s"
+	  "server_stabilization_time": "10s",
+	  "redundancy_zone_tag": "az",
+	  "disable_upgrade_migration": true
 	 }}`
 	config, err := DecodeConfig(bytes.NewReader([]byte(input)))
 	if err != nil {
@@ -1125,6 +1127,12 @@ func TestDecodeConfig_Autopilot(t *testing.T) {
 	if config.Autopilot.ServerStabilizationTime == nil || *config.Autopilot.ServerStabilizationTime != 10*time.Second {
 		t.Fatalf("bad: %#v", config)
 	}
+	if config.Autopilot.RedundancyZoneTag != "az" {
+		t.Fatalf("bad: %#v", config)
+	}
+	if config.Autopilot.DisableUpgradeMigration == nil || !*config.Autopilot.DisableUpgradeMigration {
+		t.Fatalf("bad: %#v", config)
+	}
 }
 
 func TestDecodeConfig_Services(t *testing.T) {

command/agent/operator_endpoint.go

@@ -191,6 +191,8 @@ func (s *HTTPServer) OperatorAutopilotConfiguration(resp http.ResponseWriter, re
 			LastContactThreshold:    api.NewReadableDuration(reply.LastContactThreshold),
 			MaxTrailingLogs:         reply.MaxTrailingLogs,
 			ServerStabilizationTime: api.NewReadableDuration(reply.ServerStabilizationTime),
+			RedundancyZoneTag:       reply.RedundancyZoneTag,
+			DisableUpgradeMigration: reply.DisableUpgradeMigration,
 			CreateIndex:             reply.CreateIndex,
 			ModifyIndex:             reply.ModifyIndex,
 		}
@@ -213,6 +215,8 @@ func (s *HTTPServer) OperatorAutopilotConfiguration(resp http.ResponseWriter, re
 			LastContactThreshold:    conf.LastContactThreshold.Duration(),
 			MaxTrailingLogs:         conf.MaxTrailingLogs,
 			ServerStabilizationTime: conf.ServerStabilizationTime.Duration(),
+			RedundancyZoneTag:       conf.RedundancyZoneTag,
+			DisableUpgradeMigration: conf.DisableUpgradeMigration,
 		}
 
 		// Check for cas value
@@ -299,6 +303,8 @@ func (s *HTTPServer) OperatorServerHealth(resp http.ResponseWriter, req *http.Re
 			ID:          server.ID,
 			Name:        server.Name,
 			Address:     server.Address,
+			Version:     server.Version,
+			Leader:      server.Leader,
 			SerfStatus:  server.SerfStatus.String(),
 			LastContact: api.NewReadableDuration(server.LastContact),
 			LastTerm:    server.LastTerm,

command/operator_autopilot_get.go

@@ -59,6 +59,8 @@ func (c *OperatorAutopilotGetCommand) Run(args []string) int {
 	c.Ui.Output(fmt.Sprintf("LastContactThreshold = %v", config.LastContactThreshold.String()))
 	c.Ui.Output(fmt.Sprintf("MaxTrailingLogs = %v", config.MaxTrailingLogs))
 	c.Ui.Output(fmt.Sprintf("ServerStabilizationTime = %v", config.ServerStabilizationTime.String()))
+	c.Ui.Output(fmt.Sprintf("RedundancyZoneTag = %q", config.RedundancyZoneTag))
+	c.Ui.Output(fmt.Sprintf("DisableUpgradeMigration = %v", config.DisableUpgradeMigration))
 
 	return 0
 }

command/operator_autopilot_set.go

@@ -34,6 +34,8 @@ func (c *OperatorAutopilotSetCommand) Run(args []string) int {
 	var maxTrailingLogs base.UintValue
 	var lastContactThreshold base.DurationValue
 	var serverStabilizationTime base.DurationValue
+	var redundancyZoneTag base.StringValue
+	var disableUpgradeMigration base.BoolValue
 
 	f := c.Command.NewFlagSet(c)
 
@@ -52,6 +54,12 @@ func (c *OperatorAutopilotSetCommand) Run(args []string) int {
 			"'healthy' state before being added to the cluster. Only takes effect if all "+
 			"servers are running Raft protocol version 3 or higher. Must be a duration "+
 			"value such as `10s`.")
+	f.Var(&redundancyZoneTag, "redundancy-zone-tag",
+		"(Enterprise-only) Controls the node_meta tag name used for separating servers into "+
+			"different redundancy zones.")
+	f.Var(&disableUpgradeMigration, "disable-upgrade-migration",
+		"(Enterprise-only) Controls whether Consul will avoid promoting new servers until "+
+			"it can perform a migration. Must be one of `true|false`.")
 
 	if err := c.Command.Parse(args); err != nil {
 		if err == flag.ErrHelp {
@@ -78,6 +86,8 @@ func (c *OperatorAutopilotSetCommand) Run(args []string) int {
 
 	// Update the config values based on the set flags.
 	cleanupDeadServers.Merge(&conf.CleanupDeadServers)
+	redundancyZoneTag.Merge(&conf.RedundancyZoneTag)
+	disableUpgradeMigration.Merge(&conf.DisableUpgradeMigration)
 
 	trailing := uint(conf.MaxTrailingLogs)
 	maxTrailingLogs.Merge(&trailing)

command/util_test.go

@@ -15,6 +15,7 @@ import (
 	"github.com/hashicorp/consul/command/agent"
 	"github.com/hashicorp/consul/consul"
 	"github.com/hashicorp/consul/logger"
+	"github.com/hashicorp/consul/version"
 	"github.com/mitchellh/cli"
 )
 
@@ -23,6 +24,8 @@ var offset uint64
 func init() {
 	// Seed the random number generator
 	rand.Seed(time.Now().UnixNano())
+
+	version.Version = "0.8.0"
 }
 
 type agentWrapper struct {
@@ -115,6 +118,8 @@ func nextConfig() *agent.Config {
 	conf.BindAddr = "127.0.0.1"
 	conf.Server = true
 
+	conf.Version = version.Version
+
 	conf.Ports.HTTP = 10000 + 10*idx
 	conf.Ports.HTTPS = 10401 + 10*idx
 	conf.Ports.SerfLan = 10201 + 10*idx

consul/agent/server.go

@@ -8,8 +8,10 @@ package agent
 import (
 	"fmt"
 	"net"
+	"regexp"
 	"strconv"
 
+	"github.com/hashicorp/go-version"
 	"github.com/hashicorp/serf/serf"
 )
 
@@ -32,8 +34,10 @@ type Server struct {
 	WanJoinPort int
 	Bootstrap   bool
 	Expect      int
+	Build       version.Version
 	Version     int
 	RaftVersion int
+	NonVoter    bool
 	Addr        net.Addr
 	Status      serf.MemberStatus
 }
@@ -56,6 +60,8 @@ func (s *Server) String() string {
 	return fmt.Sprintf("%s (Addr: %s/%s) (DC: %s)", s.Name, networkStr, addrStr, s.Datacenter)
 }
 
+var versionFormat = regexp.MustCompile(`\d+\.\d+\.\d+`)
+
 // IsConsulServer returns true if a serf member is a consul server
 // agent. Returns a bool and a pointer to the Server.
 func IsConsulServer(m serf.Member) (bool, *Server) {
@@ -82,6 +88,11 @@ func IsConsulServer(m serf.Member) (bool, *Server) {
 		return false, nil
 	}
 
+	build_version, err := version.NewVersion(versionFormat.FindString(m.Tags["build"]))
+	if err != nil {
+		return false, nil
+	}
+
 	wan_join_port := 0
 	wan_join_port_str, ok := m.Tags["wan_join_port"]
 	if ok {
@@ -106,6 +117,8 @@ func IsConsulServer(m serf.Member) (bool, *Server) {
 		}
 	}
 
+	_, nonVoter := m.Tags["nonvoter"]
+
 	addr := &net.TCPAddr{IP: m.Addr, Port: port}
 
 	parts := &Server{
@@ -117,9 +130,11 @@ func IsConsulServer(m serf.Member) (bool, *Server) {
 		Bootstrap:   bootstrap,
 		Expect:      expect,
 		Addr:        addr,
+		Build:       *build_version,
 		Version:     vsn,
 		RaftVersion: raft_vsn,
 		Status:      m.Status,
+		NonVoter:    nonVoter,
 	}
 	return true, parts
 }

consul/agent/server_test.go

@@ -59,6 +59,7 @@ func TestIsConsulServer(t *testing.T) {
 			"id":            "asdf",
 			"dc":            "east-aws",
 			"port":          "10000",
+			"build":         "0.8.0",
 			"wan_join_port": "1234",
 			"vsn":           "1",
 			"expect":        "3",
@@ -137,6 +138,7 @@ func TestIsConsulServer_Optional(t *testing.T) {
 			"dc":    "east-aws",
 			"port":  "10000",
 			"vsn":   "1",
+			"build": "0.8.0",
 			// wan_join_port, raft_vsn, and expect are optional and
 			// should default to zero.
 		},

consul/autopilot.go

@@ -133,12 +133,12 @@ func (b *BasicAutopilot) PromoteNonVoters(autopilotConf *structs.AutopilotConfig
 		return fmt.Errorf("failed to get raft configuration: %v", err)
 	}
 
+	// Find any non-voters eligible for promotion
 	var promotions []raft.Server
-	raftServers := future.Configuration().Servers
 	voterCount := 0
-	for _, server := range raftServers {
+	for _, server := range future.Configuration().Servers {
 		// If this server has been stable and passing for long enough, promote it to a voter
-		if server.Suffrage == raft.Nonvoter {
+		if !isVoter(server.Suffrage) {
 			health := b.server.getServerHealth(string(server.ID))
 			if health.IsStable(time.Now(), autopilotConf) {
 				promotions = append(promotions, server)
@@ -148,18 +148,25 @@ func (b *BasicAutopilot) PromoteNonVoters(autopilotConf *structs.AutopilotConfig
 		}
 	}
 
-	// Exit early if there's nothing to promote
+	if _, err := b.server.handlePromotions(voterCount, promotions); err != nil {
-	if len(promotions) == 0 {
+		return err
+	}
+
 	return nil
 }
 
+func (s *Server) handlePromotions(voterCount int, promotions []raft.Server) (bool, error) {
+	if len(promotions) == 0 {
+		return false, nil
+	}
+
 	// If there's currently an even number of servers, we can promote the first server in the list
 	// to get to an odd-sized quorum
 	newServers := false
 	if voterCount%2 == 0 {
-		addFuture := b.server.raft.AddVoter(promotions[0].ID, promotions[0].Address, 0, 0)
+		addFuture := s.raft.AddVoter(promotions[0].ID, promotions[0].Address, 0, 0)
 		if err := addFuture.Error(); err != nil {
-			return fmt.Errorf("failed to add raft peer: %v", err)
+			return newServers, fmt.Errorf("failed to add raft peer: %v", err)
 		}
 		promotions = promotions[1:]
 		newServers = true
@@ -167,13 +174,13 @@ func (b *BasicAutopilot) PromoteNonVoters(autopilotConf *structs.AutopilotConfig
 
 	// Promote remaining servers in twos to maintain an odd quorum size
 	for i := 0; i < len(promotions)-1; i += 2 {
-		addFirst := b.server.raft.AddVoter(promotions[i].ID, promotions[i].Address, 0, 0)
+		addFirst := s.raft.AddVoter(promotions[i].ID, promotions[i].Address, 0, 0)
 		if err := addFirst.Error(); err != nil {
-			return fmt.Errorf("failed to add raft peer: %v", err)
+			return newServers, fmt.Errorf("failed to add raft peer: %v", err)
 		}
-		addSecond := b.server.raft.AddVoter(promotions[i+1].ID, promotions[i+1].Address, 0, 0)
+		addSecond := s.raft.AddVoter(promotions[i+1].ID, promotions[i+1].Address, 0, 0)
 		if err := addSecond.Error(); err != nil {
-			return fmt.Errorf("failed to add raft peer: %v", err)
+			return newServers, fmt.Errorf("failed to add raft peer: %v", err)
 		}
 		newServers = true
 	}
@@ -181,12 +188,12 @@ func (b *BasicAutopilot) PromoteNonVoters(autopilotConf *structs.AutopilotConfig
 	// If we added a new server, trigger a check to remove dead servers
 	if newServers {
 		select {
-		case b.server.autopilotRemoveDeadCh <- struct{}{}:
+		case s.autopilotRemoveDeadCh <- struct{}{}:
 		default:
 		}
 	}
 
-	return nil
+	return newServers, nil
 }
 
 // serverHealthLoop monitors the health of the servers in the cluster
@@ -264,6 +271,7 @@ func (s *Server) updateClusterHealth() error {
 	fetchedStats := s.statsFetcher.Fetch(ctx, fetchList)
 
 	// Build a current list of server healths
+	leader := s.raft.Leader()
 	var clusterHealth structs.OperatorHealthReply
 	healthyCount := 0
 	voterCount := 0
@@ -271,6 +279,7 @@ func (s *Server) updateClusterHealth() error {
 		health := structs.ServerHealth{
 			ID:          string(server.ID),
 			Address:     string(server.Address),
+			Leader:      server.Address == leader,
 			LastContact: -1,
 			Voter:       server.Suffrage == raft.Voter,
 		}
@@ -279,6 +288,7 @@ func (s *Server) updateClusterHealth() error {
 		if ok {
 			health.Name = parts.Name
 			health.SerfStatus = parts.Status
+			health.Version = parts.Build.String()
 			if stats, ok := fetchedStats[string(server.ID)]; ok {
 				if err := s.updateServerHealth(&health, parts, stats, autopilotConf, targetLastIndex); err != nil {
 					s.logger.Printf("[WARN] consul: error updating server health: %s", err)
@@ -372,3 +382,12 @@ func (s *Server) getServerHealth(id string) *structs.ServerHealth {
 	}
 	return nil
 }
+
+func isVoter(suffrage raft.ServerSuffrage) bool {
+	switch suffrage {
+	case raft.Voter, raft.Staging:
+		return true
+	default:
+		return false
+	}
+}

consul/autopilot_test.go

@@ -98,7 +98,6 @@ func TestAutopilot_CleanupDeadServerPeriodic(t *testing.T) {
 	dir1, s1 := testServerWithConfig(t, func(c *Config) {
 		c.Datacenter = "dc1"
 		c.Bootstrap = true
-		c.AutopilotInterval = 100 * time.Millisecond
 	})
 	defer os.RemoveAll(dir1)
 	defer s1.Shutdown()

consul/config.go

@@ -80,6 +80,10 @@ type Config struct {
 	// RaftConfig is the configuration used for Raft in the local DC
 	RaftConfig *raft.Config
 
+	// (Enterprise-only) NonVoter is used to prevent this server from being added
+	// as a voting member of the Raft cluster.
+	NonVoter bool
+
 	// RPCAddr is the RPC address used by Consul. This should be reachable
 	// by the WAN and LAN
 	RPCAddr *net.TCPAddr
@@ -330,6 +334,7 @@ func DefaultConfig() *Config {
 	}
 
 	conf := &Config{
+		Build:                    "0.8.0",
 		Datacenter:               DefaultDC,
 		NodeName:                 hostname,
 		RPCAddr:                  DefaultRPCAddr,

consul/fsm.go

@@ -448,6 +448,15 @@ func (c *consulFSM) Restore(old io.ReadCloser) error {
 				return err
 			}
 
+		case structs.AutopilotRequestType:
+			var req structs.AutopilotConfig
+			if err := dec.Decode(&req); err != nil {
+				return err
+			}
+			if err := restore.Autopilot(&req); err != nil {
+				return err
+			}
+
 		default:
 			return fmt.Errorf("Unrecognized msg type: %v", msgType)
 		}
@@ -514,6 +523,11 @@ func (s *consulSnapshot) Persist(sink raft.SnapshotSink) error {
 		return err
 	}
 
+	if err := s.persistAutopilot(sink, encoder); err != nil {
+		sink.Cancel()
+		return err
+	}
+
 	return nil
 }
 
@@ -677,6 +691,21 @@ func (s *consulSnapshot) persistPreparedQueries(sink raft.SnapshotSink,
 	return nil
 }
 
+func (s *consulSnapshot) persistAutopilot(sink raft.SnapshotSink,
+	encoder *codec.Encoder) error {
+	autopilot, err := s.state.Autopilot()
+	if err != nil {
+		return err
+	}
+
+	sink.Write([]byte{byte(structs.AutopilotRequestType)})
+	if err := encoder.Encode(autopilot); err != nil {
+		return err
+	}
+
+	return nil
+}
+
 func (s *consulSnapshot) Release() {
 	s.state.Close()
 }

consul/fsm_test.go

@@ -13,6 +13,7 @@ import (
 	"github.com/hashicorp/consul/types"
 	"github.com/hashicorp/go-uuid"
 	"github.com/hashicorp/raft"
+	"time"
 )
 
 type MockSink struct {
@@ -423,6 +424,15 @@ func TestFSM_SnapshotRestore(t *testing.T) {
 		t.Fatalf("err: %s", err)
 	}
 
+	autopilotConf := &structs.AutopilotConfig{
+		CleanupDeadServers:   true,
+		LastContactThreshold: 100 * time.Millisecond,
+		MaxTrailingLogs:      222,
+	}
+	if err := fsm.state.AutopilotSetConfig(15, autopilotConf); err != nil {
+		t.Fatalf("err: %s", err)
+	}
+
 	// Snapshot
 	snap, err := fsm.Snapshot()
 	if err != nil {
@@ -564,6 +574,15 @@ func TestFSM_SnapshotRestore(t *testing.T) {
 		t.Fatalf("bad: %#v", queries[0])
 	}
 
+	// Verify autopilot config is restored.
+	_, restoredConf, err := fsm2.state.AutopilotConfig()
+	if err != nil {
+		t.Fatalf("err: %s", err)
+	}
+	if !reflect.DeepEqual(restoredConf, autopilotConf) {
+		t.Fatalf("bad: %#v, %#v", restoredConf, autopilotConf)
+	}
+
 	// Snapshot
 	snap, err = fsm2.Snapshot()
 	if err != nil {
@@ -1314,6 +1333,67 @@ func TestFSM_Txn(t *testing.T) {
 	}
 }
 
+func TestFSM_Autopilot(t *testing.T) {
+	fsm, err := NewFSM(nil, os.Stderr)
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+
+	// Set the autopilot config using a request.
+	req := structs.AutopilotSetConfigRequest{
+		Datacenter: "dc1",
+		Config: structs.AutopilotConfig{
+			CleanupDeadServers:   true,
+			LastContactThreshold: 10 * time.Second,
+			MaxTrailingLogs:      300,
+		},
+	}
+	buf, err := structs.Encode(structs.AutopilotRequestType, req)
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+	resp := fsm.Apply(makeLog(buf))
+	if _, ok := resp.(error); ok {
+		t.Fatalf("bad: %v", resp)
+	}
+
+	// Verify key is set directly in the state store.
+	_, config, err := fsm.state.AutopilotConfig()
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+	if config.CleanupDeadServers != req.Config.CleanupDeadServers {
+		t.Fatalf("bad: %v", config.CleanupDeadServers)
+	}
+	if config.LastContactThreshold != req.Config.LastContactThreshold {
+		t.Fatalf("bad: %v", config.LastContactThreshold)
+	}
+	if config.MaxTrailingLogs != req.Config.MaxTrailingLogs {
+		t.Fatalf("bad: %v", config.MaxTrailingLogs)
+	}
+
+	// Now use CAS and provide an old index
+	req.CAS = true
+	req.Config.CleanupDeadServers = false
+	req.Config.ModifyIndex = config.ModifyIndex - 1
+	buf, err = structs.Encode(structs.AutopilotRequestType, req)
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+	resp = fsm.Apply(makeLog(buf))
+	if _, ok := resp.(error); ok {
+		t.Fatalf("bad: %v", resp)
+	}
+
+	_, config, err = fsm.state.AutopilotConfig()
+	if err != nil {
+		t.Fatalf("err: %v", err)
+	}
+	if !config.CleanupDeadServers {
+		t.Fatalf("bad: %v", config.CleanupDeadServers)
+	}
+}
+
 func TestFSM_IgnoreUnknown(t *testing.T) {
 	fsm, err := NewFSM(nil, os.Stderr)
 	if err != nil {

consul/serf.go

@@ -57,7 +57,7 @@ func (s *Server) lanEventHandler() {
 				s.localMemberEvent(e.(serf.MemberEvent))
 			case serf.EventUser:
 				s.localEvent(e.(serf.UserEvent))
-			case serf.EventMemberUpdate: // Ignore
+			case serf.EventMemberUpdate:
 				s.localMemberEvent(e.(serf.MemberEvent))
 			case serf.EventQuery: // Ignore
 			default:

consul/server.go

@@ -265,7 +265,9 @@ func NewServer(config *Config) (*Server, error) {
 		tombstoneGC:           gc,
 		shutdownCh:            make(chan struct{}),
 	}
-	s.autopilotPolicy = &BasicAutopilot{s}
+
+	// Set up the autopilot policy
+	s.autopilotPolicy = &BasicAutopilot{server: s}
 
 	// Initialize the stats fetcher that autopilot will use.
 	s.statsFetcher = NewStatsFetcher(logger, s.connPool, s.config.Datacenter)
@@ -380,6 +382,9 @@ func (s *Server) setupSerf(conf *serf.Config, ch chan serf.Event, path string, w
 	if s.config.BootstrapExpect != 0 {
 		conf.Tags["expect"] = fmt.Sprintf("%d", s.config.BootstrapExpect)
 	}
+	if s.config.NonVoter {
+		conf.Tags["nonvoter"] = "1"
+	}
 	conf.MemberlistConfig.LogOutput = s.config.LogOutput
 	conf.LogOutput = s.config.LogOutput
 	conf.EventCh = ch

consul/server_test.go

@@ -73,6 +73,12 @@ func testServerConfig(t *testing.T, NodeName string) (string, *Config) {
 
 	config.ReconcileInterval = 100 * time.Millisecond
 
+	config.AutopilotConfig.ServerStabilizationTime = 100 * time.Millisecond
+	config.ServerHealthInterval = 50 * time.Millisecond
+	config.AutopilotInterval = 100 * time.Millisecond
+
+	config.Build = "0.8.0"
+
 	config.CoordinateUpdatePeriod = 100 * time.Millisecond
 	return dir, config
 }

consul/servers/router_test.go

@@ -58,6 +58,7 @@ func (m *mockCluster) AddMember(dc string, name string, coord *coordinate.Coordi
 			"dc":    dc,
 			"role":  "consul",
 			"port":  "8300",
+			"build": "0.8.0",
 			"vsn":   "3",
 		},
 	}

consul/state/autopilot.go

@@ -7,6 +7,30 @@ import (
 	"github.com/hashicorp/go-memdb"
 )
 
+// Autopilot is used to pull the autopilot config from the snapshot.
+func (s *StateSnapshot) Autopilot() (*structs.AutopilotConfig, error) {
+	c, err := s.tx.First("autopilot-config", "id")
+	if err != nil {
+		return nil, err
+	}
+
+	config, ok := c.(*structs.AutopilotConfig)
+	if !ok {
+		return nil, nil
+	}
+
+	return config, nil
+}
+
+// Autopilot is used when restoring from a snapshot.
+func (s *StateRestore) Autopilot(config *structs.AutopilotConfig) error {
+	if err := s.tx.Insert("autopilot-config", config); err != nil {
+		return fmt.Errorf("failed restoring autopilot config: %s", err)
+	}
+
+	return nil
+}
+
 // AutopilotConfig is used to get the current Autopilot configuration.
 func (s *StateStore) AutopilotConfig() (uint64, *structs.AutopilotConfig, error) {
 	tx := s.db.Txn(false)

consul/state/prepared_query.go

@@ -58,7 +58,7 @@ func (s *StateSnapshot) PreparedQueries() (structs.PreparedQueries, error) {
 	return ret, nil
 }
 
-// PrepparedQuery is used when restoring from a snapshot. For general inserts,
+// PreparedQuery is used when restoring from a snapshot. For general inserts,
 // use PreparedQuerySet.
 func (s *StateRestore) PreparedQuery(query *structs.PreparedQuery) error {
 	// If this is a template, compile it, otherwise leave the compiled

consul/structs/operator.go

@@ -26,6 +26,15 @@ type AutopilotConfig struct {
 	// applicable with Raft protocol version 3 or higher.
 	ServerStabilizationTime time.Duration
 
+	// (Enterprise-only) RedundancyZoneTag is the node tag to use for separating
+	// servers into zones for redundancy. If left blank, this feature will be disabled.
+	RedundancyZoneTag string
+
+	// (Enterprise-only) DisableUpgradeMigration will disable Autopilot's upgrade migration
+	// strategy of waiting until enough newer-versioned servers have been added to the
+	// cluster before promoting them to voters.
+	DisableUpgradeMigration bool
+
 	// RaftIndex stores the create/modify indexes of this configuration.
 	RaftIndex
 }
@@ -117,6 +126,12 @@ type ServerHealth struct {
 	// The status of the SerfHealth check for the server.
 	SerfStatus serf.MemberStatus
 
+	// Version is the Consul version of the server.
+	Version string
+
+	// Leader is whether this server is currently the leader.
+	Leader bool
+
 	// LastContact is the time since this node's last contact with the leader.
 	LastContact time.Duration
 

vendor/github.com/hashicorp/go-version/LICENSE

@@ -0,0 +1,354 @@
+Mozilla Public License, version 2.0
+
+1. Definitions
+
+1.1. “Contributor”
+
+     means each individual or legal entity that creates, contributes to the
+     creation of, or owns Covered Software.
+
+1.2. “Contributor Version”
+
+     means the combination of the Contributions of others (if any) used by a
+     Contributor and that particular Contributor’s Contribution.
+
+1.3. “Contribution”
+
+     means Covered Software of a particular Contributor.
+
+1.4. “Covered Software”
+
+     means Source Code Form to which the initial Contributor has attached the
+     notice in Exhibit A, the Executable Form of such Source Code Form, and
+     Modifications of such Source Code Form, in each case including portions
+     thereof.
+
+1.5. “Incompatible With Secondary Licenses”
+     means
+
+     a. that the initial Contributor has attached the notice described in
+        Exhibit B to the Covered Software; or
+
+     b. that the Covered Software was made available under the terms of version
+        1.1 or earlier of the License, but not also under the terms of a
+        Secondary License.
+
+1.6. “Executable Form”
+
+     means any form of the work other than Source Code Form.
+
+1.7. “Larger Work”
+
+     means a work that combines Covered Software with other material, in a separate
+     file or files, that is not Covered Software.
+
+1.8. “License”
+
+     means this document.
+
+1.9. “Licensable”
+
+     means having the right to grant, to the maximum extent possible, whether at the
+     time of the initial grant or subsequently, any and all of the rights conveyed by
+     this License.
+
+1.10. “Modifications”
+
+     means any of the following:
+
+     a. any file in Source Code Form that results from an addition to, deletion
+        from, or modification of the contents of Covered Software; or
+
+     b. any new file in Source Code Form that contains any Covered Software.
+
+1.11. “Patent Claims” of a Contributor
+
+      means any patent claim(s), including without limitation, method, process,
+      and apparatus claims, in any patent Licensable by such Contributor that
+      would be infringed, but for the grant of the License, by the making,
+      using, selling, offering for sale, having made, import, or transfer of
+      either its Contributions or its Contributor Version.
+
+1.12. “Secondary License”
+
+      means either the GNU General Public License, Version 2.0, the GNU Lesser
+      General Public License, Version 2.1, the GNU Affero General Public
+      License, Version 3.0, or any later versions of those licenses.
+
+1.13. “Source Code Form”
+
+      means the form of the work preferred for making modifications.
+
+1.14. “You” (or “Your”)
+
+      means an individual or a legal entity exercising rights under this
+      License. For legal entities, “You” includes any entity that controls, is
+      controlled by, or is under common control with You. For purposes of this
+      definition, “control” means (a) the power, direct or indirect, to cause
+      the direction or management of such entity, whether by contract or
+      otherwise, or (b) ownership of more than fifty percent (50%) of the
+      outstanding shares or beneficial ownership of such entity.
+
+
+2. License Grants and Conditions
+
+2.1. Grants
+
+     Each Contributor hereby grants You a world-wide, royalty-free,
+     non-exclusive license:
+
+     a. under intellectual property rights (other than patent or trademark)
+        Licensable by such Contributor to use, reproduce, make available,
+        modify, display, perform, distribute, and otherwise exploit its
+        Contributions, either on an unmodified basis, with Modifications, or as
+        part of a Larger Work; and
+
+     b. under Patent Claims of such Contributor to make, use, sell, offer for
+        sale, have made, import, and otherwise transfer either its Contributions
+        or its Contributor Version.
+
+2.2. Effective Date
+
+     The licenses granted in Section 2.1 with respect to any Contribution become
+     effective for each Contribution on the date the Contributor first distributes
+     such Contribution.
+
+2.3. Limitations on Grant Scope
+
+     The licenses granted in this Section 2 are the only rights granted under this
+     License. No additional rights or licenses will be implied from the distribution
+     or licensing of Covered Software under this License. Notwithstanding Section
+     2.1(b) above, no patent license is granted by a Contributor:
+
+     a. for any code that a Contributor has removed from Covered Software; or
+
+     b. for infringements caused by: (i) Your and any other third party’s
+        modifications of Covered Software, or (ii) the combination of its
+        Contributions with other software (except as part of its Contributor
+        Version); or
+
+     c. under Patent Claims infringed by Covered Software in the absence of its
+        Contributions.
+
+     This License does not grant any rights in the trademarks, service marks, or
+     logos of any Contributor (except as may be necessary to comply with the
+     notice requirements in Section 3.4).
+
+2.4. Subsequent Licenses
+
+     No Contributor makes additional grants as a result of Your choice to
+     distribute the Covered Software under a subsequent version of this License
+     (see Section 10.2) or under the terms of a Secondary License (if permitted
+     under the terms of Section 3.3).
+
+2.5. Representation
+
+     Each Contributor represents that the Contributor believes its Contributions
+     are its original creation(s) or it has sufficient rights to grant the
+     rights to its Contributions conveyed by this License.
+
+2.6. Fair Use
+
+     This License is not intended to limit any rights You have under applicable
+     copyright doctrines of fair use, fair dealing, or other equivalents.
+
+2.7. Conditions
+
+     Sections 3.1, 3.2, 3.3, and 3.4 are conditions of the licenses granted in
+     Section 2.1.
+
+
+3. Responsibilities
+
+3.1. Distribution of Source Form
+
+     All distribution of Covered Software in Source Code Form, including any
+     Modifications that You create or to which You contribute, must be under the
+     terms of this License. You must inform recipients that the Source Code Form
+     of the Covered Software is governed by the terms of this License, and how
+     they can obtain a copy of this License. You may not attempt to alter or
+     restrict the recipients’ rights in the Source Code Form.
+
+3.2. Distribution of Executable Form
+
+     If You distribute Covered Software in Executable Form then:
+
+     a. such Covered Software must also be made available in Source Code Form,
+        as described in Section 3.1, and You must inform recipients of the
+        Executable Form how they can obtain a copy of such Source Code Form by
+        reasonable means in a timely manner, at a charge no more than the cost
+        of distribution to the recipient; and
+
+     b. You may distribute such Executable Form under the terms of this License,
+        or sublicense it under different terms, provided that the license for
+        the Executable Form does not attempt to limit or alter the recipients’
+        rights in the Source Code Form under this License.
+
+3.3. Distribution of a Larger Work
+
+     You may create and distribute a Larger Work under terms of Your choice,
+     provided that You also comply with the requirements of this License for the
+     Covered Software. If the Larger Work is a combination of Covered Software
+     with a work governed by one or more Secondary Licenses, and the Covered
+     Software is not Incompatible With Secondary Licenses, this License permits
+     You to additionally distribute such Covered Software under the terms of
+     such Secondary License(s), so that the recipient of the Larger Work may, at
+     their option, further distribute the Covered Software under the terms of
+     either this License or such Secondary License(s).
+
+3.4. Notices
+
+     You may not remove or alter the substance of any license notices (including
+     copyright notices, patent notices, disclaimers of warranty, or limitations
+     of liability) contained within the Source Code Form of the Covered
+     Software, except that You may alter any license notices to the extent
+     required to remedy known factual inaccuracies.
+
+3.5. Application of Additional Terms
+
+     You may choose to offer, and to charge a fee for, warranty, support,
+     indemnity or liability obligations to one or more recipients of Covered
+     Software. However, You may do so only on Your own behalf, and not on behalf
+     of any Contributor. You must make it absolutely clear that any such
+     warranty, support, indemnity, or liability obligation is offered by You
+     alone, and You hereby agree to indemnify every Contributor for any
+     liability incurred by such Contributor as a result of warranty, support,
+     indemnity or liability terms You offer. You may include additional
+     disclaimers of warranty and limitations of liability specific to any
+     jurisdiction.
+
+4. Inability to Comply Due to Statute or Regulation
+
+   If it is impossible for You to comply with any of the terms of this License
+   with respect to some or all of the Covered Software due to statute, judicial
+   order, or regulation then You must: (a) comply with the terms of this License
+   to the maximum extent possible; and (b) describe the limitations and the code
+   they affect. Such description must be placed in a text file included with all
+   distributions of the Covered Software under this License. Except to the
+   extent prohibited by statute or regulation, such description must be
+   sufficiently detailed for a recipient of ordinary skill to be able to
+   understand it.
+
+5. Termination
+
+5.1. The rights granted under this License will terminate automatically if You
+     fail to comply with any of its terms. However, if You become compliant,
+     then the rights granted under this License from a particular Contributor
+     are reinstated (a) provisionally, unless and until such Contributor
+     explicitly and finally terminates Your grants, and (b) on an ongoing basis,
+     if such Contributor fails to notify You of the non-compliance by some
+     reasonable means prior to 60 days after You have come back into compliance.
+     Moreover, Your grants from a particular Contributor are reinstated on an
+     ongoing basis if such Contributor notifies You of the non-compliance by
+     some reasonable means, this is the first time You have received notice of
+     non-compliance with this License from such Contributor, and You become
+     compliant prior to 30 days after Your receipt of the notice.
+
+5.2. If You initiate litigation against any entity by asserting a patent
+     infringement claim (excluding declaratory judgment actions, counter-claims,
+     and cross-claims) alleging that a Contributor Version directly or
+     indirectly infringes any patent, then the rights granted to You by any and
+     all Contributors for the Covered Software under Section 2.1 of this License
+     shall terminate.
+
+5.3. In the event of termination under Sections 5.1 or 5.2 above, all end user
+     license agreements (excluding distributors and resellers) which have been
+     validly granted by You or Your distributors under this License prior to
+     termination shall survive termination.
+
+6. Disclaimer of Warranty
+
+   Covered Software is provided under this License on an “as is” basis, without
+   warranty of any kind, either expressed, implied, or statutory, including,
+   without limitation, warranties that the Covered Software is free of defects,
+   merchantable, fit for a particular purpose or non-infringing. The entire
+   risk as to the quality and performance of the Covered Software is with You.
+   Should any Covered Software prove defective in any respect, You (not any
+   Contributor) assume the cost of any necessary servicing, repair, or
+   correction. This disclaimer of warranty constitutes an essential part of this
+   License. No use of  any Covered Software is authorized under this License
+   except under this disclaimer.
+
+7. Limitation of Liability
+
+   Under no circumstances and under no legal theory, whether tort (including
+   negligence), contract, or otherwise, shall any Contributor, or anyone who
+   distributes Covered Software as permitted above, be liable to You for any
+   direct, indirect, special, incidental, or consequential damages of any
+   character including, without limitation, damages for lost profits, loss of
+   goodwill, work stoppage, computer failure or malfunction, or any and all
+   other commercial damages or losses, even if such party shall have been
+   informed of the possibility of such damages. This limitation of liability
+   shall not apply to liability for death or personal injury resulting from such
+   party’s negligence to the extent applicable law prohibits such limitation.
+   Some jurisdictions do not allow the exclusion or limitation of incidental or
+   consequential damages, so this exclusion and limitation may not apply to You.
+
+8. Litigation
+
+   Any litigation relating to this License may be brought only in the courts of
+   a jurisdiction where the defendant maintains its principal place of business
+   and such litigation shall be governed by laws of that jurisdiction, without
+   reference to its conflict-of-law provisions. Nothing in this Section shall
+   prevent a party’s ability to bring cross-claims or counter-claims.
+
+9. Miscellaneous
+
+   This License represents the complete agreement concerning the subject matter
+   hereof. If any provision of this License is held to be unenforceable, such
+   provision shall be reformed only to the extent necessary to make it
+   enforceable. Any law or regulation which provides that the language of a
+   contract shall be construed against the drafter shall not be used to construe
+   this License against a Contributor.
+
+
+10. Versions of the License
+
+10.1. New Versions
+
+      Mozilla Foundation is the license steward. Except as provided in Section
+      10.3, no one other than the license steward has the right to modify or
+      publish new versions of this License. Each version will be given a
+      distinguishing version number.
+
+10.2. Effect of New Versions
+
+      You may distribute the Covered Software under the terms of the version of
+      the License under which You originally received the Covered Software, or
+      under the terms of any subsequent version published by the license
+      steward.
+
+10.3. Modified Versions
+
+      If you create software not governed by this License, and you want to
+      create a new license for such software, you may create and use a modified
+      version of this License if you rename the license and remove any
+      references to the name of the license steward (except to note that such
+      modified license differs from this License).
+
+10.4. Distributing Source Code Form that is Incompatible With Secondary Licenses
+      If You choose to distribute Source Code Form that is Incompatible With
+      Secondary Licenses under the terms of this version of the License, the
+      notice described in Exhibit B of this License must be attached.
+
+Exhibit A - Source Code Form License Notice
+
+      This Source Code Form is subject to the
+      terms of the Mozilla Public License, v.
+      2.0. If a copy of the MPL was not
+      distributed with this file, You can
+      obtain one at
+      http://mozilla.org/MPL/2.0/.
+
+If it is not possible or desirable to put the notice in a particular file, then
+You may include the notice in a location (such as a LICENSE file in a relevant
+directory) where a recipient would be likely to look for such a notice.
+
+You may add additional accurate notices of copyright ownership.
+
+Exhibit B - “Incompatible With Secondary Licenses” Notice
+
+      This Source Code Form is “Incompatible
+      With Secondary Licenses”, as defined by
+      the Mozilla Public License, v. 2.0.
+

vendor/github.com/hashicorp/go-version/README.md

@@ -0,0 +1,65 @@
+# Versioning Library for Go
+[![Build Status](https://travis-ci.org/hashicorp/go-version.svg?branch=master)](https://travis-ci.org/hashicorp/go-version)
+
+go-version is a library for parsing versions and version constraints,
+and verifying versions against a set of constraints. go-version
+can sort a collection of versions properly, handles prerelease/beta
+versions, can increment versions, etc.
+
+Versions used with go-version must follow [SemVer](http://semver.org/).
+
+## Installation and Usage
+
+Package documentation can be found on
+[GoDoc](http://godoc.org/github.com/hashicorp/go-version).
+
+Installation can be done with a normal `go get`:
+
+```
+$ go get github.com/hashicorp/go-version
+```
+
+#### Version Parsing and Comparison
+
+```go
+v1, err := version.NewVersion("1.2")
+v2, err := version.NewVersion("1.5+metadata")
+
+// Comparison example. There is also GreaterThan, Equal, and just
+// a simple Compare that returns an int allowing easy >=, <=, etc.
+if v1.LessThan(v2) {
+    fmt.Printf("%s is less than %s", v1, v2)
+}
+```
+
+#### Version Constraints
+
+```go
+v1, err := version.NewVersion("1.2")
+
+// Constraints example.
+constraints, err := version.NewConstraint(">= 1.0, < 1.4")
+if constraints.Check(v1) {
+	fmt.Printf("%s satisfies constraints %s", v1, constraints)
+}
+```
+
+#### Version Sorting
+
+```go
+versionsRaw := []string{"1.1", "0.7.1", "1.4-beta", "1.4", "2"}
+versions := make([]*version.Version, len(versionsRaw))
+for i, raw := range versionsRaw {
+    v, _ := version.NewVersion(raw)
+    versions[i] = v
+}
+
+// After this, the versions are properly sorted
+sort.Sort(version.Collection(versions))
+```
+
+## Issues and Contributing
+
+If you find an issue with this library, please report an issue. If you'd
+like, we welcome any contributions. Fork this library and submit a pull
+request.

vendor/github.com/hashicorp/go-version/constraint.go

@@ -0,0 +1,178 @@
+package version
+
+import (
+	"fmt"
+	"regexp"
+	"strings"
+)
+
+// Constraint represents a single constraint for a version, such as
+// ">= 1.0".
+type Constraint struct {
+	f        constraintFunc
+	check    *Version
+	original string
+}
+
+// Constraints is a slice of constraints. We make a custom type so that
+// we can add methods to it.
+type Constraints []*Constraint
+
+type constraintFunc func(v, c *Version) bool
+
+var constraintOperators map[string]constraintFunc
+
+var constraintRegexp *regexp.Regexp
+
+func init() {
+	constraintOperators = map[string]constraintFunc{
+		"":   constraintEqual,
+		"=":  constraintEqual,
+		"!=": constraintNotEqual,
+		">":  constraintGreaterThan,
+		"<":  constraintLessThan,
+		">=": constraintGreaterThanEqual,
+		"<=": constraintLessThanEqual,
+		"~>": constraintPessimistic,
+	}
+
+	ops := make([]string, 0, len(constraintOperators))
+	for k := range constraintOperators {
+		ops = append(ops, regexp.QuoteMeta(k))
+	}
+
+	constraintRegexp = regexp.MustCompile(fmt.Sprintf(
+		`^\s*(%s)\s*(%s)\s*$`,
+		strings.Join(ops, "|"),
+		VersionRegexpRaw))
+}
+
+// NewConstraint will parse one or more constraints from the given
+// constraint string. The string must be a comma-separated list of
+// constraints.
+func NewConstraint(v string) (Constraints, error) {
+	vs := strings.Split(v, ",")
+	result := make([]*Constraint, len(vs))
+	for i, single := range vs {
+		c, err := parseSingle(single)
+		if err != nil {
+			return nil, err
+		}
+
+		result[i] = c
+	}
+
+	return Constraints(result), nil
+}
+
+// Check tests if a version satisfies all the constraints.
+func (cs Constraints) Check(v *Version) bool {
+	for _, c := range cs {
+		if !c.Check(v) {
+			return false
+		}
+	}
+
+	return true
+}
+
+// Returns the string format of the constraints
+func (cs Constraints) String() string {
+	csStr := make([]string, len(cs))
+	for i, c := range cs {
+		csStr[i] = c.String()
+	}
+
+	return strings.Join(csStr, ",")
+}
+
+// Check tests if a constraint is validated by the given version.
+func (c *Constraint) Check(v *Version) bool {
+	return c.f(v, c.check)
+}
+
+func (c *Constraint) String() string {
+	return c.original
+}
+
+func parseSingle(v string) (*Constraint, error) {
+	matches := constraintRegexp.FindStringSubmatch(v)
+	if matches == nil {
+		return nil, fmt.Errorf("Malformed constraint: %s", v)
+	}
+
+	check, err := NewVersion(matches[2])
+	if err != nil {
+		return nil, err
+	}
+
+	return &Constraint{
+		f:        constraintOperators[matches[1]],
+		check:    check,
+		original: v,
+	}, nil
+}
+
+//-------------------------------------------------------------------
+// Constraint functions
+//-------------------------------------------------------------------
+
+func constraintEqual(v, c *Version) bool {
+	return v.Equal(c)
+}
+
+func constraintNotEqual(v, c *Version) bool {
+	return !v.Equal(c)
+}
+
+func constraintGreaterThan(v, c *Version) bool {
+	return v.Compare(c) == 1
+}
+
+func constraintLessThan(v, c *Version) bool {
+	return v.Compare(c) == -1
+}
+
+func constraintGreaterThanEqual(v, c *Version) bool {
+	return v.Compare(c) >= 0
+}
+
+func constraintLessThanEqual(v, c *Version) bool {
+	return v.Compare(c) <= 0
+}
+
+func constraintPessimistic(v, c *Version) bool {
+	// If the version being checked is naturally less than the constraint, then there
+	// is no way for the version to be valid against the constraint
+	if v.LessThan(c) {
+		return false
+	}
+	// We'll use this more than once, so grab the length now so it's a little cleaner
+	// to write the later checks
+	cs := len(c.segments)
+
+	// If the version being checked has less specificity than the constraint, then there
+	// is no way for the version to be valid against the constraint
+	if cs > len(v.segments) {
+		return false
+	}
+
+	// Check the segments in the constraint against those in the version. If the version
+	// being checked, at any point, does not have the same values in each index of the
+	// constraints segments, then it cannot be valid against the constraint.
+	for i := 0; i < c.si-1; i++ {
+		if v.segments[i] != c.segments[i] {
+			return false
+		}
+	}
+
+	// Check the last part of the segment in the constraint. If the version segment at
+	// this index is less than the constraints segment at this index, then it cannot
+	// be valid against the constraint
+	if c.segments[cs-1] > v.segments[cs-1] {
+		return false
+	}
+
+	// If nothing has rejected the version by now, it's valid
+	return true
+}

vendor/github.com/hashicorp/go-version/version.go

@@ -0,0 +1,322 @@
+package version
+
+import (
+	"bytes"
+	"fmt"
+	"reflect"
+	"regexp"
+	"strconv"
+	"strings"
+)
+
+// The compiled regular expression used to test the validity of a version.
+var versionRegexp *regexp.Regexp
+
+// The raw regular expression string used for testing the validity
+// of a version.
+const VersionRegexpRaw string = `v?([0-9]+(\.[0-9]+)*?)` +
+	`(-?([0-9A-Za-z\-]+(\.[0-9A-Za-z\-]+)*))?` +
+	`(\+([0-9A-Za-z\-]+(\.[0-9A-Za-z\-]+)*))?` +
+	`?`
+
+// Version represents a single version.
+type Version struct {
+	metadata string
+	pre      string
+	segments []int64
+	si       int
+}
+
+func init() {
+	versionRegexp = regexp.MustCompile("^" + VersionRegexpRaw + "$")
+}
+
+// NewVersion parses the given version and returns a new
+// Version.
+func NewVersion(v string) (*Version, error) {
+	matches := versionRegexp.FindStringSubmatch(v)
+	if matches == nil {
+		return nil, fmt.Errorf("Malformed version: %s", v)
+	}
+	segmentsStr := strings.Split(matches[1], ".")
+	segments := make([]int64, len(segmentsStr))
+	si := 0
+	for i, str := range segmentsStr {
+		val, err := strconv.ParseInt(str, 10, 64)
+		if err != nil {
+			return nil, fmt.Errorf(
+				"Error parsing version: %s", err)
+		}
+
+		segments[i] = int64(val)
+		si++
+	}
+
+	// Even though we could support more than three segments, if we
+	// got less than three, pad it with 0s. This is to cover the basic
+	// default usecase of semver, which is MAJOR.MINOR.PATCH at the minimum
+	for i := len(segments); i < 3; i++ {
+		segments = append(segments, 0)
+	}
+
+	return &Version{
+		metadata: matches[7],
+		pre:      matches[4],
+		segments: segments,
+		si:       si,
+	}, nil
+}
+
+// Must is a helper that wraps a call to a function returning (*Version, error)
+// and panics if error is non-nil.
+func Must(v *Version, err error) *Version {
+	if err != nil {
+		panic(err)
+	}
+
+	return v
+}
+
+// Compare compares this version to another version. This
+// returns -1, 0, or 1 if this version is smaller, equal,
+// or larger than the other version, respectively.
+//
+// If you want boolean results, use the LessThan, Equal,
+// or GreaterThan methods.
+func (v *Version) Compare(other *Version) int {
+	// A quick, efficient equality check
+	if v.String() == other.String() {
+		return 0
+	}
+
+	segmentsSelf := v.Segments64()
+	segmentsOther := other.Segments64()
+
+	// If the segments are the same, we must compare on prerelease info
+	if reflect.DeepEqual(segmentsSelf, segmentsOther) {
+		preSelf := v.Prerelease()
+		preOther := other.Prerelease()
+		if preSelf == "" && preOther == "" {
+			return 0
+		}
+		if preSelf == "" {
+			return 1
+		}
+		if preOther == "" {
+			return -1
+		}
+
+		return comparePrereleases(preSelf, preOther)
+	}
+
+	// Get the highest specificity (hS), or if they're equal, just use segmentSelf length
+	lenSelf := len(segmentsSelf)
+	lenOther := len(segmentsOther)
+	hS := lenSelf
+	if lenSelf < lenOther {
+		hS = lenOther
+	}
+	// Compare the segments
+	// Because a constraint could have more/less specificity than the version it's
+	// checking, we need to account for a lopsided or jagged comparison
+	for i := 0; i < hS; i++ {
+		if i > lenSelf-1 {
+			// This means Self had the lower specificity
+			// Check to see if the remaining segments in Other are all zeros
+			if !allZero(segmentsOther[i:]) {
+				// if not, it means that Other has to be greater than Self
+				return -1
+			}
+			break
+		} else if i > lenOther-1 {
+			// this means Other had the lower specificity
+			// Check to see if the remaining segments in Self are all zeros -
+			if !allZero(segmentsSelf[i:]) {
+				//if not, it means that Self has to be greater than Other
+				return 1
+			}
+			break
+		}
+		lhs := segmentsSelf[i]
+		rhs := segmentsOther[i]
+		if lhs == rhs {
+			continue
+		} else if lhs < rhs {
+			return -1
+		}
+		// Otherwis, rhs was > lhs, they're not equal
+		return 1
+	}
+
+	// if we got this far, they're equal
+	return 0
+}
+
+func allZero(segs []int64) bool {
+	for _, s := range segs {
+		if s != 0 {
+			return false
+		}
+	}
+	return true
+}
+
+func comparePart(preSelf string, preOther string) int {
+	if preSelf == preOther {
+		return 0
+	}
+
+	selfNumeric := true
+	_, err := strconv.ParseInt(preSelf, 10, 64)
+	if err != nil {
+		selfNumeric = false
+	}
+
+	otherNumeric := true
+	_, err = strconv.ParseInt(preOther, 10, 64)
+	if err != nil {
+		otherNumeric = false
+	}
+
+	// if a part is empty, we use the other to decide
+	if preSelf == "" {
+		if otherNumeric {
+			return -1
+		}
+		return 1
+	}
+
+	if preOther == "" {
+		if selfNumeric {
+			return 1
+		}
+		return -1
+	}
+
+	if selfNumeric && !otherNumeric {
+		return -1
+	} else if !selfNumeric && otherNumeric {
+		return 1
+	} else if preSelf > preOther {
+		return 1
+	}
+
+	return -1
+}
+
+func comparePrereleases(v string, other string) int {
+	// the same pre release!
+	if v == other {
+		return 0
+	}
+
+	// split both pre releases for analyse their parts
+	selfPreReleaseMeta := strings.Split(v, ".")
+	otherPreReleaseMeta := strings.Split(other, ".")
+
+	selfPreReleaseLen := len(selfPreReleaseMeta)
+	otherPreReleaseLen := len(otherPreReleaseMeta)
+
+	biggestLen := otherPreReleaseLen
+	if selfPreReleaseLen > otherPreReleaseLen {
+		biggestLen = selfPreReleaseLen
+	}
+
+	// loop for parts to find the first difference
+	for i := 0; i < biggestLen; i = i + 1 {
+		partSelfPre := ""
+		if i < selfPreReleaseLen {
+			partSelfPre = selfPreReleaseMeta[i]
+		}
+
+		partOtherPre := ""
+		if i < otherPreReleaseLen {
+			partOtherPre = otherPreReleaseMeta[i]
+		}
+
+		compare := comparePart(partSelfPre, partOtherPre)
+		// if parts are equals, continue the loop
+		if compare != 0 {
+			return compare
+		}
+	}
+
+	return 0
+}
+
+// Equal tests if two versions are equal.
+func (v *Version) Equal(o *Version) bool {
+	return v.Compare(o) == 0
+}
+
+// GreaterThan tests if this version is greater than another version.
+func (v *Version) GreaterThan(o *Version) bool {
+	return v.Compare(o) > 0
+}
+
+// LessThan tests if this version is less than another version.
+func (v *Version) LessThan(o *Version) bool {
+	return v.Compare(o) < 0
+}
+
+// Metadata returns any metadata that was part of the version
+// string.
+//
+// Metadata is anything that comes after the "+" in the version.
+// For example, with "1.2.3+beta", the metadata is "beta".
+func (v *Version) Metadata() string {
+	return v.metadata
+}
+
+// Prerelease returns any prerelease data that is part of the version,
+// or blank if there is no prerelease data.
+//
+// Prerelease information is anything that comes after the "-" in the
+// version (but before any metadata). For example, with "1.2.3-beta",
+// the prerelease information is "beta".
+func (v *Version) Prerelease() string {
+	return v.pre
+}
+
+// Segments returns the numeric segments of the version as a slice of ints.
+//
+// This excludes any metadata or pre-release information. For example,
+// for a version "1.2.3-beta", segments will return a slice of
+// 1, 2, 3.
+func (v *Version) Segments() []int {
+	segmentSlice := make([]int, len(v.segments))
+	for i, v := range v.segments {
+		segmentSlice[i] = int(v)
+	}
+	return segmentSlice
+}
+
+// Segments64 returns the numeric segments of the version as a slice of int64s.
+//
+// This excludes any metadata or pre-release information. For example,
+// for a version "1.2.3-beta", segments will return a slice of
+// 1, 2, 3.
+func (v *Version) Segments64() []int64 {
+	return v.segments
+}
+
+// String returns the full version string included pre-release
+// and metadata information.
+func (v *Version) String() string {
+	var buf bytes.Buffer
+	fmtParts := make([]string, len(v.segments))
+	for i, s := range v.segments {
+		// We can ignore err here since we've pre-parsed the values in segments
+		str := strconv.FormatInt(s, 10)
+		fmtParts[i] = str
+	}
+	fmt.Fprintf(&buf, strings.Join(fmtParts, "."))
+	if v.pre != "" {
+		fmt.Fprintf(&buf, "-%s", v.pre)
+	}
+	if v.metadata != "" {
+		fmt.Fprintf(&buf, "+%s", v.metadata)
+	}
+
+	return buf.String()
+}

vendor/github.com/hashicorp/go-version/version_collection.go

@@ -0,0 +1,17 @@
+package version
+
+// Collection is a type that implements the sort.Interface interface
+// so that versions can be sorted.
+type Collection []*Version
+
+func (v Collection) Len() int {
+	return len(v)
+}
+
+func (v Collection) Less(i, j int) bool {
+	return v[i].LessThan(v[j])
+}
+
+func (v Collection) Swap(i, j int) {
+	v[i], v[j] = v[j], v[i]
+}

vendor/vendor.json

@@ -503,6 +503,12 @@
 			"revision": "64130c7a86d732268a38cb04cfbaf0cc987fda98",
 			"revisionTime": "2016-07-17T02:21:40Z"
 		},
+		{
+			"checksumSHA1": "tUGxc7rfX0cmhOOUDhMuAZ9rWsA=",
+			"path": "github.com/hashicorp/go-version",
+			"revision": "03c5bf6be031b6dd45afec16b1cf94fc8938bc77",
+			"revisionTime": "2017-02-02T08:07:59Z"
+		},
 		{
 			"checksumSHA1": "d9PxF1XQGLMJZRct2R8qVM/eYlE=",
 			"path": "github.com/hashicorp/golang-lru",

website/source/docs/agent/http/operator.html.markdown

@@ -292,6 +292,8 @@ A JSON body is returned that looks like this:
     "LastContactThreshold": "200ms",
     "MaxTrailingLogs": 250,
     "ServerStabilizationTime": "10s",
+    "RedundancyZoneTag": "",
+    "DisableUpgradeMigration": false,
     "CreateIndex": 4,
     "ModifyIndex": 4
 }
@@ -321,6 +323,8 @@ body must look like:
     "LastContactThreshold": "200ms",
     "MaxTrailingLogs": 250,
     "ServerStabilizationTime": "10s",
+    "RedundancyZoneTag": "",
+    "DisableUpgradeMigration": false,
     "CreateIndex": 4,
     "ModifyIndex": 4
 }
@@ -362,6 +366,8 @@ A JSON body is returned that looks like this:
             "Name": "node1",
             "Address": "127.0.0.1:8300",
             "SerfStatus": "alive",
+            "Version": "0.7.4",
+            "Leader": true,
             "LastContact": "0s",
             "LastTerm": 2,
             "LastIndex": 46,
@@ -374,6 +380,8 @@ A JSON body is returned that looks like this:
             "Name": "node2",
             "Address": "127.0.0.1:8205",
             "SerfStatus": "alive",
+            "Version": "0.7.4",
+            "Leader": false,
             "LastContact": "27.291304ms",
             "LastTerm": 2,
             "LastIndex": 46,
@@ -400,6 +408,10 @@ The `Servers` list holds detailed health information on each server:
 
 - `SerfStatus` is the SerfHealth check status for the server.
 
+- `Version` is the Consul version of the server.
+
+- `Leader` is whether this server is currently the leader.
+
 - `LastContact` is the time elapsed since this server's last contact with the leader.
 
 - `LastTerm` is the server's last known Raft leader term.

website/source/docs/agent/options.html.markdown

@@ -335,6 +335,11 @@ will exit with an error at startup.
   participate in a WAN gossip pool with server nodes in other datacenters. Servers act as gateways
   to other datacenters and forward traffic as appropriate.
 
+* <a name="_non_voting_server"></a><a href="#_non_voting_server">`-non-voting-server`</a> - (Enterprise-only)
+  This flag is used to make the server not participate in the Raft quorum, and have it only receive the data
+  replication stream. This can be used to add read scalability to a cluster in cases where a high volume of
+  reads to servers are needed.
+
 * <a name="_syslog"></a><a href="#_syslog">`-syslog`</a> - This flag enables logging to syslog. This
   is only supported on Linux and OSX. It will result in an error if provided on Windows.
 
@@ -580,6 +585,16 @@ Consul will not enable TLS for the HTTP API unless the `https` port has been ass
   cluster. Only takes effect if all servers are running Raft protocol version 3 or higher. Must be a duration value
   such as `30s`. Defaults to `10s`.
 
+  * <a name="redundancy_zone_tag"></a><a href="#redundancy_zone_tag">`redundancy_zone_tag`</a> - (Enterprise-only)
+  This controls the [`-node-meta`](#_node_meta) key to use when Autopilot is separating servers into zones for
+  redundancy. Only one server in each zone can be a voting member at one time. If left blank (the default), this
+  feature will be disabled.
+
+  * <a name="disable_upgrade_migration"></a><a href="#disable_upgrade_migration">`disable_upgrade_migration`</a> - (Enterprise-only)
+  If set to `true`, this setting will disable Autopilot's upgrade migration strategy in Consul Enterprise of waiting
+  until enough newer-versioned servers have been added to the cluster before promoting any of them to voters. Defaults
+  to `false`.
+
 * <a name="bootstrap"></a><a href="#bootstrap">`bootstrap`</a> Equivalent to the
   [`-bootstrap` command-line flag](#_bootstrap).
 

website/source/docs/commands/operator/autopilot.html.markdown.erb

@@ -43,6 +43,8 @@ CleanupDeadServers = true
 LastContactThreshold = 200ms
 MaxTrailingLogs = 250
 ServerStabilizationTime = 10s
+RedundancyZoneTag = ""
+DisableUpgradeMigration = false
 ```
 
 ## set-config
@@ -61,16 +63,22 @@ Usage: `consul operator autopilot set-config [options]`
 * `-cleanup-dead-servers` - Specifies whether to enable automatic removal of dead servers
 upon the successful joining of new servers to the cluster. Must be one of `[true|false]`.
 
-* `last-contact-threshold` - Controls the maximum amount of time a server can go without contact
+* `-last-contact-threshold` - Controls the maximum amount of time a server can go without contact
 from the leader before being considered unhealthy. Must be a duration value such as `200ms`.
 
-* `max-trailing-logs` - Controls the maximum number of log entries that a server can trail
+* `-max-trailing-logs` - Controls the maximum number of log entries that a server can trail
 the leader by before being considered unhealthy.
 
-* `server-stabilization-time` - Controls the minimum amount of time a server must be stable in
+* `-server-stabilization-time` - Controls the minimum amount of time a server must be stable in
 the 'healthy' state before being added to the cluster. Only takes effect if all servers are
 running Raft protocol version 3 or higher. Must be a duration value such as `10s`.
 
+* `-disable-upgrade-migration` - (Enterprise-only) Controls whether Consul will avoid promoting
+new servers until it can perform a migration. Must be one of `[true|false]`.
+
+* `-redundancy-zone-tag`- (Enterprise-only) Controls the [`-node-meta`](/docs/agent/options.html#_node_meta)
+key name used for separating servers into different redundancy zones.
+
 The output looks like this:
 
 ```