2023-03-28 18:39:22 +00:00
|
|
|
// Copyright (c) HashiCorp, Inc.
|
|
|
|
// SPDX-License-Identifier: MPL-2.0
|
|
|
|
|
2018-10-03 12:36:38 +00:00
|
|
|
package proxycfg
|
|
|
|
|
|
|
|
import (
|
2019-06-18 00:52:01 +00:00
|
|
|
"context"
|
2020-04-16 23:24:11 +00:00
|
|
|
"fmt"
|
2021-02-08 16:19:57 +00:00
|
|
|
"sort"
|
2021-10-22 21:22:55 +00:00
|
|
|
"strings"
|
2020-04-16 23:24:11 +00:00
|
|
|
|
2021-11-01 20:43:44 +00:00
|
|
|
"github.com/hashicorp/consul/acl"
|
2023-02-13 19:18:05 +00:00
|
|
|
"github.com/hashicorp/consul/agent/connect"
|
2023-02-09 17:58:55 +00:00
|
|
|
"github.com/hashicorp/consul/agent/consul/discoverychain"
|
2022-07-13 16:14:57 +00:00
|
|
|
"github.com/hashicorp/consul/agent/proxycfg/internal/watch"
|
2021-04-06 18:19:59 +00:00
|
|
|
"github.com/hashicorp/consul/agent/structs"
|
2022-06-01 20:31:37 +00:00
|
|
|
"github.com/hashicorp/consul/lib"
|
2023-02-17 21:14:46 +00:00
|
|
|
"github.com/hashicorp/consul/proto/private/pbpeering"
|
2018-10-03 12:36:38 +00:00
|
|
|
)
|
|
|
|
|
2020-04-16 21:00:48 +00:00
|
|
|
// TODO(ingress): Can we think of a better for this bag of data?
|
|
|
|
// A shared data structure that contains information about discovered upstreams
|
|
|
|
type ConfigSnapshotUpstreams struct {
|
|
|
|
Leaf *structs.IssuedCert
|
2021-12-13 22:13:33 +00:00
|
|
|
|
2022-03-30 18:43:59 +00:00
|
|
|
MeshConfig *structs.MeshConfigEntry
|
|
|
|
MeshConfigSet bool
|
|
|
|
|
2022-01-20 16:12:04 +00:00
|
|
|
// DiscoveryChain is a map of UpstreamID -> CompiledDiscoveryChain's, and
|
|
|
|
// is used to determine what services could be targeted by this upstream.
|
|
|
|
// We then instantiate watches for those targets.
|
|
|
|
DiscoveryChain map[UpstreamID]*structs.CompiledDiscoveryChain
|
2020-04-16 21:00:48 +00:00
|
|
|
|
2022-01-20 16:12:04 +00:00
|
|
|
// WatchedDiscoveryChains is a map of UpstreamID -> CancelFunc's
|
2021-03-17 19:40:39 +00:00
|
|
|
// in order to cancel any watches when the proxy's configuration is
|
|
|
|
// changed. Ingress gateways and transparent proxies need this because
|
|
|
|
// discovery chain watches are added and removed through the lifecycle
|
|
|
|
// of a single proxycfg state instance.
|
2022-01-20 16:12:04 +00:00
|
|
|
WatchedDiscoveryChains map[UpstreamID]context.CancelFunc
|
2021-03-17 19:40:39 +00:00
|
|
|
|
2022-01-20 16:12:04 +00:00
|
|
|
// WatchedUpstreams is a map of UpstreamID -> (map of TargetID ->
|
2020-04-16 21:00:48 +00:00
|
|
|
// CancelFunc's) in order to cancel any watches when the configuration is
|
|
|
|
// changed.
|
2022-01-20 16:12:04 +00:00
|
|
|
WatchedUpstreams map[UpstreamID]map[string]context.CancelFunc
|
2020-04-16 21:00:48 +00:00
|
|
|
|
2022-01-20 16:12:04 +00:00
|
|
|
// WatchedUpstreamEndpoints is a map of UpstreamID -> (map of
|
2020-04-16 21:00:48 +00:00
|
|
|
// TargetID -> CheckServiceNodes) and is used to determine the backing
|
|
|
|
// endpoints of an upstream.
|
2022-01-20 16:12:04 +00:00
|
|
|
WatchedUpstreamEndpoints map[UpstreamID]map[string]structs.CheckServiceNodes
|
2019-08-05 18:30:35 +00:00
|
|
|
|
2022-06-21 02:47:14 +00:00
|
|
|
// UpstreamPeerTrustBundles is a map of (PeerName -> PeeringTrustBundle).
|
2022-06-01 21:53:52 +00:00
|
|
|
// It is used to store trust bundles for upstream TLS transport sockets.
|
2022-07-13 16:14:57 +00:00
|
|
|
UpstreamPeerTrustBundles watch.Map[PeerName, *pbpeering.PeeringTrustBundle]
|
2022-06-01 21:53:52 +00:00
|
|
|
|
2022-01-20 16:12:04 +00:00
|
|
|
// WatchedGateways is a map of UpstreamID -> (map of GatewayKey.String() ->
|
|
|
|
// CancelFunc) in order to cancel watches for mesh gateways
|
|
|
|
WatchedGateways map[UpstreamID]map[string]context.CancelFunc
|
2020-04-16 21:00:48 +00:00
|
|
|
|
2022-01-20 16:12:04 +00:00
|
|
|
// WatchedGatewayEndpoints is a map of UpstreamID -> (map of
|
|
|
|
// GatewayKey.String() -> CheckServiceNodes) and is used to determine the
|
|
|
|
// backing endpoints of a mesh gateway.
|
|
|
|
WatchedGatewayEndpoints map[UpstreamID]map[string]structs.CheckServiceNodes
|
2021-03-17 19:40:39 +00:00
|
|
|
|
2022-09-27 13:49:28 +00:00
|
|
|
// WatchedLocalGWEndpoints is used to store the backing endpoints of
|
|
|
|
// a local mesh gateway. Currently, this is used by peered upstreams
|
|
|
|
// configured with local mesh gateway mode so that they can watch for
|
|
|
|
// gateway endpoints.
|
|
|
|
//
|
|
|
|
// Note that the string form of GatewayKey is used as the key so empty
|
2023-08-23 16:53:44 +00:00
|
|
|
// fields can be normalized in CE.
|
2022-09-27 13:49:28 +00:00
|
|
|
// GatewayKey.String() -> structs.CheckServiceNodes
|
|
|
|
WatchedLocalGWEndpoints watch.Map[string, structs.CheckServiceNodes]
|
|
|
|
|
2021-03-17 19:40:39 +00:00
|
|
|
// UpstreamConfig is a map to an upstream's configuration.
|
2022-01-20 16:12:04 +00:00
|
|
|
UpstreamConfig map[UpstreamID]*structs.Upstream
|
2021-06-09 20:34:17 +00:00
|
|
|
|
2022-01-28 03:52:26 +00:00
|
|
|
// PassthroughEndpoints is a map of: UpstreamID -> (map of TargetID ->
|
2022-01-28 06:49:06 +00:00
|
|
|
// (set of IP addresses)). It contains the upstream endpoints that
|
|
|
|
// can be dialed directly by a transparent proxy.
|
2022-01-28 03:52:26 +00:00
|
|
|
PassthroughUpstreams map[UpstreamID]map[string]map[string]struct{}
|
2021-12-13 22:13:33 +00:00
|
|
|
|
2022-01-28 06:49:06 +00:00
|
|
|
// PassthroughIndices is a map of: address -> indexedTarget.
|
|
|
|
// It is used to track the modify index associated with a passthrough address.
|
|
|
|
// Tracking this index helps break ties when a single address is shared by
|
|
|
|
// more than one upstream due to a race.
|
|
|
|
PassthroughIndices map[string]indexedTarget
|
|
|
|
|
2021-12-13 22:13:33 +00:00
|
|
|
// IntentionUpstreams is a set of upstreams inferred from intentions.
|
2022-01-20 16:12:04 +00:00
|
|
|
//
|
2021-12-13 22:13:33 +00:00
|
|
|
// This list only applies to proxies registered in 'transparent' mode.
|
2022-01-20 16:12:04 +00:00
|
|
|
IntentionUpstreams map[UpstreamID]struct{}
|
2022-06-03 21:42:50 +00:00
|
|
|
|
2022-07-13 16:14:57 +00:00
|
|
|
// PeeredUpstreams is a set of all upstream targets in a local partition.
|
|
|
|
//
|
|
|
|
// This list only applies to proxies registered in 'transparent' mode.
|
|
|
|
PeeredUpstreams map[UpstreamID]struct{}
|
|
|
|
|
2022-06-03 21:42:50 +00:00
|
|
|
// PeerUpstreamEndpoints is a map of UpstreamID -> (set of IP addresses)
|
|
|
|
// and used to determine the backing endpoints of an upstream in another
|
|
|
|
// peer.
|
2022-07-13 16:14:57 +00:00
|
|
|
PeerUpstreamEndpoints watch.Map[UpstreamID, structs.CheckServiceNodes]
|
|
|
|
|
2022-06-10 21:11:40 +00:00
|
|
|
PeerUpstreamEndpointsUseHostnames map[UpstreamID]struct{}
|
2021-06-09 20:34:17 +00:00
|
|
|
}
|
|
|
|
|
2022-01-28 06:49:06 +00:00
|
|
|
// indexedTarget is used to associate the Raft modify index of a resource
|
|
|
|
// with the corresponding upstream target.
|
|
|
|
type indexedTarget struct {
|
|
|
|
upstreamID UpstreamID
|
|
|
|
targetID string
|
|
|
|
idx uint64
|
|
|
|
}
|
|
|
|
|
2021-10-22 21:22:55 +00:00
|
|
|
type GatewayKey struct {
|
|
|
|
Datacenter string
|
|
|
|
Partition string
|
|
|
|
}
|
|
|
|
|
|
|
|
func (k GatewayKey) String() string {
|
2021-10-23 20:17:29 +00:00
|
|
|
resp := k.Datacenter
|
2022-04-05 21:10:06 +00:00
|
|
|
if !acl.IsDefaultPartition(k.Partition) {
|
2021-10-23 20:17:29 +00:00
|
|
|
resp = k.Partition + "." + resp
|
|
|
|
}
|
|
|
|
return resp
|
2021-10-22 21:22:55 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
func (k GatewayKey) IsEmpty() bool {
|
|
|
|
return k.Partition == "" && k.Datacenter == ""
|
|
|
|
}
|
|
|
|
|
2021-10-24 15:51:55 +00:00
|
|
|
func (k GatewayKey) Matches(dc, partition string) bool {
|
2022-04-05 21:10:06 +00:00
|
|
|
return acl.EqualPartitions(k.Partition, partition) && k.Datacenter == dc
|
2021-10-24 15:51:55 +00:00
|
|
|
}
|
|
|
|
|
2021-10-22 21:22:55 +00:00
|
|
|
func gatewayKeyFromString(s string) GatewayKey {
|
2021-10-26 21:32:12 +00:00
|
|
|
split := strings.SplitN(s, ".", 2)
|
2021-10-23 20:17:29 +00:00
|
|
|
|
|
|
|
if len(split) == 1 {
|
2021-11-01 20:43:44 +00:00
|
|
|
return GatewayKey{Datacenter: split[0], Partition: acl.DefaultPartitionName}
|
2021-10-22 21:22:55 +00:00
|
|
|
}
|
2021-10-23 20:17:29 +00:00
|
|
|
return GatewayKey{Partition: split[0], Datacenter: split[1]}
|
2021-10-22 21:22:55 +00:00
|
|
|
}
|
|
|
|
|
2020-04-16 21:00:48 +00:00
|
|
|
type configSnapshotConnectProxy struct {
|
|
|
|
ConfigSnapshotUpstreams
|
|
|
|
|
2022-06-21 02:47:14 +00:00
|
|
|
InboundPeerTrustBundlesSet bool
|
|
|
|
InboundPeerTrustBundles []*pbpeering.PeeringTrustBundle
|
2022-06-01 20:31:37 +00:00
|
|
|
|
2020-04-16 21:00:48 +00:00
|
|
|
WatchedServiceChecks map[structs.ServiceID][]structs.CheckType // TODO: missing garbage collection
|
2022-01-20 16:12:04 +00:00
|
|
|
PreparedQueryEndpoints map[UpstreamID]structs.CheckServiceNodes // DEPRECATED:see:WatchedUpstreamEndpoints
|
2020-08-27 17:20:58 +00:00
|
|
|
|
|
|
|
// NOTE: Intentions stores a list of lists as returned by the Intentions
|
|
|
|
// Match RPC. So far we only use the first list as the list of matching
|
|
|
|
// intentions.
|
2023-04-20 16:16:04 +00:00
|
|
|
Intentions structs.SimplifiedIntentions
|
2020-08-27 17:20:58 +00:00
|
|
|
IntentionsSet bool
|
2022-07-14 18:45:51 +00:00
|
|
|
|
|
|
|
DestinationsUpstream watch.Map[UpstreamID, *structs.ServiceConfigEntry]
|
|
|
|
DestinationGateways watch.Map[UpstreamID, structs.CheckServiceNodes]
|
2019-06-18 00:52:01 +00:00
|
|
|
}
|
|
|
|
|
2022-03-30 18:43:59 +00:00
|
|
|
// isEmpty is a test helper
|
|
|
|
func (c *configSnapshotConnectProxy) isEmpty() bool {
|
2019-10-17 21:46:49 +00:00
|
|
|
if c == nil {
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
return c.Leaf == nil &&
|
2020-08-27 17:20:58 +00:00
|
|
|
!c.IntentionsSet &&
|
2019-10-17 21:46:49 +00:00
|
|
|
len(c.DiscoveryChain) == 0 &&
|
2021-03-17 19:40:39 +00:00
|
|
|
len(c.WatchedDiscoveryChains) == 0 &&
|
2019-10-17 21:46:49 +00:00
|
|
|
len(c.WatchedUpstreams) == 0 &&
|
|
|
|
len(c.WatchedUpstreamEndpoints) == 0 &&
|
2022-07-13 16:14:57 +00:00
|
|
|
c.UpstreamPeerTrustBundles.Len() == 0 &&
|
2019-10-17 21:46:49 +00:00
|
|
|
len(c.WatchedGateways) == 0 &&
|
|
|
|
len(c.WatchedGatewayEndpoints) == 0 &&
|
|
|
|
len(c.WatchedServiceChecks) == 0 &&
|
2021-03-17 19:40:39 +00:00
|
|
|
len(c.PreparedQueryEndpoints) == 0 &&
|
2021-04-06 18:19:59 +00:00
|
|
|
len(c.UpstreamConfig) == 0 &&
|
2021-06-09 20:34:17 +00:00
|
|
|
len(c.PassthroughUpstreams) == 0 &&
|
2021-12-13 22:13:33 +00:00
|
|
|
len(c.IntentionUpstreams) == 0 &&
|
2022-07-14 18:45:51 +00:00
|
|
|
c.DestinationGateways.Len() == 0 &&
|
|
|
|
c.DestinationsUpstream.Len() == 0 &&
|
2022-07-13 16:14:57 +00:00
|
|
|
len(c.PeeredUpstreams) == 0 &&
|
2022-06-21 02:47:14 +00:00
|
|
|
!c.InboundPeerTrustBundlesSet &&
|
2022-06-03 21:42:50 +00:00
|
|
|
!c.MeshConfigSet &&
|
2022-07-13 16:14:57 +00:00
|
|
|
c.PeerUpstreamEndpoints.Len() == 0 &&
|
2022-06-10 21:11:40 +00:00
|
|
|
len(c.PeerUpstreamEndpointsUseHostnames) == 0
|
2019-10-17 21:46:49 +00:00
|
|
|
}
|
|
|
|
|
2022-07-13 20:12:01 +00:00
|
|
|
func (c *configSnapshotConnectProxy) IsImplicitUpstream(uid UpstreamID) bool {
|
|
|
|
_, intentionImplicit := c.IntentionUpstreams[uid]
|
|
|
|
_, peeringImplicit := c.PeeredUpstreams[uid]
|
|
|
|
return intentionImplicit || peeringImplicit
|
|
|
|
}
|
|
|
|
|
2023-01-18 19:43:53 +00:00
|
|
|
func (c *configSnapshotConnectProxy) GetUpstream(uid UpstreamID, entMeta *acl.EnterpriseMeta) (*structs.Upstream, bool) {
|
|
|
|
upstream, found := c.UpstreamConfig[uid]
|
|
|
|
// We should fallback to the wildcard defaults generated from service-defaults + proxy-defaults
|
|
|
|
// whenever we don't find the upstream config.
|
|
|
|
if !found {
|
|
|
|
wildcardUID := NewWildcardUID(entMeta)
|
|
|
|
upstream = c.UpstreamConfig[wildcardUID]
|
|
|
|
}
|
|
|
|
|
|
|
|
explicit := upstream != nil && upstream.HasLocalPortOrSocket()
|
|
|
|
implicit := c.IsImplicitUpstream(uid)
|
|
|
|
return upstream, !implicit && !explicit
|
|
|
|
}
|
|
|
|
|
2020-04-10 18:06:08 +00:00
|
|
|
type configSnapshotTerminatingGateway struct {
|
2022-03-30 18:43:59 +00:00
|
|
|
MeshConfig *structs.MeshConfigEntry
|
|
|
|
MeshConfigSet bool
|
|
|
|
|
2020-06-12 14:57:41 +00:00
|
|
|
// WatchedServices is a map of service name to a cancel function. This cancel
|
2020-04-10 18:06:08 +00:00
|
|
|
// function is tied to the watch of linked service instances for the given
|
|
|
|
// id. If the linked services watch would indicate the removal of
|
|
|
|
// a service altogether we then cancel watching that service for its endpoints.
|
2020-06-12 14:57:41 +00:00
|
|
|
WatchedServices map[structs.ServiceName]context.CancelFunc
|
2020-04-10 18:06:08 +00:00
|
|
|
|
2020-06-12 14:57:41 +00:00
|
|
|
// WatchedIntentions is a map of service name to a cancel function.
|
2020-04-10 18:06:08 +00:00
|
|
|
// This cancel function is tied to the watch of intentions for linked services.
|
|
|
|
// As with WatchedServices, intention watches will be cancelled when services
|
|
|
|
// are no longer linked to the gateway.
|
2020-06-12 14:57:41 +00:00
|
|
|
WatchedIntentions map[structs.ServiceName]context.CancelFunc
|
2020-04-10 18:06:08 +00:00
|
|
|
|
2020-08-27 17:20:58 +00:00
|
|
|
// NOTE: Intentions stores a map of list of lists as returned by the Intentions
|
|
|
|
// Match RPC. So far we only use the first list as the list of matching
|
|
|
|
// intentions.
|
|
|
|
//
|
|
|
|
// A key being present implies that we have gotten at least one watch reply for the
|
|
|
|
// service. This is logically the same as ConnectProxy.IntentionsSet==true
|
2023-04-20 16:16:04 +00:00
|
|
|
Intentions map[structs.ServiceName]structs.SimplifiedIntentions
|
2020-08-27 17:20:58 +00:00
|
|
|
|
2020-06-12 14:57:41 +00:00
|
|
|
// WatchedLeaves is a map of ServiceName to a cancel function.
|
2020-04-10 18:06:08 +00:00
|
|
|
// This cancel function is tied to the watch of leaf certs for linked services.
|
|
|
|
// As with WatchedServices, leaf watches will be cancelled when services
|
|
|
|
// are no longer linked to the gateway.
|
2020-06-12 14:57:41 +00:00
|
|
|
WatchedLeaves map[structs.ServiceName]context.CancelFunc
|
2020-04-10 18:06:08 +00:00
|
|
|
|
2020-06-12 14:57:41 +00:00
|
|
|
// ServiceLeaves is a map of ServiceName to a leaf cert.
|
2020-04-10 18:06:08 +00:00
|
|
|
// Terminating gateways will present different certificates depending
|
|
|
|
// on the service that the caller is trying to reach.
|
2020-06-12 14:57:41 +00:00
|
|
|
ServiceLeaves map[structs.ServiceName]*structs.IssuedCert
|
2020-04-10 18:06:08 +00:00
|
|
|
|
2020-08-27 17:20:58 +00:00
|
|
|
// WatchedConfigs is a map of ServiceName to a cancel function. This cancel
|
|
|
|
// function is tied to the watch of service configs for linked services. As
|
|
|
|
// with WatchedServices, service config watches will be cancelled when
|
|
|
|
// services are no longer linked to the gateway.
|
|
|
|
WatchedConfigs map[structs.ServiceName]context.CancelFunc
|
|
|
|
|
|
|
|
// ServiceConfigs is a map of service name to the resolved service config
|
|
|
|
// for that service.
|
|
|
|
ServiceConfigs map[structs.ServiceName]*structs.ServiceConfigResponse
|
|
|
|
|
2020-06-12 14:57:41 +00:00
|
|
|
// WatchedResolvers is a map of ServiceName to a cancel function.
|
2020-04-14 14:59:23 +00:00
|
|
|
// This cancel function is tied to the watch of resolvers for linked services.
|
|
|
|
// As with WatchedServices, resolver watches will be cancelled when services
|
|
|
|
// are no longer linked to the gateway.
|
2020-06-12 14:57:41 +00:00
|
|
|
WatchedResolvers map[structs.ServiceName]context.CancelFunc
|
2020-04-14 14:59:23 +00:00
|
|
|
|
2020-06-12 14:57:41 +00:00
|
|
|
// ServiceResolvers is a map of service name to an associated
|
2020-04-14 14:59:23 +00:00
|
|
|
// service-resolver config entry for that service.
|
2020-08-27 17:20:58 +00:00
|
|
|
ServiceResolvers map[structs.ServiceName]*structs.ServiceResolverConfigEntry
|
|
|
|
ServiceResolversSet map[structs.ServiceName]bool
|
2020-04-14 14:59:23 +00:00
|
|
|
|
2020-06-12 14:57:41 +00:00
|
|
|
// ServiceGroups is a map of service name to the service instances of that
|
2020-04-10 18:06:08 +00:00
|
|
|
// service in the local datacenter.
|
2020-06-12 14:57:41 +00:00
|
|
|
ServiceGroups map[structs.ServiceName]structs.CheckServiceNodes
|
2020-04-27 22:25:37 +00:00
|
|
|
|
2020-06-12 14:57:41 +00:00
|
|
|
// GatewayServices is a map of service name to the config entry association
|
2020-04-27 22:25:37 +00:00
|
|
|
// between the gateway and a service. TLS configuration stored here is
|
|
|
|
// used for TLS origination from the gateway to the linked service.
|
2022-05-24 16:51:52 +00:00
|
|
|
// This map does not include GatewayServices that represent Endpoints to external
|
|
|
|
// destinations.
|
2020-06-12 14:57:41 +00:00
|
|
|
GatewayServices map[structs.ServiceName]structs.GatewayService
|
2020-06-03 21:28:45 +00:00
|
|
|
|
2022-05-24 16:51:52 +00:00
|
|
|
// DestinationServices is a map of service name to GatewayServices that represent
|
|
|
|
// a destination to an external destination of the service mesh.
|
|
|
|
DestinationServices map[structs.ServiceName]structs.GatewayService
|
|
|
|
|
2020-06-12 14:57:41 +00:00
|
|
|
// HostnameServices is a map of service name to service instances with a hostname as the address.
|
2020-06-03 21:28:45 +00:00
|
|
|
// If hostnames are configured they must be provided to Envoy via CDS not EDS.
|
2020-06-12 14:57:41 +00:00
|
|
|
HostnameServices map[structs.ServiceName]structs.CheckServiceNodes
|
2023-10-05 22:38:57 +00:00
|
|
|
|
|
|
|
// WatchedInboundPeerTrustBundles is a map of service name to a cancel function. This cancel
|
|
|
|
// function is tied to the watch of the inbound peer trust bundles for the gateway.
|
|
|
|
WatchedInboundPeerTrustBundles map[structs.ServiceName]context.CancelFunc
|
|
|
|
|
|
|
|
// InboundPeerTrustBundles is a map of service name to a list of peering trust bundles.
|
|
|
|
// These bundles are used to configure RBAC policies for inbound filter chains on the gateway
|
|
|
|
// from services that are in a cluster-peered datacenter.
|
|
|
|
InboundPeerTrustBundles map[structs.ServiceName][]*pbpeering.PeeringTrustBundle
|
2020-04-10 18:06:08 +00:00
|
|
|
}
|
|
|
|
|
2020-08-27 17:20:58 +00:00
|
|
|
// ValidServices returns the list of service keys that have enough data to be emitted.
|
|
|
|
func (c *configSnapshotTerminatingGateway) ValidServices() []structs.ServiceName {
|
|
|
|
out := make([]structs.ServiceName, 0, len(c.ServiceGroups))
|
|
|
|
for svc := range c.ServiceGroups {
|
|
|
|
// It only counts if ALL of our watches have come back (with data or not).
|
|
|
|
|
|
|
|
// Skip the service if we don't know if there is a resolver or not.
|
|
|
|
if _, ok := c.ServiceResolversSet[svc]; !ok {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
|
|
|
// Skip the service if we don't have a cert to present for mTLS.
|
|
|
|
if cert, ok := c.ServiceLeaves[svc]; !ok || cert == nil {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
|
|
|
// Skip the service if we haven't gotten our intentions yet.
|
|
|
|
if _, intentionsSet := c.Intentions[svc]; !intentionsSet {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
|
|
|
// Skip the service if we haven't gotten our service config yet to know
|
|
|
|
// the protocol.
|
|
|
|
if _, ok := c.ServiceConfigs[svc]; !ok {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
|
|
|
out = append(out, svc)
|
|
|
|
}
|
|
|
|
return out
|
|
|
|
}
|
|
|
|
|
2022-05-24 16:51:52 +00:00
|
|
|
// ValidDestinations returns the list of service keys (that represent exclusively endpoints) that have enough data to be emitted.
|
|
|
|
func (c *configSnapshotTerminatingGateway) ValidDestinations() []structs.ServiceName {
|
|
|
|
out := make([]structs.ServiceName, 0, len(c.DestinationServices))
|
|
|
|
for svc := range c.DestinationServices {
|
|
|
|
// It only counts if ALL of our watches have come back (with data or not).
|
|
|
|
|
|
|
|
// Skip the service if we don't have a cert to present for mTLS.
|
|
|
|
if cert, ok := c.ServiceLeaves[svc]; !ok || cert == nil {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
|
|
|
// Skip the service if we haven't gotten our intentions yet.
|
|
|
|
if _, intentionsSet := c.Intentions[svc]; !intentionsSet {
|
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
|
|
|
// Skip the service if we haven't gotten our service config yet to know
|
|
|
|
// the protocol.
|
2022-07-18 21:10:06 +00:00
|
|
|
if conf, ok := c.ServiceConfigs[svc]; !ok || len(conf.Destination.Addresses) == 0 {
|
2022-05-24 16:51:52 +00:00
|
|
|
continue
|
|
|
|
}
|
|
|
|
|
|
|
|
out = append(out, svc)
|
|
|
|
}
|
|
|
|
return out
|
|
|
|
}
|
|
|
|
|
2022-03-30 18:43:59 +00:00
|
|
|
// isEmpty is a test helper
|
|
|
|
func (c *configSnapshotTerminatingGateway) isEmpty() bool {
|
2020-04-10 18:06:08 +00:00
|
|
|
if c == nil {
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
return len(c.ServiceLeaves) == 0 &&
|
|
|
|
len(c.WatchedLeaves) == 0 &&
|
|
|
|
len(c.WatchedIntentions) == 0 &&
|
2020-08-27 17:20:58 +00:00
|
|
|
len(c.Intentions) == 0 &&
|
2020-04-10 18:06:08 +00:00
|
|
|
len(c.ServiceGroups) == 0 &&
|
2020-04-14 14:59:23 +00:00
|
|
|
len(c.WatchedServices) == 0 &&
|
2020-04-24 00:16:09 +00:00
|
|
|
len(c.ServiceResolvers) == 0 &&
|
2020-08-27 17:20:58 +00:00
|
|
|
len(c.ServiceResolversSet) == 0 &&
|
2020-04-27 22:25:37 +00:00
|
|
|
len(c.WatchedResolvers) == 0 &&
|
2020-08-27 17:20:58 +00:00
|
|
|
len(c.ServiceConfigs) == 0 &&
|
|
|
|
len(c.WatchedConfigs) == 0 &&
|
2020-06-03 21:28:45 +00:00
|
|
|
len(c.GatewayServices) == 0 &&
|
2022-05-24 16:51:52 +00:00
|
|
|
len(c.DestinationServices) == 0 &&
|
2022-03-30 18:43:59 +00:00
|
|
|
len(c.HostnameServices) == 0 &&
|
|
|
|
!c.MeshConfigSet
|
2020-04-10 18:06:08 +00:00
|
|
|
}
|
|
|
|
|
2022-09-26 16:50:17 +00:00
|
|
|
type PeerServersValue struct {
|
|
|
|
Addresses []structs.ServiceAddress
|
|
|
|
Index uint64
|
|
|
|
UseCDS bool
|
|
|
|
}
|
|
|
|
|
2022-10-06 13:54:14 +00:00
|
|
|
type PeeringServiceValue struct {
|
|
|
|
Nodes structs.CheckServiceNodes
|
|
|
|
UseCDS bool
|
|
|
|
}
|
|
|
|
|
2019-06-18 00:52:01 +00:00
|
|
|
type configSnapshotMeshGateway struct {
|
2020-06-12 14:57:41 +00:00
|
|
|
// WatchedServices is a map of service name to a cancel function. This cancel
|
2020-03-09 20:59:02 +00:00
|
|
|
// function is tied to the watch of connect enabled services for the given
|
|
|
|
// id. If the main datacenter services watch would indicate the removal of
|
2020-04-10 18:06:08 +00:00
|
|
|
// a service altogether we then cancel watching that service for its
|
2020-03-09 20:59:02 +00:00
|
|
|
// connect endpoints.
|
2020-06-12 14:57:41 +00:00
|
|
|
WatchedServices map[structs.ServiceName]context.CancelFunc
|
2020-03-09 20:59:02 +00:00
|
|
|
|
|
|
|
// WatchedServicesSet indicates that the watch on the datacenters services
|
|
|
|
// has completed. Even when there are no connect services, this being set
|
|
|
|
// (and the Connect roots being available) will be enough for the config
|
|
|
|
// snapshot to be considered valid. In the case of Envoy, this allows it to
|
|
|
|
// start its listeners even when no services would be proxied and allow its
|
|
|
|
// health check to pass.
|
2019-10-17 21:46:49 +00:00
|
|
|
WatchedServicesSet bool
|
2020-03-09 20:59:02 +00:00
|
|
|
|
2021-10-23 19:19:51 +00:00
|
|
|
// WatchedGateways is a map of GatewayKeys to a cancel function.
|
2020-03-09 20:59:02 +00:00
|
|
|
// This cancel function is tied to the watch of mesh-gateway services in
|
2021-10-23 19:19:51 +00:00
|
|
|
// that datacenter/partition.
|
|
|
|
WatchedGateways map[string]context.CancelFunc
|
2020-03-09 20:59:02 +00:00
|
|
|
|
2020-06-12 14:57:41 +00:00
|
|
|
// ServiceGroups is a map of service name to the service instances of that
|
2020-03-09 20:59:02 +00:00
|
|
|
// service in the local datacenter.
|
2020-06-12 14:57:41 +00:00
|
|
|
ServiceGroups map[structs.ServiceName]structs.CheckServiceNodes
|
2020-03-09 20:59:02 +00:00
|
|
|
|
2022-10-06 13:54:14 +00:00
|
|
|
// PeeringServices is a map of peer name -> (map of
|
|
|
|
// service name -> CheckServiceNodes) and is used to determine the backing
|
|
|
|
// endpoints of a service on a peer.
|
|
|
|
PeeringServices map[string]map[structs.ServiceName]PeeringServiceValue
|
|
|
|
|
|
|
|
// WatchedPeeringServices is a map of peer name -> (map of service name ->
|
|
|
|
// cancel function) and is used to track watches on services within a peer.
|
|
|
|
WatchedPeeringServices map[string]map[structs.ServiceName]context.CancelFunc
|
|
|
|
|
|
|
|
// WatchedPeers is a map of peer name -> cancel functions. It is used to
|
|
|
|
// track watches on peers.
|
|
|
|
WatchedPeers map[string]context.CancelFunc
|
|
|
|
|
2020-06-12 14:57:41 +00:00
|
|
|
// ServiceResolvers is a map of service name to an associated
|
2020-03-09 20:59:02 +00:00
|
|
|
// service-resolver config entry for that service.
|
2020-06-12 14:57:41 +00:00
|
|
|
ServiceResolvers map[structs.ServiceName]*structs.ServiceResolverConfigEntry
|
2020-03-09 20:59:02 +00:00
|
|
|
|
|
|
|
// GatewayGroups is a map of datacenter names to services of kind
|
|
|
|
// mesh-gateway in that datacenter.
|
2020-02-19 16:57:55 +00:00
|
|
|
GatewayGroups map[string]structs.CheckServiceNodes
|
2020-03-09 20:59:02 +00:00
|
|
|
|
|
|
|
// FedStateGateways is a map of datacenter names to mesh gateways in that
|
|
|
|
// datacenter.
|
|
|
|
FedStateGateways map[string]structs.CheckServiceNodes
|
|
|
|
|
2022-09-26 16:50:17 +00:00
|
|
|
// WatchedLocalServers is a map of (structs.ConsulServiceName -> structs.CheckServiceNodes)`
|
2022-09-23 01:24:13 +00:00
|
|
|
// Mesh gateways can spin up watches for local servers both for
|
|
|
|
// WAN federation and for peering. This map ensures we only have one
|
|
|
|
// watch at a time.
|
2022-09-26 16:50:17 +00:00
|
|
|
WatchedLocalServers watch.Map[string, structs.CheckServiceNodes]
|
2020-06-03 21:28:45 +00:00
|
|
|
|
|
|
|
// HostnameDatacenters is a map of datacenters to mesh gateway instances with a hostname as the address.
|
|
|
|
// If hostnames are configured they must be provided to Envoy via CDS not EDS.
|
|
|
|
HostnameDatacenters map[string]structs.CheckServiceNodes
|
2022-06-06 19:20:41 +00:00
|
|
|
|
2022-06-15 19:36:18 +00:00
|
|
|
// ExportedServicesSlice is a sorted slice of services that are exported to
|
|
|
|
// connected peers.
|
2022-06-06 19:20:41 +00:00
|
|
|
ExportedServicesSlice []structs.ServiceName
|
|
|
|
|
2022-06-15 19:36:18 +00:00
|
|
|
// ExportedServicesWithPeers is a map of exported service name to a sorted
|
|
|
|
// slice of peers that they are exported to.
|
2022-06-06 19:20:41 +00:00
|
|
|
ExportedServicesWithPeers map[structs.ServiceName][]string
|
|
|
|
|
2022-06-15 19:36:18 +00:00
|
|
|
// ExportedServicesSet indicates that the watch on the list of
|
|
|
|
// peer-exported services has completed at least once.
|
|
|
|
ExportedServicesSet bool
|
2022-06-06 19:20:41 +00:00
|
|
|
|
2022-06-15 19:36:18 +00:00
|
|
|
// DiscoveryChain is a map of the peer-exported service names to their
|
|
|
|
// local compiled discovery chain. This will be populated regardless of
|
|
|
|
// L4/L7 status of the chain.
|
2022-06-06 19:20:41 +00:00
|
|
|
DiscoveryChain map[structs.ServiceName]*structs.CompiledDiscoveryChain
|
|
|
|
|
2022-06-15 19:36:18 +00:00
|
|
|
// WatchedDiscoveryChains is a map of peer-exported service names to a
|
|
|
|
// cancel function.
|
2022-06-06 19:20:41 +00:00
|
|
|
WatchedDiscoveryChains map[structs.ServiceName]context.CancelFunc
|
2022-06-15 19:36:18 +00:00
|
|
|
|
|
|
|
// MeshConfig is the mesh config entry that should be used for services
|
|
|
|
// fronted by this mesh gateway.
|
|
|
|
MeshConfig *structs.MeshConfigEntry
|
|
|
|
|
|
|
|
// MeshConfigSet indicates that the watch on the mesh config entry has
|
|
|
|
// completed at least once.
|
|
|
|
MeshConfigSet bool
|
|
|
|
|
|
|
|
// Leaf is the leaf cert to be used by this mesh gateway.
|
|
|
|
Leaf *structs.IssuedCert
|
|
|
|
|
|
|
|
// LeafCertWatchCancel is a CancelFunc to use when refreshing this gateway's
|
|
|
|
// leaf cert watch with different parameters.
|
|
|
|
LeafCertWatchCancel context.CancelFunc
|
|
|
|
|
2022-09-26 16:50:17 +00:00
|
|
|
// PeerServers is the map of peering server names to their addresses.
|
|
|
|
PeerServers map[string]PeerServersValue
|
|
|
|
|
|
|
|
// PeerServersWatchCancel is a CancelFunc to use when resetting the watch
|
|
|
|
// on all peerings as it is enabled/disabled.
|
|
|
|
PeerServersWatchCancel context.CancelFunc
|
|
|
|
|
2022-06-15 19:36:18 +00:00
|
|
|
// PeeringTrustBundles is the list of trust bundles for peers where
|
|
|
|
// services have been exported to using this mesh gateway.
|
|
|
|
PeeringTrustBundles []*pbpeering.PeeringTrustBundle
|
|
|
|
|
|
|
|
// PeeringTrustBundlesSet indicates that the watch on the peer trust
|
|
|
|
// bundles has completed at least once.
|
|
|
|
PeeringTrustBundlesSet bool
|
2022-06-06 19:20:41 +00:00
|
|
|
}
|
|
|
|
|
2022-06-28 19:52:25 +00:00
|
|
|
// MeshGatewayValidExportedServices ensures that the following data is present
|
|
|
|
// if it exists for a service before it returns that in the set of services to
|
|
|
|
// expose.
|
|
|
|
//
|
|
|
|
// - peering info
|
|
|
|
// - discovery chain
|
|
|
|
func (c *ConfigSnapshot) MeshGatewayValidExportedServices() []structs.ServiceName {
|
|
|
|
out := make([]structs.ServiceName, 0, len(c.MeshGateway.ExportedServicesSlice))
|
|
|
|
for _, svc := range c.MeshGateway.ExportedServicesSlice {
|
|
|
|
if _, ok := c.MeshGateway.ExportedServicesWithPeers[svc]; !ok {
|
|
|
|
continue // not possible
|
|
|
|
}
|
2022-06-29 15:29:54 +00:00
|
|
|
|
2022-11-08 01:30:15 +00:00
|
|
|
if _, ok := c.MeshGateway.ServiceGroups[svc]; !ok {
|
|
|
|
continue // unregistered services
|
|
|
|
}
|
|
|
|
|
2022-06-29 15:29:54 +00:00
|
|
|
chain, ok := c.MeshGateway.DiscoveryChain[svc]
|
|
|
|
if !ok {
|
2022-06-28 19:52:25 +00:00
|
|
|
continue // ignore; not ready
|
|
|
|
}
|
2022-06-29 15:29:54 +00:00
|
|
|
|
|
|
|
if structs.IsProtocolHTTPLike(chain.Protocol) {
|
|
|
|
if c.MeshGateway.Leaf == nil {
|
|
|
|
continue // ignore; not ready
|
|
|
|
}
|
|
|
|
}
|
2022-06-28 19:52:25 +00:00
|
|
|
out = append(out, svc)
|
|
|
|
}
|
|
|
|
return out
|
|
|
|
}
|
|
|
|
|
|
|
|
func (c *ConfigSnapshot) GetMeshGatewayEndpoints(key GatewayKey) structs.CheckServiceNodes {
|
|
|
|
// Mesh gateways in remote DCs are discovered in two ways:
|
|
|
|
//
|
|
|
|
// 1. Via an Internal.ServiceDump RPC in the remote DC (GatewayGroups).
|
|
|
|
// 2. In the federation state that is replicated from the primary DC (FedStateGateways).
|
|
|
|
//
|
|
|
|
// We determine which set to use based on whichever contains the highest
|
|
|
|
// raft ModifyIndex (and is therefore most up-to-date).
|
|
|
|
//
|
|
|
|
// Previously, GatewayGroups was always given presedence over FedStateGateways
|
|
|
|
// but this was problematic when using mesh gateways for WAN federation.
|
|
|
|
//
|
|
|
|
// Consider the following example:
|
|
|
|
//
|
|
|
|
// - Primary and Secondary DCs are WAN Federated via local mesh gateways.
|
|
|
|
//
|
|
|
|
// - Secondary DC's mesh gateway is running on an ephemeral compute instance
|
|
|
|
// and is abruptly terminated and rescheduled with a *new IP address*.
|
|
|
|
//
|
|
|
|
// - Primary DC's mesh gateway is no longer able to connect to the Secondary
|
|
|
|
// DC as its proxy is configured with the old IP address. Therefore any RPC
|
|
|
|
// from the Primary to the Secondary DC will fail (including the one to
|
|
|
|
// discover the gateway's new IP address).
|
|
|
|
//
|
|
|
|
// - Secondary DC performs its regular anti-entropy of federation state data
|
|
|
|
// to the Primary DC (this succeeds as there is still connectivity in this
|
|
|
|
// direction).
|
|
|
|
//
|
|
|
|
// - At this point the Primary DC's mesh gateway should observe the new IP
|
|
|
|
// address and reconfigure its proxy, however as we always prioritised
|
|
|
|
// GatewayGroups this didn't happen and the connection remained severed.
|
|
|
|
maxModifyIndex := func(vals structs.CheckServiceNodes) uint64 {
|
|
|
|
var max uint64
|
|
|
|
for _, v := range vals {
|
|
|
|
if i := v.Service.RaftIndex.ModifyIndex; i > max {
|
|
|
|
max = i
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return max
|
|
|
|
}
|
|
|
|
|
|
|
|
endpoints := c.MeshGateway.GatewayGroups[key.String()]
|
|
|
|
fedStateEndpoints := c.MeshGateway.FedStateGateways[key.String()]
|
|
|
|
|
|
|
|
if maxModifyIndex(fedStateEndpoints) > maxModifyIndex(endpoints) {
|
|
|
|
return fedStateEndpoints
|
|
|
|
}
|
|
|
|
return endpoints
|
|
|
|
}
|
|
|
|
|
2022-06-06 19:20:41 +00:00
|
|
|
func (c *configSnapshotMeshGateway) IsServiceExported(svc structs.ServiceName) bool {
|
|
|
|
if c == nil || len(c.ExportedServicesWithPeers) == 0 {
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
|
|
|
_, ok := c.ExportedServicesWithPeers[svc]
|
|
|
|
return ok
|
2020-03-09 20:59:02 +00:00
|
|
|
}
|
|
|
|
|
2021-10-26 21:58:23 +00:00
|
|
|
func (c *configSnapshotMeshGateway) GatewayKeys() []GatewayKey {
|
2020-03-09 20:59:02 +00:00
|
|
|
sz1, sz2 := len(c.GatewayGroups), len(c.FedStateGateways)
|
|
|
|
|
|
|
|
sz := sz1
|
|
|
|
if sz2 > sz1 {
|
|
|
|
sz = sz2
|
|
|
|
}
|
|
|
|
|
2021-10-23 20:17:29 +00:00
|
|
|
keys := make([]GatewayKey, 0, sz)
|
2021-11-01 17:23:55 +00:00
|
|
|
for key := range c.FedStateGateways {
|
2021-10-23 20:17:29 +00:00
|
|
|
keys = append(keys, gatewayKeyFromString(key))
|
2020-03-09 20:59:02 +00:00
|
|
|
}
|
2021-11-01 17:23:55 +00:00
|
|
|
for key := range c.GatewayGroups {
|
|
|
|
gk := gatewayKeyFromString(key)
|
|
|
|
if _, ok := c.FedStateGateways[gk.Datacenter]; !ok {
|
|
|
|
keys = append(keys, gk)
|
2020-03-09 20:59:02 +00:00
|
|
|
}
|
|
|
|
}
|
2021-02-08 16:19:57 +00:00
|
|
|
|
|
|
|
// Always sort the results to ensure we generate deterministic things over
|
|
|
|
// xDS, such as mesh-gateway listener filter chains.
|
2021-10-23 20:17:29 +00:00
|
|
|
sort.Slice(keys, func(i, j int) bool {
|
|
|
|
if keys[i].Datacenter != keys[j].Datacenter {
|
|
|
|
return keys[i].Datacenter < keys[j].Datacenter
|
|
|
|
}
|
|
|
|
return keys[i].Partition < keys[j].Partition
|
|
|
|
})
|
|
|
|
return keys
|
2019-06-18 00:52:01 +00:00
|
|
|
}
|
|
|
|
|
2022-03-30 18:43:59 +00:00
|
|
|
// isEmpty is a test helper
|
|
|
|
func (c *configSnapshotMeshGateway) isEmpty() bool {
|
2019-10-17 21:46:49 +00:00
|
|
|
if c == nil {
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
return len(c.WatchedServices) == 0 &&
|
|
|
|
!c.WatchedServicesSet &&
|
2021-10-23 19:19:51 +00:00
|
|
|
len(c.WatchedGateways) == 0 &&
|
2019-10-17 21:46:49 +00:00
|
|
|
len(c.ServiceGroups) == 0 &&
|
|
|
|
len(c.ServiceResolvers) == 0 &&
|
2020-03-09 20:59:02 +00:00
|
|
|
len(c.GatewayGroups) == 0 &&
|
|
|
|
len(c.FedStateGateways) == 0 &&
|
2022-06-06 19:20:41 +00:00
|
|
|
len(c.HostnameDatacenters) == 0 &&
|
2022-09-26 16:50:17 +00:00
|
|
|
c.WatchedLocalServers.Len() == 0 &&
|
2022-06-06 19:20:41 +00:00
|
|
|
c.isEmptyPeering()
|
|
|
|
}
|
|
|
|
|
|
|
|
// isEmptyPeering is a test helper
|
|
|
|
func (c *configSnapshotMeshGateway) isEmptyPeering() bool {
|
|
|
|
if c == nil {
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
|
|
|
|
return len(c.ExportedServicesSlice) == 0 &&
|
|
|
|
len(c.ExportedServicesWithPeers) == 0 &&
|
2022-06-15 19:36:18 +00:00
|
|
|
!c.ExportedServicesSet &&
|
2022-06-06 19:20:41 +00:00
|
|
|
len(c.DiscoveryChain) == 0 &&
|
2022-06-15 19:36:18 +00:00
|
|
|
len(c.WatchedDiscoveryChains) == 0 &&
|
|
|
|
!c.MeshConfigSet &&
|
|
|
|
c.LeafCertWatchCancel == nil &&
|
|
|
|
c.Leaf == nil &&
|
|
|
|
len(c.PeeringTrustBundles) == 0 &&
|
|
|
|
!c.PeeringTrustBundlesSet
|
2019-10-17 21:46:49 +00:00
|
|
|
}
|
|
|
|
|
2023-02-10 21:13:44 +00:00
|
|
|
type upstreamIDSet map[UpstreamID]struct{}
|
|
|
|
|
|
|
|
func (u upstreamIDSet) add(uid UpstreamID) {
|
|
|
|
u[uid] = struct{}{}
|
|
|
|
}
|
|
|
|
|
|
|
|
type routeUpstreamSet map[structs.ResourceReference]upstreamIDSet
|
|
|
|
|
|
|
|
func (r routeUpstreamSet) hasUpstream(uid UpstreamID) bool {
|
|
|
|
for _, set := range r {
|
|
|
|
if _, ok := set[uid]; ok {
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return false
|
|
|
|
}
|
|
|
|
|
|
|
|
func (r routeUpstreamSet) set(route structs.ResourceReference, set upstreamIDSet) {
|
|
|
|
r[route] = set
|
|
|
|
}
|
|
|
|
|
|
|
|
func (r routeUpstreamSet) delete(route structs.ResourceReference) {
|
|
|
|
delete(r, route)
|
|
|
|
}
|
|
|
|
|
2023-03-21 16:23:23 +00:00
|
|
|
type (
|
|
|
|
listenerUpstreamMap map[APIGatewayListenerKey]structs.Upstreams
|
|
|
|
listenerRouteUpstreams map[structs.ResourceReference]listenerUpstreamMap
|
|
|
|
)
|
2023-02-10 21:13:44 +00:00
|
|
|
|
|
|
|
func (l listenerRouteUpstreams) set(route structs.ResourceReference, listener APIGatewayListenerKey, upstreams structs.Upstreams) {
|
|
|
|
if _, ok := l[route]; !ok {
|
|
|
|
l[route] = make(listenerUpstreamMap)
|
|
|
|
}
|
|
|
|
l[route][listener] = upstreams
|
|
|
|
}
|
|
|
|
|
|
|
|
func (l listenerRouteUpstreams) delete(route structs.ResourceReference) {
|
|
|
|
delete(l, route)
|
|
|
|
}
|
|
|
|
|
|
|
|
func (l listenerRouteUpstreams) toUpstreams() map[IngressListenerKey]structs.Upstreams {
|
|
|
|
listeners := make(map[IngressListenerKey]structs.Upstreams, len(l))
|
|
|
|
for _, listenerMap := range l {
|
|
|
|
for listener, set := range listenerMap {
|
|
|
|
listeners[listener] = append(listeners[listener], set...)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
return listeners
|
|
|
|
}
|
|
|
|
|
2023-02-08 21:52:12 +00:00
|
|
|
type configSnapshotAPIGateway struct {
|
|
|
|
ConfigSnapshotUpstreams
|
|
|
|
|
|
|
|
TLSConfig structs.GatewayTLSConfig
|
|
|
|
|
|
|
|
// GatewayConfigLoaded is used to determine if we have received the initial
|
|
|
|
// api-gateway config entry yet.
|
|
|
|
GatewayConfigLoaded bool
|
|
|
|
GatewayConfig *structs.APIGatewayConfigEntry
|
|
|
|
|
|
|
|
// BoundGatewayConfigLoaded is used to determine if we have received the initial
|
|
|
|
// bound-api-gateway config entry yet.
|
|
|
|
BoundGatewayConfigLoaded bool
|
|
|
|
BoundGatewayConfig *structs.BoundAPIGatewayConfigEntry
|
|
|
|
|
|
|
|
// LeafCertWatchCancel is a CancelFunc to use when refreshing this gateway's
|
|
|
|
// leaf cert watch with different parameters.
|
2023-03-21 16:23:23 +00:00
|
|
|
// LeafCertWatchCancel context.CancelFunc
|
2023-02-08 21:52:12 +00:00
|
|
|
|
|
|
|
// Upstreams is a list of upstreams this ingress gateway should serve traffic
|
|
|
|
// to. This is constructed from the ingress-gateway config entry, and uses
|
|
|
|
// the GatewayServices RPC to retrieve them.
|
|
|
|
// TODO Determine if this is updated "for free" or not. If not, we might need
|
|
|
|
// to do some work to populate it in handlerAPIGateway
|
2023-02-10 21:13:44 +00:00
|
|
|
Upstreams listenerRouteUpstreams
|
2023-02-08 21:52:12 +00:00
|
|
|
|
|
|
|
// UpstreamsSet is the unique set of UpstreamID the gateway routes to.
|
2023-02-10 21:13:44 +00:00
|
|
|
UpstreamsSet routeUpstreamSet
|
2023-02-08 21:52:12 +00:00
|
|
|
|
|
|
|
HTTPRoutes watch.Map[structs.ResourceReference, *structs.HTTPRouteConfigEntry]
|
|
|
|
TCPRoutes watch.Map[structs.ResourceReference, *structs.TCPRouteConfigEntry]
|
|
|
|
Certificates watch.Map[structs.ResourceReference, *structs.InlineCertificateConfigEntry]
|
|
|
|
|
2023-02-09 21:20:12 +00:00
|
|
|
// LeafCertWatchCancel is a CancelFunc to use when refreshing this gateway's
|
|
|
|
// leaf cert watch with different parameters.
|
|
|
|
LeafCertWatchCancel context.CancelFunc
|
|
|
|
|
2023-02-08 21:52:12 +00:00
|
|
|
// Listeners is the original listener config from the api-gateway config
|
|
|
|
// entry to save us trying to pass fields through Upstreams
|
|
|
|
Listeners map[string]structs.APIGatewayListener
|
|
|
|
|
|
|
|
BoundListeners map[string]structs.BoundAPIGatewayListener
|
|
|
|
}
|
|
|
|
|
2023-02-17 18:18:11 +00:00
|
|
|
func (c *configSnapshotAPIGateway) synthesizeChains(datacenter string, listener structs.APIGatewayListener, boundListener structs.BoundAPIGatewayListener) ([]structs.IngressService, structs.Upstreams, []*structs.CompiledDiscoveryChain, error) {
|
2023-02-09 17:58:55 +00:00
|
|
|
chains := []*structs.CompiledDiscoveryChain{}
|
2023-06-08 18:11:44 +00:00
|
|
|
|
|
|
|
// We leverage the test trust domain knowing
|
|
|
|
// that the domain will get overridden if
|
|
|
|
// there is a target to something other than an
|
|
|
|
// external/peered service. If the below
|
|
|
|
// code doesn't get a trust domain due to all the
|
|
|
|
// targets being external, the chain will
|
|
|
|
// have the domain munged anyway during synthesis.
|
|
|
|
trustDomain := connect.TestTrustDomain
|
2023-02-13 19:18:05 +00:00
|
|
|
|
|
|
|
DOMAIN_LOOP:
|
|
|
|
for _, chain := range c.DiscoveryChain {
|
|
|
|
for _, target := range chain.Targets {
|
|
|
|
if !target.External {
|
2023-06-08 18:11:44 +00:00
|
|
|
domain := connect.TrustDomainForTarget(*target)
|
|
|
|
if domain != "" {
|
|
|
|
trustDomain = domain
|
2023-02-13 19:18:05 +00:00
|
|
|
break DOMAIN_LOOP
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2023-02-17 18:18:11 +00:00
|
|
|
synthesizer := discoverychain.NewGatewayChainSynthesizer(datacenter, trustDomain, listener.Name, c.GatewayConfig)
|
|
|
|
synthesizer.SetHostname(listener.GetHostname())
|
2023-02-09 17:58:55 +00:00
|
|
|
for _, routeRef := range boundListener.Routes {
|
|
|
|
switch routeRef.Kind {
|
|
|
|
case structs.HTTPRoute:
|
|
|
|
route, ok := c.HTTPRoutes.Get(routeRef)
|
2023-02-17 18:18:11 +00:00
|
|
|
if !ok || listener.Protocol != structs.ListenerProtocolHTTP {
|
2023-02-09 17:58:55 +00:00
|
|
|
continue
|
|
|
|
}
|
|
|
|
synthesizer.AddHTTPRoute(*route)
|
|
|
|
for _, service := range route.GetServices() {
|
|
|
|
id := NewUpstreamIDFromServiceName(structs.NewServiceName(service.Name, &service.EnterpriseMeta))
|
|
|
|
if chain := c.DiscoveryChain[id]; chain != nil {
|
|
|
|
chains = append(chains, chain)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
case structs.TCPRoute:
|
|
|
|
route, ok := c.TCPRoutes.Get(routeRef)
|
2023-02-17 18:18:11 +00:00
|
|
|
if !ok || listener.Protocol != structs.ListenerProtocolTCP {
|
2023-02-09 17:58:55 +00:00
|
|
|
continue
|
|
|
|
}
|
|
|
|
synthesizer.AddTCPRoute(*route)
|
|
|
|
for _, service := range route.GetServices() {
|
|
|
|
id := NewUpstreamIDFromServiceName(structs.NewServiceName(service.Name, &service.EnterpriseMeta))
|
|
|
|
if chain := c.DiscoveryChain[id]; chain != nil {
|
|
|
|
chains = append(chains, chain)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
default:
|
2023-02-13 19:18:05 +00:00
|
|
|
return nil, nil, nil, fmt.Errorf("unknown route kind %q", routeRef.Kind)
|
2023-02-09 17:58:55 +00:00
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
if len(chains) == 0 {
|
2023-02-13 19:18:05 +00:00
|
|
|
return nil, nil, nil, nil
|
|
|
|
}
|
|
|
|
|
|
|
|
services, compiled, err := synthesizer.Synthesize(chains...)
|
|
|
|
if err != nil {
|
|
|
|
return nil, nil, nil, err
|
|
|
|
}
|
|
|
|
|
|
|
|
// reconstruct the upstreams
|
|
|
|
upstreams := make([]structs.Upstream, 0, len(services))
|
|
|
|
for _, service := range services {
|
|
|
|
upstreams = append(upstreams, structs.Upstream{
|
|
|
|
DestinationName: service.Name,
|
|
|
|
DestinationNamespace: service.NamespaceOrDefault(),
|
|
|
|
DestinationPartition: service.PartitionOrDefault(),
|
|
|
|
IngressHosts: service.Hosts,
|
2023-02-17 18:18:11 +00:00
|
|
|
LocalBindPort: listener.Port,
|
2023-02-13 19:18:05 +00:00
|
|
|
Config: map[string]interface{}{
|
2023-02-17 18:18:11 +00:00
|
|
|
"protocol": string(listener.Protocol),
|
2023-02-13 19:18:05 +00:00
|
|
|
},
|
|
|
|
})
|
2023-02-08 21:52:12 +00:00
|
|
|
}
|
2023-02-09 17:58:55 +00:00
|
|
|
|
2023-02-13 19:18:05 +00:00
|
|
|
return services, upstreams, compiled, err
|
2023-02-09 17:58:55 +00:00
|
|
|
}
|
|
|
|
|
2023-07-10 21:27:56 +00:00
|
|
|
// valid tests for two valid api gateway snapshot states:
|
|
|
|
// 1. waiting: the watch on api and bound gateway entries is set, but none were received
|
|
|
|
// 2. loaded: both the valid config entries AND the leaf certs are set
|
|
|
|
func (c *configSnapshotAPIGateway) valid() bool {
|
|
|
|
waiting := c.GatewayConfigLoaded && len(c.Upstreams) == 0 && c.BoundGatewayConfigLoaded && c.Leaf == nil
|
|
|
|
|
|
|
|
// If we have a leaf, it implies we successfully watched parent resources
|
|
|
|
loaded := c.GatewayConfigLoaded && c.BoundGatewayConfigLoaded && c.Leaf != nil
|
|
|
|
|
|
|
|
return waiting || loaded
|
|
|
|
}
|
|
|
|
|
2020-04-16 21:00:48 +00:00
|
|
|
type configSnapshotIngressGateway struct {
|
|
|
|
ConfigSnapshotUpstreams
|
2020-04-27 23:36:20 +00:00
|
|
|
|
2021-09-13 12:03:16 +00:00
|
|
|
// TLSConfig is the gateway-level TLS configuration. Listener/service level
|
2021-08-24 13:09:01 +00:00
|
|
|
// config is preserved in the Listeners map below.
|
|
|
|
TLSConfig structs.GatewayTLSConfig
|
2021-08-17 11:27:31 +00:00
|
|
|
|
2021-08-24 13:09:01 +00:00
|
|
|
// GatewayConfigLoaded is used to determine if we have received the initial
|
|
|
|
// ingress-gateway config entry yet.
|
|
|
|
GatewayConfigLoaded bool
|
2020-04-27 23:36:20 +00:00
|
|
|
|
|
|
|
// Hosts is the list of extra host entries to add to our leaf cert's DNS SANs.
|
|
|
|
Hosts []string
|
|
|
|
HostsSet bool
|
|
|
|
|
|
|
|
// LeafCertWatchCancel is a CancelFunc to use when refreshing this gateway's
|
|
|
|
// leaf cert watch with different parameters.
|
|
|
|
LeafCertWatchCancel context.CancelFunc
|
|
|
|
|
2020-04-16 21:00:48 +00:00
|
|
|
// Upstreams is a list of upstreams this ingress gateway should serve traffic
|
|
|
|
// to. This is constructed from the ingress-gateway config entry, and uses
|
|
|
|
// the GatewayServices RPC to retrieve them.
|
2020-04-16 23:24:11 +00:00
|
|
|
Upstreams map[IngressListenerKey]structs.Upstreams
|
2021-07-13 12:53:59 +00:00
|
|
|
|
2022-01-20 16:12:04 +00:00
|
|
|
// UpstreamsSet is the unique set of UpstreamID the gateway routes to.
|
|
|
|
UpstreamsSet map[UpstreamID]struct{}
|
2021-12-13 23:40:04 +00:00
|
|
|
|
2021-07-13 12:53:59 +00:00
|
|
|
// Listeners is the original listener config from the ingress-gateway config
|
|
|
|
// entry to save us trying to pass fields through Upstreams
|
|
|
|
Listeners map[IngressListenerKey]structs.IngressListener
|
2022-09-28 18:56:46 +00:00
|
|
|
|
|
|
|
// Defaults is the default configuration for upstream service instances
|
|
|
|
Defaults structs.IngressServiceConfig
|
2020-04-16 21:00:48 +00:00
|
|
|
}
|
|
|
|
|
2022-03-30 18:43:59 +00:00
|
|
|
// isEmpty is a test helper
|
|
|
|
func (c *configSnapshotIngressGateway) isEmpty() bool {
|
2020-04-16 21:00:48 +00:00
|
|
|
if c == nil {
|
|
|
|
return true
|
|
|
|
}
|
|
|
|
return len(c.Upstreams) == 0 &&
|
2021-12-13 23:40:04 +00:00
|
|
|
len(c.UpstreamsSet) == 0 &&
|
2020-04-16 21:00:48 +00:00
|
|
|
len(c.DiscoveryChain) == 0 &&
|
|
|
|
len(c.WatchedUpstreams) == 0 &&
|
2022-03-30 18:43:59 +00:00
|
|
|
len(c.WatchedUpstreamEndpoints) == 0 &&
|
|
|
|
!c.MeshConfigSet
|
2020-04-16 21:00:48 +00:00
|
|
|
}
|
|
|
|
|
2023-07-10 21:27:56 +00:00
|
|
|
// valid tests for two valid ingress snapshot states:
|
|
|
|
// 1. waiting: the watch on ingress config entries is set, but none were received
|
|
|
|
// 2. loaded: both the ingress config entry AND the leaf cert are set
|
|
|
|
func (c *configSnapshotIngressGateway) valid() bool {
|
|
|
|
waiting := c.GatewayConfigLoaded && len(c.Upstreams) == 0 && c.Leaf == nil
|
|
|
|
|
|
|
|
// If we have a leaf, it implies we successfully watched parent resources
|
|
|
|
loaded := c.GatewayConfigLoaded && c.Leaf != nil
|
|
|
|
|
|
|
|
return waiting || loaded
|
|
|
|
}
|
|
|
|
|
2023-02-08 21:52:12 +00:00
|
|
|
type APIGatewayListenerKey = IngressListenerKey
|
|
|
|
|
2023-05-19 18:50:59 +00:00
|
|
|
func APIGatewayListenerKeyFromListener(l structs.APIGatewayListener) APIGatewayListenerKey {
|
|
|
|
return APIGatewayListenerKey{Protocol: string(l.Protocol), Port: l.Port}
|
|
|
|
}
|
|
|
|
|
2020-04-16 23:24:11 +00:00
|
|
|
type IngressListenerKey struct {
|
|
|
|
Protocol string
|
|
|
|
Port int
|
|
|
|
}
|
|
|
|
|
|
|
|
func (k *IngressListenerKey) RouteName() string {
|
2020-04-30 14:31:37 +00:00
|
|
|
return fmt.Sprintf("%d", k.Port)
|
2020-04-16 23:24:11 +00:00
|
|
|
}
|
|
|
|
|
2021-08-24 13:09:01 +00:00
|
|
|
func IngressListenerKeyFromGWService(s structs.GatewayService) IngressListenerKey {
|
|
|
|
return IngressListenerKey{Protocol: s.Protocol, Port: s.Port}
|
|
|
|
}
|
|
|
|
|
|
|
|
func IngressListenerKeyFromListener(l structs.IngressListener) IngressListenerKey {
|
|
|
|
return IngressListenerKey{Protocol: l.Protocol, Port: l.Port}
|
|
|
|
}
|
|
|
|
|
2018-10-03 12:36:38 +00:00
|
|
|
// ConfigSnapshot captures all the resulting config needed for a proxy instance.
|
|
|
|
// It is meant to be point-in-time coherent and is used to deliver the current
|
|
|
|
// config state to observers who need it to be pushed in (e.g. XDS server).
|
|
|
|
type ConfigSnapshot struct {
|
2020-08-27 17:20:58 +00:00
|
|
|
Kind structs.ServiceKind
|
|
|
|
Service string
|
2022-05-27 11:38:52 +00:00
|
|
|
ProxyID ProxyID
|
2020-08-27 17:20:58 +00:00
|
|
|
Address string
|
|
|
|
Port int
|
|
|
|
ServiceMeta map[string]string
|
|
|
|
TaggedAddresses map[string]structs.ServiceAddress
|
|
|
|
Proxy structs.ConnectProxyConfig
|
|
|
|
Datacenter string
|
|
|
|
IntentionDefaultAllow bool
|
2021-10-29 00:47:42 +00:00
|
|
|
Locality GatewayKey
|
2023-05-19 22:14:16 +00:00
|
|
|
JWTProviders map[string]*structs.JWTProviderConfigEntry
|
2020-01-24 15:04:58 +00:00
|
|
|
|
2020-03-09 20:59:02 +00:00
|
|
|
ServerSNIFn ServerSNIFunc
|
|
|
|
Roots *structs.IndexedCARoots
|
2019-06-18 00:52:01 +00:00
|
|
|
|
|
|
|
// connect-proxy specific
|
|
|
|
ConnectProxy configSnapshotConnectProxy
|
|
|
|
|
2020-04-10 18:06:08 +00:00
|
|
|
// terminating-gateway specific
|
|
|
|
TerminatingGateway configSnapshotTerminatingGateway
|
|
|
|
|
2019-06-18 00:52:01 +00:00
|
|
|
// mesh-gateway specific
|
|
|
|
MeshGateway configSnapshotMeshGateway
|
2018-10-03 12:36:38 +00:00
|
|
|
|
2020-04-16 21:00:48 +00:00
|
|
|
// ingress-gateway specific
|
|
|
|
IngressGateway configSnapshotIngressGateway
|
2023-02-08 21:52:12 +00:00
|
|
|
|
|
|
|
// api-gateway specific
|
|
|
|
APIGateway configSnapshotAPIGateway
|
2018-10-03 12:36:38 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// Valid returns whether or not the snapshot has all required fields filled yet.
|
|
|
|
func (s *ConfigSnapshot) Valid() bool {
|
2019-06-24 19:05:36 +00:00
|
|
|
switch s.Kind {
|
|
|
|
case structs.ServiceKindConnectProxy:
|
2021-04-28 22:13:29 +00:00
|
|
|
if s.Proxy.Mode == structs.ProxyModeTransparent && !s.ConnectProxy.MeshConfigSet {
|
2021-04-06 18:19:59 +00:00
|
|
|
return false
|
|
|
|
}
|
2020-08-27 17:20:58 +00:00
|
|
|
return s.Roots != nil &&
|
|
|
|
s.ConnectProxy.Leaf != nil &&
|
2022-03-30 18:43:59 +00:00
|
|
|
s.ConnectProxy.IntentionsSet &&
|
|
|
|
s.ConnectProxy.MeshConfigSet
|
2020-08-27 17:20:58 +00:00
|
|
|
|
2020-04-10 18:06:08 +00:00
|
|
|
case structs.ServiceKindTerminatingGateway:
|
2022-03-30 18:43:59 +00:00
|
|
|
return s.Roots != nil &&
|
|
|
|
s.TerminatingGateway.MeshConfigSet
|
2020-08-27 17:20:58 +00:00
|
|
|
|
2019-06-18 00:52:01 +00:00
|
|
|
case structs.ServiceKindMeshGateway:
|
2022-09-26 16:50:17 +00:00
|
|
|
if s.MeshGateway.WatchedLocalServers.Len() == 0 {
|
2022-09-23 01:24:13 +00:00
|
|
|
if s.ServiceMeta[structs.MetaWANFederationKey] == "1" {
|
|
|
|
return false
|
|
|
|
}
|
2022-09-23 03:14:25 +00:00
|
|
|
if cfg := s.MeshConfig(); cfg.PeerThroughMeshGateways() {
|
2020-03-09 20:59:02 +00:00
|
|
|
return false
|
|
|
|
}
|
|
|
|
}
|
2020-08-27 17:20:58 +00:00
|
|
|
return s.Roots != nil &&
|
2022-06-06 19:20:41 +00:00
|
|
|
(s.MeshGateway.WatchedServicesSet || len(s.MeshGateway.ServiceGroups) > 0) &&
|
2022-06-15 19:36:18 +00:00
|
|
|
s.MeshGateway.ExportedServicesSet &&
|
|
|
|
s.MeshGateway.MeshConfigSet &&
|
|
|
|
s.MeshGateway.PeeringTrustBundlesSet
|
2020-08-27 17:20:58 +00:00
|
|
|
|
2020-04-16 21:00:48 +00:00
|
|
|
case structs.ServiceKindIngressGateway:
|
|
|
|
return s.Roots != nil &&
|
2023-07-10 21:27:56 +00:00
|
|
|
s.IngressGateway.valid() &&
|
2022-03-30 18:43:59 +00:00
|
|
|
s.IngressGateway.HostsSet &&
|
|
|
|
s.IngressGateway.MeshConfigSet
|
2023-02-08 21:52:12 +00:00
|
|
|
|
|
|
|
case structs.ServiceKindAPIGateway:
|
|
|
|
// TODO Is this the proper set of things to validate?
|
|
|
|
return s.Roots != nil &&
|
2023-07-10 21:27:56 +00:00
|
|
|
s.APIGateway.valid() &&
|
2023-02-08 21:52:12 +00:00
|
|
|
s.APIGateway.MeshConfigSet
|
2019-06-24 19:05:36 +00:00
|
|
|
default:
|
|
|
|
return false
|
|
|
|
}
|
2018-10-03 12:36:38 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// Clone makes a deep copy of the snapshot we can send to other goroutines
|
|
|
|
// without worrying that they will racily read or mutate shared maps etc.
|
2022-10-14 09:26:42 +00:00
|
|
|
func (s *ConfigSnapshot) Clone() *ConfigSnapshot {
|
|
|
|
snap := s.DeepCopy()
|
2019-06-18 00:52:01 +00:00
|
|
|
|
2019-07-02 03:10:51 +00:00
|
|
|
// nil these out as anything receiving one of these clones does not need them and should never "cancel" our watches
|
2019-06-18 00:52:01 +00:00
|
|
|
switch s.Kind {
|
2019-07-02 03:10:51 +00:00
|
|
|
case structs.ServiceKindConnectProxy:
|
2022-06-03 21:42:50 +00:00
|
|
|
// common with connect-proxy and ingress-gateway
|
2019-07-02 03:10:51 +00:00
|
|
|
snap.ConnectProxy.WatchedUpstreams = nil
|
2019-08-05 18:30:35 +00:00
|
|
|
snap.ConnectProxy.WatchedGateways = nil
|
2022-06-03 21:42:50 +00:00
|
|
|
snap.ConnectProxy.WatchedDiscoveryChains = nil
|
2020-04-10 18:06:08 +00:00
|
|
|
case structs.ServiceKindTerminatingGateway:
|
|
|
|
snap.TerminatingGateway.WatchedServices = nil
|
|
|
|
snap.TerminatingGateway.WatchedIntentions = nil
|
|
|
|
snap.TerminatingGateway.WatchedLeaves = nil
|
2020-08-27 17:20:58 +00:00
|
|
|
snap.TerminatingGateway.WatchedConfigs = nil
|
|
|
|
snap.TerminatingGateway.WatchedResolvers = nil
|
2019-06-18 00:52:01 +00:00
|
|
|
case structs.ServiceKindMeshGateway:
|
2021-10-23 19:19:51 +00:00
|
|
|
snap.MeshGateway.WatchedGateways = nil
|
2019-06-18 00:52:01 +00:00
|
|
|
snap.MeshGateway.WatchedServices = nil
|
2020-04-16 21:00:48 +00:00
|
|
|
case structs.ServiceKindIngressGateway:
|
2022-06-03 21:42:50 +00:00
|
|
|
// common with connect-proxy and ingress-gateway
|
2020-04-16 21:00:48 +00:00
|
|
|
snap.IngressGateway.WatchedUpstreams = nil
|
2020-05-07 15:22:57 +00:00
|
|
|
snap.IngressGateway.WatchedGateways = nil
|
2020-04-16 21:00:48 +00:00
|
|
|
snap.IngressGateway.WatchedDiscoveryChains = nil
|
2022-06-03 21:42:50 +00:00
|
|
|
// only ingress-gateway
|
2020-05-07 15:22:57 +00:00
|
|
|
snap.IngressGateway.LeafCertWatchCancel = nil
|
2023-02-08 21:52:12 +00:00
|
|
|
case structs.ServiceKindAPIGateway:
|
|
|
|
// common with connect-proxy and api-gateway
|
|
|
|
snap.APIGateway.WatchedUpstreams = nil
|
|
|
|
snap.APIGateway.WatchedGateways = nil
|
|
|
|
snap.APIGateway.WatchedDiscoveryChains = nil
|
|
|
|
|
|
|
|
// only api-gateway
|
2023-03-21 16:23:23 +00:00
|
|
|
// snap.APIGateway.LeafCertWatchCancel = nil
|
|
|
|
// snap.APIGateway.
|
2019-06-18 00:52:01 +00:00
|
|
|
}
|
|
|
|
|
2022-10-14 09:26:42 +00:00
|
|
|
return snap
|
2018-10-03 12:36:38 +00:00
|
|
|
}
|
2020-04-16 21:00:48 +00:00
|
|
|
|
|
|
|
func (s *ConfigSnapshot) Leaf() *structs.IssuedCert {
|
|
|
|
switch s.Kind {
|
|
|
|
case structs.ServiceKindConnectProxy:
|
|
|
|
return s.ConnectProxy.Leaf
|
|
|
|
case structs.ServiceKindIngressGateway:
|
|
|
|
return s.IngressGateway.Leaf
|
2023-02-08 21:52:12 +00:00
|
|
|
case structs.ServiceKindAPIGateway:
|
|
|
|
return s.APIGateway.Leaf
|
2022-06-15 19:36:18 +00:00
|
|
|
case structs.ServiceKindMeshGateway:
|
|
|
|
return s.MeshGateway.Leaf
|
|
|
|
default:
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func (s *ConfigSnapshot) PeeringTrustBundles() []*pbpeering.PeeringTrustBundle {
|
|
|
|
switch s.Kind {
|
|
|
|
case structs.ServiceKindConnectProxy:
|
2022-06-21 02:47:14 +00:00
|
|
|
return s.ConnectProxy.InboundPeerTrustBundles
|
2022-06-15 19:36:18 +00:00
|
|
|
case structs.ServiceKindMeshGateway:
|
|
|
|
return s.MeshGateway.PeeringTrustBundles
|
2020-04-16 21:00:48 +00:00
|
|
|
default:
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
}
|
2022-03-30 18:43:59 +00:00
|
|
|
|
2022-06-01 21:53:52 +00:00
|
|
|
// RootPEMs returns all PEM-encoded public certificates for the root CA.
|
|
|
|
func (s *ConfigSnapshot) RootPEMs() string {
|
|
|
|
var rootPEMs string
|
|
|
|
for _, root := range s.Roots.Roots {
|
|
|
|
rootPEMs += lib.EnsureTrailingNewline(root.RootCert)
|
|
|
|
}
|
|
|
|
return rootPEMs
|
|
|
|
}
|
|
|
|
|
2022-03-30 18:43:59 +00:00
|
|
|
func (s *ConfigSnapshot) MeshConfig() *structs.MeshConfigEntry {
|
|
|
|
switch s.Kind {
|
|
|
|
case structs.ServiceKindConnectProxy:
|
|
|
|
return s.ConnectProxy.MeshConfig
|
|
|
|
case structs.ServiceKindIngressGateway:
|
|
|
|
return s.IngressGateway.MeshConfig
|
2023-02-08 21:52:12 +00:00
|
|
|
case structs.ServiceKindAPIGateway:
|
|
|
|
return s.APIGateway.MeshConfig
|
2022-03-30 18:43:59 +00:00
|
|
|
case structs.ServiceKindTerminatingGateway:
|
|
|
|
return s.TerminatingGateway.MeshConfig
|
2022-06-15 19:36:18 +00:00
|
|
|
case structs.ServiceKindMeshGateway:
|
|
|
|
return s.MeshGateway.MeshConfig
|
2022-03-30 18:43:59 +00:00
|
|
|
default:
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
|
|
|
func (s *ConfigSnapshot) MeshConfigTLSIncoming() *structs.MeshDirectionalTLSConfig {
|
|
|
|
mesh := s.MeshConfig()
|
|
|
|
if mesh == nil || mesh.TLS == nil {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
return mesh.TLS.Incoming
|
|
|
|
}
|
|
|
|
|
|
|
|
func (s *ConfigSnapshot) MeshConfigTLSOutgoing() *structs.MeshDirectionalTLSConfig {
|
|
|
|
mesh := s.MeshConfig()
|
|
|
|
if mesh == nil || mesh.TLS == nil {
|
|
|
|
return nil
|
|
|
|
}
|
|
|
|
return mesh.TLS.Outgoing
|
|
|
|
}
|
2022-06-03 21:42:50 +00:00
|
|
|
|
2022-08-30 15:46:34 +00:00
|
|
|
func (s *ConfigSnapshot) ToConfigSnapshotUpstreams() (*ConfigSnapshotUpstreams, error) {
|
|
|
|
switch s.Kind {
|
|
|
|
case structs.ServiceKindConnectProxy:
|
|
|
|
return &s.ConnectProxy.ConfigSnapshotUpstreams, nil
|
|
|
|
case structs.ServiceKindIngressGateway:
|
|
|
|
return &s.IngressGateway.ConfigSnapshotUpstreams, nil
|
2023-02-08 21:52:12 +00:00
|
|
|
case structs.ServiceKindAPIGateway:
|
|
|
|
return &s.APIGateway.ConfigSnapshotUpstreams, nil
|
2022-08-30 15:46:34 +00:00
|
|
|
default:
|
|
|
|
// This is a coherence check and should never fail
|
|
|
|
return nil, fmt.Errorf("No upstream snapshot for gateway mode %q", s.Kind)
|
|
|
|
}
|
|
|
|
}
|
|
|
|
|
2023-01-03 16:44:08 +00:00
|
|
|
func (u *ConfigSnapshotUpstreams) UpstreamPeerMeta(uid UpstreamID) (structs.PeeringServiceMeta, bool) {
|
2022-07-13 16:14:57 +00:00
|
|
|
nodes, _ := u.PeerUpstreamEndpoints.Get(uid)
|
2022-06-03 21:42:50 +00:00
|
|
|
if len(nodes) == 0 {
|
2023-01-03 16:44:08 +00:00
|
|
|
return structs.PeeringServiceMeta{}, false
|
2022-06-03 21:42:50 +00:00
|
|
|
}
|
|
|
|
|
|
|
|
// In agent/rpc/peering/subscription_manager.go we denormalize the
|
|
|
|
// PeeringServiceMeta data onto each replicated service instance to convey
|
|
|
|
// this information back to the importing side of the peering.
|
|
|
|
//
|
|
|
|
// This data is guaranteed (subject to any eventual consistency lag around
|
|
|
|
// updates) to be the same across all instances, so we only need to take
|
|
|
|
// the first item.
|
|
|
|
//
|
|
|
|
// TODO(peering): consider replicating this "common to all instances" data
|
|
|
|
// using a different replication type and persist it separately in the
|
|
|
|
// catalog to avoid this weird construction.
|
|
|
|
csn := nodes[0]
|
|
|
|
if csn.Service == nil {
|
2023-01-03 16:44:08 +00:00
|
|
|
return structs.PeeringServiceMeta{}, false
|
2022-06-03 21:42:50 +00:00
|
|
|
}
|
2023-01-03 16:44:08 +00:00
|
|
|
return *csn.Service.Connect.PeerMeta, true
|
2022-06-03 21:42:50 +00:00
|
|
|
}
|
|
|
|
|
2022-07-19 18:56:28 +00:00
|
|
|
// PeeredUpstreamIDs returns a slice of peered UpstreamIDs from explicit config entries
|
|
|
|
// and implicit imported services.
|
|
|
|
// Upstreams whose trust bundles have not been stored in the snapshot are ignored.
|
2022-06-03 21:42:50 +00:00
|
|
|
func (u *ConfigSnapshotUpstreams) PeeredUpstreamIDs() []UpstreamID {
|
2022-07-19 18:56:28 +00:00
|
|
|
out := make([]UpstreamID, 0, u.PeerUpstreamEndpoints.Len())
|
|
|
|
u.PeerUpstreamEndpoints.ForEachKey(func(uid UpstreamID) bool {
|
|
|
|
if _, ok := u.PeerUpstreamEndpoints.Get(uid); !ok {
|
|
|
|
// uid might exist in the map but if Set hasn't been called, skip for now.
|
|
|
|
return true
|
2022-06-03 21:42:50 +00:00
|
|
|
}
|
|
|
|
|
2022-07-13 16:14:57 +00:00
|
|
|
if _, ok := u.UpstreamPeerTrustBundles.Get(uid.Peer); !ok {
|
2022-06-03 21:42:50 +00:00
|
|
|
// The trust bundle for this upstream is not available yet, skip for now.
|
2022-07-19 18:56:28 +00:00
|
|
|
return true
|
2022-06-03 21:42:50 +00:00
|
|
|
}
|
|
|
|
out = append(out, uid)
|
2022-07-19 18:56:28 +00:00
|
|
|
return true
|
|
|
|
})
|
2022-06-03 21:42:50 +00:00
|
|
|
return out
|
|
|
|
}
|