mirror of https://github.com/hashicorp/consul
Backport of [API Gateway] Fix trust domain for external peered services in synthesis code into release/1.16.x (#17616)
* backport of commitpull/17626/head proto-public/v0.4.0-rc163e8743472
* backport of commit896f11789b
--------- Co-authored-by: Andrew Stucki <andrew.stucki@hashicorp.com>
parent
937825c11e
commit
6519808f72
|
@ -0,0 +1,4 @@
|
|||
```release-note:bug
|
||||
gateways: Fixed a bug in API gateways where binding a route that only targets a service imported from a peer results
|
||||
in the programmed gateway having no routes.
|
||||
```
|
|
@ -741,14 +741,23 @@ type configSnapshotAPIGateway struct {
|
|||
|
||||
func (c *configSnapshotAPIGateway) synthesizeChains(datacenter string, listener structs.APIGatewayListener, boundListener structs.BoundAPIGatewayListener) ([]structs.IngressService, structs.Upstreams, []*structs.CompiledDiscoveryChain, error) {
|
||||
chains := []*structs.CompiledDiscoveryChain{}
|
||||
trustDomain := ""
|
||||
|
||||
// We leverage the test trust domain knowing
|
||||
// that the domain will get overridden if
|
||||
// there is a target to something other than an
|
||||
// external/peered service. If the below
|
||||
// code doesn't get a trust domain due to all the
|
||||
// targets being external, the chain will
|
||||
// have the domain munged anyway during synthesis.
|
||||
trustDomain := connect.TestTrustDomain
|
||||
|
||||
DOMAIN_LOOP:
|
||||
for _, chain := range c.DiscoveryChain {
|
||||
for _, target := range chain.Targets {
|
||||
if !target.External {
|
||||
trustDomain = connect.TrustDomainForTarget(*target)
|
||||
if trustDomain != "" {
|
||||
domain := connect.TrustDomainForTarget(*target)
|
||||
if domain != "" {
|
||||
trustDomain = domain
|
||||
break DOMAIN_LOOP
|
||||
}
|
||||
}
|
||||
|
|
Loading…
Reference in New Issue