1890 Commits (1.14.0-beta1)

Author	SHA1	Message	Date
Daniel Nephin	89f41bddfe	Remove TTL from cacheEntryExpiry ... This should very slightly reduce the amount of memory required to store each item in the cache. It will also enable setting different TTLs based on the type of result. For example we may want to use a shorter TTL when the result indicates the resource does not exist, as storing these types of records could easily lead to a DOS caused by OOM.	5 years ago
Daniel Nephin	7246d8b6cb	agent/cache: Reduce differences between notify implementations ... These two notify functions are very similar. There appear to be just enough differences that trying to parameterize the differences may not improve things. For now, reduce some of the cosmetic differences so that the material differences are more obvious.	5 years ago
Daniel Nephin	66fbb13976	agent/cache: Inline the refresh function to make recursion more obvious ... fetch is already an exceptionally long function, but hiding the recrusion in a function call likely does not help.	5 years ago
Daniel Nephin	faeaed5d0c	agent/cache: Make the return values of getEntryLocked more obvious ... Use named returned so that the caller has a better idea of what these bools mean. Return early to reduce the scope, and make it more obvious what values are returned in which cases. Also reduces the number of conditional expressions in each case.	5 years ago
Daniel Nephin	e9e45545dd	agent/cache: Small formatting improvements to improve readability ... Remove Cache.entryKey which called a single function. Format multiline struct creation one field per line.	5 years ago
Daniel Nephin	329d76fd0e	Remove SnapshotRPC passthrough ... The caller has access to the delegate, so we do not gain anything by wrapping the call in Agent.	5 years ago
Daniel Nephin	1f25bf88b8	Merge pull request #7596 from hashicorp/dnephin/agent-cache-type-entry ... agent/cache: move typeEntry lookup to the edge	5 years ago
Pierre Souchay	1b4218a068	fix flaky TestReplication_FederationStates test due to race conditions (#7612) ... The test had two racy bugs related to memdb references. The first was when we initially populated data and retained the FederationState objects in a slice. Due to how the `inmemCodec` works these were actually the identical objects passed into memdb. The second was that the `checkSame` assertion function was reading from memdb and setting the RaftIndexes to zeros to aid in equality checks. This was mutating the contents of memdb which is a no-no. With this fix, the command: ``` i=0; while /usr/local/bin/go test -count=1 -timeout 30s github.com/hashicorp/consul/agent/consul -run '^(TestReplication_FederationStates)$'; do i=$((i + 1)); printf "$i "; done ``` That used to break on my machine in less than 20 runs is now running 150+ times without any issue. Might also fix #7575	5 years ago
Pierre Souchay	4a6569a4e3	tests: change default http_max_conns_per_client to 250 to ease tests (#7625) ... On recent Mac OS versions, the ulimit defaults to 256 by default, but many systems (eg: some Linux distributions) often limit this value to 1024. On validation of configuration, Consul now validates that the number of allowed files descriptors is bigger than http_max_conns_per_client. This make some unit tests failing on Mac OS. Use a less important value in unit test, so tests runs well by default on Mac OS without need for tuning the OS.	5 years ago
Freddy	9eb1867fbb	Terminating gateway discovery (#7571) ... * Enable discovering terminating gateways * Add TerminatingGatewayServices to state store * Use GatewayServices RPC endpoint for ingress/terminating	5 years ago
Freddy	aae14b3951	Add decode rules for Expose cfg in service-defaults (#7611)	5 years ago
Matt Keeler	0e7d3d93b3	Enable filtering language support for the v1/connect/intentions… (#7593) ... * Enable filtering language support for the v1/connect/intentions listing API * Update website for filtering of Intentions * Update website/source/api/connect/intentions.html.md	5 years ago
Daniel Nephin	8549cc2d99	Merge pull request #7598 from pierresouchay/preallocation_of_dns_meta ... Pre-allocations of DNS meta to avoid several allocations	5 years ago
Pierre Souchay	d1d016d61d	[LINT] Close resp.Body to avoid linter complaining (#7600)	5 years ago
Pierre Souchay	c9e01ed0a3	Pre-allocations of DNS meta to avoid several allocations	5 years ago
Daniel Nephin	c9a87be6ee	agent/cache: move typeEntry lookup to the edge ... This change moves all the typeEntry lookups to the first step in the exported methods, and makes unexporter internals accept the typeEntry struct. This change is primarily intended to make it easier to extract the container of caches from the Cache type. It may incidentally reduce locking in fetch, but that was not a goal.	5 years ago
Pierre Souchay	73056fecf8	Fixed unstable test TestForwardSignals() ... Sometimes, in the CI, it could receive a SIGURG, producing this line: FAIL: TestForwardSignals/signal-interrupt (0.06s) util_test.go:286: expected to read line "signal: interrupt" but got "signal: urgent I/O condition" Only forward the signals we test to avoid this kind of false positive Example of such unstable errors in CI: https://circleci.com/gh/hashicorp/consul/153571	5 years ago
Pierre Souchay	09e638a9c6	tests: more tolerance to latency for unstable test `TestCacheNotifyPolling()`. (#7574)	5 years ago
Matt Keeler	8aec09aa8f	Ensure that token clone copies the roles (#7577)	5 years ago
Chris Piraino	584f90bbeb	Fix flapping of mesh gateway connect-service watches (#7575)	5 years ago
Pierre Souchay	2a8bf45e38	agent: show warning when enable_script_checks is enabled without safty net (#7437) ... In order to enforce a bit security on Consul agents, add a new method in agent to highlight possible security issues. This does not return an error for now, but might in the future. For now, it detects issues such as: https://www.hashicorp.com/blog/protecting-consul-from-rce-risk-in-specific-configurations/ This would display this kind of messages: ``` 2020-03-11T18:27:49.873+0100 [ERROR] agent: [SECURITY] issue: error="using enable-script-checks without ACLs and without allow_write_http_from is DANGEROUS, use enable-local-script-checks instead see https://www.hashicorp.com/blog/protecting-consul-from-rce-risk-in-specific-configurations/" ```	5 years ago
Andy Lindeman	fb0a990e4d	agent: rewrite checks with proxy address, not local service address (#7518) ... Exposing checks is supposed to allow a Consul agent bound to a different IP address (e.g., in a different Kubernetes pod) to access healthchecks through the proxy while the underlying service binds to localhost. This is an important security feature that makes sure no external traffic reaches the service except through the proxy. However, as far as I can tell, this is subtly broken in the case where the Consul agent cannot reach the proxy over localhost. If a proxy is configured with: `{ LocalServiceAddress: "127.0.0.1", Checks: true }`, as is typical with a sidecar proxy, the Consul checks are currently rewritten to `127.0.0.1:<random port>`. A Consul agent that does not share the loopback address cannot reach this address. Just to make sure I was not misunderstanding, I tried configuring the proxy with `{ LocalServiceAddress: "<pod ip>", Checks: true }`. In this case, while the checks are rewritten as expected and the agent can reach the dynamic port, the proxy can no longer reach its backend because the traffic is no longer on the loopback interface. I think rewriting the checks to use `proxy.Address`, the proxy's own address, is more correct in this case. That is the IP where the proxy can be reached, both by other proxies and by a Consul agent running on a different IP. The local service address should continue to use `127.0.0.1` in most cases.	5 years ago
Andy Lindeman	c1cb18c648	proxycfg: support path exposed with non-HTTP2 protocol (#7510) ... If a proxied service is a gRPC or HTTP2 service, but a path is exposed using the HTTP1 or TCP protocol, Envoy should not be configured with `http2ProtocolOptions` for the cluster backing the path. A situation where this comes up is a gRPC service whose healthcheck or metrics route (e.g. for Prometheus) is an HTTP1 service running on a different port. Previously, if these were exposed either using `Expose: { Checks: true }` or `Expose: { Paths: ... }`, Envoy would still be configured to communicate with the path over HTTP2, which would not work properly.	5 years ago
Pierre Souchay	be1c5c4b48	config: validate system limits against limits.http_max_conns_per_client (#7434) ... I spent some time today on my local Mac to figure out why Consul 1.6.3+ was not accepting limits.http_max_conns_per_client. This adds an explicit check on number of file descriptors to be sure it might work (this is no guarantee as if many clients are reaching the agent, it might consume even more file descriptors) Anyway, many users are fighting with RLIMIT_NOFILE, having a clear message would allow them to figure out what to fix. Example of message (reload or start): ``` 2020-03-11T16:38:37.062+0100 [ERROR] agent: Error starting agent: error="system allows a max of 512 file descriptors, but limits.http_max_conns_per_client: 8192 needs at least 8212" ```	5 years ago
Shaker Islam	ac309d55f4	docs: document exported functions in agent.go (closes #7101) (#7366) ... and fix one linter error	5 years ago
Pierre Souchay	08acd6a03e	[FIX BUILD] fix build due to merge of #7562 ... Due to merge #7562, upstream does not compile anymore. Error is: ERRO Running error: gofmt: analysis skipped: errors in package: [/Users/p.souchay/go/src/github.com/hashicorp/consul/agent/config_endpoint_test.go:188:33: too many arguments]	5 years ago
Daniel Nephin	0d8edc3e27	Merge pull request #7562 from hashicorp/dnephin/remove-tname-from-name ... testing: Remove old default value from NewTestAgent() calls	5 years ago
Daniel Nephin	190fc3c732	Merge pull request #7533 from hashicorp/dnephin/xds-server-1 ... agent/xds: small cleanup	5 years ago
Emre Savcı	2083b7b04d	agent: add len, cap while initializing arrays	5 years ago
Daniel Nephin	e759daafdd	Rename NewTestAgentWithFields to StartTestAgent ... This function now only starts the agent. Using: git grep -l 'StartTestAgent(t, true,' | \ xargs sed -i -e 's/StartTestAgent(t, true,/StartTestAgent(t,/g'	5 years ago
Daniel Nephin	f9f6b14533	Convert the remaining calls to NewTestAgentWithFields ... After removing the t.Name() parameter with sed, convert the last few tests which use a custom name to call NewTestAgentWithFields instead.	5 years ago
Daniel Nephin	0c409d460f	Merge pull request #7470 from hashicorp/dnephin/dns-unused-params ... dns: Remove a few unused function parameters	5 years ago
Pierre Souchay	54b22c638d	config: allow running `consul agent -dev -ui-dir=some_path` (#7525) ... When run in with `-dev` in DevMode, it is not possible to replace the embeded UI with another one because `-dev` implies `-ui`. This commit allows this an slightly change the error message about Consul 0.7.0 which is very old and does not apply to current version anyway.	5 years ago
Daniel Nephin	475659a132	Remove name from NewTestAgent ... Using: git grep -l 'NewTestAgent(t, t.Name(),' | \ xargs sed -i -e 's/NewTestAgent(t, t.Name(),/NewTestAgent(t,/g'	5 years ago
Freddy	90576060bc	Add config entry for terminating gateways (#7545) ... This config entry will be used to configure terminating gateways. It accepts the name of the gateway and a list of services the gateway will represent. For each service users will be able to specify: its name, namespace, and additional options for TLS origination. Co-authored-by: Kyle Havlovitz <kylehav@gmail.com> Co-authored-by: Chris Piraino <cpiraino@hashicorp.com>	5 years ago
Kyle Havlovitz	c911174327	Add config entry/state for Ingress Gateways (#7483) ... * Add Ingress gateway config entry and other relevant structs * Add api package tests for ingress gateways * Embed EnterpriseMeta into ingress service struct * Add namespace fields to api module and test consul config write decoding * Don't require a port for ingress gateways * Add snakeJSON and camelJSON cases in command test * Run Normalize on service's ent metadata Sadly cannot think of a way to test this in OSS. * Every protocol requires at least 1 service * Validate ingress protocols * Update agent/structs/config_entry_gateways.go Co-authored-by: Chris Piraino <cpiraino@hashicorp.com> Co-authored-by: Freddy <freddygv@users.noreply.github.com>	5 years ago
Daniel Nephin	9d959907a4	Merge pull request #7485 from hashicorp/dnephin/do-not-skip-tests-on-ci ... ci: Make it harder to accidentally skip tests on CI, and doc why some are skipped	5 years ago
Daniel Nephin	ad7c78f134	Remove t.Name() from TestAgent.Name ... And re-add the name to the logger so that log messages from different agents in a single can be identified.	5 years ago
Daniel Nephin	231c99f7b4	Document Agent.LogOutput	5 years ago
Daniel Nephin	dd40a1535e	testing: reduce verbosity of output log ... Previously the log output included the test name twice and a long date format. The test output is already grouped by test, so adding the test name did not add any new information. The date and time are only useful to understand elapsed time, so using a short format should provide succident detail. Also fixed a bug in NewTestAgentWithFields where nil was returned instead of the test agent.	5 years ago
Daniel Nephin	1d90ecc31d	Remove unused token parameter	5 years ago
Daniel Nephin	ef68e404a5	A little less 'just'	5 years ago
Daniel Nephin	002fc85ef2	Remove unused customEDSClusterJSON	5 years ago
Matt Keeler	028654410c	Ensure server requirements checks are done against ALL known se… (#7491) ... Co-authored-by: Paul Banks <banks@banksco.de>	5 years ago
Matt Keeler	74a665afc3	Add information about which services are proxied to ui services… (#7417)	5 years ago
Daniel Nephin	b5c7d292e4	Merge pull request #7516 from hashicorp/dnephin/remove-unused-method ... agent: Remove unused method Encrypted from delegate interface	5 years ago
Daniel Nephin	bb8833a2d5	agent: Remove unused Encrypted from interface ... It appears to be unused. It looks like it has been around a while, I geuss at some point we stopped using this method.	5 years ago
Freddy	18d356899c	Enable CLI to register terminating gateways (#7500) ... * Enable CLI to register terminating gateways * Centralize gateway proxy configuration	5 years ago
Daniel Nephin	33c7894123	Merge pull request #7498 from hashicorp/dnephin/small-cleanup ... envoy: small cleanup in cmd and server	5 years ago
Alejandro Baez	bafa69bb69	Add PolicyReadByName for API (#6615)	5 years ago