consul

Commit Graph

Author	SHA1	Message	Date
Jeremy Jacobson	aebc520839	Backport of [CC-5718] Remove HCP token requirement during bootstrap (#18289 ) [CC-5718] Remove HCP token requirement during bootstrap	1 year ago
Hans Hasselberg	74fe2be631	manual backport of #17296 to release/1.14.x (#17342 ) * update hcp-sdk-go * add version, datacenter and acl info * fewer changes * go mod tidy and lint * less code * remove duplicated dep * fmt * go mod tidy	2 years ago
Hans Hasselberg	e26ac3f388	Update HCP bootstrapping to support existing clusters 1.14.x version (#17303 ) * Persist HCP management token from server config We want to move away from injecting an initial management token into Consul clusters linked to HCP. The reasoning is that by using a separate class of token we can have more flexibility in terms of allowing HCP's token to co-exist with the user's management token. Down the line we can also more easily adjust the permissions attached to HCP's token to limit it's scope. With these changes, the cloud management token is like the initial management token in that iit has the same global management policy and if it is created it effectively bootstraps the ACL system. * Update SDK and mock HCP server The HCP management token will now be sent in a special field rather than as Consul's "initial management" token configuration. This commit also updates the mock HCP server to more accurately reflect the behavior of the CCM backend. * Refactor HCP bootstrapping logic and add tests We want to allow users to link Consul clusters that already exist to HCP. Existing clusters need care when bootstrapped by HCP, since we do not want to do things like change ACL/TLS settings for a running cluster. Additional changes: * Deconstruct MaybeBootstrap so that it can be tested. The HCP Go SDK requires HTTPS to fetch a token from the Auth URL, even if the backend server is mocked. By pulling the hcp.Client creation out we can modify its TLS configuration in tests while keeping the secure behavior in production code. * Add light validation for data received/loaded. * Sanitize initial_management token from received config, since HCP will only ever use the CloudConfig.MangementToken. * Add changelog entry * pin logr * pin stdr --------- Co-authored-by: freddygv <freddy@hashicorp.com> Co-authored-by: John Murret <john.murret@hashicorp.com>	2 years ago
hc-github-team-consul-core	7eb104544e	backport of commit `12d5cc0c37` (#17028 ) Co-authored-by: Luke Kysow <1034429+lkysow@users.noreply.github.com>	2 years ago
hc-github-team-consul-core	3e3ab25f9b	xds: don't attempt to load-balance sessions for local proxies (#15789 ) (#16004 ) Previously, we'd begin a session with the xDS concurrency limiter regardless of whether the proxy was registered in the catalog or in the server's local agent state. This caused problems for users who run `consul connect envoy` directly against a server rather than a client agent, as the server's locally registered proxies wouldn't be included in the limiter's capacity. Now, the `ConfigSource` is responsible for beginning the session and we only do so for services in the catalog. Fixes: https://github.com/hashicorp/consul/issues/15753 Co-authored-by: Dan Upton <daniel@floppy.co>	2 years ago
hc-github-team-consul-core	35fb3cb433	Backport of Update go version to 1.19 into release/1.14.x (#15139 ) This pull request was automerged via backport-assistant	2 years ago
Hans Hasselberg	0d5935ab83	adding configuration option cloud.scada_address (#14936 ) * adding scada_address * config tests * add changelog entry	2 years ago
Nick Ethier	1c1b0994b8	add HCP integration component (#14723 ) * add HCP integration * lint: use non-deprecated logging interface	2 years ago

8 Commits (18831-backport1.14.10)