5299 Commits (CC-5545/upgrade-hds-packages)

Author	SHA1	Message	Date
Iryna Shustava	105ebfdd00	catalog, mesh: implement missing ACL hooks (#19143) ... This change adds ACL hooks to the remaining catalog and mesh resources, excluding any computed ones. Those will for now continue using the default operator:x permissions. It refactors a lot of the common testing functions so that they can be re-used between resources. There are also some types that we don't yet support (e.g. virtual IPs) that this change adds ACL hooks to for future-proofing.	1 year ago
R.B. Boyer	20d1fb8c78	server: run the api checks against the path without params (#19205)	1 year ago
Dhia Ayachi	5fbf0c00d3	Add namespace read write tests (#19173)	1 year ago
Thomas Eckert	76c60fdfac	Golden File Tests for TermGW w/ Cluster Peering (#19096) ... Add intention to create golden file for terminating gateway peered trust bundle	1 year ago
Nitya Dhanushkodi	95d9b2c7e4	[NET-4931] xdsv2, sidecarproxycontroller, l4 trafficpermissions: support L7 (#19185) ... * xdsv2: support l7 by adding xfcc policy/headers, tweaking routes, and make a bunch of listeners l7 tests pass * sidecarproxycontroller: add l7 local app support * trafficpermissions: make l4 traffic permissions work on l7 workloads * rename route name field for consistency with l4 cluster name field * resolve conflicts and rebase * fix: ensure route name is used in l7 destination route name as well. previously it was only in the route names themselves, now the route name and l7 destination route name line up	1 year ago
Iryna Shustava	25283f0ec2	get-envoy-bootstrap-params: when v2 is enabled, use computed proxy configuration (#19175)	1 year ago
Chris S. Kim	197bcd4164	Refactor connect_auth.go into agent_endpoint.go (#19166)	1 year ago
John Maguire	7a323c492b	[NET-5457] Golden Files for Multiple Virtual Hosts (#19131) ... * Add new golden file tests * Update with latest deterministic code	1 year ago
John Murret	6cbd417f29	NET-5822 - Add default outbound router in TProxy (#19087) ... * NET-5822 - Add default outbound router in TProxy * fixing connection timeout to be 5 s instead of 10 seconds	1 year ago
R.B. Boyer	b9ab63c55d	server: when the v2 catalog experiment is enabled reject api and rpc requests that are for the v1 catalog (#19129) ... When the v2 catalog experiment is enabled the old v1 catalog apis will be forcibly disabled at both the API (json) layer and the RPC (msgpack) layer. This will also disable anti-entropy as it uses the v1 api. This includes all of /v1/catalog/*, /v1/health/*, most of /v1/agent/*, /v1/config/*, and most of /v1/internal/*.	1 year ago
John Maguire	8bebfc147d	[NET-5457] Fix CE code for jwt multiple virtual hosts bug (#19123) ... * Fix CE code for jwt multiple virtual hosts bug * Fix struct definition * fix bug with always appending route to jwt config * Update comment to be correct * Update comment	1 year ago
Semir Patel	830c4ea81c	v2tenancy: cluster scoped reads (#19082)	1 year ago
Dhia Ayachi	226590541c	Activate verifier when running WAL with experimental features (#19102) ... * activate verifier when running WAL with experimental features * only change verifier parameters if it's disabled (default value)	1 year ago
Chris S. Kim	92ce814693	Remove old build tags (#19128)	1 year ago
Chris Thain	dcdf2fc6ba	Update Vault CA provider namespace configuration (#19095)	1 year ago
Ashesh Vidyut	a30ccdf5dc	NET-4135 - Fix NodeMeta filtering Catalog List Services API (#18322) ... * logs for debugging * Init * white spaces fix * added change log * Fix tests * fix typo * using queryoptionfilter to populate args.filter * tests * fix test * fix tests * fix tests * fix tests * fix tests * fix variable name * fix tests * fix tests * fix tests * Update .changelog/18322.txt Co-authored-by: Ganesh S <ganesh.seetharaman@hashicorp.com> * fix change log * address nits * removed unused line * doing join only when filter has nodemeta * fix tests * fix tests * Update agent/consul/catalog_endpoint.go Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> * fix tests * removed unwanted code --------- Co-authored-by: Ganesh S <ganesh.seetharaman@hashicorp.com> Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com>	1 year ago
Derek Menteer	af3439b53d	Ensure that upstream configuration is properly normalized. (#19076) ... This PR fixes an issue where upstreams did not correctly inherit the proper namespace / partition from the parent service when attempting to fetch the upstream protocol due to inconsistent normalization. Some of the merge-service-configuration logic would normalize to default, while some of the proxycfg logic would normalize to match the parent service. Due to this mismatch in logic, an incorrect service-defaults configuration entry would be fetched and have its protocol applied to the upstream.	1 year ago
Dhia Ayachi	ed882e2522	Make raft-wal default when `resource-apis` is active (#19090) ... Make raft-wal default when v2 catalog experiment is on	1 year ago
Thomas Eckert	342306c312	Allow connections through Terminating Gateways from peered clusters NET-3463 (#18959) ... * Add InboundPeerTrustBundle maps to Terminating Gateway * Add notify and cancelation of watch for inbound peer trust bundles * Pass peer trust bundles to the RBAC creation function * Regenerate Golden Files * add changelog, also adds another spot that needed peeredTrustBundles * Add basic test for terminating gateway with peer trust bundle * Add intention to cluster peered golden test * rerun codegen * update changelog * really update the changelog --------- Co-authored-by: Melisa Griffin <melisa.griffin@hashicorp.com>	1 year ago
Chris S. Kim	aa526db225	Retry flaky tests (#19088)	1 year ago
Chris S. Kim	ad26494016	[CE] Add workload bind type and templated policy (#19077)	1 year ago
Eric Haberkorn	f2b7b4591a	Fix Traffic Permissions Default Deny (#19028) ... Whenver a traffic permission exists for a given workload identity, turn on default deny. Previously, this was only working at the port level.	1 year ago
John Murret	d67e5c6e35	NET-5590 - authorization: check for identity:write in CA certs, xds server, and getting envoy bootstrap params (#19049) ... * NET-5590 - authorization: check for identity:write in CA certs, xds server, and getting envoy bootstrap params * gofmt file	1 year ago
Chris S. Kim	41e6f6cd8b	Reduce number of ports that consul test agents take (#19047)	1 year ago
sarahalsmiller	9addd9ed7c	[NET-5788] Fix needed for JWTAuth in Consul Enterprise (#19038) ... change needed for fix in consul-enterprise	1 year ago
Nitya Dhanushkodi	9a48266712	remove log (#19029)	1 year ago
Chris Thain	5e45db18b7	Include RequestTimeout in marshal/unmarshal of ServiceResolverConfigE… (#19031)	1 year ago
Eric Haberkorn	7ce6ebaeb3	Handle Traffic Permissions With Empty Sources Properly (#19024) ... Fix issues with empty sources * Validate that each permission on traffic permissions resources has at least one source. * Don't construct RBAC policies when there aren't any principals. This resulted in Envoy rejecting xDS updates with a validation error. ``` error= | rpc error: code = Internal desc = Error adding/updating listener(s) public_listener: Proto constraint validation failed (RBACValidationError.Rules: embedded message failed validation | caused by RBACValidationError.Policies[consul-intentions-layer4-1]: embedded message failed validation | caused by PolicyValidationError.Principals: value must contain at least 1 item(s)): rules { ```	1 year ago
Iryna Shustava	06c15d0656	auth: register auth controllers with the server (#19000)	1 year ago
Iryna Shustava	e6b724d062	catalog,mesh,auth: Move resource types to the proto-public module (#18935)	1 year ago
R.B. Boyer	7688178ad2	peerstream: fix flaky test related to autopilot integration (#18979)	1 year ago
Iryna Shustava	d88888ee8b	catalog,mesh,auth: Bump versions to v2beta1 (#18930)	1 year ago
R.B. Boyer	ef6f2494c7	resource: allow for the ACLs.Read hook to request the entire data payload to perform the authz check (#18925) ... The ACLs.Read hook for a resource only allows for the identity of a resource to be passed in for use in authz consideration. For some resources we wish to allow for the current stored value to dictate how to enforce the ACLs (such as reading a list of applicable services from the payload and allowing service:read on any of them to control reading the enclosing resource). This change update the interface to usually accept a *pbresource.ID, but if the hook decides it needs more data it returns a sentinel error and the resource service knows to defer the authz check until after fetching the data from storage.	1 year ago
Nitya Dhanushkodi	0a11499588	net-5689 fix disabling panic threshold logic (#18958)	1 year ago
Chris S. Kim	565e79344f	Dump response body on fail (#18962)	1 year ago
Ronald	276c60a947	skip flaky test (#18949)	1 year ago
John Landa	9eaa8eb026	dns token (#17936) ... * dns token fix whitespace for docs and comments fix test cases fix test cases remove tabs in help text Add changelog Peering dns test Peering dns test Partial implementation of Peered DNS test Swap to new topology lib expose dns port for integration tests on client remove partial test implementation remove extra port exposure remove changelog from the ent pr Add dns token to set-agent-token switch Add enterprise golden file Use builtin/dns template in tests Update ent dns policy Update ent dns template test remove local gen certs fix templated policy specs * add changelog * go mod tidy	1 year ago
Dhia Ayachi	341dc28ff9	Add namespace proto and registration (#18848) ... * add namespace proto and registration * fix proto generation * add missing copywrite headers * fix proto linter errors * fix exports and Type export * add mutate hook and more validation * add more validation rules and tests * Apply suggestions from code review Co-authored-by: Semir Patel <semir.patel@hashicorp.com> * fix owner error and add test * remove ACL for now * add tests around space suffix prefix. * only fait when ns and ap are default, add test for it --------- Co-authored-by: Semir Patel <semir.patel@hashicorp.com>	1 year ago
R.B. Boyer	d574473fd1	mesh: make FailoverPolicy work in xdsv2 and ProxyStateTemplate (#18900) ... Ensure that configuring a FailoverPolicy for a service that is reachable via a xRoute or a direct upstream causes an envoy aggregate cluster to be created for the original cluster name, but with separate clusters for each one of the possible destinations.	1 year ago
Ronald	c8299522b5	[NET-5332] Add nomad server templated policy (#18888) ... * [NET-5332] Add nomad server templated policy * slksfd	1 year ago
Nitya Dhanushkodi	3a2e62053a	v2: various fixes to make K8s tproxy multiport acceptance tests and manual explicit upstreams (single port) tests pass (#18874) ... Adding coauthors who mobbed/paired at various points throughout last week. Co-authored-by: Dan Stough <dan.stough@hashicorp.com> Co-authored-by: Iryna Shustava <iryna@hashicorp.com> Co-authored-by: John Murret <john.murret@hashicorp.com> Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com> Co-authored-by: Ashwin Venkatesh <ashwin@hashicorp.com> Co-authored-by: Michael Wilkerson <mwilkerson@hashicorp.com>	1 year ago
Nick Ethier	1a3081ab32	agent/config: prevent startup if resource-apis experiment and cloud are enabled (#18876)	1 year ago
Blake Covarrubias	019c62e1ba	xds: Use downstream protocol when connecting to local app (#18573) ... Configure Envoy to use the same HTTP protocol version used by the downstream caller when forwarding requests to a local application that is configured with the protocol set to either `http2` or `grpc`. This allows upstream applications that support both HTTP/1.1 and HTTP/2 on a single port to receive requests using either protocol. This is beneficial when the application primarily communicates using HTTP/2, but also needs to support HTTP/1.1, such as to respond to Kubernetes HTTP readiness/liveness probes. Co-authored-by: Derek Menteer <derek.menteer@hashicorp.com>	1 year ago
Eric Haberkorn	170417ac97	Honor Default Traffic Permissions in V2 (#18886) ... wire up v2 default traffic permissions	1 year ago
Iryna Shustava	212793a4ee	mesh: only build tproxy outbound listener once per destination (#18836) ... Previously, when using implicit upstreams, we'd build outbound listener per destination instead of one for all destinations. This will result in port conflicts when trying to send this config to envoy. This PR also makes sure that leaf and root references are always added (before we would only add it if there are inbound non-mesh ports). Also, black-hole traffic when there are no inbound ports other than mesh	1 year ago
Chris S. Kim	91e6c3a82f	Remove flaky test assertions (#18870)	1 year ago
Semir Patel	62796a1454	resource: mutate and validate before acls on write (#18868)	1 year ago
Ronald	49cb84297f	Move ACL templated policies to hcl files (#18853)	1 year ago
Andrew Stucki	087539fc7b	Fix gateway services cleanup where proxy deregistration happens after service deregistration (#18831) ... * Fix gateway services cleanup where proxy deregistration happens after service deregistration * Add test * Add changelog * Fix comment	1 year ago
Dhia Ayachi	4435e4a420	add v2 tenancy bridge Flag and v2 Tenancy Bridge initial implementation (#18830) ... * add v2 tenancy bridge and a feature flag for v2 tenancy * move tenancy bridge v2 under resource package	1 year ago