consul

Commit Graph

Author	SHA1	Message	Date
Semir Patel	62796a1454	resource: mutate and validate before acls on write (#18868 )	1 year ago
R.B. Boyer	dabbc9627b	mesh: normalize/default/validate tenancy components of mesh internal References (#18827 ) HTTPRoute, GRPCRoute, TCPRoute, and Upstreams resources contain inner Reference fields. We want to ensure that components of those reference Tenancy fields left unspecified are defaulted using the tenancy of the enclosing resource. As the underlying helper being used to do the normalization calls the function modified in #18822, it also means that the PeerName field will be set to "local" for now automatically to avoid "local" != "" issues downstream.	1 year ago
R.B. Boyer	696aa1bbd2	mesh: update xds controller to synthesize empty endpoints when no endpoints ref is found (#18835 )	1 year ago
R.B. Boyer	b4d5178e5c	catalog: normalize/default/validate tenancy components of FailoverPolicy internal References (#18825 ) FailoverPolicy resources contain inner Reference fields. We want to ensure that components of those reference Tenancy fields left unspecified are defaulted using the tenancy of the enclosing FailoverPolicy resource. As the underlying helper being used to do the normalization calls the function modified in #18822, it also means that the PeerName field will be set to "local" for now automatically to avoid "local" != "" issues downstream.	1 year ago
Dhia Ayachi	4435e4a420	add v2 tenancy bridge Flag and v2 Tenancy Bridge initial implementation (#18830 ) * add v2 tenancy bridge and a feature flag for v2 tenancy * move tenancy bridge v2 under resource package	1 year ago
Iryna Shustava	a89938e0c1	catalog: Default protocol to tcp in catalog.Service if unspecified (#18832 )	1 year ago
R.B. Boyer	5cde50dee7	mesh: prevent writing a ComputedRoutes with no ported configs (#18833 )	1 year ago
skpratt	1fda2965e8	Allow empty data writes for resources (#18819 ) * allow nil data writes for resources * update demo to test valid type with no data	1 year ago
Iryna Shustava	6838441c54	Default to tcp protocol when workload protocol is unspecified (#18824 )	1 year ago
Eric Haberkorn	21fdbbabbc	Wire up traffic permissions (#18812 ) Wire up traffic permissions	1 year ago
Semir Patel	d3dad14030	resource: default peername to "local" for now (#18822 )	1 year ago
R.B. Boyer	9c1a1ffcde	mesh: call the right mapper (#18818 )	1 year ago
R.B. Boyer	66e1cdf40c	mesh: Wire ComputedRoutes into the ProxyStateTemplate via the sidecar controller (#18752 ) Reworks the sidecar controller to accept ComputedRoutes as an input and use it to generate appropriate ProxyStateTemplate resources containing L4/L7 mesh configuration.	1 year ago
skpratt	e5808d85f7	register traffic permission and workload identity types (#18704 ) * add workload identity and traffic permission protos * register new types * add generated pb code * fix exports.go path * add proto newlines * fix type name Co-authored-by: Eric Haberkorn <erichaberkorn@gmail.com> * address review * fix protos and add tests * fix validation constraints * add tests --------- Co-authored-by: Eric Haberkorn <erichaberkorn@gmail.com>	1 year ago
Dhia Ayachi	658c27a684	add fuzz tests to resourcehcl package and fix some panics (#18798 ) * add a simple fuzz test for the resourcehcl package and fix some panics uncovered by the test * fix default for null values	1 year ago
Iryna Shustava	7f2a1d9812	catalog: service endpoints inherits protocol from service when workload doesn't have one (#18792 )	1 year ago
R.B. Boyer	07f54fe3b8	resource: add helper to normalize inner Reference tenancy during mutate (#18765 ) When one resource contains an inner field that is of type *pbresource.Reference we want the Tenancy to be reasonably defaulted by the following rules: 1. The final values will be limited by the scope of the referenced type. 2. Values will be inferred from the parent's tenancy, and if that is insufficient then using the default tenancy for the type's scope. 3. Namespace will only be used from a parent if the reference and the parent share a partition, otherwise the default namespace will be used. Until we tackle peering, this hard codes an assumption of peer name being local. The logic for defaulting may need adjustment when that is addressed.	1 year ago
Eric Haberkorn	12be06f8e5	Add V2 TCP traffic permissions (#18771 ) Add support for TCP traffic permissions	1 year ago
Nitya Dhanushkodi	78b170ad50	xds controller: setup watches for and compute leaf cert references in ProxyStateTemplate, and wire up leaf cert manager dependency (#18756 ) * Refactors the leafcert package to not have a dependency on agent/consul and agent/cache to avoid import cycles. This way the xds controller can just import the leafcert package to use the leafcert manager. The leaf cert logic in the controller: * Sets up watches for leaf certs that are referenced in the ProxyStateTemplate (which generates the leaf certs too). * Gets the leaf cert from the leaf cert cache * Stores the leaf cert in the ProxyState that's pushed to xds * For the cert watches, this PR also uses a bimapper + a thin wrapper to map leaf cert events to related ProxyStateTemplates Since bimapper uses a resource.Reference or resource.ID to map between two resource types, I've created an internal type for a leaf certificate to use for the resource.Reference, since it's not a v2 resource. The wrapper allows mapping events to resources (as opposed to mapping resources to resources) The controller tests: Unit: Ensure that we resolve leaf cert references Lifecycle: Ensure that when the CA is updated, the leaf cert is as well Also adds a new spiffe id type, and adds workload identity and workload identity URI to leaf certs. This is so certs are generated with the new workload identity based SPIFFE id. * Pulls out some leaf cert test helpers into a helpers file so it can be used in the xds controller tests. * Wires up leaf cert manager dependency * Support getting token from proxytracker * Add workload identity spiffe id type to the authorize and sign functions --------- Co-authored-by: John Murret <john.murret@hashicorp.com>	1 year ago
R.B. Boyer	89e6725eee	mesh: create new routes-controller to reconcile xRoute types into a ComputedRoutes resource (#18460 ) This new controller produces an intermediate output (ComputedRoutes) that is meant to summarize all relevant xRoutes and related mesh configuration in an easier-to-use format for downstream use to construct the ProxyStateTemplate. It also applies status updates to the xRoute resource types to indicate that they are themselves semantically valid inputs.	1 year ago
Poonam Jadhav	264166fcc0	fix: write endpoint errors out gracefully (#18743 )	1 year ago
John Murret	62062fd4fd	NET-5132 - Configure multiport routing for connect proxies in TProxy mode (#18606 ) * mesh-controller: handle L4 protocols for a proxy without upstreams * sidecar-controller: Support explicit destinations for L4 protocols and single ports. * This controller generates and saves ProxyStateTemplate for sidecar proxies. * It currently supports single-port L4 ports only. * It keeps a cache of all destinations to make it easier to compute and retrieve destinations. * It will update the status of the pbmesh.Upstreams resource if anything is invalid. * endpoints-controller: add workload identity to the service endpoints resource * small fixes * review comments * Address PR comments * sidecar-proxy controller: Add support for transparent proxy This currently does not support inferring destinations from intentions. * PR review comments * mesh-controller: handle L4 protocols for a proxy without upstreams * sidecar-controller: Support explicit destinations for L4 protocols and single ports. * This controller generates and saves ProxyStateTemplate for sidecar proxies. * It currently supports single-port L4 ports only. * It keeps a cache of all destinations to make it easier to compute and retrieve destinations. * It will update the status of the pbmesh.Upstreams resource if anything is invalid. * endpoints-controller: add workload identity to the service endpoints resource * small fixes * review comments * Make sure endpoint refs route to mesh port instead of an app port * Address PR comments * fixing copyright * tidy imports * sidecar-proxy controller: Add support for transparent proxy This currently does not support inferring destinations from intentions. * tidy imports * add copyright headers * Prefix sidecar proxy test files with source and destination. * Update controller_test.go * NET-5132 - Configure multiport routing for connect proxies in TProxy mode * formatting golden files * reverting golden files and adding changes in manually. build implicit destinations still has some issues. * fixing files that were incorrectly repeating the outbound listener * PR comments * extract AlpnProtocol naming convention to getAlpnProtocolFromPortName(portName) * removing address level filtering. * adding license to resources_test.go --------- Co-authored-by: Iryna Shustava <iryna@hashicorp.com> Co-authored-by: R.B. Boyer <rb@hashicorp.com> Co-authored-by: github-team-consul-core <github-team-consul-core@hashicorp.com>	1 year ago
Dhia Ayachi	b1688ad856	Run copyright after running deep-copy as part of the Makefile/CI (#18741 ) * execute copyright headers after performing deep-copy generation. * fix copyright install * Apply suggestions from code review Co-authored-by: Semir Patel <semir.patel@hashicorp.com> * Apply suggestions from code review Co-authored-by: Semir Patel <semir.patel@hashicorp.com> * rename steps to match codegen naming * remove copywrite install category --------- Co-authored-by: Semir Patel <semir.patel@hashicorp.com>	1 year ago
R.B. Boyer	a69e901660	xds: update golden tests to be deterministic (#18707 )	1 year ago
John Murret	3e78b4cf34	Prefix sidecar proxy test files with source and destination. (#18620 ) * mesh-controller: handle L4 protocols for a proxy without upstreams * sidecar-controller: Support explicit destinations for L4 protocols and single ports. * This controller generates and saves ProxyStateTemplate for sidecar proxies. * It currently supports single-port L4 ports only. * It keeps a cache of all destinations to make it easier to compute and retrieve destinations. * It will update the status of the pbmesh.Upstreams resource if anything is invalid. * endpoints-controller: add workload identity to the service endpoints resource * small fixes * review comments * Address PR comments * sidecar-proxy controller: Add support for transparent proxy This currently does not support inferring destinations from intentions. * PR review comments * mesh-controller: handle L4 protocols for a proxy without upstreams * sidecar-controller: Support explicit destinations for L4 protocols and single ports. * This controller generates and saves ProxyStateTemplate for sidecar proxies. * It currently supports single-port L4 ports only. * It keeps a cache of all destinations to make it easier to compute and retrieve destinations. * It will update the status of the pbmesh.Upstreams resource if anything is invalid. * endpoints-controller: add workload identity to the service endpoints resource * small fixes * review comments * Make sure endpoint refs route to mesh port instead of an app port * Address PR comments * fixing copyright * tidy imports * sidecar-proxy controller: Add support for transparent proxy This currently does not support inferring destinations from intentions. * tidy imports * add copyright headers * Prefix sidecar proxy test files with source and destination. * Update controller_test.go --------- Co-authored-by: Iryna Shustava <iryna@hashicorp.com> Co-authored-by: R.B. Boyer <rb@hashicorp.com> Co-authored-by: github-team-consul-core <github-team-consul-core@hashicorp.com>	1 year ago
Iryna Shustava	1557e1d6a3	sidecar-proxy controller: Add support for transparent proxy (NET-5069) (#18458 ) This commit adds support for transparent proxy to the sidecar proxy controller. As we do not yet support inferring destinations from intentions, this assumes that all services in the cluster are destinations.	1 year ago
R.B. Boyer	acd9b3d1c4	test: update sidecarproxy/builder golden tests to use determinstic golden data (#18703 )	1 year ago
Iryna Shustava	3c70e14713	sidecar-proxy controller: L4 controller with explicit upstreams (NET-3988) (#18352 ) * This controller generates and saves ProxyStateTemplate for sidecar proxies. * It currently supports single-port L4 ports only. * It keeps a cache of all destinations to make it easier to compute and retrieve destinations. * It will update the status of the pbmesh.Upstreams resource if anything is invalid. * This commit also changes service endpoints to include workload identity. This made the implementation a bit easier as we don't need to look up as many workloads and instead rely on endpoints data.	1 year ago
wangxinyi7	df9d12a56a	Net 2714/xw cli read command (#18462 ) enable `consul resource read` command in cli	1 year ago
Semir Patel	b96cff7436	resource: Require scope for resource registration (#18635 )	1 year ago
Michael Zalimeni	699aa47416	fix: make UNSPECIFIED protocol pass validation (#18634 ) We explicitly enumerate the allowed protocols in validation, so this change is necessary to use the new enum value. Also add tests for enum validators to ensure they stay aligned to protos unless we explicitly want them to diverge.	1 year ago
Dhia Ayachi	f8d77f027a	delete all v2 resources type when deleting a namespace (CE) (#18621 ) * add namespace scope to ServiceV1Alpha1Type * add CE portion of namespace deletion	1 year ago
Ashwin Venkatesh	797e42dc24	Watch the ProxyTracker from xDS controller (#18611 )	1 year ago
John Murret	0e606504bc	NET-4944 - wire up controllers with proxy tracker (#18603 ) Co-authored-by: github-team-consul-core <github-team-consul-core@hashicorp.com>	1 year ago
John Murret	051f250edb	NET-5338 - NET-5338 - Run a v2 mode xds server (#18579 ) * NET-5338 - NET-5338 - Run a v2 mode xds server * fix linting	1 year ago
Semir Patel	067a0112e2	resource: Make resource listbyowner tenancy aware (#18566 )	1 year ago
R.B. Boyer	8a931241f2	chore: fix missing/incorrect license headers (#18555 )	1 year ago
R.B. Boyer	5b88aae3b4	catalog: validating Protocol and Health enums on Service, Workload, and ServiceEndpoints (#18554 )	1 year ago
Ashwin Venkatesh	4f9955d91e	Update trust bundle into proxy-state-template (#18550 )	1 year ago
R.B. Boyer	17667a1c75	mesh: adding type aliases for mesh resource usage (#18448 ) Introduces some simple type aliases for DecodedResource[*X] wrappers for each type which cut down on the verbosity	1 year ago
Ashwin Venkatesh	0d60380214	xds controller: resolve ServiceEndpoints references in ProxyStateTemp… (#18544 ) xds controller: resolve ServiceEndpoints references in ProxyStateTemplate	1 year ago
R.B. Boyer	55723c541e	mesh: add validation for the new pbmesh resources (#18410 ) Adds validation for HTTPRoute, GRPCRoute, TCPRoute, DestinationPolicy, and ComputedRoutes.	1 year ago
R.B. Boyer	570c84d032	catalog: add failover mode enum validation (#18545 )	1 year ago
Semir Patel	53e28a4963	OSS -> CE (community edition) changes (#18517 )	1 year ago
Matt Keeler	547f4f8395	Reduce required type arguments for DecodedResource (#18540 )	1 year ago
Iryna Shustava	0b580ffd22	bimapper: fix data race (#18519 )	1 year ago
Iryna Shustava	cc596ce772	bimapper: allow to untrack links and support reference or id (#18451 )	1 year ago
Ashwin Venkatesh	97b41d946f	Support custom watches on controller (#18439 ) * Support custom watches on controller * refactor mapper methods	1 year ago
Semir Patel	217107f627	resource: Make resource list tenancy aware (#18475 )	1 year ago
Poonam Jadhav	f88d4fe28f	Net-2707/list resource endpoint (#18444 ) feat: list resources endpoint	1 year ago

... 2 3 4 5 6

293 Commits (CC-7146/Sidebar-item-for-linking-status)