715 Commits (FFMMM-patch-1)

Author	SHA1	Message	Date
Daniel Nephin	dc58a8c339	api: remove the test for TestAPI_RulesTranslate_Raw ... The API endpoint was removed in a previous commit, so we can no longer test this deprecated method.	3 years ago
tarat44	c1ed3a9a94	change config option to H2PingUseTLS	3 years ago
tarat44	3c9f5a73d9	add support for h2c in h2 ping health checks	3 years ago
FFMMM	8bb6d8571c	wrap few doRequest calls for error handling (#11158)	3 years ago
Paul Banks	7b4cbe3143	Final readability tweaks from review	3 years ago
Paul Banks	b5345ea878	Add changelog; Add API package support for new fields.	3 years ago
FFMMM	377c3a9b0b	add StatusError to api package (#11054) ... * add require http codes in api and use in operator_autopilot health check * add StatusError type in api package Signed-off-by: FFMMM <FFMMM@users.noreply.github.com>	3 years ago
R.B. Boyer	2af8e16ef9	api: add partition field to acl structs (#11080)	3 years ago
Evan Culver	c4c833fd0e	sso/oidc: add support for acr_values request parameter (#11026) ... Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com>	3 years ago
freddygv	e0a7900f52	Fixup api config and Envoy test	3 years ago
freddygv	886f873fa4	Trim newlines before parenthesis end	3 years ago
Daniel Nephin	1f9479603c	Add failures_before_warning to checks (#10969) ... Signed-off-by: Jakub Sokołowski <jakub@status.im> * agent: add failures_before_warning setting The new setting allows users to specify the number of check failures that have to happen before a service status us updated to be `warning`. This allows for more visibility for detected issues without creating alerts and pinging administrators. Unlike the previous behavior, which caused the service status to not update until it reached the configured `failures_before_critical` setting, now Consul updates the Web UI view with the `warning` state and the output of the service check when `failures_before_warning` is breached. The default value of `FailuresBeforeWarning` is the same as the value of `FailuresBeforeCritical`, which allows for retaining the previous default behavior of not triggering a warning. When `FailuresBeforeWarning` is set to a value higher than that of `FailuresBeforeCritical it has no effect as `FailuresBeforeCritical` takes precedence. Resolves: https://github.com/hashicorp/consul/issues/10680 Signed-off-by: Jakub Sokołowski <jakub@status.im> Co-authored-by: Jakub Sokołowski <jakub@status.im>	3 years ago
Chris S. Kim	5b658d2f39	Sync partition fields from enterprise (#11021)	3 years ago
Dhia Ayachi	ad914e16c2	acl-tokens table partitioning (#11020) ... * convert `Policies` index to use `indexerMulti` * remove non used indexer * fix oss policy Get * add oss tests * remove reference to partition in oss test * convert `Roles` index to use `indexerMulti` * add role test in oss * fix oss to use the right index func * convert `Roles` index to use `indexerSingle` * split authmethod write indexer to oss and ent * add auth method unit tests * add index locality * move intFromBool to be available for oss * add expiry indexes * add api tests * fix rebase * use Bool func * preallocate slice * rename variable	3 years ago
Paul Banks	a9bf4c9b82	Add Changelog entry and api package support for HTTP Header manip	3 years ago
Dhia Ayachi	bc0e4f2f46	partition dicovery chains (#10983) ... * partition dicovery chains * fix default partition for OSS	3 years ago
Paul Ewing	1a45e96307	Revert early out errors in license API (#10952) ... Licensing recently changed in Consul v1.10 and along with those changes the client API was updated such that PutLicense and ResetLicense both immediately return an error to avoid an unecessary round trip that will inevitably fail. For reference, see: 08eb600ee5 Unfortunately, this change broke forward compatibility such that a v1.10 client can no longer make these requests to a v1.9 server which is a valid use case. This commit reintroduces these requests to fix this compatibility breakage but leaves the deprecation notices in tact.	3 years ago
Freddy	d2e50fd130	Sync partitions support in api module (#10938)	3 years ago
Dhia Ayachi	1950ebbe1f	oss portion of ent #1069 (#10883)	3 years ago
R.B. Boyer	097e1645e3	agent: ensure that most agent behavior correctly respects partition configuration (#10880)	3 years ago
Daniel Nephin	4359e38114	debug: restore cancel on SigInt ... Some previous changes broke interrupting the debug on SigInterupt. This change restores the original behaviour by passing a context to requests. Since a new API client function was required to pass the context, I had it also return an io.ReadCloser, so that output can be streamed to files instead of fully buffering in process memory.	3 years ago
R.B. Boyer	310e775a8a	state: partition nodes and coordinates in the state store (#10859) ... Additionally: - partitioned the catalog indexes appropriately for partitioning - removed a stray reference to a non-existent index named "node.checks"	3 years ago
Daniel Nephin	de3439b2cc	api: remove client library tests for old API endpoints ... These methods are being kept around in the api module for now to allow the api module to work with older versions of the HTTP API, but we are no longer able to test them. Since the endpoints are removed there is no way for them to change, so there does not appear to be a need to keep running the tests.	3 years ago
Kyle Havlovitz	073b6c8411	oss: Rename default partition	3 years ago
Mark Anderson	d3cebbd32c	Fixup to support unix domain socket via command line (#10758) ... Missed the need to add support for unix domain socket config via api/command line. This is a variant of the problems described in it is easy to drop one. Signed-off-by: Mark Anderson <manderson@hashicorp.com>	3 years ago
Daniel Nephin	d3325b0253	Merge pull request #10612 from bigmikes/acl-replication-fix ... acl: acl replication routine to report the last error message	3 years ago
Giulio Micheloni	d4a3fe33e8	String type instead of error type and changelog.	3 years ago
Daniel Nephin	97fed47708	Merge pull request #10632 from hashicorp/pairing/acl-authorizer-when-acl-disabled ... acls: Update ACL authorizer to return meaningful permission when ACLs are disabled	3 years ago
Blake Covarrubias	c919f2d9ea	api: Support QueryOptions on additional agent endpoints (#10691) ... Add support for setting QueryOptions on the following agent API endpoints: - /agent/health/service/name/:name - /agent/health/service/id/:id - /agent/service/maintenance/:id This follows the same pattern used in #9903 to support query options for other agent API endpoints. Resolves #9710	3 years ago
Evan Culver	4c4bbfb7c0	Fix api/agent test	3 years ago
Evan Culver	f2d30bbc88	Fix api/agent test	3 years ago
Daniel Nephin	c3149ec0fd	debug: use the new metrics stream in debug command	3 years ago
R.B. Boyer	96b97d6554	replumbing a bunch of api and agent structs for partitions (#10681)	3 years ago
R.B. Boyer	fc9b1a277d	sync changes to oss files made in enterprise (#10670)	3 years ago
Evan Culver	0527dcff57	acls: Show `AuthMethodNamespace` when reading/listing ACL token meta (#10598)	3 years ago
Kyle Havlovitz	77a2f38677	http: add partition query param parsing	3 years ago
Evan Culver	8fce7083c1	tests: skip cases that depend on test server when -short flag set (#10576)	3 years ago
Evan Culver	13bd86527b	Add support for returning ACL secret IDs for accessors with acl:write (#10546)	3 years ago
Daniel Nephin	ec6da0859d	Merge pull request #10570 from hashicorp/copy-of-master ... Changes that were accidentally merged into the old master branch	3 years ago
Jared Kirschner	e517e744af	Merge pull request #10559 from jkirschner-hashicorp/fix-autopilot-config-post-default-values ... Fix defaults for autopilot config update	3 years ago
Jared Kirschner	14059c2653	Fix defaults for autopilot config update ... Previously, for a POST request to the /v1/operator/autopilot/configuration endpoint, any fields not included in the payload were set to a zero-initialized value rather than the documented default value. Now, if an optional field is not included in the payload, it will be set to its documented default value: - CleanupDeadServers: true - LastContactThreshold: "200ms" - MaxTrailingLogs: 250 - MinQuorum: 0 - ServerStabilizationTime: "10s" - RedundancyZoneTag: "" - DisableUpgradeMigration: false - UpgradeVersionTag: ""	3 years ago
Daniel Nephin	3a045cca8d	ca: remove unused RotationPeriod field ... This field was never used. Since it is persisted as part of a map[string]interface{} it is pretty easy to remove it.	3 years ago
Kyle Nusbaum	e72a703041	api: change io.Discard to ioutil.Discard	3 years ago
Daniel Nephin	6ac9149c3f	api: properly close the response body ... reads resp.Body until EOF, so that the http client is able to re-use the TCP connection.	3 years ago
Freddy	ffb13f35f1	Rename CatalogDestinationsOnly (#10397) ... CatalogDestinationsOnly is a passthrough that would enable dialing addresses outside of Consul's catalog. However, when this flag is set to true only _connect_ endpoints for services can be dialed. This flag is being renamed to signal that non-Connect endpoints can't be dialed by transparent proxies when the value is set to true.	3 years ago
Freddy	429f9d8bb8	Add flag for transparent proxies to dial individual instances (#10329)	4 years ago
Dhia Ayachi	4c7f5f31c7	debug: remove the CLI check for debug_enabled (#10273) ... * debug: remove the CLI check for debug_enabled The API allows collecting profiles even debug_enabled=false as long as ACLs are enabled. Remove this check from the CLI so that users do not need to set debug_enabled=true for no reason. Also: - fix the API client to return errors on non-200 status codes for debug endpoints - improve the failure messages when pprof data can not be collected Co-Authored-By: Dhia Ayachi <dhia@hashicorp.com> * remove parallel test runs parallel runs create a race condition that fail the debug tests * Add changelog Co-authored-by: Daniel Nephin <dnephin@hashicorp.com>	4 years ago
Rémi Lapeyre	213524a657	Always set the Content-Type header when a body is present (#10204) ... * Always set the Content-Type header when a body is present Closes https://github.com/hashicorp/consul/issues/10011 * Add Changelog entry * Add more Content-Type exceptions * Fix tests	4 years ago
Matt Keeler	08eb600ee5	Deprecate API driven licensing. ... The two methods in the API client to Put or Reset a license will now always return an error.	4 years ago
Iryna Shustava	d7d44f6ae7	Save exposed ports in agent's store and expose them via API (#10173) ... * Save exposed HTTP or GRPC ports to the agent's store * Add those the health checks API so we can retrieve them from the API * Change redirect-traffic command to also exclude those ports from inbound traffic redirection when expose.checks is set to true.	4 years ago
Daniel Nephin	0f53d6e119	api: fix mesh config entry tests for default namespace	4 years ago
Mark Anderson	f808a25a73	Fixup checksums for tests ... Signed-off-by: Mark Anderson <manderson@hashicorp.com>	4 years ago
Mark Anderson	4d0346bc46	Fixup filtering tests ... Missed annotations for SocketPath, LocalSocketPath, LocalServiceSocketPath Signed-off-by: Mark Anderson <manderson@hashicorp.com>	4 years ago
Daniel Nephin	347f3d2128	Merge pull request #10155 from hashicorp/dnephin/config-entry-remove-fields ... config-entry: remove Kind and Name field from Mesh config entry	4 years ago
Daniel Nephin	c8c85523e1	config-entries: add a test for the API client ... Also fixes a bug with listing kind=mesh config entries. ValidateConfigEntryKind was only being used by the List endpoint, and was yet another place where we have to enumerate all the kinds. This commit removes ValidateConfigEntryKind and uses MakeConfigEntry instead. This change removes the need to maintain two separate functions at the cost of creating an instance of the config entry which will be thrown away immediately.	4 years ago
Mark Anderson	8040f91a43	Add support for downstreams ... Enhance config by adding SocketPath and LocalSocketPath config values Supports syntax of the form: ``` services { name = "sock_forwarder" id = "sock_forwarder.1" socket_path = "/tmp/downstream_3.sock" connect { sidecar_service { proxy { local_service_socket_path = "/tmp/downstream.sock" } } } } ``` Signed-off-by: Mark Anderson <manderson@hashicorp.com>	4 years ago
Mark Anderson	583ae65d5b	Convert mode to string representation ... Signed-off-by: Mark Anderson <manderson@hashicorp.com>	4 years ago
Mark Anderson	8b1217417a	First changes for unix domain sockets upstreams ... Start making structure changes to support unix domain socket address for upstreams upstreams = [ { destination_name = "echo-service" local_bind_socket_path = "/tmp/upstream.sock" config { passive_health_check { interval = "10s" max_failures = 42 } } } Signed-off-by: Mark Anderson <manderson@hashicorp.com>	4 years ago
Daniel Nephin	a07a58a873	config-entry: use custom MarshalJSON for mesh type ... So that the Kind field is added to the JSON object.	4 years ago
Daniel Nephin	62efaaab21	config-entry: remove Kind and Name field from Mesh config entry ... No config entry needs a Kind field. It is only used to determine the Go type to target. As we introduce new config entries (like this one) we can remove the kind field and have the GetKind method return the single supported value. In this case (similar to proxy-defaults) the Name field is also unnecessary. We always use the same value. So we can omit the name field entirely.	4 years ago
Freddy	078c40425f	Rename "cluster" config entry to "mesh" (#10127) ... This config entry is being renamed primarily because in k8s the name cluster could be confusing given that the config entry applies across federated datacenters. Additionally, this config entry will only apply to Consul as a service mesh, so the more generic "cluster" name is not needed.	4 years ago
R.B. Boyer	4db8b78854	connect: update centralized upstreams representation in service-defaults (#10015)	4 years ago
freddygv	7cb3f32672	Convert new tproxy structs in api module into ptrs ... This way we avoid serializing these when empty. Otherwise users of the latest version of the api submodule cannot interact with older versions of Consul, because a new api client would send keys that the older Consul doesn't recognize yet.	4 years ago
freddygv	7bd51ff536	Replace TransparentProxy bool with ProxyMode ... This PR replaces the original boolean used to configure transparent proxy mode. It was replaced with a string mode that can be set to: - "": Empty string is the default for when the setting should be defaulted from other configuration like config entries. - "direct": Direct mode is how applications originally opted into the mesh. Proxy listeners need to be dialed directly. - "transparent": Transparent mode enables configuring Envoy as a transparent proxy. Traffic must be captured and redirected to the inbound and outbound listeners. This PR also adds a struct for transparent proxy specific configuration. Initially this is not stored as a pointer. Will revisit that decision before GA.	4 years ago
freddygv	98ba582797	Fixup mesh gateway docs	4 years ago
Freddy	a02245b75a	Merge pull request #9976 from hashicorp/centralized-upstream-fixups	4 years ago
freddygv	d6db67ef86	Fixup test	4 years ago
Daniel Nephin	5d21d4d77f	Merge pull request #9925 from hashicorp/dnephin/update-memberlist ... Update memberlist to v0.2.3	4 years ago
freddygv	ab752c1c86	Avoid sending zero-value upstream defaults from api	4 years ago
R.B. Boyer	499fee73b3	connect: add toggle to globally disable wildcard outbound network access when transparent proxy is enabled (#9973) ... This adds a new config entry kind "cluster" with a single special name "cluster" where this can be controlled.	4 years ago
Daniel Nephin	46279547ec	Update memberlist to v0.2.3 ... To pickup data race fixes	4 years ago
Seth Hoenig	cd1cd4febd	api: enable query options on agent endpoints ... This PR adds support for setting QueryOptions on a few agent API endpoints. Nomad needs to be able to set the Namespace field on these endpoints to: - query for services / checks in a namespace - deregister services / checks in a namespace - update TTL status on checks in a namespace	4 years ago
Freddy	8207b832df	Add TransparentProxy option to proxy definitions	4 years ago
Freddy	c664938bae	Add per-upstream configuration to service-defaults	4 years ago
Christopher Broglie	f0307c73e5	Add support for configuring TLS ServerName for health checks ... Some TLS servers require SNI, but the Golang HTTP client doesn't include it in the ClientHello when connecting to an IP address. This change adds a new TLSServerName field to health check definitions to optionally set it. This fixes #9473.	4 years ago
freddygv	6090cfcf68	PR comments	4 years ago
freddygv	8b46d8dcbb	Restore old Envoy prefix on escape hatches ... This is done because after removing ID and NodeName from ServiceConfigRequest we will no longer know whether a request coming in is for a Consul client earlier than v1.10.	4 years ago
freddygv	41b2ba1e58	Add omitempty across the board for UpstreamConfig	4 years ago
Matt Keeler	30903db442	AutopilotServerHealth now handles the 429 status code (#8599) ... AutopilotServerHealthy now handles the 429 status code Previously we would error out and not parse the response. Now either a 200 or 429 status code are considered expected statuses and will result in the method returning the reply allowing API consumers to not only see if the system is healthy or not but which server is unhealthy.	4 years ago
freddygv	23ffa3d3f3	And another test fix	4 years ago
Kyle Havlovitz	1e87c7183a	Merge pull request #9672 from hashicorp/ca-force-skip-xc ... connect/ca: Allow ForceWithoutCrossSigning for all providers	4 years ago
freddygv	6fd30d0384	Add TransparentProxy opt to proxy definition	4 years ago
freddygv	e3dc2a49df	Turn Limits and PassiveHealthChecks into pointers	4 years ago
freddygv	87cde19b4c	Create new types for service-defaults upstream cfg	4 years ago
Mark Anderson	b9d22f48cd	Add fields to the /acl/auth-methods endpoint. (#9741) ... * A GET of the /acl/auth-method/:name endpoint returns the fields MaxTokenTTL and TokenLocality, while a LIST (/acl/auth-methods) does not. The list command returns a filtered subset of the full set. This is somewhat deliberate, so that secrets aren't shown, but the TTL and Locality fields aren't (IMO) security critical, and it is useful for the front end to be able to show them. For consistency these changes mirror the 'omit empty' and string representation choices made for the GET call. This includes changes to the gRPC and API code in the client. The new output looks similar to this curl 'http://localhost:8500/v1/acl/auth-methods' | jq '.' { "MaxTokenTTL": "8m20s", "Name": "minikube-ttl-local2", "Type": "kubernetes", "Description": "minikube auth method", "TokenLocality": "local", "CreateIndex": 530, "ModifyIndex": 530, "Namespace": "default" } ] Signed-off-by: Mark Anderson <manderson@hashicorp.com> * Add changelog Signed-off-by: Mark Anderson <manderson@hashicorp.com>	4 years ago
Kyle Havlovitz	7dac583863	connect/ca: Allow ForceWithoutCrossSigning for all providers ... This allows setting ForceWithoutCrossSigning when reconfiguring the CA for any provider, in order to forcibly move to a new root in cases where the old provider isn't reachable or able to cross-sign for whatever reason.	4 years ago
Conor Mongey	7a368bd2b6	Move header methods from config to client	4 years ago
Conor Mongey	eb65e59741	Only override headers if they're set	4 years ago
Conor Mongey	f647569b84	Prefer http.Header over map[string]string to allow for multi-valued headers	4 years ago
Conor Mongey	cdc8cd7b0e	Allow setting arbitrary headers in API client	4 years ago
Daniel Nephin	5a7f4c0dea	Merge pull request #8609 from hashicorp/dnephin/add-query-options-to-ServiceRegister ... api: Add a context to ServiceRegisterOpts	4 years ago
Mike Morris	ab927d5480	Merge pull request #9270 from hashicorp/release/1.9.0 ... merge: release/1.9.0 back into 1.9.x	4 years ago
R.B. Boyer	7c7a3e5165	command: when generating envoy bootstrap configs use the datacenter returned from the agent services endpoint (#9229) ... Fixes #9215	4 years ago
Matt Keeler	66fd23d67f	Refactor to call non-voting servers read replicas (#9191) ... Co-authored-by: Kit Patella <kit@jepsen.io>	4 years ago
Freddy	fe728855ed	Add DC and NS support for Envoy metrics (#9207) ... This PR updates the tags that we generate for Envoy stats. Several of these come with breaking changes, since we can't keep two stats prefixes for a filter.	4 years ago
Matt Keeler	7f87adbcf4	Remove this constant as it is soon to be changing and we want to prevent backwards compat issues (#9193)	4 years ago
R.B. Boyer	61eac21f1a	agent: return the default ACL policy to callers as a header (#9101) ... Header is: X-Consul-Default-ACL-Policy=<allow|deny> This is of particular utility when fetching matching intentions, as the fallthrough for a request that doesn't match any intentions is to enforce using the default acl policy.	4 years ago
Matt Keeler	7ef9b04f90	Add a CLI command for retrieving the autopilot configuration. (#9142)	4 years ago
Matt Keeler	c048e86bb2	Switch to using the external autopilot module	4 years ago
R.B. Boyer	8baf158ea8	Revert "Add namespace support for metrics (OSS) (#9117)" (#9124) ... This reverts commit 06b3b017d3.	4 years ago