consul

Commit Graph

Author	SHA1	Message	Date
Michael Zalimeni	d9206fc7e2	[NET-1151 NET-11228] security: Add request normalization and header match options to prevent L7 intentions bypass (#21816 ) mesh: add options for HTTP incoming request normalization Expose global mesh configuration to enforce inbound HTTP request normalization on mesh traffic via Envoy xDS config. mesh: enable inbound URL path normalization by default mesh: add support for L7 header match contains and ignore_case Enable partial string and case-insensitive matching in L7 intentions header match rules. ui: support L7 header match contains and ignore_case Co-authored-by: Phil Renaud <phil@riotindustries.com> test: add request normalization integration bats tests Add both "positive" and "negative" test suites, showing normalization in action as well as expected results when it is not enabled, for the same set of test cases. Also add some alternative service container test helpers for verifying raw HTTP request paths, which is difficult to do with Fortio. docs: update security and reference docs for L7 intentions bypass prevention - Update security docs with best practices for service intentions configuration - Update configuration entry references for mesh and intentions to reflect new values and add guidance on usage	1 month ago
Michael Zalimeni	2a99624859	test: update pause Docker image in Envoy int tests (#21659 ) k8s.gcr.io has been migrated to registry.k8s.io for several years now, and the old registry is being shut down, causing image pull failures. Update to target the new registry when pulling the pause image used in Envoy integration tests.	3 months ago
Michael Zalimeni	40ca4ad6d0	[NET-5622] build: consolidate Envoy version management (#21245 ) * build: consolidate Envoy version management Simplify Envoy version management by consolidating all runtime, build, and CI sources of Envoy versions into a single plaintext file. The goal of this change is to avoid common mistakes missing an update of some Envoy versions (both in general and due to release branch inconsistency), and enable automated Envoy version updates in the future. * ci: add missing ref argument for get-go-version Supports nightly tests.	5 months ago
sarahalsmiller	2cdc387bd3	Bump Envoy Versions (#21277 ) * update envoy versions * add changelog * update nightly integrations	5 months ago
Dan Stough	cf1c030043	feat: update supported envoy to 1.29 (#21142 )	6 months ago
R.B. Boyer	502346029d	test: remove v2 integration tests (#21056 ) This removes any references to v2 integration tests from: - envoy integration tests (test/integration/connect) - container tests (test/integration/consul-container) - deployer tests (test-integ)	7 months ago
Michael Zalimeni	5eea0b6c76	test: force IPv4 on Docker 26+ to fix Envoy int tests (#20986 ) As of Docker Engine 26.0.0 (https://github.com/moby/moby/pull/47062), IPv6 is enabled by default where supported. This causes issues for our tests attempting to resolve requests to other containers over localhost, since on Linux IPv6 will be preferred over IPv4 when available when applying the default behavior defined in RFC3484. As a workaround, force IPv4 with a flag passed to `docker run`.	7 months ago
John Murret	255aa158db	update comments and docs about running envoy integration tests with the ENVOY_VERSION set. (#18614 ) update ENVOY_VERSION and documentation of it used in the bats envoy tests. Co-authored-by: github-team-consul-core <github-team-consul-core@hashicorp.com>	1 year ago
John Murret	051f250edb	NET-5338 - NET-5338 - Run a v2 mode xds server (#18579 ) * NET-5338 - NET-5338 - Run a v2 mode xds server * fix linting	1 year ago
hashicorp-copywrite[bot]	5fb9df1640	[COMPLIANCE] License changes (#18443 ) * Adding explicit MPL license for sub-package This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository. * Adding explicit MPL license for sub-package This directory and its subdirectories (packages) contain files licensed with the MPLv2 `LICENSE` file in this directory and are intentionally licensed separately from the BSL `LICENSE` file at the root of this repository. * Updating the license from MPL to Business Source License Going forward, this project will be licensed under the Business Source License v1.1. Please see our blog post for more details at <Blog URL>, FAQ at www.hashicorp.com/licensing-faq, and details of the license at www.hashicorp.com/bsl. * add missing license headers * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 * Update copyright file headers to BUSL-1.1 --------- Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com>	1 year ago
John Murret	2cefa8d9bd	ci: remove test-integrations CircleCI workflow (#16928 ) * remove all CircleCI files * remove references to CircleCI * remove more references to CircleCI * pin golangci-lint to v1.51.1 instead of v1.51	2 years ago
Nick Irvine	32358ddf7e	port ENT ingress gateway upgrade tests [NET-2294] [NET-2296] (#16804 )	2 years ago
Ronald	b64674623e	Copyright headers for missing files/folders (#16708 ) * copyright headers for agent folder	2 years ago
Andrew Stucki	f4210d47dd	Add basic smoke test to make sure an APIGateway runs (#16217 )	2 years ago
Derek Menteer	ef61bdf3c2	Remove unnecessary default test config. (#15361 )	2 years ago
boruszak	38b1a515f1	Mergimg	2 years ago
freddygv	3034df6a5c	Require Connect and TLS to generate peering tokens By requiring Connect and a gRPC TLS listener we can automatically configure TLS for all peering control-plane traffic.	2 years ago
Luke Kysow	960c42854b	Remove terminal colouring from test output so it is (#14810 ) more readable in CI. ``` Running primary verification step for case-ingress-gateway-multiple-services... �[34;1mverify.bats �[0m�[1G ingress proxy admin is up on :20000�[K�[75G 1/12�[2G�[1G ✓ ingress proxy admin is up on :20000�[K �[0m�[1G s1 proxy admin is up on :19000�[K�[75G 2/12�[2G�[1G ✓ s1 proxy admin is up on :19000�[K �[0m�[1G s2 proxy admin is up on :19001�[K�[75G 3/12�[2G�[1G ✓ s2 proxy admin is up on :19001�[K �[0m�[1G s1 proxy listener should be up and have right cert�[K�[75G 4/12�[2G�[1G ✓ s1 proxy listener should be up and have right cert�[K �[0m�[1G s2 proxy listener should be up and have right cert�[K�[75G 5/12�[2G�[1G ✓ s2 proxy listener should be up and have right cert�[K �[0m�[1G ingress-gateway should have healthy endpoints for s1�[K�[75G 6/12�[2G�[31;1m�[1G ✗ ingress-gateway should have healthy endpoints for s1�[K �[0m�[31;22m (from function `assert_upstream_has_endpoints_in_status' in file /workdir/primary/bats/helpers.bash, line 385, ``` versus ``` Running primary verification step for case-ingress-gateway-multiple-services... 1..12 ok 1 ingress proxy admin is up on :20000 ok 2 s1 proxy admin is up on :19000 ok 3 s2 proxy admin is up on :19001 ok 4 s1 proxy listener should be up and have right cert ok 5 s2 proxy listener should be up and have right cert not ok 6 ingress-gateway should have healthy endpoints for s1 not ok 7 s1 proxy should have been configured with max_connections in services ok 8 ingress-gateway should have healthy endpoints for s2 ```	2 years ago
Evan Culver	31ef39112a	Add more content to integration test docs (#14613 )	2 years ago
Evan Culver	d0416f593c	connect: Bump latest Envoy to 1.23.1 in test matrix (#14573 )	2 years ago
Luke Kysow	095764a482	Suppress "unbound variable" error. (#14424 ) Without this change, you'd see this error: ``` ./run-tests.sh: line 49: LAMBDA_TESTS_ENABLED: unbound variable ./run-tests.sh: line 49: LAMBDA_TESTS_ENABLED: unbound variable ```	2 years ago
Luke Kysow	70bb6a2abd	Run integration tests locally using amd64 (#14365 ) Locally, always run integration tests using amd64, even if running on an arm mac. This ensures the architecture locally always matches the CI/CD environment. In addition: * Use consul:local for envoy integration and upgrade tests. Previously, consul:local was used for upgrade tests and consul-dev for integration tests. I didn't see a reason to use separate images as it's more confusing. * By default, disable the requirement that aws credentials are set. These are only needed for the lambda tests and make it so you can't run any tests locally, even if you're not running the lambda tests. Now they'll only run if the LAMBDA_TESTS_ENABLED env var is set. * Split out the building of the Docker image for integration tests into its own target from `dev-docker`. This allows us to always use an amd64 image without messing up the `dev-docker` target. * Add support for passing GO_TEST_FLAGs to `test-envoy-integ` target. * Add a wait_for_leader function because tests were failing locally without it.	2 years ago
Chris S. Kim	670531f828	Retry docker build steps	2 years ago
Chris Thain	af40b9b144	Add Consul Lambda integration tests (#13770 )	2 years ago
Evan Culver	4116537b83	connect: Add support for Envoy 1.23, remove 1.19 (#13807 )	2 years ago
R.B. Boyer	af04851637	peering: move peer replication to the external gRPC port (#13698 ) Peer replication is intended to be between separate Consul installs and effectively should be considered "external". This PR moves the peer stream replication bidirectional RPC endpoint to the external gRPC server and ensures that things continue to function.	2 years ago
R.B. Boyer	1a9c86ea8f	xds: mesh gateways now correctly load up peer-exported discovery chains using L7 protocols (#13624 ) A mesh gateway will now configure the filter chains for L7 exported services using the correct discovery chain information.	2 years ago
Dan Upton	ebf74d08fd	test: run Envoy integration tests against both servers and clients (#13610 )	2 years ago
Evan Culver	7f8c650d61	connect: Use Envoy 1.22.2 instead of 1.22.1 (#13444 )	2 years ago
Evan Culver	ba6136eb42	connect: Update Envoy support matrix to latest patch releases (#13431 )	2 years ago
R.B. Boyer	bba3eb8cdd	peering: mesh gateways are required for cross-peer service mesh communication (#13410 ) Require use of mesh gateways in order for service mesh data plane traffic to flow between peers. This also adds plumbing for envoy integration tests involving peers, and one starter peering test.	2 years ago
R.B. Boyer	bd87505bf2	ci: upgrade bats and the circle machine executors to get integration tests to function again (#12918 ) Bonus change: send less context when building the test-sds-server to speed up the setup.	3 years ago
Evan Culver	000d0621b4	connect: Add Envoy 1.22 to integration tests, remove Envoy 1.18 (#12805 ) Co-authored-by: R.B. Boyer <rb@hashicorp.com>	3 years ago
Evan Culver	881e17fae1	connect: Add Envoy 1.21.1 to support matrix, remove 1.17.4 (#12777 )	3 years ago
R.B. Boyer	231e5b61e7	test: use docker buildkit backend for envoy integration tests (#12726 )	3 years ago
Evan Culver	b95f010ac0	connect: Upgrade Envoy 1.20 to 1.20.2 (#12443 )	3 years ago
Evan Culver	e35dd08a63	connect: Upgrade Envoy 1.20 to 1.20.1 (#11895 )	3 years ago
freddygv	5c1f7aa372	Allow cross-partition references in disco chain * Add partition fields to targets like service route destinations * Update validation to prevent cross-DC + cross-partition references * Handle partitions when reading config entries for disco chain * Encode partition in compiled targets	3 years ago
freddygv	129d54d060	Fix integ test	3 years ago
freddygv	cc19f09f92	Add cross-partition integration test	3 years ago
Evan Culver	61be9371f5	connect: Remove support for Envoy 1.16 (#11354 )	3 years ago
Evan Culver	bec08f4ec3	connect: Add support for Envoy 1.20 (#11277 )	3 years ago
R.B. Boyer	3b6eeced50	test: remove some envoy integ test warnings (#11369 ) We launch one container as part of the test with --pid=host but apparently within that container it launches a copy of "tini" as a process supervisor that prefers to be PID 1. Because it's not PID 1 it logs a warning message about this to the envoy integration test logs that can lead to thinking somehow that a test failure is related when in fact it's completely unrelated. Adding this environment variable avoids the warning.	3 years ago
Paul Banks	2b755d7b3f	Allow skipping v2 compat tests for SDS as it's only the SDS server integration that doesn't support v2	3 years ago
Paul Banks	e01c3585a5	Fix integration tests in CI - serve SDS certs from the Docker image not a mounted path	3 years ago
Paul Banks	cd8ad007fe	Add basic integration test for Envoy ingress with SDS	3 years ago
Evan Culver	7605dff46e	add envoy 1.19.1	3 years ago
Freddy	8d83d27674	connect: update envoy supported versions to latest patch release (#10961) Relevant advisory: https://github.com/envoyproxy/envoy/security/advisories/GHSA-6g4j-5vrw-2m8h	3 years ago
Matt Keeler	caafc02449	hcs-1936: Prepare for adding license auto-retrieval to auto-config in enterprise	4 years ago
R.B. Boyer	3b50a55533	connect: update supported envoy versions to 1.18.3, 1.17.3, 1.16.4, and 1.15.5 (#10231 )	4 years ago

1 2

84 Commits (main)