consul

Commit Graph

Author	SHA1	Message	Date
sarahalsmiller	32ce33825d	[Security] Secvuln 8633 Consul configuration allowed repeated keys (#21908 ) * upgrade hcl package and account for possiblity of duplicates existing already in the cache * upgrade to new tag * add defensive line to prevent potential forever loop * o mod tidy and changelog * Update acl/policy.go * fix raft reversion * go mod tidy * fix test * remove duplicate key in test * remove duplicates from test cases * clean up * go mod tidy * go mod tidy * pull in new hcl tag	1 week ago
Nathan Coleman	eda961f4a2	Upgrade test improvements for 1.20.x (#21813 ) * Bump Envoy version used for 1.20.x upgrade tests * Improve README + docstrings	1 month ago
Dhia Ayachi	39104a3ce1	Update raft to 1.7.0 and add configuration for prevote (#21758 ) * update raft to 1.7.0 * add config to disable raft prevote * add changelog	2 months ago
R.B. Boyer	3e6f1c1fe1	remove v2 tenancy, catalog, and mesh (#21592 ) * remove v2 tenancy, catalog, and mesh - Inline the v2tenancy experiment to false - Inline the resource-apis experiment to false - Inline the hcp-v2-resource-apis experiment to false - Remove ACL policy templates and rule language changes related to workload identities (a v2-only concept) (e.g. identity and identity_prefix) - Update the gRPC endpoint used by consul-dataplane to no longer respond specially for v2 - Remove stray v2 references scattered throughout the DNS v1.5 newer implementation. * changelog * go mod tidy on consul containers * lint fixes from ENT --------- Co-authored-by: John Murret <john.murret@hashicorp.com>	3 months ago
John Murret	ab794b59f8	update version, changelog, and submodules after 1.19.2, 1.18.4, 1.17.7 and 1.15.14 releases (#21676 ) * update changelog * Update CHANGELOG.md * remove duplicate 1.19.1 section * update version * update go.mod with most recent modules	3 months ago
sarahalsmiller	f3649e16a7	NET-10288-Bump-go-to-resolve-CVE-2024-24791 (#21507 ) * bump go version * changelog * Update .changelog/21507.txt * Update go.mod Co-authored-by: Deniz Onur Duzgun <59659739+dduzgun-security@users.noreply.github.com> * go mod tidy --------- Co-authored-by: Deniz Onur Duzgun <59659739+dduzgun-security@users.noreply.github.com>	5 months ago
sarahalsmiller	6f31bfebbe	Update retryable-http-client to resolve CVE-2024-6104 (#21384 ) * update retryable-http-client * changelog	5 months ago
Michael Zalimeni	9e23fa7840	[NET-9445] chore: update submodule versions (#21263 ) chore: update submodule versions - Update submodule versions that were released - Add missing replace directive to troubleshoot submodule	6 months ago
R.B. Boyer	502346029d	test: remove v2 integration tests (#21056 ) This removes any references to v2 integration tests from: - envoy integration tests (test/integration/connect) - container tests (test/integration/consul-container) - deployer tests (test-integ)	7 months ago
Michael Zalimeni	86b0818c1f	[NET-8601] security: upgrade vault/api to remove go-jose.v2 (#20910 ) security: upgrade vault/api to remove go-jose.v2 This dependency has an open vulnerability (GO-2024-2631), and is no longer needed by the latest `vault/api`. This is a follow-up to the upgrade of `go-jose/v3` in this repository to make all our dependencies consolidate on v3. Also remove the recently added security scan triage block for GO-2024-2631, which was added due to incorrect reports that `go-jose/v3@3.0.3` was impacted; in reality, is was this indirect client dependency (not impacted by CVE) that the scanner was flagging. A bug report has been filed to address the incorrect reporting.	7 months ago
John Murret	d261a987f1	update go-control-plane envoy dependency to 0.12.0 (#20973 ) * update go-control-plane envoy dependency to 0.12.0 * add changelog * go mod tidy * fix linting issues * add agent/grpc-internal to the list of SA1019 ignores	8 months ago
Deniz Onur Duzgun	3152ac3702	security: bump go, x/net and envoy versions (#20956 ) * Bump go version * Bump x/net * Bump envoy version * Add changelog --------- Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>	8 months ago
Chris S. Kim	f3f2175edd	Update go-jose library (#20888 )	8 months ago
Michael Zalimeni	d4761c0ccd	security: upgrade google.golang.org/protobuf to 1.33.0 (#20801 ) Resolves CVE-2024-24786.	9 months ago
wangxinyi7	b1bd6ab91a	revert grpc to http (#20716 ) * Revert "refactor the resource client (#20343)" This reverts commit `3c5cb04b0f`. * Revert "clean up http client (#20342)" This reverts commit `2b89025eab`. * remove deprecated peer * fix the typo * remove forwarding test as it tests grpc, should add it back	9 months ago
Nathan Coleman	2456fe5148	[NET-7657] Remove proto definitions for GatewayClass + GatewayClassConfig (#20523 )	10 months ago
skpratt	57bad0df85	add traffic permissions excludes and tests (#20453 ) * add traffic permissions tests * review fixes * Update internal/mesh/internal/controllers/sidecarproxy/builder/local_app.go Co-authored-by: John Landa <jonathanlanda@gmail.com> --------- Co-authored-by: John Landa <jonathanlanda@gmail.com>	10 months ago
wangxinyi7	ab8f23478a	add more integration tests (#20479 ) * add more integration tests	10 months ago
Derek Menteer	266f6548f9	Debug failing CICD tests (#20455 ) Fix CICD test flakes by locking container socket.	10 months ago
wangxinyi7	fb2b696c0e	missing prefix / (#20447 ) * missing prefix / and fix typos	10 months ago
Derek Menteer	ba5cac434a	Use mirrored image for CICD tests. (#20378 )	10 months ago
Derek Menteer	e586a4490d	Fix CICD docker image rate limits. (#20304 ) The docker image used in CICD was referencing `registry.k8s.io/pause:3.3`, which appears to no longer function correctly. This commit swaps over to a Hashicorp mirrored image that shouldn't have rate limits or disappearing images.	10 months ago
John Landa	65920dccf4	move deny action to enterprise only for traffic permissions (#20313 ) Add missing import Add explicit enum case for deny action Remove extra comments Add build tags to ent and ce tests Add copyright headers for the ce files Fix case statements for ce validator Remove ce tests with Deny traffic permissions Fix more integration tests Split more ce and ent tests, add back ent deny tests for traffic permissions controller temp rename before rebase Readd ent deny tests for traffic permissions controller	10 months ago
Nick Cellino	fe678e9da1	Sync cluster attributes from GNM to Link resource (#20158 ) * Add 'GetCluster' function to HCP client * Sync cluster data inside Link controller * Add access mode to HCP Link * Sync AccessLevel property * Fix imports and remove outdated comments * Switch accessMode to access level * Add comment around HCPClientFn * Fix spacing in link.proto * Add helper for writing status. Fix reconciliation loop	10 months ago
cskh	cba3b25196	integ test: import missing changes from ent (#20187 )	10 months ago
Matt Keeler	326c0ecfbe	In-Memory gRPC (#19942 ) * Implement In-Process gRPC for use by controller caching/indexing This replaces the pipe base listener implementation we were previously using. The new style CAN avoid cloning resources which our controller caching/indexing is taking advantage of to not duplicate resource objects in memory. To maintain safety for controllers and for them to be able to modify data they get back from the cache and the resource service, the client they are presented in their runtime will be wrapped with an autogenerated client which clones request and response messages as they pass through the client. Another sizable change in this PR is to consolidate how server specific gRPC services get registered and managed. Before this was in a bunch of different methods and it was difficult to track down how gRPC services were registered. Now its all in one place. * Fix race in tests * Ensure the resource service is registered to the multiplexed handler for forwarding from client agents * Expose peer streaming on the internal handler	10 months ago
Manoj Srinivasamurthy	fa6eb61f70	NET-6813: adding resolver default subset test in agentless upgrade test (#20046 )	11 months ago
Michael Zalimeni	fe10339caa	[NET-7009] security: update x/crypto to 0.17.0 (#20023 ) security: update x/crypto to 0.17.0 This addresses CVE-2023-48795 (x/crypto/ssh).	11 months ago
John Murret	a995505976	NET-6317 - update usage of deprecated fields: http2_protocol_options and access_log_path (#19940 ) * updating usage of http2_protocol_options and access_log_path * add changelog * update template for AdminAccessLogConfig * remove mucking with AdminAccessLogConfig	11 months ago
Matt Keeler	123bc95e1a	Add Common Controller Caching Infrastructure (#19767 ) * Add Common Controller Caching Infrastructure	12 months ago
Matt Keeler	d4fda945bb	Fix a test flake where a retry timer was being reused causing tests after the first to exit early (#19864 ) Fix a test flake where a retry timer was being reused causing tests after the first to exit too early.	12 months ago
Matt Keeler	efe279f802	Retry lint fixes (#19151 ) * Add a make target to run lint-consul-retry on all the modules * Cleanup sdk/testutil/retry * Fix a bunch of retry.Run* usage to not use the outer testing.T * Fix some more recent retry lint issues and pin to v1.4.0 of lint-consul-retry * Fix codegen copywrite lint issues * Don’t perform cleanup after each retry attempt by default. * Use the common testutil.TestingTB interface in test-integ/tenancy * Fix retry tests * Update otel access logging extension test to perform requests within the retry block	12 months ago
aahel	649aa5655f	skip TestCatalogUpgrade for consul versions < 1.18.0 (#19811 ) skip TestCatalogUpgrade for conul versions < 1.18.0	12 months ago
sarahalsmiller	fd1d97c334	Add Kubebuilder tags to Gatewayclassconfig proto messages (#19725 ) * add build tags/import k8s specific proto packages * fix generated import paths * fix gomod linting issue * mod tidy every go mod file * revert protobuff version, take care of in different pr * cleaned up new lines * added newline to end of file	12 months ago
cskh	04a3a3e8d0	Integ test (test/deployer): upgrade test with service mesh (#19658 ) * Integ test (test/deployer): upgrade test with service mesh * license	1 year ago
R.B. Boyer	da8700f216	test: fix some multiport deployer bugs and remove a container test already handled by deployer tests (#19614 )	1 year ago
cskh	4ab7adaf54	upgrade test: remove duplicate test case (#19643 )	1 year ago
Matt Keeler	a7774a9538	Introduce randomized timings and reproducible randomization into controller integration tests. (#19393 ) As the V2 architecture hinges on eventual consistency and controllers reconciling the existing state in response to writes, there are potential issues we could run into regarding ordering and timing of operations. We want to be able to guarantee that given a set of resources the system will always eventually get to the desired correct state. The order of resource writes and delays in performing those writes should not alter the final outcome of reaching the desired state. To that end, this commit introduces arbitrary randomized delays before performing resources writes into the `resourcetest.Client`. Its `PublishResources` method was already randomizing the order of resource writes. By default, no delay is added to normal writes and deletes but tests can opt-in via either passing hard coded options when creating the `resourcetest.Client` or using the `resourcetest.ConfigureTestCLIFlags` function to allow processing of CLI parameters. In addition to allowing configurability of the request delay min and max, the client also has a configurable random number generator seed. When Using the CLI parameter helpers, a test log will be written noting the currently used settings. If the test fails then you can reproduce the same delays and order randomizations by providing the seed during the previous test failure.	1 year ago
cskh	38d94282ca	Ci upgrade test 1 17 (#19536 ) CI: upgrade test from 1.17	1 year ago
R.B. Boyer	65592d91a8	chore: apply enterprise changes that were missed to some testing files (#19504 ) This should align between CE `ef35525` and ENT 7f95226dbe40151c8f17dd4464784b60cf358dc1 in: - testing/integration/consul-container - test-integ - testing/deployer	1 year ago
Dan Stough	fd128f4947	build: dependency updates for 1.17.0 (#19453 )	1 year ago
Semir Patel	ef35525cf1	resource: finalizer aware delete endpoint (2 of 5) (#19493 ) resource: make delete endpoint finalizer aware	1 year ago
R.B. Boyer	4b85aa5a97	testing/deployer: support tproxy in v2 for dataplane (#19094 ) This updates the testing/deployer (aka "topology test") framework to allow for a v2-oriented topology to opt services into enabling TransparentProxy. The restrictions are similar to that of #19046 The multiport Ports map that was added in #19046 was changed to allow for the protocol to be specified at this time, but for now the only supported protocol is TCP as only L4 functions currently on main. As part of making transparent proxy work, the DNS server needed a new zonefile for responding to virtual.consul requests, since there is no Kubernetes DNS and the Consul DNS work for v2 has not happened yet. Once Consul DNS supports v2 we should switch over. For now the format of queries is: <service>--<namespace>--<partition>.virtual.consul Additionally: - All transparent proxy enabled services are assigned a virtual ip in the 10.244.0/24 range. This is something Consul will do in v2 at a later date, likely during 1.18. - All services with exposed ports (non-mesh) are assigned a virtual port number for use with tproxy - The consul-dataplane image has been made un-distroless, and gotten the necessary tools to execute consul connect redirect-traffic before running dataplane, thus simulating a kubernetes init container in plain docker.	1 year ago
Semir Patel	aaac20f4a8	resource: misc finalizer apis (#19474 )	1 year ago
R.B. Boyer	a72f868218	testing/deployer: update deployer to use v2 catalog constructs when requested (#19046 ) This updates the testing/deployer (aka "topology test") framework to conditionally configure and launch catalog constructs using v2 resources. This is controlled via a Version field on the Node construct in a topology.Config. This only functions for a dataplane type and has other restrictions that match the rest of v2 (no peering, no wanfed, no mesh gateways). Like config entries, you can statically provide a set of initial resources to be synced when bringing up the cluster (beyond those that are generated for you such as workloads, services, etc). If you want to author a test that can be freely converted between v1 and v2 then that is possible. If you switch to the multi-port definition on a topology.Service (aka "workload/instance") then that makes v1 ineligible. This also adds a starter set of "on every PR" integration tests for single and multiport under test-integ/catalogv2	1 year ago
Derek Menteer	8f4c43727d	[NET-5916] Fix locality-aware routing config and tests (CE) (#19483 ) Fix locality-aware routing config and tests	1 year ago
Michael Zalimeni	42647de35d	[NET-6138] security: Bump `google.golang.org/grpc` to 1.56.3 (CVE-2023-44487) (#19414 ) Bump google.golang.org/grpc to 1.56.3 This resolves [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487). Co-authored-by: Chris Thain <chris.m.thain@gmail.com>	1 year ago
John Murret	f0cf8f2f40	NET-6294 - v1 Agentless proxycfg datasource errors after v2 changes (#19365 )	1 year ago
Dhia Ayachi	12ef115b61	bump raft-wal version to 0.4.1 (#19314 ) * bump raft-wal version to 0.4.1 * changelog * go mod tidy integration tests * go mod tidy test-integ	1 year ago
Michael Zalimeni	8eb074e7c1	[NET-5944] security: Update Go version to 1.20.10 and `x/net` to 0.17.0 (#19225 ) * Bump golang.org/x/net to 0.17.0 This resolves [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) / [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487). * Update Go version to 1.20.10 This resolves [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) / [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) (`net/http`).	1 year ago

1 2 3 4 5

210 Commits (main)