consul

Commit Graph

Author	SHA1	Message	Date
Deniz Onur Duzgun	f055b05ca2	Backport of security: bump go, x/net and envoy versions into release/1.15.x (#20962 ) Backport of security: bump go, x/net and envoy versions into release/1.15.x * Bump go version * Bump x/net * Bump envoy version * Add changelog --------- Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>	8 months ago
Michael Zalimeni	4290bb49ed	[NET-7339] security: update gopkg.in/yaml (#20281 ) security: update gopkg.in/yaml This addresses CVE-2022-28948 and CVE-2021-4235.	10 months ago
hc-github-team-es-release-engineering	e13a4c2e09	[DO NOT MERGE UNTIL EOY] EOY license fixes 1.15.x (#19787 )	11 months ago
hc-github-team-consul-core	c32f33b671	Backport of [NET-7009] security: update x/crypto to 0.17.0 into release/1.15.x (#20027 ) backport of commit `d8a33b4e72` Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>	11 months ago
hc-github-team-consul-core	c33ef90dde	Backport of [NET-5944] security: Update Go version to 1.20.10 and `x/net` to 0.17.0 into release/1.15.x (#19233 ) * backport of commit `d7d9de9564` * backport of commit `0794b1ce74` --------- Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>	1 year ago
hc-github-team-consul-core	78f6df469c	Backport of [NET-5146] security: Update Go version to 1.20.7 and `x/net` to 0.13.0 into release/1.15.x (#18362 ) backport of commit `905e371607` Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>	1 year ago
hc-github-team-consul-core	43ee53a54c	backport of commit `9862a83324` (#16930 ) Co-authored-by: cskh <hui.kang@hashicorp.com>	2 years ago
hc-github-team-consul-core	a3a9b05e14	backport of commit `748e2a76cb` (#16328 ) Co-authored-by: DanStough <dan.stough@hashicorp.com>	2 years ago
hc-github-team-consul-core	0e89df2b7a	Backport of [OSS] security: update go to 1.20.1 into release/1.15.x (#16314 ) * backport of commit `2a8cdf1747` * backport of commit `716d162048` * backport of commit `2c757fac4f` * backport of commit `f81c5d4933` * backport of commit `ff4f0596f3` * backport of commit `31bbca9fe4` * backport of commit `2f54191353` * backport of commit `c263147180` --------- Co-authored-by: DanStough <dan.stough@hashicorp.com>	2 years ago
Dhia Ayachi	2d902b26ac	add log-drop package (#15670 ) * add log-drop package * refactor to extract level * extract metrics * Apply suggestions from code review Co-authored-by: Dan Upton <daniel@floppy.co> * fix compile errors * change to implement a log sink * fix tests to remove sleep * rename and add go docs * fix expending variadic Co-authored-by: Dan Upton <daniel@floppy.co>	2 years ago
Derek Menteer	f52f3c5afc	Fix SDK to support older versions of Consul. (#15423 ) This change was necessary, because the configuration was always generated with a gRPC TLS port, which did not exist in Consul 1.13, and would result in the server failing to launch with an error. This code checks the version of Consul and conditionally adds the gRPC TLS port, only if the version number is greater than 1.14.	2 years ago
Kyle Schochenmaier	bf0f61a878	removes ioutil usage everywhere which was deprecated in go1.16 (#15297 ) * update go version to 1.18 for api and sdk, go mod tidy * removes ioutil usage everywhere which was deprecated in go1.16 in favour of io and os packages. Also introduces a lint rule which forbids use of ioutil going forward. Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com>	2 years ago
Chris S. Kim	bde57c0dd0	Regenerate files according to 1.19.2 formatter	2 years ago
Iryna Shustava	2a25669b13	cli/sdk: Allow redirection to a different consul dns port (#15050 )	2 years ago
freddygv	fac3ddc857	Use internal server certificate for peering TLS A previous commit introduced an internally-managed server certificate to use for peering-related purposes. Now the peering token has been updated to match that behavior: - The server name matches the structure of the server cert - The CA PEMs correspond to the Connect CA Note that if Conect is disabled, and by extension the Connect CA, we fall back to the previous behavior of returning the manually configured certs and local server SNI. Several tests were updated to use the gRPC TLS port since they enable Connect by default. This means that the peering token will embed the Connect CA, and the dialer will expect a TLS listener.	2 years ago
Chris S. Kim	31afaa8097	Track last user of a port	2 years ago
Chris S. Kim	b374250d08	Add debugging logs to freeport	2 years ago
Luke Kysow	988e1fd35d	peering: default to false (#13963 ) * defaulting to false because peering will be released as beta * Ignore peering disabled error in bundles cachetype Co-authored-by: Matt Keeler <mkeeler@users.noreply.github.com> Co-authored-by: freddygv <freddy@hashicorp.com> Co-authored-by: Matt Keeler <mjkeeler7@gmail.com>	2 years ago
R.B. Boyer	af04851637	peering: move peer replication to the external gRPC port (#13698 ) Peer replication is intended to be between separate Consul installs and effectively should be considered "external". This PR moves the peer stream replication bidirectional RPC endpoint to the external gRPC server and ensures that things continue to function.	2 years ago
R.B. Boyer	0d6d16ddfb	add general runstep test helper instead of copying it all over the place (#13013 )	3 years ago
DanStough	95250e7915	Update go version to 1.18.1	3 years ago
R.B. Boyer	80dfcb1bcd	raft: update to v1.3.5 (#12325 ) This includes closing some leadership transfer gaps and adding snapshot restore progress logging.	3 years ago
Daniel Nephin	b058845110	sdk: add TestLogLevel for setting log level in tests And default log level to WARN.	3 years ago
Ashwin Venkatesh	7568f3a102	Add support for 'Partition' and 'RetryJoin' (#12126 ) - Adding a 'Partition' and 'RetryJoin' command allows test cases where one would like to spin up a Consul Agent in a non-default partition to test use-cases that are common when enabling Admin Partition on Kubernetes.	3 years ago
Dan Upton	ca3aca92c4	[OSS] Remove remaining references to master (#11827 )	3 years ago
Daniel Nephin	4185045a7f	sdk/freeport: rename Port to GetOne For better consistency with GetN	3 years ago
Daniel Nephin	ba41db5c4e	sdk: upgrade freeport godoc To clarify how it works, and when it is important to use.	3 years ago
Daniel Nephin	5a61893642	testing: use httptest with freeport	3 years ago
Daniel Nephin	8c7475d95e	sdk: add freeport functions that use t.Cleanup	3 years ago
R.B. Boyer	1e02460bd1	re-run gofmt on 1.17 (#11579 ) This should let freshly recompiled golangci-lint binaries using Go 1.17 pass 'make lint'	3 years ago
Nitya Dhanushkodi	139c4eb844	command/redirect_traffic: Redirect DNS requests to Consul if -consul-dns-ip is passed in (#11480 ) * command/redirect_traffic: add rules to redirect DNS to Consul. Currently uses a hack to get the consul dns service ip, and this hack only works when the service is deployed in the same namespace as consul. * command/redirect_traffic: redirect DNS to Consul when -consul-dns-ip is passed in * Add unit tests to Consul DNS IP table redirect rules Co-authored-by: Ashwin Venkatesh <ashwin@hashicorp.com> Co-authored-by: Iryna Shustava <ishustava@users.noreply.github.com>	3 years ago
FFMMM	4ddf973a31	add root_cert_ttl option for consul connect, vault ca providers (#11428 ) * add root_cert_ttl option for consul connect, vault ca providers Signed-off-by: FFMMM <FFMMM@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Chris S. Kim <ckim@hashicorp.com> * add changelog, pr feedback Signed-off-by: FFMMM <FFMMM@users.noreply.github.com> * Update .changelog/11428.txt, more docs Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> * Update website/content/docs/agent/options.mdx Co-authored-by: Kyle Havlovitz <kylehav@gmail.com> Co-authored-by: Chris S. Kim <ckim@hashicorp.com> Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> Co-authored-by: Kyle Havlovitz <kylehav@gmail.com>	3 years ago
Freddy	e18f3c1f6d	Update error texts (#11022 ) Co-authored-by: Daniel Nephin <dnephin@hashicorp.com>	3 years ago
Sergey Matyukevich	06f3ccebce	Allow configuring graceful stop in testutil (#10566 ) * Allow configuring graceful stop in testutil Signed-off-by: Sergey Matyukevich <s.matyukevich@gmail.com> * add a changelog Co-authored-by: Dhia Ayachi <dhia@hashicorp.com>	3 years ago
Iryna Shustava	95305881ce	cli/sdk: Allow applying redirect-traffic rules in a provided Linux namespace (#10564 )	3 years ago
R.B. Boyer	d7fb3543fc	sdk: Stop making a special /tmp/consul-test directory for testutil.TempFile and testutil.TempDir (#10494 )	3 years ago
David Bariod	797bfb7b51	remove a race condition in sdk testutil server stop (#10342 ) * remove a race condition in sdk testutil server stop * ensure the process has actually stopped	4 years ago
Matt Keeler	caafc02449	hcs-1936: Prepare for adding license auto-retrieval to auto-config in enterprise	4 years ago
Matt Keeler	234d0a3c2a	Preparation for changing where license management is done.	4 years ago
Daniel Nephin	1618912cf6	Fix some test flakes - return errors in TestAgent.Start so that the retry works correctly - remove duplicate logging, the error is returned already - add a missing t.Helper() to retry.Run - properly set a.Agent to nil so that subsequent retry attempts will actually try to start	4 years ago
Iryna Shustava	8dffb89131	Implement traffic redirection exclusion based on proxy config and user-provided values (#10134 ) * Use proxy outbound port from TransparentProxyConfig if provided * If -proxy-id is provided to the redirect-traffic command, exclude any listener ports from inbound traffic redirection. This includes envoy_prometheus_bind_addr, envoy_stats_bind_addr, and the ListenerPort from the Expose configuration. * Allow users to provide additional inbound and outbound ports, outbound CIDRs and additional user IDs to be excluded from traffic redirection. This affects both the traffic-redirect command and the iptables SDK package.	4 years ago
Daniel Nephin	3a27fce2ad	submatview: fix godoc and comment typos Co-authored-by: Paul Banks <banks@banksco.de>	4 years ago
Daniel Nephin	a2986ebb9c	sdk/retry: support ending the iteration early I've found this feature to be very useful in https://pkg.go.dev/gotest.tools/v3/poll#WaitOn I have encountered a few cases where I wanted that same support, so this commit adds it.	4 years ago
Daniel Nephin	034c5c5f8c	sdk/retry: remove the need to pass args to NextOr	4 years ago
Daniel Nephin	5de0a452cf	sdk/retry: a few small debug improvements On a few occasions I've had to read timeout stack traces for tests and noticed that retry.Run runs the function in a goroutine. This makes debuging a timeout more difficult because the gourinte of the retryable function is disconnected from the stack of the actual test. It requires searching through the entire stack trace to find the other goroutine. By using panic instead of runtime.Goexit() we remove the need for a separate goroutine. Also a few other small improvements: * add `R.Helper` so that an assertion function can be used with both testing.T and retry.R. * Pass t to `Retryer.NextOr`, and call `t.Helper` in a number of places so that the line number reported by `t.Log` is the line in the test where `retry.Run` was called, instead of some line in `retry.go` that is not relevant to the failure. * improve the implementation of `dedup` by removing the need to iterate twice. Instad track the lines and skip any duplicate when writing to the buffer.	4 years ago
Iryna Shustava	5755c97bc7	cli: Add new `consul connect redirect-traffic` command for applying traffic redirection rules when Transparent Proxy is enabled. (#9910 ) * Add new consul connect redirect-traffic command for applying traffic redirection rules when Transparent Proxy is enabled. * Add new iptables package for applying traffic redirection rules with iptables.	4 years ago
John Eikenberry	1266bfd65b	[SDK] change all cases of *testing.T to testing.TB Using the interface opens up the use of all methods to benchmarks as well as tests.	4 years ago
Shengjing Zhu	b931e989b8	sdk: read procfs instead of using sysctl command This drops the dependency of sysctl command	4 years ago
R.B. Boyer	a2a8e9c783	connect: intentions are now managed as a new config entry kind "service-intentions" (#8834 ) - Upgrade the ConfigEntry.ListAll RPC to be kind-aware so that older copies of consul will not see new config entries it doesn't understand replicate down. - Add shim conversion code so that the old API/CLI method of interacting with intentions will continue to work so long as none of these are edited via config entry endpoints. Almost all of the read-only APIs will continue to function indefinitely. - Add new APIs that operate on individual intentions without IDs so that the UI doesn't need to implement CAS operations. - Add a new serf feature flag indicating support for intentions-as-config-entries. - The old line-item intentions way of interacting with the state store will transparently flip between the legacy memdb table and the config entry representations so that readers will never see a hiccup during migration where the results are incomplete. It uses a piece of system metadata to control the flip. - The primary datacenter will begin migrating intentions into config entries on startup once all servers in the datacenter are on a version of Consul with the intentions-as-config-entries feature flag. When it is complete the old state store representations will be cleared. We also record a piece of system metadata indicating this has occurred. We use this metadata to skip ALL of this code the next time the leader starts up. - The secondary datacenters continue to run the old intentions replicator until all servers in the secondary DC and primary DC support intentions-as-config-entries (via serf flag). Once this condition it met the old intentions replicator ceases. - The secondary datacenters replicate the new config entries as they are migrated in the primary. When they detect that the primary has zeroed it's old state store table it waits until all config entries up to that point are replicated and then zeroes its own copy of the old state store table. We also record a piece of system metadata indicating this has occurred. We use this metadata to skip ALL of this code the next time the leader starts up.	4 years ago
Paul Burlumi	bb2b5dd871	testutil: use TestingTB instead of testing.TB	4 years ago

1 2

87 Commits (release/1.15.15)