93 Commits (0047f09be55fdf790263cbc088bf5ec924ffe644)

Author	SHA1	Message	Date
James Phillips	95930e3cb7	Merge pull request #2237 from hashicorp/f-acl-replication ... Adds ACL replication.	8 years ago
Seth Vargo	c77436ce9b	Update links to serf	8 years ago
James Phillips	c499c4e7d3	Updates documentation for ACL replication.	8 years ago
Seth Vargo	31d427f925	Update arch diagram	8 years ago
James Phillips	eeb0ca636b	Adds a note about prepared queries to the coordinates internals guide.	9 years ago
Sean Chittenden	92298e3d02	Speling police	9 years ago
James Phillips	6711662676	Adds a note about template query ACLs.	9 years ago
James Phillips	01ae1e7dfe	Merge pull request #1820 from hashicorp/f-port-docs ... Adds a reference to the network ports from the security guide.	9 years ago
James Phillips	c1de5b7a13	Adds a reference to the network ports from the security page.	9 years ago
James Phillips	dca480e284	Cleans up the documents.	9 years ago
James Phillips	483898abe5	Renames "prepared_query" ACL policy to "query".	9 years ago
James Phillips	880cd21667	Refactors docs into a more complete state for prepared query ACLs.	9 years ago
James Phillips	67de77482e	Creates new "prepared-query" ACL type and new token capture behavior. ... Prior to this change, prepared queries had the following behavior for ACLs, which will need to change to support templates: 1. A management token, or a token with read access to the service being queried needed to be provided in order to create a prepared query. 2. The token used to create the prepared query was stored with the query in the state store and used to execute the query. 3. A management token, or the token used to create the query needed to be supplied to perform and CRUD operations on an existing prepared query. This was pretty subtle and complicated behavior, and won't work for templates since the service name is computed at execution time. To solve this, we introduce a new "prepared-query" ACL type, where the prefix applies to the query name for static prepared query types and to the prefix for template prepared query types. With this change, the new behavior is: 1. A management token, or a token with "prepared-query" write access to the query name or (soon) the given template prefix is required to do any CRUD operations on a prepared query, or to list prepared queries (the list is filtered by this ACL). 2. You will no longer need a management token to list prepared queries, but you will only be able to see prepared queries that you have access to (you get an empty list instead of permission denied). 3. When listing or getting a query, because it was easy to capture management tokens given the past behavior, this will always blank out the "Token" field (replacing the contents as <hidden>) for all tokens unless a management token is supplied. Going forward, we should discourage people from binding tokens for execution unless strictly necessary. 4. No token will be captured by default when a prepared query is created. If the user wishes to supply an execution token then can pass it in via the "Token" field in the prepared query definition. Otherwise, this field will default to empty. 5. At execution time, we will use the captured token if it exists with the prepared query definition, otherwise we will use the token that's passed in with the request, just like we do for other RPCs (or you can use the agent's configured token for DNS). 6. Prepared queries with no name (accessible only by ID) will not require ACLs to create or modify (execution time will depend on the service ACL configuration). Our argument here is that these are designed to be ephemeral and the IDs are as good as an ACL. Management tokens will be able to list all of these. These changes enable templates, but also enable delegation of authority to manage the prepared query namespace.	9 years ago
csawyerYumaed	5026a40ec1	Update documentation - add Network Ports. ... Update security.html.markdown add section on Network Port usage. TODO: add Atlas port usage.	9 years ago
Seth Vargo	cae0ff354a	Use HTTPS + www. where appropriate	9 years ago
James Phillips	800e946bf1	Adds and updates docs for prepared queries.	9 years ago
James Phillips	86f56ee4a1	Adds a note about the new acquire behavior into the sessions internals guide.	9 years ago
James Phillips	cf1b9fe074	Fixes a typo.	9 years ago
James Phillips	cef9402ab9	Updates docs for network coordinates.	9 years ago
James Phillips	2f9ebdb135	Merge pull request #1187 from sfncook/enable_tag_drift_03 ... Enable tag drift 03	9 years ago
Shawn Cook	1f330add02	Doc changes in response to review.	9 years ago
Shawn Cook	598526eba2	Docs - add verbage to anti-entropy page.	9 years ago
Anthony Scalisi	10e028d599	remove various typos	9 years ago
Jack Pearkes	25f0f3cb37	website: fix broken link on acl page	9 years ago
Ryan Uber	38175f450b	website: docs for keyring ACLs	10 years ago
Ryan Uber	84a47947d7	website: fix event acl policy docs	10 years ago
Ryan Uber	1e5a2a8960	website: add docs for user event acls	10 years ago
Ryan Uber	0381e1a253	website: fix mention of read-only policy for service acls	10 years ago
Ryan Uber	9285ec1891	website: add note about anonymous token and discovery ACLs	10 years ago
Ryan Uber	96746fb1c1	website: document service discovery ACLs	10 years ago
Armon Dadgar	9707383021	website: Update ACL description to longest-prefix	10 years ago
Ryan Uber	8d2834fb12	website: document service and check acl options	10 years ago
Ryan Breen	0696a45b43	Website: cleanup for docs/internals/sessions.html.	10 years ago
Ryan Breen	26f03ea30d	Website: cleanup for docs/internals/security.html.	10 years ago
Ryan Breen	8a50c28fc1	Website: minor tweaks for docs/internals/jepsen.html.	10 years ago
Ryan Breen	dd15b47bdf	Website: fix caps issue in docs/internals/consensus.html.	10 years ago
Ryan Breen	218b432446	Website: minor additional tweaks for docs/internals/consensus.html.	10 years ago
Ryan Breen	2b9bb18921	Website: cleanup for docs/internals/consensus.html, including removing LMDB references in favor of BoltDB per GH-857.	10 years ago
Ryan Breen	5e6a4d4f7d	Website: tweaks to docs/internals/architecture.html.	10 years ago
Ryan Breen	efb374e080	Website: very minor tweaks to docs/internals/anti-entropy.html.	10 years ago
Ryan Breen	d90a466f45	Website: more cleanup for docs/internals/acl.html.	10 years ago
Ryan Breen	ba3071c147	Website: GH-781 and cleanup for docs/internals/acl.html.	10 years ago
Ryan Breen	709de1a43b	Website: GH-730 for docs/internals/acl.html.	10 years ago
Ryan Breen	dc764fee91	Website: cleanup for docs/internals/index.html.	10 years ago
Ryan Uber	86a0417fd7	website: fix typo in anti-entropy docs	10 years ago
Ryan Uber	883f19ea08	Merge pull request #751 from hashicorp/f-ae-doc ... Document anti-entropy internals	10 years ago
Ryan Uber	c459c22327	website: adjustments to anti-entropy docs	10 years ago
Ryan Uber	87bdbdbb98	website: first pass at anti-entropy docs	10 years ago
Ryan Breen	30b7cf7f1f	Website: GH-747 change acl_master token to acl_master_token	10 years ago
Ryan Breen	caf1783366	Website: GH-747 Add docs on acl_master_token installation.	10 years ago