3747 Commits (0402cc16bfbaa392b4fbb4c17e1e88942fd28bb5)

Author	SHA1	Message	Date
Daniel Nephin	d63cef1219	acl: remove legacy ACL replication	3 years ago
R.B. Boyer	ee372a854a	acl: adding a new mesh resource	3 years ago
Dhia Ayachi	ced8329d80	try to infer command partition from node partition (#10981)	3 years ago
Dhia Ayachi	09197c989c	add partition to SNI when partition is non default (#10917)	3 years ago
Freddy	8d83d27674	connect: update envoy supported versions to latest patch release ... (#10961) Relevant advisory: https://github.com/envoyproxy/envoy/security/advisories/GHSA-6g4j-5vrw-2m8h	3 years ago
Evan Culver	79c7e73618	rpc: authorize raft requests (#10925)	3 years ago
hc-github-team-consul-core	cd3333ad6a	auto-updated agent/uiserver/bindata_assetfs.go from commit eeeb91bea	3 years ago
Chris S. Kim	1a9b2f09dd	ent->oss test fix (#10926)	3 years ago
hc-github-team-consul-core	2d66c4ea13	auto-updated agent/uiserver/bindata_assetfs.go from commit a907e1d87	3 years ago
hc-github-team-consul-core	a163051dbb	auto-updated agent/uiserver/bindata_assetfs.go from commit a0b0ed2bc	3 years ago
Chris S. Kim	45dcc8b553	api: expose upstream routing configurations in topology view (#10811) ... Some users are defining routing configurations that do not have associated services. This commit surfaces these configs in the topology visualization. Also fixes a minor internal bug with non-transparent proxy upstream/downstream references.	3 years ago
R.B. Boyer	a6d22efb49	acl: some acl authz refactors for nodes (#10909)	3 years ago
hc-github-team-consul-core	11b1dc1f97	auto-updated agent/uiserver/bindata_assetfs.go from commit a777b0a9b	3 years ago
hc-github-team-consul-core	5e31421602	auto-updated agent/uiserver/bindata_assetfs.go from commit 8192dde48	3 years ago
R.B. Boyer	5b6d96d27d	grpc: ensure that streaming gRPC requests work over mesh gateway based wan federation (#10838) ... Fixes #10796	3 years ago
hc-github-team-consul-core	4993d877d9	auto-updated agent/uiserver/bindata_assetfs.go from commit 05a28c311	3 years ago
freddygv	01936ddb70	Avoid passing zero value into variadic	3 years ago
freddygv	f52bd80f6d	Update comment for test function	3 years ago
freddygv	af52d21884	Update prepared query cluster SAN validation ... Previously SAN validation for prepared queries was broken because we validated against the name, namespace, and datacenter for prepared queries. However, prepared queries can target: - Services with a name that isn't their own - Services in multiple datacenters This means that the SpiffeID to validate needs to be based on the prepared query endpoints, and not the prepared query's upstream definition. This commit updates prepared query clusters to account for that.	3 years ago
freddygv	85878685b7	Fixup proxy config test fixtures ... - The TestNodeService helper created services with the fixed name "web", and now that name is overridable. - The discovery chain snapshot didn't have prepared query endpoints so the endpoints tests were missing data for prepared queries	3 years ago
R.B. Boyer	fb27c1b24f	agent: add partition labels to catalog API metrics where appropriate (#10890)	3 years ago
R.B. Boyer	d66a43f5f2	fixing various bits of enterprise meta plumbing to be more correct (#10889)	3 years ago
Dhia Ayachi	1950ebbe1f	oss portion of ent #1069 (#10883)	3 years ago
R.B. Boyer	ac41e30614	state: partition the nodes.uuid and nodes.meta indexes as well (#10882)	3 years ago
R.B. Boyer	097e1645e3	agent: ensure that most agent behavior correctly respects partition configuration (#10880)	3 years ago
Daniel Nephin	271352dbb7	Merge pull request #10849 from hashicorp/dnephin/contrib-doc-xds-auth ... xds: document how authorization works	3 years ago
R.B. Boyer	e44bce3c4f	state: partition the usage metrics subsystem (#10867)	3 years ago
Daniel Nephin	8252a2691c	xds: document how authorization works	3 years ago
R.B. Boyer	613dd7d053	state: adjust streaming event generation to account for partitioned nodes (#10860) ... Also re-enabled some tests that had to be disabled in the prior PR.	3 years ago
R.B. Boyer	310e775a8a	state: partition nodes and coordinates in the state store (#10859) ... Additionally: - partitioned the catalog indexes appropriately for partitioning - removed a stray reference to a non-existent index named "node.checks"	3 years ago
Daniel Nephin	01bf115c2b	acl: small improvements to ACLResolver disable due to RPC error ... Remove the error return, so that not handling is not reported as an error by errcheck. It was returning the error passed as an arg unmodified so there is no reason to return the same value that was passed in. Remove the term upstreams to remove any confusion with the term used in service mesh. Remove the AutoDisable field, and replace it with the TTL value, using 0 to indicate the setting is turned off. Replace "not Before" with "After". Add some test coverage to show the behaviour is still correct.	3 years ago
Daniel Nephin	d5498770fa	acl: make ACLDisabledTTL a constant ... This field was never user-configurable. We always overwrote the value with 120s from NonUserSource. However, we also never copied the value from RuntimeConfig to consul.Config, So the value in NonUserSource was always ignored, and we used the default value of 30s set by consul.DefaultConfig. All of this code is an unnecessary distraction because a user can not actually configure this value. This commit removes the fields and uses a constant value instad. Someone attempting to set acl.disabled_ttl in their config will now get an error about an unknown field, but previously the value was completely ignored, so the new behaviour seems more correct. We have to keep this field in the AutoConfig response for backwards compatibility, but the value will be ignored by the client, so it doesn't really matter what value we set.	3 years ago
Daniel Nephin	abd2e160f9	Fix test failures ... Tests only specified one of the fields, but in production we copy the value from a single place, so we can do the same in tests. The AutoConfig test broke because of the problem noticed in a previous commit. The DisabledTTL is not wired up properly so it reports 0s here. Changed the test to use an explicit value.	3 years ago
Daniel Nephin	17841248dd	config: remove ACLResolver settings from RuntimeConfig	3 years ago
Daniel Nephin	31e034215f	acl: remove ACLResolver config fields from consul.Config	3 years ago
Daniel Nephin	d4701903f6	acl: replace ACLResolver.Config with its own struct ... This is step toward decoupling ACLResolver from the agent/consul package.	3 years ago
Daniel Nephin	c2b24adb5f	acl: remove ACLRulesTranslateLegacyToken API endpoint	3 years ago
Daniel Nephin	b7bced9bcf	acl: remove legacy bootstrap ... Return an explicit error from the RPC, and remove the flag from the HTTP API.	3 years ago
Daniel Nephin	858071d55a	agent: update some tests that were using legacy ACL endpoints ... The tests were updated to use the new ACL endpoints now that the legacy ones have been removed.	3 years ago
Daniel Nephin	7ecd2e5466	http: update legacy ACL endpoints to return an error ... Also move a test for the ACLReplicationStatus endpoint into the correct file.	3 years ago
Daniel Nephin	9671dd6b97	acl: add some notes about removing legacy ACL system	3 years ago
Daniel Nephin	887d11923b	Merge pull request #10792 from hashicorp/dnephin/rename-authz-vars ... acl: use authz consistently as the variable name for an acl.Authorizer	3 years ago
Daniel Nephin	c85c62dffb	Merge pull request #10807 from hashicorp/dnephin/remove-acl-datacenter ... config: remove ACLDatacenter	3 years ago
Daniel Nephin	e637cd71f3	acl: use authz consistently as the variable name for an acl.Authorizer ... Follow up to https://github.com/hashicorp/consul/pull/10737#discussion_r682147950 Renames all variables for acl.Authorizer to use `authz`. Previously some places used `rule` which I believe was an old name carried over from the legacy ACL system. A couple places also used authorizer. This commit also removes another couple of authorizer nil checks that are no longer necessary.	3 years ago
hc-github-team-consul-core	ed85684d96	auto-updated agent/uiserver/bindata_assetfs.go from commit ae9c31338	3 years ago
Kyle Havlovitz	fa5df0349d	Merge pull request #10843 from hashicorp/partitions/rename-default ... oss: Rename default partition	3 years ago
Kyle Havlovitz	073b6c8411	oss: Rename default partition	3 years ago
Daniel Nephin	0575498d0d	proxycfg: Lookup the agent token as a default ... When no ACL token is provided with the service registration.	3 years ago
Daniel Nephin	b313f495b8	proxycfg: Add a test to show the bug ... When a token is not provided at registration, the agent token is not being used.	3 years ago
Mike Morris	3bae53a989	deps: upgrade gogo-protobuf to v1.3.2 (#10813) ... * deps: upgrade gogo-protobuf to v1.3.2 * go mod tidy using go 1.16 * proto: regen protobufs after upgrading gogo/protobuf Co-authored-by: Daniel Nephin <dnephin@hashicorp.com>	3 years ago
Mark Anderson	d3cebbd32c	Fixup to support unix domain socket via command line (#10758) ... Missed the need to add support for unix domain socket config via api/command line. This is a variant of the problems described in it is easy to drop one. Signed-off-by: Mark Anderson <manderson@hashicorp.com>	3 years ago
hc-github-team-consul-core	199e850d16	auto-updated agent/uiserver/bindata_assetfs.go from commit ab6a67520	3 years ago
Daniel Nephin	67fc97522f	server: remove defaulting of PrimaryDatacenter ... The constructor for Server is not at all the appropriate place to be setting default values for a config struct that was passed in. In production this value is always set from agent/config. In tests we should set the default in a test helper.	3 years ago
Daniel Nephin	d3325b0253	Merge pull request #10612 from bigmikes/acl-replication-fix ... acl: acl replication routine to report the last error message	3 years ago
Daniel Nephin	7160f7a614	acl: remove ACLDatacenter ... This field has been unnecessary for a while now. It was always set to the same value as PrimaryDatacenter. So we can remove the duplicate field and use PrimaryDatacenter directly. This change was made by GoLand refactor, which did most of the work for me.	3 years ago
Giulio Micheloni	d4a3fe33e8	String type instead of error type and changelog.	3 years ago
Daniel Nephin	b837ba35a0	acl: remove Server.ResolveTokenIdentityAndDefaultMeta ... This method suffered from similar naming to a couple other methods on Server, and had not great re-use (2 callers). By copying a few of the lines into one of the callers we can move the implementation into the second caller. Once moved, we can see that ResolveTokenAndDefaultMeta is identical in both Client and Server, and likely should be further refactored, possibly into ACLResolver. This change is being made to make ACL resolution easier to trace.	3 years ago
Daniel Nephin	6cf6e7c5fe	acl: remove Server.ResolveTokenToIdentityAndAuthorizer ... This method was an alias for ACLResolver.ResolveTokenToIdentityAndAuthorizer. By removing the method that does nothing the code becomes easier to trace.	3 years ago
Daniel Nephin	cc4f155801	acl: recouple acl filtering from ACLResolver ... ACL filtering only needs an authorizer and a logger. We can decouple filtering from the ACLResolver by passing in the necessary logger. This change is being made in preparation for moving the ACLResolver into an acl package	3 years ago
Daniel Nephin	111f3620a8	acl: remove unused error return ... filterACLWithAuthorizer could never return an error. This change moves us a little bit closer to being able to enable errcheck and catch problems caused by unhandled error return values.	3 years ago
Daniel Nephin	c0100543d0	acl: rename acl.Authorizer vars to authz ... For consistency	3 years ago
Daniel Nephin	4f5477ccfa	acl: move vet functions ... These functions are moved to the one place they are called to improve code locality. They are being moved out of agent/consul/acl.go in preparation for moving ACLResolver to an acl package.	3 years ago
Daniel Nephin	c4eadb6b96	acl: move vetRegisterWithACL and vetDeregisterWithACL ... These functions are used in only one place. Move the functions next to their one caller to improve code locality. This change is being made in preparation for moving the ACLResolver into an acl package. The moved functions were previously in the same file as the ACLResolver. By moving them out of that file we may be able to move the entire file with fewer modifications.	3 years ago
Daniel Nephin	1deba421c7	Merge pull request #10770 from hashicorp/dnephin/log-cert-expiration ... telemetry: add log message when certs are about to expire	3 years ago
Daniel Nephin	0c42b38c92	Merge pull request #10793 from hashicorp/dnephin/acl-intentions ... acl: small cleanup of a couple Authorization flows	3 years ago
Dhia Ayachi	b495036823	defer setting the state before returning to avoid stuck in `INITIALIZING` state (#10630) ... * defer setting the state before returning to avoid being stuck in `INITIALIZING` state * add changelog * move comment with the right if statement * ca: report state transition error from setSTate * update comment to reflect state transition Co-authored-by: Daniel Nephin <dnephin@hashicorp.com>	3 years ago
Daniel Nephin	e94016872a	Merge pull request #10768 from hashicorp/dnephin/agent-tls-cert-expiration-metric ... telemetry: add Agent TLS Certificate expiration metric	3 years ago
Daniel Nephin	c718de730b	acl: remove special handling of services in txn_endpoint ... Follow up to: https://github.com/hashicorp/consul/pull/10738#discussion_r680190210 Previously we were passing an Authorizer that would always allow the operation, then later checking the authorization using vetServiceTxnOp. On the surface this seemed strange, but I think it was actually masking a bug as well. Over time `servicePreApply` was changed to add additional authorization for `service.Proxy.DestinationServiceName`, but because we were passing a nil Authorizer, that authorization was not handled on the txn_endpoint. `TxnServiceOp.FillAuthzContext` has some special handling in enterprise, so we need to make sure to continue to use that from the Txn endpoint. This commit removes the `vetServiceTxnOp` function, and passes in the `FillAuthzContext` function so that `servicePreApply` can be used by both the catalog and txn endpoints. This should be much less error prone and prevent bugs like this in the future.	3 years ago
hc-github-team-consul-core	af9acf4943	auto-updated agent/uiserver/bindata_assetfs.go from commit bcd53e73a	3 years ago
Daniel Nephin	5b2e5882b4	acl: move check for Intention.DestinationName into Authorizer ... Follow up to https://github.com/hashicorp/consul/pull/10737#discussion_r680134445 Move the check for the Intention.DestinationName into the Authorizer to remove the need to check what kind of Authorizer is being used. It sounds like this check is only for legacy ACLs, so is probably just a safeguard .	3 years ago
Daniel Nephin	bbce192b4d	Merge pull request #10738 from hashicorp/dnephin/remove-authorizer-nil-checks-2 ... acl: remove the last of the authz == nil checks	3 years ago
Daniel Nephin	9cdd823ffc	Merge pull request #10737 from hashicorp/dnephin/remove-authorizer-nil-checks ... acl: remove authz == nil checks	3 years ago
Daniel Nephin	0e58e1ac4b	telemetry: add log message when certs are about to expire	3 years ago
Daniel Nephin	9420506fae	telemetry: fix a couple bugs in cert expiry metrics ... 1. do not emit the metric if Query fails 2. properly check for PrimaryUsersIntermediate, the logic was inverted Also improve the logging by including the metric name in the log message	3 years ago
Daniel Nephin	8c575445da	telemetry: add a metric for agent TLS cert expiry	3 years ago
Dhia Ayachi	cfa9cf6d84	fix state index for `CAOpSetRootsAndConfig` op (#10675) ... * fix state index for `CAOpSetRootsAndConfig` op * add changelog * Update changelog Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> * remove the change log as it's not needed Co-authored-by: Daniel Nephin <dnephin@hashicorp.com>	3 years ago
hc-github-team-consul-core	2f6c95011b	auto-updated agent/uiserver/bindata_assetfs.go from commit 8ad1ab9c0	3 years ago
Evan Culver	710bd90ef7	checks: Add Interval and Timeout to API response (#10717)	3 years ago
Daniel Nephin	8cf1aa1bda	acl: Remove the remaining authz == nil checks ... These checks were a bit more involved. They were previously skipping some code paths when the authorizer was nil. After looking through these it seems correct to remove the authz == nil check, since it will never evaluate to true.	3 years ago
Daniel Nephin	dc50b36b0f	acl: remove acl == nil checks	3 years ago
Daniel Nephin	4f1a36629a	acl: remove authz == nil checks ... These case are already impossible conditions, because most of these functions already start with a check for ACLs being disabled. So the code path being removed could never be reached. The one other case (ConnectAuthorized) was already changed in a previous commit. This commit removes an impossible branch because authz == nil can never be true.	3 years ago
Daniel Nephin	f497d5ab30	acl: remove many instances of authz == nil	3 years ago
Daniel Nephin	b8ae00c23b	agent: remove unused agent methods ... These methods are no longer used. Remove the methods, and update the tests to use actual method used by production code. Also removes the 'authz == nil' check is no longer a possible code path now that we are returning a non-nil acl.Authorizer when ACLs are disabled.	3 years ago
Daniel Nephin	9dd6d26d05	acl: remove rule == nil checks	3 years ago
hc-github-team-consul-core	323039dd06	auto-updated agent/uiserver/bindata_assetfs.go from commit 2ee501be8	3 years ago
Daniel Nephin	97fed47708	Merge pull request #10632 from hashicorp/pairing/acl-authorizer-when-acl-disabled ... acls: Update ACL authorizer to return meaningful permission when ACLs are disabled	3 years ago
Evan Culver	727b81a757	Fix intention endpoint test	3 years ago
Daniel Nephin	84fac3ce0e	acl: use acl.ManangeAll when ACLs are disabled ... Instead of returning nil and checking for nilness Removes a bunch of nil checks, and fixes one test failures.	3 years ago
Blake Covarrubias	11f1f3fe34	Add OSS changes for specifying audit log permission mode	3 years ago
Daniel Nephin	d2b58cd0d6	Merge pull request #10707 from hashicorp/dnephin/streaming-setup-default-timeout ... streaming: set default query timeout	3 years ago
Daniel Nephin	242b3a2dc5	streaming: set a default timeout ... The blocking query backend sets the default value on the server side. The streaming backend does not using blocking queries, so we must set the timeout on the client.	3 years ago
hc-github-team-consul-core	9c33505aef	auto-updated agent/uiserver/bindata_assetfs.go from commit eb5512fb7	3 years ago
Chris S. Kim	9c3af1a429	sync enterprise files with oss (#10705)	3 years ago
Daniel Nephin	8cfbc8e7c9	http: don't log an error if the request is cancelled ... Now that we have at least one endpoint that uses context for cancellation we can encounter this scenario where the returned error is a context.Cancelled or context.DeadlineExceeded. If the request.Context().Err() is not nil, then we know the request itself was cancelled, so we can log a different message at Info level, instad of the error.	3 years ago
Daniel Nephin	a0b114968e	Merge pull request #10399 from hashicorp/dnephin/debug-stream-metrics ... debug: use the new metrics stream in debug command	3 years ago
Daniel Nephin	e58a074bde	http: add tests for AgentMetricsStream	3 years ago
Daniel Nephin	beea1c2218	http: emit indented JSON in the metrics stream endpoint ... To remove the need to decode and re-encode in the CLI	3 years ago
Daniel Nephin	c3149ec0fd	debug: use the new metrics stream in debug command	3 years ago
Freddy	ff9700b068	Reset root prune interval after TestLeader_CARootPruning completes ... #10645 Co-authored-by: Daniel Nephin <dnephin@hashicorp.com>	3 years ago
Chris S. Kim	91c90a672a	agent: update proxy upstreams to inherit namespace from service (#10688)	3 years ago
Freddy	19f6e1ca31	Log the correlation ID when blocking queries fire (#10689) ... Knowing that blocking queries are firing does not provide much information on its own. If we know the correlation IDs we can piece together which parts of the snapshot have been populated. Some of these responses might be empty from the blocking query timing out. But if they're returning quickly I think we can reasonably assume they contain data.	3 years ago
R.B. Boyer	3343c7cb3a	state: refactor some node/coordinate state store functions to take an EnterpriseMeta (#10687) ... Note the field is not used yet.	3 years ago
R.B. Boyer	96b97d6554	replumbing a bunch of api and agent structs for partitions (#10681)	3 years ago
R.B. Boyer	fc9b1a277d	sync changes to oss files made in enterprise (#10670)	3 years ago
R.B. Boyer	188e8dc51f	agent/structs: add a bunch more EnterpriseMeta helper functions to help with partitioning (#10669)	3 years ago
Dhia Ayachi	c6859b3fb0	config raft apply silent error (#10657) ... * return an error when the index is not valid * check response as bool when applying `CAOpSetConfig` * remove check for bool response * fix error message and add check to test * fix comment * add changelog	3 years ago
Freddy	cf4821885d	Avoid panic on concurrent writes to cached service config map (#10647) ... If multiple instances of a service are co-located on the same node then their proxies will all share a cache entry for their resolved service configuration. This is because the cache key contains the name of the watched service but does not take into account the ID of the watching proxies. This means that there will be multiple agent service manager watches that can wake up on the same cache update. These watchers then concurrently modify the value in the cache when merging the resolved config into the local proxy definitions. To avoid this concurrent map write we will only delete the key from opaque config in the local proxy definition after the merge, rather than from the cached value before the merge.	3 years ago
hc-github-team-consul-core	139717d3f8	auto-updated agent/uiserver/bindata_assetfs.go from commit 1eb7a83ee	3 years ago
Blake Covarrubias	a0cd3dd88e	Add DNS recursor strategy option (#10611) ... This change adds a new `dns_config.recursor_strategy` option which controls how Consul queries DNS resolvers listed in the `recursors` config option. The supported options are `sequential` (default), and `random`. Closes #8807 Co-authored-by: Blake Covarrubias <blake@covarrubi.as> Co-authored-by: Priyanka Sengupta <psengupta@flatiron.com>	3 years ago
Daniel Nephin	499250cbf1	Merge pull request #10396 from hashicorp/dnephin/fix-more-data-races ... Fix some data races	3 years ago
Daniel Nephin	1c8ac9cd4b	Merge pull request #10009 from hashicorp/dnephin/trim-dns-response-with-edns ... dns: properly trim response when EDNS is used	3 years ago
Daniel Nephin	a77575e93e	acl: use SetHash consistently in testPolicyForID ... A previous commit used SetHash on two of the cases to fix a data race. This commit applies that change to all cases. Using SetHash in this test helper should ensure that the test helper behaves closer to production.	3 years ago
Daniel Nephin	4bf58d8e6a	dns: improve naming of error to match DNS terminology ... Co-authored-by: Blake Covarrubias <blake@covarrubi.as>	3 years ago
Dhia Ayachi	f0cd1441a9	fix truncate when NS is set ... Also: fix test to catch the issue	3 years ago
Evan Culver	0527dcff57	acls: Show `AuthMethodNamespace` when reading/listing ACL token meta (#10598)	3 years ago
Daniel Nephin	bb675139c1	Merge pull request #10567 from hashicorp/dnephin/config-unexport-build ... config: unexport the remaining builder methods	3 years ago
Freddy	12b7e07d5c	Merge pull request #10621 from hashicorp/vuln/validate-sans	3 years ago
Daniel Nephin	bb7fb21004	Fix godoc comment ... Co-authored-by: Freddy <freddygv@users.noreply.github.com>	3 years ago
R.B. Boyer	20feb42d3a	xds: ensure single L7 deny intention with default deny policy does not result in allow action (CVE-2021-36213) (#10619)	3 years ago
hc-github-team-consul-core	58807668bd	auto-updated agent/uiserver/bindata_assetfs.go from commit 0762da3a6	3 years ago
Giulio Micheloni	814ef6b103	acl: fix error type into a string type for serialization issue ... acl_endpoint_test.go:507: Error Trace: acl_endpoint_test.go:507 retry.go:148 retry.go:149 retry.go:103 acl_endpoint_test.go:504 Error: Received unexpected error: codec.decoder: decodeValue: Cannot decode non-nil codec value into nil error (1 methods) Test: TestACLEndpoint_ReplicationStatus	3 years ago
freddygv	b4c5c58c9b	Add TODOs about partition handling	3 years ago
freddygv	5a82656510	Update golden files	3 years ago
freddygv	47da00d3c7	Validate SANs for passthrough clusters and failovers	3 years ago
freddygv	5454147c09	Update golden files to account for SAN validation	3 years ago
freddygv	a6d3fe90b1	Validate Subject Alternative Name for upstreams ... These changes ensure that the identity of services dialed is cryptographically verified. For all upstreams we validate against SPIFFE IDs in the format used by Consul's service mesh: spiffe://<trust-domain>/ns/<namespace>/dc/<datacenter>/svc/<service>	3 years ago
Daniel Nephin	fa47c04065	Fix a data race in TestACLResolver_Client ... By setting the hash when we create the policy. ``` WARNING: DATA RACE Read at 0x00c0028b4b10 by goroutine 1182: github.com/hashicorp/consul/agent/structs.(*ACLPolicy).SetHash() /home/daniel/pers/code/consul/agent/structs/acl.go:701 +0x40d github.com/hashicorp/consul/agent/structs.ACLPolicies.resolveWithCache() /home/daniel/pers/code/consul/agent/structs/acl.go:779 +0xfe github.com/hashicorp/consul/agent/structs.ACLPolicies.Compile() /home/daniel/pers/code/consul/agent/structs/acl.go:809 +0xf1 github.com/hashicorp/consul/agent/consul.(*ACLResolver).ResolveTokenToIdentityAndAuthorizer() /home/daniel/pers/code/consul/agent/consul/acl.go:1226 +0x6ef github.com/hashicorp/consul/agent/consul.resolveTokenAsync() /home/daniel/pers/code/consul/agent/consul/acl_test.go:66 +0x5c Previous write at 0x00c0028b4b10 by goroutine 1509: github.com/hashicorp/consul/agent/structs.(*ACLPolicy).SetHash() /home/daniel/pers/code/consul/agent/structs/acl.go:730 +0x3a8 github.com/hashicorp/consul/agent/structs.ACLPolicies.resolveWithCache() /home/daniel/pers/code/consul/agent/structs/acl.go:779 +0xfe github.com/hashicorp/consul/agent/structs.ACLPolicies.Compile() /home/daniel/pers/code/consul/agent/structs/acl.go:809 +0xf1 github.com/hashicorp/consul/agent/consul.(*ACLResolver).ResolveTokenToIdentityAndAuthorizer() /home/daniel/pers/code/consul/agent/consul/acl.go:1226 +0x6ef github.com/hashicorp/consul/agent/consul.resolveTokenAsync() /home/daniel/pers/code/consul/agent/consul/acl_test.go:66 +0x5c Goroutine 1182 (running) created at: github.com/hashicorp/consul/agent/consul.TestACLResolver_Client.func4() /home/daniel/pers/code/consul/agent/consul/acl_test.go:1669 +0x459 testing.tRunner() /usr/lib/go/src/testing/testing.go:1193 +0x202 Goroutine 1509 (running) created at: github.com/hashicorp/consul/agent/consul.TestACLResolver_Client.func4() /home/daniel/pers/code/consul/agent/consul/acl_test.go:1668 +0x415 testing.tRunner() /usr/lib/go/src/testing/testing.go:1193 +0x202 ```	3 years ago
Daniel Nephin	a0ca381037	agent: remove deprecated call in a test	3 years ago
Daniel Nephin	678014de1d	agent: fix a data race in a test ... The test was modifying a pointer to a struct that had been passed to another goroutine. Instead create a new struct to modify. ``` WARNING: DATA RACE Write at 0x00c01407c3c0 by goroutine 832: github.com/hashicorp/consul/agent.TestServiceManager_PersistService_API() /home/daniel/pers/code/consul/agent/service_manager_test.go:446 +0x1d86 testing.tRunner() /usr/lib/go/src/testing/testing.go:1193 +0x202 Previous read at 0x00c01407c3c0 by goroutine 938: reflect.typedmemmove() /usr/lib/go/src/runtime/mbarrier.go:177 +0x0 reflect.Value.Set() /usr/lib/go/src/reflect/value.go:1569 +0x13b github.com/mitchellh/copystructure.(*walker).Primitive() /home/daniel/go/pkg/mod/github.com/mitchellh/copystructure@v1.0.0/copystructure.go:289 +0x190 github.com/mitchellh/reflectwalk.walkPrimitive() /home/daniel/go/pkg/mod/github.com/mitchellh/reflectwalk@v1.0.1/reflectwalk.go:252 +0x31b github.com/mitchellh/reflectwalk.walk() /home/daniel/go/pkg/mod/github.com/mitchellh/reflectwalk@v1.0.1/reflectwalk.go:179 +0x24d github.com/mitchellh/reflectwalk.walkStruct() /home/daniel/go/pkg/mod/github.com/mitchellh/reflectwalk@v1.0.1/reflectwalk.go:386 +0x4ec github.com/mitchellh/reflectwalk.walk() /home/daniel/go/pkg/mod/github.com/mitchellh/reflectwalk@v1.0.1/reflectwalk.go:188 +0x656 github.com/mitchellh/reflectwalk.walkStruct() /home/daniel/go/pkg/mod/github.com/mitchellh/reflectwalk@v1.0.1/reflectwalk.go:386 +0x4ec github.com/mitchellh/reflectwalk.walk() /home/daniel/go/pkg/mod/github.com/mitchellh/reflectwalk@v1.0.1/reflectwalk.go:188 +0x656 github.com/mitchellh/reflectwalk.Walk() /home/daniel/go/pkg/mod/github.com/mitchellh/reflectwalk@v1.0.1/reflectwalk.go:92 +0x164 github.com/mitchellh/copystructure.Config.Copy() /home/daniel/go/pkg/mod/github.com/mitchellh/copystructure@v1.0.0/copystructure.go:69 +0xe7 github.com/mitchellh/copystructure.Copy() /home/daniel/go/pkg/mod/github.com/mitchellh/copystructure@v1.0.0/copystructure.go:13 +0x84 github.com/hashicorp/consul/agent.mergeServiceConfig() /home/daniel/pers/code/consul/agent/service_manager.go:362 +0x56 github.com/hashicorp/consul/agent.(*serviceConfigWatch).handleUpdate() /home/daniel/pers/code/consul/agent/service_manager.go:279 +0x250 github.com/hashicorp/consul/agent.(*serviceConfigWatch).runWatch() /home/daniel/pers/code/consul/agent/service_manager.go:246 +0x2d4 Goroutine 832 (running) created at: testing.(*T).Run() /usr/lib/go/src/testing/testing.go:1238 +0x5d7 testing.runTests.func1() /usr/lib/go/src/testing/testing.go:1511 +0xa6 testing.tRunner() /usr/lib/go/src/testing/testing.go:1193 +0x202 testing.runTests() /usr/lib/go/src/testing/testing.go:1509 +0x612 testing.(*M).Run() /usr/lib/go/src/testing/testing.go:1417 +0x3b3 main.main() _testmain.go:1181 +0x236 Goroutine 938 (running) created at: github.com/hashicorp/consul/agent.(*serviceConfigWatch).start() /home/daniel/pers/code/consul/agent/service_manager.go:223 +0x4e4 github.com/hashicorp/consul/agent.(*ServiceManager).AddService() /home/daniel/pers/code/consul/agent/service_manager.go:98 +0x344 github.com/hashicorp/consul/agent.(*Agent).addServiceLocked() /home/daniel/pers/code/consul/agent/agent.go:1942 +0x2e4 github.com/hashicorp/consul/agent.(*Agent).AddService() /home/daniel/pers/code/consul/agent/agent.go:1929 +0x337 github.com/hashicorp/consul/agent.TestServiceManager_PersistService_API() /home/daniel/pers/code/consul/agent/service_manager_test.go:400 +0x17c4 testing.tRunner() /usr/lib/go/src/testing/testing.go:1193 +0x202 ```	3 years ago
Daniel Nephin	0acfc2c65b	agent: fix a data race in DNS tests ... The dnsConfig pulled from the atomic.Value is a pointer, so modifying it in place creates a data race. Use the exported ReloadConfig interface instead.	3 years ago
Daniel Nephin	970f5d78ec	agent: fix two data race in agent tests ... The LogOutput io.Writer used by TestAgent must allow concurrent reads and writes, and a bytes.Buffer does not allow this. The bytes.Buffer must be wrapped with a lock to make this safe.	3 years ago
Daniel Nephin	baa2b8628e	consul: fix data race in leader CA tests ... Some global variables are patched to shorter values in these tests. But the goroutines that read them can outlive the test because nothing waited for them to exit. This commit adds a Wait() method to the routine manager, so that tests can wait for the goroutines to exit. This prevents the data race because the 'reset to original value' can happen after all other goroutines have stopped.	3 years ago
Daniel Nephin	204bf2b345	dns: correct rcode for qtype not supported ... A previous commit started using QueryRefuced, but that is not correct. QueryRefuced refers to the OpCode, not the query type. Instead use errNoAnswer because we have no records for that query type.	3 years ago
Dhia Ayachi	ad2065f2aa	Check response len do not exceed max Buffer size	3 years ago
Dhia Ayachi	f8f2756967	add missing test for truncate	3 years ago
Daniel Nephin	d116bda958	dns: remove network parameter from two funcs ... Now that trimDNSResponse is handled by the caller we don't need to pass this value around. We can remove it from both the serviceLookup struct, and two functions.	3 years ago
Daniel Nephin	42f7963252	dns: trim response immediately before the write ... Previously the response was being trimmed before adding the EDNS values, which could cause it to exceed the max size.	3 years ago
Daniel Nephin	436a02af31	dns: handle errors from dispatch	3 years ago
Daniel Nephin	9267b09c32	dns: error response from dispatch ... So that dispatch can communicate status back to the caller.	3 years ago
Daniel Nephin	68d6f1315f	dns: refactor dispatch to use an explicit return in each case ... In preparation for changing the return value, so that SOA, eDNS trimming and 'not found' errors can be handled in a single place.	3 years ago
Daniel Nephin	b96c8195a5	dns: small refactor to setEDNS to return early ... Using a guard clause instead of a long nested if. The diff is best viewed with whitespace turned off.	3 years ago
Daniel Nephin	4beff900d1	dns: remove unused method ... It was added in 5934f803bf but it was never used.	3 years ago
Daniel Nephin	f31aa12cf1	dns: remove unnecessary function wrapping ... The dispatch function was called from a single place and did nothing but add a default value. Removing it makes code easier to trace by removing an unnecessary hop.	3 years ago
Kyle Havlovitz	77a2f38677	http: add partition query param parsing	3 years ago
hc-github-team-consul-core	1169df0878	auto-updated agent/uiserver/bindata_assetfs.go from commit 3e80e637b	3 years ago
Giulio Micheloni	529fe737ef	acl: acl replication routine to report the last error message	3 years ago
Daniel Nephin	74fb650b6b	Merge pull request #10588 from hashicorp/dnephin/config-fix-ports-grpc ... config: rename `ports.grpc` to `ports.xds`	3 years ago
Daniel Nephin	b5cd2050b4	fix backwards compat for envoy command ... The compatv2 integration tests were failing because they use an older CLI version with a newer HTTP API. This commit restores the GRPCPort field to the DebugConfig output to allow older CIs to continue to fetch the port.	3 years ago
Daniel Nephin	233d03dbbd	Apply suggestions from code review ... Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com>	3 years ago
Daniel Nephin	4ad80ccee3	command/envoy: stop using the DebugConfig from Self endpoint ... The DebugConfig in the self endpoint can change at any time. It's not a stable API. With the previous change to rename GRPCPort to XDSPort this command would have broken. This commit adds the XDSPort to a stable part of the XDS api, and changes the envoy command to read this new field. It includes support for the old API as well, in case a newer CLI is used with an older API, and adds a test for both cases.	3 years ago
Daniel Nephin	c48f26b0a6	config: update config settings and flags for ports.xds	3 years ago
Dhia Ayachi	58bd817336	check expiry date of the root/intermediate before using it to sign a leaf (#10500) ... * ca: move provider creation into CAManager This further decouples the CAManager from Server. It reduces the interface between them and removes the need for the SetLogger method on providers. * ca: move SignCertificate to CAManager To reduce the scope of Server, and keep all the CA logic together * ca: move SignCertificate to the file where it is used * auto-config: move autoConfigBackend impl off of Server Most of these methods are used exclusively for the AutoConfig RPC endpoint. This PR uses a pattern that we've used in other places as an incremental step to reducing the scope of Server. * fix linter issues * check error when `raftApplyMsgpack` * ca: move SignCertificate to CAManager To reduce the scope of Server, and keep all the CA logic together * check expiry date of the intermediate before using it to sign a leaf * fix typo in comment Co-authored-by: Kyle Havlovitz <kylehav@gmail.com> * Fix test name * do not check cert start date * wrap error to mention it is the intermediate expired * Fix failing test * update comment Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> * use shim to avoid sleep in test * add root cert validation * remove duplicate code * Revert "fix linter issues" This reverts commit 6356302b54. * fix import issue * gofmt leader_connect_ca * add changelog entry * update error message Co-authored-by: Freddy <freddygv@users.noreply.github.com> * fix error message in test Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> Co-authored-by: Kyle Havlovitz <kylehav@gmail.com> Co-authored-by: Freddy <freddygv@users.noreply.github.com>	3 years ago
R.B. Boyer	6c47efd532	connect/ca: ensure edits to the key type/bits for the connect builtin CA will regenerate the roots (#10330) ... progress on #9572	3 years ago
R.B. Boyer	7bf9ea55cf	connect/ca: require new vault mount points when updating the key type/bits for the vault connect CA provider (#10331) ... progress on #9572	3 years ago
Daniel Nephin	0ccad1d6f7	Merge pull request #10479 from hashicorp/dnephin/ca-provider-explore-2 ... ca: move Server.SignIntermediate to CAManager	3 years ago
Daniel Nephin	b89ec826c8	Merge pull request #10445 from hashicorp/dnephin/ca-provider-explore ... ca: isolate more of the CA logic in CAManager	3 years ago
Daniel Nephin	bf292cbae4	ca: use provider constructors to be more consistent ... Adds a contructor for the one provider that did not have one.	3 years ago
Dhia Ayachi	5ed56fc786	check error when `raftApplyMsgpack`	3 years ago
Daniel Nephin	3091026e02	auto-config: move autoConfigBackend impl off of Server ... Most of these methods are used exclusively for the AutoConfig RPC endpoint. This PR uses a pattern that we've used in other places as an incremental step to reducing the scope of Server.	3 years ago
Daniel Nephin	0512cb2813	ca: move SignCertificate to the file where it is used	3 years ago
Daniel Nephin	dfebfe508e	ca: move SignCertificate to CAManager ... To reduce the scope of Server, and keep all the CA logic together	3 years ago
Daniel Nephin	570eac3167	Merge pull request #10590 from hashicorp/dnephin/tls-config-less-copy ... config: remove duplicate tlsutil.Config fields from agent/consul.Config	3 years ago
hc-github-team-consul-core	a9dcfc59bd	auto-updated agent/uiserver/bindata_assetfs.go from commit a96e87aec	3 years ago
Dhia Ayachi	047537833d	add missing state reset when stopping ca manager	3 years ago
Daniel Nephin	6228c4a53c	ca: fix mockCAServerDelegate to work with the new interface ... raftApply was removed so ApplyCARequest needs to handle all the possible operations Also set the providerShim to use the mock provider. other changes are small test improvements that were necessary to debug the failures.	3 years ago
Daniel Nephin	7dae65cd56	ca: remove unused method ... and small refactor to getCAProvider so that GoLand is less confused about what it is doing. Previously it was reporting that the for condition was always true, which was not the case.	3 years ago
Daniel Nephin	1960c717af	ca: remove raftApply from delegate interface ... After moving ca.ConsulProviderStateDelegate into the interface we now have the ApplyCARequest method which does the same thing. Use this more specific method instead of raftApply.	3 years ago
Daniel Nephin	1f4cdde9cc	ca: move generateCASignRequest to the delegate ... This method on Server was only used by the caDelegateWithState, so move it there until we can move it entirely into CAManager.	3 years ago
Daniel Nephin	fc14f5ab14	ca: move provider creation into CAManager ... This further decouples the CAManager from Server. It reduces the interface between them and removes the need for the SetLogger method on providers.	3 years ago
Daniel Nephin	b1877660d5	ca-manager: move provider shutdown into CAManager ... Reducing the coupling between Server and CAManager	3 years ago
Daniel Nephin	be8c675942	config: remove misleading UseTLS field ... This field was documented as enabling TLS for outgoing RPC, but that was not the case. All this field did was set the use_tls serf tag. Instead of setting this field in a place far from where it is used, move the logic to where the serf tag is set, so that the code is much more obvious.	3 years ago
Daniel Nephin	70770db345	config: remove duplicate TLSConfig fields from agent/consul.Config ... tlsutil.Config already presents an excellent structure for this configuration. Copying the runtime config fields to agent/consul.Config makes code harder to trace, and provides no advantage. Instead of copying the fields around, use the tlsutil.Config struct directly instead. This is one small step in removing the many layers of duplicate configuration.	3 years ago
Daniel Nephin	895bf9adec	config: update GRPCPort and addr in runtime config	3 years ago
Daniel Nephin	7d73fd7ae5	rename GRPC->XDS where appropriate	3 years ago
Evan Culver	13bd86527b	Add support for returning ACL secret IDs for accessors with acl:write (#10546)	3 years ago
Daniel Nephin	ec6da0859d	Merge pull request #10570 from hashicorp/copy-of-master ... Changes that were accidentally merged into the old master branch	3 years ago
R.B. Boyer	c94b8c6a39	config: add agent config flag for enterprise clients to indicate they wish to join a particular partition (#10572)	3 years ago
Dhia Ayachi	6390e91be5	Add ca certificate metrics (#10504) ... * add intermediate ca metric routine * add Gauge config for intermediate cert * Stop metrics routine when stopping leader * add changelog entry * updage changelog Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> * use variables instead of a map * go imports sort * Add metrics for primary and secondary ca * start metrics routine in the right DC * add telemetry documentation * update docs * extract expiry fetching in a func * merge metrics for primary and secondary into signing ca metric Co-authored-by: Daniel Nephin <dnephin@hashicorp.com>	3 years ago
hc-github-team-consul-core	97831bf3dc	auto-updated agent/uiserver/bindata_assetfs.go from commit 6fbeea5de	3 years ago
Jared Kirschner	e517e744af	Merge pull request #10559 from jkirschner-hashicorp/fix-autopilot-config-post-default-values ... Fix defaults for autopilot config update	3 years ago
hc-github-team-consul-core	00f4d94139	auto-updated agent/uiserver/bindata_assetfs.go from commit 2c4f22a9f	3 years ago
Daniel Nephin	2c4f22a9f0	Merge pull request #10552 from hashicorp/dnephin/ca-remove-rotation-period ... ca: remove unused RotationPeriod field	3 years ago
Daniel Nephin	d1c9d9bc68	config: unexport the remaining builder methods ... And remove BuildAndValidate. This commit completes some earlier work to reduce the config interface a single Load function. The last remaining test was converted to use Load instad of BuildAndValidate.	3 years ago
Jared Kirschner	14059c2653	Fix defaults for autopilot config update ... Previously, for a POST request to the /v1/operator/autopilot/configuration endpoint, any fields not included in the payload were set to a zero-initialized value rather than the documented default value. Now, if an optional field is not included in the payload, it will be set to its documented default value: - CleanupDeadServers: true - LastContactThreshold: "200ms" - MaxTrailingLogs: 250 - MinQuorum: 0 - ServerStabilizationTime: "10s" - RedundancyZoneTag: "" - DisableUpgradeMigration: false - UpgradeVersionTag: ""	3 years ago
hc-github-team-consul-core	c47bcc0d4c	auto-updated agent/uiserver/bindata_assetfs.go from commit 74070c095	3 years ago
hc-github-team-consul-core	98cc5aaa35	auto-updated agent/uiserver/bindata_assetfs.go from commit 5f73de6fb	3 years ago
jkirschner-hashicorp	5f73de6fbc	Merge pull request #10560 from jkirschner-hashicorp/change-sane-to-reasonable ... Replace use of 'sane' where appropriate	3 years ago
Daniel Nephin	3a045cca8d	ca: remove unused RotationPeriod field ... This field was never used. Since it is persisted as part of a map[string]interface{} it is pretty easy to remove it.	3 years ago
Jared Kirschner	bd536151e1	Replace use of 'sane' where appropriate ... HashiCorp voice, style, and language guidelines recommend avoiding ableist language unless its reference to ability is accurate in a particular use.	3 years ago
Dhia Ayachi	9b45107c1e	Format certificates properly (rfc7468) with a trailing new line (#10411) ... * trim carriage return from certificates when inserting rootCA in the inMemDB * format rootCA properly when returning the CA on the connect CA endpoint * Fix linter warnings * Fix providers to trim certs before returning it * trim newlines on write when possible * add changelog * make sure all provider return a trailing newline after the root and intermediate certs * Fix endpoint to return trailing new line * Fix failing test with vault provider * make test more robust * make sure all provider return a trailing newline after the leaf certs * Check for suffix before removing newline and use function * Add comment to consul provider * Update change log Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> * fix typo * simplify code callflow Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> * extract requireNewLine as shared func * remove dependency to testify in testing file * remove extra newline in vault provider * Add cert newline fix to envoy xds * remove new line from mock provider * Remove adding a new line from provider and fix it when the cert is read * Add a comment to explain the fix * Add missing for leaf certs * fix missing new line * fix missing new line in leaf certs * remove extra new line in test * updage changelog Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> * fix in vault provider and when reading cache (RPC call) * fix AWS provider * fix failing test in the provider * remove comments and empty lines * add check for empty cert in test * fix linter warnings * add new line for leaf and private key * use string concat instead of Sprintf * fix new lines for leaf signing * preallocate slice and remove append * Add new line to `SignIntermediate` and `CrossSignCA` Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> Co-authored-by: Daniel Nephin <dnephin@hashicorp.com>	3 years ago
Daniel Nephin	690dc41c55	Merge pull request #10515 from hashicorp/dnephin/fix-arm32-atomic-aligment ... Fix panic on 32-bit platforms	3 years ago
Daniel Nephin	f34d3543b1	testing: fix a test for 32-bit ... The hcl decoding apparently uses strconv.ParseInt, which fails to parse a 64bit int. Since hcl v1 is basically EOl, it seems unlikely we'll fix this in hcl. Since this test is only about loading values from config files, the extra large number doesn't seem important. Trim a few zeros from the numbers so that they parse properly on 32bit platforms. Also skip a slow test when -short is used.	3 years ago
Daniel Nephin	dce59d9277	fix 64-bit aligment for 32-bit platforms ... sync/atomic must be used with 64-bit aligned fields, and that alignment is difficult to ensure unless the field is the first one in the struct. https://golang.org/pkg/sync/atomic/#pkg-note-BUG.	3 years ago
Daniel Nephin	bc4d349ccf	streaming: support X-Cache-Hit header ... If a value was already available in the local view the request is considered a cache hit. If the materialized had to wait for a value, it is considered a cache miss.	3 years ago
Daniel Nephin	c78391797d	streaming: fix enable of streaming in the client ... And add checks to all the tests that explicitly use streaming.	3 years ago
Daniel Nephin	8b365f8271	Remove a racy and failing test ... This test is super racy (it's not just a single line). This test also starts failing once streaming is enabled, because the cache rate limit no longer applies to the requests in the test. The queries use streaming instead of the cache. This test is no longer valid, and the functionality is already well tested by TestCacheThrottle. Instead of spending time rewriting this test, let's remove it. ``` WARNING: DATA RACE Read at 0x00c01de410fc by goroutine 735: github.com/hashicorp/consul/agent.TestCacheRateLimit.func1() /home/daniel/pers/code/consul/agent/agent_test.go:1024 +0x9af github.com/hashicorp/consul/testrpc.WaitForTestAgent() /home/daniel/pers/code/consul/testrpc/wait.go:99 +0x209 github.com/hashicorp/consul/agent.TestCacheRateLimit.func1() /home/daniel/pers/code/consul/agent/agent_test.go:966 +0x1ad testing.tRunner() /usr/lib/go/src/testing/testing.go:1193 +0x202 Previous write at 0x00c01de410fc by goroutine 605: github.com/hashicorp/consul/agent.TestCacheRateLimit.func1.2() /home/daniel/pers/code/consul/agent/agent_test.go:998 +0xe9 Goroutine 735 (running) created at: testing.(*T).Run() /usr/lib/go/src/testing/testing.go:1238 +0x5d7 github.com/hashicorp/consul/agent.TestCacheRateLimit() /home/daniel/pers/code/consul/agent/agent_test.go:961 +0x375 testing.tRunner() /usr/lib/go/src/testing/testing.go:1193 +0x202 Goroutine 605 (finished) created at: github.com/hashicorp/consul/agent.TestCacheRateLimit.func1() /home/daniel/pers/code/consul/agent/agent_test.go:1022 +0x91e github.com/hashicorp/consul/testrpc.WaitForTestAgent() /home/daniel/pers/code/consul/testrpc/wait.go:99 +0x209 github.com/hashicorp/consul/agent.TestCacheRateLimit.func1() /home/daniel/pers/code/consul/agent/agent_test.go:966 +0x1ad testing.tRunner() /usr/lib/go/src/testing/testing.go:1193 +0x202 ```	3 years ago
Daniel Nephin	16b21b0864	http: add an X-Consul-Query-Backend header to responses ... So that it is easier to detect and test when streaming is being used.	3 years ago
Daniel Nephin	2e1e80266a	Merge pull request #10506 from hashicorp/dnephin/docs-rpc-query-metrics ... docs: correct some misleading telemetry docs	3 years ago
Daniel Nephin	7531a6681d	docs: correct some misleading telemetry docs ... The query metrics are actually reported for all read queries, not only ones that use a MinIndex to block for updates. Also clarify the raft.apply metric is only on the leader.	3 years ago
R.B. Boyer	ed8a901be7	connect: include optional partition prefixes in SPIFFE identifiers (#10507) ... NOTE: this does not include any intentions enforcement changes yet	3 years ago
R.B. Boyer	a2876453a5	connect/ca: cease including the common name field in generated certs (#10424) ... As part of this change, we ensure that the SAN extensions are marked as critical when the subject is empty so that AWS PCA tolerates the loss of common names well and continues to function as a Connect CA provider. Parts of this currently hack around a bug in crypto/x509 and can be removed after https://go-review.googlesource.com/c/go/+/329129 lands in a Go release. Note: the AWS PCA tests do not run automatically, but the following passed locally for me: ENABLE_AWS_PCA_TESTS=1 go test ./agent/connect/ca -run TestAWS	3 years ago
hc-github-team-consul-core	f24ee5d842	auto-updated agent/uiserver/bindata_assetfs.go from commit ace794d21	3 years ago
Dhia Ayachi	a64c9a3e62	return an empty record when asked for an addr dns with type other then A, AAAA and ANY (#10401) ... * return an invalid record when asked for an addr dns with type other then A and AAAA * add changelog * fix ANY use case and add a test for it * update changelog type Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> * return empty response if the question record type do not match for addr * set comment in the right place * return A\AAAA record in extra section if record type is not A\AAAA for addr * Fix failing test * remove commented code Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> * use require for test validation * use variable to init struct * fix failing test * Update agent/dns.go Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> * Update .changelog/10401.txt Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> * Update agent/dns.go Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> * Update agent/dns.go Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> * Update agent/dns.go Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> * fix compilation error Co-authored-by: Daniel Nephin <dnephin@hashicorp.com>	3 years ago
Daniel Nephin	bb37c4dfe8	Merge pull request #10476 from hashicorp/dnephin/ca-primary-uses-intermediate ... ca: replace ca.PrimaryIntermediateProviders	3 years ago
R.B. Boyer	e3835ac6a1	structs: prohibit config entries from referencing more than one partition at a time (#10478) ... affected kinds: service-defaults, ingress-gateway, terminating-gateway, service-intentions	3 years ago
R.B. Boyer	8344b7fe2e	structs: prevent service-defaults upstream configs from using wildcard names or namespaces (#10475)	3 years ago
Daniel Nephin	f52d76f096	ca: replace ca.PrimaryIntermediateProviders ... With an optional interface that providers can use to indicate if they use an intermediate cert in the primary DC. This removes the need to look up the provider config when renewing the intermediate.	3 years ago
R.B. Boyer	ac50db9087	structs: add some missing config entry validation and clean up tests (#10465) ... Affects kinds: service-defaults, ingress-gateway, terminating-gateway	3 years ago
hc-github-team-consul-core	1822b80ef3	auto-updated agent/uiserver/bindata_assetfs.go from commit c78f7ecb2	3 years ago
Daniel Nephin	17e210ed16	Merge pull request #10444 from hashicorp/dnephin/tls-cert-exploration-2 ... tlsutil: reduce interface provided to auto-config	3 years ago
Daniel Nephin	2aad3f80fb	tlsutil: reduce interface provided to auto-config ... Replace two methods with a single one that returns the cert. This moves more of the logic into the single caller (auto-config). tlsutil.Configurator is widely used. By keeping it smaller and focused only on storing and returning TLS config, we make the code easier to follow. These two methods were more related to auto-config than to tlsutil, so reducing the interface moves the logic closer to the feature that requires it.	3 years ago
hc-github-team-consul-core	f7455a3017	auto-updated agent/uiserver/bindata_assetfs.go from commit 043f631b7	3 years ago
hc-github-team-consul-core	58bf4adc02	auto-updated agent/uiserver/bindata_assetfs.go from commit 4bddd5210	3 years ago
Daniel Nephin	10051cf6d3	proxycfg: remove unused method ... This method was accidentally re-introduced in an earlier rebase. It was removed in ed1082510d as part of the tproxy work.	3 years ago
Daniel Nephin	6bc5255028	proxycfg: move each handler into a seprate file ... There is no interaction between these handlers, so splitting them into separate files makes it easier to discover the full implementation of each kindHandler.	3 years ago
hc-github-team-consul-core	62340a56b9	auto-updated agent/uiserver/bindata_assetfs.go from commit 5f17062b0	3 years ago
hc-github-team-consul-core	211525a4c4	auto-updated agent/uiserver/bindata_assetfs.go from commit 9eab71514	3 years ago
hc-github-team-consul-core	143c73268e	auto-updated agent/uiserver/bindata_assetfs.go from commit ac424187f	3 years ago
Daniel Nephin	d81f527be8	Merge pull request #9924 from hashicorp/dnephin/cert-expiration-metric ... connect: emit a metric for the seconds until root CA expiry	3 years ago
Daniel Nephin	19d3eeff3c	Merge pull request #9489 from hashicorp/dnephin/proxycfg-state-2 ... proxycfg: split state into a handler for each kind	3 years ago
Daniel Nephin	345e979b4c	Merge pull request #10425 from hashicorp/dnephin/tls-cert-exploration ... tlsutil: fix a possible panic, and make the package safer	3 years ago
Daniel Nephin	0a14a3e17c	inline assignment	4 years ago
Nitya Dhanushkodi	52043830b4	proxycfg: reference to entry in map should not panic	4 years ago
Daniel Nephin	e738fa3b80	Replace type conversion with embedded structs	4 years ago
Daniel Nephin	32c15d9a88	proxycfg: split state into kind-specific types ... This commit extracts all the kind-specific logic into handler types, and keeps the generic parts on the state struct. This change should make it easier to add new kinds, and see the implementation of each kind more clearly.	4 years ago
Daniel Nephin	cd05df7157	proxycfg: unmethod hostnameEndpoints ... the method receiver can be replaced by the first argument. This will allow us to extract more from the state struct in the future.	4 years ago
Daniel Nephin	97c6ee00d7	Remove duplicate import ... because two PRs crossed paths.	4 years ago
Daniel Nephin	0547d0c046	Merge pull request #9466 from hashicorp/dnephin/proxycfg-state ... proxycfg: prepare state for split by kind	4 years ago
R.B. Boyer	5b495ae8e0	xds: fix flaky protocol tests (#10410)	4 years ago
Freddy	ae886136f1	Merge pull request #10404 from hashicorp/ingress-stats	4 years ago
R.B. Boyer	80c39f1083	xds: adding more delta protocol tests (#10398) ... Fixes #10125	4 years ago
freddygv	924a5ba642	Regen golden files	4 years ago
Freddy	0a38c8fe10	Update agent/xds/listeners.go ... Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com>	4 years ago
Freddy	3ee66b2e9a	Omit empty tproxy config in JSON responses (#10402)	4 years ago
Nitya Dhanushkodi	b8b44419a0	proxycfg: Ensure that endpoints for explicit upstreams in other datacenters are watched in transparent mode (#10391) ... Co-authored-by: Freddy Vallenilla <freddy@hashicorp.com>	4 years ago
freddygv	f3e4705923	Remove unused param	4 years ago
Dhia Ayachi	c8ba2d40fd	improve monitor performance (#10368) ... * remove flush for each write to http response in the agent monitor endpoint * fix race condition when we stop and start monitor multiple times, the doneCh is closed and never recover. * start log reading goroutine before adding the sink to avoid filling the log channel before getting a chance of reading from it * flush every 500ms to optimize log writing in the http server side. * add changelog file * add issue url to changelog * fix changelog url * Update changelog Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> * use ticker to flush and avoid race condition when flushing in a different goroutine * stop the ticker when done Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> * Revert "fix race condition when we stop and start monitor multiple times, the doneCh is closed and never recover." This reverts commit 1eeddf7a * wait for log consumer loop to start before registering the sink Co-authored-by: Daniel Nephin <dnephin@hashicorp.com>	4 years ago
freddygv	0aec6761dc	Update ingress gateway stats labeling ... In the absence of stats_tags to handle this pattern, when we pass "ingress_upstream.$port" as the stat_prefix, Envoy splits up that prefix and makes the port a part of the metric name. For example: - stat_prefix: ingress_upstream.8080 This leads to metric names like envoy_http_8080_no_route. Changing the stat_prefix to ingress_upstream_80880 yields the expected metric names such as envoy_http_no_route. Note that we don't encode the destination's name/ns/dc in this stat_prefix because for HTTP services ingress gateways use a single filter chain. Only cluster metrics are available on a per-upstream basis.	4 years ago
freddygv	6f8c6043b6	Update terminating gateway stats labeling ... This change makes it so that the stat prefix for terminating gateways matches that of connect proxies. By using the structure of "upstream.svc.ns.dc" we can extract labels for the destination service, namespace, and datacenter.	4 years ago
R.B. Boyer	848ad8535b	xds: ensure that dependent xDS resources are reconfigured during primary type warming (#10381) ... Updates to a cluster will clear the associated endpoints, and updates to a listener will clear the associated routes. Update the incremental xDS logic to account for this implicit cleanup so that we can finish warming the clusters and listeners. Fixes #10379	4 years ago
Daniel Nephin	aec7e798b0	Update metric name ... and handle the case where there is no active root CA.	4 years ago
Daniel Nephin	1c980e4700	connect: emit a metric for the number of seconds until root CA expiration	4 years ago
Freddy	ffb13f35f1	Rename CatalogDestinationsOnly (#10397) ... CatalogDestinationsOnly is a passthrough that would enable dialing addresses outside of Consul's catalog. However, when this flag is set to true only _connect_ endpoints for services can be dialed. This flag is being renamed to signal that non-Connect endpoints can't be dialed by transparent proxies when the value is set to true.	4 years ago
Freddy	33bd9b5be8	Relax validation for expose.paths config (#10394) ... Previously we would return an error if duplicate paths were specified. This could lead to problems in cases where a user has the same path, say /healthz, on two different ports. This validation was added to signal a potential misconfiguration. Instead we will only check for duplicate listener ports, since that is what would lead to ambiguity issues when generating xDS config. In the future we could look into using a single listener and creating distinct filter chains for each path/port.	4 years ago
Daniel Nephin	016c5611d1	proxycfg: extract two types from state struct ... These two new struct types will allow us to make polymorphic handler for each kind, instad of having all the logic for each proxy kind on the state struct.	4 years ago
Daniel Nephin	9c40aa729f	proxycfg: pass context around where it is needed ... context.Context should never be stored on a struct (as it says in the godoc) because it is easy to to end up with the wrong context when it is stored. Also see https://blog.golang.org/context-and-structs This change is also in preparation for splitting state into kind-specific handlers so that the implementation of each kind is grouped together.	4 years ago
Daniel Nephin	3726cb52c7	http: add PrimaryDatacenter to the /v1/agent/self response ... This field is available in DebugConfig, but that field is not stable and could change at any time. The consul-k8s needs to be able to detect the primary DC for tests, so adding this field to the stable part of the API response.	4 years ago
Freddy	429f9d8bb8	Add flag for transparent proxies to dial individual instances (#10329)	4 years ago
Daniel Nephin	3d5ff8b5db	submatview: add test cases for store.Get with timeout and no index ... Also set a more unique name for the serviceRequest.Type to prevent potential name conflicts in the future.	4 years ago
Daniel Nephin	cf5cdf07a0	Merge pull request #10364 from hashicorp/dnephin/streaming-e2e-test ... submatview: and Store integration test with stream backend	4 years ago