1706 Commits (0687e2fe934e1313eb0bb0b4bc003b44fde2e762)

Author	SHA1	Message	Date
R.B. Boyer	5882e21b2b	agent: tolerate more failure scenarios during service registration with central config enabled (#6472) ... Also: * Finished threading replaceExistingChecks setting (from GH-4905) through service manager. * Respected the original configSource value that was used to register a service or a check when restoring persisted data. * Run several existing tests with and without central config enabled (not exhaustive yet). * Switch to ioutil.ReadFile for all types of agent persistence.	5 years ago
Matt Keeler	100ebd63f9	Allow for enterprise only leader routines (#6533) ... Eventually I am thinking we may need a way to register these at different priority levels but for now sticking this here is fine	5 years ago
R.B. Boyer	af01d397a5	connect: don't colon-hex-encode the AuthorityKeyId and SubjectKeyId fields in connect certs (#6492) ... The fields in the certs are meant to hold the original binary representation of this data, not some ascii-encoded version. The only time we should be colon-hex-encoding fields is for display purposes or marshaling through non-TLS mediums (like RPC).	5 years ago
R.B. Boyer	796de297c8	connect: intermediate CA certs generated with the vault provider lack URI SANs (#6491) ... This only affects vault versions >=1.1.1 because the prior code accidentally relied upon a bug that was fixed in https://github.com/hashicorp/vault/pull/6505 The existing tests should have caught this, but they were using a vendored copy of vault version 0.10.3. This fixes the tests by running an actual copy of vault instead of an in-process copy. This has the added benefit of changing the dependency on vault to just vault/api. Also update VaultProvider to use similar SetIntermediate validation code as the ConsulProvider implementation.	5 years ago
Matt Keeler	51dcd126b7	Add support for implementing new requests with protobufs instea… (#6502) ... * Add build system support for protobuf generation This is done generically so that we don’t have to keep updating the makefile to add another proto generation. Note: anything not in the vendor directory and with a .proto extension will be run through protoc if the corresponding namespace.pb.go file is not up to date. If you want to rebuild just a single proto file you can do so with: make proto-rebuild PROTOFILES=<list of proto files to rebuild> Providing the PROTOFILES var will override the default behavior of finding all the .proto files. * Start adding types to the agent/proto package These will be needed for some other work and are by no means comprehensive. * Add ability to resolve/fixup the agentpb.ACLLinks structure in the state store. * Use protobuf marshalling of raft requests instead of msgpack for protoc generated types. This does not change any encoding of existing types. * Removed structs package automatically encoding with protobuf marshalling Instead the caller of raftApply that wants to opt-in to protobuf encoding will have to call `raftApplyProtobuf` * Run update-vendor to fixup modules.txt Nothing changed as far as dependencies go but the ordering of modules in that file depends on the time they are first seen and its not alphabetical. * Rename some things and implement the structs.RPCInfo interface bits agentpb.QueryOptions and agentpb.WriteRequest implement 3 of the 4 RPCInfo funcs and the new TargetDatacenter message type implements the fourth. * Use the right encoding function. * Renamed agent/proto package to agent/agentpb to prevent package name conflicts * Update modules.txt to fix ordering * Change blockingQuery to take in interfaces for the query options and meta * Add %T to error output. * Add/Update some comments	5 years ago
R.B. Boyer	f9496dc627	sdk: add freelist tracking and ephemeral port range skipping to freeport ... This should cut down on test flakiness. Problems handled: - If you had enough parallel test cases running, the former circular approach to handling the port block could hand out the same port to multiple cases before they each had a chance to bind them, leading to one of the two tests to fail. - The freeport library would allocate out of the ephemeral port range. This has been corrected for Linux (which should cover CI). - The library now waits until a formerly-in-use port is verified to be free before putting it back into circulation.	5 years ago
R.B. Boyer	7ccaa13514	fix typo of 'unknown' in log messages	5 years ago
R.B. Boyer	20eb0d3e94	cache: remove data race in agent cache ... In normal operations there is a read/write race related to request QueryOptions fields. An example race: WARNING: DATA RACE Read at 0x00c000836950 by goroutine 30: github.com/hashicorp/consul/agent/structs.(*ServiceConfigRequest).CacheInfo() /go/src/github.com/hashicorp/consul/agent/structs/config_entry.go:506 +0x109 github.com/hashicorp/consul/agent/cache.(*Cache).getWithIndex() /go/src/github.com/hashicorp/consul/agent/cache/cache.go:262 +0x5c github.com/hashicorp/consul/agent/cache.(*Cache).notifyBlockingQuery() /go/src/github.com/hashicorp/consul/agent/cache/watch.go:89 +0xd7 Previous write at 0x00c000836950 by goroutine 147: github.com/hashicorp/consul/agent/cache-types.(*ResolvedServiceConfig).Fetch() /go/src/github.com/hashicorp/consul/agent/cache-types/resolved_service_config.go:31 +0x219 github.com/hashicorp/consul/agent/cache.(*Cache).fetch.func1() /go/src/github.com/hashicorp/consul/agent/cache/cache.go:495 +0x112 This patch does a lightweight copy of the request struct so that the embedded QueryOptions fields that are mutated during Fetch() are scoped to just that one RPC.	5 years ago
hashicorp-ci	4f499a8044	update bindata_assetfs.go	5 years ago
Hans Hasselberg	4a20efda9b	agent: handleEnterpriseLeave (#6453)	5 years ago
R.B. Boyer	a86e63f81e	test: actually wait for the TestAgent to be fully shutdown (#6441)	5 years ago
Sarah Adams	001137e5e5	test: ensure all TestAgent constructions use a constructor (#6443) ... ensure all TestAgent constructions use a constructor to get start retries + test logs going to the right place Fixes #6435	5 years ago
Sarah Adams	74461406e0	remove funky panic/recover in agent tests (#6442)	5 years ago
Sarah Adams	4ed5515fca	refactor & add better retry logic to NewTestAgent (#6363) ... Fixes #6361	5 years ago
Pierre Souchay	be50400c62	Distinguish between DC not existing and not being available (#6399)	5 years ago
Aestek	7c7b7f24fd	Add option to register services and their checks idempotently (#4905)	5 years ago
Sarah Adams	9f4b329b6d	txn: don't try to decode request bodies > raft.SuggestedMaxDataSize (#6422) ... txn: don't try to decode request bodies > raft.SuggestedMaxDataSize	5 years ago
Matt Keeler	42d608587f	Store primaries root in secondary after intermediate signature (#6333) ... * Store primaries root in secondary after intermediate signature This ensures that the intermediate exists within the CA root stored in raft and not just in the CA provider state. This has the very nice benefit of actually outputting the intermediate cert within the ca roots HTTP/RPC endpoints. This change means that if signing the intermediate fails it will not set the root within raft. So far I have not come up with a reason why that is bad. The secondary CA roots watch will pull the root again and go through all the motions. So as soon as getting an intermediate CA works the root will get set. * Make TestAgentAntiEntropy_Check_DeferSync less flaky I am not sure this is the full fix but it seems to help for me.	5 years ago
R.B. Boyer	7deaba63e1	test: ensure the node name is a valid dns name (#6424) ... The space in the node name was making every test emit a useless warning.	5 years ago
R.B. Boyer	3be88df207	test: explicitly run the pprof tests for 1s instead of the 30s default (#6421)	5 years ago
R.B. Boyer	d979d8c239	test: add additional http status code assertions in coordinate HTTP API tests (#6410) ... When this test flakes sometimes this happens: --- FAIL: TestCoordinate_Node (1.69s) panic: interface conversion: interface {} is nil, not structs.Coordinates [recovered] FAIL github.com/hashicorp/consul/agent 19.999s Exit code: 1 panic: interface conversion: interface {} is nil, not structs.Coordinates [recovered] panic: interface conversion: interface {} is nil, not structs.Coordinates There is definitely a bug lurking, but the code seems to imply this can only return nil on 404. The tests previously were not checking the status code. The underlying cause of the flake is unknown, but this should turn the failure into a more normal test failure.	5 years ago
Pierre Souchay	58f04815d5	Display IPs of machines when node names conflict to ease troubleshooting ... When there is an node name conflicts, such messages are displayed within Consul: `consul.fsm: EnsureRegistration failed: failed inserting node: Error while renaming Node ID: "e1d456bc-f72d-98e5-ebb3-26ae80d785cf": Node name node001 is reserved by node 05f10209-1b9c-b90c-e3e2-059e64556d4a with name node001` While it is easy to find the node that has reserved the name, it is hard to find the node trying to aquire the name since it is not registered, because it is not part of `consul members` output This PR will display the IP of the offender and solve far more easily those issues.	5 years ago
Alvin Huang	c516fabfac	revert commits on master (#6413)	5 years ago
tradel	5a22b77340	update tests to match new method signatures	5 years ago
tradel	1ff46f3f0a	confi\gure providers with DC and domain	5 years ago
tradel	5ba28a6a7b	create a common name for autoTLS agent certs	5 years ago
tradel	9b1ac4e7ef	add subject names to issued certs	5 years ago
tradel	7f36a5b676	construct a common name for each CSR	5 years ago
tradel	672e181399	add serviceID to leaf cert request	5 years ago
tradel	a4312d2e6e	add domain and nodeName to agent cert request	5 years ago
tradel	82ae7caf3e	Added DC and domain args to Configure method	5 years ago
R.B. Boyer	b962fe38cd	test: send testagent logs through testing.Logf (#6411)	5 years ago
R.B. Boyer	91da908d2f	test: fix TestAgent.Start() to not segfault if the DNSServer cannot ListenAndServe (#6409) ... The embedded `Server` field on a `DNSServer` is only set inside of the `ListenAndServe` method. If that method fails for reasons like the address being in use and is not bindable, then the `Server` field will not be set and the overall `Agent.Start()` will fail. This will trigger the inner loop of `TestAgent.Start()` to invoke `ShutdownEndpoints` which will attempt to pretty print the DNS servers using fields on that inner `Server` field. Because it was never set, this causes a nil pointer dereference and crashes the test.	5 years ago
Alvin Huang	0be1531d80	add nil pointer check for pointer to ACLToken struct (#6407)	5 years ago
Hans Hasselberg	d051342902	make sure auto_encrypt has private key type and bits (#6392)	5 years ago
Hans Hasselberg	faa54ab989	auto_encrypt: verify_incoming_rpc is good enough for auto_encrypt.allow_tls (#6376) ... Previously `verify_incoming` was required when turning on `auto_encrypt.allow_tls`, but that doesn't work together with HTTPS UI in some scenarios. Adding `verify_incoming_rpc` to the allowed configurations.	5 years ago
R.B. Boyer	7bc941575c	test: don't leak agent goroutines in TestAgent_sidecarServiceFromNodeService (#6396) ... A goroutine dump using runtime.Stack() before/after shows a drop from 121 => 4.	5 years ago
Hans Hasselberg	f3def8c0d0	make sure auto_encrypt has private key type and bits	5 years ago
hashicorp-ci	3757cb6a96	update bindata_assetfs.go	5 years ago
R.B. Boyer	cc9a6f7993	Merge pull request #6388 from hashicorp/release/1-6 ... merging release/1-6 into master	5 years ago
Matt Keeler	cbd1857186	Secondary CA `establishLeadership` fix (#6383) ... This prevents ACL issues (or other issues) during intermediate CA cert signing from failing leader establishment.	5 years ago
Hans Hasselberg	3e46352ccb	auto_encrypt: use server-port (#6287) ... AutoEncrypt needs the server-port because it wants to talk via RPC. Information from gossip might not be available at that point and thats why the server-port is being used.	5 years ago
R.B. Boyer	dfcdc41ef8	connect: allow 'envoy_cluster_json' escape hatch to continue to function (#6378)	5 years ago
R.B. Boyer	7a6faccf2f	docs: document how envoy escape hatches work with the discovery chain (#6350) ... - Bootstrap escape hatches are OK. - Public listener/cluster escape hatches are OK. - Upstream listener/cluster escape hatches are not supported. If an unsupported escape hatch is configured and the discovery chain is activated log a warning and act like it was not configured. Fixes #6160	5 years ago
Matt Keeler	0c3cf47266	Ensure that config entry writes are forwarded to the primary DC (#6339)	5 years ago
R.B. Boyer	fd1c62ee8b	connect: ensure time.Duration fields retain their human readable forms in the API (#6348) ... This applies for both config entries and the compiled discovery chain. Also omit some other config entries fields when empty.	5 years ago
R.B. Boyer	561b2fe606	connect: generate the full SNI names for discovery targets in the compiler rather than in the xds package (#6340)	5 years ago
R.B. Boyer	ae79cdab1b	connect: introduce ExternalSNI field on service-defaults (#6324) ... Compiling this will set an optional SNI field on each DiscoveryTarget. When set this value should be used for TLS connections to the instances of the target. If not set the default should be used. Setting ExternalSNI will disable mesh gateway use for that target. It also disables several service-resolver features that do not make sense for an external service.	5 years ago
R.B. Boyer	1a485011d0	connect: updating a service-defaults config entry should leave an unset protocol alone (#6342) ... If the entry is updated for reasons other than protocol it is surprising that the value is explicitly persisted as 'tcp' rather than leaving it empty and letting it fall back dynamically on the proxy-defaults value.	5 years ago
Matt Keeler	318b9ebbe3	Filter out left/leaving serf members when determining if new AC… (#6332)	5 years ago
R.B. Boyer	72207256b9	xds: improve how envoy metrics are emitted (#6312) ... Since generated envoy clusters all are named using (mostly) SNI syntax we can have envoy read the various fields out of that structure and emit it as stats labels to the various telemetry backends. I changed the delimiter for the 'customization hash' from ':' to '~' because ':' is always reencoded by envoy as '_' when generating metrics keys.	5 years ago
R.B. Boyer	3975cb89bf	agent: blocking central config RPCs iterations should not interfere with each other (#6316)	5 years ago
hashicorp-ci	d7bb2bbee4	update bindata_assetfs.go	5 years ago
hashicorp-ci	5919c7c184	Merge Consul OSS branch 'master' at commit 8f7586b339	5 years ago
Sarah Adams	8ff1f481fe	add flag to allow /operator/keyring requests to only hit local servers (#6279) ... Add parameter local-only to operator keyring list requests to force queries to only hit local servers (no WAN traffic). HTTP API: GET /operator/keyring?local-only=true CLI: consul keyring -list --local-only Sending the local-only flag with any non-GET/list request will result in an error.	5 years ago
Mike Morris	61206fdf42	snapshot: add TLS support to HalfCloser interface (#6216) ... Calls net.TCPConn.CloseWrite or mtls.Conn.CloseWrite, which was added in https://go-review.googlesource.com/c/go/+/31318/	5 years ago
Matt Keeler	6a1e0dfed8	Update the v1/agent/service/:service endpoint to output tagged… (#6304)	5 years ago
R.B. Boyer	913d85ea5b	connect: allow mesh gateways to use central config (#6302)	5 years ago
Mike Morris	65be58703c	connect: remove managed proxies (#6220) ... * connect: remove managed proxies implementation and all supporting config options and structs * connect: remove deprecated ProxyDestination * command: remove CONNECT_PROXY_TOKEN env var * agent: remove entire proxyprocess proxy manager * test: remove all managed proxy tests * test: remove irrelevant managed proxy note from TestService_ServerTLSConfig * test: update ContentHash to reflect managed proxy removal * test: remove deprecated ProxyDestination test * telemetry: remove managed proxy note * http: remove /v1/agent/connect/proxy endpoint * ci: remove deprecated test exclusion * website: update managed proxies deprecation page to note removal * website: remove managed proxy configuration API docs * website: remove managed proxy note from built-in proxy config * website: add note on removing proxy subdirectory of data_dir	5 years ago
R.B. Boyer	9bbbea1777	connect: ensure intention replication continues to work when the replication ACL token changes (#6288)	5 years ago
hashicorp-ci	913784e1bf	Merge Consul OSS branch 'master' at commit d84863799d	5 years ago
Sarah Adams	d84863799d	fallback to proxy config global protocol when upstream services' protocol is unset (#6277) ... fallback to proxy config global protocol when upstream services' protocol is unset Fixes #5857	5 years ago
R.B. Boyer	8e22d80e35	connect: fix failover through a mesh gateway to a remote datacenter (#6259) ... Failover is pushed entirely down to the data plane by creating envoy clusters and putting each successive destination in a different load assignment priority band. For example this shows that normally requests go to 1.2.3.4:8080 but when that fails they go to 6.7.8.9:8080: - name: foo load_assignment: cluster_name: foo policy: overprovisioning_factor: 100000 endpoints: - priority: 0 lb_endpoints: - endpoint: address: socket_address: address: 1.2.3.4 port_value: 8080 - priority: 1 lb_endpoints: - endpoint: address: socket_address: address: 6.7.8.9 port_value: 8080 Mesh gateways route requests based solely on the SNI header tacked onto the TLS layer. Envoy currently only lets you configure the outbound SNI header at the cluster layer. If you try to failover through a mesh gateway you ideally would configure the SNI value per endpoint, but that's not possible in envoy today. This PR introduces a simpler way around the problem for now: 1. We identify any target of failover that will use mesh gateway mode local or remote and then further isolate any resolver node in the compiled discovery chain that has a failover destination set to one of those targets. 2. For each of these resolvers we will perform a small measurement of comparative healths of the endpoints that come back from the health API for the set of primary target and serial failover targets. We walk the list of targets in order and if any endpoint is healthy we return that target, otherwise we move on to the next target. 3. The CDS and EDS endpoints both perform the measurements in (2) for the affected resolver nodes. 4. For CDS this measurement selects which TLS SNI field to use for the cluster (note the cluster is always going to be named for the primary target) 5. For EDS this measurement selects which set of endpoints will populate the cluster. Priority tiered failover is ignored. One of the big downsides to this approach to failover is that the failover detection and correction is going to be controlled by consul rather than deferring that entirely to the data plane as with the prior version. This also means that we are bound to only failover using official health signals and cannot make use of data plane signals like outlier detection to affect failover. In this specific scenario the lack of data plane signals is ok because the effectiveness is already muted by the fact that the ultimate destination endpoints will have their data plane signals scrambled when they pass through the mesh gateway wrapper anyway so we're not losing much. Another related fix is that we now use the endpoint health from the underlying service, not the health of the gateway (regardless of failover mode).	5 years ago
R.B. Boyer	c395affc93	connect: expose an API endpoint to compile the discovery chain (#6248) ... In addition to exposing compilation over the API cleaned up the structures that would be exchanged to be cleaner and easier to support and understand. Also removed ability to configure the envoy OverprovisioningFactor.	5 years ago
Todd Radel	96be92f3b5	connect: generate intermediate at same time as root (#6272) ... Generate intermediate at same time as root Co-Authored-By: Freddy <freddygv@users.noreply.github.com>	5 years ago
R.B. Boyer	dcb609af83	connect: detect and prevent circular discovery chain references (#6246)	5 years ago
R.B. Boyer	1d0efdc69e	server: if inserting bootstrap config entries fails don't silence the errors (#6256)	5 years ago
R.B. Boyer	f02924fafe	connect: simplify the compiled discovery chain data structures (#6242) ... This should make them better for sending over RPC or the API. Instead of a chain implemented explicitly like a linked list (nodes holding pointers to other nodes) instead switch to a flat map of named nodes with nodes linking other other nodes by name. The shipped structure is just a map and a string to indicate which key to start from. Other changes: * inline the compiler option InferDefaults as true * introduce compiled target config to avoid needing to send back additional maps of Resolvers; future target-specific compiled state can go here * move compiled MeshGateway out of the Resolver and into the TargetConfig where it makes more sense.	5 years ago
R.B. Boyer	6393edba53	connect: reconcile how upstream configuration works with discovery chains (#6225) ... * connect: reconcile how upstream configuration works with discovery chains The following upstream config fields for connect sidecars sanely integrate into discovery chain resolution: - Destination Namespace/Datacenter: Compilation occurs locally but using different default values for namespaces and datacenters. The xDS clusters that are created are named as they normally would be. - Mesh Gateway Mode (single upstream): If set this value overrides any value computed for any resolver for the entire discovery chain. The xDS clusters that are created may be named differently (see below). - Mesh Gateway Mode (whole sidecar): If set this value overrides any value computed for any resolver for the entire discovery chain. If this is specifically overridden for a single upstream this value is ignored in that case. The xDS clusters that are created may be named differently (see below). - Protocol (in opaque config): If set this value overrides the value computed when evaluating the entire discovery chain. If the normal chain would be TCP or if this override is set to TCP then the result is that we explicitly disable L7 Routing and Splitting. The xDS clusters that are created may be named differently (see below). - Connect Timeout (in opaque config): If set this value overrides the value for any resolver in the entire discovery chain. The xDS clusters that are created may be named differently (see below). If any of the above overrides affect the actual result of compiling the discovery chain (i.e. "tcp" becomes "grpc" instead of being a no-op override to "tcp") then the relevant parameters are hashed and provided to the xDS layer as a prefix for use in naming the Clusters. This is to ensure that if one Upstream discovery chain has no overrides and tangentially needs a cluster named "api.default.XXX", and another Upstream does have overrides for "api.default.XXX" that they won't cross-pollinate against the operator's wishes. Fixes #6159	5 years ago
R.B. Boyer	8564b6bb38	connect: validate upstreams and prevent duplicates (#6224) ... * connect: validate upstreams and prevent duplicates * Actually run Upstream.Validate() instead of ignoring it as dead code. * Prevent two upstreams from declaring the same bind address and port. It wouldn't work anyway. * Prevent two upstreams from being declared that use the same type+name+namespace+datacenter. Due to how the Upstream.Identity() function worked this ended up mostly being enforced in xDS at use-time, but it should be enforced more clearly at register-time.	5 years ago
Paul Banks	e87cef2bb8	Revert "connect: support AWS PCA as a CA provider" (#6251) ... This reverts commit 3497b7c00d.	5 years ago
Todd Radel	3497b7c00d	connect: support AWS PCA as a CA provider (#6189) ... Port AWS PCA provider from consul-ent	5 years ago
Todd Radel	2552f4a11a	connect: Support RSA keys in addition to ECDSA (#6055) ... Support RSA keys in addition to ECDSA	5 years ago
freddygv	1a14b94441	Update default gossip encryption key size to 32 bytes	5 years ago
hashicorp-ci	847b90288a	Merge Consul OSS branch 'master' at commit a1725e6b52	5 years ago
Matt Keeler	a1725e6b52	Fix flaky tests (#6229)	5 years ago
Matt Keeler	fcc18c1675	Fix prepared query upstream endpoint generation (#6236) ... Use the correct SNI value for prepared query upstreams	5 years ago
hashicorp-ci	1527616c8c	update bindata_assetfs.go	5 years ago
Matt Keeler	35e67b1d1a	Fix CA Replication when ACLs are enabled (#6201) ... Secondary CA initialization steps are: • Wait until the primary will be capable of signing intermediate certs. We use serf metadata to check the versions of servers in the primary which avoids needing a token like the previous implementation that used RPCs. We require at least one alive server in the primary and the all alive servers meet the version requirement. • Initialize the secondary CA by getting the primary to sign an intermediate When a primary dc is configured, if no existing CA is initialized and for whatever reason we cannot initialize a secondary CA the secondary DC will remain without a CA. As soon as it can it will initialize the secondary CA by pulling the primaries roots and getting the primary to sign an intermediate. This also fixes a segfault that can happen during leadership revocation. There was a spot in the secondaryCARootsWatch that was getting the CA Provider and executing methods on it without nil checking. Under normal circumstances it wont be nil but during leadership revocation it gets nil'ed out. Therefore there is a period of time between closing the stop chan and when the go routine is actually stopped where it could read a nil provider and cause a segfault.	5 years ago
R.B. Boyer	c6c4a2251a	Merge Consul OSS branch master at commit b3541c4f34	5 years ago
hashicorp-ci	0c9c5bfa98	update bindata_assetfs.go	5 years ago
Jack Pearkes	4e0a16ab2d	config: correct limit to limits in config example (#6219) ... This isn't yet documented on the website, but wanted to update this to add the missing s.	5 years ago
Matt Keeler	8b54307be2	Allow forwarding of some status RPCs (#6198) ... * Allow forwarding of some status RPCs * Update docs * add comments about not using the regular forward	5 years ago
Jeff Mitchell	1ea7a34756	Make the chunking test multidimensional (#6212) ... This ensures that it's not just a single operation we restores successfully, but many. It's the same foundation, just with multiple going on at once.	5 years ago
Freddy	89158c7a76	auto-encrypt: Fix port resolution and fallback to default port (#6205) ... Auto-encrypt meant to fallback to the default port when it wasn't provided, but it hadn't been because of an issue with the error handling. We were checking against an incomplete error value: "missing port in address" vs "address $HOST: missing port in address" Additionally, all RPCs to AutoEncrypt.Sign were using a.config.ServerPort, so those were updated to use ports resolved by resolveAddrs, if they are available.	5 years ago
Jeff Mitchell	94c73d0c92	Chunking support (#6172) ... * Initial chunk support This uses the go-raft-middleware library to allow for chunked commits to the KV	5 years ago
Matt Keeler	3053342198	Envoy Mesh Gateway integration tests (#6187) ... * Allow setting the mesh gateway mode for an upstream in config files * Add envoy integration test for mesh gateways This necessitated many supporting changes in most of the other test cases. Add remote mode mesh gateways integration test	5 years ago
Freddy	199f6cc41d	Make new config when retrying testServer creation (#6204)	5 years ago
R.B. Boyer	ad9e7b6ae9	connect: allow L7 routers to match on http methods (#6164) ... Fixes #6158	5 years ago
R.B. Boyer	85cf2706e6	connect: change router syntax for matching query parameters to resemble the syntax for matching paths and headers for consistency. (#6163) ... This is a breaking change, but only in the context of the beta series.	5 years ago
R.B. Boyer	1dbd92e091	connect: validate and test more of the L7 config entries (#6156)	5 years ago
R.B. Boyer	e039dfd7f8	connect: rework how the service resolver subset OnlyPassing flag works (#6173) ... The main change is that we no longer filter service instances by health, preferring instead to render all results down into EDS endpoints in envoy and merely label the endpoints as HEALTHY or UNHEALTHY. When OnlyPassing is set to true we will force consul checks in a 'warning' state to render as UNHEALTHY in envoy. Fixes #6171	5 years ago
Alvin Huang	ef6b80bab2	resolve circleci config conflicts	5 years ago
Freddy	d86efb83e5	Restore NotifyListen to avoid panic in newServer retry (#6200)	5 years ago
Pierre Souchay	b4590fb8e8	Display nicely Networks (CIDR) in runtime configuration (#6029) ... * Display nicely Networks (CIDR) in runtime configuration CIDR mask is displayed in binary in configuration. This add support for nicely displaying CIDR in runtime configuration. Currently, if a configuration contains the following lines: "http_config": { "allow_write_http_from": [ "127.0.0.0/8", "::1/128" ] } A call to `/v1/agent/self?pretty` would display "AllowWriteHTTPFrom": [ { "IP": "127.0.0.0", "Mask": "/wAAAA==" }, { "IP": "::1", "Mask": "/////////////////////w==" } ] This PR fixes it and it will now display: "AllowWriteHTTPFrom": [ "127.0.0.0/8", "::1/128" ] * Added test for cidr nice rendering in `TestSanitize()`.	5 years ago
Matt Keeler	d7fe8befa9	Update go-bexpr (#6190) ... * Update go-bexpr to v0.1.1 This brings in: • `in`/`not in` operators to do substring matching • `matches` / `not matches` operators to perform regex string matching. * Add the capability to auto-generate the filtering selector ops tables for our docs	5 years ago
Paul Banks	f38da47c55	Allow raft TrailingLogs to be configured. (#6186) ... This fixes pathological cases where the write throughput and snapshot size are both so large that more than 10k log entries are written in the time it takes to restore the snapshot from disk. In this case followers that restart can never catch up with leader replication again and enter a loop of constantly downloading a full snapshot and restoring it only to find that snapshot is already out of date and the leader has truncated its logs so a new snapshot is sent etc. In general if you need to adjust this, you are probably abusing Consul for purposes outside its design envelope and should reconsider your usage to reduce data size and/or write volume.	5 years ago
Christian Muehlhaeuser	7753b97cc7	Simplified code in various places (#6176) ... All these changes should have no side-effects or change behavior: - Use bytes.Buffer's String() instead of a conversion - Use time.Since and time.Until where fitting - Drop unnecessary returns and assignment	5 years ago
hashicorp-ci	a4431da1cc	Merge Consul OSS branch 'master' at commit ef257b084d	5 years ago
javicrespo	b006060d4c	log rotation: limit count of rotated log files (#5831)	5 years ago