431 Commits (07478d3ff3c09a2fcf7acac966cd0b01603f69f9)

Author	SHA1	Message	Date
Michael Zalimeni	72999bb735	Update submodules to latest following 1.16.0 (#18197) ... Align all our internal use of submodules on the latest versions.	1 year ago
Michael Zalimeni	29cdb75d05	[NET-4865] Bump golang.org/x/net to 0.12.0 (#18186) ... Bump golang.org/x/net to 0.12.0 While not necessary to directly address CVE-2023-29406 (which should be handled by using a patched version of Go when building), an accompanying change to HTTP/2 error handling does impact agent code. See https://go-review.googlesource.com/c/net/+/506995 for the HTTP/2 change. Bump this dependency across our submodules as well for the sake of potential indirect consumers of `x/net/http`.	1 year ago
Nick Irvine	cd3fc9e1d0	add peering_commontopo tests [NET-3700] (#17951) ... Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> Co-authored-by: R.B. Boyer <rb@hashicorp.com> Co-authored-by: Freddy <freddygv@users.noreply.github.com> Co-authored-by: NiniOak <anita.akaeze@hashicorp.com>	1 year ago
Ronald	921445712e	[NET-4792] Add integrations tests for jwt-auth (#18169)	1 year ago
Ronald	03cf37e7b8	Re-order expected/actual for assertContainerState in consul container tests (#18157) ... Re-order expected/actual, consul container tests	1 year ago
Ronald	bcc6a9d752	Use JWT-auth filter in metadata mode & Delegate validation to RBAC filter (#18062) ... ### Description <!-- Please describe why you're making this change, in plain English. --> - Currently the jwt-auth filter doesn't take into account the service identity when validating jwt-auth, it only takes into account the path and jwt provider during validation. This causes issues when multiple source intentions restrict access to an endpoint with different JWT providers. - To fix these issues, rather than use the JWT auth filter for validation, we use it in metadata mode and allow it to forward the successful validated JWT token payload to the RBAC filter which will make the decisions. This PR ensures requests with and without JWT tokens successfully go through the jwt-authn filter. The filter however only forwards the data for successful/valid tokens. On the RBAC filter level, we check the payload for claims and token issuer + existing rbac rules. ### Testing & Reproduction steps <!-- * In the case of bugs, describe how to replicate * If any manual tests were done, document the steps and the conditions to replicate * Call out any important/ relevant unit tests, e2e tests or integration tests you have added or are adding --> - This test covers a multi level jwt requirements (requirements at top level and permissions level). It also assumes you have envoy running, you have a redis and a sidecar proxy service registered, and have a way to generate jwks with jwt. I mostly use: https://www.scottbrady91.com/tools/jwt for this. - first write your proxy defaults ``` Kind = "proxy-defaults" name = "global" config { protocol = "http" } ``` - Create two providers ``` Kind = "jwt-provider" Name = "auth0" Issuer = "https://ronald.local" JSONWebKeySet = { Local = { JWKS = "eyJrZXlzIjog....." } } ``` ``` Kind = "jwt-provider" Name = "okta" Issuer = "https://ronald.local" JSONWebKeySet = { Local = { JWKS = "eyJrZXlzIjogW3...." } } ``` - add a service intention ``` Kind = "service-intentions" Name = "redis" JWT = { Providers = [ { Name = "okta" }, ] } Sources = [ { Name = "*" Permissions = [{ Action = "allow" HTTP = { PathPrefix = "/workspace" } JWT = { Providers = [ { Name = "okta" VerifyClaims = [ { Path = ["aud"] Value = "my_client_app" }, { Path = ["sub"] Value = "5be86359073c434bad2da3932222dabe" } ] }, ] } }, { Action = "allow" HTTP = { PathPrefix = "/" } JWT = { Providers = [ { Name = "auth0" }, ] } }] } ] ``` - generate 3 jwt tokens: 1 from auth0 jwks, 1 from okta jwks with different claims than `/workspace` expects and 1 with correct claims - connect to your envoy (change service and address as needed) to view logs and potential errors. You can add: `-- --log-level debug` to see what data is being forwarded ``` consul connect envoy -sidecar-for redis1 -grpc-addr 127.0.0.1:8502 ``` - Make the following requests: ``` curl -s -H "Authorization: Bearer $Auth0_TOKEN" --insecure --cert leaf.cert --key leaf.key --cacert connect-ca.pem https://localhost:20000/workspace -v RBAC filter denied curl -s -H "Authorization: Bearer $Okta_TOKEN_with_wrong_claims" --insecure --cert leaf.cert --key leaf.key --cacert connect-ca.pem https://localhost:20000/workspace -v RBAC filter denied curl -s -H "Authorization: Bearer $Okta_TOKEN_with_correct_claims" --insecure --cert leaf.cert --key leaf.key --cacert connect-ca.pem https://localhost:20000/workspace -v Successful request ``` ### TODO * [x] Update test coverage * [ ] update integration tests (follow-up PR) * [x] appropriate backport labels added	1 year ago
Nick Irvine	05b665e856	chore: bump upgrade integrations tests to 1.15, 116 [NET-4743] (#18130)	1 year ago
Dan Stough	1b08626358	[OSS] Fix initial_fetch_timeout to wait for all xDS resources (#18024) ... * fix(connect): set initial_fetch_time to wait indefinitely * changelog * PR feedback 1	1 year ago
Ronald	ada3938115	Add first integration test for jwt auth with intention (#18005)	1 year ago
Dan Stough	b94095d92e	[OSS] Improve Gateway Test Coverage of Catalog Health (#18011) ... * fix(cli): remove failing check from 'connect envoy' registration for api gateway * test(integration): add tests to check catalog statsus of gateways on startup * remove extra sleep comment * Update test/integration/consul-container/libs/assert/service.go * changelog	1 year ago
Chris Thain	4f0bdd35e6	Integration test for ext-authz Envoy extension (#17980)	1 year ago
Chris S. Kim	50a9d1b696	Remove POC code (#17974)	1 year ago
Dan Bond	7dbba6c94d	deps: coredns v1.10.1 (#17912)	1 year ago
wangxinyi7	b782f2e39a	counter part of ent pr (#17618)	1 year ago
Michael Zalimeni	d0797c4a0d	Fixup consul-container/test/debugging.md (#17815) ... Add missing `-t` flag and fix minor typo.	1 year ago
Eric Haberkorn	a3ba559149	Make locality aware routing xDS changes (#17826)	1 year ago
John Murret	6d39328771	Add documentation for remote debugging of integration tests. (#17800) ... * Add documentation for remote debugging of integration tests. * add link from main docs page. * changes related to PR feedback	1 year ago
Michael Zalimeni	18b1555a6d	Improve Prop Override docs examples (#17799) ... - Provide more realistics examples for setting properties not already supported natively by Consul - Remove superfluous commas from HCL, correct target service name, and fix service defaults vs. proxy defaults in examples - Align existing integration test to updated docs	1 year ago
Matt Keeler	37636eab71	Catalog V2 Container Based Integration Test (#17674) ... * Implement the Catalog V2 controller integration container tests This now allows the container tests to import things from the root module. However for now we want to be very restrictive about which packages we allow importing. * Add an upgrade test for the new catalog Currently this should be dormant and not executed. However its put in place to detect breaking changes in the future and show an example of how to do an upgrade test with integration tests structured like catalog v2. * Make testutil.Retry capable of performing cleanup operations These cleanup operations are executed after each retry attempt. * Move TestContext to taking an interface instead of a concrete testing.T This allows this to be used on a retry.R or generally anything that meets the interface. * Move to using TestContext instead of background contexts Also this forces all test methods to implement the Cleanup method now instead of that being an optional interface. Co-authored-by: Daniel Upton <daniel@floppy.co>	1 year ago
Michael Zalimeni	2dd5551003	Fix Property Override Services parsing (#17584) ... Ensure that the embedded api struct is properly parsed when deserializing config containing a set ResourceFilter.Services field. Also enhance existing integration test to guard against bugs and exercise this field.	1 year ago
Michael Zalimeni	8e52d489ce	Add Prop Override Envoy extension integration test (#17569)	1 year ago
Matt Keeler	77f44fa878	Various bits of cleanup detected when using Go Workspaces (#17462) ... TLDR with many modules the versions included in each diverged quite a bit. Attempting to use Go Workspaces produces a bunch of errors. This commit: 1. Fixes envoy-library-references.sh to work again 2. Ensures we are pulling in go-control-plane@v0.11.0 everywhere (previously it was at that version in some modules and others were much older) 3. Remove one usage of golang/protobuf that caused us to have a direct dependency on it. 4. Remove deprecated usage of the Endpoint field in the grpc resolver.Target struct. The current version of grpc (v1.55.0) has removed that field and recommended replacement with URL.Opaque and calls to the Endpoint() func when needing to consume the previous field. 4. `go work init <all the paths to go.mod files>` && `go work sync`. This syncrhonized versions of dependencies from the main workspace/root module to all submodules 5. Updated .gitignore to ignore the go.work and go.work.sum files. This seems to be standard practice at the moment. 6. Update doc comments in protoc-gen-consul-rate-limit to be go fmt compatible 7. Upgraded makefile infra to perform linting, testing and go mod tidy on all modules in a flexible manner. 8. Updated linter rules to prevent usage of golang/protobuf 9. Updated a leader peering test to account for an extra colon in a grpc error message.	1 year ago
Poonam Jadhav	217248ba31	feat: expose logs method on container interface (#17526)	2 years ago
Paul Glass	f0ba3f40bc	Integration test for permissive mTLS (#17205) ... * Integration test for permissive mTLS	2 years ago
Paul Glass	7f4fd2735a	Only synthesize anonymous token in primary DC (#17231) ... * Only synthesize anonymous token in primary DC * Add integration test for wan fed issue	2 years ago
sarahalsmiller	134aac7c26	xds: generate endpoints directly from API gateway snapshot (#17390) ... * endpoints xds cluster configuration * resources test fix * fix reversion in resources_test * Update agent/proxycfg/api_gateway.go Co-authored-by: John Maguire <john.maguire@hashicorp.com> * gofmt * Modify getReadyUpstreams to filter upstreams by listener (#17410) Each listener would previously have all upstreams from any route that bound to the listener. This is problematic when a route bound to one listener also binds to other listeners and so includes upstreams for multiple listeners. The list for a given listener would then wind up including upstreams for other listeners. * Update agent/proxycfg/api_gateway.go Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com> * Restore import blocking * Skip to next route if route has no upstreams * cleanup * change set from bool to empty struct --------- Co-authored-by: John Maguire <john.maguire@hashicorp.com> Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com>	2 years ago
cskh	1339c79f8d	consul-container test: no splitting and on single runner (#17394)	2 years ago
R.B. Boyer	2f5256ec7a	test: slight refactoring ahead of peering testing improvements (#17387)	2 years ago
R.B. Boyer	06481bf03a	test: fix oss/ent drift in gateway container tests (#17365)	2 years ago
cskh	17f06b8808	upgrade test: fix on-the-fly-image build and downsize runner (#17331)	2 years ago
cskh	2edfda998a	consul-container: mitigate the drift from ent repo (#17323)	2 years ago
cskh	c61e994fc0	Container test: fix container test slow image build (#17316) ... Container integ test: fix container test slow image build	2 years ago
cskh	83ad0dfa74	Upgrade test target image (#17226) ... * upgrade test: add targetimage name as parameter to upgrade function - the image name of latest version and target version could be different. Add the parameter of targetImage to the upgrade function * fix a bug of expected error	2 years ago
Semir Patel	5eaeb7b8e5	Support Envoy's MaxEjectionPercent and BaseEjectionTime config entries for passive health checks (#15979) ... * Add MaxEjectionPercent to config entry * Add BaseEjectionTime to config entry * Add MaxEjectionPercent and BaseEjectionTime to protobufs * Add MaxEjectionPercent and BaseEjectionTime to api * Fix integration test breakage * Verify MaxEjectionPercent and BaseEjectionTime in integration test upstream confings * Website docs for MaxEjectionPercent and BaseEjection time * Add `make docs` to browse docs at http://localhost:3000 * Changelog entry * so that is the difference between consul-docker and dev-docker * blah * update proto funcs * update proto --------- Co-authored-by: Maliz <maliheh.monshizadeh@hashicorp.com>	2 years ago
Paul Glass	b431b04d0c	TProxy integration test (#17103) ... * TProxy integration test * Fix GHA compatibility integration test command Previously, when test splitting allocated multiple test directories to a runner, the workflow ran `go tests "./test/dir1 ./test/dir2"` which results in a directory not found error. This fixes that.	2 years ago
Semir Patel	e7bb8fdf15	Fix or disable pipeline breaking changes that made it into main in last day or so (#17130) ... * Fix straggler from renaming Register->RegisterTypes * somehow a lint failure got through previously * Fix lint-consul-retry errors * adding in fix for success jobs getting skipped. (#17132) * Temporarily disable inmem backend conformance test to get green pipeline * Another test needs disabling --------- Co-authored-by: John Murret <john.murret@hashicorp.com>	2 years ago
Paul Banks	9e35c47bbd	De-flake snapshot test (#17120)	2 years ago
John Maguire	e47f3216e5	APIGW Normalize Status Conditions (#16994) ... * normalize status conditions for gateways and routes * Added tests for checking condition status and panic conditions for validating combinations, added dummy code for fsm store * get rid of unneeded gateway condition generator struct * Remove unused file * run go mod tidy * Update tests, add conflicted gateway status * put back removed status for test * Fix linting violation, remove custom conflicted status * Update fsm commands oss * Fix incorrect combination of type/condition/status * cleaning up from PR review * Change "invalidCertificate" to be of accepted status * Move status condition enums into api package * Update gateways controller and generated code * Update conditions in fsm oss tests * run go mod tidy on consul-container module to fix linting * Fix type for gateway endpoint test * go mod tidy from changes to api * go mod tidy on troubleshoot * Fix route conflicted reason * fix route conflict reason rename * Fix text for gateway conflicted status * Add valid certificate ref condition setting * Revert change to resolved refs to be handled in future PR	2 years ago
R.B. Boyer	9db223f54b	fix the linter (#17077)	2 years ago
Anita Akaeze	fece53c48e	NET-3648: Add script to get consul and envoy version (#17060)	2 years ago
hashicorp-copywrite[bot]	9f81fc01e9	[COMPLIANCE] Add Copyright and License Headers (#16854) ... Co-authored-by: hashicorp-copywrite[bot] <110428419+hashicorp-copywrite[bot]@users.noreply.github.com> Co-authored-by: Ronald <roncodingenthusiast@users.noreply.github.com>	2 years ago
John Murret	2cefa8d9bd	ci: remove test-integrations CircleCI workflow (#16928) ... * remove all CircleCI files * remove references to CircleCI * remove more references to CircleCI * pin golangci-lint to v1.51.1 instead of v1.51	2 years ago
Dhia Ayachi	711179db96	add ability to start container tests in debug mode and attach a debugger (#16887) ... * add ability to start container tests in debug mode and attach a debugger to consul while running it. * add a debug message with the debug port * use pod to get the right port * fix image used in basic test * add more data to identify which container to debug. * fix comment Co-authored-by: Evan Culver <eculver@users.noreply.github.com> * rename debugUri to debugURI --------- Co-authored-by: Evan Culver <eculver@users.noreply.github.com>	2 years ago
Michael Wilkerson	0dd4ea2033	* added Sameness Group to proto files (#16998) ... - added Sameness Group to config entries - added Sameness Group to subscriptions * generated proto files * added Sameness Group events to the state store - added test cases * Refactored health RPC Client - moved code that is common to rpcclient under rpcclient common.go. This will help set us up to support future RPC clients * Refactored proxycfg glue views - Moved views to rpcclient config entry. This will allow us to reuse this code for a config entry client * added config entry RPC Client - Copied most of the testing code from rpcclient/health * hooked up new rpcclient in agent * fixed documentation and comments for clarity	2 years ago
cskh	75bda84873	upgrade test: config nodeName, nodeid, and inherited persistent data for consul container (#16931)	2 years ago
Chris Thain	175bb1a303	Wasm Envoy HTTP extension (#16877)	2 years ago
Nick Irvine	4ae59923ff	port ENT upgrade tests flattening (#16824)	2 years ago
Nick Irvine	32358ddf7e	port ENT ingress gateway upgrade tests [NET-2294] [NET-2296] (#16804)	2 years ago
Ronald	b64674623e	Copyright headers for missing files/folders (#16708) ... * copyright headers for agent folder	2 years ago
John Maguire	9217ac19bd	Expand route flattening test for multiple namespaces (#16745) ... * Exand route flattening test for multiple namespaces * Add helper for checking http route config entry exists without checking for bound status * Fix port and hostname check for http route flattening test	2 years ago
Dhia Ayachi	769d9505a8	add extra resiliency to snapshot restore test (#16712)	2 years ago
Anita Akaeze	0fc8a3efa7	NET-2397: Add readme.md to upgrade test subdirectory (#16610) ... * NET-2397: Add readme.md to upgrade test subdirectory * remove test code * fix link and update steps of adding new test cases (#16654) * fix link and update steps of adding new test cases * Apply suggestions from code review Co-authored-by: Nick Irvine <115657443+nfi-hashicorp@users.noreply.github.com> --------- Co-authored-by: Nick Irvine <115657443+nfi-hashicorp@users.noreply.github.com> --------- Co-authored-by: cskh <hui.kang@hashicorp.com> Co-authored-by: Nick Irvine <115657443+nfi-hashicorp@users.noreply.github.com>	2 years ago
Dhia Ayachi	b9d8552e25	Snapshot restore tests (#16647) ... * add snapshot restore test * add logstore as test parameter * Use the correct image version * make sure we read the logs from a followers to test the follower snapshot install path. * update to raf-wal v0.3.0 * add changelog. * updating changelog for bug description and removed integration test. * setting up test container builder to only set logStore for 1.15 and higher --------- Co-authored-by: Paul Banks <pbanks@hashicorp.com> Co-authored-by: John Murret <john.murret@hashicorp.com>	2 years ago
Andrew Stucki	501b87fd31	[API Gateway] Fix invalid cluster causing gateway programming delay (#16661) ... * Add test for http routes * Add fix * Fix tests * Add changelog entry * Refactor and fix flaky tests	2 years ago
John Maguire	197ed67ea7	Add in query options for catalog service existing in a specific (#16652) ... namespace when creating service for tests	2 years ago
John Maguire	ff5887a99e	Update e2e tests for namespaces (#16627) ... * Refactored "NewGatewayService" to handle namespaces, fixed TestHTTPRouteFlattening test * Fixed existing http_route tests for namespacing * Squash aclEnterpriseMeta for ResourceRefs and HTTPServices, accept namespace for creating connect services and regular services * Use require instead of assert after creating namespaces in http_route_tests * Refactor NewConnectService and NewGatewayService functions to use cfg objects to reduce number of method args * Rename field on SidecarConfig in tests from `SidecarServiceName` to `Name` to avoid stutter	2 years ago
Freddy	724b752ca7	Backport ENT-4704 (#16612)	2 years ago
John Maguire	fa93a0d4f7	Add namespace file with build tag for OSS gateway tests (#16590) ... * Add namespace file with build tag for OSS tests * Remove TODO comment	2 years ago
Semir Patel	9a5cb20570	Bump submodules from latest 1.15.1 patch release (#16578) ... * Update changelog with Consul patch releases 1.13.7, 1.14.5, 1.15.1 * Bump submodules from latest patch release * Forgot one	2 years ago
Anita Akaeze	280bdd3ea0	NET-2954: Improve integration tests CI execution time (#16565) ... * NET-2954: Improve integration tests CI execution time * fix ci * remove comments and modify config file	2 years ago
cskh	b649a5e8e4	upgrade test: use retry with ModifyIndex and remove ent test file (#16553)	2 years ago
cskh	94ecb9c5d5	upgrade test: discovery chain across partition (#16543)	2 years ago
Anita Akaeze	9d8e00db24	Merge pull request #4573 from hashicorp/NET-2841 (#16544) ... * Merge pull request #4573 from hashicorp/NET-2841 NET-2841: PART 2 refactor upgrade tests to include version 1.15 * update upgrade versions	2 years ago
Melisa Griffin	fc232326a0	NET-2904 Fixes API Gateway Route Service Weight Division Error	2 years ago
Andrew Stucki	cc0765b87d	Fix resolution of service resolvers with subsets for external upstreams (#16499) ... * Fix resolution of service resolvers with subsets for external upstreams * Add tests * Add changelog entry * Update view filter logic	2 years ago
Andrew Stucki	5deffbd95b	Fix issue where terminating gateway service resolvers weren't properly cleaned up (#16498) ... * Fix issue where terminating gateway service resolvers weren't properly cleaned up * Add integration test for cleaning up resolvers * Add changelog entry * Use state test and drop integration test	2 years ago
Anita Akaeze	358c35ef70	Merge pull request #4584 from hashicorp/refactor_cluster_config (#16517) ... NET-2841: PART 1 - refactor NewPeeringCluster to support custom config	2 years ago
Anita Akaeze	2b6d35fa8f	Merge pull request #4538 from hashicorp/NET-2396 (#16516) ... NET-2396: refactor test to reduce duplication	2 years ago
Nick Irvine	367a64f059	NET-2292: port ingress-gateway test case "http" from BATS addendum (#16490)	2 years ago
sarahalsmiller	6db445ba29	Gateway Test HTTPPathRewrite (#16418) ... * add http url path rewrite * add Mike's test back in * update kind to use api.APIGateway	2 years ago
Mike Morris	29db217a0e	gateways: add e2e test for API Gateway HTTPRoute ParentRef change (#16408) ... * test(gateways): add API Gateway HTTPRoute ParentRef change test * test(gateways): add checkRouteError helper * test(gateways): remove EOF check in CI this seems to sometimes be 'connection reset by peer' instead * Update test/integration/consul-container/test/gateways/http_route_test.go	2 years ago
cskh	c7713462ca	upgrade test: consolidate resolver test cases (#16443)	2 years ago
sarahalsmiller	d99dcd48c2	Basic gobased API gateway spinup test (#16278) ... * wip, proof of concept, gateway service being registered, don't know how to hit it * checkpoint * Fix up API Gateway go tests (#16297) * checkpoint, getting InvalidDiscoveryChain route protocol does not match targeted service protocol * checkpoint * httproute hittable * tests working, one header test failing * differentiate services by status code, minor cleanup * working tests * updated GetPort interface * fix getport --------- Co-authored-by: Andrew Stucki <andrew.stucki@hashicorp.com>	2 years ago
Anita Akaeze	94b378998f	NO_JIRA: refactor validate function in traffic mgt tests (#16422)	2 years ago
Semir Patel	d4dee31503	Try DRYing up createCluster in integration tests (#16199)	2 years ago
Anita Akaeze	1ed70cf9d0	NET-2286: Add tests to verify traffic redirects between services (#16390)	2 years ago
cskh	3de9f7fc17	upgrade test: peering with resolver and failover (#16391)	2 years ago
Eric Haberkorn	595131fca9	Refactor the disco chain -> xds logic (#16392)	2 years ago
Anita Akaeze	98a771d1e4	NET-2285: Assert total number of expected instances by Consul (#16371)	2 years ago
Anita Akaeze	84c7b0066c	initial code (#16296)	2 years ago
Derek Menteer	5309f68bc0	Upgrade Alpine image to 3.17 (#16358)	2 years ago
cskh	de17c7c26f	upgrade test: splitter and resolver config entry in peered cluster (#16356)	2 years ago
Andrew Stucki	18e2ee77ca	[API Gateway] Fix targeting service splitters in HTTPRoutes (#16350) ... * [API Gateway] Fix targeting service splitters in HTTPRoutes * Fix test description	2 years ago
Andrew Stucki	7f9ec78932	[API Gateway] Validate listener name is not empty (#16340) ... * [API Gateway] Validate listener name is not empty * Update docstrings and test	2 years ago
wangxinyi7	9d55cd1f18	fix flakieness (#16338)	2 years ago
Dan Stough	f1436109ea	[OSS] security: update go to 1.20.1 (#16263) ... * security: update go to 1.20.1	2 years ago
Andrew Stucki	e4a992c581	Fix hostname alignment checks for HTTPRoutes (#16300) ... * Fix hostname alignment checks for HTTPRoutes	2 years ago
Andrew Stucki	b3ddd4d24e	Inline API Gateway TLS cert code (#16295) ... * Include secret type when building resources from config snapshot * First pass at generating envoy secrets from api-gateway snapshot * Update comments for xDS update order * Add secret type + corresponding golden files to existing tests * Initialize test helpers for testing api-gateway resource generation * Generate golden files for new api-gateway xDS resource test * Support ADS for TLS certificates on api-gateway * Configure TLS on api-gateway listeners * Inline TLS cert code * update tests * Add SNI support so we can have multiple certificates * Remove commented out section from helper * regen deep-copy * Add tcp tls test --------- Co-authored-by: Nathan Coleman <nathan.coleman@hashicorp.com>	2 years ago
Nitya Dhanushkodi	8dab825c36	troubleshoot: fixes and updated messages (#16294)	2 years ago
Thomas Eckert	2460ac99c9	API Gateway Envoy Golden Listener Tests (#16221) ... * Simple API Gateway e2e test for tcp routes * Drop DNSSans since we don't front the Gateway with a leaf cert * WIP listener tests for api-gateway * Return early if no routes * Add back in leaf cert to testing * Fix merge conflicts * Re-add kind to setup * Fix iteration over listener upstreams * New tcp listener test * Add tests for API Gateway with TCP and HTTP routes * Move zero-route check back * Drop generateIngressDNSSANs * Check for chains not routes --------- Co-authored-by: Andrew Stucki <andrew.stucki@hashicorp.com>	2 years ago
cskh	fd61605ffb	upgrade test: fix flaky peering through mesh gateway (#16271)	2 years ago
malizz	247211de6a	add integration tests for troubleshoot (#16223) ... * draft * expose internal admin port and add proxy test * update tests * move comment * add failure case, fix lint issues * cleanup * handle error * revert changes to service interface * address review comments * fix merge conflict * merge the tests so cluster is created once * fix other test	2 years ago
cskh	5b7f36c2ce	integ test: fix retry upstream test (#16246)	2 years ago
Andrew Stucki	9bb0ecfc18	[API Gateway] Add integration test for HTTP routes (#16236) ... * [API Gateway] Add integration test for conflicted TCP listeners * [API Gateway] Update simple test to leverage intentions and multiple listeners * Fix broken unit test * [API Gateway] Add integration test for HTTP routes	2 years ago
cskh	ab5dac3414	upgrade test: peering with http router config entry (#16231) ... * upgrade test: peering with http router config entry	2 years ago
Andrew Stucki	8ff2974dbe	[API Gateway] Update simple test to leverage intentions and multiple listeners (#16228) ... * [API Gateway] Add integration test for conflicted TCP listeners * [API Gateway] Update simple test to leverage intentions and multiple listeners * Fix broken unit test * PR suggestions	2 years ago
Andrew Stucki	318ba215ab	[API Gateway] Add integration test for conflicted TCP listeners (#16225)	2 years ago
Derek Menteer	4f2ce60654	Fix peering acceptors in secondary datacenters. (#16230) ... Prior to this commit, secondary datacenters could not be initialized as peering acceptors if ACLs were enabled. This is due to the fact that internal server-to-server API calls would fail because the management token was not generated. This PR makes it so that both primary and secondary datacenters generate their own management token whenever a leader is elected in their respective clusters.	2 years ago
Andrew Stucki	3b9c569561	Simple API Gateway e2e test for tcp routes (#16222) ... * Simple API Gateway e2e test for tcp routes * Drop DNSSans since we don't front the Gateway with a leaf cert	2 years ago
Andrew Stucki	f4210d47dd	Add basic smoke test to make sure an APIGateway runs (#16217)	2 years ago
Anita Akaeze	d72ad5fb95	Merge pull request #4216 from hashicorp/NET-2252-add-assert-fortioname (#16212) ... NET-2252: integration tests: add assert.FortioName	2 years ago
cskh	e91bc9c058	feat: envoy extension - http local rate limit (#16196) ... - http local rate limit - Apply rate limit only to local_app - unit test and integ test	2 years ago
cskh	b4151780d6	Upgrade test: verify the agent token is working after upgrade (#16164) ... 1. Upgraded agent can inherit the persisted token and join the cluster 2. Agent token prior to upgrade is still valid after upgrade 3. Enable ACL in the agent configuration	2 years ago
wangxinyi7	906ebb97f6	change log level (#16128)	2 years ago
Anita Akaeze	f58d5bb221	NET-2087: Restart proxy sidecar during cluster upgrade (#16140)	2 years ago
Anita Akaeze	fcf18222c5	add assertions (#16087)	2 years ago
Dan Upton	e40b731a52	rate: add prometheus definitions, docs, and clearer names (#15945)	2 years ago
Anita Akaeze	08a19e532d	NO_JIRA: Add function to get container status before making api call (#16116)	2 years ago
cskh	f6da81c9d0	improvement: prevent filter being added twice from any enovy extension (#16112) ... * improvement: prevent filter being added twice from any enovy extension * break if error != nil * update test	2 years ago
cskh	9da61c1cec	Upgrade test: retain sidecar containers during upgrade. (#16100)	2 years ago
cskh	ffb81782de	Upgrade test: peering control plane traffic through mesh gateway (#16091)	2 years ago
cskh	5fa9ab28dc	integ test: remove hardcoded upstream local bind port and max number of envoy sidecar (#16092)	2 years ago
cskh	ebdb8e5fb2	flaky test: use retry long to wait for config entry upgrade (#16068) ... * flaky test: use retry long to wait for config entry upgrade * increase wait for rbac policy	2 years ago
cskh	dbaab52786	Post upgrade test validation: envoy endpoint and register service (#16067)	2 years ago
Dan Stough	bb71d045e1	test: run integration tests in parallel (#16035)	2 years ago
R.B. Boyer	96389eb266	test: container tests wait for available networks (#16045)	2 years ago
Dan Stough	91d6a81c14	test(integration): add access logging test (#16008)	2 years ago
John Murret	794277371f	Integration test for server rate limiting (#15960) ... * rate limit test * Have tests for the 3 modes * added assertions for logs and metrics * add comments to test sections * add check for rate limit exceeded text in log assertion section. * fix linting error * updating test to use KV get and put. move log assertion tolast. * Adding logging for blocking messages in enforcing mode. refactoring tests. * modified test description * formatting * Apply suggestions from code review Co-authored-by: Dan Upton <daniel@floppy.co> * Update test/integration/consul-container/test/ratelimit/ratelimit_test.go Co-authored-by: Dhia Ayachi <dhia@hashicorp.com> * expand log checking so that it ensures both logs are they when they are supposed to be and not there when they are not expected to be. * add retry on test * Warn once when rate limit exceed regardless of enforcing vs permissive. * Update test/integration/consul-container/test/ratelimit/ratelimit_test.go Co-authored-by: Dan Upton <daniel@floppy.co> Co-authored-by: Dan Upton <daniel@floppy.co> Co-authored-by: Dhia Ayachi <dhia@hashicorp.com>	2 years ago
Anita Akaeze	4e154144a6	NET-2038: Add envoy assertion function of listener verification (#15969)	2 years ago
Dan Stough	e8dde59bd0	chore(ci): fix compat ent compat tests for sidecars and gateways (#15997)	2 years ago
R.B. Boyer	d59efd390c	test: general cleanup and fixes for the container integration test suite (#15959) ... - remove dep on consul main module - use 'consul tls' subcommands instead of tlsutil - use direct json config construction instead of agent/config structs - merge libcluster and libagent packages together - more widely use BuildContext - get the OSS/ENT runner stuff working properly - reduce some flakiness - fix some correctness related to http/https API	2 years ago
Dan Stough	6d2880e894	feat: add access logs to dataplane bootstrap rpc (#15951)	2 years ago
Matt Keeler	5afd4657ec	Protobuf Modernization (#15949) ... * Protobuf Modernization Remove direct usage of golang/protobuf in favor of google.golang.org/protobuf Marshallers (protobuf and json) needed some changes to account for different APIs. Moved to using the google.golang.org/protobuf/types/known/* for the well known types including replacing some custom Struct manipulation with whats available in the structpb well known type package. This also updates our devtools script to install protoc-gen-go from the right location so that files it generates conform to the correct interfaces. * Fix go-mod-tidy make target to work on all modules	2 years ago
Eric Haberkorn	8d923c1789	Add the Lua Envoy extension (#15906)	2 years ago
cskh	1113314641	Refactoring the peering integ test to accommodate coming changes of o… (#15885) ... * Refactoring the peering integ test to accommodate coming changes of other upgrade scenarios. - Add a utils package under test that contains methods to set up various test scenarios. - Deduplication: have a single CreatingPeeringClusterAndSetup replace CreatingAcceptingClusterAndSetup and CreateDialingClusterAndSetup. - Separate peering cluster creation and server registration. * Apply suggestions from code review Co-authored-by: Dan Stough <dan.stough@hashicorp.com>	2 years ago
Dan Upton	d4c435856b	grpc: `protoc` plugin for generating gRPC rate limit specifications (#15564) ... Adds automation for generating the map of `gRPC Method Name → Rate Limit Type` used by the middleware introduced in #15550, and will ensure we don't forget to add new endpoints. Engineers must annotate their RPCs in the proto file like so: ``` rpc Foo(FooRequest) returns (FooResponse) { option (consul.internal.ratelimit.spec) = { operation_type: READ, }; } ``` When they run `make proto` a protoc plugin `protoc-gen-consul-rate-limit` will be installed that writes rate-limit specs as a JSON array to a file called `.ratelimit.tmp` (one per protobuf package/directory). After running Buf, `make proto` will execute a post-process script that will ingest all of the `.ratelimit.tmp` files and generate a Go file containing the mappings in the `agent/grpc-middleware` package. In the enterprise repository, it will write an additional file with the enterprise-only endpoints. If an engineer forgets to add the annotation to a new RPC, the plugin will return an error like so: ``` RPC Foo is missing rate-limit specification, fix it with: import "proto-public/annotations/ratelimit/ratelimit.proto"; service Bar { rpc Foo(...) returns (...) { option (hashicorp.consul.internal.ratelimit.spec) = { operation_type: OPERATION_READ | OPERATION_WRITE | OPERATION_EXEMPT, }; } } ``` In the future, this annotation can be extended to support rate-limit category (e.g. KV vs Catalog) and to determine the retry policy.	2 years ago
Nitya Dhanushkodi	d382ca0aec	extensions: refactor serverless plugin to use extensions from config entry fields (#15817) ... docs: update config entry docs and the Lambda manual registration docs Co-authored-by: Nitya Dhanushkodi <nitya@hashicorp.com> Co-authored-by: Eric <eric@haberkorn.co>	2 years ago
cskh	692a6edd7d	Upgrade test: test peering upgrade from an old version of consul (#15768) ... * upgrade test: test peering upgrade from an old version of consul NET-1809	2 years ago
Semir Patel	bafa5c7156	Pass remote addr of incoming HTTP requests through to RPC(..) calls (#15700)	2 years ago
cskh	04bf24c8c1	feat(ingress-gateway): support outlier detection of upstream service for ingress gateway (#15614) ... * feat(ingress-gateway): support outlier detection of upstream service for ingress gateway * changelog Co-authored-by: Eric Haberkorn <erichaberkorn@gmail.com>	2 years ago
Dan Stough	98ef5f28dd	[OSS] security: update x/net module (#15737) ... Co-authored-by: Dhia Ayachi <dhia@hashicorp.com>	2 years ago
Eric Haberkorn	4268c1c25c	Remove the `connect.enable_serverless_plugin` agent configuration option (#15710)	2 years ago
cskh	3df68751f5	Flakiness test: case-cfg-splitter-peering-ingress-gateways (#15707) ... * integ-test: fix flaky test - case-cfg-splitter-peering-ingress-gateways * add retry peering to all peering cases Co-authored-by: Dan Stough <dan.stough@hashicorp.com>	2 years ago
cskh	36f05bc8fb	integ-test: test consul upgrade from the snapshot of a running cluster (#15595) ... * integ-test: test consul upgrade from the snapshot of a running cluster * use Target version as default Co-authored-by: Dan Stough <dan.stough@hashicorp.com>	2 years ago
Dan Stough	227fd14287	chore: updates from 1.14.2 release (#15633) ... * chore: updates from 1.14.2 release	2 years ago
Derek Menteer	8079686bf0	Add 1.14.1 release updates. (#15514) ... Add post-release changes for 1.14.1 updates.	2 years ago
cskh	359a908bea	integ-test: remove unnecessary step since connection is already via mgw (#15381)	2 years ago
Derek Menteer	dc27e35f82	Consul 1.14 post-release updates (#15382) ... * Update changelog with 1.14 notes. * gomod version bumps for 1.14 release.	2 years ago
Derek Menteer	ef61bdf3c2	Remove unnecessary default test config. (#15361)	2 years ago
Kyle Schochenmaier	bf0f61a878	removes ioutil usage everywhere which was deprecated in go1.16 (#15297) ... * update go version to 1.18 for api and sdk, go mod tidy * removes ioutil usage everywhere which was deprecated in go1.16 in favour of io and os packages. Also introduces a lint rule which forbids use of ioutil going forward. Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com>	2 years ago
Freddy	7f5f7e9cf9	Avoid blocking child type updates on parent ack (#15083)	2 years ago
Chris S. Kim	985a4ee1b1	Update hcp-scada-provider to fix diamond dependency problem with go-msgpack (#15185)	2 years ago
R.B. Boyer	ed294fc49c	test: fix envoy integration tests to explicitly create config entries (#15269) ... This is instead of the current behavior where we feed the config entries in using the config_entries.bootstrap configuration which oddly races against other setup code in some circumstances. I converted ALL tests to explicitly create config entries.	2 years ago
Dan Stough	553312ef61	fix: persist peering CA updates to dialing clusters (#15243) ... fix: persist peering CA updates to dialing clusters	2 years ago
cskh	94d232ab1e	integ test: reduce flakiness due to compound output from retry (#15233) ... * integ test: avoid flakiness due to compound output from retry * changelog	2 years ago
Dan Stough	05e93f7569	test: refactor testcontainers and add peering integ tests (#15084)	2 years ago
Derek Menteer	2d4b62be3c	Add tests.	2 years ago
Chris S. Kim	41019adf56	Update go version to 1.19	2 years ago
cskh	fa970a85ad	integration test: specify image name for testing dev container (#15069) ... * integration test: specify image name for testing dev container * Add todo	2 years ago
cskh	6a9739ad7e	chore: fix the module path to align with the code structure (#15053)	2 years ago