9360 Commits (07ec7988a457a2493a0ccfd1699b46a8ea4ab263)

 

All Branches   

Search

Author	SHA1	Message	Date
Paul Banks	07ec7988a4	Update CHANGELOG.md	6 years ago
Diogenes S. Jesus	f0e081bf88	Fix repeating wording in sentence (#5256) ... Fix `to join to join` typo	6 years ago
John Cowen	3a0b0b2b65	Update CHANGELOG.md	6 years ago
John Cowen	a35fe7c5ba	ui: Removes delete button form pages that show your current token (#5241) ... Tokens can no longer delete themselves see: https://github.com/hashicorp/consul/pull/5210 ...so we remove the button to allow you to do that from the UI	6 years ago
John Cowen	c8386ec0cc	UI: [BUGFIX] Decode/encode urls (#5206) ... In 858b05fc31 (diff-46ef88aa04507fb9b039344277531584) we removed encoding values in pathnames as we thought they were eventually being encoded by `ember`. It looks like this isn't the case. Turns out sometimes they are encoded sometimes they aren't. It's complicated. If at all possible refer to the PR https://github.com/hashicorp/consul/pull/5206. It's related to the difference between `dynamic` routes and `wildcard` routes. Partly related to this is a decision on whether we urlencode the slashes within service names or not. Whilst historically we haven't done this, we feel its a good time to change this behaviour, so we'll also be changing services to use dynamic routes instead of wildcard routes. So service links will then look like /ui/dc-1/services/application%2Fservice rather than /ui/dc-1/services/application/service Here, we define our routes in a declarative format (for the moment at least JSON) outside of Router.map, and loop through this within Router.map to set all our routes using the standard this.route method. We essentially configure our Router from the outside. As this configuration is now done declaratively outside of Router.map we can also make this data available to href-to and paramsFor, allowing us to detect wildcard routes and therefore apply urlencoding/decoding. Where I mention 'conditionally' below, this is detection is what is used for the decision. We conditionally add url encoding to the `{{href-to}}` helper/addon. The reasoning here is, if we are asking for a 'href/url' then whatever we receive back should always be urlencoded. We've done this by reusing as much code from the original `ember-href-to` addon as possible, after this change every call to the `{{href-to}}` helper will be urlencoded. As all links using `{{href-to}}` are now properly urlencoded. We also need to decode them in the correct place 'on the other end', so.. We also override the default `Route.paramsFor` method to conditionally decode all params before passing them to the `Route.model` hook. Lastly (the revert), as we almost consistently use url params to construct API calls, we make sure we re-encode any slugs that have been passed in by the user/developer. The original API for the `createURL` function was to allow you to pass values that didn't need encoding, values that **did** need encoding, followed by query params (which again require url encoding) All in all this should make the entire ember app url encode/decode safe.	6 years ago
Matt Keeler	8f0d622a54	Revendor serf to pull in keyring list truncation changes. (#5251)	6 years ago
Hans Hasselberg	0da4502740	website: update nokogiri (#5252)	6 years ago
Hans Hasselberg	88058879dc	Update CHANGELOG.md	6 years ago
Hans Hasselberg	174099593a	agent: display messages from serf in cli (#5236) ... * display messages from serf in cli	6 years ago
Kyle Havlovitz	2abc48c1eb	Update CHANGELOG.md	6 years ago
Kyle Havlovitz	8851505892	Merge pull request #5250 from hashicorp/forward-intention-rpcs ... connect: Forward intention RPCs if this isn't the primary	6 years ago
Kyle Havlovitz	88c044759f	connect: Forward intention RPCs if this isn't the primary	6 years ago
Kyle Havlovitz	6b28434f8a	Merge pull request #5249 from hashicorp/ca-fixes-oss ... Minor CA fixes	6 years ago
Kyle Havlovitz	46ef7dc1fb	Update CHANGELOG.md	6 years ago
Kyle Havlovitz	5bdf130767	Merge pull request #4869 from hashicorp/txn-checks ... Add node/service/check operations to transaction api	6 years ago
Kyle Havlovitz	a28ba4687d	connect/ca: return a better error message if the CA isn't fully initialized when signing	6 years ago
Matt Keeler	922baf811c	Update CHANGELOG.md	6 years ago
Matt Keeler	579a8b32ed	Fix several ACL token/policy resolution issues. (#5246) ... * Fix 2 remote ACL policy resolution issues 1 - Use the right method to fire async not found errors when the ACL.PolicyResolve RPC returns that error. This was previously accidentally firing a token result instead of a policy result which would have effectively done nothing (unless there happened to be a token with a secret id == the policy id being resolved. 2. When concurrent policy resolution is being done we single flight the requests. The bug before was that for the policy resolution that was going to piggy back on anothers RPC results it wasn’t waiting long enough for the results to come back due to looping with the wrong variable. * Fix a handful of other edge case ACL scenarios The main issue was that token specific issues (not able to access a particular policy or the token being deleted after initial fetching) were poisoning the policy cache. A second issue was that for concurrent token resolutions, the first resolution to get started would go fetch all the policies. If before the policies were retrieved a second resolution request came in, the new request would register watchers for those policies but then never block waiting for them to complete. This resulted in using the default policy when it shouldn't have.	6 years ago
Paul Banks	ef9f27cbc8	connect: tame thundering herd of CSRs on CA rotation (#5228) ... * Support rate limiting and concurrency limiting CSR requests on servers; handle CA rotations gracefully with jitter and backoff-on-rate-limit in client * Add CSR rate limiting docs * Fix config naming and add tests for new CA configs	6 years ago
kaitlincarter-hc	3e45da1414	Add acl.enable_key_list_policy to agent config docs. (#5227) ... * Adding key list parameter to agent config docs. * Fixed typo in master token section * Updated based on comments from Paul and Matt.	6 years ago
Kyle Havlovitz	ddc4a8d848	oss: add the enterprise server stub for intention replication check	6 years ago
Matt Keeler	884b2e00af	Update CHANGELOG.md	6 years ago
Matt Keeler	7e6b3e6a0c	Implement prepared query upstreams watching for envoy (#5224) ... Fixes #4969 This implements non-blocking request polling at the cache layer which is currently only used for prepared queries. Additionally this enables the proxycfg manager to poll prepared queries for use in envoy proxy upstreams.	6 years ago
Erik R. Rygg	8c87238b99	Merge pull request #5215 from hashicorp/deployment_guide_updates ... Include information about multi-dc Connect	6 years ago
John Cowen	66c139ceae	UI: Text change and clarity Node Health > Health Checks (#5115) ... Text change Node Health > Health Checks Also adds an info icon and tooltip to Health Checks column header	6 years ago
Jihoon Chung	d5e28bda56	ui: Fix typo in acl-migration guide link (#5135)	6 years ago
Rebecca Zanzig	fbb40d72c0	Merge pull request #5230 from hashicorp/docs/helm-formatting ... Docs/helm formatting	6 years ago
Rebecca Zanzig	ebba215891	Fix broken links	6 years ago
Rebecca Zanzig	df99f4a3ac	Indent code blocks further to fix list formatting	6 years ago
Rebecca Zanzig	388ff4caed	Merge pull request #5222 from hashicorp/docs/helm-0.5.0 ... Add documentation about the two additional Helm chart options	6 years ago
Chris Wang	1e3bda174d	Fix typo in k8s connect documentation (#5229)	6 years ago
Kyle Havlovitz	21380021af	txn: update existing txn api docs with new operations	6 years ago
kaitlincarter-hc	59c010eb3b	Update links for learn migration (#5223) ... * Stared updaing links for the learn migration * Language change cluster -> datacenter (#5212) * Updating the language from cluster to datacenter in the backup guide to be consistent and more accurate. * missed some clusters * updated three broken links for the sidebar nav	6 years ago
Hans Hasselberg	3c110d5c78	Sorting entries in Changelog for upcoming release	6 years ago
Rebecca Zanzig	98b3c13dbb	Merge pull request #5213 from hashicorp/docs/helm-security ... Add a security warning about the default Helm chart installation	6 years ago
Rebecca Zanzig	6de477ef96	Add documentation about the two additional Helm chart options ... Adds info about `k8stag` and `nodePortSyncType` options that were added in consul-helm v0.5.0. Additionally moves the k8sprefix to match the order in the Helm chart values file, while also clarifying that it only affects one sync direction.	6 years ago
Rebecca Zanzig	1c70407bd1	Add a security warning about the default Helm chart installation ... If a user installs the default Helm chart Consul on a Kubernetes cluster that is open to the internet, it is lacking some important security configurations.	6 years ago
kaitlincarter-hc	adcdc81f93	Language change cluster -> datacenter (#5212) ... * Updating the language from cluster to datacenter in the backup guide to be consistent and more accurate. * missed some clusters	6 years ago
Matt Keeler	6fe09aa23b	Update CHANGELOG.md	6 years ago
Matt Keeler	1ec5f2a27f	Store leaf cert indexes in raft and use for the ModifyIndex on the returned certs (#5211) ... * Store leaf cert indexes in raft and use for the ModifyIndex on the returned certs This ensures that future certificate signings will have a strictly greater ModifyIndex than any previous certs signed.	6 years ago
Matt Keeler	834e168f94	Update CHANGELOG.md	6 years ago
Aestek	4afbe792df	Improve blocking queries on services that do not exist (#4810) ... ## Background When making a blocking query on a missing service (was never registered, or is not registered anymore) the query returns as soon as any service is updated. On clusters with frequent updates (5~10 updates/s in our DCs) these queries virtually do not block, and clients with no protections againt this waste ressources on the agent and server side. Clients that do protect against this get updates later than they should because of the backoff time they implement between requests. ## Implementation While reducing the number of unnecessary updates we still want : * Clients to be notified as soon as when the last instance of a service disapears. * Clients to be notified whenever there's there is an update for the service. * Clients to be notified as soon as the first instance of the requested service is added. To reduce the number of unnecessary updates we need to block when a request to a missing service is made. However in the following case : 1. Client `client1` makes a query for service `foo`, gets back a node and X-Consul-Index 42 2. `foo` is unregistered 3. `client1`  makes a query for `foo` with `index=42` -> `foo` does not exist, the query blocks and `client1` is not notified of the change on `foo` We could store the last raft index when each service was last alive to know wether we should block on the incoming query or not, but that list could grow indefinetly. We instead store the last raft index when a service was unregistered and use it when a query targets a service that does not exist. When a service `srv` is unregistered this "missing service index" is always greater than any X-Consul-Index held by the clients while `srv` was up, allowing us to immediatly notify them. 1. Client `client1` makes a query for service `foo`, gets back a node and `X-Consul-Index: 42` 2. `foo` is unregistered, we set the "missing service index" to 43 3. `client1` makes a blocking query for `foo` with `index=42` -> `foo` does not exist, we check against the "missing service index" and return immediatly with `X-Consul-Index: 43` 4. `client1` makes a blocking query for `foo` with `index=43` -> we block 5. Other changes happen in the cluster, but foo still doesn't exist and "missing service index" hasn't changed, the query is still blocked 6. `foo` is registered again on index 62 -> `foo` exists and its index is greater than 43, we unblock the query	6 years ago
R.B. Boyer	4db60f8243	website: minor acl guide fixes (#5214)	6 years ago
Elghazal Ahmed	2e97a4858f	website: add autowire in Community Tools list (#5118) ... * add autowire in Community Tools list * put list in the right alphabetic order	6 years ago
Hans Hasselberg	f8112e7eaf	Update CHANGELOG.md	6 years ago
Hans Hasselberg	27738c77c0	Update CHANGELOG.md	6 years ago
Matt Keeler	052d68b5fb	Update CHANGELOG.md	6 years ago
Matt Keeler	baa8946ea6	cache: Pass through wait query param to the cache.Get (#5203) ... This adds a MaxQueryTime field to the connect ca leaf cache request type and populates it via the wait query param. The cache will then do the right thing and timeout the operation as expected if no new leaf cert is available within that time. Fixes #4462 The reproduction scenario in the original issue now times out appropriately.	6 years ago
Matt Keeler	27a9f51b24	Update CHANGELOG.md	6 years ago
Pierre Souchay	1618d79518	Allow `"disable_host_node_id": false` to work on Linux as non-root. (#4926) ... Bump `shirou/gopsutil` to include https://github.com/shirou/gopsutil/pull/603 This will allow to have consistent node-id even when machine is reinstalled when using `"disable_host_node_id": false` It will fix https://github.com/hashicorp/consul/issues/4914 and allow having the same node-id even when reinstalling a node from scratch. However, it is only compatible with a single OS (installing to Windows will change the node-id, but it seems acceptable).	6 years ago