646 Commits (0827c9422227720752d421eada1cf74c71685486)

Author	SHA1	Message	Date
Daniel Nephin	65d48e5042	state: remove support for updating legacy ACL tokens	3 years ago
Daniel Nephin	3390f85ab4	acl: remove ACLTokenTypeManagement	3 years ago
Daniel Nephin	32b4ad42ac	acl: remove ACLTokenTypeClient, ... along with the last test referencing it.	3 years ago
Daniel Nephin	c77e5747b1	acl: remove EmbeddedPolicy ... This method is no longer. It only existed for legacy tokens, which are no longer supported.	3 years ago
Daniel Nephin	1344137ce2	acl: move the legacy ACL struct to the one package where it is used ... It is now only used for restoring snapshots. We can remove it in phase 2.	3 years ago
Daniel Nephin	531f2f8a3f	acl: remove most of the rest of structs/acl_legacy.go	3 years ago
Kyle Havlovitz	04cd2c983e	Add new service-exports config entry	3 years ago
Jared Kirschner	14af8cb7a9	Merge pull request #11293 from bisakhmondal/service_filter ... expression validation of service-resolver subset filter	3 years ago
R.B. Boyer	cc2abb79ba	acl: small OSS refactors to help ensure that auth methods with namespace rules work with partitions (#11323)	3 years ago
Bisakh Mondal	a350a383d3	add service resolver subset filter validation	3 years ago
tarat44	166269f93b	preload json values in structs to determine defaults	3 years ago
tarat44	ecdcfd6360	only set default on H2PingUseTLS if H2PING is set	3 years ago
tarat44	1e8e44d442	fix formatting	3 years ago
tarat44	c1ed3a9a94	change config option to H2PingUseTLS	3 years ago
tarat44	3c9f5a73d9	add support for h2c in h2 ping health checks	3 years ago
Daniel Nephin	3ac910606c	acl: remove reading of serf acl tags ... We no long need to read the acl serf tag, because servers are always either ACL enabled or ACL disabled. We continue to write the tag so that during an upgarde older servers will see the tag.	3 years ago
Daniel Nephin	8e9773e20b	acl: remove ACL.GetPolicy endpoint and resolve legacy acls ... And all code that was no longer used once those two were removed.	3 years ago
Daniel Nephin	6e1ebd3df7	acl: remove the last of the legacy FSM ... Replace it with an implementation that returns an error, and rename some symbols to use a Deprecated suffix to make it clear. Also remove the ACLRequest struct, which is no longer referenced.	3 years ago
Daniel Nephin	ed928511ca	acl: remove bootstrap-init FSM operation	3 years ago
Daniel Nephin	05f0cc3993	acl: remove ACLDelete FSM command, and state store function ... These are no longer used now that ACL.Apply has been removed.	3 years ago
Daniel Nephin	966e50e00e	acl: remove legacy field to ACLBoostrap	3 years ago
Daniel Nephin	ea4a8343cd	Merge pull request #11177 from hashicorp/dnephin/remove-entmeta-methods ... structs: remove EnterpriseMeta helper methods	3 years ago
Daniel Nephin	4c579a49ed	Merge pull request #10986 from hashicorp/dnephin/acl-legacy-remove-rpc ... acl: remove legacy ACL RPC - part 1	3 years ago
Daniel Nephin	eb632c53a2	structs: rename the last helper method. ... This one gets used a bunch, but we can rename it to make the behaviour more obvious.	3 years ago
Daniel Nephin	8d8c1f9d5e	structs: remove another helper ... We already have a helper funtion.	3 years ago
Daniel Nephin	6d72517682	structs: remove two methods that were only used once each. ... These methods only called a single function. Wrappers like this end up making code harder to read because it adds extra ways of doing things. We already have many helper functions for constructing these types, we don't need additional methods.	3 years ago
Chris S. Kim	5c37819d09	Cleanup unnecessary normalizing method (#11169)	3 years ago
Paul Banks	7b4cbe3143	Final readability tweaks from review	3 years ago
Paul Banks	07f81991df	Refactor SDS validation to make it more contained and readable	3 years ago
Paul Banks	2281d883b9	Fix some more Enterprise Normalization issues affecting tests	3 years ago
Paul Banks	659321d008	Handle namespaces in route names correctly; add tests for enterprise	3 years ago
Paul Banks	4e39f03d5b	Add ingress-gateway config for SDS	3 years ago
Daniel Nephin	e7c63004a8	acl: remove a couple legacy ACL operation constants ... structs.ACLForceSet was deprecated 4 years ago, it should be safe to remove now. ACLBootstrapNow was removed in a recent commit. While it is technically possible that a cluster with mixed version could still attempt a legacy boostrap, we documented that the legacy system was deprecated in 1.4, so no clusters that are being upgraded should be attempting a legacy boostrap.	3 years ago
Daniel Nephin	868bfc7a0a	acl: Remove unused ACLPolicyIDType	3 years ago
Daniel Nephin	aee8a9511d	Merge pull request #10985 from hashicorp/dnephin/acl-legacy-remove-replication ... acl: remove legacy ACL replication	3 years ago
R.B. Boyer	ca73abdea1	acl: fix intention:*:write checks (#11061) ... This is a partial revert of #10793	3 years ago
Freddy	fcef19f94b	acl: small resolver changes to account for partitions (#11052) ... Also refactoring the enterprise side of a test to make it easier to reason about.	3 years ago
Freddy	e18f3c1f6d	Update error texts (#11022) ... Co-authored-by: Daniel Nephin <dnephin@hashicorp.com>	3 years ago
Daniel Nephin	1f9479603c	Add failures_before_warning to checks (#10969) ... Signed-off-by: Jakub Sokołowski <jakub@status.im> * agent: add failures_before_warning setting The new setting allows users to specify the number of check failures that have to happen before a service status us updated to be `warning`. This allows for more visibility for detected issues without creating alerts and pinging administrators. Unlike the previous behavior, which caused the service status to not update until it reached the configured `failures_before_critical` setting, now Consul updates the Web UI view with the `warning` state and the output of the service check when `failures_before_warning` is breached. The default value of `FailuresBeforeWarning` is the same as the value of `FailuresBeforeCritical`, which allows for retaining the previous default behavior of not triggering a warning. When `FailuresBeforeWarning` is set to a value higher than that of `FailuresBeforeCritical it has no effect as `FailuresBeforeCritical` takes precedence. Resolves: https://github.com/hashicorp/consul/issues/10680 Signed-off-by: Jakub Sokołowski <jakub@status.im> Co-authored-by: Jakub Sokołowski <jakub@status.im>	3 years ago
Paul Banks	b38e84df63	Include namespace and partition in error messages when validating ingress header manip	3 years ago
Paul Banks	1079089f20	Refactor HTTPHeaderModifiers.MergeDefaults based on feedback	3 years ago
Paul Banks	9e4e204e96	Fix enterprise test failures caused by differences in normalizing EnterpriseMeta	3 years ago
Paul Banks	3004eadd08	Fix enterprise discovery chain tests; Fix multi-level split merging	3 years ago
Paul Banks	b5ae00d753	Remove unnecessary check	3 years ago
Paul Banks	1b9632531a	Integration tests for all new header manip features	3 years ago
Paul Banks	e22cc9c53a	Header manip for split legs plumbing	3 years ago
Paul Banks	f439dfc04f	Ingress gateway header manip plumbing	3 years ago
Paul Banks	d776a2d236	Add HTTP header manip for router and splitter entries	3 years ago
Paul Banks	46e4041283	Header manip and validation added for ingress-gateway entries	3 years ago
Chris S. Kim	9bbfa048a2	Sync enterprise changes to oss (#10994) ... This commit updates OSS with files for enterprise-specific admin partitions feature work	3 years ago
Kyle Havlovitz	a14950025a	Merge pull request #10984 from hashicorp/mesh-resource ... acl: adding a new mesh resource	3 years ago
Dhia Ayachi	bc0e4f2f46	partition dicovery chains (#10983) ... * partition dicovery chains * fix default partition for OSS	3 years ago
Daniel Nephin	f063402b29	acl: remove ACL.IsSame ... The only caller of this method was removed in a recent commit along with replication.	3 years ago
Daniel Nephin	d63cef1219	acl: remove legacy ACL replication	3 years ago
R.B. Boyer	ee372a854a	acl: adding a new mesh resource	3 years ago
Dhia Ayachi	09197c989c	add partition to SNI when partition is non default (#10917)	3 years ago
Chris S. Kim	45dcc8b553	api: expose upstream routing configurations in topology view (#10811) ... Some users are defining routing configurations that do not have associated services. This commit surfaces these configs in the topology visualization. Also fixes a minor internal bug with non-transparent proxy upstream/downstream references.	3 years ago
R.B. Boyer	a6d22efb49	acl: some acl authz refactors for nodes (#10909)	3 years ago
freddygv	85878685b7	Fixup proxy config test fixtures ... - The TestNodeService helper created services with the fixed name "web", and now that name is overridable. - The discovery chain snapshot didn't have prepared query endpoints so the endpoints tests were missing data for prepared queries	3 years ago
Dhia Ayachi	1950ebbe1f	oss portion of ent #1069 (#10883)	3 years ago
R.B. Boyer	097e1645e3	agent: ensure that most agent behavior correctly respects partition configuration (#10880)	3 years ago
R.B. Boyer	310e775a8a	state: partition nodes and coordinates in the state store (#10859) ... Additionally: - partitioned the catalog indexes appropriately for partitioning - removed a stray reference to a non-existent index named "node.checks"	3 years ago
Daniel Nephin	e637cd71f3	acl: use authz consistently as the variable name for an acl.Authorizer ... Follow up to https://github.com/hashicorp/consul/pull/10737#discussion_r682147950 Renames all variables for acl.Authorizer to use `authz`. Previously some places used `rule` which I believe was an old name carried over from the legacy ACL system. A couple places also used authorizer. This commit also removes another couple of authorizer nil checks that are no longer necessary.	3 years ago
Kyle Havlovitz	073b6c8411	oss: Rename default partition	3 years ago
Daniel Nephin	d3325b0253	Merge pull request #10612 from bigmikes/acl-replication-fix ... acl: acl replication routine to report the last error message	3 years ago
Daniel Nephin	5b2e5882b4	acl: move check for Intention.DestinationName into Authorizer ... Follow up to https://github.com/hashicorp/consul/pull/10737#discussion_r680134445 Move the check for the Intention.DestinationName into the Authorizer to remove the need to check what kind of Authorizer is being used. It sounds like this check is only for legacy ACLs, so is probably just a safeguard .	3 years ago
Daniel Nephin	9cdd823ffc	Merge pull request #10737 from hashicorp/dnephin/remove-authorizer-nil-checks ... acl: remove authz == nil checks	3 years ago
Evan Culver	710bd90ef7	checks: Add Interval and Timeout to API response (#10717)	3 years ago
Daniel Nephin	f497d5ab30	acl: remove many instances of authz == nil	3 years ago
Evan Culver	727b81a757	Fix intention endpoint test	3 years ago
Chris S. Kim	9c3af1a429	sync enterprise files with oss (#10705)	3 years ago
Chris S. Kim	91c90a672a	agent: update proxy upstreams to inherit namespace from service (#10688)	3 years ago
R.B. Boyer	96b97d6554	replumbing a bunch of api and agent structs for partitions (#10681)	3 years ago
R.B. Boyer	fc9b1a277d	sync changes to oss files made in enterprise (#10670)	3 years ago
R.B. Boyer	188e8dc51f	agent/structs: add a bunch more EnterpriseMeta helper functions to help with partitioning (#10669)	3 years ago
Evan Culver	0527dcff57	acls: Show `AuthMethodNamespace` when reading/listing ACL token meta (#10598)	3 years ago
Giulio Micheloni	814ef6b103	acl: fix error type into a string type for serialization issue ... acl_endpoint_test.go:507: Error Trace: acl_endpoint_test.go:507 retry.go:148 retry.go:149 retry.go:103 acl_endpoint_test.go:504 Error: Received unexpected error: codec.decoder: decodeValue: Cannot decode non-nil codec value into nil error (1 methods) Test: TestACLEndpoint_ReplicationStatus	3 years ago
Giulio Micheloni	529fe737ef	acl: acl replication routine to report the last error message	3 years ago
Evan Culver	13bd86527b	Add support for returning ACL secret IDs for accessors with acl:write (#10546)	3 years ago
Daniel Nephin	2c4f22a9f0	Merge pull request #10552 from hashicorp/dnephin/ca-remove-rotation-period ... ca: remove unused RotationPeriod field	3 years ago
jkirschner-hashicorp	5f73de6fbc	Merge pull request #10560 from jkirschner-hashicorp/change-sane-to-reasonable ... Replace use of 'sane' where appropriate	3 years ago
Daniel Nephin	3a045cca8d	ca: remove unused RotationPeriod field ... This field was never used. Since it is persisted as part of a map[string]interface{} it is pretty easy to remove it.	3 years ago
Jared Kirschner	bd536151e1	Replace use of 'sane' where appropriate ... HashiCorp voice, style, and language guidelines recommend avoiding ableist language unless its reference to ability is accurate in a particular use.	3 years ago
Daniel Nephin	16b21b0864	http: add an X-Consul-Query-Backend header to responses ... So that it is easier to detect and test when streaming is being used.	3 years ago
R.B. Boyer	ed8a901be7	connect: include optional partition prefixes in SPIFFE identifiers (#10507) ... NOTE: this does not include any intentions enforcement changes yet	3 years ago
R.B. Boyer	e3835ac6a1	structs: prohibit config entries from referencing more than one partition at a time (#10478) ... affected kinds: service-defaults, ingress-gateway, terminating-gateway, service-intentions	3 years ago
R.B. Boyer	8344b7fe2e	structs: prevent service-defaults upstream configs from using wildcard names or namespaces (#10475)	3 years ago
R.B. Boyer	ac50db9087	structs: add some missing config entry validation and clean up tests (#10465) ... Affects kinds: service-defaults, ingress-gateway, terminating-gateway	3 years ago
Freddy	3ee66b2e9a	Omit empty tproxy config in JSON responses (#10402)	4 years ago
Freddy	ffb13f35f1	Rename CatalogDestinationsOnly (#10397) ... CatalogDestinationsOnly is a passthrough that would enable dialing addresses outside of Consul's catalog. However, when this flag is set to true only _connect_ endpoints for services can be dialed. This flag is being renamed to signal that non-Connect endpoints can't be dialed by transparent proxies when the value is set to true.	4 years ago
Freddy	33bd9b5be8	Relax validation for expose.paths config (#10394) ... Previously we would return an error if duplicate paths were specified. This could lead to problems in cases where a user has the same path, say /healthz, on two different ports. This validation was added to signal a potential misconfiguration. Instead we will only check for duplicate listener ports, since that is what would lead to ambiguity issues when generating xDS config. In the future we could look into using a single listener and creating distinct filter chains for each path/port.	4 years ago
Freddy	429f9d8bb8	Add flag for transparent proxies to dial individual instances (#10329)	4 years ago
Daniel Nephin	ba15f92a8a	structs: fix cache keys ... So that requests are cached properly, and the cache does not return the wrong data for a request.	4 years ago
Daniel Nephin	920ae31598	structs: add two cache completeness tests types that implement cache.Request	4 years ago
Daniel Nephin	46dfdb611f	structs: improve the interface of assertCacheInfoKeyIsComplete	4 years ago
Daniel Nephin	7c2957e24d	structs: Add more cache key tests	4 years ago
Dhia Ayachi	f785c5b332	RPC Timeout/Retries account for blocking requests (#8978)	4 years ago
R.B. Boyer	597448da47	server: ensure that central service config flattening properly resets the state each time (#10239) ... The prior solution to call reply.Reset() aged poorly since newer fields were added to the reply, but not added to Reset() leading serial blocking query loops on the server to blend replies. This could manifest as a service-defaults protocol change from default=>http not reverting back to default after the config entry reponsible was deleted.	4 years ago
R.B. Boyer	7e1d7803b8	agent: ensure we hash the non-deprecated upstream fields on ServiceConfigRequest (#10240)	4 years ago
Iryna Shustava	d7d44f6ae7	Save exposed ports in agent's store and expose them via API (#10173) ... * Save exposed HTTP or GRPC ports to the agent's store * Add those the health checks API so we can retrieve them from the API * Change redirect-traffic command to also exclude those ports from inbound traffic redirection when expose.checks is set to true.	4 years ago