20719 Commits (0fefaa649fc7b65c3975bff15f0fc635b33e26fa)

 

All Branches   

Search

Author	SHA1	Message	Date
Ashesh Vidyut	6fd33ba30d	NET-4519 Collecting journald logs in "consul debug" bundle (#18797) ... * debug since * fix docs * chagelog added * fix go mod * debug test fix * fix test * tabs test fix * Update .changelog/18797.txt Co-authored-by: Ganesh S <ganesh.seetharaman@hashicorp.com> --------- Co-authored-by: Ganesh S <ganesh.seetharaman@hashicorp.com>	1 year ago
Iryna Shustava	212793a4ee	mesh: only build tproxy outbound listener once per destination (#18836) ... Previously, when using implicit upstreams, we'd build outbound listener per destination instead of one for all destinations. This will result in port conflicts when trying to send this config to envoy. This PR also makes sure that leaf and root references are always added (before we would only add it if there are inbound non-mesh ports). Also, black-hole traffic when there are no inbound ports other than mesh	1 year ago
Chris S. Kim	91e6c3a82f	Remove flaky test assertions (#18870)	1 year ago
Semir Patel	62796a1454	resource: mutate and validate before acls on write (#18868)	1 year ago
R.B. Boyer	dabbc9627b	mesh: normalize/default/validate tenancy components of mesh internal References (#18827) ... HTTPRoute, GRPCRoute, TCPRoute, and Upstreams resources contain inner Reference fields. We want to ensure that components of those reference Tenancy fields left unspecified are defaulted using the tenancy of the enclosing resource. As the underlying helper being used to do the normalization calls the function modified in #18822, it also means that the PeerName field will be set to "local" for now automatically to avoid "local" != "" issues downstream.	1 year ago
R.B. Boyer	696aa1bbd2	mesh: update xds controller to synthesize empty endpoints when no endpoints ref is found (#18835)	1 year ago
Ronald	49cb84297f	Move ACL templated policies to hcl files (#18853)	1 year ago
Andrew Stucki	087539fc7b	Fix gateway services cleanup where proxy deregistration happens after service deregistration (#18831) ... * Fix gateway services cleanup where proxy deregistration happens after service deregistration * Add test * Add changelog * Fix comment	1 year ago
R.B. Boyer	b4d5178e5c	catalog: normalize/default/validate tenancy components of FailoverPolicy internal References (#18825) ... FailoverPolicy resources contain inner Reference fields. We want to ensure that components of those reference Tenancy fields left unspecified are defaulted using the tenancy of the enclosing FailoverPolicy resource. As the underlying helper being used to do the normalization calls the function modified in #18822, it also means that the PeerName field will be set to "local" for now automatically to avoid "local" != "" issues downstream.	1 year ago
Gautam	132c1eaa87	Adding Apigee for ext_authz, minor fix in the default ext_authz docs (#18796) ... * adding apigee for ext_authz, minor fix * adding the Apigee docs to nav * Apply suggestions from code review Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com> Co-authored-by: Blake Covarrubias <blake.covarrubias@gmail.com> * addressing feedback * Apply suggestions from code review Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com> --------- Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com> Co-authored-by: Blake Covarrubias <blake.covarrubias@gmail.com>	1 year ago
cskh	4357362973	grafana: display connected consul-dataplanes (#18842)	1 year ago
Blake Covarrubias	17901acd4f	docs: Fix typo in description for server_addresses (#18838) ... Change 'If not port' to 'If no port'. Resolves #18553	1 year ago
Dhia Ayachi	4435e4a420	add v2 tenancy bridge Flag and v2 Tenancy Bridge initial implementation (#18830) ... * add v2 tenancy bridge and a feature flag for v2 tenancy * move tenancy bridge v2 under resource package	1 year ago
Poonam Jadhav	bf4e0b1aa9	fix: provide meaningful error messages and add test (#18772) ... * fix: provide meaningful error messages and add test * fix: return error instead of warning when extra args are provided	1 year ago
Ashesh Vidyut	0018b7e5a8	Fixes for integration tests windows for ENT (#18839) ... * fixes for integration tests * fix runner size for enterprise * fix spacing * fix spacing * removed branch test run	1 year ago
Ashesh Vidyut	5d99fb7bdf	Audit log consul 1.17x changes (#18669) ... * audit log consul 1.17x changes * added some details * verbose	1 year ago
Chris S. Kim	461549e304	Adjust metrics test (#18837)	1 year ago
Iryna Shustava	a89938e0c1	catalog: Default protocol to tcp in catalog.Service if unspecified (#18832)	1 year ago
R.B. Boyer	5cde50dee7	mesh: prevent writing a ComputedRoutes with no ported configs (#18833)	1 year ago
Chris S. Kim	edf56ee970	Fix nondeterministic test (#18828)	1 year ago
skpratt	1fda2965e8	Allow empty data writes for resources (#18819) ... * allow nil data writes for resources * update demo to test valid type with no data	1 year ago
James Hartig	b2e21c103f	consul operator raft transfer-leader should send the id (#17107) ... Fixes #16955 Co-authored-by: Dhia Ayachi <dhia@hashicorp.com>	1 year ago
Ronald	aff13cd4c2	Use embedded strings for templated policies (#18829)	1 year ago
sarahalsmiller	753c8f1774	Retry and timeout test acceptance test (#18791) ... * retry and timeout test * add docker mirrior * checkpoint * add in error * add in delay * up error rate * fix status code	1 year ago
Iryna Shustava	6838441c54	Default to tcp protocol when workload protocol is unspecified (#18824)	1 year ago
trujillo-adam	850fbda2e9	added consul and envoy version constraints (#18726) ... * added consul and envoy version constraints * fixed Destination configuraiton and added tproxy requirement * Apply suggestions from code review Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com> --------- Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>	1 year ago
Eric Haberkorn	21fdbbabbc	Wire up traffic permissions (#18812) ... Wire up traffic permissions	1 year ago
Semir Patel	d3dad14030	resource: default peername to "local" for now (#18822)	1 year ago
Ronald	e24b3d9b3f	fix templated policy cli output (#18821)	1 year ago
R.B. Boyer	9c1a1ffcde	mesh: call the right mapper (#18818)	1 year ago
R.B. Boyer	66e1cdf40c	mesh: Wire ComputedRoutes into the ProxyStateTemplate via the sidecar controller (#18752) ... Reworks the sidecar controller to accept ComputedRoutes as an input and use it to generate appropriate ProxyStateTemplate resources containing L4/L7 mesh configuration.	1 year ago
Ronald	1afeb6e040	[NET-5334] Added CLI commands for templated policies (#18816)	1 year ago
Ronald	802122640b	[NET-5329] use acl templated policy under the hood for node/service identities (#18813)	1 year ago
skpratt	e5808d85f7	register traffic permission and workload identity types (#18704) ... * add workload identity and traffic permission protos * register new types * add generated pb code * fix exports.go path * add proto newlines * fix type name Co-authored-by: Eric Haberkorn <erichaberkorn@gmail.com> * address review * fix protos and add tests * fix validation constraints * add tests --------- Co-authored-by: Eric Haberkorn <erichaberkorn@gmail.com>	1 year ago
Chris S. Kim	d667cc3809	Fix flaky test (#18805)	1 year ago
Melisa Griffin	e6b3c26d5f	Removes errant word in docs that was breaking the build (#18804)	1 year ago
Melisa Griffin	8997d1a4f8	Updates gateway-class-config docs to include fields for privileged container port-mapping and Openshift Security Context Constraints ... Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>	1 year ago
Chris S. Kim	6748fac43d	Clean up resources in test (#18799)	1 year ago
Dhia Ayachi	658c27a684	add fuzz tests to resourcehcl package and fix some panics (#18798) ... * add a simple fuzz test for the resourcehcl package and fix some panics uncovered by the test * fix default for null values	1 year ago
Iryna Shustava	7f2a1d9812	catalog: service endpoints inherits protocol from service when workload doesn't have one (#18792)	1 year ago
Derek Menteer	02259ef964	Fix snapshot creation issue. (#18783) ... The renaming of files from oss -> ce caused incorrect snapshots to be created due to ce writes now happening prior to ent writes. When this happens various entities will attempt to be restored from the snapshot prior to a partition existing and will cause a panic to occur.	1 year ago
Chris S. Kim	4dfca64ded	Vault CA provider clean up previous default issuers (#18773)	1 year ago
wangxinyi7	426c906ee1	delete command ready (#18679) ... * delete command for resource management	1 year ago
Michael Zalimeni	09fffd4b1e	Disable docs change CI skip detection (#18775) ... There's currently a bug that causes CI to be skipped on all non-PR changes. Until that's fixed and we can be certain the check will fail CI or default to running tests in the case of errors, disabling this check.	1 year ago
R.B. Boyer	07f54fe3b8	resource: add helper to normalize inner Reference tenancy during mutate (#18765) ... When one resource contains an inner field that is of type *pbresource.Reference we want the Tenancy to be reasonably defaulted by the following rules: 1. The final values will be limited by the scope of the referenced type. 2. Values will be inferred from the parent's tenancy, and if that is insufficient then using the default tenancy for the type's scope. 3. Namespace will only be used from a parent if the reference and the parent share a partition, otherwise the default namespace will be used. Until we tackle peering, this hard codes an assumption of peer name being local. The logic for defaulting may need adjustment when that is addressed.	1 year ago
Eric Haberkorn	12be06f8e5	Add V2 TCP traffic permissions (#18771) ... Add support for TCP traffic permissions	1 year ago
Ashesh Vidyut	0b6efbb9c1	Windows Integration Test Changes (#18758) ... * some changes to debug * revert machines * increased timeout * added sleep 10 seconds before test start * chagne envoy version * removed sleep * revert timeout * replace position * removed date * Revert "[NET-5217] [OSS] Derive sidecar proxy locality from parent service (#18437)" This reverts commit 05604eeec1. * fix build * Revert "replace position" This reverts commit 48e6af46a8. * Revert "Revert "[NET-5217] [OSS] Derive sidecar proxy locality from parent service (#18437)"" This reverts commit d7c568e2be. * comment out api gateway http hostnames test * fix import * revert integ test run on PR	1 year ago
Chris S. Kim	d090668c37	Add workload identity ACL rules (#18769)	1 year ago
Sophie Gairo	a55c4a1c25	Test: NET-5592 - update Nomad integration testing (#18768) ... NET-5592 - update Nomad integration testing	1 year ago
Nitya Dhanushkodi	78b170ad50	xds controller: setup watches for and compute leaf cert references in ProxyStateTemplate, and wire up leaf cert manager dependency (#18756) ... * Refactors the leafcert package to not have a dependency on agent/consul and agent/cache to avoid import cycles. This way the xds controller can just import the leafcert package to use the leafcert manager. The leaf cert logic in the controller: * Sets up watches for leaf certs that are referenced in the ProxyStateTemplate (which generates the leaf certs too). * Gets the leaf cert from the leaf cert cache * Stores the leaf cert in the ProxyState that's pushed to xds * For the cert watches, this PR also uses a bimapper + a thin wrapper to map leaf cert events to related ProxyStateTemplates Since bimapper uses a resource.Reference or resource.ID to map between two resource types, I've created an internal type for a leaf certificate to use for the resource.Reference, since it's not a v2 resource. The wrapper allows mapping events to resources (as opposed to mapping resources to resources) The controller tests: Unit: Ensure that we resolve leaf cert references Lifecycle: Ensure that when the CA is updated, the leaf cert is as well Also adds a new spiffe id type, and adds workload identity and workload identity URI to leaf certs. This is so certs are generated with the new workload identity based SPIFFE id. * Pulls out some leaf cert test helpers into a helpers file so it can be used in the xds controller tests. * Wires up leaf cert manager dependency * Support getting token from proxytracker * Add workload identity spiffe id type to the authorize and sign functions --------- Co-authored-by: John Murret <john.murret@hashicorp.com>	1 year ago