Commit Graph

20521 Commits (170417ac97d80e4b622cfc4b0cdad1a1e41226cd)

Author SHA1 Message Date
Eric Haberkorn 170417ac97
Honor Default Traffic Permissions in V2 (#18886)
wire up v2 default traffic permissions
2023-09-19 10:42:32 -04:00
cskh 9b497f8c78
CI: lint test-integ (#18875)
* CI: lint test-integ

* fix lint error
2023-09-19 10:05:51 -04:00
Ashesh Vidyut 6fd33ba30d
NET-4519 Collecting journald logs in "consul debug" bundle (#18797)
* debug since

* fix docs

* chagelog added

* fix go mod

* debug test fix

* fix test

* tabs test fix

* Update .changelog/18797.txt

Co-authored-by: Ganesh S <ganesh.seetharaman@hashicorp.com>

---------

Co-authored-by: Ganesh S <ganesh.seetharaman@hashicorp.com>
2023-09-19 08:46:50 +05:30
Iryna Shustava 212793a4ee
mesh: only build tproxy outbound listener once per destination (#18836)
Previously, when using implicit upstreams, we'd build outbound listener per destination instead of one for all destinations. This will result in port conflicts when trying to send this config to envoy.

This PR also makes sure that leaf and root references are always added (before we would only add it if there are inbound non-mesh ports).

Also, black-hole traffic when there are no inbound ports other than mesh
2023-09-18 18:26:13 -06:00
Chris S. Kim 91e6c3a82f
Remove flaky test assertions (#18870) 2023-09-18 15:56:23 -07:00
Semir Patel 62796a1454
resource: mutate and validate before acls on write (#18868) 2023-09-18 17:04:29 -05:00
R.B. Boyer dabbc9627b
mesh: normalize/default/validate tenancy components of mesh internal References (#18827)
HTTPRoute, GRPCRoute, TCPRoute, and Upstreams resources contain inner
Reference fields. We want to ensure that components of those reference Tenancy
fields left unspecified are defaulted using the tenancy of the enclosing resource.

As the underlying helper being used to do the normalization calls the function
modified in #18822, it also means that the PeerName field will be set to "local" for
now automatically to avoid "local" != "" issues downstream.
2023-09-18 17:02:13 -05:00
R.B. Boyer 696aa1bbd2
mesh: update xds controller to synthesize empty endpoints when no endpoints ref is found (#18835) 2023-09-18 16:19:54 -05:00
Ronald 49cb84297f
Move ACL templated policies to hcl files (#18853) 2023-09-18 17:10:35 -04:00
Andrew Stucki 087539fc7b
Fix gateway services cleanup where proxy deregistration happens after service deregistration (#18831)
* Fix gateway services cleanup where proxy deregistration happens after service deregistration

* Add test

* Add changelog

* Fix comment
2023-09-18 16:19:17 -04:00
R.B. Boyer b4d5178e5c
catalog: normalize/default/validate tenancy components of FailoverPolicy internal References (#18825)
FailoverPolicy resources contain inner Reference fields. We want to ensure 
that components of those reference Tenancy fields left unspecified are defaulted 
using the tenancy of the enclosing FailoverPolicy resource.

As the underlying helper being used to do the normalization calls the function 
modified in #18822, it also means that the PeerName field will be set to "local" for 
now automatically to avoid "local" != "" issues downstream.
2023-09-18 14:59:08 -05:00
Gautam 132c1eaa87
Adding Apigee for ext_authz, minor fix in the default ext_authz docs (#18796)
* adding apigee for ext_authz, minor fix

* adding the Apigee docs to nav

* Apply suggestions from code review

Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>
Co-authored-by: Blake Covarrubias <blake.covarrubias@gmail.com>

* addressing feedback

* Apply suggestions from code review

Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>

---------

Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>
Co-authored-by: Blake Covarrubias <blake.covarrubias@gmail.com>
2023-09-18 11:23:11 -07:00
cskh 4357362973
grafana: display connected consul-dataplanes (#18842) 2023-09-18 13:23:02 -04:00
Blake Covarrubias 17901acd4f
docs: Fix typo in description for server_addresses (#18838)
Change 'If not port' to 'If no port'.

Resolves #18553
2023-09-18 17:14:41 +00:00
Dhia Ayachi 4435e4a420
add v2 tenancy bridge Flag and v2 Tenancy Bridge initial implementation (#18830)
* add v2 tenancy bridge and a feature flag for v2 tenancy

* move tenancy bridge v2 under resource package
2023-09-18 12:25:05 -04:00
Poonam Jadhav bf4e0b1aa9
fix: provide meaningful error messages and add test (#18772)
* fix: provide meaningful error messages and add test

* fix: return error instead of warning when extra args are provided
2023-09-18 09:09:31 -04:00
Ashesh Vidyut 0018b7e5a8
Fixes for integration tests windows for ENT (#18839)
* fixes for integration tests

* fix runner size for enterprise

* fix spacing

* fix spacing

* removed branch test run
2023-09-18 10:45:22 +05:30
Ashesh Vidyut 5d99fb7bdf
Audit log consul 1.17x changes (#18669)
* audit log consul 1.17x changes

* added some details

* verbose
2023-09-16 10:14:27 +05:30
Chris S. Kim 461549e304
Adjust metrics test (#18837) 2023-09-15 23:15:42 +00:00
Iryna Shustava a89938e0c1
catalog: Default protocol to tcp in catalog.Service if unspecified (#18832) 2023-09-15 15:11:56 -06:00
R.B. Boyer 5cde50dee7
mesh: prevent writing a ComputedRoutes with no ported configs (#18833) 2023-09-15 15:13:01 -05:00
Chris S. Kim edf56ee970
Fix nondeterministic test (#18828) 2023-09-15 15:23:49 -04:00
skpratt 1fda2965e8
Allow empty data writes for resources (#18819)
* allow nil data writes for resources

* update demo to test valid type with no data
2023-09-15 14:00:23 -05:00
James Hartig b2e21c103f
consul operator raft transfer-leader should send the id (#17107)
Fixes #16955

Co-authored-by: Dhia Ayachi <dhia@hashicorp.com>
2023-09-15 14:38:59 -04:00
Ronald aff13cd4c2
Use embedded strings for templated policies (#18829) 2023-09-15 13:49:22 -04:00
sarahalsmiller 753c8f1774
Retry and timeout test acceptance test (#18791)
* retry and timeout test

* add docker mirrior

* checkpoint

* add in error

* add in delay

* up error rate

* fix status code
2023-09-15 11:54:51 -05:00
Iryna Shustava 6838441c54
Default to tcp protocol when workload protocol is unspecified (#18824) 2023-09-15 10:39:53 -06:00
trujillo-adam 850fbda2e9
added consul and envoy version constraints (#18726)
* added consul and envoy version constraints

* fixed Destination configuraiton and added tproxy requirement

* Apply suggestions from code review

Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>

---------

Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>
2023-09-15 09:37:11 -07:00
Eric Haberkorn 21fdbbabbc
Wire up traffic permissions (#18812)
Wire up traffic permissions
2023-09-15 12:31:22 -04:00
Semir Patel d3dad14030
resource: default peername to "local" for now (#18822) 2023-09-15 09:34:18 -05:00
Ronald e24b3d9b3f
fix templated policy cli output (#18821) 2023-09-15 14:20:44 +00:00
R.B. Boyer 9c1a1ffcde
mesh: call the right mapper (#18818) 2023-09-14 22:43:05 +00:00
R.B. Boyer 66e1cdf40c
mesh: Wire ComputedRoutes into the ProxyStateTemplate via the sidecar controller (#18752)
Reworks the sidecar controller to accept ComputedRoutes as an input and use it to generate appropriate ProxyStateTemplate resources containing L4/L7 mesh configuration.
2023-09-14 17:19:04 -05:00
Ronald 1afeb6e040
[NET-5334] Added CLI commands for templated policies (#18816) 2023-09-14 20:14:55 +00:00
Ronald 802122640b
[NET-5329] use acl templated policy under the hood for node/service identities (#18813) 2023-09-14 14:36:34 -04:00
skpratt e5808d85f7
register traffic permission and workload identity types (#18704)
* add workload identity and traffic permission protos

* register new types

* add generated pb code

* fix exports.go path

* add proto newlines

* fix type name

Co-authored-by: Eric Haberkorn <erichaberkorn@gmail.com>

* address review

* fix protos and add tests

* fix validation constraints

* add tests

---------

Co-authored-by: Eric Haberkorn <erichaberkorn@gmail.com>
2023-09-14 12:40:54 -05:00
Chris S. Kim d667cc3809
Fix flaky test (#18805) 2023-09-14 16:46:47 +00:00
Melisa Griffin e6b3c26d5f
Removes errant word in docs that was breaking the build (#18804) 2023-09-14 16:37:30 +00:00
Melisa Griffin 8997d1a4f8
Updates gateway-class-config docs to include fields for privileged container port-mapping and Openshift Security Context Constraints
Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>
2023-09-14 12:08:26 -04:00
Chris S. Kim 6748fac43d
Clean up resources in test (#18799) 2023-09-14 15:33:19 +00:00
Dhia Ayachi 658c27a684
add fuzz tests to resourcehcl package and fix some panics (#18798)
* add a simple fuzz test for the resourcehcl package and fix some panics uncovered by the test

* fix default for null values
2023-09-14 10:59:33 -04:00
Iryna Shustava 7f2a1d9812
catalog: service endpoints inherits protocol from service when workload doesn't have one (#18792) 2023-09-14 08:52:12 -06:00
Derek Menteer 02259ef964
Fix snapshot creation issue. (#18783)
The renaming of files from oss -> ce caused incorrect snapshots
to be created due to ce writes now happening prior to ent writes.
When this happens various entities will attempt to be restored
from the snapshot prior to a partition existing and will cause a
panic to occur.
2023-09-13 15:35:31 -05:00
Chris S. Kim 4dfca64ded
Vault CA provider clean up previous default issuers (#18773) 2023-09-13 19:33:02 +00:00
wangxinyi7 426c906ee1
delete command ready (#18679)
* delete command for resource management
2023-09-13 11:48:40 -07:00
Michael Zalimeni 09fffd4b1e
Disable docs change CI skip detection (#18775)
There's currently a bug that causes CI to be skipped on all non-PR
changes. Until that's fixed and we can be certain the check will fail CI
or default to running tests in the case of errors, disabling this check.
2023-09-13 17:27:02 +00:00
R.B. Boyer 07f54fe3b8
resource: add helper to normalize inner Reference tenancy during mutate (#18765)
When one resource contains an inner field that is of type *pbresource.Reference we want the
Tenancy to be reasonably defaulted by the following rules:

1. The final values will be limited by the scope of the referenced type.
2. Values will be inferred from the parent's tenancy, and if that is insufficient then using
   the default tenancy for the type's scope.
3. Namespace will only be used from a parent if the reference and the parent share a
   partition, otherwise the default namespace will be used.

Until we tackle peering, this hard codes an assumption of peer name being local. The
logic for defaulting may need adjustment when that is addressed.
2023-09-13 12:08:12 -05:00
Eric Haberkorn 12be06f8e5
Add V2 TCP traffic permissions (#18771)
Add support for TCP traffic permissions
2023-09-13 09:03:42 -04:00
Ashesh Vidyut 0b6efbb9c1
Windows Integration Test Changes (#18758)
* some changes to debug

* revert machines

* increased timeout

* added sleep 10 seconds before test start

* chagne envoy version

* removed sleep

* revert timeout

* replace position

* removed date

* Revert "[NET-5217] [OSS] Derive sidecar proxy locality from parent service (#18437)"

This reverts commit 05604eeec1.

* fix build

* Revert "replace position"

This reverts commit 48e6af46a8.

* Revert "Revert "[NET-5217] [OSS] Derive sidecar proxy locality from parent service (#18437)""

This reverts commit d7c568e2be.

* comment out api gateway http hostnames test

* fix import

* revert integ test run on PR
2023-09-13 15:40:08 +05:30
Chris S. Kim d090668c37
Add workload identity ACL rules (#18769) 2023-09-12 17:22:51 -04:00