2053 Commits (1a853fc9546c8b92c6e8201f263f15290bb9bbde)

Author	SHA1	Message	Date
Chris Piraino	1a853fc954	Always require Host header values for http services (#7990) ... Previously, we did not require the 'service-name.*' host header value when on a single http service was exposed. However, this allows a user to get into a situation where, if they add another service to the listener, suddenly the previous service's traffic might not be routed correctly. Thus, we always require the Host header, even if there is only 1 service. Also, we add the make the default domain matching more restrictive by matching "service-name.ingress.*" by default. This lines up better with the namespace case and more accurately matches the Consul DNS value we expect people to use in this case.	5 years ago
Hans Hasselberg	c7e6c9ebec	http: use default minsize for gzip handler. (#7354) ... Fixes #6306	5 years ago
Hans Hasselberg	72f92ae7ca	agent: add option to disable agent cache for HTTP endpoints (#8023) ... This allows the operator to disable agent caching for the http endpoint. It is on by default for backwards compatibility and if disabled will ignore the url parameter `cached`.	5 years ago
Hans Hasselberg	5281cb74db	Setup intermediate_pki_path on secondary when using vault (#8001) ... Make sure to mount vault backend for intermediate_pki_path on secondary dc.	5 years ago
R.B. Boyer	9cfa4a3fc9	tests: ensure that the ServiceExists helper function normalizes entmeta (#8025) ... This fixes a unit test failure over in enterprise due to https://github.com/hashicorp/consul/pull/7384	5 years ago
R.B. Boyer	b88bd6660e	server: don't activate federation state replication or anti-entropy until all servers are running 1.8.0+ (#8014)	5 years ago
Hans Hasselberg	dfcf45c6cf	tests: use constructor instead init (#8024)	5 years ago
Pierre Souchay	9813ae512b	checks: when a service does not exists in an alias, consider it failing (#7384) ... In current implementation of Consul, check alias cannot determine if a service exists or not. Because a service without any check is semantically considered as passing, so when no healthchecks are found for an agent, the check was considered as passing. But this make little sense as the current implementation does not make any difference between: * a non-existing service (passing) * a service without any check (passing as well) In order to make it work, we have to ensure that when a check did not find any healthcheck, the service does indeed exists. If it does not, lets consider the check as failing.	5 years ago
Hans Hasselberg	0f343332da	Merge pull request #7966 from hashicorp/pool_improvements ... Agent connection pool cleanup	5 years ago
Freddy	9ed325ba8b	Enable gateways to resolve hostnames to IPv4 addresses (#7999) ... The DNS resolution will be handled by Envoy and defaults to LOGICAL_DNS. This discovery type can be overridden on a per-gateway basis with the envoy_dns_discovery_type Gateway Option. If a service contains an instance with a hostname as an address we set the Envoy cluster to use DNS as the discovery type rather than EDS. Since both mesh gateways and terminating gateways route to clusters using SNI, whenever there is a mix of hostnames and IP addresses associated with a service we use the hostname + CDS rather than the IPs + EDS. Note that we detect hostnames by attempting to parse the service instance's address as an IP. If it is not a valid IP we assume it is a hostname.	5 years ago
Matt Keeler	771c613dae	Fix legacy management tokens in unupgraded secondary dcs (#7908) ... The ACL.GetPolicy RPC endpoint was supposed to return the “parent” policy and not always the default policy. In the case of legacy management tokens the parent policy was supposed to be “manage”. The result of us not sending this properly was that operations that required specifically a management token such as saving a snapshot would not work in secondary DCs until they were upgraded.	5 years ago
Matt Keeler	0e4c65d422	Fix segfault due to race condition for checking server versions (#7957) ... The ACL monitoring routine uses c.routers to check for server version updates. Therefore it needs to be started after initializing the routers.	5 years ago
Daniel Nephin	99eb583ebc	Replace goe/verify.Values with testify/require.Equal (#7993) ... * testing: replace most goe/verify.Values with require.Equal One difference between these two comparisons is that go/verify considers nil slices/maps to be equal to empty slices/maps, where as testify/require does not, and does not appear to provide any way to enable that behaviour. Because of this difference some expected values were changed from empty slices to nil slices, and some calls to verify.Values were left. * Remove github.com/pascaldekloe/goe/verify Reduce the number of assertion packages we use from 2 to 1	5 years ago
Alvin Huang	80c34f0461	Merge pull request #7956 from hashicorp/update-master-to-1.8.0-beta2 ... Update master to 1.8.0 beta2	5 years ago
R.B. Boyer	833211c14c	acl: allow auth methods created in the primary datacenter to optionally create global tokens (#7899)	5 years ago
R.B. Boyer	ffb9c7d6f7	acl: remove the deprecated `acl_enforce_version_8` option (#7991) ... Fixes #7292	5 years ago
Jono Sosulska	c554ba9e10	Replace whitelist/blacklist terminology with allowlist/denylist (#7971) ... * Replace whitelist/blacklist terminology with allowlist/denylist	5 years ago
Hans Hasselberg	1fbc1d4777	pool: remove timeout parameter ... Timeout was never used in a meaningful way by callers, which is why it is now entirely internal to the pool.	5 years ago
Hans Hasselberg	ad03f863ff	pool: remove useTLS and ForceTLS ... In the past TLS usage was enforced with these variables, but these days this decision is made by TLSConfigurator and there is no reason to keep using the variables.	5 years ago
Hans Hasselberg	c45432014b	pool: remove version ... The version field has been used to decide which multiplexing to use. It was introduced in 2457293dce. But this is 6y ago and there is no need for this differentiation anymore.	5 years ago
hashicorp-ci	cd617dbfa9	update bindata_assetfs.go	5 years ago
hashicorp-ci	b3ca11fb0b	update bindata_assetfs.go	5 years ago
Daniel Nephin	c88fae0aac	ci: Add staticcheck and fix most errors ... Three of the checks are temporarily disabled to limit the size of the diff, and allow us to enable all the other checks in CI. In a follow up we can fix the issues reported by the other checks one at a time, and enable them.	5 years ago
Daniel Nephin	4f2bff174d	Merge pull request #7963 from hashicorp/dnephin/replace-lib-translate-keys ... Replace lib.TranslateKeys with a mapstructure decode hook	5 years ago
Daniel Nephin	6a2d7d77c0	config: use the new HookTranslateKeys instead of lib.TranslateKeys ... With the exception of CA provider config, which will be migrated at some later time.	5 years ago
Daniel Nephin	8ced4300c8	Add alias struct tags for new decode hook	5 years ago
R.B. Boyer	77f2e54618	create lib/stringslice package (#7934)	5 years ago
R.B. Boyer	ddd0a13e27	agent: handle re-bootstrapping in a secondary datacenter when WAN federation via mesh gateways is configured (#7931) ... The main fix here is to always union the `primary-gateways` list with the list of mesh gateways in the primary returned from the replicated federation states list. This will allow any replicated (incorrect) state to be supplemented with user-configured (correct) state in the config file. Eventually the game of random selection whack-a-mole will pick a winning entry and re-replicate the latest federation states from the primary. If the user-configured state is actually the incorrect one, then the same eventual correct selection process will work in that case, too. The secondary fix is actually to finish making wanfed-via-mgws actually work as originally designed. Once a secondary datacenter has replicated federation states for the primary AND managed to stand up its own local mesh gateways then all of the RPCs from a secondary to the primary SHOULD go through two sets of mesh gateways to arrive in the consul servers in the primary (one hop for the secondary datacenter's mesh gateway, and one hop through the primary datacenter's mesh gateway). This was neglected in the initial implementation. While everything works, ideally we should treat communications that go around the mesh gateways as just provided for bootstrapping purposes. Now we heuristically use the success/failure history of the federation state replicator goroutine loop to determine if our current mesh gateway route is working as intended. If it is, we try using the local gateways, and if those don't work we fall back on trying the primary via the union of the replicated state and the go-discover configuration flags. This can be improved slightly in the future by possibly initializing the gateway choice to local on startup if we already have replicated state. This PR does not address that improvement. Fixes #7339	5 years ago
Raphaël Rondeau	0d2f178b7b	connect: fix endpoints clusterName when using cluster escape hatch (#7319) ... ```changelog * fix(connect): fix endpoints clusterName when using cluster escape hatch ```	5 years ago
Pierre Souchay	d6649e42af	Stop all watches before shuting down anything dring shutdown. (#7526) ... This will prevent watches from being triggered. ```changelog * fix(agent): stop all watches before shuting down ```	5 years ago
R.B. Boyer	1b5023cb69	connect: ensure proxy-defaults protocol is used for upstreams (#7938)	5 years ago
Kyle Havlovitz	b14696e32a	Standardize support for Tagged and BindAddresses in Ingress Gateways (#7924) ... * Standardize support for Tagged and BindAddresses in Ingress Gateways This updates the TaggedAddresses and BindAddresses behavior for Ingress to match Mesh/Terminating gateways. The `consul connect envoy` command now also allows passing an address without a port for tagged/bind addresses. * Update command/connect/envoy/envoy.go Co-authored-by: Freddy <freddygv@users.noreply.github.com> * PR comments * Check to see if address is an actual IP address * Update agent/xds/listeners.go Co-authored-by: Freddy <freddygv@users.noreply.github.com> * fix whitespace Co-authored-by: Chris Piraino <cpiraino@hashicorp.com> Co-authored-by: Freddy <freddygv@users.noreply.github.com>	5 years ago
Daniel Nephin	03291943e1	Merge pull request #7933 from hashicorp/dnephin/state-txn-missing-errors ... state: fix unhandled error	5 years ago
Daniel Nephin	04bf0f3490	Update agent/consul/state/catalog.go ... Co-authored-by: Hans Hasselberg <me@hans.io>	5 years ago
Seth Hoenig	44ee818d46	grpc: use default resolver scheme for grpc dialing (#7617) ... Currently checks of type gRPC will emit log messages such as, 2020/02/12 13:48:22 [INFO] parsed scheme: "" 2020/02/12 13:48:22 [INFO] scheme "" not registered, fallback to default scheme Without adding full support for using custom gRPC schemes (maybe that's right long-term path) we can just supply the default scheme as provided by the grpc library. Fixes https://github.com/hashicorp/consul/issues/7274 and https://github.com/hashicorp/nomad/issues/7415	5 years ago
Daniel Nephin	3f607d9ef0	state: use an error to indicate compare failed ... Errors are values. We can use the error value to identify the 'comparison failed' case which makes the function easier to use and should make it harder to miss handle the error case	5 years ago
Pierre Souchay	5c7af90154	tests: added unit test to ensure watches are not re-triggered on consul reload (#7449) ... This ensures no regression about https://github.com/hashicorp/consul/issues/7318 And ensure that https://github.com/hashicorp/consul/issues/7446 cannot happen anymore	5 years ago
Pierre Souchay	e9d176db2a	Allow to restrict servers that can join a given Serf Consul cluster. (#7628) ... Based on work done in https://github.com/hashicorp/memberlist/pull/196 this allows to restrict the IP ranges that can join a given Serf cluster and be a member of the cluster. Restrictions on IPs can be done separatly using 2 new differents flags and config options to restrict IPs for LAN and WAN Serf.	5 years ago
Daniel Nephin	1bbea2751f	consul/state: refactor tnxService to avoid missed cases ... Handling errors at the end of a log switch/case block is somewhat brittle. This block included a couple cases where errors were ignored, but it was not obvious the way it was written. This change moves all error handling into each case block. There is still potentially one case where err is ignored, which will be handled in a follow up.	5 years ago
Daniel Nephin	9f27d61bee	Remove unused var ... The usage was removed in 8e22d80e35, however it seems there may be a bug here because the cluster name is not updated when the target changes.	5 years ago
Daniel Nephin	4f738b462b	Handle error from template.Execute ... Refactored the function to make the problem more obvious, by using a guard.	5 years ago
Daniel Nephin	c662f0f0de	Fix a number of problems found by staticcheck ... Some of these problems are minor (unused vars), but others are real bugs (ignored errors). Co-authored-by: Matt Keeler <mkeeler@users.noreply.github.com>	5 years ago
Daniel Nephin	5c99109dd9	Remove unused var ... The usage of this var was removed in b92f895c23. Found by using staticcheck	5 years ago
Chris Piraino	9d9e23cc44	Add service id context to the proxycfg logger ... This is especially useful when multiple proxies are all querying the same Consul agent.	5 years ago
Chris Piraino	79468793f6	Do not return an error if requested service is not a gateway ... This commit converts the previous error into just a Warn-level log message. By returning an error when the requested service was not a gateway, we did not appropriately update envoy because the cache Fetch returned an error and thus did not propagate the update through proxycfg and xds packages.	5 years ago
Aleksandr Zagaevskiy	a75e3d9051	Preserve ModifyIndex for unchanged entry in KVS TXN (#7832)	5 years ago
Pierre Souchay	cf55e81c06	tests: fix unstable test `TestAgentAntiEntropy_Checks`. (#7594) ... Example of failure: https://circleci.com/gh/hashicorp/consul/153932#tests/containers/2	5 years ago
Kit Patella	ad1d4d4d07	http: migrate from instrumentation in s.wrap() to an s.enterpriseHandler()	5 years ago
Matt Keeler	acccdbe45c	Fix identity resolution on clients and in secondary dcs (#7862) ... Previously this happened to be using the method on the Server/Client that was meant to allow the ACLResolver to locally resolve tokens. On Servers that had tokens (primary or secondary dc + token replication) this function would lookup the token from raft and return the ACLIdentity. On clients this was always a noop. We inadvertently used this function instead of creating a new one when we added logging accessor ids for permission denied RPC requests. With this commit, a new method is used for resolving the identity properly via the ACLResolver which may still resolve locally in the case of being on a server with tokens but also supports remote token resolution.	5 years ago
Chris Piraino	7a7760bfd5	Make new gateway tests compatible with enterprise (#7856)	5 years ago