consul

Commit Graph

Author	SHA1	Message	Date
Ville Vesilehto	1e37e1318e	remove mesh from env variable name	1 year ago
Ville Vesilehto	86c599531c	Merge branch 'main' into feat/vault-token-env	1 year ago
Ville Vesilehto	0aa03f71ca	use provider specific env variable and add precedence	1 year ago
Dan Stough	da79997f3d	test: fix FIPS inline cert test message (#18076 )	1 year ago
Ville Vesilehto	977e90dfda	add missing address to runtime tests	1 year ago
Ville Vesilehto	71c358bd2c	Merge branch 'main' into feat/vault-token-env	1 year ago
Ville Vesilehto	a289bfb9ae	feat: add support for VAULT_ADDR env variable	1 year ago
Dan Stough	1b08626358	[OSS] Fix initial_fetch_timeout to wait for all xDS resources (#18024 ) * fix(connect): set initial_fetch_time to wait indefinitely * changelog * PR feedback 1	1 year ago
Fulvio	f4b08040fd	Add verify server hostname to tls default (#17155 )	1 year ago
Ville Vesilehto	ba402bbfdd	Merge branch 'main' into feat/vault-token-env	1 year ago
Ronald	ada3938115	Add first integration test for jwt auth with intention (#18005 )	1 year ago
Poonam Jadhav	8af4ad178c	feat: include nodes count in operator usage endpoint and cli command (#17939 ) * feat: update operator usage api endpoint to include nodes count * feat: update operator usange cli command to includes nodes count	1 year ago
Derek Menteer	0094dbf312	Fix incorrect protocol for transparent proxy upstreams. (#17894 ) This PR fixes a bug that was introduced in: https://github.com/hashicorp/consul/pull/16021 A user setting a protocol in proxy-defaults would cause tproxy implicit upstreams to not honor the upstream service's protocol set in its `ServiceDefaults.Protocol` field, and would instead always use the proxy-defaults value. Due to the fact that upstreams configured with "tcp" can successfully contact upstream "http" services, this issue was not recognized until recently (a proxy-defaults with "tcp" and a listening service with "http" would make successful requests, but not the opposite). As a temporary work-around, users experiencing this issue can explicitly set the protocol on the `ServiceDefaults.UpstreamConfig.Overrides`, which should take precedence. The fix in this PR removes the proxy-defaults protocol from the wildcard upstream that tproxy uses to configure implicit upstreams. When the protocol was included, it would always overwrite the value during discovery chain compilation, which was not correct. The discovery chain compiler also consumes proxy defaults to determine the protocol, so simply excluding it from the wildcard upstream config map resolves the issue.	1 year ago
Ronald	80394278b8	Expose JWKS cluster config through JWTProviderConfigEntry (#17978 ) * Expose JWKS cluster config through JWTProviderConfigEntry * fix typos, rename trustedCa to trustedCA	1 year ago
Ville Vesilehto	df3260485e	feat(connect): read vault token from env	1 year ago
Chris Thain	0b1299c28d	Remove duplicate and unused newDecodeConfigEntry func (#17979 )	1 year ago
Chris S. Kim	50a9d1b696	Remove POC code (#17974 )	1 year ago
Ashesh Vidyut	2af6bc434a	feature - [NET - 4005] - [Supportability] Reloadable Configuration - enable_debug (#17565 ) * # This is a combination of 9 commits. # This is the 1st commit message: init without tests # This is the commit message #2: change log # This is the commit message #3: fix tests # This is the commit message #4: fix tests # This is the commit message #5: added tests # This is the commit message #6: change log breaking change # This is the commit message #7: removed breaking change # This is the commit message #8: fix test # This is the commit message #9: keeping the test behaviour same * # This is a combination of 12 commits. # This is the 1st commit message: init without tests # This is the commit message #2: change log # This is the commit message #3: fix tests # This is the commit message #4: fix tests # This is the commit message #5: added tests # This is the commit message #6: change log breaking change # This is the commit message #7: removed breaking change # This is the commit message #8: fix test # This is the commit message #9: keeping the test behaviour same # This is the commit message #10: made enable debug atomic bool # This is the commit message #11: fix lint # This is the commit message #12: fix test true enable debug * parent `10f500e895` author absolutelightning <ashesh.vidyut@hashicorp.com> 1687352587 +0530 committer absolutelightning <ashesh.vidyut@hashicorp.com> 1687352592 +0530 init without tests change log fix tests fix tests added tests change log breaking change removed breaking change fix test keeping the test behaviour same made enable debug atomic bool fix lint fix test true enable debug using enable debug in agent as atomic bool test fixes fix tests fix tests added update on correct locaiton fix tests fix reloadable config enable debug fix tests fix init and acl 403 * revert commit	1 year ago
Ronald	1512ea307e	Dynamically create jwks clusters for jwt-providers (#17944 )	1 year ago
Ranjandas	1b1f33f224	Fixes Secondary ConnectCA update (#17846 ) This fixes a bug that was identified which resulted in subsequent ConnectCA configuration update not to persist in the cluster.	1 year ago
John Maguire	67a239a821	Ensure RSA keys are at least 2048 bits in length (#17911 ) * Ensure RSA keys are at least 2048 bits in length * Add changelog * update key length check for FIPS compliance * Fix no new variables error and failing to return when error exists from validating * clean up code for better readability * actually return value	1 year ago
Ronald	767ef2dd4c	Allow service identity tokens the ability to read jwt-providers (#17893 ) * Allow service identity tokens the ability to read jwt-providers * more tests * service_prefix tests	1 year ago
Alex Simenduev	33a2d90852	Fix a bug that wrongly trims domains when there is an overlap with DC name (#17160 ) * Fix a bug that wrongly trims domains when there is an overlap with DC name Before this change, when DC name and domain/alt-domain overlap, the domain name incorrectly trimmed from the query. Example: Given: datacenter = dc-test, alt-domain = test.consul. Querying for "test-node.node.dc-test.consul" will faile, because the code was trimming "test.consul" instead of just ".consul" This change, fixes the issue by adding dot (.) before trimming * trimDomain: ensure domain trimmed without modyfing original domains * update changelog --------- Co-authored-by: Dhia Ayachi <dhia@hashicorp.com>	1 year ago
Dan Upton	b117eb0126	resource: enforce consistent naming of resource types (#17611 ) For consistency, resource type names must follow these rules: - `Group` must be snake case, and in most cases a single word. - `GroupVersion` must be lowercase, start with a "v" and end with a number. - `Kind` must be pascal case. These were chosen because they map to our protobuf type naming conventions.	1 year ago
cskh	f16c5d87ab	watch: support -filter for consul watch: checks, services, nodes, service (#17780 ) * watch: support -filter for watch checks * Add filter for watch nodes, services, and service - unit test added - Add changelog - update doc	1 year ago
Chris Thain	366bd6f89f	ext-authz Envoy extension: support `localhost` as a valid target URI. (#17821 )	1 year ago
Chris S. Kim	a4653de8da	CA provider doc updates and Vault provider minor update (#17831 ) Update CA provider docs Clarify that providers can differ between primary and secondary datacenters Provide a comparison chart for consul vs vault CA providers Loosen Vault CA provider validation for RootPKIPath Update Vault CA provider documentation	1 year ago
George Bolo	82441a27fa	fixes #17732 - AccessorID in request body should be optional when updating ACL token (#17739 ) * AccessorID in request body should be optional when updating ACL token * add a test case * fix test case * add changelog entry for PR #17739	1 year ago
Eric Haberkorn	a3ba559149	Make locality aware routing xDS changes (#17826 )	1 year ago
Paul Glass	d2363eb711	Test permissive mTLS filter chain not configured with tproxy disabled (#17747 )	1 year ago
chappie	5352ccf8ed	HCP Add node id/name to config (#17750 )	1 year ago
Ronald	5f95f5f6d8	Stop referenced jwt providers from being deleted (#17755 ) * Stop referenced jwt providers from being deleted	1 year ago
Michael Zalimeni	265c003033	Add Patch index to Prop Override validation errors (#17777 ) When a patch is found invalid, include its index for easier debugging when multiple patches are provided.	1 year ago
Michael Zalimeni	f9aa7aebb3	Property Override validation improvements (#17759 ) * Reject inbound Prop Override patch with Services Services filtering is only supported for outbound TrafficDirection patches. * Improve Prop Override unexpected type validation - Guard against additional invalid parent and target types - Add specific error handling for Any fields (unsupported)	1 year ago
Derek Menteer	04edace1de	Fix issue with streaming service health watches. (#17775 ) Fix issue with streaming service health watches. This commit fixes an issue where the health streams were unaware of service export changes. Whenever an exported-services config entry is modified, it is effectively an ACL change. The bug would be triggered by the following situation: - no services are exported - an upstream watch to service X is spawned - the streaming backend filters out data for service X (due to lack of exports) - service X is finally exported In the situation above, the streaming backend does not trigger a refresh of its data. This means that any events that were supposed to have been received prior to the export are NOT backfilled, and the watches never see service X spawning. We currently have decided to not trigger a stream refresh in this situation due to the potential for a thundering herd effect (touching exports would cause a re-fetch of all watches for that partition, potentially). Therefore, a local blocking-query approach was added by this commit for agentless. It's also worth noting that the streaming subscription is currently bypassed most of the time with agentful, because proxycfg has a `req.Source.Node != ""` which prevents the `streamingEnabled` check from passing. This means that while agents should technically have this same issue, they don't experience it with mesh health watches. Note that this is a temporary fix that solves the issue for proxycfg, but not service-discovery use cases.	1 year ago
Eric Haberkorn	0994ccf162	validate localities on agent configs and registration endpoints (#17712 )	1 year ago
chappie	7ab287c1d5	Add truncation to body (#17723 )	1 year ago
Chris Thain	9289e680d6	OSS merge: Update error handling login when applying extensions (#17740 )	1 year ago
Ashesh Vidyut	fa40654885	[NET-3865] [Supportability] Additional Information in the output of 'consul operator raft list-peers' (#17582 ) * init * fix tests * added -detailed in docs * added change log * fix doc * checking for entry in map * fix tests * removed detailed flag * removed detailed flag * revert unwanted changes * removed unwanted changes * updated change log * pr review comment changes * pr comment changes single API instead of two * fix change log * fix tests * fix tests * fix test operator raft endpoint test * Update .changelog/17582.txt Co-authored-by: Semir Patel <semir.patel@hashicorp.com> * nits * updated docs --------- Co-authored-by: Semir Patel <semir.patel@hashicorp.com>	1 year ago
R.B. Boyer	72f991d8d3	agent: remove agent cache dependency from service mesh leaf certificate management (#17075 ) * agent: remove agent cache dependency from service mesh leaf certificate management This extracts the leaf cert management from within the agent cache. This code was produced by the following process: 1. All tests in agent/cache, agent/cache-types, agent/auto-config, agent/consul/servercert were run at each stage. - The tests in agent matching .Leaf were run at each stage. - The tests in agent/leafcert were run at each stage after they existed. 2. The former leaf cert Fetch implementation was extracted into a new package behind a "fake RPC" endpoint to make it look almost like all other cache type internals. 3. The old cache type was shimmed to use the fake RPC endpoint and generally cleaned up. 4. I selectively duplicated all of Get/Notify/NotifyCallback/Prepopulate from the agent/cache.Cache implementation over into the new package. This was renamed as leafcert.Manager. - Code that was irrelevant to the leaf cert type was deleted (inlining blocking=true, refresh=false) 5. Everything that used the leaf cert cache type (including proxycfg stuff) was shifted to use the leafcert.Manager instead. 6. agent/cache-types tests were moved and gently replumbed to execute as-is against a leafcert.Manager. 7. Inspired by some of the locking changes from derek's branch I split the fat lock into N+1 locks. 8. The waiter chan struct{} was eventually replaced with a singleflight.Group around cache updates, which was likely the biggest net structural change. 9. The awkward two layers or logic produced as a byproduct of marrying the agent cache management code with the leaf cert type code was slowly coalesced and flattened to remove confusion. 10. The .Leaf tests from the agent package were copied and made to work directly against a leafcert.Manager to increase direct coverage. I have done a best effort attempt to port the previous leaf-cert cache type's tests over in spirit, as well as to take the e2e-ish tests in the agent package with Leaf in the test name and copy those into the agent/leafcert package to get more direct coverage, rather than coverage tangled up in the agent logic. There is no net-new test coverage, just coverage that was pushed around from elsewhere.	1 year ago
Eric Haberkorn	0a1efe73f3	Refactor disco chain prioritize by locality structs (#17696 ) This includes prioritize by localities on disco chain targets rather than resolvers, allowing different targets within the same partition to have different policies.	1 year ago
Dan Stough	bba5cd8455	fix: stop peering delete routine on leader loss (#17483 )	1 year ago
Chris Thain	a8f1350835	ENT merge of ext-authz extension updates (#17684 )	1 year ago
Chris Thain	c04c122ef3	Default `ProxyType` for builtin extensions (#17657 )	1 year ago
Nathan Coleman	1074252361	api-gateway: stop adding all header filters to virtual host when generating xDS (#17644 ) * Add header filter to api-gateway xDS golden test * Stop adding all header filters to virtual host when generating xDS for api-gateway * Regenerate xDS golden file for api-gateway w/ header filter	1 year ago
Matt Keeler	baaf6d84c7	Add generic experiments configuration and use it to enable catalog v2 resources (#17604 ) * Add generic experiments configuration and use it to enable catalog v2 resources * Run formatting with -s as CI will validate that this has been done	1 year ago
R.B. Boyer	ec347ef01d	sort some imports that are wonky between oss and ent (#17637 )	1 year ago
Andrew Stucki	3cb70566a9	[API Gateway] Fix rate limiting for API gateways (#17631 ) * [API Gateway] Fix rate limiting for API gateways * Add changelog * Fix failing unit tests * Fix operator usage tests for api package	1 year ago
Andrew Stucki	9a4f503b2b	[API Gateway] Fix trust domain for external peered services in synthesis code (#17609 ) * [API Gateway] Fix trust domain for external peered services in synthesis code * Add changelog	1 year ago
Eric Haberkorn	779647b948	Add Envoy and Consul version constraints to Envoy extensions (#17612 )	1 year ago

1 2 3 4 5 ...

5155 Commits (1e37e1318eb670a995fff64648107fb65c908a12)