21245 Commits (223714bdea9c8760f2007a7e7e1b697b61338a75)

 

All Branches   

Search

Author	SHA1	Message	Date
Anita Akaeze	6ffcf28df0	enable verify envoy script (#19303)	1 year ago
Nitya Dhanushkodi	def66ddf0e	mesh: provide missing domain to route configurations in ProxyStateTemplate (#19298) ... * add empty domains * update unit tests	1 year ago
Chris Thain	681aef31e9	Update supported Envoy versions (#19276)	1 year ago
Anita Akaeze	ef27bc2fd6	NET-6239: Temporarily disable verify envoy check (#19299) ... * skip verify envoy version * cleanup	1 year ago
Iryna Shustava	dfea3a0efe	acls,catalog,mesh: properly authorize workload selectors on writes (#19260) ... To properly enforce writes on resources that have workload selectors with prefixes, we need another service authorization rule that allows us to check whether read is allowed within a given prefix. Specifically we need to only allow writes if the policy prefix allows for a wider set of names than the prefix selector on the resource. We should also not allow policies with exact names for prefix matches. Part of [NET-3993]	1 year ago
trujillo-adam	e5a49bf56f	reformatted the JSON schema server conf ref (#19288)	1 year ago
Poonam Jadhav	2bd38d8806	fix: allow snake case keys for ip based rate limit config entry (#19277) ... * fix: allow snake case keys for ip based rate limit config entry * chore: add changelog	1 year ago
Michael Zalimeni	5e517c5980	[NET-6221] Ensure LB policy set for locality-aware routing (CE) (#19283) ... Ensure LB policy set for locality-aware routing (CE) `overprovisioningFactor` should be overridden with the expected value (100,000) when there are multiple endpoint groups. Update code and tests to enforce this. This is an Enterprise feature. This commit represents the CE portions of the change; tests are added in the corresponding `consul-enterprise` change.	1 year ago
cskh	d52ee6a222	fix nightly integration test: envoy version and n-2 version (#19286)	1 year ago
Dan Stough	a94c013c8d	build(docker): always publish full and minor version tags for dev images (#19278)	1 year ago
Eric Haberkorn	f45be222bb	Prevent circular dependencies between v2 resources and generate a mermaid diagram with their dependencies (#19230)	1 year ago
David Yu	16f0a24ff5	docs: Fix multi-port install (#19262) ... * Update configure.mdx Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>	1 year ago
Jeff Boruszak	c4d6d4d307	docs: Multiport HCP constraint update (#19261) ... * Add sentence * link text adjustment	1 year ago
Nitya Dhanushkodi	51b58cd910	fix expose paths (#19257) ... When testing adding http probes to apps, I ran into some issues which I fixed here: - The listener should be listening on the exposed listener port, updated that. - The listener and route names were pointing to the path of the exposed path. In my test, the path was "/" resulting in an empty string path. Also, the path may not be unique across exposed path listeners, so I decided to use the path+exposed port as the unique identifier.	1 year ago
Dan Stough	9b719e6dec	test: add 1.17 nightly integrations test (#19253)	1 year ago
Blake Covarrubias	9976e08505	docs: Fix example control-plane-request-limit HCL and JSON (#19105) ... The control-plane-request-limit config entry does not support specifying parameter names in snake case format. This commit updates the HCL and JSON examples to use the supported camel case key format.	1 year ago
Sophie Gairo	61bd08c8b9	Net 4893- Ensure we're testing all the latest versions of Vault/Nomad (#19119) ... * NET-5592 - update Nomad integration testing * NET-4893: Ensure we're testing all the latest versions of Vault/Nomad	1 year ago
John Maguire	b78465b491	[NET-5810] CE changes for multiple virtual hosts (#19246) ... CE changes for multiple virtual hosts	1 year ago
Chris Hut	a6c990c6fe	Cc 5545: Upgrade HDS packages and modifiers (#19226) ... * Upgrade @hashicorp/design-system-tokens to 1.9.0 * Upgrade @hashicorp/design-system-components to 1.8.1 * Upgrade @hashicorp/design-system-components and ember-in-viewport * Explicitly install ember-modifier@4.1.0 * rename copy-button * Fix how cleanup is done in with-copyable * Update aria-menu modifier for new structure * Update css-prop modifier to new structure * Convert did-upsert to regular class modifier * Update notification modifier for new structure * Update on-oustside modifier for new structure * Move destroy handler registration in with-copyable * Update style modifier for new structure * Update validate modifier for new structure * Guard against setting on destroyed object * Upgrade @hashicorp/design-system-components to 2.14.1 * Remove debugger * Guard against null in aria-menu * Fix undefined hash in validate addon * Upgrade ember-on-resize-modifier * Fix copy button import, missing import and array destructuring --------- Co-authored-by: wenincode <tyler.wendlandt@hashicorp.com>	1 year ago
John Murret	9f4f99c626	NET-6097 - sidecar proxy controller - give name to first failover policy target (#19239)	1 year ago
Michael Zalimeni	8eb074e7c1	[NET-5944] security: Update Go version to 1.20.10 and `x/net` to 0.17.0 (#19225) ... * Bump golang.org/x/net to 0.17.0 This resolves [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) / [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487). * Update Go version to 1.20.10 This resolves [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) / [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) (`net/http`).	1 year ago
Semir Patel	4c5a46e5e1	v2tenancy: rename v1alpha1 -> v2beta1 (#19227)	1 year ago
David Yu	b81c8627db	Add reason why port 53 is not used by default (#19222) ... * Update dns-configuration.mdx * Update website/content/docs/services/discovery/dns-configuration.mdx Co-authored-by: Tu Nguyen <im2nguyen@users.noreply.github.com>	1 year ago
Jeff Boruszak	dcd593004e	docs: Multi-port corrections (#19224) ... * typo fixes and instruction corrections * typo * link path correction	1 year ago
R.B. Boyer	6741392a4f	catalog: add FailoverPolicy ACL hook tenancy test (#19179)	1 year ago
R.B. Boyer	df8ea430c6	mesh: add DestinationPolicy ACL hook tenancy tests (#19178) ... Enhance the DestinationPolicy ACL hook tests to cover tenanted situations. These tests will only execute in enterprise.	1 year ago
Semir Patel	ad177698f7	resource: enforce lowercase v2 resource names (#19218)	1 year ago
R.B. Boyer	6c7d0759e4	mesh: add xRoute ACL hook tenancy tests (#19177) ... Enhance the xRoute ACL hook tests to cover tenanted situations. These tests will only execute in enterprise.	1 year ago
modrake	3716b69792	Relplat 897 copywrite bot workarounds (#19200) ... Co-authored-by: Ronald Ekambi <ronekambi@gmail.com>	1 year ago
John Murret	a7fbd00865	NET-5073 - ProxyConfiguration: implement various connection options (#19187) ... * NET-5073 - ProxyConfiguration: implement various connection options * PR feedback - LocalConnection and InboundConnection do not affect exposed routes. configure L7 route destinations. fix connection proto sequence numbers. * add timeout to L7 Route Destinations	1 year ago
Iryna Shustava	105ebfdd00	catalog, mesh: implement missing ACL hooks (#19143) ... This change adds ACL hooks to the remaining catalog and mesh resources, excluding any computed ones. Those will for now continue using the default operator:x permissions. It refactors a lot of the common testing functions so that they can be re-used between resources. There are also some types that we don't yet support (e.g. virtual IPs) that this change adds ACL hooks to for future-proofing.	1 year ago
Iryna Shustava	2ea33e9b86	mesh: add more validations to Destinations resource (#19202)	1 year ago
Iryna Shustava	e94d6ceca6	mesh: add validation hook to proxy configuration (#19186)	1 year ago
Michael Zalimeni	9b0f4b7fc5	chore: update version and nightly CI for 1.17 (#19208) ... Update version file to 1.18-dev, and replace 1.13 nightly test with 1.17.	1 year ago
Ashwin Venkatesh	3d1a606c3b	Clone proto into deepcopy correctly (#19204)	1 year ago
R.B. Boyer	20d1fb8c78	server: run the api checks against the path without params (#19205)	1 year ago
R.B. Boyer	99f7a1219e	catalog: add metadata filtering to refine workload selectors (#19198) ... This implements the Filter field on pbcatalog.WorkloadSelector to be a post-fetch in-memory filter using the https://github.com/hashicorp/go-bexpr expression language to filter resources based on their envelope metadata fields. All existing usages of WorkloadSelector should be able to make use of the filter.	1 year ago
R.B. Boyer	f0e4897736	mesh: ensure that xRoutes have ParentRefs that have matching Tenancy to the enclosing resource (#19176) ... We don't want an xRoute controlling traffic for a Service in another tenancy.	1 year ago
Dhia Ayachi	5fbf0c00d3	Add namespace read write tests (#19173)	1 year ago
Thomas Eckert	76c60fdfac	Golden File Tests for TermGW w/ Cluster Peering (#19096) ... Add intention to create golden file for terminating gateway peered trust bundle	1 year ago
Ashwin Venkatesh	c2a0d4f9ca	Create DeepCopy() and Json Marshal/Unmarshal for proto-public (#19015) ... * Override Marshal/UnmarshalJSON for proto-public types * Generate Deepcopy() for proto-public types for Kubernetes CRDs.	1 year ago
Poonam Jadhav	a50a9e984a	Net-5771/apply command stdin input (#19084) ... * feat: apply command now accepts input from stdin * feat: accept first positional non-flag file path arg * fix: detect hcl format	1 year ago
Nitya Dhanushkodi	95d9b2c7e4	[NET-4931] xdsv2, sidecarproxycontroller, l4 trafficpermissions: support L7 (#19185) ... * xdsv2: support l7 by adding xfcc policy/headers, tweaking routes, and make a bunch of listeners l7 tests pass * sidecarproxycontroller: add l7 local app support * trafficpermissions: make l4 traffic permissions work on l7 workloads * rename route name field for consistency with l4 cluster name field * resolve conflicts and rebase * fix: ensure route name is used in l7 destination route name as well. previously it was only in the route names themselves, now the route name and l7 destination route name line up	1 year ago
Iryna Shustava	e3cb4ec35e	mesh: properly handle missing workload protocols (#19172) ... Sometimes workloads could come with unspecified protocols such as when running on Kubernetes. Currently, if this is the case, we will just default to tcp protocol. However, to make sidecar-proxy controller work with l7 protocols we should instead inherit the protocol from service. This change adds tracking for services that a workload is part of and attempts to inherit the protocol whenever services a workload is part of doesn't have conflicting protocols.	1 year ago
Iryna Shustava	a39eec0ef4	mesh: fix race in the sidecar-proxy controller test (#19183)	1 year ago
John Murret	dbca544d25	NET-5951 - Unique route names for implicit routes (#19174) ... * NET-5951 - Unique route names for implicit routes * remove use of datacenter * PR feedback	1 year ago
Derek Menteer	9500711881	Add 1.17 upgrade-specific note for upstream normalization. (#19181) ... Add 1.17 upgrade-specific note for upstream normalization. Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>	1 year ago
trujillo-adam	67393b543b	Update metdata for locality-aware usage page (#19180)	1 year ago
Iryna Shustava	25283f0ec2	get-envoy-bootstrap-params: when v2 is enabled, use computed proxy configuration (#19175)	1 year ago
Iryna Shustava	54a12ab3c9	mesh: sidecar proxy controller improvements (#19083) ... This change builds on #19043 and #19067 and updates the sidecar controller to use those computed resources. This achieves several benefits: * The cache is now simplified which helps us solve for previous bugs (such as multiple Upstreams/Destinations targeting the same service would overwrite each other) * We no longer need proxy config cache * We no longer need to do merging of proxy configs as part of the controller logic * Controller watches are simplified because we no longer need to have complex mapping using cache and can instead use the simple ReplaceType mapper. It also makes several other improvements/refactors: * Unifies all caches into one. This is because originally the caches were more independent, however, now that they need to interact with each other it made sense to unify them where sidecar proxy controller uses one cache with 3 bimappers * Unifies cache and mappers. Mapper already needed all caches anyway and so it made sense to make the cache do the mapping also now that the cache is unified. * Gets rid of service endpoints watches. This was needed to get updates in a case when service's identities have changed and we need to update proxy state template's spiffe IDs for those destinations. This will however generate a lot of reconcile requests for this controller as service endpoints objects can change a lot because they contain workload's health status. This is solved by adding a status to the service object tracking "bound identities" and have service endpoints controller update it. Having service's status updated allows us to get updates in the sidecar proxy controller because it's already watching service objects * Add a watch for workloads. We need it so that we get updates if workload's ports change. This also ensures that we update cached identities in case workload's identity changes.	1 year ago