17950 Commits (2274f35c89ceb6001542da5b94551981a51cd1f8)

 

All Branches   

Search

Author	SHA1	Message	Date
Daniel Upton	ccc672013e	proxycfg-glue: server-local implementation of `GatewayServices` ... This is the OSS portion of enterprise PR 2259. This PR provides a server-local implementation of the proxycfg.GatewayServices interface based on blocking queries.	2 years ago
Daniel Upton	15a319dbfe	proxycfg-glue: server-local implementation of `TrustBundle` and `TrustBundleList` ... This is the OSS portion of enterprise PR 2250. This PR provides server-local implementations of the proxycfg.TrustBundle and proxycfg.TrustBundleList interfaces, based on local blocking queries.	2 years ago
Daniel Upton	673d02d30f	proxycfg-glue: server-local implementation of the `Health` interface ... This is the OSS portion of enterprise PR 2249. This PR introduces an implementation of the proxycfg.Health interface based on a local materialized view of the health events. It reuses the view and request machinery from agent/rpcclient/health, which made it super straightforward.	2 years ago
Daniel Upton	3c533ceea8	proxycfg-glue: server-local implementation of `ServiceList` ... This is the OSS portion of enterprise PR 2242. This PR introduces a server-local implementation of the proxycfg.ServiceList interface, backed by streaming events and a local materializer.	2 years ago
Daniel Upton	fbf88d3b19	proxycfg-glue: server-local compiled discovery chain data source ... This is the OSS portion of enterprise PR 2236. Adds a local blocking query-based implementation of the proxycfg.CompiledDiscoveryChain interface.	2 years ago
Jared Kirschner	6d047c453a	Merge pull request #13655 from hashicorp/docs/add-envoy-to-standard-upgrade-instructions ... docs: add Envoy upgrade step to std upgrade docs	2 years ago
Jared Kirschner	23d556e9ea	docs: add Envoy upgrade step to std upgrade docs	2 years ago
John Cowen	68e79b8180	ui: Add additional API requests for peering establishment (#13734)	2 years ago
John Cowen	f6edc37d0c	ui: Move peers to a subapplication (#13725)	2 years ago
John Cowen	610038ce67	ui: Thread through data-source invalidate method (#13710) ... * ui: Thread through data-source invalidate method * Remove old invalidating state	2 years ago
John Cowen	96d11465b9	ui: Make our old TabNav component easily usable with a state machine (#13705) ... * ui: Make our old TabNav component easily usable with a state machine * Add an event handler that receives an object	2 years ago
Evan Culver	aea0d6f6bf	Add changelog entries from latest releases (#13746)	2 years ago
Chris S. Kim	f56810132f	Check if an upstream is implicit from either intentions or peered services	2 years ago
Chris S. Kim	02cff2394d	Use new maps for proxycfg peered data	2 years ago
Chris S. Kim	7f32cba735	Add new watch.Map type to refactor proxycfg	2 years ago
Chris S. Kim	b4ffa9ae0c	Scrub VirtualIPs before exporting	2 years ago
Kyle Havlovitz	9097e2b0f0	Merge pull request #13699 from hashicorp/tgate-http2-upstream ... Respect http2 protocol for upstreams of terminating gateways	2 years ago
R.B. Boyer	f1cc185335	proto: add package prefixes for all proto files where it is safe (#13735) ... We cannot do this for "subscribe" and "partition" this easily without breakage so those are omitted. Any protobuf message passed around via an Any construct will have the fully qualified package name embedded in the protobuf as a string. Also RPC method dispatch will include the package of the service during serialization. - We will be passing pbservice and pbpeering through an Any as part of peer stream replication. - We will be exposing two new gRPC services via pbpeering and pbpeerstream.	2 years ago
Dan Upton	b9e525d689	grpc: rename public/private directories to external/internal (#13721) ... Previously, public referred to gRPC services that are both exposed on the dedicated gRPC port and have their definitions in the proto-public directory (so were considered usable by 3rd parties). Whereas private referred to services on the multiplexed server port that are only usable by agents and other servers. Now, we're splitting these definitions, such that external/internal refers to the port and public/private refers to whether they can be used by 3rd parties. This is necessary because the peering replication API needs to be exposed on the dedicated port, but is not (yet) suitable for use by 3rd parties.	2 years ago
R.B. Boyer	30fffd0c90	peerstream: some cosmetic refactors to make this easier to follow (#13732) ... - Use some protobuf construction helper methods for brevity. - Rename a local variable to avoid later shadowing. - Rename the Nonce field to be more like xDS's naming. - Be more explicit about which PeerID fields are empty.	2 years ago
John Cowen	6fa68a5b57	ui: Remove UNDEFINED state from being undeleteable (#13702) ... * ui: Remove UNDEFINED state from being undeleteable * Fixup node tests	2 years ago
John Cowen	6b67b74a19	ui: Remove horizontal scrollbar from peering list rows (#13701)	2 years ago
Kyle Havlovitz	7d0c692374	Use protocol from resolved config entry, not gateway service	2 years ago
Kyle Havlovitz	7162e3bde2	Enable http2 options for grpc protocol	2 years ago
R.B. Boyer	c5c216008d	peering: always send the mesh gateway SpiffeID even for tcp services (#13728) ... If someone were to switch a peer-exported service from L4 to L7 there would be a brief SAN validation hiccup as traffic shifted to the mesh gateway for termination. This PR sends the mesh gateway SpiffeID down all the time so the clients always expect a switch.	2 years ago
R.B. Boyer	f0e6e4e697	state: prohibit changing an exported tcp discovery chain in a way that would break SAN validation (#13727) ... For L4/tcp exported services the mesh gateways will not be terminating TLS. A caller in one peer will be directly establishing TLS connections to the ultimate exported service in the other peer. The caller will be doing SAN validation using the replicated SpiffeID values shipped from the exporting side. There are a class of discovery chain edits that could be done on the exporting side that would cause the introduction of a new SpiffeID value. In between the time of the config entry update on the exporting side and the importing side getting updated peer stream data requests to the exported service would fail due to SAN validation errors. This is unacceptable so instead prohibit the exporting peer from making changes that would break peering in this way.	2 years ago
R.B. Boyer	2317f37b4d	state: prohibit exported discovery chains to have cross-datacenter or cross-partition references (#13726) ... Because peerings are pairwise, between two tuples of (datacenter, partition) having any exported reference via a discovery chain that crosses out of the peered datacenter or partition will ultimately not be able to work for various reasons. The biggest one is that there is no way in the ultimate destination to configure an intention that can allow an external SpiffeID to access a service. This PR ensures that a user simply cannot do this, so they won't run into weird situations like this.	2 years ago
Michael Klein	75768a2039	ui: peer permission handling (#13724) ... * Request peering permissions when peerings is active * Update peering ability to use peering resource * fix canDelete peer permission to check write permission * use super call in abilities.peer#canDelete	2 years ago
Chris S. Kim	a6634db4a5	Return error if ServerAddresses is empty (#13714)	2 years ago
Michael Klein	123047d5b5	ui: use environment variable for feature flagging peers (#13703) ... * ui: use environment variable for feature flagging peers * Add documentation for `features`-service * Allow setting feature flag for peers via bookmarklet * don't use features service for flagging peers * add ability for checking if peers feature is enabled * Use abilities to conditionally use peers feature * Remove unused features service	2 years ago
Michael Wilkerson	dadc18c294	update docs (#13711) ... * update docs * Update website/content/docs/nia/enterprise/index.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>	2 years ago
R.B. Boyer	9a56eed86c	proto: ensure buf formatter has been applied to protobufs (#13709)	2 years ago
Jeff Boruszak	42b049726f	Merge pull request #13693 from hashicorp/docs-cluster-peering-updates ... docs: Cluster Peering docs fixes	2 years ago
Nathan Coleman	4da7e04a4d	Merge pull request #13681 from hashicorp/docs/install-capigw-version-env-var ... docs(consul-api-gateway): use VERSION env var in install steps	2 years ago
Nathan Coleman	6938ce4b39	Update website/content/docs/api-gateway/consul-api-gateway-install.mdx	2 years ago
cskh	cf6b6dddaf	feat(cli): enable to delete config entry from an input file (#13677) ... * feat(cli): enable to delete config entry from an input file - A new flag to config delete to delete a config entry in a valid config file, e.g., config delete -filename intention-allow.hcl - Updated flag validation; -filename and -kind can't be set at the same time - Move decode config entry method from config_write.go to helpers.go for reusing ParseConfigEntry() - add changelog Co-authored-by: Dan Upton <daniel@floppy.co>	2 years ago
Kyle Havlovitz	e68487f254	Merge pull request #13678 from hashicorp/envoy-prometheus-tls-fix ... Fix syntax for envoy bootstrap prometheus secret config	2 years ago
Kyle Havlovitz	608d0fe2c1	Add changelog note	2 years ago
Kyle Havlovitz	439eccdd80	Respect http2 protocol for upstreams of terminating gateways	2 years ago
R.B. Boyer	af04851637	peering: move peer replication to the external gRPC port (#13698) ... Peer replication is intended to be between separate Consul installs and effectively should be considered "external". This PR moves the peer stream replication bidirectional RPC endpoint to the external gRPC server and ensures that things continue to function.	2 years ago
Mike Morris	8f74cb52f3	Update website/content/docs/api-gateway/consul-api-gateway-install.mdx ... Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>	2 years ago
Mike Morris	66fdf29d42	Update website/content/docs/api-gateway/consul-api-gateway-install.mdx ... Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>	2 years ago
boruszak	9ba349de8c	Clarification around "peering_token.json" and adding Partition names	2 years ago
Chris Thain	3766870719	Docs: Fix path to consul-ecs Terraform modules (#13689)	2 years ago
R.B. Boyer	ea58f235f5	server: broadcast the public grpc port using lan serf and update the consul service in the catalog with the same data (#13687) ... Currently servers exchange information about their WAN serf port and RPC port with serf tags, so that they all learn of each other's addressing information. We intend to make larger use of the new public-facing gRPC port exposed on all of the servers, so this PR addresses that by passing around the gRPC port via serf tags and then ensuring the generated consul service in the catalog has metadata about that new port as well for ease of non-serf-based lookup.	2 years ago
John Cowen	70274865a0	ui: Peer Deletion (#13665) ... * ui: Peer Deletion (#13665) * ui: Add sorting peer listing by State (#13684) * ui: Add filtering peer listing by State (#13685)	2 years ago
John Cowen	2dc949f17d	ui: CopyableCode component (#13686) ... * ui: CopyableCode component plus switch into existing implementations	2 years ago
boruszak	759f5a2bf5	"<service-name" fix - added brackets	2 years ago
Mike Morris	ccb2ee48e0	docs(consul-api-gateway): use VERSION env var in install steps	2 years ago
Usha Kodali	f332fa8f86	Consul on ECS compatibility matrix docs update (#13060)	2 years ago