1956 Commits (247f9eaf13f787738cabf91b460a68f748639885)

Author	SHA1	Message	Date
Kyle Havlovitz	247f9eaf13	Allow ingress gateways to route traffic based on Host header ... This commit adds the necessary changes to allow an ingress gateway to route traffic from a single defined port to multiple different upstream services in the Consul mesh. To do this, we now require all HTTP requests coming into the ingress gateway to specify a Host header that matches "<service-name>.*" in order to correctly route traffic to the correct service. - Differentiate multiple listener's route names by port - Adds a case in xds for allowing default discovery chains to create a route configuration when on an ingress gateway. This allows default services to easily use host header routing - ingress-gateways have a single route config for each listener that utilizes domain matching to route to different services.	5 years ago
R.B. Boyer	a854e4d9c5	acl: oss plumbing to support auth method namespace rules in enterprise (#7794) ... This includes website docs updates.	5 years ago
R.B. Boyer	3242d0816d	test: make the kube auth method test helper use freeport (#7788)	5 years ago
Hans Hasselberg	096a2f2f02	network_segments: stop advertising segment tags	5 years ago
Hans Hasselberg	995a24b8e4	agent: refactor to use a single addrFn	5 years ago
Hans Hasselberg	6994c0d47f	agent: rename local/global to src/dst	5 years ago
Chris Piraino	69b44fb942	Construct a default destination if one does not exist for service-router (#7783)	5 years ago
R.B. Boyer	22eb016153	acl: add MaxTokenTTL field to auth methods (#7779) ... When set to a non zero value it will limit the ExpirationTime of all tokens created via the auth method.	5 years ago
R.B. Boyer	ca52ba7068	acl: add DisplayName field to auth methods (#7769) ... Also add a few missing acl fields in the api.	5 years ago
Hans Hasselberg	c4093c87cc	agent: don't let left nodes hold onto their node-id (#7747)	5 years ago
Matt Keeler	daec810e34	Merge pull request #7714 from hashicorp/oss-sync/msp-agent-token	5 years ago
Matt Keeler	cbe3a70f56	Update enterprise configurations to be in OSS ... This will emit warnings about the configs not doing anything but still allow them to be parsed. This also added the warnings for enterprise fields that we already had in OSS but didn’t change their enforcement behavior. For example, attempting to use a network segment will cause a hard error in OSS.	5 years ago
R.B. Boyer	9533451a63	acl: refactor the authmethod.Validator interface (#7760) ... This is a collection of refactors that make upcoming PRs easier to digest. The main change is the introduction of the authmethod.Identity struct. In the one and only current auth method (type=kubernetes) all of the trusted identity attributes are both selectable and projectable, so they were just passed around as a map[string]string. When namespaces were added, this was slightly changed so that the enterprise metadata can also come back from the login operation, so login now returned two fields. Now with some upcoming auth methods it won't be true that all identity attributes will be both selectable and projectable, so rather than update the login function to return 3 pieces of data it seemed worth it to wrap those fields up and give them a proper name.	5 years ago
R.B. Boyer	54ba8e3868	acl: change authmethod.Validator to take a logger (#7758)	5 years ago
R.B. Boyer	8927b54121	test: move some test helpers over from enterprise (#7754)	5 years ago
R.B. Boyer	b282268408	sdk: extracting testutil.RequireErrorContains from various places it was duplicated (#7753)	5 years ago
Hans Hasselberg	51549bd232	rpc: oss changes for network area connection pooling (#7735)	5 years ago
Freddy	021f0ee36e	Watch fallback channel for gateways that do not exist (#7715) ... Also ensure that WatchSets in tests are reset between calls to watchFired. Any time a watch fires, subsequent calls to watchFired on the same WatchSet will also return true even if there were no changes.	5 years ago
Matt Keeler	7a4c73acaf	Updates to allow for using an enterprise specific token as the agents token ... This is needed to allow for managed Consul instances to register themselves in the catalog with one of the managed service provider tokens.	5 years ago
Matt Keeler	bec3fb7c18	Some boilerplate to allow for ACL Bootstrap disabling configurability	5 years ago
Freddy	137a2c32c6	TLS Origination for Terminating Gateways (#7671)	5 years ago
freddygv	4710410cb5	Remove fallthrough	5 years ago
freddygv	d1e6d668c2	Add authz filter when creating filterchain	5 years ago
freddygv	034d7d83d4	Fix snapshot IsEmpty	5 years ago
freddygv	3afe816a94	Clean up dead code, issue addressed by passing ws to serviceGatewayNodes	5 years ago
Freddy	3b1b24c2ce	Update agent/proxycfg/state_test.go	5 years ago
freddygv	eddd5bd73b	PR comments	5 years ago
freddygv	77bb2f1002	Fix internal endpoint test	5 years ago
freddygv	d82e7e8c2a	Fix listener error handling	5 years ago
freddygv	6abc71f915	Skip filter chain creation if no client cert	5 years ago
freddygv	915db10903	Avoid deleting mappings for services linked to other gateways on dereg	5 years ago
freddygv	cd28d4125d	Re-fix bug in CheckConnectServiceNodes	5 years ago
freddygv	09a8e5f36d	Use golden files for gateway certs and fix listener test flakiness	5 years ago
freddygv	840d27a9d5	Un-nest switch in gateway update handler	5 years ago
freddygv	c0e1751878	Allow terminating-gateway to setup listener before servicegroups are known	5 years ago
freddygv	913b13f31f	Add subset support	5 years ago
freddygv	9f233dece2	Fix ConnectQueryBlocking test	5 years ago
freddygv	86342e4bca	Fix bug in CheckConnectServiceNodes ... Previously, if a blocking query called CheckConnectServiceNodes before the gateway-services memdb table had any entries, a nil watchCh would be returned when calling serviceTerminatingGatewayNodes. This means that the blocking query would not fire if a gateway config entry was added after the watch started. In cases where the blocking query started on proxy registration, the proxy could potentially never become aware of an upstream endpoint if that upstream was going to be represented by a gateway.	5 years ago
freddygv	219c78e586	Add xds cluster/listener/endpoint management	5 years ago
freddygv	24207226ca	Add proxycfg state management for terminating-gateways	5 years ago
freddygv	c9385129ae	Require service:read to read terminating-gateway config	5 years ago
Matt Keeler	a1648c61ae	A couple testing helper updates (#7694)	5 years ago
Kit Patella	df14a7c694	Merge pull request #7699 from pierresouchay/fix_comment_misplaced ... Fixed comment on wrong line	5 years ago
Chris Piraino	ecc8a2d6f7	Allow ingress gateways to route through mesh gateways ... - Adds integration test for mesh gateways local + remote modes with ingress - ingress golden files updated for mesh gateway endpoints	5 years ago
Chris Piraino	cb9df538d5	Add all the xds ingress tests ... This commit copies many of the connect-proxy xds testcases and reuses for ingress gateways. This allows us to more easily see changes to the envoy configuration when make updates to ingress gateways.	5 years ago
Chris Piraino	0ca9b606e8	Pull out setupTestVariationConfigEntriesAndSnapshot in proxycfg ... This allows us to reuse the same variations for ingress gateway testing	5 years ago
Kyle Havlovitz	e7b1ee55de	Add http routing support and integration test to ingress gateways	5 years ago
Hans Hasselberg	1194fe441f	auto_encrypt: add validations for auto_encrypt.{tls,allow_tls} (#7704) ... Fixes https://github.com/hashicorp/consul/issues/7407.	5 years ago
Pierre Souchay	5e79efc80f	Fixed comment on wrong line. ... While investigating and fixing an issue on our 1.5.1 branch, I saw you also/already fixed the bug I found (tags not updated for existing servers), but comment is misplaced.	5 years ago
Freddy	3956cff60f	Fix check deletion in anti-entropy sync (#7690) ... * Incorporate entMeta into service equality check	5 years ago