19506 Commits (24c431270c68f2e66d4b9e4a5c4ff82fa5b4997f)

 

All Branches   

Search

Author	SHA1	Message	Date
Dhia Ayachi	6468e3e09c	Server side rate limiter: handle the race condition for limiters tree write in multilimiter (#15767) ... * change to perform all tree writes in the same go routine to avoid race condition. * rename runStoreOnce to reconcile * Apply suggestions from code review Co-authored-by: Dan Upton <daniel@floppy.co> * reduce nesting Co-authored-by: Dan Upton <daniel@floppy.co>	2 years ago
Semir Patel	bafa5c7156	Pass remote addr of incoming HTTP requests through to RPC(..) calls (#15700)	2 years ago
David Yu	d0a83f722b	Dockerfile: bump UBI base image to 9.1 (#15386)	2 years ago
Paul Glass	8ad56b778c	Update compat table for ECS (#15782)	2 years ago
John Murret	e027c94b52	adding config for request_limits (#15531) ... * server: add placeholder glue for rate limit handler This commit adds a no-op implementation of the rate-limit handler and adds it to the `consul.Server` struct and setup code. This allows us to start working on the net/rpc and gRPC interceptors and config logic. * Add handler errors * Set the global read and write limits * fixing multilimiter moving packages * Fix typo * Simplify globalLimit usage * add multilimiter and tests * exporting LimitedEntity * Apply suggestions from code review Co-authored-by: John Murret <john.murret@hashicorp.com> * add config update and rename config params * add doc string and split config * Apply suggestions from code review Co-authored-by: Dan Upton <daniel@floppy.co> * use timer to avoid go routine leak and change the interface * add comments to tests * fix failing test * add prefix with config edge, refactor tests * Apply suggestions from code review Co-authored-by: Dan Upton <daniel@floppy.co> * refactor to apply configs for limiters under a prefix * add fuzz tests and fix bugs found. Refactor reconcile loop to have a simpler logic * make KeyType an exported type * split the config and limiter trees to fix race conditions in config update * rename variables * fix race in test and remove dead code * fix reconcile loop to not create a timer on each loop * add extra benchmark tests and fix tests * fix benchmark test to pass value to func * server: add placeholder glue for rate limit handler This commit adds a no-op implementation of the rate-limit handler and adds it to the `consul.Server` struct and setup code. This allows us to start working on the net/rpc and gRPC interceptors and config logic. * Set the global read and write limits * fixing multilimiter moving packages * add server configuration for global rate limiting. * remove agent test * remove added stuff from handler * remove added stuff from multilimiter * removing unnecessary TODOs * Removing TODO comment from handler * adding in defaulting to infinite * add disabled status in there * adding in documentation for disabled mode. * make disabled the default. * Add mock and agent test * addig documentation and missing mock file. * Fixing test TestLoad_IntegrationWithFlags * updating docs based on PR feedback. * Updating Request Limits mode to use int based on PR feedback. * Adding RequestLimits struct so we have a nested struct in ReloadableConfig. * fixing linting references * Update agent/consul/rate/handler.go Co-authored-by: Dan Upton <daniel@floppy.co> * Update agent/consul/config.go Co-authored-by: Dan Upton <daniel@floppy.co> * removing the ignore of the request limits in JSON. addingbuilder logic to convert any read rate or write rate less than 0 to rate.Inf * added conversion function to convert request limits object to handler config. * Updating docs to reflect gRPC and RPC are rate limit and as a result, HTTP requests are as well. * Updating values for TestLoad_FullConfig() so that they were different and discernable. * Updating TestRuntimeConfig_Sanitize * Fixing TestLoad_IntegrationWithFlags test * putting nil check in place * fixing rebase * removing change for missing error checks. will put in another PR * Rebasing after default multilimiter config change * resolving rebase issues * updating reference for incomingRPCLimiter to use interface * updating interface * Updating interfaces * Fixing mock reference Co-authored-by: Daniel Upton <daniel@floppy.co> Co-authored-by: Dhia Ayachi <dhia@hashicorp.com>	2 years ago
Dan Stough	233dbcb67f	feat: add access logging API to proxy defaults (#15780)	2 years ago
cskh	04bf24c8c1	feat(ingress-gateway): support outlier detection of upstream service for ingress gateway (#15614) ... * feat(ingress-gateway): support outlier detection of upstream service for ingress gateway * changelog Co-authored-by: Eric Haberkorn <erichaberkorn@gmail.com>	2 years ago
Derek Menteer	e87d35e313	Fix DialedDirectly configuration for Consul dataplane. (#15760) ... Fix DialedDirectly configuration for Consul dataplane.	2 years ago
Dan Upton	c692802dec	grpc: add rate-limiting middleware (#15550) ... Implements the gRPC middleware for rate-limiting as a tap.ServerInHandle function (executed before the request is unmarshaled). Mappings between gRPC methods and their operation type are generated by a protoc plugin introduced by #15564.	2 years ago
Dan Upton	eef38c2199	server: add placeholder glue for rate limit handler (#15539) ... Adds a no-op implementation of the rate-limit handler and exposes it on the consul.Server struct. It allows us to start working on the net/rpc and gRPC interceptors and config (re)loading logic, without having to implement the full handler up-front. Co-authored-by: John Murret <john.murret@hashicorp.com> Co-authored-by: Dhia Ayachi <dhia@hashicorp.com>	2 years ago
Kyle Schochenmaier	06ce35d480	add changelog for enterprise 3846 (#15773)	2 years ago
Freddy	bc96606caf	Update changelog checker to handle ent-only entry (#15774)	2 years ago
John Murret	cd53120cd7	agent: Fix assignment of error when auto-reloading cert and key file changes. (#15769) ... * Adding the setting of errors missing in config file watcher code in agent. * add changelog	2 years ago
Freddy	a606ad2ddf	Add initial dev docs on config entries (#15717)	2 years ago
John Murret	348bbf60f1	Fixing CLI instructions so that the installing a cluster that is embedded in the mac instructions is moved outside of the tabbed instructions. (#15736) ... * Fixing CLI instructions so that the installing a cluster that is embedded in the mac instructions is moved outside of the tabbed instructions. Co-authored-by: boruszak <jeffrey.boruszak@hashicorp.com> Co-authored-by: David Yu <dyu@hashicorp.com>	2 years ago
Geoffrey Grosenbach	a013696f17	Remove mention of enterprise license form (#15752) ... The license form is no longer available so this recommends contacting a support representative instead.	2 years ago
R.B. Boyer	4a32070210	test: remove variable shadowing in TestDNS_ServiceLookup_ARecordLimits (#15740)	2 years ago
Jared Kirschner	8991e116fe	docs: how to launch envoy when ACLs enabled (#15497)	2 years ago
Jeff Boruszak	8950762e35	docs: Enterprise Feature Table update (#15738) ... * Table update * Old table re-added and alphabetized * Update website/content/docs/enterprise/index.mdx Co-authored-by: Tu Nguyen <im2nguyen@users.noreply.github.com> Co-authored-by: Tu Nguyen <im2nguyen@users.noreply.github.com>	2 years ago
Dan Stough	98ef5f28dd	[OSS] security: update x/net module (#15737) ... Co-authored-by: Dhia Ayachi <dhia@hashicorp.com>	2 years ago
Eric Haberkorn	4268c1c25c	Remove the `connect.enable_serverless_plugin` agent configuration option (#15710)	2 years ago
Dhia Ayachi	81e40c1fac	add multilimiter and tests (#15467) ... * add multilimiter and tests * exporting LimitedEntity * go mod tidy * Apply suggestions from code review Co-authored-by: John Murret <john.murret@hashicorp.com> * add config update and rename config params * add doc string and split config * Apply suggestions from code review Co-authored-by: Dan Upton <daniel@floppy.co> * use timer to avoid go routine leak and change the interface * add comments to tests * fix failing test * add prefix with config edge, refactor tests * Apply suggestions from code review Co-authored-by: Dan Upton <daniel@floppy.co> * refactor to apply configs for limiters under a prefix * add fuzz tests and fix bugs found. Refactor reconcile loop to have a simpler logic * make KeyType an exported type * split the config and limiter trees to fix race conditions in config update * rename variables * fix race in test and remove dead code * fix reconcile loop to not create a timer on each loop * add extra benchmark tests and fix tests * fix benchmark test to pass value to func * use a separate go routine to write limiters (#15643) * use a separate go routine to write limiters * Add updating limiter when another limiter is created * fix waiter to be a ticker, so we commit more than once. * fix tests and add tests for coverage * unexport members and add tests * make UpdateConfig thread safe and multi call to Run safe * replace swith with if * fix review comments * replace time.sleep with retries * fix flaky test and remove unnecessary init * fix test races * remove unnecessary negative test case * remove fixed todo Co-authored-by: John Murret <john.murret@hashicorp.com> Co-authored-by: Dan Upton <daniel@floppy.co>	2 years ago
Kevin Wang	eb3ff8cf73	ignore `mktg-.*` branches for CI tests (#15651)	2 years ago
Paul Glass	707ca06d79	docs: Fix go-sockaddr links (#15723)	2 years ago
cskh	3df68751f5	Flakiness test: case-cfg-splitter-peering-ingress-gateways (#15707) ... * integ-test: fix flaky test - case-cfg-splitter-peering-ingress-gateways * add retry peering to all peering cases Co-authored-by: Dan Stough <dan.stough@hashicorp.com>	2 years ago
trujillo-adam	2b81e6e060	added link to admin partitions under K8s SM (#15718)	2 years ago
Dhia Ayachi	0402fd23a3	update go version to 1.19.4 (#15705) ... * update go version to 1.19.4 * add changelog	2 years ago
Derek Menteer	97ec5279aa	Fix local mesh gateway with peering discovery chains. (#15690) ... Fix local mesh gateway with peering discovery chains. Prior to this patch, discovery chains with peers would not properly honor the mesh gateway mode for two reasons. 1. An incorrect target upstream ID was used to lookup the mesh gateway mode. To fix this, the parent upstream uid is now used instead of the discovery-chain-target-uid to find the intended mesh gateway mode. 2. The watch for local mesh gateways was never initialized for discovery chains. To fix this, the discovery chains are now scanned, and a local GW watch is spawned if: the mesh gateway mode is local and the target is a peering connection.	2 years ago
David Yu	1c5d54cb29	docs: Small docs updates, peering and K8s CNI (#15702)	2 years ago
David Yu	7a759be2c5	docs: K8s CNI namespace (#15696)	2 years ago
R.B. Boyer	5af94fb2a0	connect: use -dev-no-store-token for test vaults to reduce source of flakes (#15691) ... It turns out that by default the dev mode vault server will attempt to interact with the filesystem to store the provided root token. If multiple vault instances are running they'll all awkwardly share the filesystem and if timing results in one server stopping while another one is starting then the starting one will error with: Error initializing Dev mode: rename /home/circleci/.vault-token.tmp /home/circleci/.vault-token: no such file or directory This change uses `-dev-no-store-token` to bypass that source of flakes. Also the stdout/stderr from the vault process is included if the test fails. The introduction of more `t.Parallel` use in https://github.com/hashicorp/consul/pull/15669 increased the likelihood of this failure, but any of the tests with multiple vaults in use (or running multiple package tests in parallel that all use vault) were eventually going to flake on this.	2 years ago
R.B. Boyer	900584ca82	connect: ensure all vault connect CA tests use limited privilege tokens (#15669) ... All of the current integration tests where Vault is the Connect CA now use non-root tokens for the test. This helps us detect privilege changes in the vault model so we can keep our guides up to date. One larger change was that the RenewIntermediate function got refactored slightly so it could be used from a test, rather than the large duplicated function we were testing in a test which seemed error prone.	2 years ago
R.B. Boyer	4940a728ab	Detect Vault 1.11+ import in secondary datacenters and update default issuer (#15661) ... The fix outlined and merged in #15253 fixed the issue as it occurs in the primary DC. There is a similar issue that arises when vault is used as the Connect CA in a secondary datacenter that is fixed by this PR. Additionally: this PR adds support to run the existing suite of vault related integration tests against the last 4 versions of vault (1.9, 1.10, 1.11, 1.12)	2 years ago
Curt Bushko	95bcfd207d	Update consul-k8s docs based on the consul-k8s release/1.0.x branch (#15678)	2 years ago
David Yu	98cbf341ae	docs: Update Consul K8s CRDs (#15675)	2 years ago
Jeff Boruszak	d16a9dc409	docs: Agentless performance clarifications (#15671) ... * Requested changes	2 years ago
Chris S. Kim	c046d1a4d8	Add warn log when all ACL policies are filtered out (#15632)	2 years ago
Evan Culver	692a6fdecf	Fix broken link to Consul Dataplane index (#15660) ... The `/index` appears to result in a 404.	2 years ago
Jared Kirschner	66e28f35f1	docs: clarify Vault CA provider permissions needed (#15478)	2 years ago
Jared Kirschner	5efdd8bb91	Clarify Vault CA changelog entry (#15662)	2 years ago
James Oulman	2da843818c	docs: fix agent catalog-services caching method (#15645) ... * docs: fix agent catalog-services caching method	2 years ago
Dao Thanh Tung	b890c40ce4	Fixing CLI ACL token processing unexpected precedence (#15274) ... * Fixing CLI ACL token processing unexpected precedence * Minor flow format and add Changelog * Fixed failed tests and improve error logging message * Add unit test cases and minor changes from code review * Unset env var once the test case finishes running * remove label FINISH	2 years ago
am-ak	d73871b5a2	docs: Correct a typo in checks.mdx (#15426) ... * Update checks.mdx Correcting a typo under `UDP + Interval` * Update website/content/docs/discovery/checks.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>	2 years ago
skpratt	06880bd51f	update docs for exp v2 licensing changes (#15563)	2 years ago
Chris S. Kim	10349bd84b	clean up go.mod (#15638)	2 years ago
cskh	36f05bc8fb	integ-test: test consul upgrade from the snapshot of a running cluster (#15595) ... * integ-test: test consul upgrade from the snapshot of a running cluster * use Target version as default Co-authored-by: Dan Stough <dan.stough@hashicorp.com>	2 years ago
Dan Stough	227fd14287	chore: updates from 1.14.2 release (#15633) ... * chore: updates from 1.14.2 release	2 years ago
David Yu	7a1ce08861	CHANGELOG: add alpn config for ingress and connect proxy (#15613)	2 years ago
David Yu	62e5c65e59	docs: fix typos helm install (#15625) ... * fix typos helm install and small compat matrix change related to host ports not required any longer	2 years ago
Michael Wilkerson	ae9a1e681e	added changelog for enterprise only change (#15621)	2 years ago