consul

Tree: 25b585d0bf

Author	SHA1	Message	Date
R.B. Boyer	fdb6b80672	Switch to go 1.13.7 (#7262 ) - You can no longer cross submodule boundaries with ./... in go subcommands like `go list` or `go test`. The makefile and CI scripts were updated accordingly. - Also of note: `go mod vendor` now omits things build ignored.	5 years ago
Chris Piraino	401221de58	Allow users to configure either unstructured or JSON logging (#7130 ) * hclog Allow users to choose between unstructured and JSON logging	5 years ago
Wim	4f5d5020b8	dns: fix memoryleak by upgrading outdated miekg/dns (#6748 ) * Add updated github.com/miekg/dns to go modules * Add updated github.com/miekg/dns to vendor * Fix github.com/miekg/dns api breakage * Decrease size when trimming UDP packets Need more room for the header(?), if we don't decrease the size we get an "overflow unpacking uint32" from the dns library * Fix dns truncate tests with api changes * Make windows build working again. Upgrade x/sys and x/crypto and vendor This upgrade is needed because of API breakage in x/sys introduced by the minimal x/sys dependency of miekg/dns This API breakage has been fixed in commit `855e68c859`	5 years ago
Mike Morris	66b8c20990	Bump go-discover to support EC2 Metadata Service v2 (#6865 ) Refs https://github.com/hashicorp/go-discover/pull/128 * deps: add replace directive for gocheck Transitive dep, source at https://launchpad.net/gocheck indicates project moved. This also avoids a dependency on bzr when fetching modules. Refs https://github.com/hashicorp/consul/pull/6818 * deps: make update-vendor * test: update retry-join expected names from go-discover	5 years ago
R.B. Boyer	796de297c8	connect: intermediate CA certs generated with the vault provider lack URI SANs (#6491 ) This only affects vault versions >=1.1.1 because the prior code accidentally relied upon a bug that was fixed in https://github.com/hashicorp/vault/pull/6505 The existing tests should have caught this, but they were using a vendored copy of vault version 0.10.3. This fixes the tests by running an actual copy of vault instead of an in-process copy. This has the added benefit of changing the dependency on vault to just vault/api. Also update VaultProvider to use similar SetIntermediate validation code as the ConsulProvider implementation.	5 years ago
Aaron Bennett	430dab8c37	update dependencies for enterprise change (#6395 )	5 years ago
Jeff Mitchell	94c73d0c92	Chunking support (#6172 ) * Initial chunk support This uses the go-raft-middleware library to allow for chunked commits to the KV	5 years ago
Paul Banks	ffcfdf29fc	Upgrade xDS (go-control-plane) API to support Envoy 1.10. (#5872 ) * Upgrade xDS (go-control-plane) API to support Envoy 1.10. This includes backwards compatibility shim to work around the ext_authz package rename in 1.10. It also adds integration test support in CI for 1.10.0. * Fix go vet complaints * go mod vendor * Update Envoy version info in docs * Update website/source/docs/connect/proxies/envoy.md	6 years ago
Paul Banks	421ecd32fc	Connect: allow configuring Envoy for L7 Observability (#5558 ) * Add support for HTTP proxy listeners * Add customizable bootstrap configuration options * Debug logging for xDS AuthZ * Add Envoy Integration test suite with basic test coverage * Add envoy command tests to cover new cases * Add tracing integration test * Add gRPC support WIP * Merged changes from master Docker. get CI integration to work with same Dockerfile now * Make docker build optional for integration * Enable integration tests again! * http2 and grpc integration tests and fixes * Fix up command config tests * Store all container logs as artifacts in circle on fail * Add retries to outer part of stats measurements as we keep missing them in CI * Only dump logs on failing cases * Fix typos from code review * Review tidying and make tests pass again * Add debug logs to exec test. * Fix legit test failure caused by upstream rename in envoy config * Attempt to reduce cases of bad TLS handshake in CI integration tests * bring up the right service * Add prometheus integration test * Add test for denied AuthZ both HTTP and TCP * Try ANSI term for Circle	6 years ago
R.B. Boyer	e47d7eeddb	acl: adding support for kubernetes auth provider login (#5600 ) * auth providers * binding rules * auth provider for kubernetes * login/logout	6 years ago
Jeff Mitchell	28c84845bf	Update vendoring from go mod. (#5566 )	6 years ago
R.B. Boyer	cd96af4fc0	acl: reduce complexity of token resolution process with alternative singleflighting (#5480 ) acl: reduce complexity of token resolution process with alternative singleflighting Switches acl resolution to use golang.org/x/sync/singleflight. For the identity/legacy lookups this is a drop-in replacement with the same overall approach to request coalescing. For policies this is technically a change in behavior, but when considered holistically is approximately performance neutral (with the benefit of less code). There are two goals with this blob of code (speaking specifically of policy resolution here): 1) Minimize cross-DC requests. 2) Minimize client-to-server LAN requests. The previous iteration of this code was optimizing for the case of many possibly different tokens being resolved concurrently that have a significant overlap in linked policies such that deduplication would be worth the complexity. While this is laudable there are some things to consider that can help to adjust expectations: 1) For v1.4+ policies are always replicated, and once a single policy shows up in a secondary DC the replicated data is considered authoritative for requests made in that DC. This means that our earlier concerns about minimizing cross-DC requests are irrelevant because there will be no cross-DC policy reads that occur. 2) For Server nodes the in-memory ACL policy cache is capped at zero, meaning it has no caching. Only Client nodes run with a cache. This means that instead of having an entire DC's worth of tokens (what a Server might see) that can have policy resolutions coalesced these nodes will only ever be seeing node-local token resolutions. In a reasonable worst-case scenario where a scheduler like Kubernetes has "filled" a node with Connect services, even that will only schedule ~100 connect services per node. If every service has a unique token there will only be 100 tokens to coalesce and even then those requests have to occur concurrently AND be hitting an empty consul cache. Instead of seeing a great coalescing opportunity for cutting down on redundant Policy resolutions, in practice it's far more likely given node densities that you'd see requests for the same token concurrently than you would for two tokens sharing a policy concurrently (to a degree that would warrant the overhead of the current variation of singleflighting. Given that, this patch switches the Policy resolution process to only singleflight by requesting token (but keeps the cache as by-policy).	6 years ago
Matt Keeler	18b29c45c4	New ACLs (#4791 ) This PR is almost a complete rewrite of the ACL system within Consul. It brings the features more in line with other HashiCorp products. Obviously there is quite a bit left to do here but most of it is related docs, testing and finishing the last few commands in the CLI. I will update the PR description and check off the todos as I finish them over the next few days/week. Description At a high level this PR is mainly to split ACL tokens from Policies and to split the concepts of Authorization from Identities. A lot of this PR is mostly just to support CRUD operations on ACLTokens and ACLPolicies. These in and of themselves are not particularly interesting. The bigger conceptual changes are in how tokens get resolved, how backwards compatibility is handled and the separation of policy from identity which could lead the way to allowing for alternative identity providers. On the surface and with a new cluster the ACL system will look very similar to that of Nomads. Both have tokens and policies. Both have local tokens. The ACL management APIs for both are very similar. I even ripped off Nomad's ACL bootstrap resetting procedure. There are a few key differences though. Nomad requires token and policy replication where Consul only requires policy replication with token replication being opt-in. In Consul local tokens only work with token replication being enabled though. All policies in Nomad are globally applicable. In Consul all policies are stored and replicated globally but can be scoped to a subset of the datacenters. This allows for more granular access management. Unlike Nomad, Consul has legacy baggage in the form of the original ACL system. The ramifications of this are: A server running the new system must still support other clients using the legacy system. A client running the new system must be able to use the legacy RPCs when the servers in its datacenter are running the legacy system. The primary ACL DC's servers running in legacy mode needs to be a gate that keeps everything else in the entire multi-DC cluster running in legacy mode. So not only does this PR implement the new ACL system but has a legacy mode built in for when the cluster isn't ready for new ACLs. Also detecting that new ACLs can be used is automatic and requires no configuration on the part of administrators. This process is detailed more in the "Transitioning from Legacy to New ACL Mode" section below.	6 years ago
Mitchell Hashimoto	bbb13598bf	vendor k8s client lib	6 years ago
Siva Prasad	f4a1c381a5	Vendoring update for go-discover. (#4412 ) * New Providers added and updated vendoring for go-discover * Vendor.json formatted using make vendorfmt * Docs/Agent/auto-join: Added documentation for the new providers introduced in this PR * Updated the golang.org/x/sys/unix in the vendor directory * Agent: TestGoDiscoverRegistration updated to reflect the addition of new providers * Deleted terraform.tfstate from vendor. * Deleted terraform.tfstate.backup Deleted terraform state file artifacts from unknown runs. * Updated x/sys/windows vendor for Windows binary compilation	6 years ago
Matt Keeler	cf92110abd	Vendor golang.org/x/sys/windows/svc	6 years ago
Matt Keeler	01f82717b4	Vendor the vault api	7 years ago
Kyle Havlovitz	bd42da760b	vendor: pull in latest version of go-discover	7 years ago
Pierre Souchay	9dc7194321	Bump version of miekg/dns to 1.0.4 See https://github.com/hashicorp/consul/issues/3977 While trying to improve furthermore #3948 (This pull request is still valid since we are not using Compression to compute the result anyway). I saw a strange behaviour of dns library. Basically, msg.Len() and len(msg.Pack()) disagree on Message len. Thus, calculation of DNS response is false consul relies on msg.Len() instead of the result of Pack() This is linked to miekg/dns#453 and a fix has been provided with miekg/dns#454 Would it be possible to upgrade miekg/dns to a more recent function ? Consul might for instance upgrade to a post 1.0 release such as https://github.com/miekg/dns/releases/tag/v1.0.4	7 years ago
Dmytro Kostiuchenko	1a10b08e82	Add gRPC health-check #3073	7 years ago
James Phillips	4a2cafe525	Adds HTTP/2 support to Consul's HTTPS server. (#3657 ) * Refactors the HTTP listen path to create servers in the same spot. * Adds HTTP/2 support to Consul's HTTPS server. * Vendors Go HTTP/2 library and associated deps.	7 years ago
James Phillips	9258506dab	Adds simple rate limiting for client agent RPC calls to Consul servers. (#3440 ) * Added rate limiting for agent RPC calls. * Initializes the rate limiter based on the config. * Adds the rate limiter into the snapshot RPC path. * Adds unit tests for the RPC rate limiter. * Groups the RPC limit parameters under "limits" in the config. * Adds some documentation about the RPC limiter. * Sends a 429 response when the rate limiter kicks in. * Adds docs for new telemetry. * Makes snapshot telemetry look like RPC telemetry and cleans up comments.	7 years ago
Frank Schroeder	02ed39cb2f	vendor: drop unused deps for old discover code	7 years ago
Frank Schroeder	748b5b1b00	agent: add dependencies for docker on windows	7 years ago
Frank Schroeder	1805b50580	build: add missing dependency for solaris/amd64	7 years ago
Frank Schroeder	34df7f59ba	vendor: drop unused dependencies	7 years ago
Frank Schroeder	7b675f2710	vendor: drop unused dependencies	7 years ago
Frank Schroeder	c4b62ff37f	vendor: update github.com/fsouza/go-dockerclient Update go-dockerclient and dependant dependencies to add fix for go-dockerclient#622. Fixes #3254	7 years ago
Frank Schroeder	ba987a4417	vendor: update golang.org/x/sys/unix Update golang.org/x/sys/unix to add s390 platform files Fixes #3240	7 years ago
James Phillips	42f60b04bb	Revert "discover: move instance discover code into separate package (#3144 )" (#3180 ) This reverts commit `26bfb2d00a`.	8 years ago
Frank Schroeder	50e11db5d8	add missing packages Moving the discover package dependencies out removed some packages we need.	8 years ago
Frank Schröder	26bfb2d00a	discover: move instance discover code into separate package (#3144 ) This patch moves the code that discovers instances from metadata information to github.com/hashicorp/go-discover with sub-packages for each provider.	8 years ago
Kyle Havlovitz	77650c2e6f	vendor: pull in GCE deps	8 years ago
Kyle Havlovitz	4976c05975	Revert "vendor: Add GCE deps" This reverts commit `4831b6de40`.	8 years ago
Chris Marchesi	4831b6de40	vendor: Add GCE deps Add Google API and related dependencies for GCE discovery.	8 years ago
James Phillips	90f4f49c66	Updates metadata for golang.org/x/sys/unix, keeps SHA the same.	8 years ago
James Phillips	4c54e68e14	Updates fsouza/go-dockerclient. `9b6c972004...a53ba79627`	8 years ago
Sean Chittenden	25b09713b9	Manage dependencies via Godep Embrace the future and use Go 1.6's vendor support via Godep. Go 1.5 users should `export GO15VENDOREXPERIMENT=1`	9 years ago

38 Commits (25b585d0bfa00b452a0f2ff02859a27ed72b043d)