135 Commits (262897469260cc6319ea9369518e20ac2fed3178)

Author	SHA1	Message	Date
Tara Tufano	9deb52e868	add http2 ping health checks (#8431) ... * add http2 ping checks * fix test issue * add h2ping check to config resources * add new test and docs for h2ping * fix grammatical inconsistency in H2PING documentation * resolve rebase conflicts, add test for h2ping tls verification failure * api documentation for h2ping * update test config data with H2PING * add H2PING to protocol buffers and update changelog * fix typo in changelog entry	4 years ago
Daniel Nephin	e66af1a559	agent/consuk: Rename RPCRate -> RPCRateLimit ... so that the field name is consistent across config structs.	4 years ago
Michael Montgomery	e4f603dfae	Merge branch 'master' into 6074-allow-config-MaxHeaderBytes	4 years ago
Hans Hasselberg	44674bcdf8	fix serf_wan documentation (#9289) ... WAN config is different than LAN config, source of truth is f72d2042a8/config.go (L315-L326) and now the docs are correct.	4 years ago
Michael Montgomery	585c84e9ff	Merge branch 'master' into 6074-allow-config-MaxHeaderBytes	4 years ago
Matt Keeler	66fd23d67f	Refactor to call non-voting servers read replicas (#9191) ... Co-authored-by: Kit Patella <kit@jepsen.io>	4 years ago
R.B. Boyer	61eac21f1a	agent: return the default ACL policy to callers as a header (#9101) ... Header is: X-Consul-Default-ACL-Policy=<allow|deny> This is of particular utility when fetching matching intentions, as the fallthrough for a request that doesn't match any intentions is to enforce using the default acl policy.	4 years ago
R.B. Boyer	8e616a93c1	agent: sanitize ui metrics proxy header values on agent/self endpoint (#9104)	4 years ago
R.B. Boyer	a66c4591d7	agent: introduce path allow list for requests going through the metrics proxy (#9059) ... Added a new option `ui_config.metrics_proxy.path_allowlist`. This defaults to `["/api/v1/query", "/api/v1/query_range"]` when the metrics provider is set to `prometheus`. Requests that do not use one of the allow-listed paths (via exact match) get a 403 Forbidden response instead.	4 years ago
Michael Montgomery	5b6ac035ff	Resolves #6074. Adds new option to configure HTTP Server's MaxHeaderBytes with option `-http-max-header-bytes` ... Adds tests for behavior	4 years ago
Daniel Nephin	853667e7d8	health: change the name of UseStreamingBackend config ... Remove it from the cache section, and update the docs.	4 years ago
Daniel Nephin	ea77eccb14	Merge pull request #8825 from hashicorp/streaming/add-config ... streaming: add config and docs	4 years ago
Daniel Nephin	e7d505dc33	config: add field for enabling streaming in the client ... agent: register the new streaming cache-type	4 years ago
Matt Keeler	38f5ddce2a	Add per-agent reconnect timeouts (#8781) ... This allows for client agent to be run in a more stateless manner where they may be abruptly terminated and not expected to come back. If advertising a per-agent reconnect timeout using the advertise_reconnect_timeout configuration when that agent leaves, other agents will wait only that amount of time for the agent to come back before reaping it. This has the advantageous side effect of causing servers to deregister the node/services/checks for that agent sooner than if the global reconnect_timeout was used.	4 years ago
Daniel Nephin	b93577c94f	config: add field for enabling streaming RPC endpoint	4 years ago
Paul Banks	526bab6164	Add config changes for UI metrics	4 years ago
Daniel Nephin	629e4aaa65	config: use token.Config for ACLToken config ... Using the target Config struct reduces the amount of copying and translating of configuration structs.	4 years ago
Daniel Nephin	330be5b740	agent/token: Move token persistence out of agent ... And into token.Store. This change isolates any awareness of token persistence in a single place. It is a small step in allowing Agent.New to accept its dependencies.	4 years ago
Daniel Nephin	e16375216d	config: use logging.Config in RuntimeConfig ... To add structure to RuntimeConfig, and remove the need to translate into a third type.	4 years ago
Matt Keeler	dbb461a5d3	Allow setting verify_incoming* when using auto_encrypt or auto_config (#8394) ... Ensure that enabling AutoConfig sets the tls configurator properly This also refactors the TLS configurator a bit so the naming doesn’t imply only AutoEncrypt as the source of the automatically setup TLS cert info.	4 years ago
Matt Keeler	34034b76f5	Agent Auto Config: Implement Certificate Generation (#8360) ... Most of the groundwork was laid in previous PRs between adding the cert-monitor package to extracting the logic of signing certificates out of the connect_ca_endpoint.go code and into a method on the server. This also refactors the auto-config package a bit to split things out into multiple files.	4 years ago
Pierre Souchay	505de6dc29	Added ratelimit to handle throtling cache (#8226) ... This implements a solution for #7863 It does: Add a new config cache.entry_fetch_rate to limit the number of calls/s for a given cache entry, default value = rate.Inf Add cache.entry_fetch_max_burst size of rate limit (default value = 2) The new configuration now supports the following syntax for instance to allow 1 query every 3s: command line HCL: -hcl 'cache = { entry_fetch_rate = 0.333}' in JSON { "cache": { "entry_fetch_rate": 0.333 } }	4 years ago
Matt Keeler	2ee9fe0a4d	Move generation of the CA Configuration from the agent code into a method on the RuntimeConfig (#8363) ... This allows this to be reused elsewhere.	4 years ago
André	3bc27df844	minor: fix docstring of DNSOnlyPassing (#8318) ... In runtime.go it had "duration" but it is actually a boolean.	4 years ago
Matt Keeler	9f7b22a5eb	Agent Auto Configuration: Configuration Syntax Updates (#8003)	5 years ago
Hans Hasselberg	72f92ae7ca	agent: add option to disable agent cache for HTTP endpoints (#8023) ... This allows the operator to disable agent caching for the http endpoint. It is on by default for backwards compatibility and if disabled will ignore the url parameter `cached`.	5 years ago
R.B. Boyer	ffb9c7d6f7	acl: remove the deprecated `acl_enforce_version_8` option (#7991) ... Fixes #7292	5 years ago
Pierre Souchay	e9d176db2a	Allow to restrict servers that can join a given Serf Consul cluster. (#7628) ... Based on work done in https://github.com/hashicorp/memberlist/pull/196 this allows to restrict the IP ranges that can join a given Serf cluster and be a member of the cluster. Restrictions on IPs can be done separatly using 2 new differents flags and config options to restrict IPs for LAN and WAN Serf.	5 years ago
Emre Savcı	2083b7b04d	agent: add len, cap while initializing arrays	5 years ago
Hans Hasselberg	7777891aa6	tls: remove old ciphers (#7282) ... Following advice from: https://github.com/ssllabs/research/wiki/SSL-and-TLS-Deployment-Best-Practices, this PR removes old ciphers.	5 years ago
R.B. Boyer	6adad71125	wan federation via mesh gateways (#6884) ... This is like a Möbius strip of code due to the fact that low-level components (serf/memberlist) are connected to high-level components (the catalog and mesh-gateways) in a twisty maze of references which make it hard to dive into. With that in mind here's a high level summary of what you'll find in the patch: There are several distinct chunks of code that are affected: * new flags and config options for the server * retry join WAN is slightly different * retry join code is shared to discover primary mesh gateways from secondary datacenters * because retry join logic runs in the *agent* and the results of that operation for primary mesh gateways are needed in the *server* there are some methods like `RefreshPrimaryGatewayFallbackAddresses` that must occur at multiple layers of abstraction just to pass the data down to the right layer. * new cache type `FederationStateListMeshGatewaysName` for use in `proxycfg/xds` layers * the function signature for RPC dialing picked up a new required field (the node name of the destination) * several new RPCs for manipulating a FederationState object: `FederationState:{Apply,Get,List,ListMeshGateways}` * 3 read-only internal APIs for debugging use to invoke those RPCs from curl * raft and fsm changes to persist these FederationStates * replication for FederationStates as they are canonically stored in the Primary and replicated to the Secondaries. * a special derivative of anti-entropy that runs in secondaries to snapshot their local mesh gateway `CheckServiceNodes` and sync them into their upstream FederationState in the primary (this works in conjunction with the replication to distribute addresses for all mesh gateways in all DCs to all other DCs) * a "gateway locator" convenience object to make use of this data to choose the addresses of gateways to use for any given RPC or gossip operation to a remote DC. This gets data from the "retry join" logic in the agent and also directly calls into the FSM. * RPC (`:8300`) on the server sniffs the first byte of a new connection to determine if it's actually doing native TLS. If so it checks the ALPN header for protocol determination (just like how the existing system uses the type-byte marker). * 2 new kinds of protocols are exclusively decoded via this native TLS mechanism: one for ferrying "packet" operations (udp-like) from the gossip layer and one for "stream" operations (tcp-like). The packet operations re-use sockets (using length-prefixing) to cut down on TLS re-negotiation overhead. * the server instances specially wrap the `memberlist.NetTransport` when running with gateway federation enabled (in a `wanfed.Transport`). The general gist is that if it tries to dial a node in the SAME datacenter (deduced by looking at the suffix of the node name) there is no change. If dialing a DIFFERENT datacenter it is wrapped up in a TLS+ALPN blob and sent through some mesh gateways to eventually end up in a server's :8300 port. * a new flag when launching a mesh gateway via `consul connect envoy` to indicate that the servers are to be exposed. This sets a special service meta when registering the gateway into the catalog. * `proxycfg/xds` notice this metadata blob to activate additional watches for the FederationState objects as well as the location of all of the consul servers in that datacenter. * `xds:` if the extra metadata is in place additional clusters are defined in a DC to bulk sink all traffic to another DC's gateways. For the current datacenter we listen on a wildcard name (`server.<dc>.consul`) that load balances all servers as well as one mini-cluster per node (`<node>.server.<dc>.consul`) * the `consul tls cert create` command got a new flag (`-node`) to help create an additional SAN in certs that can be used with this flavor of federation.	5 years ago
Kim Ngo	a8f4123d37	agent/txn_endpoint: configure max txn request length (#7388) ... configure max transaction size separately from kv limit	5 years ago
Hans Hasselberg	e05ac57e8f	tls: support tls 1.3 (#7325)	5 years ago
Hans Hasselberg	cb0f94487c	config: increase http_max_conns_per_client default to 200 (#7289)	5 years ago
Hans Hasselberg	5531678e9e	Security fixes (#7182) ... * Mitigate HTTP/RPC Services Allow Unbounded Resource Usage Fixes #7159. Co-authored-by: Matt Keeler <mkeeler@users.noreply.github.com> Co-authored-by: Paul Banks <banks@banksco.de>	5 years ago
Chris Piraino	401221de58	Allow users to configure either unstructured or JSON logging (#7130) ... * hclog Allow users to choose between unstructured and JSON logging	5 years ago
Anthony Scalisi	beb928f8de	fix spelling errors (#7135)	5 years ago
Hans Hasselberg	11a571de95	agent: setup grpc server with auto_encrypt certs and add -https-port (#7086) ... * setup grpc server with TLS config used across consul. * add -https-port flag	5 years ago
Hans Hasselberg	87f32c8ba6	auto_encrypt: set dns and ip san for k8s and provide configuration (#6944) ... * Add CreateCSRWithSAN * Use CreateCSRWithSAN in auto_encrypt and cache * Copy DNSNames and IPAddresses to cert * Verify auto_encrypt.sign returns cert with SAN * provide configuration options for auto_encrypt dnssan and ipsan * rename CreateCSRWithSAN to CreateCSR	5 years ago
Matej Urbas	ce023359fe	agent: configurable MaxQueryTime and DefaultQueryTime. (#3777)	5 years ago
Matt Keeler	5934f803bf	Sync of OSS changes to support namespaces (#6909)	5 years ago
Sarah Christoff	5e1c6e907b	Set MinQuorum variable in Autopilot (#6654) ... * Add MinQuorum to Autopilot	5 years ago
Freddy	fdd10dd8b8	Expose HTTP-based paths through Connect proxy (#6446) ... Fixes: #5396 This PR adds a proxy configuration stanza called expose. These flags register listeners in Connect sidecar proxies to allow requests to specific HTTP paths from outside of the node. This allows services to protect themselves by only listening on the loopback interface, while still accepting traffic from non Connect-enabled services. Under expose there is a boolean checks flag that would automatically expose all registered HTTP and gRPC check paths. This stanza also accepts a paths list to expose individual paths. The primary use case for this functionality would be to expose paths for third parties like Prometheus or the kubelet. Listeners for requests to exposed paths are be configured dynamically at run time. Any time a proxy, or check can be registered, a listener can also be created. In this initial implementation requests to these paths are not authenticated/encrypted.	5 years ago
Mike Morris	65be58703c	connect: remove managed proxies (#6220) ... * connect: remove managed proxies implementation and all supporting config options and structs * connect: remove deprecated ProxyDestination * command: remove CONNECT_PROXY_TOKEN env var * agent: remove entire proxyprocess proxy manager * test: remove all managed proxy tests * test: remove irrelevant managed proxy note from TestService_ServerTLSConfig * test: update ContentHash to reflect managed proxy removal * test: remove deprecated ProxyDestination test * telemetry: remove managed proxy note * http: remove /v1/agent/connect/proxy endpoint * ci: remove deprecated test exclusion * website: update managed proxies deprecation page to note removal * website: remove managed proxy configuration API docs * website: remove managed proxy note from built-in proxy config * website: add note on removing proxy subdirectory of data_dir	5 years ago
R.B. Boyer	c6c4a2251a	Merge Consul OSS branch master at commit b3541c4f34	5 years ago
Jack Pearkes	4e0a16ab2d	config: correct limit to limits in config example (#6219) ... This isn't yet documented on the website, but wanted to update this to add the missing s.	5 years ago
Jeff Mitchell	94c73d0c92	Chunking support (#6172) ... * Initial chunk support This uses the go-raft-middleware library to allow for chunked commits to the KV	5 years ago
Alvin Huang	ef6b80bab2	resolve circleci config conflicts	5 years ago
Pierre Souchay	b4590fb8e8	Display nicely Networks (CIDR) in runtime configuration (#6029) ... * Display nicely Networks (CIDR) in runtime configuration CIDR mask is displayed in binary in configuration. This add support for nicely displaying CIDR in runtime configuration. Currently, if a configuration contains the following lines: "http_config": { "allow_write_http_from": [ "127.0.0.0/8", "::1/128" ] } A call to `/v1/agent/self?pretty` would display "AllowWriteHTTPFrom": [ { "IP": "127.0.0.0", "Mask": "/wAAAA==" }, { "IP": "::1", "Mask": "/////////////////////w==" } ] This PR fixes it and it will now display: "AllowWriteHTTPFrom": [ "127.0.0.0/8", "::1/128" ] * Added test for cidr nice rendering in `TestSanitize()`.	5 years ago
Paul Banks	f38da47c55	Allow raft TrailingLogs to be configured. (#6186) ... This fixes pathological cases where the write throughput and snapshot size are both so large that more than 10k log entries are written in the time it takes to restore the snapshot from disk. In this case followers that restart can never catch up with leader replication again and enter a loop of constantly downloading a full snapshot and restoring it only to find that snapshot is already out of date and the leader has truncated its logs so a new snapshot is sent etc. In general if you need to adjust this, you are probably abusing Consul for purposes outside its design envelope and should reconsider your usage to reduce data size and/or write volume.	5 years ago