3983 Commits (26c7d199135408cfb185603daabe0a194cbc751b)

Author	SHA1	Message	Date
freddygv	21f2c2e68d	Purge chain if it shouldn't be there	3 years ago
freddygv	fe85138453	additional test fixes	3 years ago
freddygv	d26b4860fd	Account for new upstreams constraint in tests	3 years ago
freddygv	2fe27b748d	Check ingress upstreams when gating chain watches	3 years ago
freddygv	6814e84459	Use ptr receiver in all Upstream methods	3 years ago
freddygv	6af9a0d8cf	Avoid storing chain without an upstream	3 years ago
freddygv	ba12dc215b	Clean up chains separately from their watches	3 years ago
freddygv	c5c290c503	Validate chains are associated with upstreams ... Previously we could get into a state where discovery chain entries were not cleaned up after the associated watch was cancelled. These changes add handling for that case where stray chain references are encountered.	3 years ago
freddygv	70d6358426	Store intention upstreams in snapshot	3 years ago
R.B. Boyer	81ea8129d7	proxycfg: ensure all of the watches are canceled if they are cancelable (#11824)	3 years ago
Jared Kirschner	f81dd817ff	Merge pull request #11818 from hashicorp/improve-url-not-found-response ... http: improve 404 Not Found response message	3 years ago
R.B. Boyer	4aabbe529c	proxycfg: use external addresses in tproxy when crossing partition boundaries (#11823)	3 years ago
Jared Kirschner	2de79abc00	http: improve 404 Not Found response message ... When a URL path is not found, return a non-empty message with the 404 status code to help the user understand what went wrong. If the URL path was not prefixed with '/v1/', suggest that may be the cause of the problem (which is a common mistake).	3 years ago
Freddy	85fe875d07	Use anonymousToken when querying by secret ID (#11813) ... Co-authored-by: Chris S. Kim <ckim@hashicorp.com> Co-authored-by: Dan Upton <daniel@floppy.co> This query has been incorrectly querying by accessor ID since New ACLs were added. However, the legacy token compat allowed this to continue to work, since it made a fallback query for the anonymousToken ID. PR #11184 removed this legacy token query, which means that the query by accessor ID is now the only check for the anonymous token's existence. This PR updates the GetBySecret call to use the secret ID of the token.	3 years ago
R.B. Boyer	631c649291	various partition related todos (#11822)	3 years ago
Kyle Havlovitz	b50ef696c6	Merge pull request #11812 from hashicorp/metrics-ui-acls ... oss: use wildcard partition in metrics proxy ui endpoint	3 years ago
Kyle Havlovitz	9dcaf0539c	Merge pull request #11798 from hashicorp/vip-goroutine-check ... leader: move the virtual IP version check into a goroutine	3 years ago
Kyle Havlovitz	018693b6ee	acl: use wildcard partition in metrics proxy ui endpoint	3 years ago
Kyle Havlovitz	80a4489844	state: fix freed VIP table id index	3 years ago
Kyle Havlovitz	ecbd3eb2a6	Exit before starting the vip check routine if possible	3 years ago
Kyle Havlovitz	04ef1c3fa0	leader: move the virtual IP version check into a goroutine	3 years ago
FFMMM	74eb257b1c	[sync ent] increase segment max limit to 4*64, make configurable (#1424) (#11795) ... * commit b6eb27563e747a78b7647d2b5da405e46364cc46 Author: FFMMM <FFMMM@users.noreply.github.com> Date: Thu Dec 9 13:53:44 2021 -0800 increase segment max limit to 4*64, make configurable (#1424) Signed-off-by: FFMMM <FFMMM@users.noreply.github.com> * fix: rename ent changelog file Signed-off-by: FFMMM <FFMMM@users.noreply.github.com>	3 years ago
Daniel Nephin	f9647ece05	Merge pull request #11780 from hashicorp/dnephin/ca-test-vault-in-secondary ... ca: improve test coverage for RenewIntermediate	3 years ago
R.B. Boyer	bb75e63eb4	agent: ensure service maintenance checks for matching partitions ahead of other errors (#11788) ... This matches behavior in most other agent api endpoints.	3 years ago
Daniel Nephin	4116a143e0	fix misleading errors on vault shutdown	3 years ago
Daniel Nephin	968aeff1bb	ca: prune some unnecessary lookups in the tests	3 years ago
Daniel Nephin	305655a8b1	ca: remove duplicate WaitFor function	3 years ago
Daniel Nephin	1dec6bb815	ca: fix flakes in RenewIntermediate tests ... I suspect one problem was that we set structs.IntermediateCertRenewInterval to 1ms, which meant that in some cases the intermediate could renew before we stored the original value. Another problem was that the 'wait for intermediate' loop was calling the provider.ActiveIntermediate, but the comparison needs to use the RPC endpoint to accurately represent a user request. So changing the 'wait for' to use the state store ensures we don't race. Also moves the patching into a separate function. Removes the addition of ca.CertificateTimeDriftBuffer as part of calculating halfTime. This was added in a previous commit to attempt to fix the flake, but it did not appear to fix the problem. Adding the time here was making the tests fail when using the shared patch function. It's not clear to me why, but there's no reason we should be including this time in the halfTime calculation.	3 years ago
Daniel Nephin	2e4e8bd791	ca: improve RenewIntermediate tests ... Use the new verifyLearfCert to show the cert verifies with intermediates from both sources. This required using the RPC interface so that the leaf pem was constructed correctly. Add IndexedCARoots.Active since that is a common operation we see in a few places.	3 years ago
Daniel Nephin	a4ba1f348d	ca: add a test for Vault in secondary DC	3 years ago
Daniel Nephin	a5d9b1d322	ca: Add CARoots.Active method ... Which will be used in the next commit.	3 years ago
R.B. Boyer	5f5720837b	acl: ensure that the agent recovery token is properly partitioned (#11782)	3 years ago
Daniel Nephin	f72e285fe8	Merge pull request #11721 from hashicorp/dnephin/ca-export-fsm-operation ... ca: use the real FSM operation in tests	3 years ago
Daniel Nephin	214dcf8d0d	ca: use the real FSM operation in tests ... Previously we had a couple copies that reproduced the FSM operation. These copies introduce risk that the test does not accurately match production. This PR removes the test versions of the FSM operation, and exports the real production FSM operation so that it can be used in tests. The consul provider tests did need to change because of this. Previously we would return a hardcoded value of 2, but in production this value is always incremented.	3 years ago
R.B. Boyer	592ac8f96a	test: test server should auto cleanup (#11779)	3 years ago
Evan Culver	7a365fa0da	rpc: Unset partition before forwarding to remote datacenter (#11758)	3 years ago
Daniel Nephin	dccd3f5806	Merge remote-tracking branch 'origin/main' into serve-panic-recovery	3 years ago
Dan Upton	7efab269c0	Rename `Master` and `AgentMaster` fields in config protobuf (#11764)	3 years ago
Chris S. Kim	f8f8580ab2	Godocs updates for catalog endpoints (#11716)	3 years ago
Mathew Estafanous	0a9621ec7a	Transition all endpoint tests in agent_endpoint_test.go to go through ServeHTTP (#11499)	3 years ago
Dan Upton	205ce9a69d	Remove references to "master" ACL tokens in tests (#11751)	3 years ago
Dan Upton	7fe81171d9	Rename `ACLMasterToken` => `ACLInitialManagementToken` (#11746)	3 years ago
Dan Upton	3a91815169	agent/token: rename `agent_master` to `agent_recovery` (internally) (#11744)	3 years ago
R.B. Boyer	9315a9812f	return the max	3 years ago
freddygv	60fe5f75bb	Remove support for failover to partition ... Failing over to a partition is more siimilar to failing over to another datacenter than it is to failing over to a namespace. In a future release we should update how localities for failover are specified. We should be able to accept a list of localities which can include both partition and datacenter.	3 years ago
freddygv	5c1f7aa372	Allow cross-partition references in disco chain ... * Add partition fields to targets like service route destinations * Update validation to prevent cross-DC + cross-partition references * Handle partitions when reading config entries for disco chain * Encode partition in compiled targets	3 years ago
R.B. Boyer	b1605639fc	light refactors to support making partitions and serf-based wan federation are mutually exclusive (#11755)	3 years ago
R.B. Boyer	e20e6348dd	areas: make the gRPC server tracker network area aware (#11748) ... Fixes a bug whereby servers present in multiple network areas would be properly segmented in the Router, but not in the gRPC mirror. This would lead servers in the current datacenter leaving from a network area (possibly during the network area's removal) from deleting their own records that still exist in the standard WAN area. The gRPC client stack uses the gRPC server tracker to execute all RPCs, even those targeting members of the current datacenter (which is unlike the net/rpc stack which has a bypass mechanism). This would manifest as a gRPC method call never opening a socket because it would block forever waiting for the current datacenter's pool of servers to be non-empty.	3 years ago
Freddy	a725f06c83	Merge pull request #11739 from hashicorp/ap/exports-rename	3 years ago
freddygv	e91509383f	Clean up additional refs to partition exports	3 years ago