consul

Commit Graph

Author	SHA1	Message	Date
Michael Zalimeni	d9206fc7e2	[NET-1151 NET-11228] security: Add request normalization and header match options to prevent L7 intentions bypass (#21816 ) mesh: add options for HTTP incoming request normalization Expose global mesh configuration to enforce inbound HTTP request normalization on mesh traffic via Envoy xDS config. mesh: enable inbound URL path normalization by default mesh: add support for L7 header match contains and ignore_case Enable partial string and case-insensitive matching in L7 intentions header match rules. ui: support L7 header match contains and ignore_case Co-authored-by: Phil Renaud <phil@riotindustries.com> test: add request normalization integration bats tests Add both "positive" and "negative" test suites, showing normalization in action as well as expected results when it is not enabled, for the same set of test cases. Also add some alternative service container test helpers for verifying raw HTTP request paths, which is difficult to do with Fortio. docs: update security and reference docs for L7 intentions bypass prevention - Update security docs with best practices for service intentions configuration - Update configuration entry references for mesh and intentions to reflect new values and add guidance on usage	1 month ago
R.B. Boyer	1986c558a8	api: remove dependency on proto-public, protobuf, and grpc (#21780 )	2 months ago
R.B. Boyer	3e6f1c1fe1	remove v2 tenancy, catalog, and mesh (#21592 ) * remove v2 tenancy, catalog, and mesh - Inline the v2tenancy experiment to false - Inline the resource-apis experiment to false - Inline the hcp-v2-resource-apis experiment to false - Remove ACL policy templates and rule language changes related to workload identities (a v2-only concept) (e.g. identity and identity_prefix) - Update the gRPC endpoint used by consul-dataplane to no longer respond specially for v2 - Remove stray v2 references scattered throughout the DNS v1.5 newer implementation. * changelog * go mod tidy on consul containers * lint fixes from ENT --------- Co-authored-by: John Murret <john.murret@hashicorp.com>	3 months ago
John Murret	ab794b59f8	update version, changelog, and submodules after 1.19.2, 1.18.4, 1.17.7 and 1.15.14 releases (#21676 ) * update changelog * Update CHANGELOG.md * remove duplicate 1.19.1 section * update version * update go.mod with most recent modules	3 months ago
John Murret	9c02eff1cd	add module retractions (#21665 )	3 months ago
Poonam Jadhav	cc2c8fb92b	NET-5912/service-defaults protocol validation (#21593 ) * fix: add validation for protocol field on service-defaults config entry * test: update test cases with correct protocol	3 months ago
Nitya Dhanushkodi	ed738a6f98	fix: use Envoy's default for validate_clusters to fix breaking routes when some backend clusters don't exist (#21587 )	3 months ago
Michael Zalimeni	9e23fa7840	[NET-9445] chore: update submodule versions (#21263 ) chore: update submodule versions - Update submodule versions that were released - Add missing replace directive to troubleshoot submodule	6 months ago
Deniz Onur Duzgun	68a7648d14	security: resolve incorrect type conversions (#21251 ) * security: resolve incorrect type conversions * add changelog * fix more incorrect type conversions	6 months ago
John Murret	9b2c1be053	NET-5879 - expose sameness group param on service health endpoint and move sameness group health fallback logic into HealthService RPC layer (#21096 ) * NET-5879 - move the filter for non-passing to occur in the health RPC layer rather than the callers of the RPC * fix import of slices * NET-5879 - expose sameness group param on service health endpoint and move sameness group health fallback logic into HealthService RPC layer * fixing deepcopy * fix license headers	6 months ago
Michael Zalimeni	86b0818c1f	[NET-8601] security: upgrade vault/api to remove go-jose.v2 (#20910 ) security: upgrade vault/api to remove go-jose.v2 This dependency has an open vulnerability (GO-2024-2631), and is no longer needed by the latest `vault/api`. This is a follow-up to the upgrade of `go-jose/v3` in this repository to make all our dependencies consolidate on v3. Also remove the recently added security scan triage block for GO-2024-2631, which was added due to incorrect reports that `go-jose/v3@3.0.3` was impacted; in reality, is was this indirect client dependency (not impacted by CVE) that the scanner was flagging. A bug report has been filed to address the incorrect reporting.	7 months ago
Nathan Coleman	5e9f02d4be	[NET-8091] Add file-system-certificate config entry for API gateway (#20873 ) * Define file-system-certificate config entry * Collect file-system-certificate(s) referenced by api-gateway onto snapshot * Add file-system-certificate to config entry kind allow lists * Remove inapplicable validation This validation makes sense for inline certificates since Consul server is holding the certificate; however, for file system certificates, Consul server never actually sees the certificate. * Support file-system-certificate as source for listener TLS certificate * Add more required mappings for the new config entry type * Construct proper TLS context based on certificate kind * Add support or SDS in xdscommon * Remove unused param * Adds back verification of certs for inline-certificates * Undo tangential changes to TLS config consumption * Remove stray curly braces * Undo some more tangential changes * Improve function name for generating API gateway secrets * Add changelog entry * Update .changelog/20873.txt Co-authored-by: Jared Kirschner <85913323+jkirschner-hashicorp@users.noreply.github.com> * Add some nil-checking, remove outdated TODO * Update test assertions to include file-system-certificate * Add documentation for file-system-certificate config entry Add new doc to nav * Fix grammar mistake * Rename watchmaps, remove outdated TODO --------- Co-authored-by: Melisa Griffin <melisa.griffin@hashicorp.com> Co-authored-by: Jared Kirschner <85913323+jkirschner-hashicorp@users.noreply.github.com>	7 months ago
Deniz Onur Duzgun	3152ac3702	security: bump go, x/net and envoy versions (#20956 ) * Bump go version * Bump x/net * Bump envoy version * Add changelog --------- Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>	8 months ago
sarahalsmiller	262f435800	NET-6821 Disable Terminating Gateway Auto Host Header Rewrite (#20802 ) * disable terminating gateway auto host rewrite * add changelog * clean up unneeded additional snapshot fields * add new field to docs * squash * fix test	8 months ago
Michael Zalimeni	d4761c0ccd	security: upgrade google.golang.org/protobuf to 1.33.0 (#20801 ) Resolves CVE-2024-24786.	9 months ago
skpratt	0610aaaaf0	add raw delete api method (#20737 ) * add raw delete * allow 200 response for successful delete * add comment	9 months ago
Chris S. Kim	0571382c4a	Retract api@v1.28.0 (#20762 )	9 months ago
Matt Keeler	16a0800777	Update API and API Docs regarding disabling gossip for a partition. (#20669 )	9 months ago
Melissa Kam	3b9bb8d6f9	[CC-7044] Start HCP manager as part of link creation (#20312 ) * Check for ACL write permissions on write Link eventually will be creating a token, so require acl:write. * Convert Run to Start, only allow to start once * Always initialize HCP components at startup * Support for updating config and client * Pass HCP manager to controller * Start HCP manager in link resource Start as part of link creation rather than always starting. Update the HCP manager with values from the link before starting as well. * Fix metrics sink leaked goroutine * Remove the hardcoded disabled hostname prefix The HCP metrics sink will always be enabled, so the length of sinks will always be greater than zero. This also means that we will also always default to prefixing metrics with the hostname, which is what our documentation states is the expected behavior anyway. * Add changelog * Check and set running status in one method * Check for primary datacenter, add back test * Clarify merge reasoning, fix timing issue in test * Add comment about controller placement * Expand on breaking change, fix typo in changelog	10 months ago
Tauhid Anjum	5d294b26d3	NET-5824 Exported services api (#20015 ) * Exported services api implemented * Tests added, refactored code * Adding server tests * changelog added * Proto gen added * Adding codegen changes * changing url, response object * Fixing lint error by having namespace and partition directly * Tests changes * refactoring tests * Simplified uniqueness logic for exported services, sorted the response in order of service name * Fix lint errors, refactored code	10 months ago
Lord-Y	758ddf84e9	Case sensitive route match (#19647 ) Add case insensitive param on service route match This commit adds in a new feature that allows service routers to specify that paths and path prefixes should ignore upper / lower casing when matching URLs. Co-authored-by: Derek Menteer <105233703+hashi-derek@users.noreply.github.com>	10 months ago
Michael Zalimeni	76b5de5039	[NET-4968] Upgrade Go to 1.21 (#20062 ) * Upgrade Go to 1.21 * ci: detect Go backwards compatibility test version automatically For our submodules and other places we choose to test against previous Go versions, detect this version automatically from the current one rather than hard-coding it.	10 months ago
hc-github-team-es-release-engineering	0e73c32ac2	[DO NOT MERGE UNTIL EOY] update year in LICENSE and copywrite files (#19780 ) update year in LICENSE and copywrite files Co-authored-by: Dhia Ayachi <dhia@hashicorp.com>	11 months ago
Michael Zalimeni	fe10339caa	[NET-7009] security: update x/crypto to 0.17.0 (#20023 ) security: update x/crypto to 0.17.0 This addresses CVE-2023-48795 (x/crypto/ssh).	11 months ago
Matt Keeler	efe279f802	Retry lint fixes (#19151 ) * Add a make target to run lint-consul-retry on all the modules * Cleanup sdk/testutil/retry * Fix a bunch of retry.Run* usage to not use the outer testing.T * Fix some more recent retry lint issues and pin to v1.4.0 of lint-consul-retry * Fix codegen copywrite lint issues * Don’t perform cleanup after each retry attempt by default. * Use the common testutil.TestingTB interface in test-integ/tenancy * Fix retry tests * Update otel access logging extension test to perform requests within the retry block	12 months ago
Ronald	dc02fa695f	[NET-6251] Nomad client templated policy (#19827 )	12 months ago
Ronald	eded2ff347	[NET-6249] Add templated policies description (#19735 )	1 year ago
Ronald	c1dbf00a85	NET-6251 API gateway templated policy (#19728 )	1 year ago
Mike Nomitch	302f994410	[NET-6640] Adds "Policy" BindType to BindingRule (#19499 ) feat: add bind type of policy Co-authored-by: Ronald Ekambi <ronekambi@gmail.com>	1 year ago
Dan Stough	fd128f4947	build: dependency updates for 1.17.0 (#19453 )	1 year ago
John Murret	f0cf8f2f40	NET-6294 - v1 Agentless proxycfg datasource errors after v2 changes (#19365 )	1 year ago
Chris S. Kim	6360c745b5	Add clarification for route match behavior (#19363 ) * Add clarification for route match behavior * Update website/content/docs/connect/config-entries/service-defaults.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> --------- Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>	1 year ago
Poonam Jadhav	2bd38d8806	fix: allow snake case keys for ip based rate limit config entry (#19277 ) * fix: allow snake case keys for ip based rate limit config entry * chore: add changelog	1 year ago
Michael Zalimeni	8eb074e7c1	[NET-5944] security: Update Go version to 1.20.10 and `x/net` to 0.17.0 (#19225 ) * Bump golang.org/x/net to 0.17.0 This resolves [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) / [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487). * Update Go version to 1.20.10 This resolves [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) / [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) (`net/http`).	1 year ago
modrake	3716b69792	Relplat 897 copywrite bot workarounds (#19200 ) Co-authored-by: Ronald Ekambi <ronekambi@gmail.com>	1 year ago
R.B. Boyer	c26d5cf62c	test: fix container test enterprise drift (#19101 )	1 year ago
Chris S. Kim	92ce814693	Remove old build tags (#19128 )	1 year ago
Ashesh Vidyut	a30ccdf5dc	NET-4135 - Fix NodeMeta filtering Catalog List Services API (#18322 ) * logs for debugging * Init * white spaces fix * added change log * Fix tests * fix typo * using queryoptionfilter to populate args.filter * tests * fix test * fix tests * fix tests * fix tests * fix tests * fix variable name * fix tests * fix tests * fix tests * Update .changelog/18322.txt Co-authored-by: Ganesh S <ganesh.seetharaman@hashicorp.com> * fix change log * address nits * removed unused line * doing join only when filter has nodemeta * fix tests * fix tests * Update agent/consul/catalog_endpoint.go Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> * fix tests * removed unwanted code --------- Co-authored-by: Ganesh S <ganesh.seetharaman@hashicorp.com> Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com>	1 year ago
Chris S. Kim	ad26494016	[CE] Add workload bind type and templated policy (#19077 )	1 year ago
Chris Thain	5e45db18b7	Include RequestTimeout in marshal/unmarshal of ServiceResolverConfigE… (#19031 )	1 year ago
Tim Gross	e5f5fc9301	api: add `CheckRegisterOpts` method to Agent API (#18943 ) Ongoing work to support Nomad Workload Identity for authenticating with Consul will mean that Nomad's service registration sync with Consul will want to use Consul tokens scoped to individual workloads for registering services and checks. The `CheckRegister` method in the API doesn't have an option to pass the token in, which prevent us from sharing the same Consul connection for all workloads. Add a `CheckRegisterOpts` to match the behavior of `ServiceRegisterOpts`.	1 year ago
Tim Gross	aedc03b7ae	api: add Token field to ServiceRegisterOpts (#18983 ) Ongoing work to support Nomad Workload Identity for authenticating with Consul will mean that Nomad's service registration sync with Consul will want to use Consul tokens scoped to individual workloads for registering services and checks. The `ServiceRegisterOpts` type in the API doesn't have an option to pass the token in, which prevent us from sharing the same Consul connection for all workloads. Add a `Token` field to match the behavior of `ServiceDeregisterOpts`.	1 year ago
Poonam Jadhav	4e77482e95	feat: remove resource api client from api module (#18984 ) * feat: remove resource api client from api module * fix: go mod clean up	1 year ago
John Landa	9eaa8eb026	dns token (#17936 ) * dns token fix whitespace for docs and comments fix test cases fix test cases remove tabs in help text Add changelog Peering dns test Peering dns test Partial implementation of Peered DNS test Swap to new topology lib expose dns port for integration tests on client remove partial test implementation remove extra port exposure remove changelog from the ent pr Add dns token to set-agent-token switch Add enterprise golden file Use builtin/dns template in tests Update ent dns policy Update ent dns template test remove local gen certs fix templated policy specs * add changelog * go mod tidy	1 year ago
Ronald	c8299522b5	[NET-5332] Add nomad server templated policy (#18888 ) * [NET-5332] Add nomad server templated policy * slksfd	1 year ago
Ronald	70e738ce20	Add operator audit endpoint changes (#18899 )	1 year ago
James Hartig	b2e21c103f	consul operator raft transfer-leader should send the id (#17107 ) Fixes #16955 Co-authored-by: Dhia Ayachi <dhia@hashicorp.com>	1 year ago
Ronald	1afeb6e040	[NET-5334] Added CLI commands for templated policies (#18816 )	1 year ago
wangxinyi7	426c906ee1	delete command ready (#18679 ) * delete command for resource management	1 year ago
Poonam Jadhav	48ef8b679c	Net-4292/list command (#18649 ) * feat: implement list command * refactor: apply command file parsing	1 year ago

1 2 3 4 5 ...

944 Commits (28b37812b8a415397fe1c51f8e5d44038feae159)