28b4b3a85d
Add x-forwarded-client-cert headers
...
Description
Add x-fowarded-client-cert information on trusted incoming connections.
Envoy provides support forwarding and annotating the
x-forwarded-client-cert header via the forward_client_cert_details
set_current_client_cert_details filter fields. It would be helpful for
consul to support this directly in its config. The escape hatches are
a bit cumbersome for this purpose.
This has been implemented on incoming connections to envoy. Outgoing
(from the local service through the sidecar) will not have a
certificate, and so are left alone.
A service on an incoming connection will now get headers something like this:
```
X-Forwarded-Client-Cert:[By=spiffe://efad7282-d9b2-3298-f6d8-38b37fb58df3.consul/ns/default/dc/dc1/svc/counting;Hash=61ad5cbdfcb50f5a3ec0ca60923d61613c149a9d4495010a64175c05a0268ab2;Cert="-----BEGIN%20CERTIFICATE-----%0AMIICHDCCAcOgAwIBAgIBCDAKBggqhkjOPQQDAjAxMS8wLQYDVQQDEyZwcmktMTli%0AYXdyb2YuY29uc3VsLmNhLmVmYWQ3MjgyLmNvbnN1bDAeFw0yMjA0MjkwMzE0NTBa%0AFw0yMjA1MDIwMzE0NTBaMAAwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARVIZ7Y%0AZEXfbOGBfxGa7Vuok1MIng%2FuzLQK2xLVlSTIPDbO5hstTGP%2B%2FGx182PYFP3jYqk5%0Aq6rYWe1wiPNMA30Io4H8MIH5MA4GA1UdDwEB%2FwQEAwIDuDAdBgNVHSUEFjAUBggr%0ABgEFBQcDAgYIKwYBBQUHAwEwDAYDVR0TAQH%2FBAIwADApBgNVHQ4EIgQgrp4q50oX%0AHHghMbxz5Bk8OJFWMdfgH0Upr350WlhyxvkwKwYDVR0jBCQwIoAgUe6uERAIj%2FLM%0AyuFzDc3Wbp9TGAKBJYAwyhF14ToOQCMwYgYDVR0RAQH%2FBFgwVoZUc3BpZmZlOi8v%0AZWZhZDcyODItZDliMi0zMjk4LWY2ZDgtMzhiMzdmYjU4ZGYzLmNvbnN1bC9ucy9k%0AZWZhdWx0L2RjL2RjMS9zdmMvZGFzaGJvYXJkMAoGCCqGSM49BAMCA0cAMEQCIDwb%0AFlchufggNTijnQ5SUcvTZrWlZyq%2FrdVC20nbbmWLAiAVshNNv1xBqJI1NmY2HI9n%0AgRMfb8aEPVSuxEHhqy57eQ%3D%3D%0A-----END%20CERTIFICATE-----%0A";Chain="-----BEGIN%20CERTIFICATE-----%0AMIICHDCCAcOgAwIBAgIBCDAKBggqhkjOPQQDAjAxMS8wLQYDVQQDEyZwcmktMTli%0AYXdyb2YuY29uc3VsLmNhLmVmYWQ3MjgyLmNvbnN1bDAeFw0yMjA0MjkwMzE0NTBa%0AFw0yMjA1MDIwMzE0NTBaMAAwWTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAARVIZ7Y%0AZEXfbOGBfxGa7Vuok1MIng%2FuzLQK2xLVlSTIPDbO5hstTGP%2B%2FGx182PYFP3jYqk5%0Aq6rYWe1wiPNMA30Io4H8MIH5MA4GA1UdDwEB%2FwQEAwIDuDAdBgNVHSUEFjAUBggr%0ABgEFBQcDAgYIKwYBBQUHAwEwDAYDVR0TAQH%2FBAIwADApBgNVHQ4EIgQgrp4q50oX%0AHHghMbxz5Bk8OJFWMdfgH0Upr350WlhyxvkwKwYDVR0jBCQwIoAgUe6uERAIj%2FLM%0AyuFzDc3Wbp9TGAKBJYAwyhF14ToOQCMwYgYDVR0RAQH%2FBFgwVoZUc3BpZmZlOi8v%0AZWZhZDcyODItZDliMi0zMjk4LWY2ZDgtMzhiMzdmYjU4ZGYzLmNvbnN1bC9ucy9k%0AZWZhdWx0L2RjL2RjMS9zdmMvZGFzaGJvYXJkMAoGCCqGSM49BAMCA0cAMEQCIDwb%0AFlchufggNTijnQ5SUcvTZrWlZyq%2FrdVC20nbbmWLAiAVshNNv1xBqJI1NmY2HI9n%0AgRMfb8aEPVSuxEHhqy57eQ%3D%3D%0A-----END%20CERTIFICATE-----%0A";Subject="";URI=spiffe://efad7282-d9b2-3298-f6d8-38b37fb58df3.consul/ns/default/dc/dc1/svc/dashboard]
```
Closes #12852
2022-05-04 08:50:58 -07:00
8ebb515bfc
Merge pull request #12917 from hashicorp/add-release-config-key
...
Add config key to the promote-staging event
2022-05-03 17:26:46 -04:00
03ac931b52
Merge pull request #12631 from driesgroblerw/patch-1
...
Updated the link to acl-policies
2022-05-03 14:59:05 -04:00
8d655ded4c
chore(ci): fix backport-assistant for stable website
2022-05-03 14:36:46 -04:00
0696ed24c8
Merge pull request #12885 from hashicorp/acl-err-cache
...
Store and return RPC error in ACL cache entries
2022-05-03 10:44:22 -07:00
76d62a14f5
Return ACLRemoteError from cache and test it correctly
2022-05-03 10:05:26 -07:00
e899e06c29
chore(ci): fix backport assistant
2022-05-03 12:41:12 -04:00
bd87505bf2
ci: upgrade bats and the circle machine executors to get integration tests to function again ( #12918 )
...
Bonus change: send less context when building the test-sds-server to
speed up the setup.
2022-05-03 11:21:32 -05:00
561221a343
Add config key to the promote-staging event
2022-05-03 11:58:14 -04:00
3b3f001580
[sync oss] api: add peering api module ( #12911 )
2022-05-02 11:49:05 -07:00
54119f3225
docs: Add example Envoy escape hatch configs ( #12764 )
...
Add example escape hatch configurations for all supported override
types.
2022-05-02 11:25:59 -07:00
b2a005342b
chore(ci): add initial support for backport assistant
2022-05-02 11:14:32 -04:00
cf12f8af20
Merge pull request #12762 from hashicorp/jkirschner-hashicorp-patch-1
...
docs: use correct previous name of recovery token
2022-04-29 18:35:56 -04:00
9791bad136
peering: Make Upstream peer-aware ( #12900 )
...
Adds DestinationPeer field to Upstream.
Adds Peer field to UpstreamID and its string conversion functions.
2022-04-29 18:12:51 -04:00
5be6f3402d
Merge pull request #12902 from hashicorp/jkirschner-hashicorp-patch-2
...
docs: fix typo
2022-04-29 17:59:26 -04:00
c1aacc2728
docs: fix typo
2022-04-29 17:57:21 -04:00
0028d927e3
Merge pull request #12893 from hashicorp/docs/improve-consul-server-resilience
...
docs: add guidance on improving Consul resilience
2022-04-29 15:42:09 -04:00
0d66301ea7
Cleanup peering files that used error types that were removed ( #12892 )
2022-04-29 14:02:26 -04:00
de51780eb8
docs: add guidance on improving Consul resilience
...
Discuss available strategies for improving server-level and infrastructure-level
fault tolerance in Consul.
2022-04-29 10:58:03 -07:00
e286dc2a50
Merge pull request #12891 from hashicorp/docs-api-gateway-0.2.1
...
Docs: update for API Gateway v0.2.1
2022-04-29 10:50:04 -07:00
474385d153
Unify various status errors into one HTTP error type. ( #12594 )
...
Replaces specific error types for HTTP Status codes with
a generic HTTPError type.
Co-authored-by: Chris S. Kim <ckim@hashicorp.com>
2022-04-29 13:42:49 -04:00
e8a1a1eb68
Dcos: update for API Gateway v0.2.1
2022-04-29 09:52:00 -07:00
d04fe6ca2c
Merge pull request #11810 from hashicorp/update-enterprise-packaging-in-feature-docs
...
Update enterprise packaging in feature docs
2022-04-28 19:38:59 -04:00
964afedd13
docs: improve ent overview headings
2022-04-28 16:27:34 -07:00
1ca903d28d
docs: explicitly fill all ent feature matrix cells
2022-04-28 12:41:37 -07:00
2626963db9
Add a Github action to remind people about backport automation ( #12884 )
2022-04-28 14:52:41 -04:00
0d8b187ea1
Store and return rpc error in acl cache entries
2022-04-28 09:08:55 -07:00
62311368c6
Merge pull request #12874 from hashicorp/japple-api-gw-fix-install-doc
...
Docs: updated versions on install page and other minor fixes.
2022-04-27 17:24:51 -07:00
144a27da3d
Docs: updated versions on install page and other minor fixes.
2022-04-27 16:52:52 -07:00
80417f02dc
website(consul-api-gateway): fixup stray div tag and step 8 link rendering ( #12873 )
2022-04-27 19:36:01 -04:00
3bf17020d9
Merge pull request #12872 from hashicorp/markdown-fix
...
docs: fixes makdown leakage
2022-04-27 14:20:19 -07:00
dbaed47da2
docs: fixes makdown leakage
2022-04-27 14:15:39 -07:00
33ccefcc4e
docs: update HCP Consul feature matrix
2022-04-27 12:44:00 -07:00
6a4ca9c5a7
Merge pull request #12871 from hashicorp/apigw-crd-version
...
Update version pin for consul-api-gateway install docs
2022-04-27 14:23:05 -05:00
8208c2daf9
Update version pin for consul-api-gateway CRD install
2022-04-27 15:07:02 -04:00
359d62a49d
Merge pull request #12863 from hashicorp/api-gateway-v0.2-docs
...
Update product docs for release of Consul API Gateway v0.2
2022-04-27 12:01:23 -07:00
1e84407681
Update minimum Consul version in Tech Specs
2022-04-27 14:55:55 -04:00
24682ccc8a
correction to the API Gateway 0.2 release notes.
2022-04-27 11:53:27 -07:00
0104383203
Instruct user to update apiGateway.image in values.yaml
2022-04-27 14:47:15 -04:00
fb1dcc6eb1
Adding release notes for API Gateway v0.2
2022-04-27 11:44:39 -07:00
d039e0088f
Hide clipboard for codeblocks that shouldn't be copied
2022-04-27 14:37:51 -04:00
ac04a1251f
hid copy fn for codeblocks that don't need it
2022-04-27 11:34:44 -07:00
195ec096bb
website(consul-api-gateway): add ReferencePolicy to overview docs ( #12861 )
...
* website(consul-api-gateway): add ReferencePolicy to overview docs
* website(consul-api-gateway): bump required Consul Helm chart version
For allowing Consul API Gateway controller to read ReferencePolicy
resources and UX improvement re-using connectInject.consulNamespaces
config for Consul API Gateway config.
* added referencepolicy documentation to route section
* Update website/content/docs/api-gateway/consul-api-gateway-install.mdx
Co-authored-by: Mike Morris <mikemorris@users.noreply.github.com>
* Update website/content/docs/api-gateway/consul-api-gateway-install.mdx
Co-authored-by: Mike Morris <mikemorris@users.noreply.github.com>
* Update website/content/docs/api-gateway/consul-api-gateway-install.mdx
Co-authored-by: Mike Morris <mikemorris@users.noreply.github.com>
* Update website/content/docs/api-gateway/consul-api-gateway-install.mdx
Co-authored-by: Mike Morris <mikemorris@users.noreply.github.com>
* Update website/content/docs/api-gateway/consul-api-gateway-install.mdx
Co-authored-by: Mike Morris <mikemorris@users.noreply.github.com>
* Update consul-api-gateway-install.mdx
* Update consul-api-gateway-install.mdx
* Update website/content/docs/api-gateway/consul-api-gateway-install.mdx
Co-authored-by: Nathan Coleman <nathandanielcoleman@gmail.com>
* Update website/content/docs/api-gateway/consul-api-gateway-install.mdx
Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>
* Update website/content/docs/api-gateway/consul-api-gateway-install.mdx
* Update website/content/docs/api-gateway/consul-api-gateway-install.mdx
* Update website/content/docs/api-gateway/index.mdx
Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>
* Update website/content/docs/api-gateway/index.mdx
* Update website/content/docs/api-gateway/index.mdx
Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>
Co-authored-by: Sarah Alsmiller <sarah.alsmiller@hashicorp.com>
Co-authored-by: sarahalsmiller <100602640+sarahalsmiller@users.noreply.github.com>
Co-authored-by: Nathan Coleman <nathandanielcoleman@gmail.com>
Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>
2022-04-27 14:25:42 -04:00
0474b35c62
Update website/content/docs/api-gateway/upgrade-specific-versions.mdx
...
Co-authored-by: Karl Cardenas <kcardenas@hashicorp.com>
2022-04-27 14:24:28 -04:00
ba0080a80e
Update website/content/docs/api-gateway/upgrade-specific-versions.mdx
...
Co-authored-by: Karl Cardenas <kcardenas@hashicorp.com>
2022-04-27 14:23:57 -04:00
21b7b18197
Update website/content/docs/api-gateway/upgrade-specific-versions.mdx
...
Co-authored-by: Karl Cardenas <kcardenas@hashicorp.com>
2022-04-27 14:23:48 -04:00
d2234fc6f7
Update website/content/docs/api-gateway/upgrade-specific-versions.mdx
...
Co-authored-by: Karl Cardenas <kcardenas@hashicorp.com>
2022-04-27 14:14:36 -04:00
45be1d370f
Update website/content/docs/api-gateway/upgrade-specific-versions.mdx
...
Co-authored-by: Karl Cardenas <kcardenas@hashicorp.com>
2022-04-27 14:14:27 -04:00
1c17b2c9c3
Update consul-api-gateway pin in installation instructions
2022-04-27 14:12:19 -04:00
d3a23229bb
Remove Consul pin from installation instructions
...
The consul-k8s chart has the correct version defaulted, and having it pinned here is another thing we have to include in all upgrade instructions
2022-04-27 14:11:51 -04:00
Mark Anderson