2212 Commits (2e72f44fdad83bb83870ce5c1e786e15bd6dbf7f)

Author	SHA1	Message	Date
Nitya Dhanushkodi	15e8b13891	Add flags to consul connect envoy for metrics merging. (#9768) ... Allows setting -prometheus-backend-port to configure the cluster envoy_prometheus_bind_addr points to. Allows setting -prometheus-scrape-path to configure which path envoy_prometheus_bind_addr exposes metrics on. -prometheus-backend-port is used by the consul-k8s metrics merging feature, to configure envoy_prometheus_bind_addr to point to the merged metrics endpoint that combines Envoy and service metrics so that one set of annotations on a Pod can scrape metrics from the service and it's Envoy sidecar. -prometheus-scrape-path is used to allow configurability of the path where prometheus metrics are exposed on envoy_prometheus_bind_addr.	4 years ago
R.B. Boyer	398b766532	xds: default to speaking xDS v3, but allow for v2 to be spoken upon request (#9658) ... - Also add support for envoy 1.17.0	4 years ago
R.B. Boyer	3b6ffc447b	xds: remove deprecated usages of xDS (#9602) ... Note that this does NOT upgrade to xDS v3. That will come in a future PR. Additionally: - Ignored staticcheck warnings about how github.com/golang/protobuf is deprecated. - Shuffled some agent/xds imports in advance of a later xDS v3 upgrade. - Remove support for envoy 1.13.x but don't add in 1.17.x yet. We have to wait until the xDS v3 support is added in a follow-up PR. Fixes #8425	4 years ago
Alex Dzyoba	098fd1797b	command/kv: Add prefix option to kv import command ... Currently when data is imported via `consul kv import` it overwrites keys under the root key. Since `consul kv export` can retrieve data for the given prefix, i.e. part of the KV tree, importing it under root may be not what users want. To mirror prefix behavior from export this PR adds prefix feature to the import command that adds prefix to all keys that are imported.	4 years ago
R.B. Boyer	6eeccc93ce	connect: update supported envoy point releases to 1.16.2, 1.15.3, 1.14.6, 1.13.7 (#9737)	4 years ago
Kyle Havlovitz	7dac583863	connect/ca: Allow ForceWithoutCrossSigning for all providers ... This allows setting ForceWithoutCrossSigning when reconfiguring the CA for any provider, in order to forcibly move to a new root in cases where the old provider isn't reachable or able to cross-sign for whatever reason.	4 years ago
Daniel Nephin	1dcafa51a4	config: make config.TestLoad_FullConfig use config.Load ... This commit makes a number of changes that should make TestLoad_FullConfig easier to work with, and make the test more like real world scenarios. * use separate files in testdata/ dir to store the config source. Separate files are much easier to edit because editors can syntax highlight json/hcl, and it makes strings easier to find. Previously trying to find strings would match strings used in other tests. * use the exported config.Load interface instead of internal NewBuilder and BuildAndValidate. * remove the tail config overrides, which are only necessary with nonZero works.	4 years ago
Daniel Nephin	32d36d0dd4	config: replace calls to config.NewBuilder with config.Load ... This is another incremental change to reduce config loading to a single small interface. All calls to NewBuilder can be replaced with Load.	4 years ago
Daniel Nephin	97a577502d	config: improve the interface of Load ... This commit reduces the interface to Load() a bit, in preparation for unexporting NewBuilder and having everything call Load. The three arguments are reduced to a single argument by moving the other two into the options struct. The three return values are reduced to two by moving the RuntimeConfig and Warnings into a LoadResult struct.	4 years ago
Hans Hasselberg	444cdeb8fb	Add flags to support CA generation for Connect (#9585)	4 years ago
Daniel Nephin	3d39359bcb	agent: move deprecated AddServiceFromSource to a test file ... The method is only used in tests, and only exists for legacy calls. There was one other package which used this method in tests. Export the AddServiceRequest and a couple of its fields so the new function can be used in those tests.	4 years ago
Daniel Nephin	6757231b82	agent: rename AddService->AddServiceFromSource ... In preparation for extracting a single AddService func that accepts a request struct.	4 years ago
R.B. Boyer	b5f9a293c9	chore: regenerate envoy golden files (#9634)	4 years ago
Matt Keeler	9215fc4e9d	Fix flaky CLI Intention Listing Test	4 years ago
Michael Hofer	3c3b67288d	cli: Add consul intention list command (based on PR #6825) (#9468) ... This PR is based on the previous work by @snuggie12 in PR #6825. It adds the command consul intention list to list all available intentions. The list functionality for intentions seems a bit overdue as it's just very handy. The web UI cannot list intentions outside of the default namespace, and using the API is sometimes not the friendliest option. ;) I cherry picked snuggie12's commits who did most of the heavy lifting (thanks again @snuggie12 for your great work!). The changes in the original commit mostly still worked on the current HEAD. On top of that I added support for namespaces and fixed the docs as they are managed differently today. Also the requested changes related to the "Connect" references in the original PRs have been addressed. Fixes #5652 Co-authored-by: Matt Hoey <mhoey05@jcu.edu>	4 years ago
Daniel Nephin	b9e60c0775	testing: skip slow tests with -short ... Add a skip condition to all tests slower than 100ms. This change was made using `gotestsum tool slowest` with data from the last 3 CI runs of master. See https://github.com/gotestyourself/gotestsum#finding-and-skipping-slow-tests With this change: ``` $ time go test -count=1 -short ./agent ok github.com/hashicorp/consul/agent 0.743s real 0m4.791s $ time go test -count=1 -short ./agent/consul ok github.com/hashicorp/consul/agent/consul 4.229s real 0m8.769s ```	4 years ago
R.B. Boyer	7c7a3e5165	command: when generating envoy bootstrap configs use the datacenter returned from the agent services endpoint (#9229) ... Fixes #9215	4 years ago
Freddy	fe728855ed	Add DC and NS support for Envoy metrics (#9207) ... This PR updates the tags that we generate for Envoy stats. Several of these come with breaking changes, since we can't keep two stats prefixes for a filter.	4 years ago
Mike Morris	7af643ac37	ci: update to Go 1.15.4 and alpine:3.12 (#9036) ... * ci: stop building darwin/386 binaries Go 1.15 drops support for 32-bit binaries on Darwin https://golang.org/doc/go1.15#darwin * tls: ConnectionState::NegotiatedProtocolIsMutual is deprecated in Go 1.15, this value is always true * correct error messages that changed slightly * Completely regenerate some TLS test data Co-authored-by: R.B. Boyer <rb@hashicorp.com>	4 years ago
Matt Keeler	7ef9b04f90	Add a CLI command for retrieving the autopilot configuration. (#9142)	4 years ago
Joel Watson	81fb937e4f	Merge pull request #9098 from hashicorp/watsonian/kv-size-breakdown ... Add detailed key size breakdown to snapshot inspect	4 years ago
Joel Watson	182333b645	Fix some minor wording issues	4 years ago
Joel Watson	94689b6ecd	Back out implicit -kvdetails functionality	4 years ago
Joel Watson	0d48559416	Length check is required here ... If one isn't included, then the nil check in the formatter never fails due to an empty slice being passed in, which causes the kv output to always get printed.	4 years ago
Joel Watson	48a358df1b	Remove trailing tabs from output	4 years ago
Joel Watson	491f2f0a57	Add more func comments	4 years ago
Joel Watson	99ec1febcc	Move kvDetails default logic	4 years ago
Joel Watson	ea804e57b4	Check for nil rather than length	4 years ago
Joel Watson	7aebd179de	Update tests for new flag names	4 years ago
Joel Watson	40a8681816	Allow omission of -kvdetails if another -kv* flag is set	4 years ago
Joel Watson	1ef259b093	Rename params to better reflect their purpose	4 years ago
Joel Watson	5ad0db73c8	Make docs for params clearer	4 years ago
Joel Watson	fbe8503258	Break KV portion of enchance into separate func	4 years ago
Joel Watson	5dd703a62a	Move KV stat gen to separate func	4 years ago
Matt Keeler	c048e86bb2	Switch to using the external autopilot module	4 years ago
Mike Morris	6396042ba7	connect: switch the default gateway port from 443 to 8443 (#9116) ... * test: update ingress gateway golden file to port 8443 * test: update Envoy flags_test to port 8443 Co-authored-by: R.B. Boyer <rb@hashicorp.com>	4 years ago
R.B. Boyer	8baf158ea8	Revert "Add namespace support for metrics (OSS) (#9117)" (#9124) ... This reverts commit 06b3b017d3.	4 years ago
Freddy	06b3b017d3	Add namespace support for metrics (OSS) (#9117)	4 years ago
Joel Watson	aabb537aed	Pull sorting into separate function	4 years ago
Joel Watson	3ee20d500a	Refactor to reduce how many vars are being passed around	4 years ago
Joel Watson	1a50aa023a	Fallback to alphabetic sorting if size is equal	4 years ago
Joel Watson	be2a212d75	Add tests for new snapshot inspect flags	4 years ago
Joel Watson	5f5b49955c	Update snapshot inspect formatter test	4 years ago
Joel Watson	eafc593d0f	Make key breakdown total size accurate	4 years ago
Joel Watson	4bf70dd857	Cleanup formatter	4 years ago
Joel Watson	208d6ebd95	Get JSON formatting working	4 years ago
Joel Watson	e7a88d4a30	This ended up not being used.	4 years ago
Joel Watson	262fb3a0c3	Add snapshot inspect filter param	4 years ago
Joel Watson	10f325dc81	Initial stab at snapshot inspect key breakdown	4 years ago
s-christoff	79ce24e9fc	cli: Add JSON and Pretty Print formatting for `consul snapshot inspect` (#9006)	4 years ago
R.B. Boyer	a2c50d3303	connect: add support for envoy 1.16.0, drop support for 1.12.x, and bump point releases as well (#8944) ... Supported versions will be: "1.16.0", "1.15.2", "1.14.5", "1.13.6"	4 years ago
s-christoff	9bb348c6c7	Enhance the output of consul snapshot inspect (#8787)	4 years ago
Blake Covarrubias	4c83ad3e02	doc: Update acl-method command example (#8845) ... * Update acl-method command example * add tailing backtick	4 years ago
R.B. Boyer	9fbcb2e68d	command: remove conditional envoy bootstrap generation for versions <=1.10.0 since those are not supported (#8855)	4 years ago
Ryan Ooi	852896b068	add tailing backtick	4 years ago
Ryan Ooi	c80b048111	Update acl-method command example	4 years ago
R.B. Boyer	1b413b0444	connect: support defining intentions using layer 7 criteria (#8839) ... Extend Consul’s intentions model to allow for request-based access control enforcement for HTTP-like protocols in addition to the existing connection-based enforcement for unspecified protocols (e.g. tcp).	4 years ago
R.B. Boyer	a2a8e9c783	connect: intentions are now managed as a new config entry kind "service-intentions" (#8834) ... - Upgrade the ConfigEntry.ListAll RPC to be kind-aware so that older copies of consul will not see new config entries it doesn't understand replicate down. - Add shim conversion code so that the old API/CLI method of interacting with intentions will continue to work so long as none of these are edited via config entry endpoints. Almost all of the read-only APIs will continue to function indefinitely. - Add new APIs that operate on individual intentions without IDs so that the UI doesn't need to implement CAS operations. - Add a new serf feature flag indicating support for intentions-as-config-entries. - The old line-item intentions way of interacting with the state store will transparently flip between the legacy memdb table and the config entry representations so that readers will never see a hiccup during migration where the results are incomplete. It uses a piece of system metadata to control the flip. - The primary datacenter will begin migrating intentions into config entries on startup once all servers in the datacenter are on a version of Consul with the intentions-as-config-entries feature flag. When it is complete the old state store representations will be cleared. We also record a piece of system metadata indicating this has occurred. We use this metadata to skip ALL of this code the next time the leader starts up. - The secondary datacenters continue to run the old intentions replicator until all servers in the secondary DC and primary DC support intentions-as-config-entries (via serf flag). Once this condition it met the old intentions replicator ceases. - The secondary datacenters replicate the new config entries as they are migrated in the primary. When they detect that the primary has zeroed it's old state store table it waits until all config entries up to that point are replicated and then zeroes its own copy of the old state store table. We also record a piece of system metadata indicating this has occurred. We use this metadata to skip ALL of this code the next time the leader starts up.	4 years ago
Hans Hasselberg	ad4e189354	add -list-primary to `consul keyring` command (#8692) ... * add -list-primary * add docs * use builder * fix multiple actions	4 years ago
Juliano Martinez	5ce309a2f7	remove nodeName call when using -service ... - fix #8734	4 years ago
freddygv	7b9d1b41d5	Resolve conflicts against master	4 years ago
freddygv	768dbaa68d	Add session flag to cookie config	4 years ago
freddygv	eab90ea9fa	Revert EnvoyConfig nesting	4 years ago
Tim Arenz	a1fe711390	Add support for -ca-path option in the connect envoy command (#8606) ... * Add support for -ca-path option in the connect envoy command * Adding changelog entry	4 years ago
Daniel Nephin	6ca45e1a61	agent: add apiServers type for managing HTTP servers ... Remove Server field from HTTPServer. The field is no longer used.	4 years ago
freddygv	cf018cb2e0	Fixup stray LB infix refs	4 years ago
freddygv	f81fe6a1a1	Remove LB infix and move injection to xds	4 years ago
R.B. Boyer	119e945c3e	connect: all config entries pick up a meta field (#8596) ... Fixes #8595	4 years ago
freddygv	63f79e5f9b	Restructure structs and other PR comments	4 years ago
Daniel Nephin	e16375216d	config: use logging.Config in RuntimeConfig ... To add structure to RuntimeConfig, and remove the need to translate into a third type.	4 years ago
Daniel Nephin	33c401a16e	logging: Setup accept io.Writer instead of []io.Writer ... Also accept a non-pointer Config, since the config is not modified	4 years ago
Daniel Nephin	5d4df54296	agent: extract dependency creation from New ... With this change, Agent.New() accepts many of the dependencies instead of creating them in New. Accepting fully constructed dependencies from a constructor makes the type easier to test, and easier to change. There are still a number of dependencies created in Start() which can be addressed in a follow up.	4 years ago
Daniel Nephin	16217fe9b9	testing: use t.Cleanup in testutil.TempFile ... So that it has the same behaviour as TempDir. Also remove the now unnecessary 'defer os.Remove'	4 years ago
Daniel Nephin	d68edcecf4	testing: Remove all the defer os.Removeall ... Now that testutil uses t.Cleanup to remove the directory the caller no longer has to manage the removal	4 years ago
R.B. Boyer	397019d970	xds: revert setting set_node_on_first_message_only to true when generating envoy bootstrap config (#8440) ... When consul is restarted and an envoy that had already sent DiscoveryRequests to the previous consul process sends a request to the new process it doesn't respect the setting and never populates DiscoveryRequest.Node for the life of the new consul process due to this bug: https://github.com/envoyproxy/envoy/issues/9682 Fixes #8430	4 years ago
Daniel Nephin	0420d91cdd	Remove LogOutput from Agent ... Now that it is no longer used, we can remove this unnecessary field. This is a pre-step in cleanup up RuntimeConfig->Consul.Config, which is a pre-step to adding a gRPCHandler component to Server for streaming. Removing this field also allows us to remove one of the return values from logging.Setup.	4 years ago
R.B. Boyer	c599a2f5f4	xds: add support for envoy 1.15.0 and drop support for 1.11.x (#8424) ... Related changes: - hard-fail the xDS connection attempt if the envoy version is known to be too old to be supported - remove the RouterMatchSafeRegex proxy feature since all supported envoy versions have it - stop using --max-obj-name-len (due to: envoyproxy/envoy#11740)	4 years ago
Marc Billow	6960afdfe3	Simple tls cert create help text typo	4 years ago
Chris Piraino	7c4cc71131	Fix envoy bootstrap logic to not append multiple self_admin clusters (#8371) ... Previously, the envoy bootstrap config would blindly copy the self_admin cluster into the list of static clusters when configuring either ReadyBindAddr, PrometheusBindAddr, or StatsBindAddr. Since ingress gateways always configure the ReadyBindAddr property, users ran into this case much more often than previously.	4 years ago
Alvin Huang	dd9f5928fc	add v to version pretty formatter (#8341) ... * add v to version pretty formatter * remove v from json version output	4 years ago
Kit Patella	0fe7e987f0	command/kv: remove error case in put and edit error message for delete	4 years ago
Kit Patella	f530fe558f	command: fix cas put when index=0 and better errors in put and delete	4 years ago
Hans Hasselberg	496fb5fc5b	add support for envoy 1.14.4, 1.13.4, 1.12.6 (#8216)	4 years ago
Matt Keeler	fb9517bae8	Merge pull request #8268 from hashicorp/feature/improved-version-output ... Add Revision to version CLI output and add JSON support	4 years ago
R.B. Boyer	1eef096dfe	xds: version sniff envoy and switch regular expressions from 'regex' to 'safe_regex' on newer envoy versions (#8222) ... - cut down on extra node metadata transmission - split the golden file generation to compare all envoy version	4 years ago
Matt Keeler	680ac0c1c6	Add Revision to version CLI output and add JSON support ... Also add JSON format support	4 years ago
Chris Piraino	ea683ebb6c	cli: Output message on success when writing/deleting entries (#7806) ... This provides a user with a better experience, knowing that the command worked appropriately. The output of the write/delete CLI commands are not going to be used in a bash script, in fact previously a success provided no ouput, so we do not have to worry about spurious text being injected into bash pipelines.	4 years ago
R.B. Boyer	462f0f37ed	connect: various changes to make namespaces for intentions work more like for other subsystems (#8194) ... Highlights: - add new endpoint to query for intentions by exact match - using this endpoint from the CLI instead of the dump+filter approach - enforcing that OSS can only read/write intentions with a SourceNS or DestinationNS field of "default". - preexisting OSS intentions with now-invalid namespace fields will delete those intentions on initial election or for wildcard namespaces an attempt will be made to downgrade them to "default" unless one exists. - also allow the '-namespace' CLI arg on all of the intention subcommands - update lots of docs	4 years ago
Matt Keeler	e2cfa93f02	Don’t leak metrics go routines in tests (#8182)	4 years ago
freddygv	c791fbc79c	Update namespaces subject-verb agreement	4 years ago
Matt Keeler	d6e05482ab	Allow cancelling startup when performing auto-config (#8157) ... Co-authored-by: Daniel Nephin <dnephin@hashicorp.com>	5 years ago
Matt Keeler	3dbbd2d37d	Implement Client Agent Auto Config ... There are a couple of things in here. First, just like auto encrypt, any Cluster.AutoConfig RPC will implicitly use the less secure RPC mechanism. This drastically modifies how the Consul Agent starts up and moves most of the responsibilities (other than signal handling) from the cli command and into the Agent.	5 years ago
Daniel Nephin	692a4a8fc8	Merge pull request #7762 from hashicorp/dnephin/warn-on-unknown-service-file ... config: warn if a config file is being skipped because of its file extension	5 years ago
Daniel Nephin	be29d6bf75	config: warn when a config file is skipped ... All commands which read config (agent, services, and validate) will now print warnings when one of the config files is skipped because it did not match an expected format. Also ensures that config validate prints all warnings.	5 years ago
Daniel Nephin	068b43df90	Enable gofmt simplify ... Code changes done automatically with 'gofmt -s -w'	5 years ago
Matt Keeler	d3881dd754	ACL Node Identities (#7970) ... A Node Identity is very similar to a service identity. Its main targeted use is to allow creating tokens for use by Consul agents that will grant the necessary permissions for all the typical agent operations (node registration, coordinate updates, anti-entropy). Half of this commit is for golden file based tests of the acl token and role cli output. Another big updates was to refactor many of the tests in agent/consul/acl_endpoint_test.go to use the same style of tests and the same helpers. Besides being less boiler plate in the tests it also uses a common way of starting a test server with ACLs that should operate without any warnings regarding deprecated non-uuid master tokens etc.	5 years ago
Daniel Nephin	219790ca49	config: Make ConfigFormat not a pointer ... The nil value was never used. We can avoid a bunch of complications by making the field a string value instead of a pointer. This change is in preparation for fixing a silent config failure.	5 years ago
Daniel Nephin	77101eee82	config: rename Flags to BuilderOpts ... Flags is an overloaded term in this context. It generally is used to refer to command line flags. This struct, however, is a data object used as input to the construction. It happens to be partially populated by command line flags, but otherwise has very little to do with them. Renaming this struct should make the actual responsibility of this struct more obvious, and remove the possibility that it is confused with command line flags. This change is in preparation for adding additional fields to BuilderOpts.	5 years ago
Daniel Nephin	85e0338136	config: remove Args field from Flags ... This field was populated for one reason, to test that it was empty. Of all the callers, only a single one used this functionality. The rest constructed a `Flags{}` struct which did not set Args. I think this shows that the logic was in the wrong place. Only the agent command needs to care about validating the args. This commit removes the field, and moves the logic to the one caller that cares. Also fix some comments.	5 years ago
Hans Hasselberg	e62a43c6cf	Support envoy 1.14.2, 1.13.2, 1.12.4 (#8057)	5 years ago
Kyle Havlovitz	6fd3b25313	Fix a CLI test failure with namespaces in enterprise	5 years ago
Kyle Havlovitz	0c8966220f	Merge pull request #8040 from hashicorp/ingress/expose-cli ... Ingress expose CLI command	5 years ago
Kyle Havlovitz	e3a725c4e0	Always allow updating the exposed service and differentiate by namespace	5 years ago
Kyle Havlovitz	edab5588d8	Add -host flag to expose command	5 years ago
Kyle Havlovitz	5958328552	Allow multiple listeners per service via expose command	5 years ago
Daniel Nephin	75cbbe2702	config: add HookWeakDecodeFromSlice ... Currently opaque config blocks (config entries, and CA provider config) are modified by PatchSliceOfMaps, making it impossible for these opaque config sections to contain slices of maps. In order to fix this problem, any lazy-decoding of these blocks needs to support weak decoding of []map[string]interface{} to a struct type before PatchSliceOfMaps is replaces. This is necessary because these config blobs are persisted, and during an upgrade an older version of Consul could read one of the new configuration values, which would cause an error. To support the upgrade path, this commit first introduces the new hooks for weak decoding of []map[string]interface{} and uses them only in the lazy-decode paths. That way, in a future release, new style configuration will be supported by the older version of Consul. This decode hook has a number of advantages: 1. It no longer panics. It allows mapstructure to report the error 2. It no longer requires the user to declare which fields are slices of structs. It can deduce that information from the 'to' value. 3. It will make it possible to preserve opaque configuration, allowing for structured opaque config.	5 years ago
Kyle Havlovitz	acae044df4	Document the namespace format for expose CLI command	5 years ago
Kyle Havlovitz	b874c8ef0c	Add connect expose CLI command	5 years ago
R.B. Boyer	4d083103e2	fix some flaky snapshot tests (#8015)	5 years ago
R.B. Boyer	833211c14c	acl: allow auth methods created in the primary datacenter to optionally create global tokens (#7899)	5 years ago
R.B. Boyer	ffb9c7d6f7	acl: remove the deprecated `acl_enforce_version_8` option (#7991) ... Fixes #7292	5 years ago
Jono Sosulska	c554ba9e10	Replace whitelist/blacklist terminology with allowlist/denylist (#7971) ... * Replace whitelist/blacklist terminology with allowlist/denylist	5 years ago
Daniel Nephin	c88fae0aac	ci: Add staticcheck and fix most errors ... Three of the checks are temporarily disabled to limit the size of the diff, and allow us to enable all the other checks in CI. In a follow up we can fix the issues reported by the other checks one at a time, and enable them.	5 years ago
Daniel Nephin	6a2d7d77c0	config: use the new HookTranslateKeys instead of lib.TranslateKeys ... With the exception of CA provider config, which will be migrated at some later time.	5 years ago
Kyle Havlovitz	b14696e32a	Standardize support for Tagged and BindAddresses in Ingress Gateways (#7924) ... * Standardize support for Tagged and BindAddresses in Ingress Gateways This updates the TaggedAddresses and BindAddresses behavior for Ingress to match Mesh/Terminating gateways. The `consul connect envoy` command now also allows passing an address without a port for tagged/bind addresses. * Update command/connect/envoy/envoy.go Co-authored-by: Freddy <freddygv@users.noreply.github.com> * PR comments * Check to see if address is an actual IP address * Update agent/xds/listeners.go Co-authored-by: Freddy <freddygv@users.noreply.github.com> * fix whitespace Co-authored-by: Chris Piraino <cpiraino@hashicorp.com> Co-authored-by: Freddy <freddygv@users.noreply.github.com>	5 years ago
Daniel Nephin	c662f0f0de	Fix a number of problems found by staticcheck ... Some of these problems are minor (unused vars), but others are real bugs (ignored errors). Co-authored-by: Matt Keeler <mkeeler@users.noreply.github.com>	5 years ago
Freddy	ccd0822539	Use proxy-id in gateway auto-registration (#7845)	5 years ago
Daniel Nephin	600645b5f9	Add unconvert linter ... To find unnecessary type convertions	5 years ago
R.B. Boyer	1efafd7523	acl: add auth method for JWTs (#7846)	5 years ago
R.B. Boyer	7414a3fa53	cli: ensure 'acl auth-method update' doesn't deep merge the Config field (#7839)	5 years ago
Kyle Havlovitz	136549205c	Merge pull request #7759 from hashicorp/ingress/tls-hosts ... Add TLS option for Ingress Gateway listeners	5 years ago
R.B. Boyer	82379779a2	cli: oss refactors to support making the auth method CLI aware of namespace rules in enterprise (#7812)	5 years ago
R.B. Boyer	56ea112908	test: make auth method cli crud test work in both oss and ent (#7800)	5 years ago
Chris Piraino	0c22eacca8	Add TLS field to ingress API structs ... - Adds test in api and command/config/write packages	5 years ago
R.B. Boyer	db870ba92b	test: make auth method cli crud test helper ignore the default namespace (#7799)	5 years ago
Chris Piraino	f40833d094	Allow Hosts field to be set on an ingress config entry ... - Validate that this cannot be set on a 'tcp' listener nor on a wildcard service. - Add Hosts field to api and test in consul config write CLI - xds: Configure envoy with user-provided hosts from ingress gateways	5 years ago
Chris Piraino	b73a13fc9e	Remove service_subset field from ingress config entry ... We decided that this was not a useful MVP feature, and just added unnecessary complexity	5 years ago
R.B. Boyer	22eb016153	acl: add MaxTokenTTL field to auth methods (#7779) ... When set to a non zero value it will limit the ExpirationTime of all tokens created via the auth method.	5 years ago
s-christoff	f9956c1c46	cli: Add -config flag to "acl authmethod update/create" (#7776)	5 years ago
R.B. Boyer	ca52ba7068	acl: add DisplayName field to auth methods (#7769) ... Also add a few missing acl fields in the api.	5 years ago
Freddy	137a2c32c6	TLS Origination for Terminating Gateways (#7671)	5 years ago
R.B. Boyer	b989967791	cli: ensure that 'snapshot save' is fsync safe and also only writes to the requested file on success (#7698)	5 years ago
R.B. Boyer	5f1518c37c	cli: fix usage of gzip.Reader to better detect corrupt snapshots during save/restore (#7697)	5 years ago
Chris Piraino	3d2de925d8	Add support for ingress-gateway in CLI command (#7618) ... * Add support for ingress-gateway in CLI command - Supports -register command - Creates a static Envoy listener that exposes only the /ready API so that we can register a TCP healthcheck against the ingress gateway itself - Updates ServiceAddressValue.String() to be more in line with Value()	5 years ago
Daniel Nephin	25b585d0bf	Fix golden file for envoy tests ... The envoy version was updated after the PR which added this test was opened, and merged before the test was merged, so it ended up with the wrong version.	5 years ago
Daniel Nephin	6b860c926f	Merge pull request #7608 from hashicorp/dnephin/grpc-default-scheme ... command/envoy: enable TLS when CONSUL_HTTP_ADDR=https://...	5 years ago
Hans Hasselberg	66415be90e	connect: support envoy 1.14.1 (#7624)	5 years ago
Freddy	aae14b3951	Add decode rules for Expose cfg in service-defaults (#7611)	5 years ago
Daniel Nephin	8b6861518f	Fix CONSUL_HTTP_ADDR=https not enabling TLS ... Use the config instead of attempting to reparse the env var.	5 years ago
Daniel Nephin	0888c6575b	Step 3: fix a bug in api.NewClient and fix the tests ... The api client should never rever to HTTP if the user explicitly requested TLS. This change broke some tests because the tests always use an non-TLS http server, but some tests explicitly enable TLS.	5 years ago
Daniel Nephin	1a8ffec6a7	Step 2: extract the grpc address logic and a new type ... The new grpcAddress function contains all of the logic to translate the command line options into the values used in the template. The new type has two advantages. 1. It introduces a logical grouping of values in the BootstrapTplArgs struct which is exceptionally large. This grouping makes the struct easier to understand because each set of nested values can be seen as a single entity. 2. It gives us a reasonable return value for this new function.	5 years ago
Daniel Nephin	830b4a15f6	Step 1: move all the grpcAddr logic into the same spot ... There is no reason a reader should have to jump around to find this value. It is only used in 1 place	5 years ago
Freddy	b61214ef24	Fix regression with gateway registration and update docs (#7582)	5 years ago
Daniel Nephin	0d8edc3e27	Merge pull request #7562 from hashicorp/dnephin/remove-tname-from-name ... testing: Remove old default value from NewTestAgent() calls	5 years ago
Daniel Nephin	e759daafdd	Rename NewTestAgentWithFields to StartTestAgent ... This function now only starts the agent. Using: git grep -l 'StartTestAgent(t, true,' | \ xargs sed -i -e 's/StartTestAgent(t, true,/StartTestAgent(t,/g'	5 years ago
Daniel Nephin	f9f6b14533	Convert the remaining calls to NewTestAgentWithFields ... After removing the t.Name() parameter with sed, convert the last few tests which use a custom name to call NewTestAgentWithFields instead.	5 years ago
Daniel Nephin	475659a132	Remove name from NewTestAgent ... Using: git grep -l 'NewTestAgent(t, t.Name(),' | \ xargs sed -i -e 's/NewTestAgent(t, t.Name(),/NewTestAgent(t,/g'	5 years ago
Freddy	90576060bc	Add config entry for terminating gateways (#7545) ... This config entry will be used to configure terminating gateways. It accepts the name of the gateway and a list of services the gateway will represent. For each service users will be able to specify: its name, namespace, and additional options for TLS origination. Co-authored-by: Kyle Havlovitz <kylehav@gmail.com> Co-authored-by: Chris Piraino <cpiraino@hashicorp.com>	5 years ago
Kyle Havlovitz	c911174327	Add config entry/state for Ingress Gateways (#7483) ... * Add Ingress gateway config entry and other relevant structs * Add api package tests for ingress gateways * Embed EnterpriseMeta into ingress service struct * Add namespace fields to api module and test consul config write decoding * Don't require a port for ingress gateways * Add snakeJSON and camelJSON cases in command test * Run Normalize on service's ent metadata Sadly cannot think of a way to test this in OSS. * Every protocol requires at least 1 service * Validate ingress protocols * Update agent/structs/config_entry_gateways.go Co-authored-by: Chris Piraino <cpiraino@hashicorp.com> Co-authored-by: Freddy <freddygv@users.noreply.github.com>	5 years ago
Daniel Nephin	09d0876b6c	command: remove unused logOutput field	5 years ago
Matt Keeler	37694bbb9c	Add optional JSON format to the ACL CLI commands output (#7198) ... * Add ACL CLI commands output format option. Add command level formatter, that incapsulates command output printing logiс that depends on the command `-format` option. Move Print* functions from acl_helpers to prettyFormatter. Add jsonFormatter. * Return error code in case of formatting failure. * Add acl commands -format option to doc.	5 years ago
Freddy	18d356899c	Enable CLI to register terminating gateways (#7500) ... * Enable CLI to register terminating gateways * Centralize gateway proxy configuration	5 years ago
Artur Mullakhmetov	845b9c23fe	Return error code in case of formatting failure.	5 years ago
Artur Mullakhmetov	eab5b81d91	Add ACL CLI commands output format option. ... Add command level formatter, that incapsulates command output printing logiс that depends on the command `-format` option. Move Print* functions from acl_helpers to prettyFormatter. Add jsonFormatter.	5 years ago
Daniel Nephin	e5d6273a48	command/envoy: Refactor flag parsing/validation (#7504)	5 years ago
Daniel Nephin	a95974cf79	Remove unnecessary methods ... They call only a single method and add no additional functionality	5 years ago
Daniel Nephin	8df3746927	cmd: use env vars as defaults ... Insted of setting them afterward in Run. This change required a small re-ordering of the test to patch the environment before calling New()	5 years ago
Daniel Nephin	6e10616b13	Fix tests failing on master ... The default version was changed in https://github.com/hashicorp/consul/pull/7452 which caused these tests to fail.	5 years ago
Hans Hasselberg	d5f4b8c3a3	envoy: default to 1.13.1 (#7452)	5 years ago
Hans Hasselberg	bf6a91af94	docs: fix filenames (#7453)	5 years ago
Chris Piraino	d3dd49b79c	Log "vew version available" message at info level (#7462)	5 years ago
R.B. Boyer	dfe5ba134b	fix flaky TestCatalogListNodesCommand_verticalBar test (#7422)	5 years ago
R.B. Boyer	6adad71125	wan federation via mesh gateways (#6884) ... This is like a Möbius strip of code due to the fact that low-level components (serf/memberlist) are connected to high-level components (the catalog and mesh-gateways) in a twisty maze of references which make it hard to dive into. With that in mind here's a high level summary of what you'll find in the patch: There are several distinct chunks of code that are affected: * new flags and config options for the server * retry join WAN is slightly different * retry join code is shared to discover primary mesh gateways from secondary datacenters * because retry join logic runs in the *agent* and the results of that operation for primary mesh gateways are needed in the *server* there are some methods like `RefreshPrimaryGatewayFallbackAddresses` that must occur at multiple layers of abstraction just to pass the data down to the right layer. * new cache type `FederationStateListMeshGatewaysName` for use in `proxycfg/xds` layers * the function signature for RPC dialing picked up a new required field (the node name of the destination) * several new RPCs for manipulating a FederationState object: `FederationState:{Apply,Get,List,ListMeshGateways}` * 3 read-only internal APIs for debugging use to invoke those RPCs from curl * raft and fsm changes to persist these FederationStates * replication for FederationStates as they are canonically stored in the Primary and replicated to the Secondaries. * a special derivative of anti-entropy that runs in secondaries to snapshot their local mesh gateway `CheckServiceNodes` and sync them into their upstream FederationState in the primary (this works in conjunction with the replication to distribute addresses for all mesh gateways in all DCs to all other DCs) * a "gateway locator" convenience object to make use of this data to choose the addresses of gateways to use for any given RPC or gossip operation to a remote DC. This gets data from the "retry join" logic in the agent and also directly calls into the FSM. * RPC (`:8300`) on the server sniffs the first byte of a new connection to determine if it's actually doing native TLS. If so it checks the ALPN header for protocol determination (just like how the existing system uses the type-byte marker). * 2 new kinds of protocols are exclusively decoded via this native TLS mechanism: one for ferrying "packet" operations (udp-like) from the gossip layer and one for "stream" operations (tcp-like). The packet operations re-use sockets (using length-prefixing) to cut down on TLS re-negotiation overhead. * the server instances specially wrap the `memberlist.NetTransport` when running with gateway federation enabled (in a `wanfed.Transport`). The general gist is that if it tries to dial a node in the SAME datacenter (deduced by looking at the suffix of the node name) there is no change. If dialing a DIFFERENT datacenter it is wrapped up in a TLS+ALPN blob and sent through some mesh gateways to eventually end up in a server's :8300 port. * a new flag when launching a mesh gateway via `consul connect envoy` to indicate that the servers are to be exposed. This sets a special service meta when registering the gateway into the catalog. * `proxycfg/xds` notice this metadata blob to activate additional watches for the FederationState objects as well as the location of all of the consul servers in that datacenter. * `xds:` if the extra metadata is in place additional clusters are defined in a DC to bulk sink all traffic to another DC's gateways. For the current datacenter we listen on a wildcard name (`server.<dc>.consul`) that load balances all servers as well as one mini-cluster per node (`<node>.server.<dc>.consul`) * the `consul tls cert create` command got a new flag (`-node`) to help create an additional SAN in certs that can be used with this flavor of federation.	5 years ago
Alex Dzyoba	4137d06f9f	command: change delim in columnize to funny node names (#6652) ... When node name contains vertical bar symbol some commands output is garbled because `|` is used as a delimiter in `columnize.SimpleFormat`. This commit changes format string to use `\x1f` - ASCII unit separator[1] as a delimiter and also adds test to cover this case. Affected commands: * `consul catalog nodes` * `consul members` * `consul operator raft list-peers` * `consul intention get` Fixes #3951. [1]: https://en.wikipedia.org/wiki/Delimiter#Solutions	5 years ago
Johannes Scheuermann	f8ded993af	agent: log error when agent crashes in an early stage (#7411)	5 years ago
Chris Piraino	d7fdb249fc	Fix -mesh-gateway flag help text (#7265)	5 years ago
Lars Lehtonen	26d706eecd	monitor: fix dropped error (#7206)	5 years ago
Hans Hasselberg	6739fe6e83	connect: add validations around intermediate cert ttl (#7213)	5 years ago
Hans Hasselberg	9cb7adb304	add envoy version 1.12.2 and 1.13.0 to the matrix (#7240) ... * add 1.12.2 * add envoy 1.13.0 * Introduce -envoy-version to get 1.10.0 passing. * update old version and fix consul-exec case * add envoy_version and fix check * Update Envoy CLI tests to account for the 1.13 compatibility changes. Co-authored-by: Matt Keeler <mkeeler@users.noreply.github.com>	5 years ago
R.B. Boyer	36982d5274	cli: fix typo in -namespace help text (#7225)	5 years ago
Paschalis Tsilias	a335aa57c5	Expose Envoy's /stats for statsd agents (#7173) ... * Expose Envoy /stats for statsd agents; Add testcases * Remove merge conflict leftover * Add support for prefix instead of path; Fix docstring to mirror these changes * Add new config field to docs; Add testcases to check that /stats/prometheus is exposed as well * Parametrize matchType (prefix or path) and value * Update website/source/docs/connect/proxies/envoy.md Co-Authored-By: Paul Banks <banks@banksco.de> Co-authored-by: Paul Banks <banks@banksco.de>	5 years ago
Michael Hofer	4ab3af0ede	docs: add missing Autopilot -min-quorum documentation (#7192)	5 years ago
Lars Lehtonen	699d1b2acb	cli: check previously ignored errors when updating a policy (#6565)	5 years ago
R.B. Boyer	cf29bd4dcf	cli: improve the file safety of 'consul tls' subcommands (#7186) ... - also fixing the signature of file.WriteAtomicWithPerms	5 years ago
Matt Keeler	bfc03ec587	Fix a couple bugs regarding intentions with namespaces (#7169)	5 years ago
Chris Piraino	401221de58	Allow users to configure either unstructured or JSON logging (#7130) ... * hclog Allow users to choose between unstructured and JSON logging	5 years ago
Anthony Scalisi	beb928f8de	fix spelling errors (#7135)	5 years ago
Matt Keeler	c09693e545	Updates to Config Entries and Connect for Namespaces (#7116)	5 years ago
Paul Lesiak	527daba03c	bug: Consul lock does not receive signals if lock not acquired (#5909)	5 years ago
Hans Hasselberg	804eb17094	connect: check if intermediate cert needs to be renewed. (#6835) ... Currently when using the built-in CA provider for Connect, root certificates are valid for 10 years, however secondary DCs get intermediates that are valid for only 1 year. There is no mechanism currently short of rotating the root in the primary that will cause the secondary DCs to renew their intermediates. This PR adds a check that renews the cert if it is half way through its validity period. In order to be able to test these changes, a new configuration option was added: IntermediateCertTTL which is set extremely low in the tests.	5 years ago
Aestek	ba8fd8296f	Add support for dual stack IPv4/IPv6 network (#6640) ... * Use consts for well known tagged adress keys * Add ipv4 and ipv6 tagged addresses for node lan and wan * Add ipv4 and ipv6 tagged addresses for service lan and wan * Use IPv4 and IPv6 address in DNS	5 years ago
Hans Hasselberg	ab2f2484ad	connect: use inline_string instead for envoy ca(#7024)	5 years ago
Matt Keeler	c276e2a634	Revert "Remove docs refs to NS inference from ACL token" (#6976) ... This reverts commit 3a8426de9c. # Conflicts: # command/flags/http.go # website/source/api/acl/binding-rules.html.md # website/source/api/acl/policies.html.md # website/source/api/acl/roles.html.md # website/source/api/acl/tokens.html.md # website/source/api/kv.html.md # website/source/api/session.html.md # website/source/docs/commands/_http_api_namespace_options.html.md	5 years ago
Matt Keeler	34e6e23d43	Change how namespaces are specified for the CLI (#6960)	5 years ago
Hans Hasselberg	1661041046	envoy: replace ca filename with inline_bytes. (#6822)	5 years ago
freddygv	3a8426de9c	Remove docs refs to NS inference from ACL token	5 years ago
Matt Keeler	5934f803bf	Sync of OSS changes to support namespaces (#6909)	5 years ago
Matt Keeler	a704ebe639	Add Namespace support to the API module and the CLI commands (#6874) ... Also update the Docs and fixup the HTTP API to return proper errors when someone attempts to use Namespaces with an OSS agent. Add Namespace HTTP API docs Make all API endpoints disallow unknown fields	5 years ago
Aestek	6817676223	Fix consul connect token env variable doc (#5942) ... The cli documentation for consul connect commands incorrectly indicated to use CONSUL_TOKEN instead of CONSUL_HTTP_TOKEN env var.	5 years ago
Sarah Adams	aed5cb7669	give feedback to CLI user on forceleave command if node does not exist (#6841)	5 years ago
Matt Keeler	b069d6777b	OSS KV Modifications to Support Namespaces	5 years ago
Chris Piraino	646da639ee	Allow services register command to register an unnamed check ... The logic in parsing data files and converting them to data structures accidentally removed healthchecks with no Name field, even though we explicitly state in API documentation that is allowed. We remove the check for "len(results.Checks) == 1" because if the length of the array is more than 0, we know that it is not a zero value array. This allows us to register a singular, unnamed check via the CLI. Fixes #6796	5 years ago
Sarah Christoff	5e1c6e907b	Set MinQuorum variable in Autopilot (#6654) ... * Add MinQuorum to Autopilot	5 years ago
rerorero	86c8e48dd9	fix: incorrect struct tag and WaitGroup usage (#6649) ... * remove duplicated json tag * fix: incorrect wait group usage	5 years ago
Sarah Christoff	5e26971864	Prune Unhealthy Agents (#6571) ... * Add -prune flag to ForceLeave	5 years ago
Freddy	fdd10dd8b8	Expose HTTP-based paths through Connect proxy (#6446) ... Fixes: #5396 This PR adds a proxy configuration stanza called expose. These flags register listeners in Connect sidecar proxies to allow requests to specific HTTP paths from outside of the node. This allows services to protect themselves by only listening on the loopback interface, while still accepting traffic from non Connect-enabled services. Under expose there is a boolean checks flag that would automatically expose all registered HTTP and gRPC check paths. This stanza also accepts a paths list to expose individual paths. The primary use case for this functionality would be to expose paths for third parties like Prometheus or the kubelet. Listeners for requests to exposed paths are be configured dynamically at run time. Any time a proxy, or check can be registered, a listener can also be created. In this initial implementation requests to these paths are not authenticated/encrypted.	5 years ago
Sarah Adams	001137e5e5	test: ensure all TestAgent constructions use a constructor (#6443) ... ensure all TestAgent constructions use a constructor to get start retries + test logs going to the right place Fixes #6435	5 years ago
Sarah Adams	4ed5515fca	refactor & add better retry logic to NewTestAgent (#6363) ... Fixes #6361	5 years ago
R.B. Boyer	ae79cdab1b	connect: introduce ExternalSNI field on service-defaults (#6324) ... Compiling this will set an optional SNI field on each DiscoveryTarget. When set this value should be used for TLS connections to the instances of the target. If not set the default should be used. Setting ExternalSNI will disable mesh gateway use for that target. It also disables several service-resolver features that do not make sense for an external service.	5 years ago
R.B. Boyer	72207256b9	xds: improve how envoy metrics are emitted (#6312) ... Since generated envoy clusters all are named using (mostly) SNI syntax we can have envoy read the various fields out of that structure and emit it as stats labels to the various telemetry backends. I changed the delimiter for the 'customization hash' from ':' to '~' because ':' is always reencoded by envoy as '_' when generating metrics keys.	5 years ago