10219 Commits (31289371454a1c0ee1a3940ad1fc7bdda50e3513)

 

All Branches   

Search

Author	SHA1	Message	Date
R.B. Boyer	3128937145	update changelog	5 years ago
R.B. Boyer	6393edba53	connect: reconcile how upstream configuration works with discovery chains (#6225) ... * connect: reconcile how upstream configuration works with discovery chains The following upstream config fields for connect sidecars sanely integrate into discovery chain resolution: - Destination Namespace/Datacenter: Compilation occurs locally but using different default values for namespaces and datacenters. The xDS clusters that are created are named as they normally would be. - Mesh Gateway Mode (single upstream): If set this value overrides any value computed for any resolver for the entire discovery chain. The xDS clusters that are created may be named differently (see below). - Mesh Gateway Mode (whole sidecar): If set this value overrides any value computed for any resolver for the entire discovery chain. If this is specifically overridden for a single upstream this value is ignored in that case. The xDS clusters that are created may be named differently (see below). - Protocol (in opaque config): If set this value overrides the value computed when evaluating the entire discovery chain. If the normal chain would be TCP or if this override is set to TCP then the result is that we explicitly disable L7 Routing and Splitting. The xDS clusters that are created may be named differently (see below). - Connect Timeout (in opaque config): If set this value overrides the value for any resolver in the entire discovery chain. The xDS clusters that are created may be named differently (see below). If any of the above overrides affect the actual result of compiling the discovery chain (i.e. "tcp" becomes "grpc" instead of being a no-op override to "tcp") then the relevant parameters are hashed and provided to the xDS layer as a prefix for use in naming the Clusters. This is to ensure that if one Upstream discovery chain has no overrides and tangentially needs a cluster named "api.default.XXX", and another Upstream does have overrides for "api.default.XXX" that they won't cross-pollinate against the operator's wishes. Fixes #6159	5 years ago
R.B. Boyer	5e32bbdf4d	update changelog	5 years ago
R.B. Boyer	8564b6bb38	connect: validate upstreams and prevent duplicates (#6224) ... * connect: validate upstreams and prevent duplicates * Actually run Upstream.Validate() instead of ignoring it as dead code. * Prevent two upstreams from declaring the same bind address and port. It wouldn't work anyway. * Prevent two upstreams from being declared that use the same type+name+namespace+datacenter. Due to how the Upstream.Identity() function worked this ended up mostly being enforced in xDS at use-time, but it should be enforced more clearly at register-time.	5 years ago
Paul Banks	e87cef2bb8	Revert "connect: support AWS PCA as a CA provider" (#6251) ... This reverts commit 3497b7c00d.	5 years ago
Todd Radel	3497b7c00d	connect: support AWS PCA as a CA provider (#6189) ... Port AWS PCA provider from consul-ent	5 years ago
Todd Radel	2552f4a11a	connect: Support RSA keys in addition to ECDSA (#6055) ... Support RSA keys in addition to ECDSA	5 years ago
Freddy	919316f188	Update CHANGELOG.md	5 years ago
freddygv	1a14b94441	Update default gossip encryption key size to 32 bytes	5 years ago
Matt Keeler	5bb8d60786	Update CHANGELOG.md	5 years ago
Matt Keeler	1fdda51839	Fix envoy canBind (#6238) ... * Fix envoy cli canBind function The string form of an Addr was including the CIDR causing the str equals to not match. * Remove debug prints	5 years ago
hashicorp-ci	847b90288a	Merge Consul OSS branch 'master' at commit a1725e6b52	5 years ago
Matt Keeler	a1725e6b52	Fix flaky tests (#6229)	5 years ago
Matt Keeler	5288dec952	Update CHANGELOG.md	5 years ago
Matt Keeler	64bc7a6c47	Update CHANGELOG.md	5 years ago
Matt Keeler	fcc18c1675	Fix prepared query upstream endpoint generation (#6236) ... Use the correct SNI value for prepared query upstreams	5 years ago
hashicorp-ci	5ff04a303e	Release v1.6.0-beta3	5 years ago
hashicorp-ci	1527616c8c	update bindata_assetfs.go	5 years ago
Alvin Huang	b2944bdbe1	Merge remote-tracking branch 'origin/master' into release/1-6	5 years ago
Matt Keeler	0481187152	Update CHANGELOG.md	5 years ago
Matt Keeler	35e67b1d1a	Fix CA Replication when ACLs are enabled (#6201) ... Secondary CA initialization steps are: • Wait until the primary will be capable of signing intermediate certs. We use serf metadata to check the versions of servers in the primary which avoids needing a token like the previous implementation that used RPCs. We require at least one alive server in the primary and the all alive servers meet the version requirement. • Initialize the secondary CA by getting the primary to sign an intermediate When a primary dc is configured, if no existing CA is initialized and for whatever reason we cannot initialize a secondary CA the secondary DC will remain without a CA. As soon as it can it will initialize the secondary CA by pulling the primaries roots and getting the primary to sign an intermediate. This also fixes a segfault that can happen during leadership revocation. There was a spot in the secondaryCARootsWatch that was getting the CA Provider and executing methods on it without nil checking. Under normal circumstances it wont be nil but during leadership revocation it gets nil'ed out. Therefore there is a period of time between closing the stop chan and when the go routine is actually stopped where it could read a nil provider and cause a segfault.	5 years ago
Matt Keeler	59454c7edc	Set --max-obj-name-len 256 when execing Envoy (#6202) ... * Pass -max-obj-name-len 256 to envoy * Update test expectations. * Add a note about requireing the max-obj-name-len option to be set	5 years ago
Todd Radel	dbae899796	Merge pull request #6210 from hashicorp/docs/fix-ambassador-link ... Fix links to ambassador website	5 years ago
R.B. Boyer	3ca566a152	Merge pull request #6223 from hashicorp/master-merge-b3541c4f3 ... Master merge b3541c4f3	5 years ago
R.B. Boyer	c6c4a2251a	Merge Consul OSS branch master at commit b3541c4f34	5 years ago
Jack Pearkes	b3541c4f34	Putting source back into Dev Mode	5 years ago
hashicorp-ci	a42ded477c	Release v1.5.3	5 years ago
hashicorp-ci	0c9c5bfa98	update bindata_assetfs.go	5 years ago
Jack Pearkes	43996ce05f	Update CHANGELOG.md	5 years ago
Mike Morris	34984e4764	docs: add TCP half-close broken pipe to common errors (#6203)	5 years ago
Jack Pearkes	4e0a16ab2d	config: correct limit to limits in config example (#6219) ... This isn't yet documented on the website, but wanted to update this to add the missing s.	5 years ago
Matt Keeler	69629870fe	Update CHANGELOG.md	5 years ago
Matt Keeler	8b54307be2	Allow forwarding of some status RPCs (#6198) ... * Allow forwarding of some status RPCs * Update docs * add comments about not using the regular forward	5 years ago
Alvin Huang	54ef3d5a40	check vendor folder (#6006) ... * check vendor in circleci * make vendor checking step more descriptive * reorganize check-vendor and gofmt jobs	5 years ago
Alvin Huang	3c889b4e65	remove sdk and api packages (#6214)	5 years ago
Alvin Huang	3558f9cf6d	add dev docker image upload (#5879) ... * add dev docker image upload * remove the go cache since that isn't needed * add comment and image labels * get password from stdin	5 years ago
Jeff Mitchell	1ea7a34756	Make the chunking test multidimensional (#6212) ... This ensures that it's not just a single operation we restores successfully, but many. It's the same foundation, just with multiple going on at once.	5 years ago
Freddy	89158c7a76	auto-encrypt: Fix port resolution and fallback to default port (#6205) ... Auto-encrypt meant to fallback to the default port when it wasn't provided, but it hadn't been because of an issue with the error handling. We were checking against an incomplete error value: "missing port in address" vs "address $HOST: missing port in address" Additionally, all RPCs to AutoEncrypt.Sign were using a.config.ServerPort, so those were updated to use ports resolved by resolveAddrs, if they are available.	5 years ago
Matt Keeler	eab413d5d5	Update CHANGELOG.md	5 years ago
Jeff Mitchell	94c73d0c92	Chunking support (#6172) ... * Initial chunk support This uses the go-raft-middleware library to allow for chunked commits to the KV	5 years ago
Matt Keeler	3053342198	Envoy Mesh Gateway integration tests (#6187) ... * Allow setting the mesh gateway mode for an upstream in config files * Add envoy integration test for mesh gateways This necessitated many supporting changes in most of the other test cases. Add remote mode mesh gateways integration test	5 years ago
Todd Radel	569b37133a	Fix links to ambassador website	5 years ago
Freddy	199f6cc41d	Make new config when retrying testServer creation (#6204)	5 years ago
R.B. Boyer	e5e3f483c5	update changelog	5 years ago
R.B. Boyer	ad9e7b6ae9	connect: allow L7 routers to match on http methods (#6164) ... Fixes #6158	5 years ago
R.B. Boyer	85cf2706e6	connect: change router syntax for matching query parameters to resemble the syntax for matching paths and headers for consistency. (#6163) ... This is a breaking change, but only in the context of the beta series.	5 years ago
R.B. Boyer	880d149c19	update changelog	5 years ago
R.B. Boyer	1dbd92e091	connect: validate and test more of the L7 config entries (#6156)	5 years ago
R.B. Boyer	483effd496	update changelog	5 years ago
R.B. Boyer	e039dfd7f8	connect: rework how the service resolver subset OnlyPassing flag works (#6173) ... The main change is that we no longer filter service instances by health, preferring instead to render all results down into EDS endpoints in envoy and merely label the endpoints as HEALTHY or UNHEALTHY. When OnlyPassing is set to true we will force consul checks in a 'warning' state to render as UNHEALTHY in envoy. Fixes #6171	5 years ago