consul

Commit Graph

Author	SHA1	Message	Date
Semir Patel	317240fca7	Resource validation hook for `Write` endpoint (#16950 )	2 years ago
Semir Patel	686f49346c	Check acls on resource `Read`, `List`, and `WatchList` (#16842 )	2 years ago
John Maguire	92be8bd762	APIGW: Routes with duplicate parents should be invalid (#16926 ) * ensure route parents are unique when creating an http route * Ensure tcp route parents are unique * Added unit tests	2 years ago
John Eikenberry	97173725b7	log warning about certificate expiring sooner and with more details The old setting of 24 hours was not enough time to deal with an expiring certificates. This change ups it to 28 days OR 40% of the full cert duration, whichever is shorter. It also adds details to the log message to indicate which certificate it is logging about and a suggested action.	2 years ago
Chris Thain	175bb1a303	Wasm Envoy HTTP extension (#16877 )	2 years ago
Semir Patel	1794484298	Resource `Delete` endpoint (#16756 )	2 years ago
Dan Upton	4fa2537b3b	Resource `Write` endpoint (#16786 )	2 years ago
Dan Upton	671d5825ca	Raft storage backend (#16619 )	2 years ago
cskh	a319953576	docs: add envoy to the proxycfg diagram (#16834 ) * docs: add envoy to the proxycfg diagram	2 years ago
Freddy	f6de5ff635	Allow dialer to re-establish terminated peering (#16776 ) Currently, if an acceptor peer deletes a peering the dialer's peering will eventually get to a "terminated" state. If the two clusters need to be re-peered the acceptor will re-generate the token but the dialer will encounter this error on the call to establish: "failed to get addresses to dial peer: failed to refresh peer server addresses, will continue to use initial addresses: there is no active peering for "<<<ID>>>"" This is because in `exchangeSecret().GetDialAddresses()` we will get an error if fetching addresses for an inactive peering. The peering shows up as inactive at this point because of the existing terminated state. Rather than checking whether a peering is active we can instead check whether it was deleted. This way users do not need to delete terminated peerings in the dialing cluster before re-establishing them.	2 years ago
Chris S. Kim	a5397b1f23	Connect CA Primary Provider refactor (#16749 ) * Rename Intermediate cert references to LeafSigningCert Within the Consul CA subsystem, the term "Intermediate" is confusing because the meaning changes depending on provider and datacenter (primary vs secondary). For example, when using the Consul CA the "ActiveIntermediate" may return the root certificate in a primary datacenter. At a high level, we are interested in knowing which CA is responsible for signing leaf certs, regardless of its position in a certificate chain. This rename makes the intent clearer. * Move provider state check earlier * Remove calls to GenerateLeafSigningCert GenerateLeafSigningCert (formerly known as GenerateIntermediate) is vestigial in non-Vault providers, as it simply returns the root certificate in primary datacenters. By folding Vault's intermediate cert logic into `GenerateRoot` we can encapsulate the intermediate cert handling within `newCARoot`. * Move GenerateLeafSigningCert out of PrimaryProvidder Now that the Vault Provider calls GenerateLeafSigningCert within GenerateRoot, we can remove the method from all other providers that never used it in a meaningful way. * Add test for IntermediatePEM * Rename GenerateRoot to GenerateCAChain "Root" was being overloaded in the Consul CA context, as different providers and configs resulted in a single root certificate or a chain originating from an external trusted CA. Since the Vault provider also generates intermediates, it seems more accurate to call this a CAChain.	2 years ago
Eric Haberkorn	a6d69adcf5	Add default resolvers to disco chains based on the default sameness group (#16837 )	2 years ago
Derek Menteer	8d40cf9858	Add sameness-group to exported-services config entries (#16836 ) This PR adds the sameness-group field to exported-service config entries, which allows for services to be exported to multiple destination partitions / peers easily.	2 years ago
Dan Upton	651549c97d	storage: fix resource leak in Watch (#16817 )	2 years ago
Eric Haberkorn	0d1d2fc4c9	add order by locality failover to Consul enterprise (#16791 )	2 years ago
Ronald	b64674623e	Copyright headers for missing files/folders (#16708 ) * copyright headers for agent folder	2 years ago
Ronald	94ec4eb2f4	copyright headers for agent folder (#16704 ) * copyright headers for agent folder * Ignore test data files * fix proto files and remove headers in agent/uiserver folder * ignore deep-copy files	2 years ago
John Maguire	c833464daf	Update normalization of route refs (#16789 ) * Use merge of enterprise meta's rather than new custom method * Add merge logic for tcp routes * Add changelog * Normalize certificate refs on gateways * Fix infinite call loop * Explicitly call enterprise meta	2 years ago
Michael Wilkerson	e5d58c59c9	changes to support new PQ enterprise fields (#16793 )	2 years ago
Semir Patel	440f11203f	Resource service List(..) endpoint (#16753 )	2 years ago
Dhia Ayachi	10df4d83aa	add ip rate limiter controller OSS parts (#16790 )	2 years ago
Kyle Havlovitz	42c5b29713	Allocate virtual ip for resolver/router/splitter config entries (#16760 )	2 years ago
Semir Patel	032aba3175	WatchList(..) endpoint for the resource service (#16726 )	2 years ago
John Maguire	351bdc3c0d	Fix struct tags for TCPService enterprise meta (#16781 ) * Fix struct tags for TCPService enterprise meta * Add changelog	2 years ago
Semir Patel	3415689eb6	Read(...) endpoint for the resource service (#16655 )	2 years ago
Derek Menteer	2236975011	Change partition for peers in discovery chain targets (#16769 ) This commit swaps the partition field to the local partition for discovery chains targeting peers. Prior to this change, peer upstreams would always use a value of default regardless of which partition they exist in. This caused several issues in xds / proxycfg because of id mismatches. Some prior fixes were made to deal with one-off id mismatches that this PR also cleans up, since they are no longer needed.	2 years ago
John Eikenberry	0b1dc4ec36	tests instantiating clients w/o shutting down (#16755 ) noticed via their port still in use messages.	2 years ago
Poonam Jadhav	3df271959c	fix: remove unused tenancy category from rate limit spec (#16740 )	2 years ago
Dhia Ayachi	3ba0eb5074	delete config when nil (#16690 ) * delete config when nil * fix mock interface implementation * fix handler test to use the right assertion * extract DeleteConfig as a separate API. * fix mock limiter implementation to satisfy the new interface * fix failing tests * add test comments	2 years ago
Eric Haberkorn	495ad4c7ef	add enterprise xds tests (#16738 )	2 years ago
Eric Haberkorn	3c5c53aa80	fix bug where pqs that failover to a cluster peer dont un-fail over (#16729 )	2 years ago
cskh	7f6f6891f7	fix: gracefully fail on invalid port number (#16721 )	2 years ago
John Maguire	8dd1d73874	Remove unused are hosts set check (#16691 ) * Remove unused are hosts set check * Remove all traces of unused 'AreHostsSet' parameter * Remove unused Hosts attribute * Remove commented out use of snap.APIGateway.Hosts	2 years ago
Nitya Dhanushkodi	b9bd2c3780	peering: peering partition failover fixes (#16673 ) add local source partition for peered upstreams	2 years ago
John Maguire	1ef9f4dade	Fix route subscription when using namespaces (#16677 ) * Fix route subscription when using namespaces * Update changelog * Fix changelog entry to reference that the bug was enterprise only	2 years ago
Melisa Griffin	606f8fbbab	Adds check to verify that the API Gateway is being created with at least one listener	2 years ago
Poonam Jadhav	9c64731a56	feat: add category annotation to RPC and gRPC methods (#16646 )	2 years ago
Eric Haberkorn	7477f52a16	add sameness groups to discovery chains (#16671 )	2 years ago
Andrew Stucki	501b87fd31	[API Gateway] Fix invalid cluster causing gateway programming delay (#16661 ) * Add test for http routes * Add fix * Fix tests * Add changelog entry * Refactor and fix flaky tests	2 years ago
Eric Haberkorn	eaa39f4ef5	add sameness group support to service resolver failover and redirects (#16664 )	2 years ago
Eric Haberkorn	57e034b746	fix confusing spiffe ids in golden tests (#16643 )	2 years ago
wangxinyi7	152c75349e	net 2731 ip config entry OSS version (#16642 ) * ip config entry * name changing * move to ent * ent version * renaming * change format * renaming * refactor * add default values	2 years ago
John Maguire	ff5887a99e	Update e2e tests for namespaces (#16627 ) * Refactored "NewGatewayService" to handle namespaces, fixed TestHTTPRouteFlattening test * Fixed existing http_route tests for namespacing * Squash aclEnterpriseMeta for ResourceRefs and HTTPServices, accept namespace for creating connect services and regular services * Use require instead of assert after creating namespaces in http_route_tests * Refactor NewConnectService and NewGatewayService functions to use cfg objects to reduce number of method args * Rename field on SidecarConfig in tests from `SidecarServiceName` to `Name` to avoid stutter	2 years ago
Freddy	724b752ca7	Backport ENT-4704 (#16612 )	2 years ago
Derek Menteer	8f75d99299	Fix issue with trust bundle read ACL check. (#16630 ) This commit fixes an issue where trust bundles could not be read by services in a non-default namespace, unless they had excessive ACL permissions given to them. Prior to this change, `service:write` was required in the default namespace in order to read the trust bundle. Now, `service:write` to a service in any namespace is sufficient.	2 years ago
Chris S. Kim	d5677e5680	Preserve CARoots when updating Vault CA configuration (#16592 ) If a CA config update did not cause a root change, the codepath would return early and skip some steps which preserve its intermediate certificates and signing key ID. This commit re-orders some code and prevents updates from generating new intermediate certificates.	2 years ago
Derek Menteer	f2902e6608	Add sameness-group configuration entry. (#16608 ) This commit adds a sameness-group config entry to the API and structs packages. It includes some validation logic and a new memdb index that tracks the default sameness-group for each partition. Sameness groups will simplify the effort of managing failovers / intentions / exports for peers and partitions. Note that this change purely to introduce the configuration entry and does not include the full functionality of sameness-groups.	2 years ago
Ashvitha	f95ffe0355	Allow HCP metrics collection for Envoy proxies Co-authored-by: Ashvitha Sridharan <ashvitha.sridharan@hashicorp.com> Co-authored-by: Freddy <freddygv@users.noreply.github.com> Add a new envoy flag: "envoy_hcp_metrics_bind_socket_dir", a directory where a unix socket will be created with the name `<namespace>_<proxy_id>.sock` to forward Envoy metrics. If set, this will configure: - In bootstrap configuration a local stats_sink and static cluster. These will forward metrics to a loopback listener sent over xDS. - A dynamic listener listening at the socket path that the previously defined static cluster is sending metrics to. - A dynamic cluster that will forward traffic received at this listener to the hcp-metrics-collector service. Reasons for having a static cluster pointing at a dynamic listener: - We want to secure the metrics stream using TLS, but the stats sink can only be defined in bootstrap config. With dynamic listeners/clusters we can use the proxy's leaf certificate issued by the Connect CA, which isn't available at bootstrap time. - We want to intelligently route to the HCP collector. Configuring its addreess at bootstrap time limits our flexibility routing-wise. More on this below. Reasons for defining the collector as an upstream in `proxycfg`: - The HCP collector will be deployed as a mesh service. - Certificate management is taken care of, as mentioned above. - Service discovery and routing logic is automatically taken care of, meaning that no code changes are required in the xds package. - Custom routing rules can be added for the collector using discovery chain config entries. Initially the collector is expected to be deployed to each admin partition, but in the future could be deployed centrally in the default partition. These config entries could even be managed by HCP itself.	2 years ago
Eric Haberkorn	e298f506a5	Add Peer Locality to Discovery Chains (#16588 ) Add peer locality to discovery chains	2 years ago
Eric Haberkorn	57e2493415	allow setting locality on services and nodes (#16581 )	2 years ago

1 2 3 4 5 ...

4977 Commits (317240fca772e1ab34420c5646741430307121b8)