93 Commits (39136f46fea5a31f57a02824b4da70727d6bf979)

Author	SHA1	Message	Date
Thomas Eckert	419677cc9e	[NET-6420] Add MeshConfiguration Controller stub (#19745) ... * Add meshconfiguration/controller * Add MeshConfiguration Registration function * Fix the TODOs on the RegisterMeshGateway function * Call RegisterMeshConfiguration * Add comment to MeshConfigurationRegistration * Add a test for Reconcile and some comments	1 year ago
Chris S. Kim	5107764115	Move test setup out of subtest (#19753)	1 year ago
Ganesh S	ba2422596f	Add tenancy tests for routes controller (#19706)	1 year ago
Ganesh S	4020c002d6	Add tenancy tests for proxy cfg controller (#19649)	1 year ago
Ashesh Vidyut	d68a23aa85	NET 6539 - Add tenancy tests for folder - internal/mesh/internal/controllers/sidecarproxy (#19646) ... * Add tenancy tests for folder - internal/mesh/internal/controllers/sidecarproxy * removed rej files * added missed out file	1 year ago
Ashesh Vidyut	443461318a	NET 6525 (#19645) ... Removed resourcetest func	1 year ago
Ashesh Vidyut	fbc2a58733	NET 6442 - Add tenancy to explicit destinations controller (#19644) ... Add tenancy to explicit destinations controller	1 year ago
R.B. Boyer	b21851c903	test: add test helper to detect if the current build is enterprise (#19201) ... This can help conditionally change test behavior if the test is executing in enterprise without the need to split the test with build tags.	1 year ago
Kumar Kavish	68e7f27fd2	[NET-6438] Add tenancy to xDS Tests (#19551) ... * [NET-6438] Add tenancy to xDS Tests * [NET-6438] Add tenancy to xDS Tests - Fixing imports * [NET-6438] Add tenancy to xDS Tests - Added cleanup post test run * [NET-6356] Add tenancy to xDS Tests - Added cleanup post test run * [NET-6438] Add tenancy to xDS Tests - using t.Cleanup instead of defer delete * [NET-6438] Add tenancy to xDS Tests - rebased * [NET-6438] Add tenancy to xDS Tests - rebased	1 year ago
Nathan Coleman	40c57f10a0	NET-6391 Initialize controller for MeshGateway resource (#19552) ... * Generate resource_types for MeshGateway by specifying spec option * Register MeshGateway type w/ TODOs for hooks * Initialize controller for MeshGateway resources * Add meshgateway to list of v2 resource dependencies for golden test * Scope MeshGateway resource to partition	1 year ago
Ashesh Vidyut	515eed8c7c	Net 6439 (#19517) ... * node health controller tenancy * some prog * some fixes * revert * pr comment resolved * removed name * Add namespace and tenancy in sidecar proxy controller test * revert node health controller * clean up data * fix local * copy from ENT * removed dup code * removed tenancy * add test tenancies	1 year ago
John Murret	caaff73337	add DeliverLatest as common function for use by Manager and ProxyTracker Open (#19564) ... Open add DeliverLatest as common function for use by Manager and ProxyTracker	1 year ago
John Murret	d94d316204	NET-6319 - L7 routes have statePrefix of upstream. and should have a full path (#19473)	1 year ago
John Murret	77e9a50f8b	Source / local_app golden tests to include all protocols. (#19436) ... * cover all protocols in local_app golden tests * fix xds tests * updating latest * fix broken test * add sorting of routers to TestBuildLocalApp to get rid of the flaking	1 year ago
Matt Keeler	5698353652	Resource Hook Pre-Decode Utilities (#18548) ... Add some generic type hook wrappers to first decode the data There seems to be a pattern for Validation, Mutation and Write Authorization hooks where they first need to decode the Any data before doing the domain specific work. This PR introduces 3 new functions to generate wrappers around the other hooks to pre-decode the data into a DecodedResource and pass that in instead of the original pbresource.Resource. This PR also updates the various catalog data types to use the new hook generators.	1 year ago
Michael Zalimeni	a7803bd829	[NET-6305] xds: Ensure v2 route match and protocol are populated for gRPC (#19343) ... * xds: Ensure v2 route match is populated for gRPC Similar to HTTP, ensure that route match config (which is required by Envoy) is populated when default values are used. Because the default matches generated for gRPC contain a single empty `GRPCRouteMatch`, and that proto does not directly support prefix-based config, an interpretation of the empty struct is needed to generate the same output that the `HTTPRouteMatch` is explicitly configured to provide in internal/mesh/internal/controllers/routes/generate.go. * xds: Ensure protocol set for gRPC resources Add explicit protocol in `ProxyStateTemplate` builders and validate it is always set on clusters. This ensures that HTTP filters and `http2_protocol_options` are populated in all the necessary places for gRPC traffic and prevents future unintended omissions of non-TCP protocols. Co-authored-by: John Murret <john.murret@hashicorp.com> --------- Co-authored-by: John Murret <john.murret@hashicorp.com>	1 year ago
John Murret	59d4962564	NET-6079 - wire up sidecarproxy golden file inputs into xds controller - sources (#19241) ... * NET-5397 - wire up golden tests from sidecar-proxy controller for xds controller and xdsv2 * WIP * WIP * everything matching except leafCerts. need to mock those * single port destinations working except mixed destinations * golden test input to xds controller tests for destinations * proposed fix for failover group naming errors * clean up test to use helper. * clean up test to use helper. * fix test file * add docstring for test function. * add docstring for test function. * fix linting error * fixing test after route fix merged into main * first source test works * WIP * modify all source files * source tests pass * fixing tests after bug fix in main	1 year ago
John Murret	9775758d0c	NET-5397 - wire up destination golden tests from sidecar-proxy controller for xds controller and xdsv2 (#19167) ... * NET-5397 - wire up golden tests from sidecar-proxy controller for xds controller and xdsv2 * WIP * WIP * everything matching except leafCerts. need to mock those * single port destinations working except mixed destinations * golden test input to xds controller tests for destinations * proposed fix for failover group naming errors * clean up test to use helper. * clean up test to use helper. * fix test file * add docstring for test function. * add docstring for test function. * fix linting error * fixing test after route fix merged into main	1 year ago
Iryna Shustava	809bf1deb8	mesh: ensure route configs are named uniquely per port (#19323)	1 year ago
Nitya Dhanushkodi	def66ddf0e	mesh: provide missing domain to route configurations in ProxyStateTemplate (#19298) ... * add empty domains * update unit tests	1 year ago
Nitya Dhanushkodi	51b58cd910	fix expose paths (#19257) ... When testing adding http probes to apps, I ran into some issues which I fixed here: - The listener should be listening on the exposed listener port, updated that. - The listener and route names were pointing to the path of the exposed path. In my test, the path was "/" resulting in an empty string path. Also, the path may not be unique across exposed path listeners, so I decided to use the path+exposed port as the unique identifier.	1 year ago
John Murret	9f4f99c626	NET-6097 - sidecar proxy controller - give name to first failover policy target (#19239)	1 year ago
R.B. Boyer	df8ea430c6	mesh: add DestinationPolicy ACL hook tenancy tests (#19178) ... Enhance the DestinationPolicy ACL hook tests to cover tenanted situations. These tests will only execute in enterprise.	1 year ago
Semir Patel	ad177698f7	resource: enforce lowercase v2 resource names (#19218)	1 year ago
R.B. Boyer	6c7d0759e4	mesh: add xRoute ACL hook tenancy tests (#19177) ... Enhance the xRoute ACL hook tests to cover tenanted situations. These tests will only execute in enterprise.	1 year ago
John Murret	a7fbd00865	NET-5073 - ProxyConfiguration: implement various connection options (#19187) ... * NET-5073 - ProxyConfiguration: implement various connection options * PR feedback - LocalConnection and InboundConnection do not affect exposed routes. configure L7 route destinations. fix connection proto sequence numbers. * add timeout to L7 Route Destinations	1 year ago
Iryna Shustava	105ebfdd00	catalog, mesh: implement missing ACL hooks (#19143) ... This change adds ACL hooks to the remaining catalog and mesh resources, excluding any computed ones. Those will for now continue using the default operator:x permissions. It refactors a lot of the common testing functions so that they can be re-used between resources. There are also some types that we don't yet support (e.g. virtual IPs) that this change adds ACL hooks to for future-proofing.	1 year ago
Iryna Shustava	2ea33e9b86	mesh: add more validations to Destinations resource (#19202)	1 year ago
Iryna Shustava	e94d6ceca6	mesh: add validation hook to proxy configuration (#19186)	1 year ago
R.B. Boyer	99f7a1219e	catalog: add metadata filtering to refine workload selectors (#19198) ... This implements the Filter field on pbcatalog.WorkloadSelector to be a post-fetch in-memory filter using the https://github.com/hashicorp/go-bexpr expression language to filter resources based on their envelope metadata fields. All existing usages of WorkloadSelector should be able to make use of the filter.	1 year ago
R.B. Boyer	f0e4897736	mesh: ensure that xRoutes have ParentRefs that have matching Tenancy to the enclosing resource (#19176) ... We don't want an xRoute controlling traffic for a Service in another tenancy.	1 year ago
Nitya Dhanushkodi	95d9b2c7e4	[NET-4931] xdsv2, sidecarproxycontroller, l4 trafficpermissions: support L7 (#19185) ... * xdsv2: support l7 by adding xfcc policy/headers, tweaking routes, and make a bunch of listeners l7 tests pass * sidecarproxycontroller: add l7 local app support * trafficpermissions: make l4 traffic permissions work on l7 workloads * rename route name field for consistency with l4 cluster name field * resolve conflicts and rebase * fix: ensure route name is used in l7 destination route name as well. previously it was only in the route names themselves, now the route name and l7 destination route name line up	1 year ago
Iryna Shustava	e3cb4ec35e	mesh: properly handle missing workload protocols (#19172) ... Sometimes workloads could come with unspecified protocols such as when running on Kubernetes. Currently, if this is the case, we will just default to tcp protocol. However, to make sidecar-proxy controller work with l7 protocols we should instead inherit the protocol from service. This change adds tracking for services that a workload is part of and attempts to inherit the protocol whenever services a workload is part of doesn't have conflicting protocols.	1 year ago
Iryna Shustava	a39eec0ef4	mesh: fix race in the sidecar-proxy controller test (#19183)	1 year ago
John Murret	dbca544d25	NET-5951 - Unique route names for implicit routes (#19174) ... * NET-5951 - Unique route names for implicit routes * remove use of datacenter * PR feedback	1 year ago
Iryna Shustava	54a12ab3c9	mesh: sidecar proxy controller improvements (#19083) ... This change builds on #19043 and #19067 and updates the sidecar controller to use those computed resources. This achieves several benefits: * The cache is now simplified which helps us solve for previous bugs (such as multiple Upstreams/Destinations targeting the same service would overwrite each other) * We no longer need proxy config cache * We no longer need to do merging of proxy configs as part of the controller logic * Controller watches are simplified because we no longer need to have complex mapping using cache and can instead use the simple ReplaceType mapper. It also makes several other improvements/refactors: * Unifies all caches into one. This is because originally the caches were more independent, however, now that they need to interact with each other it made sense to unify them where sidecar proxy controller uses one cache with 3 bimappers * Unifies cache and mappers. Mapper already needed all caches anyway and so it made sense to make the cache do the mapping also now that the cache is unified. * Gets rid of service endpoints watches. This was needed to get updates in a case when service's identities have changed and we need to update proxy state template's spiffe IDs for those destinations. This will however generate a lot of reconcile requests for this controller as service endpoints objects can change a lot because they contain workload's health status. This is solved by adding a status to the service object tracking "bound identities" and have service endpoints controller update it. Having service's status updated allows us to get updates in the sidecar proxy controller because it's already watching service objects * Add a watch for workloads. We need it so that we get updates if workload's ports change. This also ensures that we update cached identities in case workload's identity changes.	1 year ago
Iryna Shustava	ad06c96456	mesh: add computed destinations with a controller that computes them (#19067) ... This commit adds a new type ComputedDestinations that will contain all destinations from any Destinations resources and will be name-aligned with a workload. This also adds an explicit-destinations controller that computes these resources. This is needed to simplify the tracking we need to do currently in the sidecar-proxy controller and makes it easier to query all explicit destinations that apply to a workload.	1 year ago
Iryna Shustava	60b75a55f7	mesh: implement exposed paths (#19044) ... Implement exposed paths listeners in the sidecar proxy controller.	1 year ago
John Murret	6cbd417f29	NET-5822 - Add default outbound router in TProxy (#19087) ... * NET-5822 - Add default outbound router in TProxy * fixing connection timeout to be 5 s instead of 10 seconds	1 year ago
Iryna Shustava	c35df12c95	mesh: Add ComputedProxyConfiguration and a controller that computes it. (#19043) ... * Introduce a new type `ComputedProxyConfiguration` and add a controller for it. This is needed for two reasons. The first one is that external integrations like kubernetes may need to read the fully computed and sorted proxy configuration per workload. The second reasons is that it makes sidecar-proxy controller logic quite a bit simpler as it no longer needs to do this. * Generalize workload selection mapper and fix a bug where it would delete IDs from the tree if only one is left after a removal is done.	1 year ago
R.B. Boyer	754ab9abf2	mesh: ensure we add the virtual port number for L7 implicit upstreams (#19085)	1 year ago
Eric Haberkorn	f2b7b4591a	Fix Traffic Permissions Default Deny (#19028) ... Whenver a traffic permission exists for a given workload identity, turn on default deny. Previously, this was only working at the port level.	1 year ago
John Murret	d67e5c6e35	NET-5590 - authorization: check for identity:write in CA certs, xds server, and getting envoy bootstrap params (#19049) ... * NET-5590 - authorization: check for identity:write in CA certs, xds server, and getting envoy bootstrap params * gofmt file	1 year ago
Iryna Shustava	3ea6afb4d4	mesh: rename Upstreams and UpstreamsConfiguration to Destinations* (#18995)	1 year ago
Iryna Shustava	e6b724d062	catalog,mesh,auth: Move resource types to the proto-public module (#18935)	1 year ago
R.B. Boyer	9e48607893	mesh: compute more of the xRoute features into ComputedRoutes (#18980) ... Convert more of the xRoutes features that were skipped in an earlier PR into ComputedRoutes and make them work: - DestinationPolicy defaults - more timeouts - load balancer policy - request/response header mutations - urlrewrite - GRPCRoute matches	1 year ago
R.B. Boyer	11d6b0df45	mesh: store bound reference pointers on a ComputedRoutes resource and use during reconcile (#18965) ... xRoute resource types contain a slice of parentRefs to services that they manipulate traffic for. All xRoutes that have a parentRef to given Service will be merged together to generate a ComputedRoutes resource name-aligned with that Service. This means that a write of an xRoute with 2 parent ref pointers will cause at most 2 reconciles for ComputedRoutes. If that xRoute's list of parentRefs were ever to be reduced, or otherwise lose an item, that subsequent map event will only emit events for the current set of refs. The removed ref will not cause the generated ComputedRoutes related to that service to be re-reconciled to omit the influence of that xRoute. To combat this, we will store on the ComputedRoutes resource a BoundResources []*pbresource.Reference field with references to all resources that were used to influence the generated output. When the routes controller reconciles, it will use a bimapper to index this influence, and the dependency mappers for the xRoutes will look themselves up in that index to discover additional (former) ComputedRoutes that need to be notified as well.	1 year ago
R.B. Boyer	633c6c9458	mesh: add ACL checks for xRoute resources (#18926) ... xRoute resources are not name-aligned with the Services they control. They have a list of "parent ref" services that they alter traffic flow for, and they contain a list of "backend ref" services that they direct that traffic to. The ACLs should be: - list: (default) - read: - ALL service:<parent_ref_service>:read - write: - ALL service:<parent_ref_service>:write - ALL service:<backend_ref_service>:read	1 year ago
R.B. Boyer	43a8dbb188	mesh: add ACL checks for DestinationPolicy resources (#18920) ... DestinationPolicy resources are name-aligned with the Service they control. The ACLs should be: - list: (default) - read: service:<resource_name>:read - write: service:<resource_name>:write	1 year ago
Iryna Shustava	d88888ee8b	catalog,mesh,auth: Bump versions to v2beta1 (#18930)	1 year ago