consul

Commit Graph

Author	SHA1	Message	Date
sarahalsmiller	32ce33825d	[Security] Secvuln 8633 Consul configuration allowed repeated keys (#21908 ) * upgrade hcl package and account for possiblity of duplicates existing already in the cache * upgrade to new tag * add defensive line to prevent potential forever loop * o mod tidy and changelog * Update acl/policy.go * fix raft reversion * go mod tidy * fix test * remove duplicate key in test * remove duplicates from test cases * clean up * go mod tidy * go mod tidy * pull in new hcl tag	1 week ago
Michael Zalimeni	d9206fc7e2	[NET-1151 NET-11228] security: Add request normalization and header match options to prevent L7 intentions bypass (#21816 ) mesh: add options for HTTP incoming request normalization Expose global mesh configuration to enforce inbound HTTP request normalization on mesh traffic via Envoy xDS config. mesh: enable inbound URL path normalization by default mesh: add support for L7 header match contains and ignore_case Enable partial string and case-insensitive matching in L7 intentions header match rules. ui: support L7 header match contains and ignore_case Co-authored-by: Phil Renaud <phil@riotindustries.com> test: add request normalization integration bats tests Add both "positive" and "negative" test suites, showing normalization in action as well as expected results when it is not enabled, for the same set of test cases. Also add some alternative service container test helpers for verifying raw HTTP request paths, which is difficult to do with Fortio. docs: update security and reference docs for L7 intentions bypass prevention - Update security docs with best practices for service intentions configuration - Update configuration entry references for mesh and intentions to reflect new values and add guidance on usage	1 month ago
R.B. Boyer	3e6f1c1fe1	remove v2 tenancy, catalog, and mesh (#21592 ) * remove v2 tenancy, catalog, and mesh - Inline the v2tenancy experiment to false - Inline the resource-apis experiment to false - Inline the hcp-v2-resource-apis experiment to false - Remove ACL policy templates and rule language changes related to workload identities (a v2-only concept) (e.g. identity and identity_prefix) - Update the gRPC endpoint used by consul-dataplane to no longer respond specially for v2 - Remove stray v2 references scattered throughout the DNS v1.5 newer implementation. * changelog * go mod tidy on consul containers * lint fixes from ENT --------- Co-authored-by: John Murret <john.murret@hashicorp.com>	3 months ago
Poonam Jadhav	cc2c8fb92b	NET-5912/service-defaults protocol validation (#21593 ) * fix: add validation for protocol field on service-defaults config entry * test: update test cases with correct protocol	3 months ago
Nitya Dhanushkodi	ed738a6f98	fix: use Envoy's default for validate_clusters to fix breaking routes when some backend clusters don't exist (#21587 )	3 months ago
John Murret	dcad90639f	NET-10685 - Remove dns v2 code (#21598 ) * NET-10685 - Remove dns v2 code * adding missing erro * add missing license info.	3 months ago
Nathan Coleman	04d95d2eda	Use text/template instead of html/template for ACL template policy generation (#21303 )	5 months ago
Dhia Ayachi	1f4caaedf2	upgrade deep-copy version, upgrade go to 1.22.3 (#21113 ) * upgrade deep-copy version, upgrade go to 1.22.3 * add changelog	6 months ago
John Murret	04940e2c78	additional changes to ensure sameness groups without DefaultForFailover can be used for DNS (#21107 )	6 months ago
John Murret	9b2c1be053	NET-5879 - expose sameness group param on service health endpoint and move sameness group health fallback logic into HealthService RPC layer (#21096 ) * NET-5879 - move the filter for non-passing to occur in the health RPC layer rather than the callers of the RPC * fix import of slices * NET-5879 - expose sameness group param on service health endpoint and move sameness group health fallback logic into HealthService RPC layer * fixing deepcopy * fix license headers	6 months ago
John Murret	a975b04302	NET-5879 - move the filter for non-passing to occur in the health RPC layer rather than the callers of the RPC (#21098 ) * NET-5879 - move the filter for non-passing to occur in the health RPC layer rather than the callers of the RPC * fix import of slices * fix test	6 months ago
Nathan Coleman	5e9f02d4be	[NET-8091] Add file-system-certificate config entry for API gateway (#20873 ) * Define file-system-certificate config entry * Collect file-system-certificate(s) referenced by api-gateway onto snapshot * Add file-system-certificate to config entry kind allow lists * Remove inapplicable validation This validation makes sense for inline certificates since Consul server is holding the certificate; however, for file system certificates, Consul server never actually sees the certificate. * Support file-system-certificate as source for listener TLS certificate * Add more required mappings for the new config entry type * Construct proper TLS context based on certificate kind * Add support or SDS in xdscommon * Remove unused param * Adds back verification of certs for inline-certificates * Undo tangential changes to TLS config consumption * Remove stray curly braces * Undo some more tangential changes * Improve function name for generating API gateway secrets * Add changelog entry * Update .changelog/20873.txt Co-authored-by: Jared Kirschner <85913323+jkirschner-hashicorp@users.noreply.github.com> * Add some nil-checking, remove outdated TODO * Update test assertions to include file-system-certificate * Add documentation for file-system-certificate config entry Add new doc to nav * Fix grammar mistake * Rename watchmaps, remove outdated TODO --------- Co-authored-by: Melisa Griffin <melisa.griffin@hashicorp.com> Co-authored-by: Jared Kirschner <85913323+jkirschner-hashicorp@users.noreply.github.com>	7 months ago
Derek Menteer	ac83ac1343	Fix streaming RPCs for agentless. (#20868 ) * Fix streaming RPCs for agentless. This PR fixes an issue where cross-dc RPCs were unable to utilize the streaming backend due to having the node name set. The result of this was the agent-cache being utilized, which would cause high cpu utilization and memory consumption due to the fact that it keeps queries alive for 72 hours before purging inactive entries. This resource consumption is compounded by the fact that each pod in consul-k8s gets a unique token. Since the agent-cache uses the token as a component of the key, the same query is duplicated for each pod that is deployed. * Add changelog.	8 months ago
sarahalsmiller	262f435800	NET-6821 Disable Terminating Gateway Auto Host Header Rewrite (#20802 ) * disable terminating gateway auto host rewrite * add changelog * clean up unneeded additional snapshot fields * add new field to docs * squash * fix test	8 months ago
Chris S. Kim	26661a1c3b	Add default intention policy (#20544 )	10 months ago
Derek Menteer	922844b8e0	Fix issue with persisting proxy-defaults (#20481 ) Fix issue with persisting proxy-defaults This resolves an issue introduced in hashicorp/consul#19829 where the proxy-defaults configuration entry with an HTTP protocol cannot be updated after it has been persisted once and a router exists. This occurs because the protocol field is not properly pre-computed before being passed into validation functions.	10 months ago
Lord-Y	758ddf84e9	Case sensitive route match (#19647 ) Add case insensitive param on service route match This commit adds in a new feature that allows service routers to specify that paths and path prefixes should ignore upper / lower casing when matching URLs. Co-authored-by: Derek Menteer <105233703+hashi-derek@users.noreply.github.com>	10 months ago
Dhia Ayachi	d641998641	Fix to not create a watch to `Internal.ServiceDump` when mesh gateway is not used (#20168 ) This add a fix to properly verify the gateway mode before creating a watch specific to mesh gateways. This watch have a high performance cost and when mesh gateways are not used is not used. This also adds an optimization to only return the nodes when watching the Internal.ServiceDump RPC to avoid unnecessary disco chain compilation. As watches in proxy config only need the nodes.	10 months ago
Dan Stough	d52e80b619	[OSS] feat: add experiments flag for v2 dns and skeleton interfaces (#20115 ) feat: add experiments flag for v2 dns and skeleton interfaces	11 months ago
Dhia Ayachi	f2b26ac194	Hash based config entry replication (#19795 ) * add a hash to config entries when normalizing * add GetHash and implement comparing hashes * only update if the Hash is different * only update if the Hash is different and not 0 * fix proto to include the Hash * fix proto gen * buf format * add SetHash and fix tests * fix config load tests * fix state test and config test * recalculate hash when restoring config entries * fix snapshot restore test * add changelog * fix missing normalize, fix proto indexes and add normalize test	12 months ago
Dhia Ayachi	d93f7f730d	parse config protocol on write to optimize disco-chain compilation (#19829 ) * parse config protocol on write to optimize disco-chain compilation * add changelog	12 months ago
Ronald	dc02fa695f	[NET-6251] Nomad client templated policy (#19827 )	12 months ago
John Maguire	a0240e3794	[NET-5688] APIGateway UI Topology Fixes (#19657 ) * Update catalog and ui endpoints to show APIGateway in gateway service topology view * Added initial implementation for service view * updated ui * Fix topology view for gateways * Adding tests for gw controller * remove unused args * Undo formatting changes * Fix call sites for upstream/downstream gw changes * Add config entry tests * Fix function calls again * Move from ServiceKey to ServiceName, cleanup from PR review * Add additional check for length of services in bound apigateway for IsSame comparison * fix formatting for proto * gofmt * Add DeepCopy for retrieved BoundAPIGateway * gofmt * gofmt * Rename function to be more consistent	12 months ago
Ronald	eded2ff347	[NET-6249] Add templated policies description (#19735 )	1 year ago
Ronald	c1dbf00a85	NET-6251 API gateway templated policy (#19728 )	1 year ago
Mike Nomitch	302f994410	[NET-6640] Adds "Policy" BindType to BindingRule (#19499 ) feat: add bind type of policy Co-authored-by: Ronald Ekambi <ronekambi@gmail.com>	1 year ago
Ronald	ea0caa3e0f	[NET-6103] Enable query tokens by service name using templated policy (#19666 )	1 year ago
John Murret	f0cf8f2f40	NET-6294 - v1 Agentless proxycfg datasource errors after v2 changes (#19365 )	1 year ago
Chris S. Kim	6360c745b5	Add clarification for route match behavior (#19363 ) * Add clarification for route match behavior * Update website/content/docs/connect/config-entries/service-defaults.mdx Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> --------- Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>	1 year ago
aahel	1280f45485	added ent to ce downgrade changes (#19311 ) * added ent to ce downgrade changes * added changelog * added busl headers	1 year ago
R.B. Boyer	b9ab63c55d	server: when the v2 catalog experiment is enabled reject api and rpc requests that are for the v1 catalog (#19129 ) When the v2 catalog experiment is enabled the old v1 catalog apis will be forcibly disabled at both the API (json) layer and the RPC (msgpack) layer. This will also disable anti-entropy as it uses the v1 api. This includes all of /v1/catalog/, /v1/health/, most of /v1/agent/, /v1/config/, and most of /v1/internal/*.	1 year ago
Chris S. Kim	92ce814693	Remove old build tags (#19128 )	1 year ago
Derek Menteer	af3439b53d	Ensure that upstream configuration is properly normalized. (#19076 ) This PR fixes an issue where upstreams did not correctly inherit the proper namespace / partition from the parent service when attempting to fetch the upstream protocol due to inconsistent normalization. Some of the merge-service-configuration logic would normalize to default, while some of the proxycfg logic would normalize to match the parent service. Due to this mismatch in logic, an incorrect service-defaults configuration entry would be fetched and have its protocol applied to the upstream.	1 year ago
Chris S. Kim	ad26494016	[CE] Add workload bind type and templated policy (#19077 )	1 year ago
Chris Thain	5e45db18b7	Include RequestTimeout in marshal/unmarshal of ServiceResolverConfigE… (#19031 )	1 year ago
Iryna Shustava	d88888ee8b	catalog,mesh,auth: Bump versions to v2beta1 (#18930 )	1 year ago
Ronald	c8299522b5	[NET-5332] Add nomad server templated policy (#18888 ) * [NET-5332] Add nomad server templated policy * slksfd	1 year ago
Ronald	49cb84297f	Move ACL templated policies to hcl files (#18853 )	1 year ago
Ronald	aff13cd4c2	Use embedded strings for templated policies (#18829 )	1 year ago
Ronald	1afeb6e040	[NET-5334] Added CLI commands for templated policies (#18816 )	1 year ago
Ronald	802122640b	[NET-5329] use acl templated policy under the hood for node/service identities (#18813 )	1 year ago
Chris S. Kim	d090668c37	Add workload identity ACL rules (#18769 )	1 year ago
Nitya Dhanushkodi	78b170ad50	xds controller: setup watches for and compute leaf cert references in ProxyStateTemplate, and wire up leaf cert manager dependency (#18756 ) * Refactors the leafcert package to not have a dependency on agent/consul and agent/cache to avoid import cycles. This way the xds controller can just import the leafcert package to use the leafcert manager. The leaf cert logic in the controller: * Sets up watches for leaf certs that are referenced in the ProxyStateTemplate (which generates the leaf certs too). * Gets the leaf cert from the leaf cert cache * Stores the leaf cert in the ProxyState that's pushed to xds * For the cert watches, this PR also uses a bimapper + a thin wrapper to map leaf cert events to related ProxyStateTemplates Since bimapper uses a resource.Reference or resource.ID to map between two resource types, I've created an internal type for a leaf certificate to use for the resource.Reference, since it's not a v2 resource. The wrapper allows mapping events to resources (as opposed to mapping resources to resources) The controller tests: Unit: Ensure that we resolve leaf cert references Lifecycle: Ensure that when the CA is updated, the leaf cert is as well Also adds a new spiffe id type, and adds workload identity and workload identity URI to leaf certs. This is so certs are generated with the new workload identity based SPIFFE id. * Pulls out some leaf cert test helpers into a helpers file so it can be used in the xds controller tests. * Wires up leaf cert manager dependency * Support getting token from proxytracker * Add workload identity spiffe id type to the authorize and sign functions --------- Co-authored-by: John Murret <john.murret@hashicorp.com>	1 year ago
Ronald	9776c10efb	[NET-5333] Add api to read/list and preview templated policies (#18748 )	1 year ago
Nathan Coleman	ed79c60e78	NET-5530 Generate deep-copy code (#18730 ) * Generate deep-copy code * Undo license header removal	1 year ago
Ronald	40d7ebc318	[NET-5330] Support templated policies in Binding rules (#18719 ) * [NET-5330] Support templated policies in Binding rules * changelog for templated policy support in binding rules	1 year ago
Nathan Coleman	e5d26a13cd	NET-5530 Support response header modifiers on http-route config entry (#18646 ) * Add response header filters to http-route config entry definitions * Map response header filters from config entry when constructing route destination * Support response header modifiers at the service level as well * Update protobuf definitions * Update existing unit tests * Add response filters to route consolidation logic * Make existing unit tests more robust * Add missing docstring * Add changelog entry * Add response filter modifiers to existing integration test * Add more robust testing for response header modifiers in the discovery chain * Add more robust testing for request header modifiers in the discovery chain * Modify test to verify that service filter modifiers take precedence over rule filter modifiers	1 year ago
Jeremy Jacobson	876c662e36	[CC-6039] Update builtin policy descriptions (#18705 )	1 year ago
Ronald	bbef879f85	[NET-5325] ACL templated policies support in tokens and roles (#18708 ) * [NET-5325] ACL templated policies support in tokens and roles - Add API support for creating tokens/roles with templated-policies - Add CLI support for creating tokens/roles with templated-policies * adding changelog	1 year ago
Iryna Shustava	4eb2197e82	dataplane: Allow getting bootstrap parameters when using V2 APIs (#18504 ) This PR enables the GetEnvoyBootstrapParams endpoint to construct envoy bootstrap parameters from v2 catalog and mesh resources. * Make bootstrap request and response parameters less specific to services so that we can re-use them for workloads or service instances. * Remove ServiceKind from bootstrap params response. This value was unused previously and is not needed for V2. * Make access logs generation generic so that we can generate them using v1 or v2 resources.	1 year ago

1 2 3 4 5 ...

944 Commits (3c3bdba926f97fa65fac00c50bf4ff081d4889d7)