17946 Commits (3ec5d8a9b108e58bae2a87e5701031be5d1aac97)

 

All Branches   

Search

Author	SHA1	Message	Date
John Cowen	892032acae	ui: Slight update to peering mocks to more properly match actual (#13664)	2 years ago
John Cowen	aaad7692ce	ui: Fixup peering imported/exported service counts (#13662) ... * ui: Fix up peer states and counts in the listing	2 years ago
Chris S. Kim	f07132dacc	Revise possible states for a peering. (#13661) ... These changes are primarily for Consul's UI, where we want to be more specific about the state a peering is in. - The "initial" state was renamed to pending, and no longer applies to peerings being established from a peering token. - Upon request to establish a peering from a peering token, peerings will be set as "establishing". This will help distinguish between the two roles: the cluster that generates the peering token and the cluster that establishes the peering. - When marked for deletion, peering state will be set to "deleting". This way the UI determines the deletion via the state rather than the "DeletedAt" field. Co-authored-by: freddygv <freddy@hashicorp.com>	2 years ago
John Cowen	27e50ae925	ui: Add peer searching and sorting (#13634) ... * ui: Add peer searching and sorting Initial name search and sort only, more to come here * Remove old peerings::search component * Use @model peers * ui: Peer listing with dc/ns/partition/name based unique IDs and polling deletion (#13648) * ui: Add peer repo with listing datasource * ui: Use data-loader component to use the data-source * ui: Remove ember-data REST things and Route.model hook * 10 second not 1 second poll * Fill out Datacenter and Partition * route > routeName * Faker randomised mocks for peering endpoint * ui: Adds initial peer detail page plus address tab (#13651)	2 years ago
John Cowen	ea33bc249c	ui: Gradual deprecation of old StateChart interface (#13604)	2 years ago
Daniel Upton	07e4e6bd7d	Changelog entry	2 years ago
Daniel Upton	45886848b4	proxycfg: server-local intention upstreams data source ... This is the OSS portion of enterprise PR 2157. It builds on the local blocking query work in #13438 to implement the proxycfg.IntentionUpstreams interface using server-local data. Also moves the ACL filtering logic from agent/consul into the acl/filter package so that it can be reused here.	2 years ago
Daniel Upton	37ccbd2826	proxycfg: server-local intentions data source ... This is the OSS portion of enterprise PR 2141. This commit provides a server-local implementation of the `proxycfg.Intentions` interface that sources data from streaming events. It adds events for the `service-intentions` config entry type, and then consumes event streams (via materialized views) for the service's explicit intentions and any applicable wildcard intentions, merging them into a single list of intentions. An alternative approach I considered was to consume _all_ intention events (via `SubjectWildcard`) and filter out the irrelevant ones. This would admittedly remove some complexity in the `agent/proxycfg-glue` package but at the expense of considerable overhead from waking potentially many thousands of connect proxies every time any intention is updated.	2 years ago
Daniel Upton	653b8c4f9d	proxycfg: server-local config entry data sources ... This is the OSS portion of enterprise PR 2056. This commit provides server-local implementations of the proxycfg.ConfigEntry and proxycfg.ConfigEntryList interfaces, that source data from streaming events. It makes use of the LocalMaterializer type introduced for peering replication, adding the necessary support for authorization. It also adds support for "wildcard" subscriptions (within a topic) to the event publisher, as this is needed to fetch service-resolvers for all services when configuring mesh gateways. Currently, events will be emitted for just the ingress-gateway, service-resolver, and mesh config entry types, as these are the only entries required by proxycfg — the events will be emitted on topics named IngressGateway, ServiceResolver, and MeshConfig topics respectively. Though these events will only be consumed "locally" for now, they can also be consumed via the gRPC endpoint (confirmed using grpcurl) so using them from client agents should be a case of swapping the LocalMaterializer for an RPCMaterializer.	2 years ago
Jared Kirschner	41990d52e0	docs: improve large version change upgrade path	2 years ago
Michael Klein	65b0faf96b	ui: allow searching services by admin-partition (#13650)	2 years ago
Michael Klein	ef21100435	ui: peering chores (#13636) ... * Update empty state topology downstreams to included peer info * Add filter for filtering for service without ExternalSources	2 years ago
alex	cd9ca4290a	peering: add imported/exported counts to peering (#13644) ... Signed-off-by: acpana <8968914+acpana@users.noreply.github.com> Co-authored-by: Chris S. Kim <ckim@hashicorp.com>	2 years ago
Chris S. Kim	b186731a2e	Fix ENT drift in files (#13647)	2 years ago
Matt Keeler	5105835cb2	Allow the /v1/internal/acl/authorize endpoint to authorize the “peering” resource (#13646) ... Currently this just checks for operator read. In the near future it will check for peering specific rules once those are implemented.	2 years ago
Chris S. Kim	d8b7940e40	Add internal endpoint to fetch peered upstream candidates from VirtualIP table (#13642) ... For initial cluster peering TProxy support we consider all imported services of a partition to be potential upstreams. We leverage the VirtualIP table because it stores plain service names (e.g. "api", not "api-sidecar-proxy").	2 years ago
Eric Haberkorn	653cb42944	Fix spelling mistake in serverless patcher (#13607) ... passhthrough -> passthrough	2 years ago
David Yu	8552d875ae	docs: add controller to cluster peering docs (#13639) ... * docs: add controller to cluster peering docs	2 years ago
John Cowen	d66f5a6364	ui: Fix up peer ENT tests (#13633) ... * ui: Add missing @nspaces * Reorder peerings to be before any optionals * Merge params instead of overwriting * Reorder int tests	2 years ago
alex	07bc22e405	no 1.9 style metrics (#13532) ... Signed-off-by: acpana <8968914+acpana@users.noreply.github.com>	2 years ago
alex	beb8b03e8a	peering: reconcile/ hint active state for list (#13619) ... Signed-off-by: acpana <8968914+acpana@users.noreply.github.com>	2 years ago
R.B. Boyer	31b95c747b	xds: modify rbac rules to use the XFCC header for peered L7 enforcement (#13629) ... When the protocol is http-like, and an intention has a peered source then the normal RBAC mTLS SAN field check is replaces with a joint combo of: mTLS SAN field must be the service's local mesh gateway leaf cert AND the first XFCC header (from the MGW) must have a URI field that matches the original intention source Also: - Update the regex program limit to be much higher than the teeny defaults, since the RBAC regex constructions are more complicated now. - Fix a few stray panics in xds generation.	2 years ago
Tu Nguyen	214495f2a2	Fix typo in cluster peering docs (#13574) ... * Fix typo in cluster peering docs * Remove highlight, update curly quotes	2 years ago
R.B. Boyer	de0f9ac519	xds: have mesh gateways forward peered SpiffeIDs using the XFCC header (#13625)	2 years ago
R.B. Boyer	1a9c86ea8f	xds: mesh gateways now correctly load up peer-exported discovery chains using L7 protocols (#13624) ... A mesh gateway will now configure the filter chains for L7 exported services using the correct discovery chain information.	2 years ago
R.B. Boyer	7133ee38f6	test: for upgrade compatibility tests retain assigned container ip addresses on upgrade (#13615) ... Use a synthetic pod construct to hold onto the IP address in the interim.	2 years ago
Dan Upton	ebf74d08fd	test: run Envoy integration tests against both servers and clients (#13610)	2 years ago
Michele Degges	977c6e58de	Turn off sec-scanner check (#13614)	2 years ago
Evan Culver	d4fdddf8d4	Fix verifications by using updated arm package names (#13601) ... Co-authored-by: alex <8968914+acpana@users.noreply.github.com>	2 years ago
R.B. Boyer	0fa828db76	peering: replicate all SpiffeID values necessary for the importing side to do SAN validation (#13612) ... When traversing an exported peered service, the discovery chain evaluation at the other side may re-route the request to a variety of endpoints. Furthermore we intend to terminate mTLS at the mesh gateway for arriving peered traffic that is http-like (L7), so the caller needs to know the mesh gateway's SpiffeID in that case as well. The following new SpiffeID values will be shipped back in the peerstream replication: - tcp: all possible SpiffeIDs resulting from the service-resolver component of the exported discovery chain - http-like: the SpiffeID of the mesh gateway	2 years ago
Kyle Havlovitz	162caaecb3	Merge pull request #13611 from hashicorp/prometheus-tls-docs ... Update docs for prometheus TLS options	2 years ago
Kyle Havlovitz	340a234361	Update docs for prometheus TLS options	2 years ago
Amier Chery	aa508c8a42	Merge pull request #13516 from maxb/docs-fix-metric-dots ... Fix use of trailing dots on metric names in telemetry.mdx	2 years ago
Amier Chery	b429d00719	Merge pull request #13603 from loicsaintroch/patch-1 ... Add HashiBox to community tools	2 years ago
Loïc Saint-Roch	1740181f61	Add HashiBox to community tools	2 years ago
Kyle Havlovitz	22a5532aef	Merge pull request #13481 from hashicorp/envoy-prometheus-tls ... Add TLS support in Envoy Prometheus endpoint	2 years ago
alex	53f0cf5835	peering, internal: support UIServices, UINodes, UINodeInfo (#13577)	2 years ago
Michele Degges	0b3f90c3e7	[CI-only] Dev tag update for main (#13541)	2 years ago
Evan Culver	359328dacb	Remove trigger-oss-merge job (#13600)	2 years ago
Chris S. Kim	2e4cb6f77d	Add new index for PeeredServiceName and ServiceVirtualIP (#13582) ... For TProxy we will be leveraging the VirtualIP table, which needs to become peer-aware	2 years ago
R.B. Boyer	a1e911a70c	tests: ensure integration tests show logs from the containers to help debugging (#13593)	2 years ago
Matt Keeler	a3a4495e78	Clarify the wording of the peering limitations in the preview (#13590)	2 years ago
Frank DiRocco	4a4a64446f	update terraform module location for consul aws modules (#13522) ... Co-authored-by: Paul Glass <pglass@hashicorp.com>	2 years ago
Paul Glass	02ee123b7b	docs: Update ECS docs for IAM auth method support (#13222)	2 years ago
David Yu	ea0966ff5e	docs: add missing $ gossip key rotation (#13581)	2 years ago
David Yu	4d9922c1e4	docs: add indent to code block config tab to align with other branches (#13573)	2 years ago
alex	20ecf0febd	Merge pull request #13570 from hashicorp/acpance/peering-oss-intentions ... oss: peering, http: get peer service intentions (#2098)	2 years ago
Will Jordan	34ecbc1d71	Add per-node max indexes (#12399) ... Adds fine-grained node.[node] entries to the index table, allowing blocking queries to return fine-grained indexes that prevent them from returning immediately when unrelated nodes/services are updated. Co-authored-by: kisunji <ckim@hashicorp.com>	2 years ago
Chris S. Kim	ba89a7d9b0	Make memdb indexers generic (#13558) ... We have many indexer functions in Consul which take interface{} and type assert before building the index. We can use generics to get rid of the initial plumbing and pass around functions with better defined signatures. This has two benefits: 1) Less verbosity; 2) Developers can parse the argument types to memdb schemas without having to introspect the function for the type assertion.	2 years ago
Matt Keeler	7a4d13b0b2	Port over the index 0 -> 1 code that lived in the old rpc setQueryMeta function. (#13561)	2 years ago