60 Commits (3f894604bbbedb97d81667d85110d43095cf2a77)

Author	SHA1	Message	Date
Daniel Nephin	8ba760a2fc	acl: remove id and revision from Policy constructors ... The fields were removed in a previous commit. Also remove an unused constructor for PolicyMerger	3 years ago
Daniel Nephin	65d48e5042	state: remove support for updating legacy ACL tokens	3 years ago
Daniel Nephin	c77e5747b1	acl: remove EmbeddedPolicy ... This method is no longer. It only existed for legacy tokens, which are no longer supported.	3 years ago
Daniel Nephin	3ac910606c	acl: remove reading of serf acl tags ... We no long need to read the acl serf tag, because servers are always either ACL enabled or ACL disabled. We continue to write the tag so that during an upgarde older servers will see the tag.	3 years ago
Daniel Nephin	8e9773e20b	acl: remove ACL.GetPolicy endpoint and resolve legacy acls ... And all code that was no longer used once those two were removed.	3 years ago
Daniel Nephin	6e1ebd3df7	acl: remove the last of the legacy FSM ... Replace it with an implementation that returns an error, and rename some symbols to use a Deprecated suffix to make it clear. Also remove the ACLRequest struct, which is no longer referenced.	3 years ago
Daniel Nephin	05f0cc3993	acl: remove ACLDelete FSM command, and state store function ... These are no longer used now that ACL.Apply has been removed.	3 years ago
Daniel Nephin	966e50e00e	acl: remove legacy field to ACLBoostrap	3 years ago
Daniel Nephin	e7c63004a8	acl: remove a couple legacy ACL operation constants ... structs.ACLForceSet was deprecated 4 years ago, it should be safe to remove now. ACLBootstrapNow was removed in a recent commit. While it is technically possible that a cluster with mixed version could still attempt a legacy boostrap, we documented that the legacy system was deprecated in 1.4, so no clusters that are being upgraded should be attempting a legacy boostrap.	3 years ago
Daniel Nephin	868bfc7a0a	acl: Remove unused ACLPolicyIDType	3 years ago
Daniel Nephin	aee8a9511d	Merge pull request #10985 from hashicorp/dnephin/acl-legacy-remove-replication ... acl: remove legacy ACL replication	3 years ago
Freddy	fcef19f94b	acl: small resolver changes to account for partitions (#11052) ... Also refactoring the enterprise side of a test to make it easier to reason about.	3 years ago
Daniel Nephin	d63cef1219	acl: remove legacy ACL replication	3 years ago
R.B. Boyer	ee372a854a	acl: adding a new mesh resource	3 years ago
R.B. Boyer	a6d22efb49	acl: some acl authz refactors for nodes (#10909)	3 years ago
Daniel Nephin	d3325b0253	Merge pull request #10612 from bigmikes/acl-replication-fix ... acl: acl replication routine to report the last error message	3 years ago
R.B. Boyer	188e8dc51f	agent/structs: add a bunch more EnterpriseMeta helper functions to help with partitioning (#10669)	3 years ago
Evan Culver	0527dcff57	acls: Show `AuthMethodNamespace` when reading/listing ACL token meta (#10598)	3 years ago
Giulio Micheloni	814ef6b103	acl: fix error type into a string type for serialization issue ... acl_endpoint_test.go:507: Error Trace: acl_endpoint_test.go:507 retry.go:148 retry.go:149 retry.go:103 acl_endpoint_test.go:504 Error: Received unexpected error: codec.decoder: decodeValue: Cannot decode non-nil codec value into nil error (1 methods) Test: TestACLEndpoint_ReplicationStatus	3 years ago
Giulio Micheloni	529fe737ef	acl: acl replication routine to report the last error message	3 years ago
Evan Culver	13bd86527b	Add support for returning ACL secret IDs for accessors with acl:write (#10546)	3 years ago
Matt Keeler	bbf5993534	Move static token resolution into the ACLResolver (#10013)	4 years ago
Mark Anderson	b9d22f48cd	Add fields to the /acl/auth-methods endpoint. (#9741) ... * A GET of the /acl/auth-method/:name endpoint returns the fields MaxTokenTTL and TokenLocality, while a LIST (/acl/auth-methods) does not. The list command returns a filtered subset of the full set. This is somewhat deliberate, so that secrets aren't shown, but the TTL and Locality fields aren't (IMO) security critical, and it is useful for the front end to be able to show them. For consistency these changes mirror the 'omit empty' and string representation choices made for the GET call. This includes changes to the gRPC and API code in the client. The new output looks similar to this curl 'http://localhost:8500/v1/acl/auth-methods' | jq '.' { "MaxTokenTTL": "8m20s", "Name": "minikube-ttl-local2", "Type": "kubernetes", "Description": "minikube auth method", "TokenLocality": "local", "CreateIndex": 530, "ModifyIndex": 530, "Namespace": "default" } ] Signed-off-by: Mark Anderson <manderson@hashicorp.com> * Add changelog Signed-off-by: Mark Anderson <manderson@hashicorp.com>	4 years ago
R.B. Boyer	d921690bfe	acl: global tokens created by auth methods now correctly replicate to secondary datacenters (#9351) ... Previously the tokens would fail to insert into the secondary's state store because the AuthMethod field of the ACLToken did not point to a known auth method from the primary.	4 years ago
Kyle Havlovitz	0bfda4481f	Add CA server delegate interface for testing	4 years ago
Matt Keeler	d3881dd754	ACL Node Identities (#7970) ... A Node Identity is very similar to a service identity. Its main targeted use is to allow creating tokens for use by Consul agents that will grant the necessary permissions for all the typical agent operations (node registration, coordinate updates, anti-entropy). Half of this commit is for golden file based tests of the acl token and role cli output. Another big updates was to refactor many of the tests in agent/consul/acl_endpoint_test.go to use the same style of tests and the same helpers. Besides being less boiler plate in the tests it also uses a common way of starting a test server with ACLs that should operate without any warnings regarding deprecated non-uuid master tokens etc.	5 years ago
Hans Hasselberg	242994a016	acl: do not resolve local tokens from remote dcs (#8068)	5 years ago
R.B. Boyer	833211c14c	acl: allow auth methods created in the primary datacenter to optionally create global tokens (#7899)	5 years ago
R.B. Boyer	a854e4d9c5	acl: oss plumbing to support auth method namespace rules in enterprise (#7794) ... This includes website docs updates.	5 years ago
R.B. Boyer	22eb016153	acl: add MaxTokenTTL field to auth methods (#7779) ... When set to a non zero value it will limit the ExpirationTime of all tokens created via the auth method.	5 years ago
R.B. Boyer	ca52ba7068	acl: add DisplayName field to auth methods (#7769) ... Also add a few missing acl fields in the api.	5 years ago
Alejandro Baez	bafa69bb69	Add PolicyReadByName for API (#6615)	5 years ago
R.B. Boyer	85a08bf8ed	server: strip local ACL tokens from RPCs during forwarding if crossing datacenters (#7419) ... Fixes #7414	5 years ago
Matt Keeler	e231d62bc9	Make the config entry and leaf cert cache types ns aware (#7256)	5 years ago
R.B. Boyer	8c596953b0	agent: ensure that we always use the same settings for msgpack (#7245) ... We set RawToString=true so that []uint8 => string when decoding an interface{}. We set the MapType so that map[interface{}]interface{} decodes to map[string]interface{}. Add tests to ensure that this doesn't break existing usages. Fixes #7223	5 years ago
Matt Keeler	663cf1e9a8	AuthMethod updates to support alternate namespace logins (#7029)	5 years ago
Matt Keeler	80d13d500b	Miscellaneous acl package cleanup ... • Renamed EnterpriseACLConfig to just Config • Removed chained_authorizer_oss.go as it was empty • Renamed acl.go to errors.go to more closely describe its contents	5 years ago
Matt Keeler	0b346616e9	Rename EnterpriseAuthorizerContext -> AuthorizerContext	5 years ago
Matt Keeler	8f0ab0129e	Miscellaneous Fixes (#6896) ... Ensure we close the Sentinel Evaluator so as not to leak go routines Fix a bunch of test logging so that various warnings when starting a test agent go to the ltest logger and not straight to stdout. Various canned ent meta types always return a valid pointer (no more nils). This allows us to blindly deref + assign in various places. Update ACL index tracking to ensure oss -> ent upgrades will work as expected. Update ent meta parsing to include function to disallow wildcarding.	5 years ago
Matt Keeler	a704ebe639	Add Namespace support to the API module and the CLI commands (#6874) ... Also update the Docs and fixup the HTTP API to return proper errors when someone attempts to use Namespaces with an OSS agent. Add Namespace HTTP API docs Make all API endpoints disallow unknown fields	5 years ago
Matt Keeler	deb91f3d3c	[Feature] API: Add a internal endpoint to query for ACL authori… (#6888) ... * Implement endpoint to query whether the given token is authorized for a set of operations * Updates to allow for remote ACL authorization via RPC This is only used when making an authorization request to a different datacenter.	5 years ago
Sarah Adams	78ad8203a4	Use encoding/json as JSON decoder instead of mapstructure (#6680) ... Fixes #6147	5 years ago
Matt Keeler	79f78632e1	Update the ACL Resolver to allow for Consul Enterprise specific hooks. (#6687)	5 years ago
Matt Keeler	e4ea9b0a96	Updates to allow for Namespacing ACL resources in Consul Enterp… (#6675) ... Main Changes: • method signature updates everywhere to account for passing around enterprise meta. • populate the EnterpriseAuthorizerContext for all ACL related authorizations. • ACL resource listings now operate like the catalog or kv listings in that the returned entries are filtered down to what the token is allowed to see. With Namespaces its no longer all or nothing. • Modified the acl.Policy parsing to abstract away basic decoding so that enterprise can do it slightly differently. Also updated method signatures so that when parsing a policy it can take extra ent metadata to use during rules validation and policy creation. Secondary Changes: • Moved protobuf encoding functions out of the agentpb package to eliminate circular dependencies. • Added custom JSON unmarshalers for a few ACL resource types (to support snake case and to get rid of mapstructure) • AuthMethod validator cache is now an interface as these will be cached per-namespace for Consul Enterprise. • Added checks for policy/role link existence at the RPC API so we don’t push the request through raft to have it fail internally. • Forward ACL token delete request to the primary datacenter when the secondary DC doesn’t have the token. • Added a bunch of ACL test helpers for inserting ACL resource test data.	5 years ago
Matt Keeler	973341a592	ACL Authorizer overhaul (#6620) ... * ACL Authorizer overhaul To account for upcoming features every Authorization function can now take an extra *acl.EnterpriseAuthorizerContext. These are unused in OSS and will always be nil. Additionally the acl package has received some thorough refactoring to enable all of the extra Consul Enterprise specific authorizations including moving sentinel enforcement into the stubbed structs. The Authorizer funcs now return an acl.EnforcementDecision instead of a boolean. This improves the overall interface as it makes multiple Authorizers easily chainable as they now indicate whether they had an authoritative decision or should use some other defaults. A ChainedAuthorizer was added to handle this Authorizer enforcement chain and will never itself return a non-authoritative decision. * Include stub for extra enterprise rules in the global management policy * Allow for an upgrade of the global-management policy	5 years ago
R.B. Boyer	20eefeea11	acl: a role binding rule for a role that does not exist should be ignored (#5778) ... I wrote the docs under this assumption but completely forgot to actually enforce it.	6 years ago
R.B. Boyer	b4371bcccd	acl: enforce that you cannot persist tokens and roles with missing links except during replication (#5779)	6 years ago
Matt Keeler	4daa1585b0	ACL Token ID Initialization (#5307)	6 years ago
R.B. Boyer	e47d7eeddb	acl: adding support for kubernetes auth provider login (#5600) ... * auth providers * binding rules * auth provider for kubernetes * login/logout	6 years ago
R.B. Boyer	cc1aa3f973	acl: adding Roles to Tokens (#5514) ... Roles are named and can express the same bundle of permissions that can currently be assigned to a Token (lists of Policies and Service Identities). The difference with a Role is that it not itself a bearer token, but just another entity that can be tied to a Token. This lets an operator potentially curate a set of smaller reusable Policies and compose them together into reusable Roles, rather than always exploding that same list of Policies on any Token that needs similar permissions. This also refactors the acl replication code to be semi-generic to avoid 3x copypasta.	6 years ago