146 Commits (3fee1129b13f4e3cd6acc49246549ac335bc3fcf)

Author	SHA1	Message	Date
Freddy	8529161f97	connect: update envoy supported versions to latest patch release [1 .10.x] (#10960)	3 years ago
Blake Covarrubias	b62f9a4e39	cli: Use admin bind address in self_admin cluster (#10757) ... Configure the self_admin cluster to use the admin bind address provided when starting Envoy. Fixes #10747	3 years ago
Iryna Shustava	ae767d9cfc	cli/sdk: Allow applying redirect-traffic rules in a provided Linux namespace (#10564)	3 years ago
Daniel Nephin	fe76dc7068	Merge pull request #10552 from hashicorp/dnephin/ca-remove-rotation-period ... ca: remove unused RotationPeriod field	3 years ago
Daniel Nephin	f81b371bc1	Merge pull request #10515 from hashicorp/dnephin/fix-arm32-atomic-aligment ... Fix panic on 32-bit platforms Conflicts in tlsutil/config.go were resolved by dropping those changes. The issue that was fixed in that file is not in 1.10.x.	3 years ago
Daniel Nephin	374072d1ee	Merge pull request #10527 from hashicorp/rename-main-branch ... Update references to the main branch Conflicts: .github/CONTRIBUTING.md website/content/docs/upgrading/instructions/upgrade-to-1-10-x.mdx The website conflicts seems like it some of the changes on main didn't make it into the 1.10.x branch, but the content is relevant for 1.10 so I took the changes from main.	3 years ago
Freddy	168073c4dc	Add flag for transparent proxies to dial individual instances (#10329)	4 years ago
Daniel Nephin	07a1b7d081	Merge pull request #10324 from hashicorp/dnephin/fix-envoy-bootstrap-exec ... envoy: fix deadlock when input is larger than named pipe buffer size	4 years ago
Daniel Nephin	510d81ac4d	Merge pull request #10253 from hashicorp/dnephin/fix-test-flake ... redirecttraffic: fix a flaky test	4 years ago
Iryna Shustava	47d8f050d2	Save exposed ports in agent's store and expose them via API (#10173) ... * Save exposed HTTP or GRPC ports to the agent's store * Add those the health checks API so we can retrieve them from the API * Change redirect-traffic command to also exclude those ports from inbound traffic redirection when expose.checks is set to true.	4 years ago
R.B. Boyer	88a8656e13	connect: update supported envoy versions to 1.18.3, 1.17.3, 1.16.4, and 1.15.5 (#10231)	4 years ago
Mark Anderson	42ff449d4f	Merge pull request #9981 from hashicorp/ma/uds_upstreams ... Unix Domain Socket support for upstreams and downstreams	4 years ago
R.B. Boyer	145a83e436	connect: update supported envoy versions to 1.18.2, 1.17.2, 1.16.3, and 1.15.4 (#10101) ... The only thing that needed fixing up pertained to this section of the 1.18.x release notes: > grpc_stats: the default value for stats_for_all_methods is switched from true to false, in order to avoid possible memory exhaustion due to an untrusted downstream sending a large number of unique method names. The previous default value was deprecated in version 1.14.0. This only changes the behavior when the value is not set. The previous behavior can be used by setting the value to true. This behavior change by be overridden by setting runtime feature envoy.deprecated_features.grpc_stats_filter_enable_stats_for_all_methods_by_default. For now to maintain status-quo I'm explicitly setting `stats_for_all_methods=true` in all versions to avoid relying upon the default. Additionally the naming of the emitted metrics for these gRPC requests changed slightly so the integration test assertions for `case-grpc` needed adjusting.	4 years ago
R.B. Boyer	6a39b47448	Support Incremental xDS mode (#9855) ... This adds support for the Incremental xDS protocol when using xDS v3. This is best reviewed commit-by-commit and will not be squashed when merged. Union of all commit messages follows to give an overarching summary: xds: exclusively support incremental xDS when using xDS v3 Attempts to use SoTW via v3 will fail, much like attempts to use incremental via v2 will fail. Work around a strange older envoy behavior involving empty CDS responses over incremental xDS. xds: various cleanups and refactors that don't strictly concern the addition of incremental xDS support Dissolve the connectionInfo struct in favor of per-connection ResourceGenerators instead. Do a better job of ensuring the xds code uses a well configured logger that accurately describes the connected client. xds: pull out checkStreamACLs method in advance of a later commit xds: rewrite SoTW xDS protocol tests to use protobufs rather than hand-rolled json strings In the test we very lightly reuse some of the more boring protobuf construction helper code that is also technically under test. The important thing of the protocol tests is testing the protocol. The actual inputs and outputs are largely already handled by the xds golden output tests now so these protocol tests don't have to do double-duty. This also updates the SoTW protocol test to exclusively use xDS v2 which is the only variant of SoTW that will be supported in Consul 1.10. xds: default xds.Server.AuthCheckFrequency at use-time instead of construction-time	4 years ago
Iryna Shustava	f383452e87	Implement traffic redirection exclusion based on proxy config and user-provided values (#10134) ... * Use proxy outbound port from TransparentProxyConfig if provided * If -proxy-id is provided to the redirect-traffic command, exclude any listener ports from inbound traffic redirection. This includes envoy_prometheus_bind_addr, envoy_stats_bind_addr, and the ListenerPort from the Expose configuration. * Allow users to provide additional inbound and outbound ports, outbound CIDRs and additional user IDs to be excluded from traffic redirection. This affects both the traffic-redirect command and the iptables SDK package.	4 years ago
Iryna Shustava	5755c97bc7	cli: Add new `consul connect redirect-traffic` command for applying traffic redirection rules when Transparent Proxy is enabled. (#9910) ... * Add new consul connect redirect-traffic command for applying traffic redirection rules when Transparent Proxy is enabled. * Add new iptables package for applying traffic redirection rules with iptables.	4 years ago
R.B. Boyer	5bcfe930c6	command: when generating envoy bootstrap configs to stdout do not mix informational logs into the json (#9980) ... Fixes #9921	4 years ago
woz5999	39f448589d	support env var expansion in envoy statsd urls ... Fixes #8561	4 years ago
Kyle Havlovitz	1e87c7183a	Merge pull request #9672 from hashicorp/ca-force-skip-xc ... connect/ca: Allow ForceWithoutCrossSigning for all providers	4 years ago
Nitya Dhanushkodi	15e8b13891	Add flags to consul connect envoy for metrics merging. (#9768) ... Allows setting -prometheus-backend-port to configure the cluster envoy_prometheus_bind_addr points to. Allows setting -prometheus-scrape-path to configure which path envoy_prometheus_bind_addr exposes metrics on. -prometheus-backend-port is used by the consul-k8s metrics merging feature, to configure envoy_prometheus_bind_addr to point to the merged metrics endpoint that combines Envoy and service metrics so that one set of annotations on a Pod can scrape metrics from the service and it's Envoy sidecar. -prometheus-scrape-path is used to allow configurability of the path where prometheus metrics are exposed on envoy_prometheus_bind_addr.	4 years ago
R.B. Boyer	398b766532	xds: default to speaking xDS v3, but allow for v2 to be spoken upon request (#9658) ... - Also add support for envoy 1.17.0	4 years ago
R.B. Boyer	3b6ffc447b	xds: remove deprecated usages of xDS (#9602) ... Note that this does NOT upgrade to xDS v3. That will come in a future PR. Additionally: - Ignored staticcheck warnings about how github.com/golang/protobuf is deprecated. - Shuffled some agent/xds imports in advance of a later xDS v3 upgrade. - Remove support for envoy 1.13.x but don't add in 1.17.x yet. We have to wait until the xDS v3 support is added in a follow-up PR. Fixes #8425	4 years ago
R.B. Boyer	6eeccc93ce	connect: update supported envoy point releases to 1.16.2, 1.15.3, 1.14.6, 1.13.7 (#9737)	4 years ago
Kyle Havlovitz	7dac583863	connect/ca: Allow ForceWithoutCrossSigning for all providers ... This allows setting ForceWithoutCrossSigning when reconfiguring the CA for any provider, in order to forcibly move to a new root in cases where the old provider isn't reachable or able to cross-sign for whatever reason.	4 years ago
R.B. Boyer	b5f9a293c9	chore: regenerate envoy golden files (#9634)	4 years ago
Daniel Nephin	b9e60c0775	testing: skip slow tests with -short ... Add a skip condition to all tests slower than 100ms. This change was made using `gotestsum tool slowest` with data from the last 3 CI runs of master. See https://github.com/gotestyourself/gotestsum#finding-and-skipping-slow-tests With this change: ``` $ time go test -count=1 -short ./agent ok github.com/hashicorp/consul/agent 0.743s real 0m4.791s $ time go test -count=1 -short ./agent/consul ok github.com/hashicorp/consul/agent/consul 4.229s real 0m8.769s ```	4 years ago
R.B. Boyer	7c7a3e5165	command: when generating envoy bootstrap configs use the datacenter returned from the agent services endpoint (#9229) ... Fixes #9215	4 years ago
Freddy	fe728855ed	Add DC and NS support for Envoy metrics (#9207) ... This PR updates the tags that we generate for Envoy stats. Several of these come with breaking changes, since we can't keep two stats prefixes for a filter.	4 years ago
Mike Morris	6396042ba7	connect: switch the default gateway port from 443 to 8443 (#9116) ... * test: update ingress gateway golden file to port 8443 * test: update Envoy flags_test to port 8443 Co-authored-by: R.B. Boyer <rb@hashicorp.com>	4 years ago
R.B. Boyer	8baf158ea8	Revert "Add namespace support for metrics (OSS) (#9117)" (#9124) ... This reverts commit 06b3b017d3.	4 years ago
Freddy	06b3b017d3	Add namespace support for metrics (OSS) (#9117)	4 years ago
R.B. Boyer	a2c50d3303	connect: add support for envoy 1.16.0, drop support for 1.12.x, and bump point releases as well (#8944) ... Supported versions will be: "1.16.0", "1.15.2", "1.14.5", "1.13.6"	4 years ago
R.B. Boyer	9fbcb2e68d	command: remove conditional envoy bootstrap generation for versions <=1.10.0 since those are not supported (#8855)	4 years ago
R.B. Boyer	a2a8e9c783	connect: intentions are now managed as a new config entry kind "service-intentions" (#8834) ... - Upgrade the ConfigEntry.ListAll RPC to be kind-aware so that older copies of consul will not see new config entries it doesn't understand replicate down. - Add shim conversion code so that the old API/CLI method of interacting with intentions will continue to work so long as none of these are edited via config entry endpoints. Almost all of the read-only APIs will continue to function indefinitely. - Add new APIs that operate on individual intentions without IDs so that the UI doesn't need to implement CAS operations. - Add a new serf feature flag indicating support for intentions-as-config-entries. - The old line-item intentions way of interacting with the state store will transparently flip between the legacy memdb table and the config entry representations so that readers will never see a hiccup during migration where the results are incomplete. It uses a piece of system metadata to control the flip. - The primary datacenter will begin migrating intentions into config entries on startup once all servers in the datacenter are on a version of Consul with the intentions-as-config-entries feature flag. When it is complete the old state store representations will be cleared. We also record a piece of system metadata indicating this has occurred. We use this metadata to skip ALL of this code the next time the leader starts up. - The secondary datacenters continue to run the old intentions replicator until all servers in the secondary DC and primary DC support intentions-as-config-entries (via serf flag). Once this condition it met the old intentions replicator ceases. - The secondary datacenters replicate the new config entries as they are migrated in the primary. When they detect that the primary has zeroed it's old state store table it waits until all config entries up to that point are replicated and then zeroes its own copy of the old state store table. We also record a piece of system metadata indicating this has occurred. We use this metadata to skip ALL of this code the next time the leader starts up.	4 years ago
Tim Arenz	a1fe711390	Add support for -ca-path option in the connect envoy command (#8606) ... * Add support for -ca-path option in the connect envoy command * Adding changelog entry	4 years ago
Daniel Nephin	33c401a16e	logging: Setup accept io.Writer instead of []io.Writer ... Also accept a non-pointer Config, since the config is not modified	4 years ago
Daniel Nephin	d68edcecf4	testing: Remove all the defer os.Removeall ... Now that testutil uses t.Cleanup to remove the directory the caller no longer has to manage the removal	4 years ago
R.B. Boyer	397019d970	xds: revert setting set_node_on_first_message_only to true when generating envoy bootstrap config (#8440) ... When consul is restarted and an envoy that had already sent DiscoveryRequests to the previous consul process sends a request to the new process it doesn't respect the setting and never populates DiscoveryRequest.Node for the life of the new consul process due to this bug: https://github.com/envoyproxy/envoy/issues/9682 Fixes #8430	4 years ago
Daniel Nephin	0420d91cdd	Remove LogOutput from Agent ... Now that it is no longer used, we can remove this unnecessary field. This is a pre-step in cleanup up RuntimeConfig->Consul.Config, which is a pre-step to adding a gRPCHandler component to Server for streaming. Removing this field also allows us to remove one of the return values from logging.Setup.	4 years ago
R.B. Boyer	c599a2f5f4	xds: add support for envoy 1.15.0 and drop support for 1.11.x (#8424) ... Related changes: - hard-fail the xDS connection attempt if the envoy version is known to be too old to be supported - remove the RouterMatchSafeRegex proxy feature since all supported envoy versions have it - stop using --max-obj-name-len (due to: envoyproxy/envoy#11740)	4 years ago
Chris Piraino	7c4cc71131	Fix envoy bootstrap logic to not append multiple self_admin clusters (#8371) ... Previously, the envoy bootstrap config would blindly copy the self_admin cluster into the list of static clusters when configuring either ReadyBindAddr, PrometheusBindAddr, or StatsBindAddr. Since ingress gateways always configure the ReadyBindAddr property, users ran into this case much more often than previously.	4 years ago
Hans Hasselberg	496fb5fc5b	add support for envoy 1.14.4, 1.13.4, 1.12.6 (#8216)	4 years ago
R.B. Boyer	1eef096dfe	xds: version sniff envoy and switch regular expressions from 'regex' to 'safe_regex' on newer envoy versions (#8222) ... - cut down on extra node metadata transmission - split the golden file generation to compare all envoy version	4 years ago
R.B. Boyer	462f0f37ed	connect: various changes to make namespaces for intentions work more like for other subsystems (#8194) ... Highlights: - add new endpoint to query for intentions by exact match - using this endpoint from the CLI instead of the dump+filter approach - enforcing that OSS can only read/write intentions with a SourceNS or DestinationNS field of "default". - preexisting OSS intentions with now-invalid namespace fields will delete those intentions on initial election or for wildcard namespaces an attempt will be made to downgrade them to "default" unless one exists. - also allow the '-namespace' CLI arg on all of the intention subcommands - update lots of docs	4 years ago
Matt Keeler	3dbbd2d37d	Implement Client Agent Auto Config ... There are a couple of things in here. First, just like auto encrypt, any Cluster.AutoConfig RPC will implicitly use the less secure RPC mechanism. This drastically modifies how the Consul Agent starts up and moves most of the responsibilities (other than signal handling) from the cli command and into the Agent.	5 years ago
Daniel Nephin	068b43df90	Enable gofmt simplify ... Code changes done automatically with 'gofmt -s -w'	5 years ago
Hans Hasselberg	e62a43c6cf	Support envoy 1.14.2, 1.13.2, 1.12.4 (#8057)	5 years ago
Kyle Havlovitz	6fd3b25313	Fix a CLI test failure with namespaces in enterprise	5 years ago
Kyle Havlovitz	e3a725c4e0	Always allow updating the exposed service and differentiate by namespace	5 years ago
Kyle Havlovitz	edab5588d8	Add -host flag to expose command	5 years ago