consul

Commit Graph

Author	SHA1	Message	Date
trujillo-adam	90bbae5d75	Docs/intentions refactor docs day 2022 (#16758 ) * converted intentions conf entry to ref CT format * set up intentions nav * add page for intentions usage * final intentions usage page * final intentions overview page * fixed old relative links * updated diagram for overview * updated links to intentions content * fixed typo in updated links * rename intentions overview page file to index * rollback link updates to intentions overview * fixed nav * Updated custom HTML in API and CLI pages to MD * applied suggestions from review to index page * moved conf examples from usage to conf ref * missed custom HTML section * applied additional feedback * Apply suggestions from code review Co-authored-by: Tu Nguyen <im2nguyen@users.noreply.github.com> * updated headings in usage page * renamed files and udpated nav * updated links to new file names * added redirects and final tweaks * typo --------- Co-authored-by: Tu Nguyen <im2nguyen@users.noreply.github.com>	2 years ago
Ashvitha	f95ffe0355	Allow HCP metrics collection for Envoy proxies Co-authored-by: Ashvitha Sridharan <ashvitha.sridharan@hashicorp.com> Co-authored-by: Freddy <freddygv@users.noreply.github.com> Add a new envoy flag: "envoy_hcp_metrics_bind_socket_dir", a directory where a unix socket will be created with the name `<namespace>_<proxy_id>.sock` to forward Envoy metrics. If set, this will configure: - In bootstrap configuration a local stats_sink and static cluster. These will forward metrics to a loopback listener sent over xDS. - A dynamic listener listening at the socket path that the previously defined static cluster is sending metrics to. - A dynamic cluster that will forward traffic received at this listener to the hcp-metrics-collector service. Reasons for having a static cluster pointing at a dynamic listener: - We want to secure the metrics stream using TLS, but the stats sink can only be defined in bootstrap config. With dynamic listeners/clusters we can use the proxy's leaf certificate issued by the Connect CA, which isn't available at bootstrap time. - We want to intelligently route to the HCP collector. Configuring its addreess at bootstrap time limits our flexibility routing-wise. More on this below. Reasons for defining the collector as an upstream in `proxycfg`: - The HCP collector will be deployed as a mesh service. - Certificate management is taken care of, as mentioned above. - Service discovery and routing logic is automatically taken care of, meaning that no code changes are required in the xds package. - Custom routing rules can be added for the collector using discovery chain config entries. Initially the collector is expected to be deployed to each admin partition, but in the future could be deployed centrally in the default partition. These config entries could even be managed by HCP itself.	2 years ago
Kyle Havlovitz	d53c331a37	Add a flag for enabling debug logs to the `connect envoy` command (#15988 ) * Add a flag for enabling debug logs to the `connect envoy` command * Update website/content/commands/connect/envoy.mdx Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com> * Add changelog note * Add debug log note to envoy proxy doc page * Update website/content/docs/connect/proxies/envoy.mdx Co-authored-by: Kendall Strautman <36613477+kendallstrautman@users.noreply.github.com> * Wording tweak in envoy bootstrap section --------- Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com> Co-authored-by: Kendall Strautman <36613477+kendallstrautman@users.noreply.github.com>	2 years ago
Jeff Boruszak	abfdc35fc7	docs: CLI page descriptions for automated checker (#16056 ) * ACL * ACL * Catalog * consul config * consul connect * top-level updates * consul intention * consul kv * consul namespace * consul peering * consul peering delete * consul services * consul snapshot * consul tls * consul acl auth-method * acl binding-rule * acl policy * acl role * acl token * fix * standardization * Update website/content/commands/snapshot/save.mdx Co-authored-by: Bryce Kalow <bkalow@hashicorp.com> * consul debug consul keyring Co-authored-by: Bryce Kalow <bkalow@hashicorp.com> Co-authored-by: Tu Nguyen <im2nguyen@users.noreply.github.com>	2 years ago
Ashlee M Boyer	6e425f7428	docs: Migrate link formats (#15976 ) * Adding check-legacy-links-format workflow * Adding test-link-rewrites workflow * Updating docs-content-check-legacy-links-format hash * Migrating links to new format Co-authored-by: Kendall Strautman <kendallstrautman@gmail.com>	2 years ago
Ashwin Venkatesh	a1e2a4f8d6	Add support for envoy readiness flags (#16015 ) * Add support for envoy readiness flags - add flags 'envoy-ready-bind-port` and `envoy-ready-bind-addr` on consul connect envoy to create a ready listener on that address.	2 years ago
Dan Stough	5d3643f4f0	docs(access logs): new docs for access logging (#15948 ) Co-authored-by: Jared Kirschner <85913323+jkirschner-hashicorp@users.noreply.github.com> Co-authored-by: Jeff Boruszak <104028618+boruszak@users.noreply.github.com>	2 years ago
Michael Wilkerson	1b28b89439	Enhancement: Consul Compatibility Checking (#15818 ) * add functions for returning the max and min Envoy major versions - added an UnsupportedEnvoyVersions list - removed an unused error from TestDetermineSupportedProxyFeaturesFromString - modified minSupportedVersion to use the function for getting the Min Envoy major version. Using just the major version without the patch is equivalent to using `.0` * added a function for executing the envoy --version command - added a new exec.go file to not be locked to unix system * added envoy version check when using consul connect envoy * added changelog entry * added docs change	2 years ago
Jared Kirschner	8991e116fe	docs: how to launch envoy when ACLs enabled (#15497 )	2 years ago
Jared Kirschner	66e28f35f1	docs: clarify Vault CA provider permissions needed (#15478 )	2 years ago
Derek Menteer	6fa8fa4fca	Fix issue with connect Envoy choosing incorrect TLS settings. (#15466 ) This commit fixes a situation where the API TLS configuration incorrectly influences the GRPC port TLS configuration for XDS.	2 years ago
Iryna Shustava	2a25669b13	cli/sdk: Allow redirection to a different consul dns port (#15050 )	2 years ago
Jared Kirschner	f59483bc9e	docs: fix api docs anchor links	2 years ago
Iryna Shustava	4bc4ef135c	cli: Add -node-name flag to redirect-traffic command (#14933 )	2 years ago
Bryce Kalow	85c1a33c42	website: content updates for developer (#14419 ) Co-authored-by: Ashlee Boyer <ashlee.boyer@hashicorp.com> Co-authored-by: Ashlee M Boyer <43934258+ashleemboyer@users.noreply.github.com> Co-authored-by: Tu Nguyen <im2nguyen@gmail.com> Co-authored-by: Tu Nguyen <im2nguyen@users.noreply.github.com> Co-authored-by: HashiBot <62622282+hashibot-web@users.noreply.github.com> Co-authored-by: Kevin Wang <kwangsan@gmail.com>	2 years ago
Evan Culver	d0416f593c	connect: Bump latest Envoy to 1.23.1 in test matrix (#14573 )	2 years ago
Jared Kirschner	95c72164a4	docs: show CLI cmd-specific opts before general opts Applied to all remaining CLI commands.	2 years ago
Kyle Havlovitz	340a234361	Update docs for prometheus TLS options	2 years ago
Natalie Smith	0a51e145c1	docs: simplify agent docs slugs	3 years ago
Natalie Smith	ddae7d18a2	docs: fix external links to agent config pages	3 years ago
Bryce Kalow	6bf67b7ef4	website: redirect /api to /api-docs (#12660 )	3 years ago
mrspanishviking	7180c99960	Revert "[Docs] Agent configuration hierarchy "	3 years ago
trujillo-adam	76d55ac2b4	merging new hierarchy for agent configuration	3 years ago
mrspanishviking	ed586ade37	Update website/content/commands/connect/redirect-traffic.mdx Co-authored-by: Blake Covarrubias <blake.covarrubias@gmail.com>	3 years ago
Ricardo Oliveira	c4ea922958	Update website/content/commands/connect/redirect-traffic.mdx Co-authored-by: mrspanishviking <cardenas88karl@gmail.com>	3 years ago
Ricardo Oliveira	db9c6acf04	Update redirect-traffic.mdx	3 years ago
Blake Covarrubias	59394e4aa2	docs: Avoid redirects by pointing links to new URLs Avoid HTTP redirects for internal site links by updating old URLs to point to the new location for the target content.	3 years ago
Blake Covarrubias	f273cfdc67	docs: Use long form of CLI flags (#12030 ) Use long form of CLI flags in all example commands. Co-authored-by: mrspanishviking <kcardenas@hashicorp.com> Co-authored-by: David Yu <dyu@hashicorp.com>	3 years ago
Matt Siegel	f7b1208fc3	Fixed absolute links to HTTP apis.	3 years ago
Matt Siegel	33933f8a33	Added ACL requirements for CLI commands	3 years ago
Matt Siegel	bfb88306f6	Added Corresponding HTTP API Endpoints for every CLI command	3 years ago
Mark Anderson	9806b7c268	Website fixups for admin partitions (#11842 ) * Website fixups for admin partitions Signed-off-by: Mark Anderson <manderson@hashicorp.com>	3 years ago
Evan Culver	df4bc6a924	Update default version in command docs	3 years ago
Freddy	8d83d27674	connect: update envoy supported versions to latest patch release (#10961) Relevant advisory: https://github.com/envoyproxy/envoy/security/advisories/GHSA-6g4j-5vrw-2m8h	3 years ago
Blake Covarrubias	8aa89c2c12	docs: Clarify ingress gateway's -address flag (#10810 ) Clarify the function of `-address` flag when instantiating an ingress gateway. Resolves #9849 Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>	3 years ago
Blake Covarrubias	17e18df81e	docs: Document supported `consul connect` env vars (#10667 ) Document the ability to specify `-sidecar-for` and `-proxy-id` flags via environment variables.	3 years ago
Iryna Shustava	95305881ce	cli/sdk: Allow applying redirect-traffic rules in a provided Linux namespace (#10564 )	3 years ago
R.B. Boyer	3b50a55533	connect: update supported envoy versions to 1.18.3, 1.17.3, 1.16.4, and 1.15.5 (#10231 )	4 years ago
R.B. Boyer	abc1dc0fe9	connect: update supported envoy versions to 1.18.2, 1.17.2, 1.16.3, and 1.15.4 (#10101 ) The only thing that needed fixing up pertained to this section of the 1.18.x release notes: > grpc_stats: the default value for stats_for_all_methods is switched from true to false, in order to avoid possible memory exhaustion due to an untrusted downstream sending a large number of unique method names. The previous default value was deprecated in version 1.14.0. This only changes the behavior when the value is not set. The previous behavior can be used by setting the value to true. This behavior change by be overridden by setting runtime feature envoy.deprecated_features.grpc_stats_filter_enable_stats_for_all_methods_by_default. For now to maintain status-quo I'm explicitly setting `stats_for_all_methods=true` in all versions to avoid relying upon the default. Additionally the naming of the emitted metrics for these gRPC requests changed slightly so the integration test assertions for `case-grpc` needed adjusting.	4 years ago
Iryna Shustava	8dffb89131	Implement traffic redirection exclusion based on proxy config and user-provided values (#10134 ) * Use proxy outbound port from TransparentProxyConfig if provided * If -proxy-id is provided to the redirect-traffic command, exclude any listener ports from inbound traffic redirection. This includes envoy_prometheus_bind_addr, envoy_stats_bind_addr, and the ListenerPort from the Expose configuration. * Allow users to provide additional inbound and outbound ports, outbound CIDRs and additional user IDs to be excluded from traffic redirection. This affects both the traffic-redirect command and the iptables SDK package.	4 years ago
Freddy	8b8c3c1992	Add docs for transparent proxy mode and config (#10038 ) Add docs for transparent proxy mode and config Co-authored-by: Nitya Dhanushkodi <nitya@hashicorp.com> Co-authored-by: Blake Covarrubias <blake@covarrubi.as> Co-authored-by: Iryna Shustava <ishustava@users.noreply.github.com> Co-authored-by: Jeff Escalante <jescalan@users.noreply.github.com>	4 years ago
Iryna Shustava	5755c97bc7	cli: Add new `consul connect redirect-traffic` command for applying traffic redirection rules when Transparent Proxy is enabled. (#9910 ) * Add new consul connect redirect-traffic command for applying traffic redirection rules when Transparent Proxy is enabled. * Add new iptables package for applying traffic redirection rules with iptables.	4 years ago
Zachary Shilton	8671762474	website: implement mktg 032 (#9953 ) * website: migrate to new nav-data format * website: clean up unused intro content * website: remove deprecated sidebar_title from frontmatter * website: add react-content to fix global style import issue	4 years ago
Kyle Havlovitz	1e87c7183a	Merge pull request #9672 from hashicorp/ca-force-skip-xc connect/ca: Allow ForceWithoutCrossSigning for all providers	4 years ago
Nitya Dhanushkodi	15e8b13891	Add flags to consul connect envoy for metrics merging. (#9768 ) Allows setting -prometheus-backend-port to configure the cluster envoy_prometheus_bind_addr points to. Allows setting -prometheus-scrape-path to configure which path envoy_prometheus_bind_addr exposes metrics on. -prometheus-backend-port is used by the consul-k8s metrics merging feature, to configure envoy_prometheus_bind_addr to point to the merged metrics endpoint that combines Envoy and service metrics so that one set of annotations on a Pod can scrape metrics from the service and it's Envoy sidecar. -prometheus-scrape-path is used to allow configurability of the path where prometheus metrics are exposed on envoy_prometheus_bind_addr.	4 years ago
R.B. Boyer	398b766532	xds: default to speaking xDS v3, but allow for v2 to be spoken upon request (#9658 ) - Also add support for envoy 1.17.0	4 years ago
R.B. Boyer	6eeccc93ce	connect: update supported envoy point releases to 1.16.2, 1.15.3, 1.14.6, 1.13.7 (#9737 )	4 years ago
Kyle Havlovitz	7dac583863	connect/ca: Allow ForceWithoutCrossSigning for all providers This allows setting ForceWithoutCrossSigning when reconfiguring the CA for any provider, in order to forcibly move to a new root in cases where the old provider isn't reachable or able to cross-sign for whatever reason.	4 years ago
Jeff Escalante	582dce9d8f	maintenance complete, pending markdown-page component addition	4 years ago

49 Commits (46212cc5706aaa0bce4ac8c5c1d32ff2509bfc27)