14779 Commits (47da00d3c71c784b398354b5e2fd49df096299eb)

 

All Branches   

Search

Author	SHA1	Message	Date
freddygv	47da00d3c7	Validate SANs for passthrough clusters and failovers	3 years ago
freddygv	5454147c09	Update golden files to account for SAN validation	3 years ago
freddygv	a6d3fe90b1	Validate Subject Alternative Name for upstreams ... These changes ensure that the identity of services dialed is cryptographically verified. For all upstreams we validate against SPIFFE IDs in the format used by Consul's service mesh: spiffe://<trust-domain>/ns/<namespace>/dc/<datacenter>/svc/<service>	3 years ago
Daniel Nephin	4a92f2d428	Merge pull request #10568 from hashicorp/dnephin/contrib-docs-config ... contrib: add first draft of agent configuration docs	3 years ago
Daniel Nephin	b93f9d8788	contrib: add first draft of agent configuration docs	3 years ago
Kyle Havlovitz	8bf7182e73	Merge pull request #10616 from hashicorp/partitions/oss-http-params ... oss: add partition query param parsing	3 years ago
Kyle Havlovitz	77a2f38677	http: add partition query param parsing	3 years ago
hc-github-team-consul-core	1169df0878	auto-updated agent/uiserver/bindata_assetfs.go from commit 3e80e637b	3 years ago
John Cowen	3e80e637ba	ui: [BUGFIX] Fix KV Code Editor syntax loading (#10605) ... This commit adds a bit of string wrangling to avoid the keys in our javascript source file also being transformed. Additionally, whilst looking at this we decided that Maps are a better dictionary than javascript objects, so we moved to use those here also (but this doesn't affect the issue)	3 years ago
John Cowen	54f0cd812a	ui: Show the correct 'ACLs Disabled' page when ACLs are disabled (#10604) ... Adds 'can access ACLs' which means one of two things 1. When ACLs are disabled I can access the 'please enable ACLs' page 2. When ACLs are enabled, its the same as canRead	3 years ago
John Cowen	b256313256	ui: [BUGFIX] Ensure in-folder KVs are created in the correct folder (#10569) ... When clicking to create a KV within folder name, would would be viewing a form that was a form for creating a KV in the root, which when the user clicked to save, saved the KV in the root. For the moment at least I've removed the code that strips double slashes, and whilst this isn't ideal, it looks like we've picked up one of those bugs that turns into a 'feature', and completely reworking KV to not rely on the double slashes is not really an option right now.	3 years ago
Melissa Kam	fb95d447db	Merge pull request #10614 from hashicorp/nia/docs-0.2.1 ... nia/docs 0.2.1	3 years ago
David Yu	28087b6949	docs: Add link to learn guide on migrating ACL tokens (#10609) ... * docs: Add link to learn guide on migrating ACL tokens	3 years ago
Daniel Nephin	74fb650b6b	Merge pull request #10588 from hashicorp/dnephin/config-fix-ports-grpc ... config: rename `ports.grpc` to `ports.xds`	3 years ago
Daniel Nephin	b5cd2050b4	fix backwards compat for envoy command ... The compatv2 integration tests were failing because they use an older CLI version with a newer HTTP API. This commit restores the GRPCPort field to the DebugConfig output to allow older CIs to continue to fetch the port.	3 years ago
Daniel Nephin	233d03dbbd	Apply suggestions from code review ... Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com>	3 years ago
Daniel Nephin	4ad80ccee3	command/envoy: stop using the DebugConfig from Self endpoint ... The DebugConfig in the self endpoint can change at any time. It's not a stable API. With the previous change to rename GRPCPort to XDSPort this command would have broken. This commit adds the XDSPort to a stable part of the XDS api, and changes the envoy command to read this new field. It includes support for the old API as well, in case a newer CLI is used with an older API, and adds a test for both cases.	3 years ago
Daniel Nephin	c48f26b0a6	config: update config settings and flags for ports.xds	3 years ago
Dhia Ayachi	58bd817336	check expiry date of the root/intermediate before using it to sign a leaf (#10500) ... * ca: move provider creation into CAManager This further decouples the CAManager from Server. It reduces the interface between them and removes the need for the SetLogger method on providers. * ca: move SignCertificate to CAManager To reduce the scope of Server, and keep all the CA logic together * ca: move SignCertificate to the file where it is used * auto-config: move autoConfigBackend impl off of Server Most of these methods are used exclusively for the AutoConfig RPC endpoint. This PR uses a pattern that we've used in other places as an incremental step to reducing the scope of Server. * fix linter issues * check error when `raftApplyMsgpack` * ca: move SignCertificate to CAManager To reduce the scope of Server, and keep all the CA logic together * check expiry date of the intermediate before using it to sign a leaf * fix typo in comment Co-authored-by: Kyle Havlovitz <kylehav@gmail.com> * Fix test name * do not check cert start date * wrap error to mention it is the intermediate expired * Fix failing test * update comment Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> * use shim to avoid sleep in test * add root cert validation * remove duplicate code * Revert "fix linter issues" This reverts commit 6356302b54. * fix import issue * gofmt leader_connect_ca * add changelog entry * update error message Co-authored-by: Freddy <freddygv@users.noreply.github.com> * fix error message in test Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> Co-authored-by: Kyle Havlovitz <kylehav@gmail.com> Co-authored-by: Freddy <freddygv@users.noreply.github.com>	3 years ago
R.B. Boyer	6c47efd532	connect/ca: ensure edits to the key type/bits for the connect builtin CA will regenerate the roots (#10330) ... progress on #9572	3 years ago
R.B. Boyer	7bf9ea55cf	connect/ca: require new vault mount points when updating the key type/bits for the vault connect CA provider (#10331) ... progress on #9572	3 years ago
Iryna Shustava	95305881ce	cli/sdk: Allow applying redirect-traffic rules in a provided Linux namespace (#10564)	3 years ago
Melissa Kam	a8e74bcf65	Merge pull request #10606 from hashicorp/cts-tf-1.0 ... nia/docs: Terraform 1.0 compatability	3 years ago
Melissa Kam	ea302c7d3e	nia/docs: Terraform 1.0 compatability	3 years ago
Daniel Nephin	dc15e5eb8c	Merge pull request #10579 from hashicorp/dnephin/improve-config-docs-tls ... docs: Improve TLS user documentation	3 years ago
Daniel Nephin	0ccad1d6f7	Merge pull request #10479 from hashicorp/dnephin/ca-provider-explore-2 ... ca: move Server.SignIntermediate to CAManager	3 years ago
Noel Quiles	29d2a9f4c5	Bump hashi-stack-menu (#10599)	3 years ago
Curt Marker	eb3e9271d3	Fixed a typo that broke the example static-server deployment (#10582) ... The service account was typo'd and needs to be fixed	3 years ago
Daniel Nephin	b89ec826c8	Merge pull request #10445 from hashicorp/dnephin/ca-provider-explore ... ca: isolate more of the CA logic in CAManager	3 years ago
Daniel Nephin	bf292cbae4	ca: use provider constructors to be more consistent ... Adds a contructor for the one provider that did not have one.	3 years ago
Dhia Ayachi	5ed56fc786	check error when `raftApplyMsgpack`	3 years ago
Daniel Nephin	3091026e02	auto-config: move autoConfigBackend impl off of Server ... Most of these methods are used exclusively for the AutoConfig RPC endpoint. This PR uses a pattern that we've used in other places as an incremental step to reducing the scope of Server.	3 years ago
Daniel Nephin	0512cb2813	ca: move SignCertificate to the file where it is used	3 years ago
Daniel Nephin	dfebfe508e	ca: move SignCertificate to CAManager ... To reduce the scope of Server, and keep all the CA logic together	3 years ago
Daniel Nephin	c69a3fa760	docs: move TLS example next to field reference	3 years ago
Daniel Nephin	7e681b1428	Update website/content/docs/agent/options.mdx ... Co-authored-by: Kent 'picat' Gruber <kent@hashicorp.com>	3 years ago
Daniel Nephin	570eac3167	Merge pull request #10590 from hashicorp/dnephin/tls-config-less-copy ... config: remove duplicate tlsutil.Config fields from agent/consul.Config	3 years ago
hc-github-team-consul-core	a9dcfc59bd	auto-updated agent/uiserver/bindata_assetfs.go from commit a96e87aec	3 years ago
Dhia Ayachi	047537833d	add missing state reset when stopping ca manager	3 years ago
Daniel Nephin	6228c4a53c	ca: fix mockCAServerDelegate to work with the new interface ... raftApply was removed so ApplyCARequest needs to handle all the possible operations Also set the providerShim to use the mock provider. other changes are small test improvements that were necessary to debug the failures.	3 years ago
Daniel Nephin	7dae65cd56	ca: remove unused method ... and small refactor to getCAProvider so that GoLand is less confused about what it is doing. Previously it was reporting that the for condition was always true, which was not the case.	3 years ago
Daniel Nephin	1960c717af	ca: remove raftApply from delegate interface ... After moving ca.ConsulProviderStateDelegate into the interface we now have the ApplyCARequest method which does the same thing. Use this more specific method instead of raftApply.	3 years ago
Daniel Nephin	1f4cdde9cc	ca: move generateCASignRequest to the delegate ... This method on Server was only used by the caDelegateWithState, so move it there until we can move it entirely into CAManager.	3 years ago
Daniel Nephin	fc14f5ab14	ca: move provider creation into CAManager ... This further decouples the CAManager from Server. It reduces the interface between them and removes the need for the SetLogger method on providers.	3 years ago
Kenia	a96e87aece	ui: Add socket icon for UDS (#10573)	3 years ago
Daniel Nephin	b1877660d5	ca-manager: move provider shutdown into CAManager ... Reducing the coupling between Server and CAManager	3 years ago
Evan Culver	8fce7083c1	tests: skip cases that depend on test server when -short flag set (#10576)	3 years ago
mrspanishviking	103a762fa9	Merge pull request #10586 from hashicorp/docs-consult-license ... docs: changing license faq title to align with Nomad and Vault faq pages	3 years ago
Daniel Nephin	be8c675942	config: remove misleading UseTLS field ... This field was documented as enabling TLS for outgoing RPC, but that was not the case. All this field did was set the use_tls serf tag. Instead of setting this field in a place far from where it is used, move the logic to where the serf tag is set, so that the code is much more obvious.	3 years ago
Daniel Nephin	70770db345	config: remove duplicate TLSConfig fields from agent/consul.Config ... tlsutil.Config already presents an excellent structure for this configuration. Copying the runtime config fields to agent/consul.Config makes code harder to trace, and provides no advantage. Instead of copying the fields around, use the tlsutil.Config struct directly instead. This is one small step in removing the many layers of duplicate configuration.	3 years ago