consul

Commit Graph

Author	SHA1	Message	Date
Melisa Griffin	9ca62aaf33	Adds proto for the GatewayClass based on the GAMMA Kubernetes Sig (#19615 )	1 year ago
Nathan Coleman	40c57f10a0	NET-6391 Initialize controller for MeshGateway resource (#19552 ) * Generate resource_types for MeshGateway by specifying spec option * Register MeshGateway type w/ TODOs for hooks * Initialize controller for MeshGateway resources * Add meshgateway to list of v2 resource dependencies for golden test * Scope MeshGateway resource to partition	1 year ago
Nathan Coleman	028f1d8c50	NET-6390 Initialize MeshGateway proto (#19548 )	1 year ago
Michael Zalimeni	a7803bd829	[NET-6305] xds: Ensure v2 route match and protocol are populated for gRPC (#19343 ) * xds: Ensure v2 route match is populated for gRPC Similar to HTTP, ensure that route match config (which is required by Envoy) is populated when default values are used. Because the default matches generated for gRPC contain a single empty `GRPCRouteMatch`, and that proto does not directly support prefix-based config, an interpretation of the empty struct is needed to generate the same output that the `HTTPRouteMatch` is explicitly configured to provide in internal/mesh/internal/controllers/routes/generate.go. * xds: Ensure protocol set for gRPC resources Add explicit protocol in `ProxyStateTemplate` builders and validate it is always set on clusters. This ensures that HTTP filters and `http2_protocol_options` are populated in all the necessary places for gRPC traffic and prevents future unintended omissions of non-TCP protocols. Co-authored-by: John Murret <john.murret@hashicorp.com> --------- Co-authored-by: John Murret <john.murret@hashicorp.com>	1 year ago
John Murret	a7fbd00865	NET-5073 - ProxyConfiguration: implement various connection options (#19187 ) * NET-5073 - ProxyConfiguration: implement various connection options * PR feedback - LocalConnection and InboundConnection do not affect exposed routes. configure L7 route destinations. fix connection proto sequence numbers. * add timeout to L7 Route Destinations	1 year ago
Iryna Shustava	e94d6ceca6	mesh: add validation hook to proxy configuration (#19186 )	1 year ago
Ashwin Venkatesh	3d1a606c3b	Clone proto into deepcopy correctly (#19204 )	1 year ago
Ashwin Venkatesh	c2a0d4f9ca	Create DeepCopy() and Json Marshal/Unmarshal for proto-public (#19015 ) * Override Marshal/UnmarshalJSON for proto-public types * Generate Deepcopy() for proto-public types for Kubernetes CRDs.	1 year ago
Nitya Dhanushkodi	95d9b2c7e4	[NET-4931] xdsv2, sidecarproxycontroller, l4 trafficpermissions: support L7 (#19185 ) * xdsv2: support l7 by adding xfcc policy/headers, tweaking routes, and make a bunch of listeners l7 tests pass * sidecarproxycontroller: add l7 local app support * trafficpermissions: make l4 traffic permissions work on l7 workloads * rename route name field for consistency with l4 cluster name field * resolve conflicts and rebase * fix: ensure route name is used in l7 destination route name as well. previously it was only in the route names themselves, now the route name and l7 destination route name line up	1 year ago
Iryna Shustava	54a12ab3c9	mesh: sidecar proxy controller improvements (#19083 ) This change builds on #19043 and #19067 and updates the sidecar controller to use those computed resources. This achieves several benefits: * The cache is now simplified which helps us solve for previous bugs (such as multiple Upstreams/Destinations targeting the same service would overwrite each other) * We no longer need proxy config cache * We no longer need to do merging of proxy configs as part of the controller logic * Controller watches are simplified because we no longer need to have complex mapping using cache and can instead use the simple ReplaceType mapper. It also makes several other improvements/refactors: * Unifies all caches into one. This is because originally the caches were more independent, however, now that they need to interact with each other it made sense to unify them where sidecar proxy controller uses one cache with 3 bimappers * Unifies cache and mappers. Mapper already needed all caches anyway and so it made sense to make the cache do the mapping also now that the cache is unified. * Gets rid of service endpoints watches. This was needed to get updates in a case when service's identities have changed and we need to update proxy state template's spiffe IDs for those destinations. This will however generate a lot of reconcile requests for this controller as service endpoints objects can change a lot because they contain workload's health status. This is solved by adding a status to the service object tracking "bound identities" and have service endpoints controller update it. Having service's status updated allows us to get updates in the sidecar proxy controller because it's already watching service objects * Add a watch for workloads. We need it so that we get updates if workload's ports change. This also ensures that we update cached identities in case workload's identity changes.	1 year ago
Iryna Shustava	ad06c96456	mesh: add computed destinations with a controller that computes them (#19067 ) This commit adds a new type ComputedDestinations that will contain all destinations from any Destinations resources and will be name-aligned with a workload. This also adds an explicit-destinations controller that computes these resources. This is needed to simplify the tracking we need to do currently in the sidecar-proxy controller and makes it easier to query all explicit destinations that apply to a workload.	1 year ago
Iryna Shustava	60b75a55f7	mesh: implement exposed paths (#19044 ) Implement exposed paths listeners in the sidecar proxy controller.	1 year ago
Iryna Shustava	c35df12c95	mesh: Add ComputedProxyConfiguration and a controller that computes it. (#19043 ) * Introduce a new type `ComputedProxyConfiguration` and add a controller for it. This is needed for two reasons. The first one is that external integrations like kubernetes may need to read the fully computed and sorted proxy configuration per workload. The second reasons is that it makes sidecar-proxy controller logic quite a bit simpler as it no longer needs to do this. * Generalize workload selection mapper and fix a bug where it would delete IDs from the tree if only one is left after a removal is done.	1 year ago
Eric Haberkorn	f2b7b4591a	Fix Traffic Permissions Default Deny (#19028 ) Whenver a traffic permission exists for a given workload identity, turn on default deny. Previously, this was only working at the port level.	1 year ago
Iryna Shustava	3ea6afb4d4	mesh: rename Upstreams and UpstreamsConfiguration to Destinations* (#18995 )	1 year ago
R.B. Boyer	ca7533850c	mesh: update various protobuf comments for mesh types (#18993 )	1 year ago
Iryna Shustava	e6b724d062	catalog,mesh,auth: Move resource types to the proto-public module (#18935 )	1 year ago
R.B. Boyer	9e48607893	mesh: compute more of the xRoute features into ComputedRoutes (#18980 ) Convert more of the xRoutes features that were skipped in an earlier PR into ComputedRoutes and make them work: - DestinationPolicy defaults - more timeouts - load balancer policy - request/response header mutations - urlrewrite - GRPCRoute matches	1 year ago
R.B. Boyer	11d6b0df45	mesh: store bound reference pointers on a ComputedRoutes resource and use during reconcile (#18965 ) xRoute resource types contain a slice of parentRefs to services that they manipulate traffic for. All xRoutes that have a parentRef to given Service will be merged together to generate a ComputedRoutes resource name-aligned with that Service. This means that a write of an xRoute with 2 parent ref pointers will cause at most 2 reconciles for ComputedRoutes. If that xRoute's list of parentRefs were ever to be reduced, or otherwise lose an item, that subsequent map event will only emit events for the current set of refs. The removed ref will not cause the generated ComputedRoutes related to that service to be re-reconciled to omit the influence of that xRoute. To combat this, we will store on the ComputedRoutes resource a BoundResources []*pbresource.Reference field with references to all resources that were used to influence the generated output. When the routes controller reconciles, it will use a bimapper to index this influence, and the dependency mappers for the xRoutes will look themselves up in that index to discover additional (former) ComputedRoutes that need to be notified as well.	1 year ago
Iryna Shustava	d88888ee8b	catalog,mesh,auth: Bump versions to v2beta1 (#18930 )	1 year ago

20 Commits (4ab7adaf54fa0ccffe158d71a87485e7b891d6f3)