150 Commits (4f940e20028a5a872e672c5437ec82b6e16f674e)

Author	SHA1	Message	Date
Karl Cardenas	d4cbe68913	docs: updated proxy page to use new codeblock	3 years ago
Iryna Shustava	0ee456649f	connect: Support auth methods for the vault connect CA provider (#11573) ... * Support vault auth methods for the Vault connect CA provider * Rotate the token (re-authenticate to vault using auth method) when the token can no longer be renewed	3 years ago
trujillo-adam	e4d89b4214	fixed typo and added link from partition exports to admin partitions section	3 years ago
trujillo-adam	6b8225c6f1	fixed bad links	3 years ago
trujillo-adam	e2ac4c8a30	added link to agent configuration from partition exports in usage section	3 years ago
trujillo-adam	756e65cbcb	applied freddy's feedback	3 years ago
trujillo-adam	91e44f488d	Adding partition exports configuraiton entry details, upstream config, acl impact	3 years ago
trujillo-adam	caf850e135	first commit for cross-partition support - partition exports section	3 years ago
mrspanishviking	b8e11507b1	Merge pull request #11543 from hashicorp/envoy-token ... docs: added more information to help endusers with proxies and ACL	3 years ago
mrspanishviking	f1b4a10c83	Update website/content/docs/connect/proxies/integrate.mdx ... Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>	3 years ago
mrspanishviking	42ab9e8aa4	Update website/content/docs/connect/ca/vault.mdx ... Co-authored-by: Daniel Nephin <dnephin@hashicorp.com>	3 years ago
Karl Cardenas	50ff9e8a6e	docs: added more information to help endusers with proxies and ACL tokens	3 years ago
Karl Cardenas	5644edae5c	docs: added link to the Learn tutorial in Vault CA integration page	3 years ago
Freddy	5e7eb85f2a	Fix caveat about resolvers operating at L4 (#11497) ... Service resolvers can specify L4 rules such as redirects, or L7 rules such as hash-based load balancing policies.	3 years ago
Connor	efe4b21287	Support Vault Namespaces explicitly in CA config (#11477) ... * Support Vault Namespaces explicitly in CA config If there is a Namespace entry included in the Vault CA configuration, set it as the Vault Namespace on the Vault client Currently the only way to support Vault namespaces in the Consul CA config is by doing one of the following: 1) Set the VAULT_NAMESPACE environment variable which will be picked up by the Vault API client 2) Prefix all Vault paths with the namespace Neither of these are super pleasant. The first requires direct access and modification to the Consul runtime environment. It's possible and expected, not super pleasant. The second requires more indepth knowledge of Vault and how it uses Namespaces and could be confusing for anyone without that context. It also infers that it is not supported * Add changelog * Remove fmt.Fprint calls * Make comment clearer * Add next consul version to website docs * Add new test for default configuration * go mod tidy * Add skip if vault not present * Tweak changelog text	3 years ago
FFMMM	fdb0ee6093	change vault ca docs to mention root cert ttl config (#11488) ... Signed-off-by: FFMMM <FFMMM@users.noreply.github.com>	3 years ago
Luke Kysow	9b680b3f81	Add quick-link for users coming from UI (#11403) ... The Consul UI topology view has an icon with the text "Configure metrics dashboard" that links to this page. Add a notice at the top of the page that links them directly to the relevant section.	3 years ago
Luke Kysow	7eb32cdb73	Remove Name/Namespace fields from upstream default (#11456) ... The UpstreamConfig.Defaults field does not support setting Name or Namespace because the purpose is to apply defaults to all upstreams. I think this was just missed in the docs since those fields would error if set under Defaults. i.e. this is not supported: ``` UpstreamConfig { Defaults { Name = "foo" Namespace = "bar" # Defaults config here } } ```	3 years ago
Evan Culver	bec08f4ec3	connect: Add support for Envoy 1.20 (#11277)	3 years ago
Andy Assareh	99ab4f98d4	docs: Mesh gateway requires 1.6.0 *or newer* (#11333) ... * 1.6.0 or newer * Update website/content/docs/connect/gateways/mesh-gateway/index.mdx Co-authored-by: David Yu <dyu@hashicorp.com> Co-authored-by: mrspanishviking <cardenas88karl@gmail.com>	3 years ago
Paul Banks	6c6c75707c	Merge pull request #11037 from hashicorp/docs/mesh-header-manip ... Document HTTP Header manipulation options added in #10613	3 years ago
Paul Banks	3da2fbdc63	Wording improvements from review	3 years ago
Evan Culver	9b73e7319d	Merge branch 'main' into eculver/envoy-1.19.1	3 years ago
Jared Kirschner	d9e78cd3e8	Merge pull request #11167 from hashicorp/add-cross-dc-comm-model-visual ... Improve mesh gateway diagram	3 years ago
Jared Kirschner	98f53e913f	Improve mesh gateway diagram ... Diagram now shows all possible cross-DC communication models supported by mesh gateways for both the control and data planes.	3 years ago
Paul Banks	1a611f0c1b	Apply suggestions from code review ... Co-authored-by: Blake Covarrubias <blake@covarrubi.as>	3 years ago
Chris S. Kim	e3248c20c9	agent: Clean up unused built-in proxy config (#11165)	3 years ago
Paul Banks	020e2692da	Merge pull request #10725 from hashicorp/banks-patch-3 ... Call out the incompatibility of wildcards and L7 permissions	3 years ago
Paul Banks	fe92cf7cb6	Document HTTP Header manipulation options added in #10613	3 years ago
Evan Culver	f7380461c7	update docs to indicate support for envoy 1.19.1 in Consul 1.11.x	3 years ago
Kyle MacDonald	4b966094ff	website: fixup incorrect markdown syntax (#11015)	3 years ago
Paul Banks	c118e51d5c	Apply suggestions from code review ... Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>	3 years ago
Paul Banks	fd259db9fb	Document how to make namespace wildcard intentions. (#10724) ... * Update intentions.mdx * Apply suggestions from code review Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> Co-authored-by: Blake Covarrubias <blake@covarrubi.as> Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> Co-authored-by: Blake Covarrubias <blake@covarrubi.as>	3 years ago
Freddy	8d83d27674	connect: update envoy supported versions to latest patch release ... (#10961) Relevant advisory: https://github.com/envoyproxy/envoy/security/advisories/GHSA-6g4j-5vrw-2m8h	3 years ago
Nitya Dhanushkodi	329ec62582	doc: remove sentence that tproxy works cross-DC with config entries. (#10885) ... It can only work if there is a running service instance in the local DC, so this is a bit misleading, since failover and redirects are typically used when there is not an instance in the local DC.	3 years ago
Blake Covarrubias	e62b1d05d8	docs: Add common CA config options to provider doc pages (#10842) ... Add the list of common Connect CA configuration options to the provider-specific CA docs. Previously these options were only documented under the agent configuration options. This change makes it so that all supported CA provider configuration options are available from a single location. Co-authored-by: Daniel Nephin <dnephin@hashicorp.com>	3 years ago
Blake Covarrubias	97b4fdff0d	Document possible risk w.r.t exposing the admin API in Envoy (#10817) ... Add a section to the Connect Security page which highlights the risks of exposing Envoy's administration interface outside of localhost. Resolves #5692 Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com> Co-authored-by: Kent 'picat' Gruber <kent@hashicorp.com>	3 years ago
Blake Covarrubias	8aa89c2c12	docs: Clarify ingress gateway's -address flag (#10810) ... Clarify the function of `-address` flag when instantiating an ingress gateway. Resolves #9849 Co-authored-by: trujillo-adam <47586768+trujillo-adam@users.noreply.github.com>	3 years ago
Chris Piraino	8f5e2a440b	docs: remove note on ingress gateway hosts field needing a port number (#10827) ... This was necessary in older versions of Consul, but was obsoleted by making Consul add the port number itself when constructing the Envoy configuration.	3 years ago
Blake Covarrubias	99b1d8ed8c	docs: Update code blocks across website ... * Use CodeTabs for examples in multiple formats. * Ensure correct language on code fences. * Use CodeBlockConfig for examples with filenames, or which need highlighted content.	3 years ago
Blake Covarrubias	3363da7d35	docs: Add JSON examples to all config entries ... This commit adds example JSON configs for several config entry resources were missing examples in this language. The examples have been updated to use the new CodeTabs resource instead of the Tab component.	3 years ago
trujillo-adam	9e348edfaf	Merge branch 'main' into docs-envoy-proxy-breaks-when-enabling-tls	3 years ago
trujillo-adam	ec7526caaa	Update website/content/docs/connect/proxies/envoy.mdx ... Co-authored-by: Blake Covarrubias <blake@covarrubi.as>	3 years ago
trujillo-adam	7d00adb824	Update website/content/docs/connect/proxies/envoy.mdx ... Co-authored-by: Blake Covarrubias <blake@covarrubi.as>	3 years ago
trujillo-adam	3fabe18acd	docs: adding env var info, resolves #7926	3 years ago
trujillo-adam	c5824a834b	Merge pull request #10763 from hashicorp/docs-proxy-integration-improvements ... general language and readability improvements to proxy integration docs	3 years ago
trujillo-adam	5913aca502	Applying more feedback from @black and @karl-cardenas-coding	3 years ago
trujillo-adam	8ec29432d2	Applying feedback from @blake	3 years ago
trujillo-adam	ee1de179ed	Update website/content/docs/connect/proxies/integrate.mdx ... Co-authored-by: Blake Covarrubias <blake@covarrubi.as>	3 years ago
trujillo-adam	31b9058602	general language and readability improvements to proxy integration docs	3 years ago
Blake Covarrubias	734fd1949f	docs: Note proxy-defaults can globally set service protocol (#10649) ... Add a note to the docs for the service defaults config entry which informs users that the service protocol can be configured for all services using the proxy defaults config entry. Resolves #8279 Co-authored-by: Freddy <freddygv@users.noreply.github.com>	3 years ago
Paul Banks	260364bb04	Call out the incompatibility of wildcards and L7 permissions	3 years ago
Fabio Lichinchi	b408bcfa39	Update vault.mdx (#10679)	3 years ago
Blake Covarrubias	832896ed11	docs: Fix spelling errors across website	3 years ago
David Yu	fc411b2313	docs: Update docs to reflect limitation in TProxy when using single Consul DC deployment with multiple k8s clusters (#10549) ... * docs: Update to reflect single Consul DC deployment with multiple k8s clusters	3 years ago
Daniel Nephin	2c4f22a9f0	Merge pull request #10552 from hashicorp/dnephin/ca-remove-rotation-period ... ca: remove unused RotationPeriod field	3 years ago
jkirschner-hashicorp	5f73de6fbc	Merge pull request #10560 from jkirschner-hashicorp/change-sane-to-reasonable ... Replace use of 'sane' where appropriate	3 years ago
Daniel Nephin	3a045cca8d	ca: remove unused RotationPeriod field ... This field was never used. Since it is persisted as part of a map[string]interface{} it is pretty easy to remove it.	3 years ago
Jared Kirschner	bd536151e1	Replace use of 'sane' where appropriate ... HashiCorp voice, style, and language guidelines recommend avoiding ableist language unless its reference to ability is accurate in a particular use.	3 years ago
Daniel Nephin	fa5d627014	Merge pull request #10527 from hashicorp/rename-main-branch ... Update references to the main branch	3 years ago
Luke Kysow	68c4c232a1	docs: Document setting dashboard_url on k8s (#10510) ... It's tricky because the `{{` needs to be escaped with Helm.	3 years ago
Daniel Nephin	4d741531b4	Update references to the main branch ... The main branch is being renamed from master->main. This commit should update all references to the main branch to the new name. Co-Authored-By: Mike Morris <mikemorris@users.noreply.github.com>	3 years ago
Jared Kirschner	8dae08e30e	Fix service splitter example weight sum ... Weight sum must be equal to 100.	3 years ago
David Yu	7962dd82f1	docs - Adding Mesh as CRD in Consul K8s (#10459) ... * docs - Adding Mesh as CRD in Consul K8s * Removing extra left brace in ServiceDefaults	3 years ago
Luke Kysow	1dcdd2516c	Update config entry docs for CRDs (#10407) ... * Update mesh, proxy-defaults and service-defaults docs to properly document Kubernetes YAML. Co-authored-by: David Yu <dyu@hashicorp.com>	3 years ago
Nitya Dhanushkodi	b72ad40286	docs: upgrading to tproxy (/docs/upgrades/upgrade-specific) (#10416) ... * docs: update tproxy docs Co-authored-by: Blake Covarrubias <blake@covarrubi.as> Co-authored-by: Iryna Shustava <ishustava@users.noreply.github.com> Co-authored-by: David Yu <dyu@hashicorp.com>	3 years ago
Nitya Dhanushkodi	7494b25c1e	docs: update tproxy docs (/docs/connect/transparent-proxy) (#10415) ... * docs: update tproxy docs * add examples * links	3 years ago
Blake Covarrubias	d9add7c2c3	docs: Remove beta tag for 1.10 features ... Remove beta tag for 1.10 features which are now GA.	3 years ago
R.B. Boyer	24a9402390	docs: mention that service defaults upstream config sections should not contain wildcards (#10451)	3 years ago
Blake Covarrubias	64d122b0a2	docs: Add example of escaping tracing JSON using jq	4 years ago
Freddy	ffb13f35f1	Rename CatalogDestinationsOnly (#10397) ... CatalogDestinationsOnly is a passthrough that would enable dialing addresses outside of Consul's catalog. However, when this flag is set to true only _connect_ endpoints for services can be dialed. This flag is being renamed to signal that non-Connect endpoints can't be dialed by transparent proxies when the value is set to true.	4 years ago
R.B. Boyer	dbca996c3c	docs: update envoy docs for changes related to xDS v2->v3 and SoTW->Incremental (#10166) ... Fixes #10098	4 years ago
Freddy	429f9d8bb8	Add flag for transparent proxies to dial individual instances (#10329)	4 years ago
Mark Anderson	1bf3dc5a5f	Docs for Unix Domain Sockets (#10252) ... * Docs for Unix Domain Sockets There are a number of cases where a user might wish to either 1) expose a service through a Unix Domain Socket in the filesystem ('downstream') or 2) connect to an upstream service by a local unix domain socket (upstream). As of Consul (1.10-beta2) we've added new syntax and support to configure the Envoy proxy to support this To connect to a service via local Unix Domain Socket instead of a port, add local_bind_socket_path and optionally local_bind_socket_mode to the upstream config for a service: upstreams = [ { destination_name = "service-1" local_bind_socket_path = "/tmp/socket_service_1" local_bind_socket_mode = "0700" ... } ... ] This will cause Envoy to create a socket with the path and mode provided, and connect that to service-1 The mode field is optional, and if omitted will use the default mode for Envoy. This is not applicable for abstract sockets. See https://www.envoyproxy.io/docs/envoy/latest/api-v3/config/core/v3/address.proto#envoy-v3-api-msg-config-core-v3-pipe for details NOTE: These options conflict the local_bind_socket_port and local_bind_socket_address options. We can bind to an port or we can bind to a socket, but not both. To expose a service listening on a Unix Domain socket to the service mesh use either the 'socket_path' field in the service definition or the 'local_service_socket_path' field in the proxy definition. These fields are analogous to the 'port' and 'service_port' fields in their respective locations. services { name = "service-2" socket_path = "/tmp/socket_service_2" ... } OR proxy { local_service_socket_path = "/tmp/socket_service_2" ... } There is no mode field since the service is expected to create the socket it is listening on, not the Envoy proxy. Again, the socket_path and local_service_socket_path fields conflict with address/port and local_service_address/local_service_port configuration entries. Set up a simple service mesh with dummy services: socat -d UNIX-LISTEN:/tmp/downstream.sock,fork UNIX-CONNECT:/tmp/upstream.sock socat -v tcp-l:4444,fork exec:/bin/cat services { name = "sock_forwarder" id = "sock_forwarder.1" socket_path = "/tmp/downstream.sock" connect { sidecar_service { proxy { upstreams = [ { destination_name = "echo-service" local_bind_socket_path = "/tmp/upstream.sock" config { passive_health_check { interval = "10s" max_failures = 42 } } } ] } } } } services { name = "echo-service" port = 4444 connect = { sidecar_service {} } Kind = "ingress-gateway" Name = "ingress-service" Listeners = [ { Port = 8080 Protocol = "tcp" Services = [ { Name = "sock_forwarder" } ] } ] consul agent -dev -enable-script-checks -config-dir=./consul.d consul connect envoy -sidecar-for sock_forwarder.1 consul connect envoy -sidecar-for echo-service -admin-bind localhost:19001 consul config write ingress-gateway.hcl consul connect envoy -gateway=ingress -register -service ingress-service -address '{{ GetInterfaceIP "eth0" }}:8888' -admin-bind localhost:19002 netcat 127.0.0.1 4444 netcat 127.0.0.1 8080 Signed-off-by: Mark Anderson <manderson@hashicorp.com> * fixup Unix capitalization Signed-off-by: Mark Anderson <manderson@hashicorp.com> * Update website/content/docs/connect/registration/service-registration.mdx Co-authored-by: Blake Covarrubias <blake@covarrubi.as> * Provide examples in hcl and json Signed-off-by: Mark Anderson <manderson@hashicorp.com> * Apply suggestions from code review Co-authored-by: Blake Covarrubias <blake@covarrubi.as> * One more fixup for docs Signed-off-by: Mark Anderson <manderson@hashicorp.com> Co-authored-by: Blake Covarrubias <blake@covarrubi.as>	4 years ago
Paul Banks	8233328e48	Fix doc note since we switched authorization mechanism in 1.9 (#10266)	4 years ago
R.B. Boyer	3b50a55533	connect: update supported envoy versions to 1.18.3, 1.17.3, 1.16.4, and 1.15.5 (#10231)	4 years ago
Daniel Nephin	f6580400dc	docs: document the current state of built-in and native	4 years ago
Daniel Nephin	583850e9d4	docs: remove name field from Mesh config entry ... Also document the name of these config entries in the API docs, so that users know how to query for them. And fix the name of mesh on the index page.	4 years ago
Freddy	2ca3f481f8	Only consider virtual IPs for transparent proxies (#10162) ... Initially we were loading every potential upstream address into Envoy and then routing traffic to the logical upstream service. The downside of this behavior is that traffic meant to go to a specific instance would be load balanced across ALL instances. Traffic to specific instance IPs should be forwarded to the original destination and if it's a destination in the mesh then we should ensure the appropriate certificates are used. This PR makes transparent proxying a Kubernetes-only feature for now since support for other environments requires generating virtual IPs, and Consul does not do that at the moment.	4 years ago
R.B. Boyer	abc1dc0fe9	connect: update supported envoy versions to 1.18.2, 1.17.2, 1.16.3, and 1.15.4 (#10101) ... The only thing that needed fixing up pertained to this section of the 1.18.x release notes: > grpc_stats: the default value for stats_for_all_methods is switched from true to false, in order to avoid possible memory exhaustion due to an untrusted downstream sending a large number of unique method names. The previous default value was deprecated in version 1.14.0. This only changes the behavior when the value is not set. The previous behavior can be used by setting the value to true. This behavior change by be overridden by setting runtime feature envoy.deprecated_features.grpc_stats_filter_enable_stats_for_all_methods_by_default. For now to maintain status-quo I'm explicitly setting `stats_for_all_methods=true` in all versions to avoid relying upon the default. Additionally the naming of the emitted metrics for these gRPC requests changed slightly so the integration test assertions for `case-grpc` needed adjusting.	4 years ago
Freddy	078c40425f	Rename "cluster" config entry to "mesh" (#10127) ... This config entry is being renamed primarily because in k8s the name cluster could be confusing given that the config entry applies across federated datacenters. Additionally, this config entry will only apply to Consul as a service mesh, so the more generic "cluster" name is not needed.	4 years ago
David Yu	b7cc83fde0	docs - Adding json formatting to TProxy HCL examples (#10088) ... formatting	4 years ago
Freddy	8b8c3c1992	Add docs for transparent proxy mode and config (#10038) ... Add docs for transparent proxy mode and config Co-authored-by: Nitya Dhanushkodi <nitya@hashicorp.com> Co-authored-by: Blake Covarrubias <blake@covarrubi.as> Co-authored-by: Iryna Shustava <ishustava@users.noreply.github.com> Co-authored-by: Jeff Escalante <jescalan@users.noreply.github.com>	4 years ago
Zachary Shilton	8671762474	website: implement mktg 032 (#9953) ... * website: migrate to new nav-data format * website: clean up unused intro content * website: remove deprecated sidebar_title from frontmatter * website: add react-content to fix global style import issue	4 years ago
Nitya Dhanushkodi	147628859d	Add metrics documentation (#9848)	4 years ago
woz5999	ea33c390ce	update docs and add changelog	4 years ago
Luke Kysow	a1d5e1fb41	docs: rename SourceAddress to SourceIP (#9878) ... SourceAddress was probably renamed to SourceIP but the docs weren't updated.	4 years ago
Mike Wickett	8f72c17248	fix: syntax issue	4 years ago
Freddy	555961e036	Merge pull request #9770 from hashicorp/docs/fix-terminating-gateway-config-entry ... Docs: Update terminating-gateway-config-entry	4 years ago
R.B. Boyer	398b766532	xds: default to speaking xDS v3, but allow for v2 to be spoken upon request (#9658) ... - Also add support for envoy 1.17.0	4 years ago
R.B. Boyer	3b6ffc447b	xds: remove deprecated usages of xDS (#9602) ... Note that this does NOT upgrade to xDS v3. That will come in a future PR. Additionally: - Ignored staticcheck warnings about how github.com/golang/protobuf is deprecated. - Shuffled some agent/xds imports in advance of a later xDS v3 upgrade. - Remove support for envoy 1.13.x but don't add in 1.17.x yet. We have to wait until the xDS v3 support is added in a follow-up PR. Fixes #8425	4 years ago
Christoph Puhl	45a569d935	Update terminating-gateway.mdx ... fix crds support reference and adding ACL clarification for linked services.	4 years ago
Preetha	4174bc4330	Add docs section on regenerating expired CA certificates (#9709) ... * Updated docs on regenerating built in CA * review feedback * Add sentence about expected behavior after update CA endpoint is used.	4 years ago
R.B. Boyer	6eeccc93ce	connect: update supported envoy point releases to 1.16.2, 1.15.3, 1.14.6, 1.13.7 (#9737)	4 years ago
Luke Kysow	9f006fdcc8	Document proxy-defaults config for prometheus (#9640)	4 years ago
Chris Boulton	8a35df81c7	connect: add local_request_timeout_ms to configure local_app http timeouts (#9554)	4 years ago
Chulki Lee	8be5a4b38a	Fix link markup in docs/connect/ca/vault	4 years ago
Luke Kysow	b6d7bf1243	Move cfg entry docs to under connect from agent (#9533) ... Since all config entries are currently related to service mesh it's a much more natural place to look for them under Service Mesh than under Agent.	4 years ago
Jeff Escalante	ef900cdb5c	update deps, restore search	4 years ago
Jeff Escalante	582dce9d8f	maintenance complete, pending markdown-page component addition	4 years ago