3871 Commits (52f0853ff95ce64806507586e8fc4d858ebfe6a7)

Author	SHA1	Message	Date
Daniel Nephin	7337cfd6dc	Merge pull request #11340 from hashicorp/dnephin/ca-manager-provider ... ca: split the Provider interface into Primary/Secondary	3 years ago
Daniel Nephin	eee598e91c	Merge pull request #11338 from hashicorp/dnephin/ca-manager-isolate-secondary ... ca: clearly identify methods that are primary-only or secondary-only	3 years ago
Daniel Upton	d47b7311b8	Support Check-And-Set deletion of config entries (#11419) ... Implements #11372	3 years ago
Dhia Ayachi	2801785710	regenerate expired certs (#11462) ... * regenerate expired certs * add documentation to generate tests certificates	3 years ago
Jared Kirschner	0854e1d684	Merge pull request #11348 from kbabuadze/fix-answers-alt-domain ... Fix answers for alt domain	3 years ago
R.B. Boyer	c8cafb7654	agent: for various /v1/agent endpoints parse the partition parameter on the request (#11444) ... Also update the corresponding CLI commands to send the parameter appropriately. NOTE: Behavioral changes are not happening in this PR.	3 years ago
R.B. Boyer	af9ffc214d	agent: add a clone function for duplicating the serf lan configuration (#11443)	3 years ago
Daniel Nephin	367b664318	Add tests for cert expiry metrics	3 years ago
Daniel Nephin	210d37e4ab	Merge pull request #10671 from hashicorp/dnephin/fix-subscribe-test-flake ... subscribe: improve TestSubscribeBackend_IntegrationWithServer_DeliversAllMessages	3 years ago
Evan Culver	61be9371f5	connect: Remove support for Envoy 1.16 (#11354)	3 years ago
Evan Culver	bec08f4ec3	connect: Add support for Envoy 1.20 (#11277)	3 years ago
freddygv	ac96ce6552	Ensure partition-exports kind gets marshalled ... The api module has decoding functions that rely on 'kind' being present of payloads. This is so that we can decode into the appropriate api type for the config entry. This commit ensures that a static kind is marshalled in responses from Consul's api endpoints so that the api module can decode them.	3 years ago
Daniel Nephin	a8e2e1c365	agent: move agent tls metric monitor to a more appropriate place ... And add a test for it	3 years ago
Daniel Nephin	c92513ec16	telemetry: set cert expiry metrics to NaN on start ... So that followers do not report 0, which would make alerting difficult.	3 years ago
Daniel Nephin	9264ce89d2	telemetry: fix cert expiry metrics by removing labels ... These labels should be set by whatever process scrapes Consul (for prometheus), or by the agent that receives them (for datadog/statsd). We need to remove them here because the labels are part of the "metric key", so we'd have to pre-declare the metrics with the labels. We could do that, but that is extra work for labels that should be added from elsewhere. Also renames the closure to be more descriptive.	3 years ago
Daniel Nephin	7948720bbb	telemetry: only emit leader cert expiry metrics on the servers	3 years ago
Daniel Nephin	7fe60e5989	telemetry: prevent stale values from cert monitors ... Prometheus scrapes metrics from each process, so when leadership transfers to a different node the previous leader would still be reporting the old cached value. By setting NaN, I believe we should zero-out the value, so that prometheus should only consider the value from the new leader.	3 years ago
Daniel Nephin	0cc58f54de	telemetry: improve cert expiry metrics ... Emit the metric immediately so that after restarting an agent, the new expiry time will be emitted. This is particularly important when this metric is being monitored, because we want the alert to resovle itself immediately. Also fixed a bug that was exposed in one of these metrics. The CARoot can be nil, so we have to handle that case.	3 years ago
Daniel Nephin	a3c781682d	subscribe: attempt to fix a flaky test ... TestSubscribeBackend_IntegrationWithServer_DeliversAllMessages has been flaking a few times. This commit cleans up the test a bit, and improves the failure output. I don't believe this actually fixes the flake, but I'm not able to reproduce it reliably. The failure appears to be that the event with Port=0 is being sent in both the snapshot and as the first event after the EndOfSnapshot event. Hopefully the improved logging will show us if these are really duplicate events, or actually different events with different indexes.	3 years ago
Freddy	fbcf9f3f6c	Merge pull request #11435 from hashicorp/ent-authorizer-refactor ... [OSS] Export ACLs refactor	3 years ago
Freddy	303532825f	Merge pull request #11432 from hashicorp/ap/exports-mgw ... [OSS] Update mesh gateways to handle partitions	3 years ago
freddygv	43360eb216	Rework acl exports interface	3 years ago
Freddy	ec7e94d129	Merge pull request #11433 from hashicorp/exported-service-acls ... [OSS] acl: Expand ServiceRead and NodeRead to account for partition exports	3 years ago
freddygv	e93c144d2f	Update comments	3 years ago
Freddy	a8762be529	Merge pull request #11431 from hashicorp/ap/exports-proxycfg ... [OSS] Update partitioned mesh gw handling for connect proxies	3 years ago
Freddy	b1b6f682e1	Merge pull request #11416 from hashicorp/ap/exports-update ... Rename service-exports to partition-exports	3 years ago
freddygv	3a2061544d	Fixup partitions assertion	3 years ago
freddygv	9480670b72	Fixup imports	3 years ago
freddygv	c72bbb6e8d	Split up locality check from hostname check	3 years ago
freddygv	d28b9052b2	Move the exportingpartitions constant to enterprise	3 years ago
freddygv	448701dbd8	Replace default partition check	3 years ago
freddygv	12923f5ebc	PR comments	3 years ago
freddygv	327e6bff25	Leave todo about default name	3 years ago
freddygv	5bf2497f71	Add oss impl of registerEntCache	3 years ago
freddygv	954d21c6ba	Register the ExportingPartitions cache type	3 years ago
freddygv	a33b6923e0	Account for partitions in xds gen for mesh gw ... This commit avoids skipping gateways in remote partitions of the local DC when generating listeners/clusters/endpoints.	3 years ago
freddygv	935112a47a	Account for partition in SNI for gateways	3 years ago
freddygv	110fae820a	Update xds pkg to account for GatewayKey	3 years ago
freddygv	7e65678c52	Update mesh gateway proxy watches for partitions ... This commit updates mesh gateway watches for cross-partitions communication. * Mesh gateways are keyed by partition and datacenter. * Mesh gateways will now watch gateways in partitions that export services to their partition. * Mesh gateways in non-default partitions will not have cross-datacenter watches. They are not involved in traditional WAN federation.	3 years ago
freddygv	aa931682ea	Avoid mixing named and unnamed params	3 years ago
freddygv	bf350224a0	Avoid passing nil config pointer	3 years ago
freddygv	df7b5af6f0	Avoid panic on nil partitionAuthorizer config ... partitionAuthorizer.config can be nil if it wasn't provided on calls to newPartitionAuthorizer outside of the ACLResolver. This usage happens often in tests. This commit: adds a nil check when the config is going to be used, updates non-test usage of NewPolicyAuthorizerWithDefaults to pass a non-nil config, and dettaches setEnterpriseConf from the ACLResolver.	3 years ago
freddygv	22bdf279d1	Update NodeRead for partition-exports ... When issuing cross-partition service discovery requests, ACL filtering often checks for NodeRead privileges. This is because the common return type is a CheckServiceNode, which contains node data.	3 years ago
Kyle Havlovitz	65c9109396	acl: pass PartitionInfo through ent ACLConfig	3 years ago
Kyle Havlovitz	d03f849e49	acl: Expand ServiceRead logic to look at service-exports for cross-partition	3 years ago
freddygv	8006c6df73	Swap in structs.EqualPartitions for cmp	3 years ago
freddygv	37a16e9487	Replace Split with SplitN	3 years ago
freddygv	b9b6447977	Finish removing useInDatacenter	3 years ago
freddygv	e1691d1627	Update XDS for sidecars dialing through gateways	3 years ago
freddygv	62e0fc62c1	Configure sidecars to watch gateways in partitions ... Previously the datacenter of the gateway was the key identifier, now it is the datacenter and partition. When dialing services in other partitions or datacenters we now watch the appropriate partition.	3 years ago
freddygv	eacb73cb78	Remove useInDatacenter from disco chain requests ... useInDatacenter was used to determine whether the mesh gateway mode of the upstream should be returned in the discovery chain target. This commit makes it so that the mesh gateway mode is returned every time, and it is up to the caller to decide whether mesh gateways should be watched or used.	3 years ago
R.B. Boyer	ef559dfdd4	agent: refactor the agent delegate interface to be partition friendly (#11429)	3 years ago
Chris S. Kim	fa293362be	agent: Ensure partition is considered in agent endpoints (#11427)	3 years ago
Konstantine	55599d0b41	remove spaces	3 years ago
Konstantine	ce85d2eada	fix altDomain responses for services where address is IP, added tests	3 years ago
Konstantine	a7e8c51f80	fix encodeIPAsFqdn to return alt-domain when requested, added test case	3 years ago
Konstantine	ffb00f01b5	fixed altDomain response for NS type queries, and added test	3 years ago
Konstantine	a828c45a62	edited TestDNS_AltDomains_Service to test responses for altDomains, and added TXT additional section check	3 years ago
Konstantine	0864bfdb71	fixed alt-domain answer for SRV records, and TXT records in additional section	3 years ago
Chris S. Kim	76bbeb3baf	ui: Pass primary dc through to uiserver (#11317) ... Co-authored-by: John Cowen <johncowen@users.noreply.github.com>	3 years ago
freddygv	8aefdc31da	Remove outdated partition label from test	3 years ago
freddygv	5c24ed61a8	Rename service-exports to partition-exports ... Existing config entries prefixed by service- are specific to individual services. Since this config entry applies to partitions it is being renamed. Additionally, the Partition label was changed to Name because using Partition at the top-level and in the enterprise meta was leading to the enterprise meta partition being dropped by msgpack.	3 years ago
Daniel Nephin	4ae2c8de9d	Merge pull request #11232 from hashicorp/dnephin/acl-legacy-remove-docs ... acl: add docs and changelog for the removal of the legacy ACL system	3 years ago
Daniel Nephin	5d41b4d2f4	Update agent/consul/acl_client.go ... Co-authored-by: Freddy <freddygv@users.noreply.github.com>	3 years ago
Daniel Nephin	65d48e5042	state: remove support for updating legacy ACL tokens	3 years ago
Daniel Nephin	0784a31e85	acl: remove init check for legacy anon token ... This token should always already be migrated from a previous version.	3 years ago
Daniel Nephin	daba3c2309	acl: remove legacy parameter to ACLDatacenter ... It is no longer used now that legacy ACLs have been removed.	3 years ago
Daniel Nephin	3390f85ab4	acl: remove ACLTokenTypeManagement	3 years ago
Daniel Nephin	32b4ad42ac	acl: remove ACLTokenTypeClient, ... along with the last test referencing it.	3 years ago
Daniel Nephin	aea4cc5a6d	acl: remove legacy arg to store.ACLTokenSet ... And remove the tests for legacy=true	3 years ago
Daniel Nephin	c77e5747b1	acl: remove EmbeddedPolicy ... This method is no longer. It only existed for legacy tokens, which are no longer supported.	3 years ago
Daniel Nephin	121431bf17	acl: remove tests for resolving legacy tokens ... The code for this was already removed, which suggests this is not actually testing what it claims. I'm guessing these are still resolving because the tokens are converted to non-legacy tokens?	3 years ago
Daniel Nephin	0d0761927a	acl: stop replication on leadership lost ... It seems like this was missing. Previously this was only called by init of ACLs during an upgrade. Now that legacy ACLs are removed, nothing was calling stop. Also remove an unused method from client.	3 years ago
Daniel Nephin	98823e573f	Remove incorrect TODO	3 years ago
Daniel Nephin	1344137ce2	acl: move the legacy ACL struct to the one package where it is used ... It is now only used for restoring snapshots. We can remove it in phase 2.	3 years ago
Daniel Nephin	531f2f8a3f	acl: remove most of the rest of structs/acl_legacy.go	3 years ago
Paul Banks	954b283fec	Merge pull request #11163 from hashicorp/feature/ingress-tls-mixed ... Add support for enabling connect-based ingress TLS per listener.	3 years ago
FFMMM	fea6f08bf9	fix autopilot_failure_tolerance, add autopilot metrics test case (#11399) ... Signed-off-by: FFMMM <FFMMM@users.noreply.github.com>	3 years ago
FFMMM	0954d261ae	use *telemetry.MetricsPrefix as prometheus.PrometheusOpts.Name (#11290) ... Signed-off-by: FFMMM <FFMMM@users.noreply.github.com>	3 years ago
Dhia Ayachi	58f5686c08	fix leadership transfer on leave suggestions (#11387) ... * add suggestions * set isLeader to false when leadership transfer succeed	3 years ago
Dhia Ayachi	f424faffdd	try to perform a leadership transfer when leaving (#11376) ... * try to perform a leadership transfer when leaving * add a changelog	3 years ago
Kyle Havlovitz	04cd2c983e	Add new service-exports config entry	3 years ago
Jared Kirschner	14af8cb7a9	Merge pull request #11293 from bisakhmondal/service_filter ... expression validation of service-resolver subset filter	3 years ago
Paul Banks	c891f30c24	Rebase and rebuild golden files for Envoy version bump	3 years ago
Paul Banks	6faf85bccd	Refactor `resolveListenerSDSConfig` to pass in whole config	3 years ago
Paul Banks	78a00f2e1c	Add support for enabling connect-based ingress TLS per listener.	3 years ago
R.B. Boyer	cc2abb79ba	acl: small OSS refactors to help ensure that auth methods with namespace rules work with partitions (#11323)	3 years ago
freddygv	e22f0cc033	Use stored entmeta to fill authzContext	3 years ago
freddygv	53ea1f634a	Ensure partition is handled by auto-encrypt	3 years ago
FFMMM	62980ffaa2	fix: only add prom autopilot gauges to servers (#11241) ... Signed-off-by: FFMMM <FFMMM@users.noreply.github.com>	3 years ago
Chris S. Kim	c6906b4d37	Update Intentions.List with partitions (#11299)	3 years ago
R.B. Boyer	0c94095dfd	acl: fix bug in 'consul members' filtering with partitions (#11263)	3 years ago
Bisakh Mondal	a350a383d3	add service resolver subset filter validation	3 years ago
Connor	257d00c908	Merge pull request #11222 from hashicorp/clly/service-mesh-metrics ... Start tracking connect service mesh usage metrics	3 years ago
Connor Kelly	786d2896ff	Replace fmt.Sprintf with function	3 years ago
tarat44	166269f93b	preload json values in structs to determine defaults	3 years ago
Daniel Nephin	b2f49279e2	ca: split Primary/Secondary Provider ... To make it more clear which methods are necessary for each scenario. This can also prevent problems which force all DCs to use the same Vault instance, which is currently a problem.	3 years ago
Daniel Nephin	1d14889eca	ca: extract primaryUpdateRootCA ... This function is only run when the CAManager is a primary. Extracting this function makes it clear which parts of UpdateConfiguration are run only in the primary and also makes the cleanup logic simpler. Instead of both a defer and a local var we can call the cleanup function in two places.	3 years ago
Daniel Nephin	0bc812a8e5	ca: rename functions to use a primary or secondary prefix ... This commit renames functions to use a consistent pattern for identifying the functions that can only be called when the Manager is run as the primary or secondary. This is a step toward eventually creating separate types and moving these methods off of CAManager.	3 years ago
Daniel Nephin	eaea56c7b2	ca: make receiver variable name consistent ... Every other method uses c not ca	3 years ago