715 Commits (596432fe38dd72738f091d501cc56aadb8620ab3)

Author	SHA1	Message	Date
Eric	02d8a11ff0	remove gogo from acl protobufs	3 years ago
Eric	5cab213e81	assorted changes required to remove gogo	3 years ago
Kyle Havlovitz	0d9c99b227	Clean up ent meta id usage in overview summary	3 years ago
Kyle Havlovitz	e530fbfb33	oss: Add overview UI internal endpoint	3 years ago
Dhia Ayachi	72a997242b	split `pbcommon` to `pbcommon` and `pbcommongogo` (#12587) ... * mogify needed pbcommon structs * mogify needed pbconnect structs * fix compilation errors and make config_translate_test pass * add missing file * remove redundant oss func declaration * fix EnterpriseMeta to copy the right data for enterprise * rename pbcommon package to pbcommongogo * regenerate proto and mog files * add missing mog files * add pbcommon package * pbcommon no mog * fix enterprise meta code generation * fix enterprise meta code generation (pbcommongogo) * fix mog generation for gogo * use `protoc-go-inject-tag` to inject tags * rename proto package * pbcommon no mog * use `protoc-go-inject-tag` to inject tags * add non gogo proto to make file * fix proto get	3 years ago
Mark Anderson	fa63aed1fa	Add source of authority annotations to the PermissionDeniedError output. (#12567) ... This extends the acl.AllowAuthorizer with source of authority information. The next step is to unify the AllowAuthorizer and ACLResolveResult structures; that will be done in a separate PR. Part of #12481 Signed-off-by: Mark Anderson <manderson@hashicorp.com>	3 years ago
Eric	eea8300187	Remove the stdduration gogo extension	3 years ago
Mark Anderson	676ea58bc4	Refactor config checks oss (#12550) ... Currently the config_entry.go subsystem delegates authorization decisions via the ConfigEntry interface CanRead and CanWrite code. Unfortunately this returns a true/false value and loses the details of the source. This is not helpful, especially since it the config subsystem can be more complex to understand, since it covers so many domains. This refactors CanRead/CanWrite to return a structured error message (PermissionDenied or the like) with more details about the reason for denial. Part of #12241 Signed-off-by: Mark Anderson <manderson@hashicorp.com>	3 years ago
Eric Haberkorn	9d0ec2eec2	Code review changes	3 years ago
Eric	f7cc7ff5cd	Add `Meta` to `ServiceConfigResponse`	3 years ago
R.B. Boyer	957146401e	catalog: compare node names case insensitively in more places (#12444) ... Many places in consul already treated node names case insensitively. The state store indexes already do it, but there are a few places that did a direct byte comparison which have now been corrected. One place of particular consideration is ensureCheckIfNodeMatches which is executed during snapshot restore (among other places). If a node check used a slightly different casing than the casing of the node during register then the snapshot restore here would deterministically fail. This has been fixed. Primary approach: git grep -i "node.*[!=]=.*node" -- ':!*_test.go' ':!docs' git grep -i '\[[^]]*member[^]]*\] git grep -i '\[[^]]*\(member\|name\|node\)[^]]*\]' -- ':!*_test.go' ':!website' ':!ui' ':!agent/proxycfg/testing.go:' ':!*.md'	3 years ago
Daniel Nephin	771df290d7	Merge pull request #11910 from hashicorp/dnephin/ca-provider-interface-for-ica-in-primary ... ca: add support for an external trusted CA	3 years ago
R.B. Boyer	8b987a4d59	configentry: make a new package to hold shared config entry structs that aren't used for RPC or the FSM (#12384) ... First two candidates are ConfigEntryKindName and DiscoveryChainConfigEntries.	3 years ago
Daniel Nephin	42ec34d101	ca: examine the full chain in newCARoot ... make TestNewCARoot much more strict compare the full result instead of only a few fields. add a test case with 2 and 3 certificates in the pem	3 years ago
FFMMM	78264a8030	Vendor in rpc mono repo for net/rpc fork, go-msgpack, msgpackrpc. (#12311) ... This commit syncs ENT changes to the OSS repo. Original commit details in ENT: ``` commit 569d25f7f4578981c3801e6e067295668210f748 Author: FFMMM <FFMMM@users.noreply.github.com> Date: Thu Feb 10 10:23:33 2022 -0800 Vendor fork net rpc (#1538) * replace net/rpc w consul-net-rpc/net/rpc Signed-off-by: FFMMM <FFMMM@users.noreply.github.com> * replace msgpackrpc and go-msgpack with fork from mono repo Signed-off-by: FFMMM <FFMMM@users.noreply.github.com> * gofmt all files touched Signed-off-by: FFMMM <FFMMM@users.noreply.github.com> ``` Signed-off-by: FFMMM <FFMMM@users.noreply.github.com>	3 years ago
Freddy	9580f79f86	Merge pull request #12223 from hashicorp/proxycfg/passthrough-cleanup	3 years ago
freddygv	cbea3d203c	Fix race of upstreams with same passthrough ip ... Due to timing, a transparent proxy could have two upstreams to dial directly with the same address. For example: - The orders service can dial upstreams shipping and payment directly. - An instance of shipping at address 10.0.0.1 is deregistered. - Payments is scaled up and scheduled to have address 10.0.0.1. - The orders service receives the event for the new payments instance before seeing the deregistration for the shipping instance. At this point two upstreams have the same passthrough address and Envoy will reject the listener configuration. To disambiguate this commit considers the Raft index when storing passthrough addresses. In the example above, 10.0.0.1 would only be associated with the newer payments service instance.	3 years ago
Daniel Nephin	997bf1e5a4	Merge pull request #12166 from hashicorp/dnephin/acl-resolve-token-2 ... acl: remove ResolveTokenToIdentity	3 years ago
Daniel Nephin	9a59733b7d	Merge pull request #11663 from hashicorp/dnephin/ca-remove-one-call-to-active-root-2 ... ca: remove second call to Provider.ActiveRoot	3 years ago
Daniel Nephin	db0478265b	Merge pull request #12109 from hashicorp/dnephin/blocking-query-1 ... rpc: make blockingQuery easier to read	3 years ago
Daniel Nephin	a5e8af79c3	acl: return a resposne from ResolveToken that includes the ACLIdentity ... So that we can duplicate duplicate methods.	3 years ago
R.B. Boyer	b60d89e7ef	bulk rewrite using this script ... set -euo pipefail unset CDPATH cd "$(dirname "$0")" for f in $(git grep '\brequire := require\.New(' | cut -d':' -f1 | sort -u); do echo "=== require: $f ===" sed -i '/require := require.New(t)/d' $f # require.XXX(blah) but not require.XXX(tblah) or require.XXX(rblah) sed -i 's/\brequire\.\([a-zA-Z0-9_]*\)(\([^tr]\)/require.\1(t,\2/g' $f # require.XXX(tblah) but not require.XXX(t, blah) sed -i 's/\brequire\.\([a-zA-Z0-9_]*\)(\(t[^,]\)/require.\1(t,\2/g' $f # require.XXX(rblah) but not require.XXX(r, blah) sed -i 's/\brequire\.\([a-zA-Z0-9_]*\)(\(r[^,]\)/require.\1(t,\2/g' $f gofmt -s -w $f done for f in $(git grep '\bassert := assert\.New(' | cut -d':' -f1 | sort -u); do echo "=== assert: $f ===" sed -i '/assert := assert.New(t)/d' $f # assert.XXX(blah) but not assert.XXX(tblah) or assert.XXX(rblah) sed -i 's/\bassert\.\([a-zA-Z0-9_]*\)(\([^tr]\)/assert.\1(t,\2/g' $f # assert.XXX(tblah) but not assert.XXX(t, blah) sed -i 's/\bassert\.\([a-zA-Z0-9_]*\)(\(t[^,]\)/assert.\1(t,\2/g' $f # assert.XXX(rblah) but not assert.XXX(r, blah) sed -i 's/\bassert\.\([a-zA-Z0-9_]*\)(\(r[^,]\)/assert.\1(t,\2/g' $f gofmt -s -w $f done	3 years ago
R.B. Boyer	424f3cdd2c	proxycfg: introduce explicit UpstreamID in lieu of bare string (#12125) ... The gist here is that now we use a value-type struct proxycfg.UpstreamID as the map key in ConfigSnapshot maps where we used to use "upstream id-ish" strings. These are internal only and used just for bidirectional trips through the agent cache keyspace (like the discovery chain target struct). For the few places where the upstream id needs to be projected into xDS, that's what (proxycfg.UpstreamID).EnvoyID() is for. This lets us ALWAYS inject the partition and namespace into these things without making stuff like the golden testdata diverge.	3 years ago
Dan Upton	ca3aca92c4	[OSS] Remove remaining references to master (#11827)	3 years ago
Daniel Nephin	fd0a9fd4f3	rpc: move the index defaulting to setQueryMeta. ... This safeguard should be safe to apply in general. We are already applying it to non-blocking queries that call blockingQuery, so it should be fine to apply it to others.	3 years ago
Kyle Havlovitz	0db874c38b	Add virtual IP generation for term gateway backed services	3 years ago
Mike Morris	1b1a97e8f9	ingress: allow setting TLS min version and cipher suites in ingress gateway config entries (#11576) ... * xds: refactor ingress listener SDS configuration * xds: update resolveListenerSDS call args in listeners_test * ingress: add TLS min, max and cipher suites to GatewayTLSConfig * xds: implement envoyTLSVersions and envoyTLSCipherSuites * xds: merge TLS config * xds: configure TLS parameters with ingress TLS context from leaf * xds: nil check in resolveListenerTLSConfig validation * xds: nil check in makeTLSParameters* functions * changelog: add entry for TLS params on ingress config entries * xds: remove indirection for TLS params in TLSConfig structs * xds: return tlsContext, nil instead of ambiguous err Co-authored-by: Chris S. Kim <ckim@hashicorp.com> * xds: switch zero checks to types.TLSVersionUnspecified * ingress: add validation for ingress config entry TLS params * ingress: validate listener TLS config * xds: add basic ingress with TLS params tests * xds: add ingress listeners mixed TLS min version defaults precedence test * xds: add more explicit tests for ingress listeners inheriting gateway defaults * xds: add test for single TLS listener on gateway without TLS defaults * xds: regen golden files for TLSVersionInvalid zero value, add TLSVersionAuto listener test * types/tls: change TLSVersion to string * types/tls: update TLSCipherSuite to string type * types/tls: implement validation functions for TLSVersion and TLSCipherSuites, make some maps private * api: add TLS params to GatewayTLSConfig, add tests * api: add TLSMinVersion to ingress gateway config entry test JSON * xds: switch to Envoy TLS cipher suite encoding from types package * xds: fixup validation for TLSv1_3 min version with cipher suites * add some kitchen sink tests and add a missing struct tag * xds: check if mergedCfg.TLSVersion is in TLSVersionsWithConfigurableCipherSuites * xds: update connectTLSEnabled comment * xds: remove unsued resolveGatewayServiceTLSConfig function * xds: add makeCommonTLSContextFromLeafWithoutParams * types/tls: add LessThan comparator function for concrete values * types/tls: change tlsVersions validation map from string to TLSVersion keys * types/tls: remove unused envoyTLSCipherSuites * types/tls: enable chacha20 cipher suites for Consul agent * types/tls: remove insecure cipher suites from allowed config TLS_ECDHE_ECDSA_WITH_AES_128_CBC_SHA256 and TLS_ECDHE_RSA_WITH_AES_128_CBC_SHA256 are both explicitly listed as insecure and disabled in the Go source. Refs https://cs.opensource.google/go/go/+/refs/tags/go1.17.3:src/crypto/tls/cipher_suites.go;l=329-330 * types/tls: add ValidateConsulAgentCipherSuites function, make direct lookup map private * types/tls: return all unmatched cipher suites in validation errors * xds: check that Envoy API value matching TLS version is found when building TlsParameters * types/tls: check that value is found in map before appending to slice in MarshalEnvoyTLSCipherSuiteStrings * types/tls: cast to string rather than fmt.Printf in TLSCihperSuite.String() * xds: add TLSVersionUnspecified to list of configurable cipher suites * structs: update note about config entry warning * xds: remove TLS min version cipher suite unconfigurable test placeholder * types/tls: update tests to remove assumption about private map values Co-authored-by: R.B. Boyer <rb@hashicorp.com>	3 years ago
Daniel Nephin	7121c78d34	ca: update godoc ... To clarify what to expect from the data stored in this field, and the behaviour of this function.	3 years ago
freddygv	6814e84459	Use ptr receiver in all Upstream methods	3 years ago
R.B. Boyer	631c649291	various partition related todos (#11822)	3 years ago
Daniel Nephin	2e4e8bd791	ca: improve RenewIntermediate tests ... Use the new verifyLearfCert to show the cert verifies with intermediates from both sources. This required using the RPC interface so that the leaf pem was constructed correctly. Add IndexedCARoots.Active since that is a common operation we see in a few places.	3 years ago
Daniel Nephin	a5d9b1d322	ca: Add CARoots.Active method ... Which will be used in the next commit.	3 years ago
R.B. Boyer	5f5720837b	acl: ensure that the agent recovery token is properly partitioned (#11782)	3 years ago
Evan Culver	7a365fa0da	rpc: Unset partition before forwarding to remote datacenter (#11758)	3 years ago
Chris S. Kim	f8f8580ab2	Godocs updates for catalog endpoints (#11716)	3 years ago
freddygv	60fe5f75bb	Remove support for failover to partition ... Failing over to a partition is more siimilar to failing over to another datacenter than it is to failing over to a namespace. In a future release we should update how localities for failover are specified. We should be able to accept a list of localities which can include both partition and datacenter.	3 years ago
freddygv	5c1f7aa372	Allow cross-partition references in disco chain ... * Add partition fields to targets like service route destinations * Update validation to prevent cross-DC + cross-partition references * Handle partitions when reading config entries for disco chain * Encode partition in compiled targets	3 years ago
Freddy	a725f06c83	Merge pull request #11739 from hashicorp/ap/exports-rename	3 years ago
freddygv	ed6076db26	Rename partition-exports to exported-services ... Using a name less tied to partitions gives us more flexibility to use this config entry in OSS for exports between datacenters/meshes.	3 years ago
freddygv	497aab669f	Add a new table to query service names by kind ... This table purposefully does not index by partition/namespace. It's a global view into all service names. This table is intended to replace the current serviceListTxn watch in intentionTopologyTxn. For cross-partition transparent proxying we need to be able to calculate upstreams from intentions in any partition. This means that the existing serviceListTxn function is insufficient since it's scoped to a partition. Moving away from that function is also beneficial because it watches the main "services" table, so watchers will wake up when any instance is registered or deregistered.	3 years ago
Freddy	f032d6ef05	Merge pull request #11680 from hashicorp/ap/partition-exports-oss	3 years ago
Mark Anderson	a89ffba2d4	Cross port of ent #1383 (#11726) ... Cross port of ent #1383 "Reject non-default datacenter when making partitioned ACLs" On the OSS side this is a minor refactor to add some more checks that are only applicable to enterprise code. Signed-off-by: Mark Anderson <manderson@hashicorp.com>	3 years ago
Dan Upton	1e47e3c82b	Groundwork for exposing when queries are filtered by ACLs (#11569)	3 years ago
Kyle Havlovitz	4f2cfee4b0	consul: add virtual IP generation for connect services	3 years ago
Daniel Nephin	28a8a64019	ca: make getLeafSigningCertFromRoot safer ... As a method on the struct type this would not be safe to call without first checking c.isIntermediateUsedToSignLeaf. So for now, move this logic to the CAMananger, so that it is always correct.	3 years ago
Daniel Nephin	b29faa3e50	ca: fix stored CARoot representation with Vault provider ... We were not adding the local signing cert to the CARoot. This commit fixes that bug, and also adds support for fixing existing CARoot on upgrade. Also update the tests for both primary and secondary to be more strict. Check the SigningKeyID is correct after initialization and rotation.	3 years ago
Daniel Nephin	32ef9c5d5c	ca: add some godoc and func for finding leaf signing cert ... This will be used in a follow up commit.	3 years ago
freddygv	5e1f7b7c36	Prevent partition-exports entry from OSS usage ... Validation was added on the config entry kind since that is called when validating config entries to bootstrap via agent configuration and when applying entries via the config RPC endpoint.	3 years ago
Dhia Ayachi	bb83624950	Partition session checks store (#11638) ... * state: port KV and Tombstone tables to new pattern * go fmt'ed * handle wildcards for tombstones * Fix graveyard ent vs oss * fix oss compilation error * add partition to tombstones and kv state store indexes * refactor to use `indexWithEnterpriseIndexable` * Apply suggestions from code review Co-authored-by: Chris S. Kim <ckim@hashicorp.com> Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> * add `singleValueID` implementation assertions * partition `tableSessions` table * fix sessions to use UUID and fix prefix index * fix oss build * clean up unused functions * fix oss compilation * add a partition indexer for sessions * Fix oss to not have partition index * fix oss tests * remove unused operations_ent.go and operations_oss.go func * remove unused const * convert `IndexID` of `session_checks` table * convert `indexSession` of `session_checks` table * convert `indexNodeCheck` of `session_checks` table * partition `indexID` and `indexSession` of `tableSessionChecks` * fix oss linter * fix review comments * remove partition for Checks as it's always use the session partition Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> Co-authored-by: Chris S. Kim <ckim@hashicorp.com> Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com>	3 years ago
Iryna Shustava	0ee456649f	connect: Support auth methods for the vault connect CA provider (#11573) ... * Support vault auth methods for the Vault connect CA provider * Rotate the token (re-authenticate to vault using auth method) when the token can no longer be renewed	3 years ago
R.B. Boyer	1e02460bd1	re-run gofmt on 1.17 (#11579) ... This should let freshly recompiled golangci-lint binaries using Go 1.17 pass 'make lint'	3 years ago
R.B. Boyer	eb21649f82	partitions: various refactors to support partitioning the serf LAN pool (#11568)	3 years ago
freddygv	e5b7c4713f	Accept partition for ingress services	3 years ago
Daniel Upton	50a1f20ff9	xds: prefer fed state gateway definitions if they're fresher (#11522) ... Fixes an issue described in #10132, where if two DCs are WAN federated over mesh gateways, and the gateway in the non-primary DC is terminated and receives a new IP address (as is commonly the case when running them on ephemeral compute instances) the primary DC is unable to re-establish its connection until the agent running on its own gateway is restarted. This was happening because we always preferred gateways discovered by the `Internal.ServiceDump` RPC (which would fail because there's no way to dial the remote DC) over those discovered in the federation state, which is replicated as long as the primary DC's gateway is reachable.	3 years ago
Dhia Ayachi	7916268c40	refactor session state store tables to use the new index pattern (#11525) ... * state: port KV and Tombstone tables to new pattern * go fmt'ed * handle wildcards for tombstones * Fix graveyard ent vs oss * fix oss compilation error * add partition to tombstones and kv state store indexes * refactor to use `indexWithEnterpriseIndexable` * Apply suggestions from code review Co-authored-by: Chris S. Kim <ckim@hashicorp.com> Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> * add `singleValueID` implementation assertions * partition `tableSessions` table * fix sessions to use UUID and fix prefix index * fix oss build * clean up unused functions * fix oss compilation * add a partition indexer for sessions * Fix oss to not have partition index * fix oss tests * remove unused func `prefixIndexFromServiceNameAsString` * fix test error check * remove unused operations_ent.go and operations_oss.go func * remove unused const Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> Co-authored-by: Chris S. Kim <ckim@hashicorp.com> Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com>	3 years ago
Dhia Ayachi	520cb5858c	KV state store refactoring and partitioning (#11510) ... * state: port KV and Tombstone tables to new pattern * go fmt'ed * handle wildcards for tombstones * Fix graveyard ent vs oss * fix oss compilation error * add partition to tombstones and kv state store indexes * refactor to use `indexWithEnterpriseIndexable` * partition kvs indexID table * add `partitionedIndexEntryName` in oss for test purpose * Apply suggestions from code review Co-authored-by: Chris S. Kim <ckim@hashicorp.com> Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> * add `singleValueID` implementation assertions * remove entmeta reference from oss Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> Co-authored-by: Chris S. Kim <ckim@hashicorp.com> Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com>	3 years ago
Daniel Nephin	8ba760a2fc	acl: remove id and revision from Policy constructors ... The fields were removed in a previous commit. Also remove an unused constructor for PolicyMerger	3 years ago
Daniel Nephin	7c679c11e6	acl: remove Policy.ID and Policy.Revision ... These two fields do not appear to be used anywhere. We use the structs.ACLPolicy ID in the ACLResolver cache, but the acl.Policy ID and revision are not used.	3 years ago
Connor	efe4b21287	Support Vault Namespaces explicitly in CA config (#11477) ... * Support Vault Namespaces explicitly in CA config If there is a Namespace entry included in the Vault CA configuration, set it as the Vault Namespace on the Vault client Currently the only way to support Vault namespaces in the Consul CA config is by doing one of the following: 1) Set the VAULT_NAMESPACE environment variable which will be picked up by the Vault API client 2) Prefix all Vault paths with the namespace Neither of these are super pleasant. The first requires direct access and modification to the Consul runtime environment. It's possible and expected, not super pleasant. The second requires more indepth knowledge of Vault and how it uses Namespaces and could be confusing for anyone without that context. It also infers that it is not supported * Add changelog * Remove fmt.Fprint calls * Make comment clearer * Add next consul version to website docs * Add new test for default configuration * go mod tidy * Add skip if vault not present * Tweak changelog text	3 years ago
Mark Anderson	7e8228a20b	Remove some usage of md5 from the system (#11491) ... * Remove some usage of md5 from the system OSS side of https://github.com/hashicorp/consul-enterprise/pull/1253 This is a potential security issue because an attacker could conceivably manipulate inputs to cause persistence files to collide, effectively deleting the persistence file for one of the colliding elements. Signed-off-by: Mark Anderson <manderson@hashicorp.com>	3 years ago
FFMMM	4ddf973a31	add root_cert_ttl option for consul connect, vault ca providers (#11428) ... * add root_cert_ttl option for consul connect, vault ca providers Signed-off-by: FFMMM <FFMMM@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Chris S. Kim <ckim@hashicorp.com> * add changelog, pr feedback Signed-off-by: FFMMM <FFMMM@users.noreply.github.com> * Update .changelog/11428.txt, more docs Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> * Update website/content/docs/agent/options.mdx Co-authored-by: Kyle Havlovitz <kylehav@gmail.com> Co-authored-by: Chris S. Kim <ckim@hashicorp.com> Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> Co-authored-by: Kyle Havlovitz <kylehav@gmail.com>	3 years ago
Daniel Nephin	51d8417545	Merge pull request #10690 from tarat44/h2c-support-in-ping-checks ... add support for h2c in h2 ping health checks	3 years ago
Daniel Upton	d47b7311b8	Support Check-And-Set deletion of config entries (#11419) ... Implements #11372	3 years ago
freddygv	ac96ce6552	Ensure partition-exports kind gets marshalled ... The api module has decoding functions that rely on 'kind' being present of payloads. This is so that we can decode into the appropriate api type for the config entry. This commit ensures that a static kind is marshalled in responses from Consul's api endpoints so that the api module can decode them.	3 years ago
freddygv	43360eb216	Rework acl exports interface	3 years ago
Freddy	b1b6f682e1	Merge pull request #11416 from hashicorp/ap/exports-update ... Rename service-exports to partition-exports	3 years ago
R.B. Boyer	ef559dfdd4	agent: refactor the agent delegate interface to be partition friendly (#11429)	3 years ago
freddygv	8aefdc31da	Remove outdated partition label from test	3 years ago
freddygv	5c24ed61a8	Rename service-exports to partition-exports ... Existing config entries prefixed by service- are specific to individual services. Since this config entry applies to partitions it is being renamed. Additionally, the Partition label was changed to Name because using Partition at the top-level and in the enterprise meta was leading to the enterprise meta partition being dropped by msgpack.	3 years ago
Daniel Nephin	65d48e5042	state: remove support for updating legacy ACL tokens	3 years ago
Daniel Nephin	3390f85ab4	acl: remove ACLTokenTypeManagement	3 years ago
Daniel Nephin	32b4ad42ac	acl: remove ACLTokenTypeClient, ... along with the last test referencing it.	3 years ago
Daniel Nephin	c77e5747b1	acl: remove EmbeddedPolicy ... This method is no longer. It only existed for legacy tokens, which are no longer supported.	3 years ago
Daniel Nephin	1344137ce2	acl: move the legacy ACL struct to the one package where it is used ... It is now only used for restoring snapshots. We can remove it in phase 2.	3 years ago
Daniel Nephin	531f2f8a3f	acl: remove most of the rest of structs/acl_legacy.go	3 years ago
Kyle Havlovitz	04cd2c983e	Add new service-exports config entry	3 years ago
Jared Kirschner	14af8cb7a9	Merge pull request #11293 from bisakhmondal/service_filter ... expression validation of service-resolver subset filter	3 years ago
R.B. Boyer	cc2abb79ba	acl: small OSS refactors to help ensure that auth methods with namespace rules work with partitions (#11323)	3 years ago
Bisakh Mondal	a350a383d3	add service resolver subset filter validation	3 years ago
tarat44	166269f93b	preload json values in structs to determine defaults	3 years ago
tarat44	ecdcfd6360	only set default on H2PingUseTLS if H2PING is set	3 years ago
tarat44	1e8e44d442	fix formatting	3 years ago
tarat44	c1ed3a9a94	change config option to H2PingUseTLS	3 years ago
tarat44	3c9f5a73d9	add support for h2c in h2 ping health checks	3 years ago
Daniel Nephin	3ac910606c	acl: remove reading of serf acl tags ... We no long need to read the acl serf tag, because servers are always either ACL enabled or ACL disabled. We continue to write the tag so that during an upgarde older servers will see the tag.	3 years ago
Daniel Nephin	8e9773e20b	acl: remove ACL.GetPolicy endpoint and resolve legacy acls ... And all code that was no longer used once those two were removed.	3 years ago
Daniel Nephin	6e1ebd3df7	acl: remove the last of the legacy FSM ... Replace it with an implementation that returns an error, and rename some symbols to use a Deprecated suffix to make it clear. Also remove the ACLRequest struct, which is no longer referenced.	3 years ago
Daniel Nephin	ed928511ca	acl: remove bootstrap-init FSM operation	3 years ago
Daniel Nephin	05f0cc3993	acl: remove ACLDelete FSM command, and state store function ... These are no longer used now that ACL.Apply has been removed.	3 years ago
Daniel Nephin	966e50e00e	acl: remove legacy field to ACLBoostrap	3 years ago
Daniel Nephin	ea4a8343cd	Merge pull request #11177 from hashicorp/dnephin/remove-entmeta-methods ... structs: remove EnterpriseMeta helper methods	3 years ago
Daniel Nephin	4c579a49ed	Merge pull request #10986 from hashicorp/dnephin/acl-legacy-remove-rpc ... acl: remove legacy ACL RPC - part 1	3 years ago
Daniel Nephin	eb632c53a2	structs: rename the last helper method. ... This one gets used a bunch, but we can rename it to make the behaviour more obvious.	3 years ago
Daniel Nephin	8d8c1f9d5e	structs: remove another helper ... We already have a helper funtion.	3 years ago
Daniel Nephin	6d72517682	structs: remove two methods that were only used once each. ... These methods only called a single function. Wrappers like this end up making code harder to read because it adds extra ways of doing things. We already have many helper functions for constructing these types, we don't need additional methods.	3 years ago
Chris S. Kim	5c37819d09	Cleanup unnecessary normalizing method (#11169)	3 years ago
Paul Banks	7b4cbe3143	Final readability tweaks from review	3 years ago
Paul Banks	07f81991df	Refactor SDS validation to make it more contained and readable	3 years ago
Paul Banks	2281d883b9	Fix some more Enterprise Normalization issues affecting tests	3 years ago
Paul Banks	659321d008	Handle namespaces in route names correctly; add tests for enterprise	3 years ago