consul

Commit Graph

Author	SHA1	Message	Date
Michael Zalimeni	86b0818c1f	[NET-8601] security: upgrade vault/api to remove go-jose.v2 (#20910 ) security: upgrade vault/api to remove go-jose.v2 This dependency has an open vulnerability (GO-2024-2631), and is no longer needed by the latest `vault/api`. This is a follow-up to the upgrade of `go-jose/v3` in this repository to make all our dependencies consolidate on v3. Also remove the recently added security scan triage block for GO-2024-2631, which was added due to incorrect reports that `go-jose/v3@3.0.3` was impacted; in reality, is was this indirect client dependency (not impacted by CVE) that the scanner was flagging. A bug report has been filed to address the incorrect reporting.	7 months ago
Deniz Onur Duzgun	3152ac3702	security: bump go, x/net and envoy versions (#20956 ) * Bump go version * Bump x/net * Bump envoy version * Add changelog --------- Co-authored-by: Michael Zalimeni <michael.zalimeni@hashicorp.com>	8 months ago
Michael Zalimeni	d4761c0ccd	security: upgrade google.golang.org/protobuf to 1.33.0 (#20801 ) Resolves CVE-2024-24786.	9 months ago
skpratt	0610aaaaf0	add raw delete api method (#20737 ) * add raw delete * allow 200 response for successful delete * add comment	9 months ago
Chris S. Kim	0571382c4a	Retract api@v1.28.0 (#20762 )	9 months ago
Michael Zalimeni	fe10339caa	[NET-7009] security: update x/crypto to 0.17.0 (#20023 ) security: update x/crypto to 0.17.0 This addresses CVE-2023-48795 (x/crypto/ssh).	11 months ago
Dan Stough	fd128f4947	build: dependency updates for 1.17.0 (#19453 )	1 year ago
Michael Zalimeni	8eb074e7c1	[NET-5944] security: Update Go version to 1.20.10 and `x/net` to 0.17.0 (#19225 ) * Bump golang.org/x/net to 0.17.0 This resolves [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) / [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487). * Update Go version to 1.20.10 This resolves [CVE-2023-39325](https://nvd.nist.gov/vuln/detail/CVE-2023-39325) / [CVE-2023-44487](https://nvd.nist.gov/vuln/detail/CVE-2023-44487) (`net/http`).	1 year ago
R.B. Boyer	c26d5cf62c	test: fix container test enterprise drift (#19101 )	1 year ago
Poonam Jadhav	4e77482e95	feat: remove resource api client from api module (#18984 ) * feat: remove resource api client from api module * fix: go mod clean up	1 year ago
Poonam Jadhav	235988b3bc	Net-2713/resource apply command (#18610 ) * feat: implement apply command * fix: resolve lint issues * refactor: use fixed types * fix: ci lint failures after main rebase	1 year ago
Dan Stough	948ce8bc23	build: updates for 1.16.1 release (#18415 ) * build: updates for 1.16.1 release * build: fix missing replace directive for envoyextensions * build: go mod tidy testing/deployer	1 year ago
Michael Zalimeni	905e371607	[NET-5146] security: Update Go version to 1.20.7 and `x/net` to 0.13.0 (#18358 ) * Update Go version to 1.20.7 This resolves [CVE-2023-29409] (https://nvd.nist.gov/vuln/detail/CVE-2023-29409)(`crypto/tls`). * Bump golang.org/x/net to 0.13.0 Addresses [CVE-2023-3978](https://nvd.nist.gov/vuln/detail/CVE-2023-3978) for security scans (non-impacting).	1 year ago
Michael Zalimeni	72999bb735	Update submodules to latest following 1.16.0 (#18197 ) Align all our internal use of submodules on the latest versions.	1 year ago
Michael Zalimeni	29cdb75d05	[NET-4865] Bump golang.org/x/net to 0.12.0 (#18186 ) Bump golang.org/x/net to 0.12.0 While not necessary to directly address CVE-2023-29406 (which should be handled by using a patched version of Go when building), an accompanying change to HTTP/2 error handling does impact agent code. See https://go-review.googlesource.com/c/net/+/506995 for the HTTP/2 change. Bump this dependency across our submodules as well for the sake of potential indirect consumers of `x/net/http`.	1 year ago
Matt Keeler	77f44fa878	Various bits of cleanup detected when using Go Workspaces (#17462 ) TLDR with many modules the versions included in each diverged quite a bit. Attempting to use Go Workspaces produces a bunch of errors. This commit: 1. Fixes envoy-library-references.sh to work again 2. Ensures we are pulling in go-control-plane@v0.11.0 everywhere (previously it was at that version in some modules and others were much older) 3. Remove one usage of golang/protobuf that caused us to have a direct dependency on it. 4. Remove deprecated usage of the Endpoint field in the grpc resolver.Target struct. The current version of grpc (v1.55.0) has removed that field and recommended replacement with URL.Opaque and calls to the Endpoint() func when needing to consume the previous field. 4. `go work init <all the paths to go.mod files>` && `go work sync`. This syncrhonized versions of dependencies from the main workspace/root module to all submodules 5. Updated .gitignore to ignore the go.work and go.work.sum files. This seems to be standard practice at the moment. 6. Update doc comments in protoc-gen-consul-rate-limit to be go fmt compatible 7. Upgraded makefile infra to perform linting, testing and go mod tidy on all modules in a flexible manner. 8. Updated linter rules to prevent usage of golang/protobuf 9. Updated a leader peering test to account for an extra colon in a grpc error message.	1 year ago
John Maguire	e47f3216e5	APIGW Normalize Status Conditions (#16994 ) * normalize status conditions for gateways and routes * Added tests for checking condition status and panic conditions for validating combinations, added dummy code for fsm store * get rid of unneeded gateway condition generator struct * Remove unused file * run go mod tidy * Update tests, add conflicted gateway status * put back removed status for test * Fix linting violation, remove custom conflicted status * Update fsm commands oss * Fix incorrect combination of type/condition/status * cleaning up from PR review * Change "invalidCertificate" to be of accepted status * Move status condition enums into api package * Update gateways controller and generated code * Update conditions in fsm oss tests * run go mod tidy on consul-container module to fix linting * Fix type for gateway endpoint test * go mod tidy from changes to api * go mod tidy on troubleshoot * Fix route conflicted reason * fix route conflict reason rename * Fix text for gateway conflicted status * Add valid certificate ref condition setting * Revert change to resolved refs to be handled in future PR	2 years ago
Semir Patel	9a5cb20570	Bump submodules from latest 1.15.1 patch release (#16578 ) * Update changelog with Consul patch releases 1.13.7, 1.14.5, 1.15.1 * Bump submodules from latest patch release * Forgot one	2 years ago
Dan Stough	82b5b4cc92	fix: revert go mod compat for sdk,api to 1.19 (#16323 )	2 years ago
Dan Stough	f1436109ea	[OSS] security: update go to 1.20.1 (#16263 ) * security: update go to 1.20.1	2 years ago
Derek Menteer	8079686bf0	Add 1.14.1 release updates. (#15514 ) Add post-release changes for 1.14.1 updates.	2 years ago
Derek Menteer	f52f3c5afc	Fix SDK to support older versions of Consul. (#15423 ) This change was necessary, because the configuration was always generated with a gRPC TLS port, which did not exist in Consul 1.13, and would result in the server failing to launch with an error. This code checks the version of Consul and conditionally adds the gRPC TLS port, only if the version number is greater than 1.14.	2 years ago
Derek Menteer	dc27e35f82	Consul 1.14 post-release updates (#15382 ) * Update changelog with 1.14 notes. * gomod version bumps for 1.14 release.	2 years ago
Kyle Schochenmaier	bf0f61a878	removes ioutil usage everywhere which was deprecated in go1.16 (#15297 ) * update go version to 1.18 for api and sdk, go mod tidy * removes ioutil usage everywhere which was deprecated in go1.16 in favour of io and os packages. Also introduces a lint rule which forbids use of ioutil going forward. Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com>	2 years ago
Nitya Dhanushkodi	5e156772f6	Remove ability to specify external addresses in GenerateToken endpoint (#14930 ) * Reverts "update generate token endpoint to take external addresses (#13844)" This reverts commit `f47319b7c6`.	2 years ago
boruszak	38b1a515f1	Mergimg	2 years ago
John Murret	79a541fd7d	Upgrade serf to v0.10.1 and memberlist to v0.5.0 to get memberlist size metrics and broadcast queue depth metric (#14873 ) * updating to serf v0.10.1 and memberlist v0.5.0 to get memberlist size metrics and memberlist broadcast queue depth metric * update changelog * update changelog * correcting changelog * adding "QueueCheckInterval" for memberlist to test * updating integration test containers to grab latest api	2 years ago
DanStough	7704daaad5	release updates for 1.13.2, 1.12.5, and 1.11.9	2 years ago
Nitya Dhanushkodi	f47319b7c6	update generate token endpoint to take external addresses (#13844 ) Update generate token endpoint (rpc, http, and api module) If ServerExternalAddresses are set, it will override any addresses gotten from the "consul" service, and be used in the token instead, and dialed by the dialer. This allows for setting up a load balancer for example, in front of the consul servers.	2 years ago
Evan Culver	d523d005d9	Latest submodule versions (#13750 )	2 years ago
DanStough	95250e7915	Update go version to 1.18.1	3 years ago
R.B. Boyer	eb21649f82	partitions: various refactors to support partitioning the serf LAN pool (#11568 )	3 years ago
Mike Morris	55659f3c9d	deps: update consul-api and consul-sdk (#11361 ) * deps: update consul/sdk in api/go.mod * deps: update consul/api to v1.11.0	3 years ago
Mike Morris	ab927d5480	Merge pull request #9270 from hashicorp/release/1.9.0 merge: release/1.9.0 back into 1.9.x	4 years ago
Matt Keeler	38f5ddce2a	Add per-agent reconnect timeouts (#8781 ) This allows for client agent to be run in a more stateless manner where they may be abruptly terminated and not expected to come back. If advertising a per-agent reconnect timeout using the advertise_reconnect_timeout configuration when that agent leaves, other agents will wait only that amount of time for the agent to come back before reaping it. This has the advantageous side effect of causing servers to deregister the node/services/checks for that agent sooner than if the global reconnect_timeout was used.	4 years ago
Mike Morris	48e7c07cf9	api: bump consul/api to v1.6.0 and consul/sdk to v0.6.0 (#8460 ) * api: bump consul/sdk dependency to v0.6.0 * api: bump dependency to v1.6.0	4 years ago
R.B. Boyer	e853368c23	gossip: Avoid issue where two unique leave events for the same node could lead to infinite rebroadcast storms (#8343 ) bump serf to v0.9.3 to include fix for https://github.com/hashicorp/serf/pull/606	4 years ago
R.B. Boyer	6adad71125	wan federation via mesh gateways (#6884 ) This is like a Möbius strip of code due to the fact that low-level components (serf/memberlist) are connected to high-level components (the catalog and mesh-gateways) in a twisty maze of references which make it hard to dive into. With that in mind here's a high level summary of what you'll find in the patch: There are several distinct chunks of code that are affected: * new flags and config options for the server * retry join WAN is slightly different * retry join code is shared to discover primary mesh gateways from secondary datacenters * because retry join logic runs in the agent and the results of that operation for primary mesh gateways are needed in the server there are some methods like `RefreshPrimaryGatewayFallbackAddresses` that must occur at multiple layers of abstraction just to pass the data down to the right layer. * new cache type `FederationStateListMeshGatewaysName` for use in `proxycfg/xds` layers * the function signature for RPC dialing picked up a new required field (the node name of the destination) * several new RPCs for manipulating a FederationState object: `FederationState:{Apply,Get,List,ListMeshGateways}` * 3 read-only internal APIs for debugging use to invoke those RPCs from curl * raft and fsm changes to persist these FederationStates * replication for FederationStates as they are canonically stored in the Primary and replicated to the Secondaries. * a special derivative of anti-entropy that runs in secondaries to snapshot their local mesh gateway `CheckServiceNodes` and sync them into their upstream FederationState in the primary (this works in conjunction with the replication to distribute addresses for all mesh gateways in all DCs to all other DCs) * a "gateway locator" convenience object to make use of this data to choose the addresses of gateways to use for any given RPC or gossip operation to a remote DC. This gets data from the "retry join" logic in the agent and also directly calls into the FSM. * RPC (`:8300`) on the server sniffs the first byte of a new connection to determine if it's actually doing native TLS. If so it checks the ALPN header for protocol determination (just like how the existing system uses the type-byte marker). * 2 new kinds of protocols are exclusively decoded via this native TLS mechanism: one for ferrying "packet" operations (udp-like) from the gossip layer and one for "stream" operations (tcp-like). The packet operations re-use sockets (using length-prefixing) to cut down on TLS re-negotiation overhead. * the server instances specially wrap the `memberlist.NetTransport` when running with gateway federation enabled (in a `wanfed.Transport`). The general gist is that if it tries to dial a node in the SAME datacenter (deduced by looking at the suffix of the node name) there is no change. If dialing a DIFFERENT datacenter it is wrapped up in a TLS+ALPN blob and sent through some mesh gateways to eventually end up in a server's :8300 port. * a new flag when launching a mesh gateway via `consul connect envoy` to indicate that the servers are to be exposed. This sets a special service meta when registering the gateway into the catalog. * `proxycfg/xds` notice this metadata blob to activate additional watches for the FederationState objects as well as the location of all of the consul servers in that datacenter. * `xds:` if the extra metadata is in place additional clusters are defined in a DC to bulk sink all traffic to another DC's gateways. For the current datacenter we listen on a wildcard name (`server.<dc>.consul`) that load balances all servers as well as one mini-cluster per node (`<node>.server.<dc>.consul`) * the `consul tls cert create` command got a new flag (`-node`) to help create an additional SAN in certs that can be used with this flavor of federation.	5 years ago
Matt Keeler	77074be9b8	Bump sdk module version to 0.4.0	5 years ago
Chris Piraino	401221de58	Allow users to configure either unstructured or JSON logging (#7130 ) * hclog Allow users to choose between unstructured and JSON logging	5 years ago
Michel Vocks	6681be918a	api: add option to set TLS options in-memory for API client (#7093 ) This PR adds the option to set in-memory certificates to the API client instead of requiring the certificate to be stored on disk in a file. This allows us to define API client TLS options per Consul secret backend in Vault. Related issue hashicorp/vault#4800	5 years ago
R.B. Boyer	4af5c2d6dd	fix the submodule go.mod and go.sum files (#7098 )	5 years ago
R.B. Boyer	ea6231ce35	api: bump to sdk v0.2.0	5 years ago
R.B. Boyer	cc9bcccc73	api: bump sdk version to v0.1.1	6 years ago
Jeff Mitchell	f1fe406aa8	Update SDK version (#5572 )	6 years ago
Jeff Mitchell	4243c3ae42	Move internal/ to sdk/ (#5568 ) * Move internal/ to sdk/ * Add a readme to the SDK folder	6 years ago
Jeff Mitchell	6327d3fd6f	Update internal dep (#5564 )	6 years ago
Jeff Mitchell	47c390025b	Convert to Go Modules (#5517 ) * First conversion * Use serf 0.8.2 tag and associated updated deps * * Move freeport and testutil into internal/ * Make internal/ its own module * Update imports * Add replace statements so API and normal Consul code are self-referencing for ease of development * Adapt to newer goe/values * Bump to new cleanhttp * Fix ban nonprintable chars test * Update lock bad args test The error message when the duration cannot be parsed changed in Go 1.12 (ae0c435877d3aacb9af5e706c40f9dddde5d3e67). This updates that test. * Update another test as well * Bump travis * Bump circleci * Bump go-discover and godo to get rid of launchpad dep * Bump dockerfile go version * fix tar command * Bump go-cleanhttp	6 years ago

47 Commits (5f129ad5b27c1ff0ae519859abe030c2717b1c32)