770 Commits (62688107affc75861a8d2f89caca9a982523beca)

Author	SHA1	Message	Date
Daniel Nephin	b29faa3e50	ca: fix stored CARoot representation with Vault provider ... We were not adding the local signing cert to the CARoot. This commit fixes that bug, and also adds support for fixing existing CARoot on upgrade. Also update the tests for both primary and secondary to be more strict. Check the SigningKeyID is correct after initialization and rotation.	3 years ago
Daniel Nephin	32ef9c5d5c	ca: add some godoc and func for finding leaf signing cert ... This will be used in a follow up commit.	3 years ago
freddygv	5e1f7b7c36	Prevent partition-exports entry from OSS usage ... Validation was added on the config entry kind since that is called when validating config entries to bootstrap via agent configuration and when applying entries via the config RPC endpoint.	3 years ago
Dhia Ayachi	bb83624950	Partition session checks store (#11638) ... * state: port KV and Tombstone tables to new pattern * go fmt'ed * handle wildcards for tombstones * Fix graveyard ent vs oss * fix oss compilation error * add partition to tombstones and kv state store indexes * refactor to use `indexWithEnterpriseIndexable` * Apply suggestions from code review Co-authored-by: Chris S. Kim <ckim@hashicorp.com> Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> * add `singleValueID` implementation assertions * partition `tableSessions` table * fix sessions to use UUID and fix prefix index * fix oss build * clean up unused functions * fix oss compilation * add a partition indexer for sessions * Fix oss to not have partition index * fix oss tests * remove unused operations_ent.go and operations_oss.go func * remove unused const * convert `IndexID` of `session_checks` table * convert `indexSession` of `session_checks` table * convert `indexNodeCheck` of `session_checks` table * partition `indexID` and `indexSession` of `tableSessionChecks` * fix oss linter * fix review comments * remove partition for Checks as it's always use the session partition Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> Co-authored-by: Chris S. Kim <ckim@hashicorp.com> Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com>	3 years ago
Iryna Shustava	0ee456649f	connect: Support auth methods for the vault connect CA provider (#11573) ... * Support vault auth methods for the Vault connect CA provider * Rotate the token (re-authenticate to vault using auth method) when the token can no longer be renewed	3 years ago
R.B. Boyer	1e02460bd1	re-run gofmt on 1.17 (#11579) ... This should let freshly recompiled golangci-lint binaries using Go 1.17 pass 'make lint'	3 years ago
R.B. Boyer	eb21649f82	partitions: various refactors to support partitioning the serf LAN pool (#11568)	3 years ago
freddygv	e5b7c4713f	Accept partition for ingress services	3 years ago
Daniel Upton	50a1f20ff9	xds: prefer fed state gateway definitions if they're fresher (#11522) ... Fixes an issue described in #10132, where if two DCs are WAN federated over mesh gateways, and the gateway in the non-primary DC is terminated and receives a new IP address (as is commonly the case when running them on ephemeral compute instances) the primary DC is unable to re-establish its connection until the agent running on its own gateway is restarted. This was happening because we always preferred gateways discovered by the `Internal.ServiceDump` RPC (which would fail because there's no way to dial the remote DC) over those discovered in the federation state, which is replicated as long as the primary DC's gateway is reachable.	3 years ago
Dhia Ayachi	7916268c40	refactor session state store tables to use the new index pattern (#11525) ... * state: port KV and Tombstone tables to new pattern * go fmt'ed * handle wildcards for tombstones * Fix graveyard ent vs oss * fix oss compilation error * add partition to tombstones and kv state store indexes * refactor to use `indexWithEnterpriseIndexable` * Apply suggestions from code review Co-authored-by: Chris S. Kim <ckim@hashicorp.com> Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> * add `singleValueID` implementation assertions * partition `tableSessions` table * fix sessions to use UUID and fix prefix index * fix oss build * clean up unused functions * fix oss compilation * add a partition indexer for sessions * Fix oss to not have partition index * fix oss tests * remove unused func `prefixIndexFromServiceNameAsString` * fix test error check * remove unused operations_ent.go and operations_oss.go func * remove unused const Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> Co-authored-by: Chris S. Kim <ckim@hashicorp.com> Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com>	3 years ago
Dhia Ayachi	520cb5858c	KV state store refactoring and partitioning (#11510) ... * state: port KV and Tombstone tables to new pattern * go fmt'ed * handle wildcards for tombstones * Fix graveyard ent vs oss * fix oss compilation error * add partition to tombstones and kv state store indexes * refactor to use `indexWithEnterpriseIndexable` * partition kvs indexID table * add `partitionedIndexEntryName` in oss for test purpose * Apply suggestions from code review Co-authored-by: Chris S. Kim <ckim@hashicorp.com> Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> * add `singleValueID` implementation assertions * remove entmeta reference from oss Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> Co-authored-by: Chris S. Kim <ckim@hashicorp.com> Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com>	3 years ago
Daniel Nephin	8ba760a2fc	acl: remove id and revision from Policy constructors ... The fields were removed in a previous commit. Also remove an unused constructor for PolicyMerger	3 years ago
Daniel Nephin	7c679c11e6	acl: remove Policy.ID and Policy.Revision ... These two fields do not appear to be used anywhere. We use the structs.ACLPolicy ID in the ACLResolver cache, but the acl.Policy ID and revision are not used.	3 years ago
Connor	efe4b21287	Support Vault Namespaces explicitly in CA config (#11477) ... * Support Vault Namespaces explicitly in CA config If there is a Namespace entry included in the Vault CA configuration, set it as the Vault Namespace on the Vault client Currently the only way to support Vault namespaces in the Consul CA config is by doing one of the following: 1) Set the VAULT_NAMESPACE environment variable which will be picked up by the Vault API client 2) Prefix all Vault paths with the namespace Neither of these are super pleasant. The first requires direct access and modification to the Consul runtime environment. It's possible and expected, not super pleasant. The second requires more indepth knowledge of Vault and how it uses Namespaces and could be confusing for anyone without that context. It also infers that it is not supported * Add changelog * Remove fmt.Fprint calls * Make comment clearer * Add next consul version to website docs * Add new test for default configuration * go mod tidy * Add skip if vault not present * Tweak changelog text	3 years ago
Mark Anderson	7e8228a20b	Remove some usage of md5 from the system (#11491) ... * Remove some usage of md5 from the system OSS side of https://github.com/hashicorp/consul-enterprise/pull/1253 This is a potential security issue because an attacker could conceivably manipulate inputs to cause persistence files to collide, effectively deleting the persistence file for one of the colliding elements. Signed-off-by: Mark Anderson <manderson@hashicorp.com>	3 years ago
FFMMM	4ddf973a31	add root_cert_ttl option for consul connect, vault ca providers (#11428) ... * add root_cert_ttl option for consul connect, vault ca providers Signed-off-by: FFMMM <FFMMM@users.noreply.github.com> * Apply suggestions from code review Co-authored-by: Chris S. Kim <ckim@hashicorp.com> * add changelog, pr feedback Signed-off-by: FFMMM <FFMMM@users.noreply.github.com> * Update .changelog/11428.txt, more docs Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> * Update website/content/docs/agent/options.mdx Co-authored-by: Kyle Havlovitz <kylehav@gmail.com> Co-authored-by: Chris S. Kim <ckim@hashicorp.com> Co-authored-by: Daniel Nephin <dnephin@hashicorp.com> Co-authored-by: Kyle Havlovitz <kylehav@gmail.com>	3 years ago
Daniel Nephin	51d8417545	Merge pull request #10690 from tarat44/h2c-support-in-ping-checks ... add support for h2c in h2 ping health checks	3 years ago
Daniel Upton	d47b7311b8	Support Check-And-Set deletion of config entries (#11419) ... Implements #11372	3 years ago
freddygv	ac96ce6552	Ensure partition-exports kind gets marshalled ... The api module has decoding functions that rely on 'kind' being present of payloads. This is so that we can decode into the appropriate api type for the config entry. This commit ensures that a static kind is marshalled in responses from Consul's api endpoints so that the api module can decode them.	3 years ago
freddygv	43360eb216	Rework acl exports interface	3 years ago
Freddy	b1b6f682e1	Merge pull request #11416 from hashicorp/ap/exports-update ... Rename service-exports to partition-exports	3 years ago
R.B. Boyer	ef559dfdd4	agent: refactor the agent delegate interface to be partition friendly (#11429)	3 years ago
freddygv	8aefdc31da	Remove outdated partition label from test	3 years ago
freddygv	5c24ed61a8	Rename service-exports to partition-exports ... Existing config entries prefixed by service- are specific to individual services. Since this config entry applies to partitions it is being renamed. Additionally, the Partition label was changed to Name because using Partition at the top-level and in the enterprise meta was leading to the enterprise meta partition being dropped by msgpack.	3 years ago
Daniel Nephin	65d48e5042	state: remove support for updating legacy ACL tokens	3 years ago
Daniel Nephin	3390f85ab4	acl: remove ACLTokenTypeManagement	3 years ago
Daniel Nephin	32b4ad42ac	acl: remove ACLTokenTypeClient, ... along with the last test referencing it.	3 years ago
Daniel Nephin	c77e5747b1	acl: remove EmbeddedPolicy ... This method is no longer. It only existed for legacy tokens, which are no longer supported.	3 years ago
Daniel Nephin	1344137ce2	acl: move the legacy ACL struct to the one package where it is used ... It is now only used for restoring snapshots. We can remove it in phase 2.	3 years ago
Daniel Nephin	531f2f8a3f	acl: remove most of the rest of structs/acl_legacy.go	3 years ago
Kyle Havlovitz	04cd2c983e	Add new service-exports config entry	3 years ago
Jared Kirschner	14af8cb7a9	Merge pull request #11293 from bisakhmondal/service_filter ... expression validation of service-resolver subset filter	3 years ago
R.B. Boyer	cc2abb79ba	acl: small OSS refactors to help ensure that auth methods with namespace rules work with partitions (#11323)	3 years ago
Bisakh Mondal	a350a383d3	add service resolver subset filter validation	3 years ago
tarat44	166269f93b	preload json values in structs to determine defaults	3 years ago
tarat44	ecdcfd6360	only set default on H2PingUseTLS if H2PING is set	3 years ago
tarat44	1e8e44d442	fix formatting	3 years ago
tarat44	c1ed3a9a94	change config option to H2PingUseTLS	3 years ago
tarat44	3c9f5a73d9	add support for h2c in h2 ping health checks	3 years ago
Daniel Nephin	3ac910606c	acl: remove reading of serf acl tags ... We no long need to read the acl serf tag, because servers are always either ACL enabled or ACL disabled. We continue to write the tag so that during an upgarde older servers will see the tag.	3 years ago
Daniel Nephin	8e9773e20b	acl: remove ACL.GetPolicy endpoint and resolve legacy acls ... And all code that was no longer used once those two were removed.	3 years ago
Daniel Nephin	6e1ebd3df7	acl: remove the last of the legacy FSM ... Replace it with an implementation that returns an error, and rename some symbols to use a Deprecated suffix to make it clear. Also remove the ACLRequest struct, which is no longer referenced.	3 years ago
Daniel Nephin	ed928511ca	acl: remove bootstrap-init FSM operation	3 years ago
Daniel Nephin	05f0cc3993	acl: remove ACLDelete FSM command, and state store function ... These are no longer used now that ACL.Apply has been removed.	3 years ago
Daniel Nephin	966e50e00e	acl: remove legacy field to ACLBoostrap	3 years ago
Daniel Nephin	ea4a8343cd	Merge pull request #11177 from hashicorp/dnephin/remove-entmeta-methods ... structs: remove EnterpriseMeta helper methods	3 years ago
Daniel Nephin	4c579a49ed	Merge pull request #10986 from hashicorp/dnephin/acl-legacy-remove-rpc ... acl: remove legacy ACL RPC - part 1	3 years ago
Daniel Nephin	eb632c53a2	structs: rename the last helper method. ... This one gets used a bunch, but we can rename it to make the behaviour more obvious.	3 years ago
Daniel Nephin	8d8c1f9d5e	structs: remove another helper ... We already have a helper funtion.	3 years ago
Daniel Nephin	6d72517682	structs: remove two methods that were only used once each. ... These methods only called a single function. Wrappers like this end up making code harder to read because it adds extra ways of doing things. We already have many helper functions for constructing these types, we don't need additional methods.	3 years ago
Chris S. Kim	5c37819d09	Cleanup unnecessary normalizing method (#11169)	3 years ago
Paul Banks	7b4cbe3143	Final readability tweaks from review	3 years ago
Paul Banks	07f81991df	Refactor SDS validation to make it more contained and readable	3 years ago
Paul Banks	2281d883b9	Fix some more Enterprise Normalization issues affecting tests	3 years ago
Paul Banks	659321d008	Handle namespaces in route names correctly; add tests for enterprise	3 years ago
Paul Banks	4e39f03d5b	Add ingress-gateway config for SDS	3 years ago
Daniel Nephin	e7c63004a8	acl: remove a couple legacy ACL operation constants ... structs.ACLForceSet was deprecated 4 years ago, it should be safe to remove now. ACLBootstrapNow was removed in a recent commit. While it is technically possible that a cluster with mixed version could still attempt a legacy boostrap, we documented that the legacy system was deprecated in 1.4, so no clusters that are being upgraded should be attempting a legacy boostrap.	3 years ago
Daniel Nephin	868bfc7a0a	acl: Remove unused ACLPolicyIDType	3 years ago
Daniel Nephin	aee8a9511d	Merge pull request #10985 from hashicorp/dnephin/acl-legacy-remove-replication ... acl: remove legacy ACL replication	3 years ago
R.B. Boyer	ca73abdea1	acl: fix intention:*:write checks (#11061) ... This is a partial revert of #10793	3 years ago
Freddy	fcef19f94b	acl: small resolver changes to account for partitions (#11052) ... Also refactoring the enterprise side of a test to make it easier to reason about.	3 years ago
Freddy	e18f3c1f6d	Update error texts (#11022) ... Co-authored-by: Daniel Nephin <dnephin@hashicorp.com>	3 years ago
Daniel Nephin	1f9479603c	Add failures_before_warning to checks (#10969) ... Signed-off-by: Jakub Sokołowski <jakub@status.im> * agent: add failures_before_warning setting The new setting allows users to specify the number of check failures that have to happen before a service status us updated to be `warning`. This allows for more visibility for detected issues without creating alerts and pinging administrators. Unlike the previous behavior, which caused the service status to not update until it reached the configured `failures_before_critical` setting, now Consul updates the Web UI view with the `warning` state and the output of the service check when `failures_before_warning` is breached. The default value of `FailuresBeforeWarning` is the same as the value of `FailuresBeforeCritical`, which allows for retaining the previous default behavior of not triggering a warning. When `FailuresBeforeWarning` is set to a value higher than that of `FailuresBeforeCritical it has no effect as `FailuresBeforeCritical` takes precedence. Resolves: https://github.com/hashicorp/consul/issues/10680 Signed-off-by: Jakub Sokołowski <jakub@status.im> Co-authored-by: Jakub Sokołowski <jakub@status.im>	3 years ago
Paul Banks	b38e84df63	Include namespace and partition in error messages when validating ingress header manip	3 years ago
Paul Banks	1079089f20	Refactor HTTPHeaderModifiers.MergeDefaults based on feedback	3 years ago
Paul Banks	9e4e204e96	Fix enterprise test failures caused by differences in normalizing EnterpriseMeta	3 years ago
Paul Banks	3004eadd08	Fix enterprise discovery chain tests; Fix multi-level split merging	3 years ago
Paul Banks	b5ae00d753	Remove unnecessary check	3 years ago
Paul Banks	1b9632531a	Integration tests for all new header manip features	3 years ago
Paul Banks	e22cc9c53a	Header manip for split legs plumbing	3 years ago
Paul Banks	f439dfc04f	Ingress gateway header manip plumbing	3 years ago
Paul Banks	d776a2d236	Add HTTP header manip for router and splitter entries	3 years ago
Paul Banks	46e4041283	Header manip and validation added for ingress-gateway entries	3 years ago
Chris S. Kim	9bbfa048a2	Sync enterprise changes to oss (#10994) ... This commit updates OSS with files for enterprise-specific admin partitions feature work	3 years ago
Kyle Havlovitz	a14950025a	Merge pull request #10984 from hashicorp/mesh-resource ... acl: adding a new mesh resource	3 years ago
Dhia Ayachi	bc0e4f2f46	partition dicovery chains (#10983) ... * partition dicovery chains * fix default partition for OSS	3 years ago
Daniel Nephin	f063402b29	acl: remove ACL.IsSame ... The only caller of this method was removed in a recent commit along with replication.	3 years ago
Daniel Nephin	d63cef1219	acl: remove legacy ACL replication	3 years ago
R.B. Boyer	ee372a854a	acl: adding a new mesh resource	3 years ago
Dhia Ayachi	09197c989c	add partition to SNI when partition is non default (#10917)	3 years ago
Chris S. Kim	45dcc8b553	api: expose upstream routing configurations in topology view (#10811) ... Some users are defining routing configurations that do not have associated services. This commit surfaces these configs in the topology visualization. Also fixes a minor internal bug with non-transparent proxy upstream/downstream references.	3 years ago
R.B. Boyer	a6d22efb49	acl: some acl authz refactors for nodes (#10909)	3 years ago
freddygv	85878685b7	Fixup proxy config test fixtures ... - The TestNodeService helper created services with the fixed name "web", and now that name is overridable. - The discovery chain snapshot didn't have prepared query endpoints so the endpoints tests were missing data for prepared queries	3 years ago
Dhia Ayachi	1950ebbe1f	oss portion of ent #1069 (#10883)	3 years ago
R.B. Boyer	097e1645e3	agent: ensure that most agent behavior correctly respects partition configuration (#10880)	3 years ago
R.B. Boyer	310e775a8a	state: partition nodes and coordinates in the state store (#10859) ... Additionally: - partitioned the catalog indexes appropriately for partitioning - removed a stray reference to a non-existent index named "node.checks"	3 years ago
Daniel Nephin	e637cd71f3	acl: use authz consistently as the variable name for an acl.Authorizer ... Follow up to https://github.com/hashicorp/consul/pull/10737#discussion_r682147950 Renames all variables for acl.Authorizer to use `authz`. Previously some places used `rule` which I believe was an old name carried over from the legacy ACL system. A couple places also used authorizer. This commit also removes another couple of authorizer nil checks that are no longer necessary.	3 years ago
Kyle Havlovitz	073b6c8411	oss: Rename default partition	3 years ago
Daniel Nephin	d3325b0253	Merge pull request #10612 from bigmikes/acl-replication-fix ... acl: acl replication routine to report the last error message	3 years ago
Daniel Nephin	5b2e5882b4	acl: move check for Intention.DestinationName into Authorizer ... Follow up to https://github.com/hashicorp/consul/pull/10737#discussion_r680134445 Move the check for the Intention.DestinationName into the Authorizer to remove the need to check what kind of Authorizer is being used. It sounds like this check is only for legacy ACLs, so is probably just a safeguard .	3 years ago
Daniel Nephin	9cdd823ffc	Merge pull request #10737 from hashicorp/dnephin/remove-authorizer-nil-checks ... acl: remove authz == nil checks	3 years ago
Evan Culver	710bd90ef7	checks: Add Interval and Timeout to API response (#10717)	3 years ago
Daniel Nephin	f497d5ab30	acl: remove many instances of authz == nil	3 years ago
Evan Culver	727b81a757	Fix intention endpoint test	3 years ago
Chris S. Kim	9c3af1a429	sync enterprise files with oss (#10705)	3 years ago
Chris S. Kim	91c90a672a	agent: update proxy upstreams to inherit namespace from service (#10688)	3 years ago
R.B. Boyer	96b97d6554	replumbing a bunch of api and agent structs for partitions (#10681)	3 years ago
R.B. Boyer	fc9b1a277d	sync changes to oss files made in enterprise (#10670)	3 years ago
R.B. Boyer	188e8dc51f	agent/structs: add a bunch more EnterpriseMeta helper functions to help with partitioning (#10669)	3 years ago
Evan Culver	0527dcff57	acls: Show `AuthMethodNamespace` when reading/listing ACL token meta (#10598)	3 years ago
Giulio Micheloni	814ef6b103	acl: fix error type into a string type for serialization issue ... acl_endpoint_test.go:507: Error Trace: acl_endpoint_test.go:507 retry.go:148 retry.go:149 retry.go:103 acl_endpoint_test.go:504 Error: Received unexpected error: codec.decoder: decodeValue: Cannot decode non-nil codec value into nil error (1 methods) Test: TestACLEndpoint_ReplicationStatus	3 years ago
Giulio Micheloni	529fe737ef	acl: acl replication routine to report the last error message	3 years ago
Evan Culver	13bd86527b	Add support for returning ACL secret IDs for accessors with acl:write (#10546)	3 years ago
Daniel Nephin	2c4f22a9f0	Merge pull request #10552 from hashicorp/dnephin/ca-remove-rotation-period ... ca: remove unused RotationPeriod field	3 years ago
jkirschner-hashicorp	5f73de6fbc	Merge pull request #10560 from jkirschner-hashicorp/change-sane-to-reasonable ... Replace use of 'sane' where appropriate	3 years ago
Daniel Nephin	3a045cca8d	ca: remove unused RotationPeriod field ... This field was never used. Since it is persisted as part of a map[string]interface{} it is pretty easy to remove it.	3 years ago
Jared Kirschner	bd536151e1	Replace use of 'sane' where appropriate ... HashiCorp voice, style, and language guidelines recommend avoiding ableist language unless its reference to ability is accurate in a particular use.	3 years ago
Daniel Nephin	16b21b0864	http: add an X-Consul-Query-Backend header to responses ... So that it is easier to detect and test when streaming is being used.	3 years ago
R.B. Boyer	ed8a901be7	connect: include optional partition prefixes in SPIFFE identifiers (#10507) ... NOTE: this does not include any intentions enforcement changes yet	3 years ago
R.B. Boyer	e3835ac6a1	structs: prohibit config entries from referencing more than one partition at a time (#10478) ... affected kinds: service-defaults, ingress-gateway, terminating-gateway, service-intentions	3 years ago
R.B. Boyer	8344b7fe2e	structs: prevent service-defaults upstream configs from using wildcard names or namespaces (#10475)	3 years ago
R.B. Boyer	ac50db9087	structs: add some missing config entry validation and clean up tests (#10465) ... Affects kinds: service-defaults, ingress-gateway, terminating-gateway	3 years ago
Freddy	3ee66b2e9a	Omit empty tproxy config in JSON responses (#10402)	4 years ago
Freddy	ffb13f35f1	Rename CatalogDestinationsOnly (#10397) ... CatalogDestinationsOnly is a passthrough that would enable dialing addresses outside of Consul's catalog. However, when this flag is set to true only _connect_ endpoints for services can be dialed. This flag is being renamed to signal that non-Connect endpoints can't be dialed by transparent proxies when the value is set to true.	4 years ago
Freddy	33bd9b5be8	Relax validation for expose.paths config (#10394) ... Previously we would return an error if duplicate paths were specified. This could lead to problems in cases where a user has the same path, say /healthz, on two different ports. This validation was added to signal a potential misconfiguration. Instead we will only check for duplicate listener ports, since that is what would lead to ambiguity issues when generating xDS config. In the future we could look into using a single listener and creating distinct filter chains for each path/port.	4 years ago
Freddy	429f9d8bb8	Add flag for transparent proxies to dial individual instances (#10329)	4 years ago
Daniel Nephin	ba15f92a8a	structs: fix cache keys ... So that requests are cached properly, and the cache does not return the wrong data for a request.	4 years ago
Daniel Nephin	920ae31598	structs: add two cache completeness tests types that implement cache.Request	4 years ago
Daniel Nephin	46dfdb611f	structs: improve the interface of assertCacheInfoKeyIsComplete	4 years ago
Daniel Nephin	7c2957e24d	structs: Add more cache key tests	4 years ago
Dhia Ayachi	f785c5b332	RPC Timeout/Retries account for blocking requests (#8978)	4 years ago
R.B. Boyer	597448da47	server: ensure that central service config flattening properly resets the state each time (#10239) ... The prior solution to call reply.Reset() aged poorly since newer fields were added to the reply, but not added to Reset() leading serial blocking query loops on the server to blend replies. This could manifest as a service-defaults protocol change from default=>http not reverting back to default after the config entry reponsible was deleted.	4 years ago
R.B. Boyer	7e1d7803b8	agent: ensure we hash the non-deprecated upstream fields on ServiceConfigRequest (#10240)	4 years ago
Iryna Shustava	d7d44f6ae7	Save exposed ports in agent's store and expose them via API (#10173) ... * Save exposed HTTP or GRPC ports to the agent's store * Add those the health checks API so we can retrieve them from the API * Change redirect-traffic command to also exclude those ports from inbound traffic redirection when expose.checks is set to true.	4 years ago
Mark Anderson	751fe7e314	Fixup more structs_test ... Signed-off-by: Mark Anderson <manderson@hashicorp.com>	4 years ago
Mark Anderson	4d0346bc46	Fixup filtering tests ... Missed annotations for SocketPath, LocalSocketPath, LocalServiceSocketPath Signed-off-by: Mark Anderson <manderson@hashicorp.com>	4 years ago
Daniel Nephin	347f3d2128	Merge pull request #10155 from hashicorp/dnephin/config-entry-remove-fields ... config-entry: remove Kind and Name field from Mesh config entry	4 years ago
Daniel Nephin	c8c85523e1	config-entries: add a test for the API client ... Also fixes a bug with listing kind=mesh config entries. ValidateConfigEntryKind was only being used by the List endpoint, and was yet another place where we have to enumerate all the kinds. This commit removes ValidateConfigEntryKind and uses MakeConfigEntry instead. This change removes the need to maintain two separate functions at the cost of creating an instance of the config entry which will be thrown away immediately.	4 years ago
Mark Anderson	8040f91a43	Add support for downstreams ... Enhance config by adding SocketPath and LocalSocketPath config values Supports syntax of the form: ``` services { name = "sock_forwarder" id = "sock_forwarder.1" socket_path = "/tmp/downstream_3.sock" connect { sidecar_service { proxy { local_service_socket_path = "/tmp/downstream.sock" } } } } ``` Signed-off-by: Mark Anderson <manderson@hashicorp.com>	4 years ago
Mark Anderson	583ae65d5b	Convert mode to string representation ... Signed-off-by: Mark Anderson <manderson@hashicorp.com>	4 years ago
Mark Anderson	06f0f79218	Continue working through proxy and agent ... Rework/listeners, rename makeListener Refactor, tests pass Signed-off-by: Mark Anderson <manderson@hashicorp.com>	4 years ago
Mark Anderson	8b1217417a	First changes for unix domain sockets upstreams ... Start making structure changes to support unix domain socket address for upstreams upstreams = [ { destination_name = "echo-service" local_bind_socket_path = "/tmp/upstream.sock" config { passive_health_check { interval = "10s" max_failures = 42 } } } Signed-off-by: Mark Anderson <manderson@hashicorp.com>	4 years ago
Freddy	ed1082510d	Fixup discovery chain handling in transparent mode (#10168) ... Co-authored-by: R.B. Boyer <4903+rboyer@users.noreply.github.com> Previously we would associate the address of a discovery chain target with the discovery chain's filter chain. This was broken for a few reasons: - If the upstream is a virtual service, the client proxy has no way of dialing it because virtual services are not targets of their discovery chains. The targets are distinct services. This is addressed by watching the endpoints of all upstream services, not just their discovery chain targets. - If multiple discovery chains resolve to the same target, that would lead to multiple filter chains attempting to match on the target's virtual IP. This is addressed by only matching on the upstream's virtual IP. NOTE: this implementation requires an intention to the redirecting virtual service and not just to the final destination. This is how we can know that the virtual service is an upstream to watch. A later PR will look into traversing discovery chains when computing upstreams so that intentions are only required to the discovery chain targets.	4 years ago
Daniel Nephin	a07a58a873	config-entry: use custom MarshalJSON for mesh type ... So that the Kind field is added to the JSON object.	4 years ago
Daniel Nephin	62efaaab21	config-entry: remove Kind and Name field from Mesh config entry ... No config entry needs a Kind field. It is only used to determine the Go type to target. As we introduce new config entries (like this one) we can remove the kind field and have the GetKind method return the single supported value. In this case (similar to proxy-defaults) the Name field is also unnecessary. We always use the same value. So we can omit the name field entirely.	4 years ago
Freddy	701b49f772	Rename cluster config files to mesh as well (#10148)	4 years ago
Freddy	078c40425f	Rename "cluster" config entry to "mesh" (#10127) ... This config entry is being renamed primarily because in k8s the name cluster could be confusing given that the config entry applies across federated datacenters. Additionally, this config entry will only apply to Consul as a service mesh, so the more generic "cluster" name is not needed.	4 years ago
Daniel Nephin	2e4dc7b705	Merge pull request #10045 from hashicorp/dnephin/state-proxy-defaults ... state: remove config-entries kind index	4 years ago
Freddy	f265dd635f	Disallow * as service-defaults name (#10069)	4 years ago
R.B. Boyer	70f1ba3a2b	fix test when run in enterprise (#10048)	4 years ago
freddygv	a0f3591aee	Don't panic on nil UpstreamConfiguration.Clone()	4 years ago
Daniel Nephin	b57b3726d2	state: remove unnecessary kind index ... The query can be performed using a prefix query on the ID index. Also backport some enterprise changes to prevent conflicts.	4 years ago
Freddy	3be304be16	Merge pull request #10016 from hashicorp/topology-update	4 years ago
Freddy	439a7fce2d	Split Upstream.Identifier() so non-empty namespace is always prepended in ent (#10031)	4 years ago
R.B. Boyer	4db8b78854	connect: update centralized upstreams representation in service-defaults (#10015)	4 years ago
Matt Keeler	bbf5993534	Move static token resolution into the ACLResolver (#10013)	4 years ago
freddygv	8e74eaa684	Update viz endpoint to include topology from intentions	4 years ago
freddygv	e1808af729	Fixup tests	4 years ago
freddygv	7cb3f32672	Convert new tproxy structs in api module into ptrs ... This way we avoid serializing these when empty. Otherwise users of the latest version of the api submodule cannot interact with older versions of Consul, because a new api client would send keys that the older Consul doesn't recognize yet.	4 years ago
Freddy	8fc60a6ca6	Merge pull request #10000 from hashicorp/remove-upstream-cfg-validation ... Remove zero-value validation of upstream cfg structs	4 years ago
freddygv	932fbddd27	Augment intention decision summary with DefaultAllow mode	4 years ago
freddygv	b8ed82b808	Fixup bexpr filtering	4 years ago
freddygv	d7c43049fa	Remove zero-value validation of upstream cfg structs ... The zero value of these flags was already being excluded in the xDS generation of circuit breaker/outlier detection config. See: makeThresholdsIfNeeded and ToOutlierDetection.	4 years ago
freddygv	7bd51ff536	Replace TransparentProxy bool with ProxyMode ... This PR replaces the original boolean used to configure transparent proxy mode. It was replaced with a string mode that can be set to: - "": Empty string is the default for when the setting should be defaulted from other configuration like config entries. - "direct": Direct mode is how applications originally opted into the mesh. Proxy listeners need to be dialed directly. - "transparent": Transparent mode enables configuring Envoy as a transparent proxy. Traffic must be captured and redirected to the inbound and outbound listeners. This PR also adds a struct for transparent proxy specific configuration. Initially this is not stored as a pointer. Will revisit that decision before GA.	4 years ago
freddygv	98ba582797	Fixup mesh gateway docs	4 years ago
Tara Tufano	9deb52e868	add http2 ping health checks (#8431) ... * add http2 ping checks * fix test issue * add h2ping check to config resources * add new test and docs for h2ping * fix grammatical inconsistency in H2PING documentation * resolve rebase conflicts, add test for h2ping tls verification failure * api documentation for h2ping * update test config data with H2PING * add H2PING to protocol buffers and update changelog * fix typo in changelog entry	4 years ago
freddygv	b21224a4c8	PR comments	4 years ago
freddygv	ab752c1c86	Avoid sending zero-value upstream defaults from api	4 years ago
freddygv	986bcccbea	Pass down upstream defaults to client proxies ... This is needed in case the client proxy is in TransparentProxy mode. Typically they won't have explicit configuration for every upstream, so this ensures the settings can be applied to all of them when generating xDS config.	4 years ago
freddygv	77ead5cca9	Prevent wildcard destinations for proxies and upstreams	4 years ago
freddygv	458eb41be1	Prevent synthetic upstreams without addresses from failing duplicate ip/port validation	4 years ago
R.B. Boyer	d4c401b350	missed build tag on this file (#9974)	4 years ago
R.B. Boyer	499fee73b3	connect: add toggle to globally disable wildcard outbound network access when transparent proxy is enabled (#9973) ... This adds a new config entry kind "cluster" with a single special name "cluster" where this can be controlled.	4 years ago
Daniel Nephin	d879fe581d	state: Move UpstreamDownstream to state package	4 years ago
Daniel Nephin	65f5b99247	state: add tests for mesh-topology table indexers	4 years ago
Freddy	1c13aa23f1	Merge pull request #9900 from hashicorp/ent-fixes ... Fixup enterprise tests from tproxy changes	4 years ago
Freddy	0bab999fe4	Merge pull request #9899 from hashicorp/wildcard-ixn-oss ... Add methods to check intention has wildcard src or dst	4 years ago
freddygv	098b9af901	Fixup enterprise tests from tproxy changes	4 years ago
freddygv	9713e3ba38	Add methods to check intention has wildcard src or dst	4 years ago
freddygv	52bf00de8b	Split up normalizing from defaulting values for upstream cfg	4 years ago
freddygv	f4f45af6d0	Merge master and fix upstream config protocol defaulting	4 years ago
Freddy	8207b832df	Add TransparentProxy option to proxy definitions	4 years ago
Freddy	c664938bae	Add per-upstream configuration to service-defaults	4 years ago
freddygv	a54d6a9010	Update proxycfg for transparent proxy	4 years ago
Daniel Nephin	9f03e23e44	Merge pull request #9881 from hashicorp/dnephin/state-index-service-check-nodes ... state: convert services.node and checks.node indexes	4 years ago
Daniel Nephin	bd6332ae25	Merge pull request #9863 from hashicorp/dnephin/config-entry-kind-name ... state: move ConfigEntryKindName	4 years ago
Christopher Broglie	f0307c73e5	Add support for configuring TLS ServerName for health checks ... Some TLS servers require SNI, but the Golang HTTP client doesn't include it in the ClientHello when connecting to an IP address. This change adds a new TLSServerName field to health check definitions to optionally set it. This fixes #9473.	4 years ago
Daniel Nephin	34eb6c01ff	state: convert services.node and checks.node indexes ... Using NodeIdentity to share the indexes with both.	4 years ago
freddygv	4bdbcff9c0	Fixup upstream test	4 years ago
freddygv	6090cfcf68	PR comments	4 years ago
freddygv	7df846aa24	Pass MeshGateway config in service config request ... ResolveServiceConfig is called by service manager before the proxy registration is in the catalog. Therefore we should pass proxy registration flags in the request rather than trying to fetch them from the state store (where they may not exist yet).	4 years ago
freddygv	8b46d8dcbb	Restore old Envoy prefix on escape hatches ... This is done because after removing ID and NodeName from ServiceConfigRequest we will no longer know whether a request coming in is for a Consul client earlier than v1.10.	4 years ago
freddygv	93c3c1780d	Only lowercase the protocol when normalizing	4 years ago
freddygv	41b2ba1e58	Add omitempty across the board for UpstreamConfig	4 years ago
freddygv	756ab4c546	Fixup protobufs and tests	4 years ago
freddygv	df1f3995f8	Update service manager to store centrally configured upstreams	4 years ago
freddygv	6fd30d0384	Add TransparentProxy opt to proxy definition	4 years ago
freddygv	306ef7d252	Restore old escape hatch alias	4 years ago
freddygv	e3dc2a49df	Turn Limits and PassiveHealthChecks into pointers	4 years ago
freddygv	acec711a6a	Update server-side config resolution and client-side merging	4 years ago
freddygv	1710ec87d2	finish moving UpstreamConfig and related fields to structs pkg	4 years ago
Daniel Nephin	b06b3dd8f8	state: move ConfigEntryKindName ... Previously this type was defined in structs, but unlike the other types in structs this type is not used by RPC requests. By moving it to state we can better indicate that this is not an API type, but part of the state implementation.	4 years ago
Daniel Nephin	71b0f0a7a6	structs: remove EnterpriseMeta.GetNamespace ... I added this recently without realizing that the method already existed and was named NamespaceOrEmpty. Replace all calls to GetNamespace with NamespaceOrEmpty or NamespaceOrDefault as appropriate.	4 years ago
freddygv	87cde19b4c	Create new types for service-defaults upstream cfg	4 years ago
Daniel Nephin	5c8a6311b6	Merge pull request #9703 from pierresouchay/streaming_tags_and_case_insensitive ... Streaming filter tags + case insensitive lookups for Service Names	4 years ago
John Cowen	5892e75452	ui: Remove any trailing fullstop/period DNS characters from Gateways UI API (#9752) ... Previous to this commit, the API response would include Gateway Addresses in the form `domain.name.:8080`, which due to the addition of the port is probably not the expected response. This commit rightTrims any `.` characters from the end of the domain before formatting the address to include the port resulting in `domain.name:8080`	4 years ago
Mark Anderson	b9d22f48cd	Add fields to the /acl/auth-methods endpoint. (#9741) ... * A GET of the /acl/auth-method/:name endpoint returns the fields MaxTokenTTL and TokenLocality, while a LIST (/acl/auth-methods) does not. The list command returns a filtered subset of the full set. This is somewhat deliberate, so that secrets aren't shown, but the TTL and Locality fields aren't (IMO) security critical, and it is useful for the front end to be able to show them. For consistency these changes mirror the 'omit empty' and string representation choices made for the GET call. This includes changes to the gRPC and API code in the client. The new output looks similar to this curl 'http://localhost:8500/v1/acl/auth-methods' | jq '.' { "MaxTokenTTL": "8m20s", "Name": "minikube-ttl-local2", "Type": "kubernetes", "Description": "minikube auth method", "TokenLocality": "local", "CreateIndex": 530, "ModifyIndex": 530, "Namespace": "default" } ] Signed-off-by: Mark Anderson <manderson@hashicorp.com> * Add changelog Signed-off-by: Mark Anderson <manderson@hashicorp.com>	4 years ago
Daniel Nephin	d1772ae305	structs: rename EnterpriseMeta constructor ... To match the Go convention.	4 years ago
Pierre Souchay	6f91085869	Use lower case for serviceName computation of cache keys	4 years ago
R.B. Boyer	03790a1f91	server: add OSS stubs supporting validation of source namespaces in service-intentions config entries (#9527)	4 years ago